@apso/cli 0.45.2 → 0.46.1

package/dist/lib/templates/go/services/service.eta

@@ -7,6 +7,9 @@ import (
 	"errors"
 
 	"app/autogen/dto"
+<% if (it.scope) { %>
+	"app/autogen/middleware"
+<% } %>
 	"app/autogen/models"
 	"app/autogen/utils"
 	"gorm.io/gorm"
@@ -37,6 +40,42 @@ type <%= it.entityName %>Service struct {
 func New<%= it.entityName %>Service(db *gorm.DB) *<%= it.entityName %>Service {
 	return &<%= it.entityName %>Service{db: db}
 }
+<% if (it.scope) { %>
+
+// scoped limits q to the caller's tenant for op ("find", "get", "create",
+// "update", "delete") per .apsorc scopeBy, and returns the scope column values.
+// Both are unchanged when op is not enforced or the caller holds a bypass role.
+func (s *<%= it.entityName %>Service) scoped(ctx context.Context, q *gorm.DB, op string) (*gorm.DB, map[string]string, error) {
+	switch op {
+	case <%~ it.scope.enforceOn.map((o) => JSON.stringify(o)).join(', ') %>:
+	default:
+		return q, nil, nil
+	}
+	a, ok := middleware.FromContext(ctx)
+	if !ok {
+		return nil, nil, ErrForbidden
+	}
+<% if (it.scope.bypassRoles.length > 0) { %>
+	if hasAnyRole(a.Roles, <%~ it.scope.bypassRoles.map((r) => JSON.stringify(r)).join(', ') %>) {
+		return q, nil, nil
+	}
+<% } %>
+	values := map[string]string{
+<% it.scope.fields.forEach((f) => { %>
+		<%~ JSON.stringify(f.column) %>: a.<%= f.source === 'userId' ? 'UserID' : f.source === 'email' ? 'Email' : 'WorkspaceID' %>,
+<% }) %>
+	}
+	table := models.<%= it.entityName %>{}.TableName()
+	for col, v := range values {
+		if v == "" {
+			return nil, nil, ErrForbidden
+		}
+		// Compared as text: token claims are strings, the column may be a number or uuid.
+		q = q.Where("CAST("+table+"."+col+" AS TEXT) = ?", v)
+	}
+	return q, values, nil
+}
+<% } %>
 
 // FindAll retrieves a paginated list of <%= it.pluralName %> with filtering, sorting, and joins.
 // Used by the nestjsx dialect ({data,count,total,page,pageCount} envelope).
@@ -47,6 +86,12 @@ func (s *<%= it.entityName %>Service) FindAll(ctx context.Context, opts utils.Qu
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "find")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 	query, total, pageCount, err := utils.ApplyQueryE(query, opts, AllowedFields<%= it.entityName %>)
 	if err != nil {
@@ -82,6 +127,12 @@ func (s *<%= it.entityName %>Service) FindAllBare(ctx context.Context, opts util
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "find")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 	query, _, _, err := utils.ApplyQueryE(query, opts, AllowedFields<%= it.entityName %>)
 	if err != nil {
@@ -107,6 +158,12 @@ func (s *<%= it.entityName %>Service) FindOne(ctx context.Context, id string) (*
 <% it.associations.filter(a => a.eager).forEach((assoc) => { %>
 	query = query.Preload("<%= assoc.referenceName || assoc.name %>")
 <% }) %>
+<% if (it.scope) { %>
+	query, _, scopeErr := s.scoped(ctx, query, "get")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 
 <% if (it.primaryKeyType === 'uuid') { %>
 	if err := query.Where("id = ?", id).First(&item).Error; err != nil {
@@ -137,6 +194,21 @@ func (s *<%= it.entityName %>Service) Create(ctx context.Context, input *dto.<%=
 		<%= assoc.referenceName || assoc.name %>ID: input.<%= assoc.referenceName || assoc.name %>ID,
 <% }) %>
 	}
+<% if (it.scope && it.scope.injectOnCreate) { %>
+
+	// The caller's tenant, never one from the body (.apsorc scopeBy).
+	_, scopeVals, scopeErr := s.scoped(ctx, s.db, "create")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% it.scope.fields.forEach((f) => { %>
+	if v, ok := scopeVals[<%~ JSON.stringify(f.column) %>]; ok {
+		if err := setFromString(&item, <%~ JSON.stringify(f.goField) %>, v); err != nil {
+			return nil, err
+		}
+	}
+<% }) %>
+<% } %>
 
 	if err := s.db.WithContext(ctx).Create(&item).Error; err != nil {
 		return nil, err
@@ -150,10 +222,17 @@ func (s *<%= it.entityName %>Service) Create(ctx context.Context, input *dto.<%=
 func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, input *dto.<%= it.entityName %>Update) (*dto.<%= it.entityName %>Response, error) {
 	var item models.<%= it.entityName %>
 
+	findQuery := s.db.WithContext(ctx)
+<% if (it.scope) { %>
+	findQuery, scopeVals, scopeErr := s.scoped(ctx, findQuery, "update")
+	if scopeErr != nil {
+		return nil, scopeErr
+	}
+<% } %>
 <% if (it.primaryKeyType === 'uuid') { %>
-	if err := s.db.WithContext(ctx).Where("id = ?", id).First(&item).Error; err != nil {
+	if err := findQuery.Where("id = ?", id).First(&item).Error; err != nil {
 <% } else { %>
-	if err := s.db.WithContext(ctx).First(&item, id).Error; err != nil {
+	if err := findQuery.First(&item, id).Error; err != nil {
 <% } %>
 		if errors.Is(err, gorm.ErrRecordNotFound) {
 			return nil, errors.New("<%= it.entityName %> not found")
@@ -172,6 +251,12 @@ func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, inp
 		updates["<%= assoc.snakeReferenceName || assoc.snakeName %>_id"] = *input.<%= assoc.referenceName || assoc.name %>ID
 	}
 <% }) %>
+<% if (it.scope) { %>
+	// A scoped row cannot move to another tenant.
+	for col := range scopeVals {
+		delete(updates, col)
+	}
+<% } %>
 
 	if len(updates) > 0 {
 		if err := s.db.WithContext(ctx).Model(&item).Updates(updates).Error; err != nil {
@@ -198,10 +283,17 @@ func (s *<%= it.entityName %>Service) Update(ctx context.Context, id string, inp
 
 // Delete removes a <%= it.entityName %> by ID
 func (s *<%= it.entityName %>Service) Delete(ctx context.Context, id string) error {
+	deleteQuery := s.db.WithContext(ctx)
+<% if (it.scope) { %>
+	deleteQuery, _, scopeErr := s.scoped(ctx, deleteQuery, "delete")
+	if scopeErr != nil {
+		return scopeErr
+	}
+<% } %>
 <% if (it.primaryKeyType === 'uuid') { %>
-	result := s.db.WithContext(ctx).Where("id = ?", id).Delete(&models.<%= it.entityName %>{})
+	result := deleteQuery.Where("id = ?", id).Delete(&models.<%= it.entityName %>{})
 <% } else { %>
-	result := s.db.WithContext(ctx).Delete(&models.<%= it.entityName %>{}, id)
+	result := deleteQuery.Delete(&models.<%= it.entityName %>{}, id)
 <% } %>
 	if result.Error != nil {
 		return result.Error

package/dist/lib/templates/guards/scope.guard.eta

@@ -8,7 +8,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
+import { <% if (it.hasNestedFk) { %>DataSource, <% } %>Repository } from 'typeorm';
 
 <% /* Import all entities that have scoped relationships (from sibling autogen folders) */ %>
 <% it.scopedEntities.forEach((entity) => { %>
@@ -73,6 +73,12 @@ export interface ScopeField {
   direct: boolean;
   /** For nested paths, the full path (e.g., 'task.workspaceId') */
   path?: string;
+  /** Nested paths: the foreign key to the first hop (e.g., 'taskId') */
+  fkField?: string;
+  /** Nested paths: the entity the foreign key points to (e.g., 'Task') */
+  parentEntity?: string;
+  /** Nested paths: the rest of the path on that entity (e.g., 'workspaceId') */
+  parentPath?: string;
 }
 
 /**
@@ -90,6 +96,11 @@ export const ENTITY_SCOPES: Record<string, ScopeConfig> = {
         direct: <%= scope.direct %>,
 <% if (scope.path) { %>
         path: '<%= scope.path %>',
+<% } %>
+<% if (scope.fkField) { %>
+        fkField: '<%= scope.fkField %>',
+        parentEntity: '<%= scope.parentEntity %>',
+        parentPath: '<%= scope.parentPath %>',
 <% } %>
       }<%= scopeIndex < entity.scopes.length - 1 ? ',' : '' %>
 <% }) %>
@@ -109,6 +120,9 @@ export class ScopeGuard implements CanActivate {
     @InjectRepository(<%= entity.name %>)
     private <%= entity.repoName %>: Repository<<%= entity.name %>>,
 <% }) %>
+<% if (it.hasNestedFk) { %>
+    private dataSource: DataSource,
+<% } %>
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -166,6 +180,12 @@ export class ScopeGuard implements CanActivate {
     if (!scopeConfig.enforceOn.includes(operation)) {
       return true;
     }
+<% if (it.hasNestedFk) { %>
+
+    // Nested paths (task.workspaceId): load the caller's parent ids for the
+    // controller's list filter, and refuse a parent from another tenant.
+    await this.loadNestedScopes(request, scopeConfig, operation);
+<% } %>
 
     // For GET requests with an ID, verify the resource belongs to this scope
     if ((operation === 'get' || operation === 'update' || operation === 'delete') && request.params?.id) {
@@ -184,6 +204,13 @@ export class ScopeGuard implements CanActivate {
     if (operation === 'create' && scopeConfig.injectOnCreate) {
       this.injectScopeValues(request, scopeConfig);
     }
+<% if (it.hasAuth) { %>
+
+    // A scoped row cannot move to another tenant on update.
+    if (operation === 'update') {
+      this.injectScopeValues(request, scopeConfig);
+    }
+<% } %>
 
     // For GET (list) requests, add scope filter
     if (operation === 'find') {
@@ -331,6 +358,50 @@ export class ScopeGuard implements CanActivate {
     );
   }
 
+<% if (it.hasNestedFk) { %>
+  /**
+   * For each nested scope, find the ids of the parent rows in the caller's
+   * tenant and put them on request.apsoScope, where the controller's
+   * @CrudAuth filter reads them. A create or update that names a parent
+   * outside that set is refused.
+   */
+  private async loadNestedScopes(
+    request: any,
+    scopeConfig: ScopeConfig,
+    operation: string,
+  ): Promise<void> {
+    for (const scope of scopeConfig.scopes) {
+      if (!scope.fkField || !scope.parentEntity || !scope.parentPath) continue;
+      const scopeValue = this.getScopeValue(request, scope.contextKey);
+      if (!scopeValue) {
+        throw new ForbiddenException('No tenant in the auth context');
+      }
+      // ponytail: loads every parent id in the tenant per request; switch to a
+      // subquery filter if a tenant grows past tens of thousands of parents.
+      const repo = this.dataSource.getRepository(scope.parentEntity);
+      const pk = repo.metadata.primaryColumns[0].propertyName;
+      const where = scope.parentPath
+        .split('.')
+        .reverse()
+        .reduce<any>((inner, key) => ({ [key]: inner }), scopeValue);
+      const parents = await repo.find({ select: { [pk]: true } as any, where });
+      const ids = parents.map((p: any) => p[pk]);
+      request.apsoScope = { ...request.apsoScope, [scope.fkField]: ids };
+
+      if (operation === 'create' || operation === 'update') {
+        const body = request.body && typeof request.body === 'object' ? request.body : {};
+        const items = Array.isArray(body.bulk) ? body.bulk : [body];
+        for (const item of items) {
+          const fk = item?.[scope.fkField] ?? item?.[scope.field]?.[pk];
+          if (fk != null && !ids.some((id: any) => String(id) === String(fk))) {
+            throw new ForbiddenException('You do not have access to this resource');
+          }
+        }
+      }
+    }
+  }
+
+<% } %>
   private getNestedValue(obj: any, path: string): any {
     return path.split('.').reduce((current, key) => current?.[key], obj);
   }

package/dist/lib/templates/python/routers/router.eta

@@ -55,7 +55,7 @@ async def get_many(
     - order=col.asc|desc[.nullsfirst|nullslast]
     - limit=..&offset=.. (windows the bare array)
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     try:
         options = parse_query_params(request.query_params, x_crud_dialect)
     except QueryParseError as exc:
@@ -113,7 +113,7 @@ async def get_one(
     Supports query parameters:
     - join=relation (repeatable)
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
 
     options = parse_query_params(request.query_params)
     joins = [j.relation for j in options.joins] if options.joins else None
@@ -134,13 +134,14 @@ async def get_one(
     summary="Create a single <%= it.entityName %>",
 )
 async def create_one(
+    request: Request,
     data: <%= it.entityName %>Create,
     db: AsyncSession = Depends(get_db),
 ) -> <%= it.entityName %>Schema:
     """
     Create a new <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     return await service.create_one(data)
 
 
@@ -151,13 +152,14 @@ async def create_one(
     summary="Create multiple <%= it.pluralEntityName %>",
 )
 async def create_many(
+    request: Request,
     data: List[<%= it.entityName %>Create],
     db: AsyncSession = Depends(get_db),
 ) -> List[<%= it.entityName %>Schema]:
     """
     Create multiple <%= it.pluralEntityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     return await service.create_many(data)
 
 
@@ -167,6 +169,7 @@ async def create_many(
     summary="Update a single <%= it.entityName %>",
 )
 async def update_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     data: <%= it.entityName %>Update,
     db: AsyncSession = Depends(get_db),
@@ -174,7 +177,7 @@ async def update_one(
     """
     Update an existing <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     item = await service.update_one(id, data)
     if not item:
         raise HTTPException(
@@ -190,6 +193,7 @@ async def update_one(
     summary="Replace a single <%= it.entityName %>",
 )
 async def replace_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     data: <%= it.entityName %>Create,
     db: AsyncSession = Depends(get_db),
@@ -197,7 +201,7 @@ async def replace_one(
     """
     Replace an existing <%= it.entityName %>.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     item = await service.replace_one(id, data)
     if not item:
         raise HTTPException(
@@ -213,13 +217,14 @@ async def replace_one(
     summary="Delete a single <%= it.entityName %>",
 )
 async def delete_one(
+    request: Request,
     id: <% if (it.primaryKeyType === 'uuid') { %>str<% } else { %>int<% } %>,
     db: AsyncSession = Depends(get_db),
 ) -> None:
     """
     Delete a <%= it.entityName %> by ID.
     """
-    service = <%= it.entityName %>Service(db)
+    service = <%= it.entityName %>Service(db, getattr(request.state, "auth", None))
     deleted = await service.delete_one(id)
     if not deleted:
         raise HTTPException(

package/dist/lib/templates/python/services/service.eta

@@ -3,6 +3,10 @@
 from typing import List, Optional, Any
 
 from sqlalchemy.ext.asyncio import AsyncSession
+<% if (it.scope) { %>
+from fastapi import HTTPException, status
+from sqlalchemy import String, cast
+<% } %>
 
 from ..models.<%= it.entityName.toLowerCase() %> import <%= it.entityName %>
 from ..schemas.<%= it.entityName.toLowerCase() %> import <%= it.entityName %>Create, <%= it.entityName %>Update
@@ -14,38 +18,94 @@ class <%= it.entityName %>Service:
     Service layer for <%= it.entityName %> CRUD operations.
     """
 
-    def __init__(self, db: AsyncSession):
+    def __init__(self, db: AsyncSession, auth: Any = None):
         self.db = db
-        self._qb = QueryBuilder(<%= it.entityName %>, db)
+        # The caller (app.autogen.auth.AuthContext), when auth is configured.
+        self.auth = auth
+<% if (it.scope) { %>
+
+    def _scope_values(self, op: str) -> dict:
+        """
+        The caller's value for each scopeBy field for op ("find", "get",
+        "create", "update", "delete"); empty when op is not enforced or the
+        caller holds a bypass role. 403 when the caller has no tenant.
+        """
+        if op not in <%~ JSON.stringify(it.scope.enforceOn) %>:
+            return {}
+        a = self.auth
+        if a is None:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tenant in the auth context")
+<% if (it.scope.bypassRoles.length > 0) { %>
+        if set(a.roles) & set(<%~ JSON.stringify(it.scope.bypassRoles) %>):
+            return {}
+<% } %>
+        values = {
+<% it.scope.fields.forEach((f) => { %>
+            <%~ JSON.stringify(f.field) %>: a.<%= f.source === 'userId' ? 'user_id' : f.source === 'email' ? 'email' : 'workspace_id' %>,
+<% }) %>
+        }
+        if any(v in (None, "") for v in values.values()):
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="No tenant in the auth context")
+        return values
+
+    def _qb(self, op: str) -> QueryBuilder:
+        """A query builder limited to the caller's tenant (compared as text)."""
+        scope = [
+            cast(getattr(<%= it.entityName %>, field), String) == str(value)
+            for field, value in self._scope_values(op).items()
+        ]
+        return QueryBuilder(<%= it.entityName %>, self.db, scope=scope)
+
+    def _with_tenant(self, payload: dict) -> dict:
+        """Set every scopeBy field to the caller's value, converted to the column's type."""
+<% if (it.scope.injectOnCreate) { %>
+        for field, value in self._scope_values("create").items():
+            try:
+                value = getattr(<%= it.entityName %>, field).type.python_type(value)
+            except (NotImplementedError, TypeError, ValueError):
+                pass
+            payload[field] = value
+<% } %>
+        return payload
+<% } else { %>
+
+    def _qb(self, op: str) -> QueryBuilder:
+        return QueryBuilder(<%= it.entityName %>, self.db)
+<% } %>
 
     async def get_many(self, options: QueryOptions) -> PaginatedResult:
         """
         Retrieve a paginated list of <%= it.pluralEntityName %> with filtering, sorting, and joins.
         (nestjsx dialect — {data,count,total,page,pageCount} envelope.)
         """
-        return await self._qb.get_many(options)
+        return await self._qb("find").get_many(options)
 
     async def get_many_list(self, options: QueryOptions) -> List[Any]:
         """
         Retrieve <%= it.pluralEntityName %> as a bare list (PostgREST dialect).
         """
-        return await self._qb.get_many_list(options)
+        return await self._qb("find").get_many_list(options)
 
     async def get_one(
         self,
         id: Any,
         joins: Optional[List[str]] = None,
+        op: str = "get",
     ) -> Optional[<%= it.entityName %>]:
         """
         Retrieve a single <%= it.entityName %> by ID.
         """
-        return await self._qb.get_one(id, joins=joins)
+        return await self._qb(op).get_one(id, joins=joins)
 
     async def create_one(self, data: <%= it.entityName %>Create) -> <%= it.entityName %>:
         """
         Create a new <%= it.entityName %>.
         """
+<% if (it.scope) { %>
+        item = <%= it.entityName %>(**self._with_tenant(data.model_dump(exclude_unset=True)))
+<% } else { %>
         item = <%= it.entityName %>(**data.model_dump(exclude_unset=True))
+<% } %>
         self.db.add(item)
         await self.db.commit()
         await self.db.refresh(item)
@@ -55,7 +115,11 @@ class <%= it.entityName %>Service:
         """
         Create multiple <%= it.pluralEntityName %>.
         """
+<% if (it.scope) { %>
+        items = [<%= it.entityName %>(**self._with_tenant(item.model_dump(exclude_unset=True))) for item in data]
+<% } else { %>
         items = [<%= it.entityName %>(**item.model_dump(exclude_unset=True)) for item in data]
+<% } %>
         self.db.add_all(items)
         await self.db.commit()
         for item in items:
@@ -70,11 +134,16 @@ class <%= it.entityName %>Service:
         """
         Update an existing <%= it.entityName %>.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="update")
         if not item:
             return None
 
         update_data = data.model_dump(exclude_unset=True)
+<% if (it.scope) { %>
+        # A scoped row cannot move to another tenant.
+        for field in self._scope_values("update"):
+            update_data.pop(field, None)
+<% } %>
         for field, value in update_data.items():
             setattr(item, field, value)
 
@@ -90,11 +159,15 @@ class <%= it.entityName %>Service:
         """
         Replace an existing <%= it.entityName %>.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="update")
         if not item:
             return None
 
         replace_data = data.model_dump()
+<% if (it.scope) { %>
+        for field in self._scope_values("update"):
+            replace_data.pop(field, None)
+<% } %>
         for field, value in replace_data.items():
             setattr(item, field, value)
 
@@ -106,7 +179,7 @@ class <%= it.entityName %>Service:
         """
         Delete a <%= it.entityName %> by ID.
         """
-        item = await self.get_one(id)
+        item = await self.get_one(id, op="delete")
         if not item:
             return False
 

package/dist/lib/templates/python/utils/query.eta

@@ -701,9 +701,11 @@ def parse_query_params(params: Any, dialect_header: Optional[str] = None) -> Que
 class QueryBuilder:
     """Build and execute filtered/sorted/paginated SQLAlchemy queries."""
 
-    def __init__(self, model: Type[T], db: AsyncSession):
+    def __init__(self, model: Type[T], db: AsyncSession, scope: Optional[List[Any]] = None):
         self.model = model
         self.db = db
+        # Conditions every query must meet (the caller's tenant, .apsorc scopeBy).
+        self.scope = list(scope or [])
 
     # -- shared predicate builders ----------------------------------------
 
@@ -735,7 +737,7 @@ class QueryBuilder:
         return or_(*exprs) if group.operator == "$or" else and_(*exprs)
 
     def _where_clauses(self, options: QueryOptions) -> List[Any]:
-        clauses: List[Any] = []
+        clauses: List[Any] = list(self.scope)
         for f in options.filters:
             expr = self._filter_expr(f)
             if expr is not None:
@@ -889,7 +891,7 @@ class QueryBuilder:
         id: Any,
         joins: Optional[List[str]] = None,
     ) -> Optional[Any]:
-        query = select(self.model).where(self.model.id == id)
+        query = select(self.model).where(self.model.id == id, *self.scope)
 
         if joins:
             for join_name in joins:

package/dist/lib/templates/rest/controller-rest.eta

@@ -1,11 +1,20 @@
 <%~ includeFile('./header.eta') %>
 
 import { Controller, Body } from "@nestjs/common";
-import { Crud, <% if (it.crudAuth.length) { %>CrudAuth, <% } %>CrudController, Override, ParsedRequest, CrudRequest, ParsedBody, CreateManyDto } from '@apso/crud';
+import { Crud, <% if (it.crudAuth.length || it.crudAuthNested.length) { %>CrudAuth, <% } %>CrudController, Override, ParsedRequest, CrudRequest, ParsedBody, CreateManyDto } from '@apso/crud';
 import { ApiTags, ApiResponse, ApiOperation, ApiBody } from '@nestjs/swagger';
 import {<%= it.entityName %>, <%= it.entityName %>Create, <%= it.entityName %>Update} from './dtos/<%= it.entityName%>.dto'
 import {<%= it.svcName %>} from './<%= it.entityName %>.service';
   
+<% if (it.crudAuthNested.length) { %>
+// A nested scopeBy path (task.workspaceId) limits rows to the parents ScopeGuard
+// found in the caller's tenant (req.apsoScope). An empty list matches no rows.
+const nestedScope = (req: any, fk: string) => {
+    const ids = req.apsoScope?.[fk];
+    if (!ids) return {};
+    return { [fk]: ids.length ? { $in: ids } : { $isnull: true, $notnull: true } };
+};
+<% } %>
 @Crud({
     model: {
         type: <%= it.entityName %>
@@ -51,12 +60,15 @@ import {<%= it.svcName %>} from './<%= it.entityName %>.service';
         <% } %>
      }
 })
-<% if (it.crudAuth.length) { %>
+<% if (it.crudAuth.length || it.crudAuthNested.length) { %>
 // Every query and write is limited to the caller's tenant (.apsorc scopeBy).
 @CrudAuth({
     filter: (req: any) => ({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
+<% }) %>
+<% it.crudAuthNested.forEach((s) => { %>
+        ...nestedScope(req, '<%= s.fkField %>'),
 <% }) %>
     }),
     persist: (req: any) => ({

package/dist/lib/types/generator.d.ts

@@ -167,6 +167,11 @@ export interface ServiceGenerationOptions extends EntityGenerationOptions {
      * Relationship map for service methods
      */
     relationshipMap: RelationshipMap;
+    /**
+     * The .apsorc auth config; with scopeBy, Go and Python services filter
+     * every query to the caller's tenant
+     */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating DTOs/schemas
@@ -257,7 +262,7 @@ export interface LanguageGenerator {
     /**
      * Generate guard files (auth, scope, etc.)
      */
-    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Generate shared query utility files (filter, sort, pagination)
      */

package/dist/lib/utils/relationships/parse.d.ts

@@ -48,6 +48,7 @@ export declare const parseRelationship: (relationship: ApsorcRelationship, allRe
  * @returns A comprehensive RelationshipMap mapping entity names to their Relationship objects.
  */
 export declare const parseRelationships: (relationships: ApsorcRelationship[]) => RelationshipMap;
+export declare const getRelationshipName: (relationship: Relationship) => string;
 export declare const getRelationshipIdField: (relationship: Relationship) => string;
 /**
  * Transforms the parsed Relationship data into the final format needed by the entity/controller templates.

package/dist/lib/utils/relationships/parse.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getRelationshipsForImport = exports.streamNestedRelationships = exports.getNestedRelationships = exports.generateNestedRelationships = exports.getRelationshipForTemplate = exports.getRelationshipIdField = exports.parseRelationships = exports.parseRelationship = exports.parseManyToMany = exports.parseManytoOne = exports.parseOneToMany = void 0;
+exports.getRelationshipsForImport = exports.streamNestedRelationships = exports.getNestedRelationships = exports.generateNestedRelationships = exports.getRelationshipForTemplate = exports.getRelationshipIdField = exports.getRelationshipName = exports.parseRelationships = exports.parseRelationship = exports.parseManyToMany = exports.parseManytoOne = exports.parseOneToMany = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 const casing_1 = require("../casing");
@@ -413,8 +413,9 @@ const getRelationshipName = (relationship) => {
     }
     return (0, casing_1.camelCase)(relationship.name);
 };
+exports.getRelationshipName = getRelationshipName;
 const getRelationshipIdField = (relationship) => {
-    return `${getRelationshipName(relationship)}Id`;
+    return `${(0, exports.getRelationshipName)(relationship)}Id`;
 };
 exports.getRelationshipIdField = getRelationshipIdField;
 /**
@@ -572,7 +573,7 @@ function* generateNestedRelationships(entityName, relationshipMap, maxDepth = 4,
     if (!relationships)
         return;
     for (const relationship of relationships) {
-        const referenceName = getRelationshipName(relationship);
+        const referenceName = (0, exports.getRelationshipName)(relationship);
         const type = relationship.type;
         // Format the property name based on relationship type
         // OneToMany and ManyToMany relationships use plural forms