@axium/server 0.35.2 → 0.36.0

package/dist/acl.d.ts

@@ -1,4 +1,4 @@
-import { type AccessControl, type AccessTarget, type UserInternal } from '@axium/core';
+import { type AccessControl, type AccessControllable, type AccessTarget, type UserInternal } from '@axium/core';
 import type * as kysely from 'kysely';
 import type { WithRequired } from 'utilium';
 import * as db from './database.js';
@@ -6,7 +6,7 @@ type _TableNames = keyof {
     [K in keyof db.Schema as db.Schema[K] extends db.DBAccessControl ? K : never]: null;
 };
 type _TargetNames = keyof db.Schema & keyof {
-    [K in _TableNames as K extends `acl.${infer TB extends keyof db.Schema}` ? TB : never]: null;
+    [K in keyof db.Schema as db.Schema[K] extends AccessControllable ? (`acl.${K}` extends keyof db.Schema ? K : never) : never]: null;
 };
 /**
  * `never` causes a ton of problems, so we use `string` if none of the tables are shareable.
@@ -40,4 +40,18 @@ export declare function remove<const TB extends TableName>(table: TB, itemId: st
 export declare function add<const TB extends TableName>(table: TB, itemId: string, target: AccessTarget): Promise<Result<TB>>;
 export declare function check<const TB extends TableName>(acl: Result<TB>[], permissions: Partial<PermissionsFor<TB>>): Set<keyof PermissionsFor<TB>>;
 export declare function listTables(): Record<string, TableName>;
+export interface OptionsForWhere<TB extends TargetName> {
+    itemId?: keyof db.Schema[TB] & string;
+    /** Alias for the item table/value */
+    alias?: string;
+}
+/**
+ * Use in a `where` to filter by items a user can access because of an ACL entry.
+ *
+ */
+export declare function existsIn<const TB extends TargetName, const O extends OptionsForWhere<TB>>(table: TB, user: Pick<UserInternal, 'id' | 'roles' | 'tags'>, options?: O): (eb: kysely.ExpressionBuilder<db.Schema & { [K in O["alias"] extends string ? O["alias"] : never]: db.Schema[TB]; }, O["alias"] extends string ? O["alias"] & (keyof db.Schema | (O["alias"] extends string ? O["alias"] : never)) : TB>) => kysely.ExpressionWrapper<db.Schema & { [K in O["alias"] extends string ? O["alias"] : never]: db.Schema[TB]; }, O["alias"] extends string ? O["alias"] & (keyof db.Schema | (O["alias"] extends string ? O["alias"] : never)) : TB, kysely.SqlBool>;
+/**
+ * Use in a `where` to filter by items a user has access to
+ */
+export declare function userHasAccess<const TB extends TargetName>(table: TB, user: Pick<UserInternal, 'id' | 'roles' | 'tags'>, options?: OptionsForWhere<TB>): (eb: kysely.ExpressionBuilder<db.Schema, TB>) => kysely.ExpressionWrapper<db.Schema, TB, kysely.SqlBool>;
 export {};

package/dist/acl.js

@@ -82,3 +82,27 @@ export function listTables() {
     }
     return tables;
 }
+/**
+ * Use in a `where` to filter by items a user can access because of an ACL entry.
+ *
+ */
+export function existsIn(table, user, options = {}) {
+    return (eb) => eb.exists(eb
+        .selectFrom(`acl.${table}`)
+        // @ts-expect-error 2349
+        .whereRef('itemId', '=', `${options.alias || `public.${table}`}.${options.itemId || 'id'}`)
+        .where((eb) => {
+        const ors = [eb('userId', '=', user.id)];
+        if (user.roles.length)
+            ors.push(eb('role', 'in', user.roles));
+        if (user.tags.length)
+            ors.push(eb('tag', 'in', user.tags));
+        return eb.or(ors);
+    }));
+}
+/**
+ * Use in a `where` to filter by items a user has access to
+ */
+export function userHasAccess(table, user, options = {}) {
+    return (eb) => eb.or([eb('userId', '=', user.id), existsIn(table, user, options)(eb)]);
+}

package/dist/api/acl.js

@@ -1,9 +1,9 @@
+import { AccessControlUpdate, AccessTarget } from '@axium/core';
 import * as z from 'zod';
 import * as acl from '../acl.js';
+import { authRequestForItem } from '../auth.js';
 import { error, parseBody, withError } from '../requests.js';
 import { addRoute } from '../routes.js';
-import { authRequestForItem } from '../auth.js';
-import { AccessControlUpdate, AccessTarget } from '@axium/core';
 function getTable(itemType) {
     const tables = acl.listTables();
     if (!(itemType in tables))

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import type { Passkey, Session, UserInternal, VerificationInternal, VerificationRole } from '@axium/core';
-import type { Insertable, Kysely, Selectable } from 'kysely';
+import type { Insertable, Kysely } from 'kysely';
 import { type WithRequired } from 'utilium';
 import * as acl from './acl.js';
 import { type Schema } from './database.js';
@@ -37,7 +37,7 @@ export interface UserAuthResult extends SessionAndUser {
 export declare function checkAuthForUser(request: Request, userId: string, sensitive?: boolean): Promise<UserAuthResult>;
 export interface ItemAuthResult<TB extends acl.TargetName> {
     fromACL: boolean;
-    item: Selectable<Schema[TB]>;
+    item: acl.WithACL<TB>;
     user?: UserInternal;
     session?: SessionInternal;
 }

package/dist/auth.js

@@ -113,21 +113,20 @@ export async function checkAuthForUser(request, userId, sensitive = false) {
 export async function authSessionForItem(itemType, itemId, permissions, session) {
     const { userId, user } = session ?? {};
     // Note: we need to do casting because of TS limitations with generics
-    const item = await db
+    const item = (await db
         .selectFrom(itemType)
         .selectAll()
         .where('id', '=', itemId)
         .$if(!!userId, eb => eb.select(acl.from(itemType, { user })))
-        .$castTo()
         .executeTakeFirstOrThrow()
         .catch(e => {
         if (e.message.includes('no rows'))
             error(404, itemType + ' not found');
         throw e;
-    });
+    }));
     const result = {
         session: session ? omit(session, 'user') : undefined,
-        item: omit(item, 'acl'),
+        item,
         user,
         fromACL: false,
     };

package/dist/main.js

@@ -590,6 +590,22 @@ try {
             if (!plugin)
                 io.exit(`Can't find a plugin matching "${search}"`);
             const _ = __addDisposableResource(env_4, db.connect(), true);
+            const info = db.getUpgradeInfo();
+            const exclude = Object.keys(info.current);
+            if (exclude.includes(plugin.name))
+                io.exit('Plugin is already initialized (database)');
+            const schema = db.getFullSchema({ exclude });
+            const delta = db.computeDelta({ tables: {}, indexes: [] }, schema);
+            if (db.deltaIsEmpty(delta)) {
+                io.info('Plugin does not define any database schema.');
+                return;
+            }
+            for (const text of db.displayDelta(delta))
+                console.log(text);
+            await rlConfirm();
+            await db.applyDelta(delta);
+            Object.assign(info.current, schema.versions);
+            db.setUpgradeInfo(info);
         }
         catch (e_4) {
             env_4.error = e_4;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.35.2",
+	"version": "0.36.0",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"funding": {
 		"type": "individual",