@apso/cli 0.47.1 → 0.47.2

package/dist/commands/generate.js

@@ -152,6 +152,7 @@ class Generate extends base_command_1.default {
                     relationships: entityRelationships,
                     allEntities: entities,
                     apiType: lowerCaseApiType,
+                    auth,
                 }),
                 generator.generateService({
                     entity,

package/dist/commands/mcp/serve.js

@@ -368,6 +368,7 @@ class McpServe extends base_command_1.default {
                             relationships: entityRelationships,
                             allEntities: entities,
                             apiType: lowerCaseApiType,
+                            auth,
                         }),
                         generator.generateService({
                             entity,

package/dist/lib/generators/go.js

@@ -244,8 +244,10 @@ class GoGenerator extends base_1.BaseGenerator {
         ];
     }
     async generateDto(options) {
+        var _a;
         const { entity, relationships, allEntities, apiType } = options;
         const { name: entityName, fields = [] } = entity;
+        const scopeFields = new Set((_a = (0, guards_1.entityScope)(entity, Boolean(options.auth))) === null || _a === void 0 ? void 0 : _a.fields.map((f) => f.field));
         const columns = this.getGoFieldsForTemplate(fields, entityName);
         const relationshipsTemplate = (0, relationships_1.getRelationshipForTemplate)(entityName, relationships, allEntities);
         // Add Go-specific properties to relationships
@@ -258,6 +260,8 @@ class GoGenerator extends base_1.BaseGenerator {
                 camelReferenceName: (0, casing_1.camelCase)(rel.referenceName || rel.name),
                 pluralName: (0, casing_1.pascalCase)((0, pluralize_1.default)(rel.name)),
                 camelPluralName: (0, casing_1.camelCase)((0, pluralize_1.default)(rel.name)),
+                // The service sets a scopeBy foreign key from the caller on create.
+                scoped: scopeFields.has(`${(0, casing_1.camelCase)(rel.referenceName || rel.name)}Id`),
             };
         });
         const primaryKeyColumns = columns.filter((column) => column.primary === true);

package/dist/lib/generators/typescript.js

@@ -109,7 +109,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         ];
     }
     async generateController(options) {
-        var _a, _b;
+        var _a;
         const { entity, relationships, relationshipMap, auth } = options;
         const { name: entityName } = entity;
         const relationshipsForTemplate = (0, relationships_1.getRelationshipForTemplate)(entityName, relationships);
@@ -128,9 +128,22 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
         const ctrlName = `${entityName}Controller`;
         const pluralEntityName = (0, pluralize_1.default)(entityName);
         const primaryKeyType = entity.primaryKeyType || "serial";
-        const scopes = auth
-            ? (_b = (_a = (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]) === null || _a === void 0 ? void 0 : _a.scopes) !== null && _b !== void 0 ? _b : []
-            : [];
+        const scoped = auth
+            ? (0, guards_1.getScopedEntities)([entity], relationshipMap)[0]
+            : undefined;
+        const scopes = (_a = scoped === null || scoped === void 0 ? void 0 : scoped.scopes) !== null && _a !== void 0 ? _a : [];
+        // Only emitted when scopeOptions differ from the defaults, so services
+        // without them keep the same generated controller.
+        const scopeOptions = scoped &&
+            (scoped.bypassRoles.length > 0 ||
+                !scoped.injectOnCreate ||
+                ["find", "get", "create", "update", "delete"].some((op) => !scoped.enforceOn.includes(op)))
+            ? {
+                enforceOn: scoped.enforceOn,
+                bypassRoles: scoped.bypassRoles,
+                injectOnCreate: scoped.injectOnCreate,
+            }
+            : undefined;
         const data = {
             svcName,
             ctrlName,
@@ -145,6 +158,7 @@ class TypeScriptGenerator extends base_1.BaseGenerator {
             // ids ScopeGuard loaded for the caller into req.apsoScope.
             crudAuth: scopes.filter((s) => s.direct),
             crudAuthNested: scopes.filter((s) => s.fkField),
+            scopeOptions,
         };
         const controllerContent = await this.renderTemplate("./rest/controller-rest", data);
         const specContent = await this.renderTemplate("./rest/controller-rest-spec", data);

package/dist/lib/templates/go/dto/dto.eta

@@ -51,7 +51,7 @@ type <%= it.entityName %>Create struct {
 <% }); -%>
 <% it.associations.forEach((assoc) => { -%>
 <% if (assoc.type === 'ManyToOne' || (assoc.type === 'OneToOne' && assoc.isOwner)) { -%>
-	<%= assoc.referenceName || assoc.name %>ID <%= assoc.primaryKeyGoType || 'uint' %> `json:"<%= assoc.camelReferenceName || assoc.camelName %>Id" validate:"required"`
+	<%= assoc.referenceName || assoc.name %>ID <%= assoc.primaryKeyGoType || 'uint' %> `json:"<%= assoc.camelReferenceName || assoc.camelName %>Id"<% if (!assoc.scoped) { %> validate:"required"<% } %>`
 <% } -%>
 <% }) -%>
 }

package/dist/lib/templates/guards/scope.guard.eta

@@ -168,7 +168,7 @@ export class ScopeGuard implements CanActivate {
     }
 
     // Check if user has bypass role
-    const userRoles: string[] = request.user?.roles || request.roles || [];
+    const userRoles: string[] = request.auth?.roles ?? request.user?.roles ?? request.roles ?? [];
     if (scopeConfig.bypassRoles.some(role => userRoles.includes(role))) {
       return true;
     }

package/dist/lib/templates/rest/controller-rest.eta

@@ -15,6 +15,26 @@ const nestedScope = (req: any, fk: string) => {
     return { [fk]: ids.length ? { $in: ids } : { $isnull: true, $notnull: true } };
 };
 <% } %>
+<% if (it.scopeOptions && (it.crudAuth.length || it.crudAuthNested.length)) { %>
+// .apsorc scopeOptions: which requests the tenant filter covers and which
+// roles skip it.
+const ENFORCE_ON = [<%~ it.scopeOptions.enforceOn.map((op) => `'${op}'`).join(', ') %>];
+const BYPASS_ROLES: string[] = [<%~ it.scopeOptions.bypassRoles.map((r) => `'${r}'`).join(', ') %>];
+const scopeOperation = (req: any) => {
+    switch (req.method) {
+        case 'GET': return req.params?.id ? 'get' : 'find';
+        case 'POST': return 'create';
+        case 'PUT':
+        case 'PATCH': return 'update';
+        case 'DELETE': return 'delete';
+        default: return 'find';
+    }
+};
+const skipScope = (req: any) => {
+    const roles: string[] = req.auth?.roles ?? req.user?.roles ?? [];
+    return roles.some((r) => BYPASS_ROLES.includes(r)) || !ENFORCE_ON.includes(scopeOperation(req));
+};
+<% } %>
 @Crud({
     model: {
         type: <%= it.entityName %>
@@ -63,7 +83,7 @@ const nestedScope = (req: any, fk: string) => {
 <% if (it.crudAuth.length || it.crudAuthNested.length) { %>
 // Every query and write is limited to the caller's tenant (.apsorc scopeBy).
 @CrudAuth({
-    filter: (req: any) => ({
+    filter: (req: any) => <% if (it.scopeOptions) { %>skipScope(req) ? {} : <% } %>({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>
@@ -71,7 +91,7 @@ const nestedScope = (req: any, fk: string) => {
         ...nestedScope(req, '<%= s.fkField %>'),
 <% }) %>
     }),
-    persist: (req: any) => ({
+    persist: (req: any) => <% if (it.scopeOptions) { %>skipScope(req)<% if (!it.scopeOptions.injectOnCreate) { %> || scopeOperation(req) === 'create'<% } %> ? {} : <% } %>({
 <% it.crudAuth.forEach((s) => { %>
         <%= s.field %>: req.<%= s.contextKey %> ?? req.user?.<%= s.contextKey %> ?? req.auth?.<%= s.contextKey %> ?? req.auth?.workspaceId,
 <% }) %>

package/dist/lib/types/generator.d.ts

@@ -181,6 +181,8 @@ export interface DtoGenerationOptions extends EntityGenerationOptions {
      * Include validation decorators/rules
      */
     includeValidation?: boolean;
+    /** With scopeBy, the service sets the tenant field, so create doesn't require it. */
+    auth?: AuthConfig;
 }
 /**
  * Options for generating migrations

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@apso/cli",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@apso/cli",
-      "version": "0.47.1",
+      "version": "0.47.2",
       "license": "Apache-2.0",
       "dependencies": {
         "@apso/schema-tools": "^0.2.0",

package/oclif.manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.47.1",
+  "version": "0.47.2",
   "commands": {
     "config": {
       "id": "config",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apso/cli",
-  "version": "0.47.1",
+  "version": "0.47.2",
   "mcpName": "io.github.apsoai/apso",
   "description": "Apso CLI",
   "author": "Apso by Mavric - @mavric",