@classytic/arc 2.41.1 → 2.44.0

package/dist/multiTenant-CAtYlW6H.d.mts

@@ -0,0 +1,104 @@
+
+import { G as CrudRouteKey, W as PresetResult } from "./index-WH7xgvxS.mjs";
+//#region src/permissions/tenantPreparation.d.ts
+type TenantFieldSpec = {
+  field: string;
+  type: "org";
+} | {
+  field: string;
+  type: "team";
+} | {
+  field: string;
+  contextKey: string;
+};
+//#endregion
+//#region src/presets/multiTenant.d.ts
+interface MultiTenantOptions {
+  /**
+   * Single-field form: name of the database field to filter by.
+   * Reads `getOrgId(scope)` as the value source.
+   *
+   * Mutually exclusive with `tenantFields` — pass one or the other, not both.
+   *
+   * @default 'organizationId'
+   */
+  tenantField?: string;
+  /**
+   * Multi-field form (2.7.1+): list of tenant dimensions to filter by in
+   * lockstep. Use this when a resource is scoped by more than just
+   * organization — e.g. organization + branch, organization + project,
+   * or organization + team + workspace.
+   *
+   * Each entry is a discriminated `TenantFieldSpec` declaring where the
+   * value comes from. Use `type: 'org'` / `type: 'team'` for built-in scope
+   * fields, or `contextKey: '...'` to read from `scope.context` (set by
+   * your auth function).
+   *
+   * Fail-closed: if any required dimension is missing, the request is
+   * rejected. Elevated scopes apply whatever resolves and skip the rest.
+   *
+   * Mutually exclusive with `tenantField`.
+   *
+   * @example
+   * ```typescript
+   * multiTenantPreset({
+   *   tenantFields: [
+   *     { field: 'organizationId', type: 'org' },
+   *     { field: 'branchId',       contextKey: 'branchId' },
+   *   ],
+   * })
+   * ```
+   */
+  tenantFields?: readonly TenantFieldSpec[];
+  /**
+   * Routes that allow public access (no auth required)
+   * When a route is in this array:
+   * - If no org context: allow through without filtering (public data)
+   * - If org context present: require auth and apply filter
+   *
+   * @default [] (strict mode - all routes require auth)
+   * @example
+   * multiTenantPreset({ allowPublic: ['list', 'get'] })
+   */
+  allowPublic?: CrudRouteKey[];
+  /**
+   * Reads that are NOT scoped to a tenant at all — a marketplace listing.
+   *
+   * `allowPublic` answers "may an anonymous caller reach this route?". That is a different
+   * question from "is this listing scoped to a tenant?", and until this option there was no way
+   * to answer the second one with "no". An `allowPublic` route still filters by the caller's
+   * organization whenever they have one, and a signed-in user of a multi-org product ALWAYS has
+   * one, because choosing an organization writes it onto the session. So a cross-tenant catalog
+   * silently became single-tenant the moment one of its own sellers browsed it: the same URL,
+   * with no header and no query parameter to explain the difference, returned a different world
+   * depending on who was asking.
+   *
+   * The only escape was to drop this preset from the resource entirely, which also drops tenant
+   * INJECTION on create/update — the thing that stops a member moving a document into another
+   * organization. Trading a write guarantee for a read behaviour is not a real choice.
+   *
+   * Listed routes get no tenant middleware: no filter, and nothing stashed for the repo layer.
+   * Everything else keeps its filter, so writes are unaffected.
+   *
+   * READS ONLY, by type. A cross-tenant `create` or `update` is not a listing, it is an escape
+   * from tenancy, and it should never be one option away by accident.
+   *
+   * THIS DOES NOT AUTHORIZE ANYTHING. Removing the tenant filter widens what the query can
+   * return, so the resource owes a row-level `policy` from its permission check saying what a
+   * stranger may see (`{ status: 'active' }`, `{ visibility: 'public' }`). Declaring this without
+   * one publishes every row in every tenant.
+   *
+   * @default []
+   * @example
+   * // A public catalog: anyone may browse every seller's LIVE products,
+   * // while create/update/delete stay pinned to the caller's own shop.
+   * multiTenantPreset({
+   *   allowPublic: ['list', 'get'],
+   *   crossTenant: ['list', 'get'],
+   * })
+   */
+  crossTenant?: readonly Extract<CrudRouteKey, "list" | "get">[];
+}
+declare function multiTenantPreset(options?: MultiTenantOptions): PresetResult;
+//#endregion
+export { multiTenantPreset as n, TenantFieldSpec as r, MultiTenantOptions as t };

package/dist/{multipartBody-DtRWM6_U.mjs → multipartBody-Cc7eZ9cq.mjs}

@@ -1,6 +1,41 @@
-/*! @classytic/arc v2.41.1 | MIT | https://classytic.com */
+/*! @classytic/arc v2.44.0 | MIT | https://classytic.com */
+import { ARC_ERROR_CODES } from "@classytic/repo-core/errors";
 import sjson from "secure-json-parse";
 //#region src/middleware/multipartBody.ts
+/**
+* Multipart Body Middleware — Opt-in multipart/form-data parsing for CRUD routes.
+*
+* Parses multipart form fields into `req.body` and attaches files to `req.body._files`.
+* Use with a `before:create` or `before:update` hook to process files (upload to S3, etc.)
+* before BaseController persists the record.
+*
+* Requires `@fastify/multipart` to be registered on the Fastify instance
+* (Arc registers it by default via `createApp()` unless `multipart: false`).
+*
+* @example
+* ```typescript
+* import { defineResource } from '@classytic/arc';
+* import { multipartBody } from '@classytic/arc/middleware';
+*
+* const productResource = defineResource({
+*   name: 'product',
+*   adapter,
+*   middlewares: {
+*     create: [multipartBody()],
+*     update: [multipartBody()],
+*   },
+*   hooks: {
+*     'before:create': async (data) => {
+*       if (data._files?.image) {
+*         data.imageUrl = await uploadToS3(data._files.image);
+*         delete data._files;
+*       }
+*       return data;
+*     },
+*   },
+* });
+* ```
+*/
 const DEFAULT_MAX_FILE_SIZE = 10485760;
 const DEFAULT_MAX_FILES = 5;
 const DEFAULT_MAX_TOTAL_BYTES = 26214400;
@@ -78,19 +113,19 @@ function multipartBody(options = {}) {
 			for await (const part of parts) if (part.type === "file") {
 				if (fileCount >= maxFiles) continue;
 				if (mimeMatcher && !mimeMatcher.matches(part.mimetype)) return reply.code(415).send({
-					code: "arc.unsupported_media_type",
+					code: ARC_ERROR_CODES.UNSUPPORTED_MEDIA_TYPE,
 					message: `File type '${part.mimetype}' not allowed. Accepted: ${mimeMatcher.describe()}`,
 					status: 415
 				});
 				const buffer = await part.toBuffer();
 				if (buffer.length > maxFileSize) return reply.code(413).send({
-					code: "arc.payload_too_large",
+					code: ARC_ERROR_CODES.PAYLOAD_TOO_LARGE,
 					message: `File '${part.filename}' exceeds maximum size of ${Math.round(maxFileSize / 1024 / 1024)}MB`,
 					status: 413
 				});
 				totalBytes += buffer.length;
 				if (totalBytes > maxTotalBytes) return reply.code(413).send({
-					code: "arc.payload_too_large",
+					code: ARC_ERROR_CODES.PAYLOAD_TOO_LARGE,
 					message: `Combined upload size exceeds ${Math.round(maxTotalBytes / 1024 / 1024)}MB per request`,
 					status: 413
 				});
@@ -106,7 +141,7 @@ function multipartBody(options = {}) {
 		} catch (err) {
 			request.log.error({ err }, "multipartBody: failed to parse multipart form");
 			return reply.code(400).send({
-				code: "arc.bad_request",
+				code: ARC_ERROR_CODES.BAD_REQUEST,
 				message: "Failed to parse multipart form data",
 				status: 400
 			});
@@ -114,10 +149,14 @@ function multipartBody(options = {}) {
 		if (requiredFields) {
 			const missing = requiredFields.filter((name) => !(name in files));
 			if (missing.length > 0) return reply.code(400).send({
-				code: "MISSING_FILE_FIELDS",
+				code: ARC_ERROR_CODES.VALIDATION_ERROR,
 				message: `Missing required file field${missing.length > 1 ? "s" : ""}: ${missing.join(", ")}`,
 				status: 400,
-				details: { missing }
+				details: missing.map((name) => ({
+					path: name,
+					code: "required",
+					message: `File field "${name}" is required`
+				}))
 			});
 		}
 		if (fileCount > 0) body[filesKey] = files;