@base44-preview/cli 0.1.27-pr.653.981b966 → 0.1.28-pr.654.637c79c

package/dist/cli/index.js

@@ -239374,7 +239374,7 @@ import { join as join13 } from "node:path";
 // package.json
 var package_default = {
   name: "base44",
-  version: "0.1.27",
+  version: "0.1.28",
   description: "Base44 CLI - Unified interface for managing Base44 applications",
   type: "module",
   bin: {
@@ -264179,7 +264179,7 @@ In order to complete registration use this verification code: ${otpCode}
         is_verified: true,
         disabled: null,
         role: "user",
-        collaborator_role: "editor",
+        collaborator_role: null,
         created_date: now,
         updated_date: now
       });
@@ -264198,6 +264198,7 @@ In order to complete registration use this verification code: ${otpCode}
 var import_express4 = __toESM(require_express(), 1);
 
 // src/cli/dev/dev-server/db/rls.ts
+import { isDeepStrictEqual as isDeepStrictEqual5 } from "node:util";
 function getRLSFieldValue(key, source) {
   const DATA_FIELD_PREFIX = "data.";
   return source[key.startsWith(DATA_FIELD_PREFIX) ? key.slice(DATA_FIELD_PREFIX.length) : key];
@@ -264315,6 +264316,23 @@ function applyFLS(record, schema, user, operation) {
   return result;
 }
 
+class FLSWriteError extends Error {
+  constructor(operation, deniedFields) {
+    const verb = operation === "create" ? "set" : "modify";
+    super(`You're not allowed to ${verb} the following fields: ${deniedFields.join(", ")}`);
+  }
+}
+function assertFLSWrite(changes, context, schema, user, operation) {
+  const denied = Object.entries(changes).filter(([key, value]) => {
+    const rls = schema.properties[key]?.rls;
+    const rule = rls?.[operation] ?? rls?.write;
+    return rule !== undefined && !isDeepStrictEqual5(context[key], value) && !checkRLS(rule, context, user);
+  }).map(([key]) => `data.${key}`);
+  if (denied.length > 0) {
+    throw new FLSWriteError(operation, denied);
+  }
+}
+
 // src/cli/dev/dev-server/db/entity-queries.ts
 function parseSort(sort) {
   if (!sort) {
@@ -264486,6 +264504,10 @@ function createUserRouter(db, logger) {
       id
     });
     if (userRecord) {
+      if (id !== currentUser.id && currentUser.collaborator_role !== "editor" && !currentUser.is_service) {
+        res.status(403).json({ message: "You are not authorized to update this user" });
+        return;
+      }
       try {
         const { id: _id, created_date: _created_date, ...body } = req.body;
         const filteredBody = db.prepareRecord(USER_COLLECTION, body, true);
@@ -264495,6 +264517,7 @@ function createUserRouter(db, logger) {
             allowedFields[key] = property;
           }
         }
+        assertFLSWrite(allowedFields, { ...userRecord, created_by: userRecord.email }, db.getSchema(USER_COLLECTION), currentUser, "update");
         db.validate(USER_COLLECTION, allowedFields, true);
         const updateData = {
           ...allowedFields,
@@ -264510,6 +264533,10 @@ function createUserRouter(db, logger) {
           res.status(422).json(error.context);
           return;
         }
+        if (error instanceof FLSWriteError) {
+          res.status(403).json({ message: error.message });
+          return;
+        }
         logger.error(`Error in PUT /${USER_COLLECTION}/${req.params.id}:`, error);
         res.status(500).json({ error: "Internal server error" });
       }
@@ -264572,7 +264599,8 @@ async function createEntityRoutes(db, logger, broadcast) {
     }, currentUser)) {
       return;
     }
-    const filteredBody = applyFLS(db.prepareRecord(entityName, recordBody), schema, currentUser, "write");
+    assertFLSWrite(recordBody, ownerFields, schema, currentUser, "create");
+    const filteredBody = db.prepareRecord(entityName, recordBody);
     db.validate(entityName, filteredBody);
     return {
       ...filteredBody,
@@ -264640,6 +264668,10 @@ async function createEntityRoutes(db, logger, broadcast) {
         res.status(422).json(error.context);
         return;
       }
+      if (error instanceof FLSWriteError) {
+        res.status(403).json({ message: error.message });
+        return;
+      }
       logger.error(`Error in POST /${entityName}:`, error);
       res.status(500).json({ error: "Internal server error" });
     }
@@ -264669,6 +264701,10 @@ async function createEntityRoutes(db, logger, broadcast) {
         res.status(422).json(error.context);
         return;
       }
+      if (error instanceof FLSWriteError) {
+        res.status(403).json({ message: error.message });
+        return;
+      }
       logger.error(`Error in POST /${entityName}/bulk:`, error);
       res.status(500).json({ error: "Internal server error" });
     }
@@ -264677,20 +264713,19 @@ async function createEntityRoutes(db, logger, broadcast) {
     const { appId, entityName, id } = req.params;
     const { id: _id, created_date: _created_date, ...body } = req.body;
     try {
-      if (schema.rls?.update !== undefined) {
-        const existing = await collection.findOneAsync({ id });
-        if (!existing) {
-          res.status(404).json({ error: `Record with id "${id}" not found` });
-          return;
-        }
-        if (!checkRLS(schema.rls.update, existing, currentUser)) {
-          res.status(404).json({
-            message: `Entity ${entityName} with ID ${id} not found`
-          });
-          return;
-        }
+      const existing = await collection.findOneAsync({ id });
+      if (!existing) {
+        res.status(404).json({ error: `Record with id "${id}" not found` });
+        return;
       }
-      const filteredBody = applyFLS(db.prepareRecord(entityName, body, true), schema, currentUser, "write");
+      if (!checkRLS(schema.rls?.update, existing, currentUser)) {
+        res.status(404).json({
+          message: `Entity ${entityName} with ID ${id} not found`
+        });
+        return;
+      }
+      const filteredBody = db.prepareRecord(entityName, body, true);
+      assertFLSWrite(filteredBody, existing, schema, currentUser, "update");
       db.validate(entityName, filteredBody, true);
       const updateData = {
         ...filteredBody,
@@ -264709,6 +264744,10 @@ async function createEntityRoutes(db, logger, broadcast) {
         res.status(422).json(error.context);
         return;
       }
+      if (error instanceof FLSWriteError) {
+        res.status(403).json({ message: error.message });
+        return;
+      }
       logger.error(`Error in PUT /${entityName}/${id}:`, error);
       res.status(500).json({ error: "Internal server error" });
     }
@@ -271221,4 +271260,4 @@ export {
   runCLI
 };
 
-//# debugId=0A00CB7F15CA88CB64756E2164756E21
+//# debugId=32B8364D7EDF277764756E2164756E21