@ditojs/server 2.30.1 → 2.30.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ditojs/server",
-  "version": "2.30.1",
+  "version": "2.30.3",
   "type": "module",
   "description": "Dito.js Server – Dito.js is a declarative and modern web framework, based on Objection.js, Koa.js and Vue.js",
   "repository": "https://github.com/ditojs/dito/tree/master/packages/server",
@@ -90,7 +90,7 @@
     "typescript": "^5.4.5"
   },
   "types": "types",
-  "gitHead": "39fbb6da77e7d90265fce7cd7cd7e92b3b034803",
+  "gitHead": "7ea9e5bd85295f299825a8560dc25caee1cc94d2",
   "scripts": {
     "types": "tsc --noEmit --esModuleInterop ./types/index.d.ts"
   },

package/src/models/Model.js

@@ -748,7 +748,12 @@ export class Model extends objection.Model {
   static modifierNotFound(query, modifier) {
     if (isString(modifier)) {
       if (query.modelClass().hasScope(modifier)) {
-        return query.applyScope(modifier)
+        return query.applyScope(
+          modifier,
+          // Pass `false` for `checkAllowedScopes`, to always allow scopes
+          // that are defined on relations to be applied.
+          false
+        )
       }
       // Now check possible scope prefixes and handle them:
       switch (modifier[0]) {
@@ -756,7 +761,12 @@ export class Model extends objection.Model {
           // Always apply eager-scopes, even if the model itself doesn't know
           // it. The scope may still be known in eager-loaded relations.
           // Note: `applyScope()` will handle the '^' sign.
-          return query.applyScope(modifier)
+          return query.applyScope(
+            modifier,
+            // Pass `false` for `checkAllowedScopes`, to always allow scopes
+            // that are defined on relations to be applied.
+            false
+          )
         case '-': // Ignore scope:
           return query.ignoreScope(modifier.slice(1))
         case '#': // Select column:

package/src/query/QueryBuilder.js

@@ -88,7 +88,7 @@ export class QueryBuilder extends objection.QueryBuilder {
     return super.toFindQuery().clear('runAfter')
   }
 
-  withScope(...args) {
+  #withScope(...args) {
     const { checkAllowedScopes, scopes } = getScopes(args)
     for (const expr of scopes) {
       if (expr) {
@@ -105,6 +105,11 @@ export class QueryBuilder extends objection.QueryBuilder {
         this.#scopes[scope] ||= graph
       }
     }
+    return scopes
+  }
+
+  withScope(...args) {
+    this.#withScope(...args)
     return this
   }
 
@@ -131,11 +136,10 @@ export class QueryBuilder extends objection.QueryBuilder {
   }
 
   applyScope(...args) {
-    // When directly applying a scope, still merge it into `this.#scopes`,
-    // so it can still be passed on to forked child queries. This also handles
-    // the checks against `_allowScopes`.
-    this.withScope(...args)
-    for (const expr of getScopes(args).scopes) {
+    // When directly applying a scope, still use `#withScope() to merge it into
+    // `this.#scopes`, so it can still be passed on to forked child queries.
+    // This also handles the checks against `#allowScopes`.
+    for (const expr of this.#withScope(...args)) {
       if (expr) {
         const { scope, graph } = getScope(expr)
         this.#applyScope(scope, graph)
@@ -171,7 +175,7 @@ export class QueryBuilder extends objection.QueryBuilder {
 
   #copyScopes(query, isChildQuery = false) {
     const isSameModelClass = this.modelClass() === query.modelClass()
-    // Only copy `_allowScopes` and `_ignoreScopes` if it's for the same model.
+    // Only copy `#allowScopes` and `_ignoreScopes` if it's for the same model.
     if (isSameModelClass) {
       this.#allowScopes = query.#allowScopes ? { ...query.#allowScopes } : null
       this.#ignoreScopes = { ...query.#ignoreScopes }
@@ -205,9 +209,9 @@ export class QueryBuilder extends objection.QueryBuilder {
       // If this isn't a normal find query, ignore all graph operations,
       // to not mess with special selects such as `count`, etc:
       this.#ignoreGraph = !isNormalFind
-      // All scopes in `_scopes` were already checked against `_allowScopes`.
+      // All scopes in `_scopes` were already checked against `#allowScopes`.
       // They themselves are allowed to apply / request other scopes that
-      // aren't listed, so clear `_allowScopes` and restore again after:
+      // aren't listed, so clear `#allowScopes` and restore again after:
       const allowScopes = this.#allowScopes
       this.#allowScopes = null
       const collectedScopes = {}
@@ -263,7 +267,12 @@ export class QueryBuilder extends objection.QueryBuilder {
           const name = `^${scope}`
           const modifiers = {
             [name]: query => {
-              query.withScope(name)
+              query.withScope(
+                name,
+                // Pass `false` for `checkAllowedScopes` as when `#applyScope()`
+                // was called, no further checks are required.
+                false
+              )
               if (query.#isJoinChildQuery) {
                 // Join child queries are never executed, and need to apply
                 // their scopes manually. Note that it's OK to call this
@@ -852,15 +861,14 @@ for (const key of [
   }
 }
 
-function getScopes(args) {
-  const last = args.at(-1)
-  let scopes = args
+function getScopes(scopes) {
   let checkAllowedScopes = true
+  const last = scopes.at(-1)
   if (isBoolean(last)) {
     checkAllowedScopes = last
-    scopes = args.slice(0, -1)
+    scopes = scopes.slice(0, -1)
   }
-  return { scopes, checkAllowedScopes }
+  return { checkAllowedScopes, scopes }
 }
 
 function filterScopes(scopes, callback) {