@baseplate-dev/project-builder-lib 0.6.4 → 0.6.6

package/dist/expression-parsers/authorizer/authorizer-expression-parser.js

@@ -0,0 +1,292 @@
+import { z } from 'zod';
+import { RefExpressionParser } from '#src/references/expression-types.js';
+import { modelAuthorizerRoleEntityType } from '#src/schema/models/authorizer/types.js';
+import { modelForeignRelationEntityType, modelLocalRelationEntityType, modelScalarFieldEntityType, } from '#src/schema/models/types.js';
+import { parseAuthorizerExpression } from './authorizer-expression-acorn-parser.js';
+import { AuthorizerExpressionParseError } from './authorizer-expression-ast.js';
+import { buildModelExpressionContext, validateAuthorizerExpression, } from './authorizer-expression-validator.js';
+import { visitAuthorizerExpression } from './authorizer-expression-visitor.js';
+/**
+ * Expression parser for model authorizer role expressions.
+ *
+ * Parses expressions like:
+ * - `model.id === auth.userId` (ownership check)
+ * - `auth.hasRole('admin')` (global role check)
+ * - `model.id === auth.userId || auth.hasRole('admin')` (combined)
+ *
+ * Uses Acorn to parse JavaScript expressions and validates
+ * that only supported constructs are used.
+ *
+ * @example
+ * ```typescript
+ * const schema = z.object({
+ *   expression: ctx.withExpression(authorizerExpressionParser, { model: modelSlot }),
+ * });
+ * ```
+ */
+export class AuthorizerExpressionParser extends RefExpressionParser {
+    name = 'authorizer-expression';
+    /**
+     * Creates a Zod schema for validating expression strings.
+     * Requires a non-empty string value.
+     */
+    createSchema() {
+        return z.string().min(1, 'Expression is required');
+    }
+    /**
+     * Parse the expression string into an AST.
+     *
+     * @param value - The expression string
+     * @returns Success with parsed expression info, or failure with error message
+     */
+    parse(value) {
+        try {
+            return { success: true, value: parseAuthorizerExpression(value) };
+        }
+        catch (error) {
+            if (error instanceof AuthorizerExpressionParseError) {
+                return { success: false, error: error.message };
+            }
+            throw error;
+        }
+    }
+    /**
+     * Get validation warnings for the expression.
+     *
+     * Validates:
+     * - Syntax errors from parsing
+     * - Model field references exist
+     * - Auth field references are valid
+     * - Role names exist in project config (warning only)
+     */
+    getWarnings(parseResult, context, resolvedSlots) {
+        // Get model context from resolved slots (throws if model not found)
+        const modelContext = this.getModelContext(context.definition, resolvedSlots);
+        // Validate the expression against model fields and roles
+        return validateAuthorizerExpression(parseResult.ast, modelContext, context.pluginStore, context.definition);
+    }
+    /**
+     * Get entity references from the expression with their positions.
+     *
+     * Walks the AST and resolves each name reference (field, relation, role)
+     * to its entity ID by navigating the model definition from the resolved slots.
+     * Returns positions marking exactly which text to replace when an entity is renamed.
+     */
+    getReferencedEntities(_value, parseResult, definition, resolvedSlots) {
+        if (!parseResult.success) {
+            return [];
+        }
+        const model = this.getRawModel(definition, resolvedSlots);
+        const allModels = definition.models.filter((m) => typeof m.name === 'string');
+        // Build lookup maps
+        const fieldByName = new Map();
+        for (const field of model.model.fields) {
+            fieldByName.set(field.name, { id: field.id });
+        }
+        const relationByName = new Map();
+        // Local relations (defined on this model)
+        for (const relation of model.model.relations) {
+            relationByName.set(relation.name, {
+                id: relation.id,
+                modelRef: relation.modelRef,
+                entityType: modelLocalRelationEntityType,
+            });
+        }
+        const modelById = new Map();
+        for (const m of allModels) {
+            modelById.set(m.id, m);
+        }
+        // Foreign relations (defined on other models pointing to this model via foreignRelationName)
+        for (const m of allModels) {
+            for (const relation of m.model.relations) {
+                if (relation.foreignRelationName && relation.modelRef === model.id) {
+                    relationByName.set(relation.foreignRelationName, {
+                        id: relation.foreignId,
+                        // Foreign relation points back to the model that defines it
+                        modelRef: m.id,
+                        entityType: modelForeignRelationEntityType,
+                    });
+                }
+            }
+        }
+        const deps = [];
+        const visitor = {
+            fieldComparison(node) {
+                for (const side of [node.left, node.right]) {
+                    if (side.type === 'fieldRef' && side.source === 'model') {
+                        const field = fieldByName.get(side.field);
+                        if (field) {
+                            deps.push({
+                                entityType: modelScalarFieldEntityType,
+                                entityId: field.id,
+                                start: side.end - side.field.length,
+                                end: side.end,
+                            });
+                        }
+                    }
+                }
+            },
+            hasRole() {
+                // Global auth roles are defined by plugins, not navigable from
+                // the raw model definition. Skip — auth role renames are rare
+                // and would require traversing plugin-specific config.
+            },
+            hasSomeRole() {
+                // Same as hasRole — skip global auth role references
+            },
+            nestedHasRole(node) {
+                const relation = relationByName.get(node.relationName);
+                if (relation) {
+                    deps.push({
+                        entityType: relation.entityType,
+                        entityId: relation.id,
+                        start: node.relationEnd - node.relationName.length,
+                        end: node.relationEnd,
+                    });
+                    // Foreign authorizer role
+                    const foreignModel = modelById.get(relation.modelRef);
+                    if (foreignModel) {
+                        const foreignRole = foreignModel.authorizer.roles.find((r) => r.name === node.role);
+                        if (foreignRole) {
+                            deps.push({
+                                entityType: modelAuthorizerRoleEntityType,
+                                entityId: foreignRole.id,
+                                start: node.roleStart + 1,
+                                end: node.roleEnd - 1,
+                            });
+                        }
+                    }
+                }
+            },
+            nestedHasSomeRole(node) {
+                const relation = relationByName.get(node.relationName);
+                if (relation) {
+                    deps.push({
+                        entityType: relation.entityType,
+                        entityId: relation.id,
+                        start: node.relationEnd - node.relationName.length,
+                        end: node.relationEnd,
+                    });
+                    const foreignModel = modelById.get(relation.modelRef);
+                    if (foreignModel) {
+                        const foreignRoleByName = new Map(foreignModel.authorizer.roles.map((r) => [r.name, r]));
+                        for (let i = 0; i < node.roles.length; i++) {
+                            const foreignRole = foreignRoleByName.get(node.roles[i]);
+                            if (foreignRole) {
+                                deps.push({
+                                    entityType: modelAuthorizerRoleEntityType,
+                                    entityId: foreignRole.id,
+                                    start: node.rolesStart[i] + 1,
+                                    end: node.rolesEnd[i] - 1,
+                                });
+                            }
+                        }
+                    }
+                }
+            },
+            relationFilter(node) {
+                const relation = relationByName.get(node.relationName);
+                if (relation) {
+                    deps.push({
+                        entityType: relation.entityType,
+                        entityId: relation.id,
+                        start: node.relationEnd - node.relationName.length,
+                        end: node.relationEnd,
+                    });
+                    // Foreign model fields referenced in conditions
+                    const foreignModel = modelById.get(relation.modelRef);
+                    const foreignFieldByName = new Map();
+                    if (foreignModel) {
+                        for (const f of foreignModel.model.fields) {
+                            foreignFieldByName.set(f.name, { id: f.id });
+                        }
+                    }
+                    for (const condition of node.conditions) {
+                        // Condition key references a field on the foreign model
+                        const foreignField = foreignFieldByName.get(condition.field);
+                        if (foreignField) {
+                            deps.push({
+                                entityType: modelScalarFieldEntityType,
+                                entityId: foreignField.id,
+                                start: condition.fieldStart,
+                                end: condition.fieldEnd,
+                            });
+                        }
+                        // Condition value may be a model field ref
+                        if (condition.value.type === 'fieldRef' &&
+                            condition.value.source === 'model') {
+                            const field = fieldByName.get(condition.value.field);
+                            if (field) {
+                                deps.push({
+                                    entityType: modelScalarFieldEntityType,
+                                    entityId: field.id,
+                                    start: condition.value.end - condition.value.field.length,
+                                    end: condition.value.end,
+                                });
+                            }
+                        }
+                    }
+                }
+            },
+            isAuthenticated() {
+                // No entity references
+            },
+            binaryLogical(_node, _ctx, visit) {
+                visit(_node.left);
+                visit(_node.right);
+            },
+        };
+        visitAuthorizerExpression(parseResult.value.ast, visitor);
+        return deps;
+    }
+    /**
+     * Navigate to the raw model object from the definition using resolved slots.
+     *
+     * Resolved slot paths point to the entity's ID field (e.g., `['models', 2, 'id']`),
+     * so we walk parent paths until we find an object with a string `name` property.
+     */
+    getRawModel(definition, resolvedSlots) {
+        const modelPath = resolvedSlots.model;
+        // Walk progressively shorter paths to find the model object.
+        // Slot paths include the idPath suffix (e.g., ['models', 2, 'id']),
+        // so we try the full path first, then strip segments until we find
+        // an object with a name property.
+        for (let len = modelPath.length; len > 0; len--) {
+            let current = definition;
+            for (let i = 0; i < len; i++) {
+                if (current === null || current === undefined) {
+                    break;
+                }
+                current = current[modelPath[i]];
+            }
+            if (current !== null &&
+                current !== undefined &&
+                typeof current === 'object' &&
+                'name' in current &&
+                typeof current.name === 'string') {
+                return current;
+            }
+        }
+        throw new Error(`Could not resolve model at path ${modelPath.join('.')}`);
+    }
+    /**
+     * Extract model context from the project definition using resolved slots.
+     */
+    getModelContext(definition, resolvedSlots) {
+        const model = this.getRawModel(definition, resolvedSlots);
+        const allModels = definition.models.filter((m) => typeof m.name === 'string');
+        return buildModelExpressionContext({
+            id: model.id,
+            name: model.name,
+            fields: model.model.fields,
+            model: { relations: model.model.relations },
+        }, allModels.map((m) => ({
+            id: m.id,
+            name: m.name,
+            authorizer: m.authorizer,
+            fields: m.model.fields,
+            model: { relations: m.model.relations },
+        })));
+    }
+}
+//# sourceMappingURL=authorizer-expression-parser.js.map

package/dist/expression-parsers/authorizer/authorizer-expression-parser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer-expression-parser.js","sourceRoot":"","sources":["../../../src/expression-parsers/authorizer/authorizer-expression-parser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAcxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,qCAAqC,CAAC;AAC1E,OAAO,EAAE,6BAA6B,EAAE,MAAM,wCAAwC,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,4BAA4B,EAC5B,0BAA0B,GAC3B,MAAM,6BAA6B,CAAC;AAMrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,8BAA8B,EAAE,MAAM,gCAAgC,CAAC;AAChF,OAAO,EACL,2BAA2B,EAC3B,4BAA4B,GAC7B,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAC;AAE/E;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,0BAA2B,SAAQ,mBAI/C;IACU,IAAI,GAAG,uBAAuB,CAAC;IAExC;;;OAGG;IACH,YAAY;QACV,OAAO,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAa;QACjB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,yBAAyB,CAAC,KAAK,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;YAClD,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;;OAQG;IACH,WAAW,CACT,WAAqC,EACrC,OAAoC,EACpC,aAAyE;QAEzE,oEAAoE;QACpE,MAAM,YAAY,GAAG,IAAI,CAAC,eAAe,CACvC,OAAO,CAAC,UAAU,EAClB,aAAa,CACd,CAAC;QAEF,yDAAyD;QACzD,OAAO,4BAA4B,CACjC,WAAW,CAAC,GAAG,EACf,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,UAAU,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,qBAAqB,CACnB,MAAc,EACd,WAA+D,EAC/D,UAA6B,EAC7B,aAAyE;QAEzE,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CACxC,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CACpD,CAAC;QAEF,oBAAoB;QACpB,MAAM,WAAW,GAAG,IAAI,GAAG,EAA0B,CAAC;QACtD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YACvC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,GAAG,EAG3B,CAAC;QACJ,0CAA0C;QAC1C,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;YAC7C,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE;gBAChC,EAAE,EAAE,QAAQ,CAAC,EAAE;gBACf,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,UAAU,EAAE,4BAA4B;aACzC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAuB,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzB,CAAC;QAED,6FAA6F;QAC7F,KAAK,MAAM,CAAC,IAAI,SAAS,EAAE,CAAC;YAC1B,KAAK,MAAM,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;gBACzC,IAAI,QAAQ,CAAC,mBAAmB,IAAI,QAAQ,CAAC,QAAQ,KAAK,KAAK,CAAC,EAAE,EAAE,CAAC;oBACnE,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,EAAE;wBAC/C,EAAE,EAAE,QAAQ,CAAC,SAAS;wBACtB,4DAA4D;wBAC5D,QAAQ,EAAE,CAAC,CAAC,EAAE;wBACd,UAAU,EAAE,8BAA8B;qBAC3C,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAA8B,EAAE,CAAC;QAE3C,MAAM,OAAO,GAAsC;YACjD,eAAe,CAAC,IAAI;gBAClB,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;wBACxD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAC1C,IAAI,KAAK,EAAE,CAAC;4BACV,IAAI,CAAC,IAAI,CAAC;gCACR,UAAU,EAAE,0BAA0B;gCACtC,QAAQ,EAAE,KAAK,CAAC,EAAE;gCAClB,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM;gCACnC,GAAG,EAAE,IAAI,CAAC,GAAG;6BACd,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,OAAO;gBACL,+DAA+D;gBAC/D,8DAA8D;gBAC9D,uDAAuD;YACzD,CAAC;YACD,WAAW;gBACT,qDAAqD;YACvD,CAAC;YACD,aAAa,CAAC,IAAI;gBAChB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC;wBACR,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBACrB,KAAK,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;wBAClD,GAAG,EAAE,IAAI,CAAC,WAAW;qBACtB,CAAC,CAAC;oBACH,0BAA0B;oBAC1B,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACtD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,WAAW,GAAG,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CACpD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAC5B,CAAC;wBACF,IAAI,WAAW,EAAE,CAAC;4BAChB,IAAI,CAAC,IAAI,CAAC;gCACR,UAAU,EAAE,6BAA6B;gCACzC,QAAQ,EAAE,WAAW,CAAC,EAAE;gCACxB,KAAK,EAAE,IAAI,CAAC,SAAS,GAAG,CAAC;gCACzB,GAAG,EAAE,IAAI,CAAC,OAAO,GAAG,CAAC;6BACtB,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,iBAAiB,CAAC,IAAI;gBACpB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC;wBACR,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBACrB,KAAK,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;wBAClD,GAAG,EAAE,IAAI,CAAC,WAAW;qBACtB,CAAC,CAAC;oBACH,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACtD,IAAI,YAAY,EAAE,CAAC;wBACjB,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAC/B,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CACtD,CAAC;wBACF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;4BAC3C,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;4BACzD,IAAI,WAAW,EAAE,CAAC;gCAChB,IAAI,CAAC,IAAI,CAAC;oCACR,UAAU,EAAE,6BAA6B;oCACzC,QAAQ,EAAE,WAAW,CAAC,EAAE;oCACxB,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;oCAC7B,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC;iCAC1B,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,cAAc,CAAC,IAAI;gBACjB,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBACvD,IAAI,QAAQ,EAAE,CAAC;oBACb,IAAI,CAAC,IAAI,CAAC;wBACR,UAAU,EAAE,QAAQ,CAAC,UAAU;wBAC/B,QAAQ,EAAE,QAAQ,CAAC,EAAE;wBACrB,KAAK,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM;wBAClD,GAAG,EAAE,IAAI,CAAC,WAAW;qBACtB,CAAC,CAAC;oBACH,gDAAgD;oBAChD,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;oBACtD,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0B,CAAC;oBAC7D,IAAI,YAAY,EAAE,CAAC;wBACjB,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;4BAC1C,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC/C,CAAC;oBACH,CAAC;oBACD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;wBACxC,wDAAwD;wBACxD,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;wBAC7D,IAAI,YAAY,EAAE,CAAC;4BACjB,IAAI,CAAC,IAAI,CAAC;gCACR,UAAU,EAAE,0BAA0B;gCACtC,QAAQ,EAAE,YAAY,CAAC,EAAE;gCACzB,KAAK,EAAE,SAAS,CAAC,UAAU;gCAC3B,GAAG,EAAE,SAAS,CAAC,QAAQ;6BACxB,CAAC,CAAC;wBACL,CAAC;wBACD,2CAA2C;wBAC3C,IACE,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU;4BACnC,SAAS,CAAC,KAAK,CAAC,MAAM,KAAK,OAAO,EAClC,CAAC;4BACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;4BACrD,IAAI,KAAK,EAAE,CAAC;gCACV,IAAI,CAAC,IAAI,CAAC;oCACR,UAAU,EAAE,0BAA0B;oCACtC,QAAQ,EAAE,KAAK,CAAC,EAAE;oCAClB,KAAK,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM;oCACzD,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG;iCACzB,CAAC,CAAC;4BACL,CAAC;wBACH,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YACD,eAAe;gBACb,uBAAuB;YACzB,CAAC;YACD,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK;gBAC9B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAClB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;SACF,CAAC;QAEF,yBAAyB,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAE1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACK,WAAW,CACjB,UAA6B,EAC7B,aAAyE;QAEzE,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CAAC;QAEtC,6DAA6D;QAC7D,oEAAoE;QACpE,mEAAmE;QACnE,kCAAkC;QAClC,KAAK,IAAI,GAAG,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,GAAG,EAAE,EAAE,CAAC;YAChD,IAAI,OAAO,GAAY,UAAU,CAAC;YAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC7B,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;oBAC9C,MAAM;gBACR,CAAC;gBACD,OAAO,GAAI,OAA4C,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,IACE,OAAO,KAAK,IAAI;gBAChB,OAAO,KAAK,SAAS;gBACrB,OAAO,OAAO,KAAK,QAAQ;gBAC3B,MAAM,IAAI,OAAO;gBACjB,OAAQ,OAAmC,CAAC,IAAI,KAAK,QAAQ,EAC7D,CAAC;gBACD,OAAO,OAAsB,CAAC;YAChC,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,mCAAmC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,eAAe,CACrB,UAA6B,EAC7B,aAAyE;QAEzE,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;QAE1D,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,CACxC,CAAC,CAAC,EAAoB,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CACpD,CAAC;QAEF,OAAO,2BAA2B,CAChC;YACE,EAAE,EAAE,KAAK,CAAC,EAAE;YACZ,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM;YAC1B,KAAK,EAAE,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,EAAE;SAC5C,EACD,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,UAAU;YACxB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM;YACtB,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE;SACxC,CAAC,CAAC,CACJ,CAAC;IACJ,CAAC;CACF"}

package/dist/{schema/models → expression-parsers}/authorizer/authorizer-expression-validator.d.ts

@@ -8,7 +8,6 @@
  */
 import type { PluginSpecStore } from '#src/plugins/index.js';
 import type { RefExpressionWarning } from '#src/references/expression-types.js';
-import type { ModelConfig } from '../models.js';
 import type { AuthorizerExpressionNode } from './authorizer-expression-ast.js';
 /**
  * Information about a model relation for nested authorizer validation.
@@ -20,6 +19,12 @@ export interface RelationValidationInfo {
     foreignModelName: string;
     /** Set of role names defined on the foreign model's authorizer */
     foreignAuthorizerRoleNames: Set<string>;
+    /** Scalar field names on the foreign model (for relation filter condition validation) */
+    foreignScalarFieldNames?: Set<string>;
+    /** Field type map for the foreign model (for type-checking relation filter condition values) */
+    foreignFieldTypes?: Map<string, string>;
+    /** Whether this is a local relation (FK on this model) or foreign/reverse (FK on the other model) */
+    direction: 'local' | 'foreign';
 }
 /**
  * Model information needed for validation.
@@ -55,20 +60,11 @@ export interface ModelValidationContext {
  */
 export declare function validateAuthorizerExpression(ast: AuthorizerExpressionNode, modelContext: ModelValidationContext, pluginStore: PluginSpecStore, definition: unknown): RefExpressionWarning[];
 /**
- * Build relation validation info from model relations and the full list of models.
- *
+ * Shape of a model for expression context building.
  * Uses structural typing so both raw JSON shapes and typed `ModelConfig` objects
  * can be passed directly.
- *
- * @param modelRelations - The relations on the current model
- * @param allModels - All models in the project (for foreign model lookup)
- * @returns Map of relation name → validation info
  */
-export declare function buildRelationValidationInfo(modelRelations: readonly {
-    name: string;
-    modelRef: string;
-    references: readonly unknown[];
-}[], allModels: readonly {
+interface ExpressionContextModel {
     id?: string;
     name: string;
     authorizer?: {
@@ -76,12 +72,36 @@ export declare function buildRelationValidationInfo(modelRelations: readonly {
             name: string;
         }[];
     };
-}[]): Map<string, RelationValidationInfo>;
+    /** Top-level fields (used by raw JSON shapes) */
+    fields?: readonly {
+        name: string;
+        type?: string;
+    }[];
+    model?: {
+        /** Nested fields (used by typed ModelConfig objects) */
+        fields?: readonly {
+            name: string;
+            type?: string;
+        }[];
+        relations?: readonly {
+            name: string;
+            modelRef: string;
+            foreignRelationName?: string;
+            references?: readonly unknown[];
+        }[];
+    };
+}
 /**
- * Extract model validation context from a model configuration.
+ * Build complete model expression context from a model and all project models.
+ *
+ * This is the primary entry point for building validation and autocomplete context.
+ * It discovers both local relations (FK on this model) and foreign/reverse relations
+ * (FK on other models pointing to this model) for use with `hasRole()`, `exists()`, `all()`, etc.
  *
- * @param modelConfig - The parsed model configuration
- * @returns Model validation context for the validator
+ * @param model - The current model (structural typing: works with both typed ModelConfig and raw JSON)
+ * @param allModels - All models in the project
+ * @returns Complete model validation context including all relations
  */
-export declare function createModelValidationContext(modelConfig: ModelConfig): ModelValidationContext;
+export declare function buildModelExpressionContext(model: ExpressionContextModel, allModels: readonly ExpressionContextModel[]): ModelValidationContext;
+export {};
 //# sourceMappingURL=authorizer-expression-validator.d.ts.map

package/dist/expression-parsers/authorizer/authorizer-expression-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorizer-expression-validator.d.ts","sourceRoot":"","sources":["../../../src/expression-parsers/authorizer/authorizer-expression-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAKhF,OAAO,KAAK,EACV,wBAAwB,EAGzB,MAAM,gCAAgC,CAAC;AAKxC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC;IACvB,8CAA8C;IAC9C,gBAAgB,EAAE,MAAM,CAAC;IACzB,kEAAkE;IAClE,0BAA0B,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACxC,yFAAyF;IACzF,uBAAuB,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,gGAAgG;IAChG,iBAAiB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qGAAqG;IACrG,SAAS,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,0CAA0C;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,mDAAmD;IACnD,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B,iEAAiE;IACjE,UAAU,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,qFAAqF;IACrF,YAAY,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACpD;AAyCD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,4BAA4B,CAC1C,GAAG,EAAE,wBAAwB,EAC7B,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,OAAO,GAClB,oBAAoB,EAAE,CA6SxB;AAED;;;;GAIG;AACH,UAAU,sBAAsB;IAC9B,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAA;SAAE,EAAE,CAAA;KAAE,CAAC;IACrD,iDAAiD;IACjD,MAAM,CAAC,EAAE,SAAS;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE;QACN,wDAAwD;QACxD,MAAM,CAAC,EAAE,SAAS;YAAE,IAAI,EAAE,MAAM,CAAC;YAAC,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,EAAE,CAAC;QACpD,SAAS,CAAC,EAAE,SAAS;YACnB,IAAI,EAAE,MAAM,CAAC;YACb,QAAQ,EAAE,MAAM,CAAC;YACjB,mBAAmB,CAAC,EAAE,MAAM,CAAC;YAC7B,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;SACjC,EAAE,CAAC;KACL,CAAC;CACH;AA2CD;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,sBAAsB,EAC7B,SAAS,EAAE,SAAS,sBAAsB,EAAE,GAC3C,sBAAsB,CAwExB"}