@apso/cli 0.46.0 → 0.46.1

package/dist/commands/generate.js

@@ -193,7 +193,7 @@ class Generate extends base_command_1.default {
             console.log(`[apso] Finished building entity '${entity.name}' in ${entityBuildTime.toFixed(2)} ms`);
         }
         // Generate guards
-        const guardFiles = await generator.generateGuards(entities, auth);
+        const guardFiles = await generator.generateGuards(entities, auth, relationshipMap);
         for (const file of guardFiles) {
             // eslint-disable-next-line no-await-in-loop
             await writeGenerated(file.path, file.content);

package/dist/commands/mcp/serve.js

@@ -402,7 +402,7 @@ class McpServe extends base_command_1.default {
                     }
                 }
                 // Generate guards
-                const guardFiles = await generator.generateGuards(entities, auth);
+                const guardFiles = await generator.generateGuards(entities, auth, relationshipMap);
                 for (const file of guardFiles) {
                     const fullPath = path.join(autogenPath, file.path);
                     // eslint-disable-next-line no-await-in-loop

package/dist/lib/generators/base.d.ts

@@ -1,5 +1,5 @@
 import * as Eta from "eta";
-import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, Entity, AuthConfig } from "../types";
+import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, LanguageGenerator, Entity, AuthConfig, RelationshipMap } from "../types";
 /**
  * Abstract base class for language-specific generators.
  * Provides common functionality and enforces the LanguageGenerator interface.
@@ -60,7 +60,7 @@ export declare abstract class BaseGenerator implements LanguageGenerator {
     /**
      * Generate guard files (auth, scope, etc.)
      */
-    abstract generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    abstract generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Generate shared query utility files (filter, sort, pagination).
      * Default no-op. Override in language generators that need query utils.

package/dist/lib/generators/typescript.d.ts

@@ -1,5 +1,5 @@
 import { BaseGenerator } from "./base";
-import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, Entity, AuthConfig } from "../types";
+import { TargetLanguage, GeneratedFile, ValidationResult, GeneratorConfig, EntityGenerationOptions, ControllerGenerationOptions, ServiceGenerationOptions, DtoGenerationOptions, MigrationGenerationOptions, Entity, AuthConfig, RelationshipMap } from "../types";
 /**
  * TypeScript/NestJS generator that wraps the existing generation functions.
  * This generator produces TypeORM entities, NestJS controllers, services, and DTOs.
@@ -20,7 +20,7 @@ export declare class TypeScriptGenerator extends BaseGenerator {
         emitEvents?: boolean;
         auth?: AuthConfig;
     }): Promise<GeneratedFile[]>;
-    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Emits a schema-derived manifest of the entities that have opted in to
      * domain-event emission (`.apsorc` `emitEvents`).

package/dist/lib/generators/typescript.js

@@ -128,6 +128,9 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         const ctrlName = `${entityName}Controller`;
         const pluralEntityName = (0, pluralize_1.default)(entityName);
         const primaryKeyType = entity.primaryKeyType || "serial";
+        const scopes = auth
+            ? (_b = (_a = (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []
+            : [];
         const data = {
             svcName,
             ctrlName,
@@ -136,12 +139,12 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             primaryKeyType,
             associations: [...new Set(relationshipsForTemplate)],
             nestedJoinsFile,
-            // Direct scopeBy fields @CrudAuth adds to every query once a caller is
-            // authenticated. Nested scopes (task.workspaceId) are checked per row by
-            // ScopeGuard only.
-            crudAuth: auth
-                ? ((_b = (_a = (0, guards_1.getScopedEntities)([entity])[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []).filter((s) => s.direct)
-                : [],
+            // scopeBy fields @CrudAuth adds to every query once a caller is
+            // authenticated. Direct fields match the caller's tenant; nested paths
+            // (task.workspaceId) match the foreign key (taskId) against the parent
+            // ids ScopeGuard loaded for the caller into req.apsoScope.
+            crudAuth: scopes.filter((s) => s.direct),
+            crudAuthNested: scopes.filter((s) => s.fkField),
         };
         const controllerContent = await this.renderTemplate("./rest/controller-rest", data);
         const specContent = await this.renderTemplate("./rest/controller-rest-spec", data);
@@ -328,7 +331,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             },
         ];
     }
-    async generateGuards(entities, auth) {
+    async generateGuards(entities, auth, relationshipMap) {
         const hasScopes = (0, guards_1.hasScopedEntities)(entities);
         const normalizedAuth = this.normalizeAuthConfig(auth);
         const jwt = auth && (0, auth_1.isJwtAuth)(auth) ? (0, auth_1.resolveJwtAuth)(auth) : undefined;
@@ -339,7 +342,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         if (!hasScopes && !hasAuth) {
             return [];
         }
-        const scopedEntities = (0, guards_1.getScopedEntities)(entities);
+        const scopedEntities = (0, guards_1.getScopedEntities)(entities, relationshipMap);
         const files = [];
         const authEntities = normalizedAuth
             ? [
@@ -354,6 +357,8 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
                 : [];
         const templateData = {
             scopedEntities,
+            // Nested paths are only enforced on list and create with a caller's tenant.
+            hasNestedFk: hasAuth && scopedEntities.some((e) => e.scopes.some((s) => s.fkField)),
             authConfig: normalizedAuth,
             hasAuth,
             authProvider: auth === null || auth === void 0 ? void 0 : auth.provider,

package/dist/lib/guards.d.ts

@@ -1,4 +1,4 @@
-import { Entity, ResolvedApiKeyAuth } from "./types";
+import { Entity, RelationshipMap, ResolvedApiKeyAuth } from "./types";
 /**
  * Represents a scope field configuration for template rendering
  */
@@ -7,6 +7,14 @@ export interface ScopeFieldConfig {
     contextKey: string;
     direct: boolean;
     path?: string;
+    /**
+     * Nested paths only, set when the relationship map is given: the entity's
+     * foreign key to the first hop (taskId), the entity it points to (Task),
+     * and the rest of the path on that entity (workspaceId).
+     */
+    fkField?: string;
+    parentEntity?: string;
+    parentPath?: string;
 }
 /**
  * Represents a scoped entity configuration for template rendering
@@ -21,9 +29,10 @@ export interface ScopedEntityConfig {
     bypassRoles: string[];
 }
 /**
- * Extracts scoped entity configurations from all entities.
+ * Extracts scoped entity configurations from all entities. Pass the
+ * relationship map to resolve nested paths to their foreign keys.
  */
-export declare function getScopedEntities(entities: Entity[]): ScopedEntityConfig[];
+export declare function getScopedEntities(entities: Entity[], relationshipMap?: RelationshipMap): ScopedEntityConfig[];
 /**
  * Checks if any entities have scopeBy configured.
  */

package/dist/lib/guards.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.nestedScopeEntities = exports.entityScope = exports.apiKeyTemplateData = exports.hasScopedEntities = exports.getScopedEntities = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
+const parse_1 = require("./utils/relationships/parse");
 /**
  * Default scope options when not specified
  */
@@ -36,18 +37,40 @@ function toRepoName(entityName) {
     return `${camelCase}Repository`;
 }
 /**
- * Extracts scoped entity configurations from all entities.
+ * A nested path's first segment must be a ManyToOne relationship of the
+ * entity: its foreign key is what list queries filter on.
  */
-function getScopedEntities(entities) {
+function resolveNestedScope(entityName, scope, relationshipMap) {
+    var _a;
+    if (scope.direct || !scope.path)
+        return scope;
+    const relation = ((_a = relationshipMap[entityName]) !== null && _a !== void 0 ? _a : []).find((r) => r.type === "ManyToOne" && (0, parse_1.getRelationshipName)(r) === scope.field);
+    if (!relation)
+        throw new Error(`${entityName}.scopeBy "${scope.path}": "${scope.field}" must be a many-to-one relationship of ${entityName}`);
+    return {
+        ...scope,
+        fkField: (0, parse_1.getRelationshipIdField)(relation),
+        parentEntity: relation.name,
+        parentPath: scope.path.split(".").slice(1).join("."),
+    };
+}
+/**
+ * Extracts scoped entity configurations from all entities. Pass the
+ * relationship map to resolve nested paths to their foreign keys.
+ */
+function getScopedEntities(entities, relationshipMap) {
     return entities
         .filter((entity) => entity.scopeBy)
         .map((entity) => {
         const options = { ...DEFAULT_SCOPE_OPTIONS, ...entity.scopeOptions };
+        const scopes = parseScopeBy(entity.scopeBy);
         return {
             name: entity.name,
             routeName: toRouteName(entity.name),
             repoName: toRepoName(entity.name),
-            scopes: parseScopeBy(entity.scopeBy),
+            scopes: relationshipMap
+                ? scopes.map((s) => resolveNestedScope(entity.name, s, relationshipMap))
+                : scopes,
             injectOnCreate: options.injectOnCreate,
             enforceOn: options.enforceOn,
             bypassRoles: options.bypassRoles,

package/dist/lib/templates/guards/scope.guard.eta

@@ -8,7 +8,7 @@ import {
 } from '@nestjs/common';
 import { Reflector } from '@nestjs/core';
 import { InjectRepository } from '@nestjs/typeorm';
-import { Repository } from 'typeorm';
+import { <% if (it.hasNestedFk) { %>DataSource, <% } %>Repository } from 'typeorm';
 
 <% /* Import all entities that have scoped relationships (from sibling autogen folders) */ %>
 <% it.scopedEntities.forEach((entity) => { %>
@@ -73,6 +73,12 @@ export interface ScopeField {
   direct: boolean;
   /** For nested paths, the full path (e.g., 'task.workspaceId') */
   path?: string;
+  /** Nested paths: the foreign key to the first hop (e.g., 'taskId') */
+  fkField?: string;
+  /** Nested paths: the entity the foreign key points to (e.g., 'Task') */
+  parentEntity?: string;
+  /** Nested paths: the rest of the path on that entity (e.g., 'workspaceId') */
+  parentPath?: string;
 }
 
 /**
@@ -90,6 +96,11 @@ export const ENTITY_SCOPES: Record<string, ScopeConfig> = {
         direct: <%= scope.direct %>,
 <% if (scope.path) { %>
         path: '<%= scope.path %>',
+<% } %>
+<% if (scope.fkField) { %>
+        fkField: '<%= scope.fkField %>',
+        parentEntity: '<%= scope.parentEntity %>',
+        parentPath: '<%= scope.parentPath %>',
 <% } %>
       }<%= scopeIndex < entity.scopes.length - 1 ? ',' : '' %>
 <% }) %>
@@ -109,6 +120,9 @@ export class ScopeGuard implements CanActivate {
     @InjectRepository(<%= entity.name %>)
     private <%= entity.repoName %>: Repository<<%= entity.name %>>,
 <% }) %>
+<% if (it.hasNestedFk) { %>
+    private dataSource: DataSource,
+<% } %>
   ) {}
 
   async canActivate(context: ExecutionContext): Promise<boolean> {
@@ -166,6 +180,12 @@ export class ScopeGuard implements CanActivate {
     if (!scopeConfig.enforceOn.includes(operation)) {
       return true;
     }
+<% if (it.hasNestedFk) { %>
+
+    // Nested paths (task.workspaceId): load the caller's parent ids for the
+    // controller's list filter, and refuse a parent from another tenant.
+    await this.loadNestedScopes(request, scopeConfig, operation);
+<% } %>
 
     // For GET requests with an ID, verify the resource belongs to this scope
     if ((operation === 'get' || operation === 'update' || operation === 'delete') && request.params?.id) {
@@ -338,6 +358,50 @@ export class ScopeGuard implements CanActivate {
     );
   }
 
+<% if (it.hasNestedFk) { %>
+  /**
+   * For each nested scope, find the ids of the parent rows in the caller's
+   * tenant and put them on request.apsoScope, where the controller's
+   * @CrudAuth filter reads them. A create or update that names a parent
+   * outside that set is refused.
+   */
+  private async loadNestedScopes(
+    request: any,
+    scopeConfig: ScopeConfig,
+    operation: string,
+  ): Promise<void> {
+    for (const scope of scopeConfig.scopes) {
+      if (!scope.fkField || !scope.parentEntity || !scope.parentPath) continue;
+      const scopeValue = this.getScopeValue(request, scope.contextKey);
+      if (!scopeValue) {
+        throw new ForbiddenException('No tenant in the auth context');
+      }
+      // ponytail: loads every parent id in the tenant per request; switch to a
+      // subquery filter if a tenant grows past tens of thousands of parents.
+      const repo = this.dataSource.getRepository(scope.parentEntity);
+      const pk = repo.metadata.primaryColumns[0].propertyName;
+      const where = scope.parentPath
+        .split('.')
+        .reverse()
+        .reduce<any>((inner, key) => ({ [key]: inner }), scopeValue);
+      const parents = await repo.find({ select: { [pk]: true } as any, where });
+      const ids = parents.map((p: any) => p[pk]);
+      request.apsoScope = { ...request.apsoScope, [scope.fkField]: ids };
+
+      if (operation === 'create' || operation === 'update') {
+        const body = request.body && typeof request.body === 'object' ? request.body : {};
+        const items = Array.isArray(body.bulk) ? body.bulk : [body];
+        for (const item of items) {
+          const fk = item?.[scope.fkField] ?? item?.[scope.field]?.[pk];
+          if (fk != null && !ids.some((id: any) => String(id) === String(fk))) {
+            throw new ForbiddenException('You do not have access to this resource');
+          }
+        }
+      }
+    }
+  }
+
+<% } %>
   private getNestedValue(obj: any, path: string): any {
     return path.split('.').reduce((current, key) => current?.[key], obj);
   }

package/dist/lib/templates/rest/controller-rest.eta

@@ -1,11 +1,20 @@
 <%~ includeFile('./header.eta') %>
 
 import { Controller, Body } from "@nestjs/common";
-import { Crud, <% if (it.crudAuth.length) { %>CrudAuth, <% } %>CrudController, Override, ParsedRequest, CrudRequest, ParsedBody, CreateManyDto } from '@apso/crud';
+import { Crud, <% if (it.crudAuth.length || it.crudAuthNested.length) { %>CrudAuth, <% } %>CrudController, Override, ParsedRequest, CrudRequest, ParsedBody, CreateManyDto } from '@apso/crud';
 import { ApiTags, ApiResponse, ApiOperation, ApiBody } from '@nestjs/swagger';
 import {<%= it.entityName %>, <%= it.entityName %>Create, <%= it.entityName %>Update} from './dtos/<%= it.entityName%>.dto'
 import {<%= it.svcName %>} from './<%= it.entityName %>.service';
   
+<% if (it.crudAuthNested.length) { %>
+// A nested scopeBy path (task.workspaceId) limits rows to the parents ScopeGuard
+// found in the caller's tenant (req.apsoScope). An empty list matches no rows.
+const nestedScope = (req: any, fk: string) => {
+    const ids = req.apsoScope?.[fk];
+    if (!ids) return {};
+    return { [fk]: ids.length ? { $in: ids } : { $isnull: true, $notnull: true } };
+};
+<% } %>
 @Crud({
     model: {
         type: <%= it.entityName %>
@@ -51,12 +60,15 @@ import {<%= it.svcName %>} from './<%= it.entityName %>.service';
         <% } %>
      }
 })
-<% if (it.crudAuth.length) { %>
+<% if (it.crudAuth.length || it.crudAuthNested.length) { %>
 // Every query and write is limited to the caller's tenant (.apsorc scopeBy).
 @CrudAuth({
     filter: (req: any) => ({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
+<% }) %>
+<% it.crudAuthNested.forEach((s) => { %>
+        ...nestedScope(req, '<%= s.fkField %>'),
 <% }) %>
     }),
     persist: (req: any) => ({

package/dist/lib/types/generator.d.ts

@@ -262,7 +262,7 @@ export interface LanguageGenerator {
     /**
      * Generate guard files (auth, scope, etc.)
      */
-    generateGuards(entities: Entity[], auth?: AuthConfig): Promise<GeneratedFile[]>;
+    generateGuards(entities: Entity[], auth?: AuthConfig, relationshipMap?: RelationshipMap): Promise<GeneratedFile[]>;
     /**
      * Generate shared query utility files (filter, sort, pagination)
      */

package/dist/lib/utils/relationships/parse.d.ts

@@ -48,6 +48,7 @@ export declare const parseRelationship: (relationship: ApsorcRelationship, allRe
  * @returns A comprehensive RelationshipMap mapping entity names to their Relationship objects.
  */
 export declare const parseRelationships: (relationships: ApsorcRelationship[]) => RelationshipMap;
+export declare const getRelationshipName: (relationship: Relationship) => string;
 export declare const getRelationshipIdField: (relationship: Relationship) => string;
 /**
  * Transforms the parsed Relationship data into the final format needed by the entity/controller templates.

package/dist/lib/utils/relationships/parse.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getRelationshipsForImport = exports.streamNestedRelationships = exports.getNestedRelationships = exports.generateNestedRelationships = exports.getRelationshipForTemplate = exports.getRelationshipIdField = exports.parseRelationships = exports.parseRelationship = exports.parseManyToMany = exports.parseManytoOne = exports.parseOneToMany = void 0;
+exports.getRelationshipsForImport = exports.streamNestedRelationships = exports.getNestedRelationships = exports.generateNestedRelationships = exports.getRelationshipForTemplate = exports.getRelationshipIdField = exports.getRelationshipName = exports.parseRelationships = exports.parseRelationship = exports.parseManyToMany = exports.parseManytoOne = exports.parseOneToMany = void 0;
 const tslib_1 = require("tslib");
 const pluralize_1 = tslib_1.__importDefault(require("pluralize"));
 const casing_1 = require("../casing");
@@ -413,8 +413,9 @@ const getRelationshipName = (relationship) => {
     }
     return (0, casing_1.camelCase)(relationship.name);
 };
+exports.getRelationshipName = getRelationshipName;
 const getRelationshipIdField = (relationship) => {
-    return `${getRelationshipName(relationship)}Id`;
+    return `${(0, exports.getRelationshipName)(relationship)}Id`;
 };
 exports.getRelationshipIdField = getRelationshipIdField;
 /**
@@ -572,7 +573,7 @@ function* generateNestedRelationships(entityName, relationshipMap, maxDepth = 4,
     if (!relationships)
         return;
     for (const relationship of relationships) {
-        const referenceName = getRelationshipName(relationship);
+        const referenceName = (0, exports.getRelationshipName)(relationship);
         const type = relationship.type;
         // Format the property name based on relationship type
         // OneToMany and ManyToMany relationships use plural forms

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.46.0",
+      "version": "0.46.1",
       "license": "Apache-2.0",
       "dependencies": {
         "@apso/schema-tools": "^0.2.0",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.46.0",
+  "version": "0.46.1",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",