@classytic/mongokit 3.39.0 → 3.40.1

package/dist/{timestamp.plugin-B5eiaItQ.mjs → timestamp.plugin-zfdLYZiO.mjs}

@@ -1,5 +1,6 @@
-import { c as ALL_OPERATIONS, t as HOOK_PRIORITY, u as OP_REGISTRY } from "./Repository-D7fDpyFx.mjs";
+import { i as ALL_OPERATIONS, o as OP_REGISTRY, t as HOOK_PRIORITY } from "./Repository-CYhSC9ut.mjs";
 import { n as warn } from "./logger-K7dPmu2U.mjs";
+import { n as declareCollectionScope } from "./join-scope-DSAznE8E.mjs";
 import { throwIfAborted, withRetry } from "@classytic/repo-core/repository";
 import mongoose from "mongoose";
 import { cachePlugin } from "@classytic/repo-core/cache";
@@ -754,6 +755,33 @@ async function getNextSequence(counterKey, increment = 1, connection, session) {
 	return result.seq;
 }
 /**
+* Current value of a counter, or `null` when it has never been created.
+* `null` and `0` differ: only a missing counter needs seeding.
+*/
+async function readSequence(counterKey, connection) {
+	const doc = await getCounterModel(connection).findById(counterKey).lean();
+	return doc ? doc.seq : null;
+}
+/**
+* Raise a counter to at least `floor` — never lowers it. Atomic (`$max` +
+* upsert), so concurrent seeders converge on the highest floor.
+*
+* Use before a counter's first increment when ids were already issued under
+* another key (e.g. moving from a global to a per-tenant sequence); otherwise
+* the new counter restarts at 1 and re-issues taken ids.
+*
+* @returns The counter's value after the raise.
+*/
+async function ensureSequenceAtLeast(counterKey, floor, connection) {
+	if (!Number.isSafeInteger(floor) || floor < 0) throw new Error(`ensureSequenceAtLeast: floor must be a non-negative integer, got ${floor}`);
+	const result = await getCounterModel(connection).findOneAndUpdate({ _id: counterKey }, { $max: { seq: floor } }, {
+		upsert: true,
+		returnDocument: "after"
+	});
+	if (!result) throw new Error(`Failed to seed counter '${counterKey}'`);
+	return result.seq;
+}
+/**
 * Generator: Simple sequential counter.
 * Produces IDs like `INV-0001`, `INV-0002`, etc.
 *
@@ -930,6 +958,62 @@ function customIdPlugin(options) {
 	};
 }
 //#endregion
+//#region src/utils/scope.ts
+/** Tenant context keys forwarded even when no tenant plugin declared one. */
+const CONVENTIONAL_TENANT_KEYS = ["organizationId", "tenantId"];
+const ATTRIBUTION_KEYS = [
+	"session",
+	"user",
+	"userId",
+	"requestId"
+];
+/** Where a repository records the tenant context keys its plugins read. */
+const TENANT_KEYS = Symbol.for("@classytic/mongokit/tenant-context-keys");
+/**
+* Record that `repo` resolves its tenant from `contextKey`. Called by
+* `multiTenantPlugin` at bind, so forwarding knows a custom key (`branchId`)
+* without the host restating it.
+*/
+function declareTenantContextKey(repo, contextKey) {
+	const holder = repo;
+	if (!holder[TENANT_KEYS]) Object.defineProperty(holder, TENANT_KEYS, {
+		value: /* @__PURE__ */ new Set(),
+		enumerable: false
+	});
+	holder[TENANT_KEYS]?.add(contextKey);
+}
+/** Every tenant context key relevant to a call spanning these repositories. */
+function tenantContextKeysOf(...repos) {
+	const keys = new Set(CONVENTIONAL_TENANT_KEYS);
+	for (const repo of repos) for (const key of repo?.[TENANT_KEYS] ?? []) keys.add(key);
+	return [...keys];
+}
+/**
+* The scope to hand a second repository call made on behalf of `source`
+* (a hook's `RepositoryContext`, or a host's request context).
+*
+* Absent values are omitted, never written as `undefined`, so spreading the
+* result into an options bag cannot erase a value set there.
+*/
+function forwardScope(source, tenantKeys = CONVENTIONAL_TENANT_KEYS) {
+	if (!source) return {};
+	const out = {};
+	let hasTenant = false;
+	for (const key of tenantKeys) {
+		const value = source[key];
+		if (value === void 0) continue;
+		out[key] = value;
+		if (value !== null && value !== "") hasTenant = true;
+	}
+	if (!hasTenant && source.bypassTenant === true) out.bypassTenant = true;
+	for (const key of ATTRIBUTION_KEYS) if (source[key] !== void 0) out[key] = source[key];
+	return out;
+}
+/** Every key `forwardScope` governs. Other forwarding helpers must not copy these themselves. */
+function isScopeKey(key, tenantKeys = CONVENTIONAL_TENANT_KEYS) {
+	return key === "bypassTenant" || tenantKeys.includes(key) || ATTRIBUTION_KEYS.includes(key);
+}
+//#endregion
 //#region src/plugins/multi-tenant.plugin.ts
 /**
 * Multi-Tenant Plugin
@@ -983,6 +1067,42 @@ function multiTenantPlugin(options = {}) {
 	return {
 		name: "multi-tenant",
 		apply(repo) {
+			declareTenantContextKey(repo, contextKey);
+			/** The one tenant decision, shared by the hook and the join rule below. */
+			const decide = (context, op) => {
+				if (context.bypassTenant === true) return { bypass: "option" };
+				if (skipWhen?.(context, op) === true) return { bypass: "callback" };
+				let tenantId = context[contextKey];
+				if (!tenantId && resolveContext) tenantId = resolveContext();
+				return { tenantId };
+			};
+			const castTenant = (tenantId) => fieldType === "objectId" ? new mongoose.Types.ObjectId(tenantId) : tenantId;
+			const missingTenant = (op) => new Error([
+				`[mongokit] Multi-tenant: Missing '${contextKey}' in context for '${op}'.`,
+				"",
+				"Three ways to provide it — pick the one that fits the call site:",
+				"",
+				`  1. Per-call:        repo.${op}(..., { ${contextKey}: '<id>' })`,
+				"  2. Ambient (ALS):   `createTenantContext()` + `resolveContext` —",
+				"                       wrap the request in `tenantContext.run({ tenantId }, fn)`,",
+				"                       then every repo call inside the closure inherits the",
+				"                       tenant with no options-bag plumbing. See",
+				"                       `createTenantContext` in @classytic/mongokit.",
+				"  3. Cross-tenant:    `bypassTenant: true` per-call (admin / migration /",
+				"                       support), or `skipWhen: adminBypass({...})` at plugin",
+				"                       construction for an always-on role-based bypass.",
+				"",
+				"Or set `required: false` if this collection is genuinely not tenant-scoped."
+			].join("\n"));
+			if (repo.Model) declareCollectionScope(repo.Model, (context, op) => {
+				const d = decide(context, op);
+				if ("bypass" in d) return void 0;
+				if (!d.tenantId) {
+					if (required) throw missingTenant(op);
+					return;
+				}
+				return { [tenantField]: castTenant(d.tenantId) };
+			}, { tenantField });
 			const allOps = [...ALL_OPERATIONS.map((op) => ({
 				op,
 				policyKey: OP_REGISTRY[op].policyKey
@@ -991,41 +1111,21 @@ function multiTenantPlugin(options = {}) {
 				if (skipOperations.includes(op)) continue;
 				if (policyKey === "none") continue;
 				repo.on(`before:${op}`, (context) => {
-					const perCallBypass = context.bypassTenant === true;
-					const callbackBypass = !perCallBypass && skipWhen?.(context, op) === true;
-					if (perCallBypass || callbackBypass) {
+					const decision = decide(context, op);
+					if ("bypass" in decision) {
 						repo.emit("after:tenant-bypass", {
 							context,
 							operation: op,
-							reason: perCallBypass ? "option" : "callback"
+							reason: decision.bypass
 						});
 						return;
 					}
-					let tenantId = context[contextKey];
-					if (!tenantId && resolveContext) {
-						tenantId = resolveContext();
-						if (tenantId) context[contextKey] = tenantId;
-					}
+					const tenantId = decision.tenantId;
+					if (tenantId && !context[contextKey]) context[contextKey] = tenantId;
 					if (!tenantId && allowDataInjection && payloadHasTenantField(context, policyKey, tenantField)) return;
-					if (!tenantId && required) throw new Error([
-						`[mongokit] Multi-tenant: Missing '${contextKey}' in context for '${op}'.`,
-						"",
-						"Three ways to provide it — pick the one that fits the call site:",
-						"",
-						`  1. Per-call:        repo.${op}(..., { ${contextKey}: '<id>' })`,
-						"  2. Ambient (ALS):   `createTenantContext()` + `resolveContext` —",
-						"                       wrap the request in `tenantContext.run({ tenantId }, fn)`,",
-						"                       then every repo call inside the closure inherits the",
-						"                       tenant with no options-bag plumbing. See",
-						"                       `createTenantContext` in @classytic/mongokit.",
-						"  3. Cross-tenant:    `bypassTenant: true` per-call (admin / migration /",
-						"                       support), or `skipWhen: adminBypass({...})` at plugin",
-						"                       construction for an always-on role-based bypass.",
-						"",
-						"Or set `required: false` if this collection is genuinely not tenant-scoped."
-					].join("\n"));
+					if (!tenantId && required) throw missingTenant(op);
 					if (!tenantId) return;
-					const castId = fieldType === "objectId" ? new mongoose.Types.ObjectId(tenantId) : tenantId;
+					const castId = castTenant(tenantId);
 					const assertTenantValue = (supplied, where) => {
 						if (onMismatch === "overwrite") return;
 						if (supplied === void 0 || supplied === null) return;
@@ -1234,6 +1334,7 @@ function softDeletePlugin(options = {}) {
 	return {
 		name: "softDelete",
 		apply(repo) {
+			if (repo.Model) declareCollectionScope(repo.Model, () => buildDeletedFilter(deletedField, filterMode, false));
 			try {
 				const schemaPaths = repo.Model.schema.paths;
 				if (!schemaPaths[deletedField]) warn(`[softDeletePlugin] Model '${repo.Model.modelName}' has no '${deletedField}' schema path. Soft-delete marks documents by \`$set\`-ing '${deletedField}', but Mongoose strict mode drops updates to undeclared paths — so delete() will SILENTLY no-op (documents are never soft-deleted). Declare it on the schema: { ${deletedField}: { type: Date, default: ${filterMode === "null" ? "null" : "undefined"} } }`);
@@ -1294,7 +1395,8 @@ function softDeletePlugin(options = {}) {
 			const SOFT_DELETE_SPECIAL = /* @__PURE__ */ new Set([
 				"updateMany",
 				"deleteMany",
-				"bulkWrite"
+				"bulkWrite",
+				"bulkUpsert"
 			]);
 			for (const op of ALL_OPERATIONS) {
 				if (SOFT_DELETE_SPECIAL.has(op)) continue;
@@ -1325,7 +1427,7 @@ function softDeletePlugin(options = {}) {
 			* `deleteMode: 'hard'` still bypasses, exactly as the single-doc path does — a purge
 			* is a deliberate physical delete, and it reaches the driver directly anyway.
 			*/
-			repo.on("before:bulkWrite", (context) => {
+			const scopeSubOps = (context) => {
 				if (options.soft === false || context.deleteMode === "hard") return;
 				const ops = context.operations;
 				if (!Array.isArray(ops)) return;
@@ -1356,7 +1458,8 @@ function softDeletePlugin(options = {}) {
 						delete subOp[key];
 					}
 				}
-			}, { priority: HOOK_PRIORITY.POLICY });
+			};
+			for (const op of ["bulkWrite", "bulkUpsert"]) repo.on(`before:${op}`, scopeSubOps, { priority: HOOK_PRIORITY.POLICY });
 			repo.on("before:deleteMany", async (context) => {
 				if (context.deleteMode === "hard") return;
 				if (options.soft !== false) {
@@ -1500,4 +1603,4 @@ function timestampPlugin() {
 	};
 }
 //#endregion
-export { customIdPlugin as a, prefixedId as c, AuditTrailQuery as d, auditTrailPlugin as f, multiTenantPlugin as i, sequentialId as l, auditLogPlugin as m, softDeletePlugin as n, dateSequentialId as o, ensureAuditTrailReady as p, adminBypass$1 as r, getNextSequence as s, timestampPlugin as t, cachePlugin as u };
+export { AuditTrailQuery as _, declareTenantContextKey as a, auditLogPlugin as b, tenantContextKeysOf as c, ensureSequenceAtLeast as d, getNextSequence as f, cachePlugin as g, sequentialId as h, multiTenantPlugin as i, customIdPlugin as l, readSequence as m, softDeletePlugin as n, forwardScope as o, prefixedId as p, adminBypass$1 as r, isScopeKey as s, timestampPlugin as t, dateSequentialId as u, auditTrailPlugin as v, ensureAuditTrailReady as y };

package/dist/{to-plain-B8ufk3Qz.d.mts → to-plain-CjgEInWV.d.mts}

@@ -1,5 +1,5 @@
-import { v as UserContext } from "./repository-ZbLtL7Nk.mjs";
-import { r as FieldPreset } from "./plugin-options-BuvtOSZf.mjs";
+import { v as UserContext } from "./repository-DNHfjAZX.mjs";
+import { r as FieldPreset } from "./plugin-options-CRhIvSzx.mjs";
 import mongoose, { Schema } from "mongoose";
 import { CacheAdapter } from "@classytic/repo-core/cache";
 import { HttpError } from "@classytic/repo-core/errors";