@axium/server 0.39.6 → 0.40.0

package/dist/acl.d.ts

@@ -1,4 +1,4 @@
-import { type AccessControl, type AccessControllable, type AccessTarget, type UserInternal } from '@axium/core';
+import type { AccessControl, AccessControllable, AccessTarget, UserInternal } from '@axium/core';
 import type * as kysely from 'kysely';
 import type { WithRequired } from 'utilium';
 import * as db from './database.js';
@@ -25,7 +25,6 @@ export type WithACL<TB extends TargetName> = kysely.Selectable<db.Schema[TB]> &
 };
 /** Match ACL entries, optionally selecting for a given user-like object */
 export declare function match(user?: Pick<UserInternal, 'id' | 'roles' | 'tags'>): (eb: kysely.ExpressionBuilder<db.Schema, any>) => kysely.ExpressionWrapper<db.Schema, any, kysely.SqlBool>;
-export declare function controlMatchesUser(control: AccessControl, user: Pick<UserInternal, 'id' | 'roles' | 'tags'>): boolean | "" | null | undefined;
 export interface ACLSelectionOptions {
     /** Instead of using the `id` from `table`, use the `id` from this instead */
     alias?: string;
@@ -42,8 +41,6 @@ export declare function get<const TB extends TableName>(table: TB, itemId: strin
 export declare function update<const TB extends TableName>(table: TB, itemId: string, target: AccessTarget, permissions: PermissionsFor<TB>): Promise<Result<TB>>;
 export declare function remove<const TB extends TableName>(table: TB, itemId: string, target: AccessTarget): Promise<Result<TB>>;
 export declare function add<const TB extends TableName>(table: TB, itemId: string, target: AccessTarget): Promise<Result<TB>>;
-/** Check an ACL against a set of permissions. */
-export declare function check<const TB extends TableName>(acl: Result<TB>[], permissions: Partial<PermissionsFor<TB>>): Set<keyof PermissionsFor<TB>>;
 export declare function listTables(): Record<string, TableName>;
 export interface OptionsForWhere<TB extends TargetName> {
     itemId?: keyof db.Schema[TB] & string;

package/dist/acl.js

@@ -1,4 +1,4 @@
-import { fromTarget } from '@axium/core';
+import { fromTarget } from '@axium/core/access';
 import { jsonArrayFrom } from 'kysely/helpers/postgres';
 import * as db from './database.js';
 /** Match ACL entries, optionally selecting for a given user-like object */
@@ -15,12 +15,6 @@ export function match(user) {
         return eb.or(ors);
     };
 }
-export function controlMatchesUser(control, user) {
-    return ((!control.role && !control.tag && !control.userId) ||
-        control.userId === user.id ||
-        (control.role && user.roles.includes(control.role)) ||
-        (control.tag && user.tags.includes(control.tag)));
-}
 /**
  * Helper to select all access controls for a given table, including the user information.
  * Optionally filter for the entries applicable to a specific user.
@@ -72,20 +66,6 @@ export async function add(table, itemId, target) {
         .$castTo()
         .executeTakeFirstOrThrow();
 }
-/** Check an ACL against a set of permissions. */
-export function check(acl, permissions) {
-    const allowed = new Set();
-    const all = new Set(Object.keys(permissions));
-    const entries = Object.entries(permissions);
-    for (const control of acl) {
-        for (const [key, needed] of entries) {
-            const value = control[key];
-            if (value === needed)
-                allowed.add(key);
-        }
-    }
-    return all.difference(allowed);
-}
 export function listTables() {
     const tables = {};
     for (const [, file] of db.schema.getFiles()) {

package/dist/auth.js

@@ -1,3 +1,4 @@
+import { checkACL, controlMatchesUser } from '@axium/core';
 import { randomBytes, randomUUID } from 'node:crypto';
 import { omit } from 'utilium';
 import * as acl from './acl.js';
@@ -121,8 +122,8 @@ export async function authSessionForItem(itemType, itemId, permissions, session,
         .select(acl.from(itemType))
         .executeTakeFirstOrThrow()
         .catch(e => {
-        if (e.message.includes('no rows'))
-            error(404, itemType + ' not found');
+        if (e.constructor.name == 'NoResultError' || e.message.includes('no rows'))
+            error(404, 'Not found');
         throw e;
     }));
     const result = {
@@ -131,9 +132,7 @@ export async function authSessionForItem(itemType, itemId, permissions, session,
         user,
         fromACL: false,
     };
-    if (!session || !user)
-        error(401, 'Item is not public');
-    if (user.isSuspended)
+    if (user?.isSuspended)
         error(403, 'User is suspended');
     if (userId == item.userId)
         return result;
@@ -166,10 +165,13 @@ export async function authSessionForItem(itemType, itemId, permissions, session,
             }
         })
         : item.acl;
-    const matching = controls.filter(c => acl.controlMatchesUser(c, user));
+    const matching = controls.filter(c => controlMatchesUser(c, user));
     if (!matching.length)
-        error(403, 'Item is not shared with you');
-    const missing = Array.from(acl.check(matching, permissions));
+        if (!session || !user)
+            error(401, 'Item is not public');
+        else
+            error(403, 'Item is not shared with you');
+    const missing = Array.from(checkACL(matching, permissions));
     if (missing.length)
         error(403, 'Missing permissions: ' + missing.join(', '));
     return result;
@@ -179,9 +181,15 @@ export async function authSessionForItem(itemType, itemId, permissions, session,
  * This will fetch the item, ACLs, users, and the authenticating session.
  */
 export async function authRequestForItem(request, itemType, itemId, permissions, recursive = false) {
-    const token = getToken(request, false);
-    if (!token)
-        error(401, 'Missing token');
-    const session = await getSessionAndUser(token).catch(() => null);
+    let session = null;
+    try {
+        const token = getToken(request, false);
+        if (!token)
+            error(401, 'Missing token');
+        session = await getSessionAndUser(token).catch(() => null);
+    }
+    catch {
+        session = null;
+    }
     return await authSessionForItem(itemType, itemId, permissions, session, recursive);
 }

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@axium/server",
-	"version": "0.39.6",
+	"version": "0.40.0",
 	"author": "James Prevett <axium@jamespre.dev>",
 	"funding": {
 		"type": "individual",
@@ -47,8 +47,8 @@
 		"clean": "rm -rf build .svelte-kit node_modules/{.vite,.vite-temp}"
 	},
 	"peerDependencies": {
-		"@axium/client": ">=0.19.0",
-		"@axium/core": ">=0.21.0",
+		"@axium/client": ">=0.20.0",
+		"@axium/core": ">=0.23.0",
 		"kysely": "^0.28.0",
 		"utilium": "^2.6.0",
 		"zod": "^4.0.5"