@dyrected/core 2.6.3 → 2.7.0

package/dist/__tests__/access-features.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-features.test.d.ts.map

package/dist/__tests__/access-features.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-features.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/access-features.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/access-features.test.js

@@ -0,0 +1,159 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { signCollectionToken } from "../auth/token.js";
+import { defineCollection, defineConfig } from "../index.js";
+import { InMemoryAdapter } from "./mocks.js";
+beforeAll(() => {
+    process.env.DYRECTED_JWT_SECRET = "test-secret";
+});
+async function adminHeaders(sub = "admin-1") {
+    const token = await signCollectionToken({ sub, email: `${sub}@example.com`, collection: "users" });
+    return { Authorization: `Bearer ${token}` };
+}
+describe("readAudit access", () => {
+    it("gates the audit log independently of read", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [{ id: "admin-1", email: "admin-1@example.com", roles: ["admin"] }]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            globals: [],
+            collections: [
+                defineCollection({ slug: "users", auth: true, fields: [{ name: "email", type: "email" }, { name: "roles", type: "select", hasMany: true, options: ["admin"] }] }),
+                defineCollection({
+                    slug: "posts",
+                    audit: true,
+                    access: {
+                        read: true, // anyone can read documents
+                        readAudit: "'admin' in user.roles", // but only admins can read the audit trail
+                    },
+                    fields: [{ name: "title", type: "text" }],
+                }),
+            ],
+        }));
+        // Anyone can read documents...
+        const listRes = await app.request("/api/collections/posts");
+        expect(listRes.status).toBe(200);
+        // ...but an anonymous caller cannot read the audit log.
+        const anonAudit = await app.request("/api/collections/posts/__audit");
+        expect(anonAudit.status).toBe(403);
+        // An admin can.
+        const adminAudit = await app.request("/api/collections/posts/__audit", { headers: await adminHeaders() });
+        expect(adminAudit.status).toBe(200);
+    });
+    it("falls back to the read rule when readAudit is not set", async () => {
+        const db = new InMemoryAdapter();
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            globals: [],
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    audit: true,
+                    access: { read: "user != null" }, // audit inherits this
+                    fields: [{ name: "title", type: "text" }],
+                }),
+            ],
+        }));
+        const anon = await app.request("/api/collections/posts/__audit");
+        expect(anon.status).toBe(403);
+    });
+});
+describe("field create access", () => {
+    it("applies the create rule on create and the update rule on update", async () => {
+        const db = new InMemoryAdapter();
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            globals: [],
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    fields: [
+                        { name: "title", type: "text" },
+                        // Settable only at creation time; ignored on later updates.
+                        { name: "refCode", type: "text", access: { create: true, update: false } },
+                        // Cannot be set at creation; editable afterward.
+                        { name: "reviewNote", type: "text", access: { create: false } },
+                    ],
+                }),
+            ],
+        }));
+        const createRes = await app.request("/api/collections/posts", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ title: "T", refCode: "ABC", reviewNote: "should be dropped" }),
+        });
+        expect(createRes.status).toBe(201);
+        const created = await createRes.json();
+        expect(created.refCode).toBe("ABC"); // create allowed
+        expect(created.reviewNote).toBeUndefined(); // create denied → dropped
+        const updateRes = await app.request(`/api/collections/posts/${created.id}`, {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ refCode: "CHANGED", reviewNote: "now allowed" }),
+        });
+        expect(updateRes.status).toBe(200);
+        const stored = await db.findOne({ collection: "posts", id: created.id });
+        expect(stored?.refCode).toBe("ABC"); // update denied → unchanged
+        expect(stored?.reviewNote).toBe("now allowed"); // update allowed (no update rule)
+    });
+});
+describe("string-valued named policies", () => {
+    it("resolves a Jexl-string policy for row-level access", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [{ id: "user-1", email: "user1@example.com", roles: [] }]);
+        db.seed("posts", [
+            { id: "post-1", title: "Mine", owner: "user-1" },
+            { id: "post-2", title: "Theirs", owner: "user-2" },
+        ]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            accessPolicies: {
+                ownDocs: "{ owner: { equals: user.sub } }",
+            },
+            globals: [],
+            collections: [
+                defineCollection({ slug: "users", auth: true, fields: [{ name: "email", type: "email" }] }),
+                defineCollection({
+                    slug: "posts",
+                    access: { read: { policy: "ownDocs" } },
+                    fields: [{ name: "title", type: "text" }, { name: "owner", type: "text" }],
+                }),
+            ],
+        }));
+        const token = await signCollectionToken({ sub: "user-1", email: "user1@example.com", collection: "users" });
+        const headers = { Authorization: `Bearer ${token}` };
+        const listRes = await app.request("/api/collections/posts", { headers });
+        const list = await listRes.json();
+        expect(list.docs).toHaveLength(1);
+        expect(list.docs[0].id).toBe("post-1");
+    });
+    it("inlines a string policy into the admin schema so it can be evaluated live", async () => {
+        const db = new InMemoryAdapter();
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            accessPolicies: {
+                isAdmin: "'admin' in user.roles",
+                alwaysDeny: false,
+            },
+            globals: [],
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    access: { create: { policy: "isAdmin" } },
+                    fields: [
+                        { name: "title", type: "text" },
+                        { name: "secret", type: "text", access: { read: { policy: "alwaysDeny" } } },
+                    ],
+                }),
+            ],
+        }));
+        const res = await app.request("/api/schemas");
+        const data = await res.json();
+        // The string policy is inlined as its Jexl expression, not collapsed to a boolean.
+        expect(data.collections[0].access.create).toBe("'admin' in user.roles");
+        // The boolean policy resolves to its literal value.
+        const secret = data.collections[0].fields.find((f) => f.name === "secret");
+        expect(secret.access.read).toBe(false);
+    });
+});
+//# sourceMappingURL=access-features.test.js.map

package/dist/__tests__/access-features.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-features.test.js","sourceRoot":"","sources":["../../src/__tests__/access-features.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,aAAa,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CAAC,GAAG,GAAG,SAAS;IACzC,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,GAAG,cAAc,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;IACnG,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;AAC9C,CAAC;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAEtF,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;gBACjK,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE;wBACN,IAAI,EAAE,IAAI,EAAE,4BAA4B;wBACxC,SAAS,EAAE,uBAAuB,EAAE,2CAA2C;qBAChF;oBACD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC1C,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,+BAA+B;QAC/B,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC5D,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEjC,wDAAwD;QACxD,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACtE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEnC,gBAAgB;QAChB,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,EAAE,EAAE,CAAC,CAAC;QAC1G,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,IAAI;oBACX,MAAM,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,sBAAsB;oBACxD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC1C,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;QACjE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,4DAA4D;wBAC5D,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;wBAC1E,iDAAiD;wBACjD,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;qBAChE;iBACF,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,mBAAmB,EAAE,CAAC;SACtF,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB;QACtD,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,0BAA0B;QAEtE,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,OAAO,CAAC,EAAE,EAAE,EAAE;YAC1E,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,aAAa,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,4BAA4B;QACjE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,kCAAkC;IACpF,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAC5E,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,cAAc,EAAE;gBACd,OAAO,EAAE,iCAAiC;aAC3C;YACD,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBAC3F,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;oBACvC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC3E,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5G,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,KAAK,IAAI,EAAE;QACzF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,cAAc,EAAE;gBACd,OAAO,EAAE,uBAAuB;gBAChC,UAAU,EAAE,KAAK;aAClB;YACD,OAAO,EAAE,EAAE;YACX,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE;oBACzC,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE;qBAC7E;iBACF,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,mFAAmF;QACnF,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;QACxE,oDAAoD;QACpD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAChF,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/access-parity.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-parity.test.d.ts.map

package/dist/__tests__/access-parity.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-parity.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/access-parity.test.ts"],"names":[],"mappings":""}

package/dist/__tests__/access-parity.test.js

@@ -0,0 +1,338 @@
+import { beforeAll, describe, expect, it } from "vitest";
+import { createDyrectedApp } from "../app.js";
+import { signCollectionToken } from "../auth/token.js";
+import { defineCollection, defineConfig, defineGlobal } from "../index.js";
+import { InMemoryAdapter } from "./mocks.js";
+beforeAll(() => {
+    process.env.DYRECTED_JWT_SECRET = "test-secret";
+});
+describe("access-control parity", () => {
+    it("enforces row-level collection access on list, read, update, and delete", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [
+            { id: "user-1", email: "user1@example.com", roles: ["editor"] },
+            { id: "user-2", email: "user2@example.com", roles: ["editor"] },
+        ]);
+        db.seed("posts", [
+            { id: "post-1", title: "Mine", owner: "user-1" },
+            { id: "post-2", title: "Theirs", owner: "user-2" },
+        ]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "users",
+                    auth: true,
+                    fields: [{ name: "email", type: "email" }, { name: "roles", type: "select", hasMany: true, options: ["editor"] }],
+                }),
+                defineCollection({
+                    slug: "posts",
+                    access: {
+                        read: ({ user }) => ({ owner: { equals: user?.sub } }),
+                        update: ({ user }) => ({ owner: { equals: user?.sub } }),
+                        delete: ({ user }) => ({ owner: { equals: user?.sub } }),
+                    },
+                    fields: [
+                        { name: "title", type: "text" },
+                        { name: "owner", type: "text" },
+                    ],
+                }),
+            ],
+            globals: [],
+        }));
+        const token = await signCollectionToken({
+            sub: "user-1",
+            email: "user1@example.com",
+            collection: "users",
+        });
+        const headers = { Authorization: `Bearer ${token}` };
+        const listRes = await app.request("/api/collections/posts", { headers });
+        expect(listRes.status).toBe(200);
+        const listData = await listRes.json();
+        expect(listData.docs).toHaveLength(1);
+        expect(listData.docs[0].id).toBe("post-1");
+        const ownRes = await app.request("/api/collections/posts/post-1", { headers });
+        expect(ownRes.status).toBe(200);
+        const otherRes = await app.request("/api/collections/posts/post-2", { headers });
+        expect(otherRes.status).toBe(403);
+        const updateOtherRes = await app.request("/api/collections/posts/post-2", {
+            method: "PATCH",
+            headers: { ...headers, "Content-Type": "application/json" },
+            body: JSON.stringify({ title: "Nope" }),
+        });
+        expect(updateOtherRes.status).toBe(403);
+        const deleteOtherRes = await app.request("/api/collections/posts/post-2", {
+            method: "DELETE",
+            headers,
+        });
+        expect(deleteOtherRes.status).toBe(403);
+        const updateOwnRes = await app.request("/api/collections/posts/post-1", {
+            method: "PATCH",
+            headers: { ...headers, "Content-Type": "application/json" },
+            body: JSON.stringify({ title: "Updated" }),
+        });
+        expect(updateOwnRes.status).toBe(200);
+        const updated = await db.findOne({ collection: "posts", id: "post-1" });
+        expect(updated?.title).toBe("Updated");
+    });
+    it("enforces row-level collection access from Jexl filter strings", async () => {
+        const db = new InMemoryAdapter();
+        db.seed("users", [
+            { id: "user-1", email: "user1@example.com", roles: ["editor"] },
+            { id: "user-2", email: "user2@example.com", roles: ["editor"] },
+        ]);
+        db.seed("posts", [
+            { id: "post-1", title: "Mine", owner: "user-1" },
+            { id: "post-2", title: "Theirs", owner: "user-2" },
+        ]);
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "users",
+                    auth: true,
+                    fields: [{ name: "email", type: "email" }, { name: "roles", type: "select", hasMany: true, options: ["editor"] }],
+                }),
+                defineCollection({
+                    slug: "posts",
+                    access: {
+                        read: "{ owner: { equals: user.sub } }",
+                        update: "{ owner: { equals: user.sub } }",
+                        delete: "{ owner: { equals: user.sub } }",
+                    },
+                    fields: [
+                        { name: "title", type: "text" },
+                        { name: "owner", type: "text" },
+                    ],
+                }),
+            ],
+            globals: [],
+        }));
+        const token = await signCollectionToken({
+            sub: "user-1",
+            email: "user1@example.com",
+            collection: "users",
+        });
+        const headers = { Authorization: `Bearer ${token}` };
+        const listRes = await app.request("/api/collections/posts", { headers });
+        expect(listRes.status).toBe(200);
+        const listData = await listRes.json();
+        expect(listData.docs).toHaveLength(1);
+        expect(listData.docs[0].id).toBe("post-1");
+        const ownRes = await app.request("/api/collections/posts/post-1", { headers });
+        expect(ownRes.status).toBe(200);
+        const otherRes = await app.request("/api/collections/posts/post-2", { headers });
+        expect(otherRes.status).toBe(403);
+    });
+    it("enforces field read and write access on the API", async () => {
+        const db = new InMemoryAdapter();
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    fields: [
+                        { name: "title", type: "text" },
+                        {
+                            name: "secret",
+                            type: "text",
+                            access: {
+                                read: false,
+                                update: false,
+                            },
+                        },
+                        {
+                            name: "settings",
+                            type: "object",
+                            fields: [
+                                { name: "visible", type: "text" },
+                                { name: "hidden", type: "text", access: { read: false, update: false } },
+                            ],
+                        },
+                    ],
+                }),
+            ],
+            globals: [],
+        }));
+        const createRes = await app.request("/api/collections/posts", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                title: "Post",
+                secret: "top-secret",
+                settings: { visible: "ok", hidden: "blocked" },
+            }),
+        });
+        expect(createRes.status).toBe(201);
+        const created = await createRes.json();
+        expect(created.secret).toBeUndefined();
+        expect(created.settings).toEqual({ visible: "ok" });
+        const stored = await db.find({ collection: "posts", limit: 10 });
+        expect(stored.docs[0].secret).toBeUndefined();
+        expect(stored.docs[0].settings).toEqual({ visible: "ok" });
+        const updateRes = await app.request(`/api/collections/posts/${stored.docs[0].id}`, {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                secret: "changed",
+                settings: { visible: "still-ok", hidden: "still-blocked" },
+            }),
+        });
+        expect(updateRes.status).toBe(200);
+        const updated = await updateRes.json();
+        expect(updated.secret).toBeUndefined();
+        expect(updated.settings).toEqual({ visible: "still-ok" });
+        const fetchedRes = await app.request(`/api/collections/posts/${stored.docs[0].id}`);
+        expect(fetchedRes.status).toBe(200);
+        const fetched = await fetchedRes.json();
+        expect(fetched.secret).toBeUndefined();
+        expect(fetched.settings).toEqual({ visible: "still-ok" });
+    });
+    it("passes document id into field access rules on API updates", async () => {
+        const db = new InMemoryAdapter();
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    fields: [
+                        { name: "title", type: "text" },
+                        {
+                            name: "slug",
+                            type: "text",
+                            access: {
+                                update: "!id",
+                            },
+                        },
+                    ],
+                }),
+            ],
+            globals: [],
+        }));
+        const createRes = await app.request("/api/collections/posts", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                title: "Post",
+                slug: "original",
+            }),
+        });
+        expect(createRes.status).toBe(201);
+        const created = await createRes.json();
+        expect(created.slug).toBe("original");
+        const updateRes = await app.request(`/api/collections/posts/${created.id}`, {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({
+                slug: "changed",
+            }),
+        });
+        expect(updateRes.status).toBe(200);
+        const updated = await updateRes.json();
+        expect(updated.slug).toBe("original");
+        const stored = await db.findOne({ collection: "posts", id: created.id });
+        expect(stored?.slug).toBe("original");
+    });
+    it("evaluates global access against doc and incoming data", async () => {
+        const db = new InMemoryAdapter();
+        await db.updateGlobal({
+            slug: "settings",
+            data: { siteName: "Public", visibility: "public", locked: true },
+        });
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [],
+            globals: [
+                defineGlobal({
+                    slug: "settings",
+                    access: {
+                        read: ({ doc }) => doc?.visibility === "public",
+                        update: ({ data }) => data?.locked !== false,
+                    },
+                    fields: [
+                        { name: "siteName", type: "text" },
+                        { name: "visibility", type: "text" },
+                        { name: "locked", type: "boolean" },
+                    ],
+                }),
+            ],
+        }));
+        const getRes = await app.request("/api/globals/settings");
+        expect(getRes.status).toBe(200);
+        const deniedUpdateRes = await app.request("/api/globals/settings", {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ locked: false }),
+        });
+        expect(deniedUpdateRes.status).toBe(403);
+        const allowedUpdateRes = await app.request("/api/globals/settings", {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ siteName: "Updated", locked: true }),
+        });
+        expect(allowedUpdateRes.status).toBe(200);
+        const global = await db.getGlobal({ slug: "settings" });
+        expect(global).toMatchObject({ siteName: "Updated", locked: true });
+    });
+    it("evaluates global access from Jexl against doc and incoming data", async () => {
+        const db = new InMemoryAdapter();
+        await db.updateGlobal({
+            slug: "settings",
+            data: { siteName: "Public", visibility: "public", locked: true },
+        });
+        const app = await createDyrectedApp(defineConfig({
+            db,
+            collections: [],
+            globals: [
+                defineGlobal({
+                    slug: "settings",
+                    access: {
+                        read: "doc.visibility == 'public'",
+                        update: "data.locked != false",
+                    },
+                    fields: [
+                        { name: "siteName", type: "text" },
+                        { name: "visibility", type: "text" },
+                        { name: "locked", type: "boolean" },
+                    ],
+                }),
+            ],
+        }));
+        const getRes = await app.request("/api/globals/settings");
+        expect(getRes.status).toBe(200);
+        const deniedUpdateRes = await app.request("/api/globals/settings", {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ locked: false }),
+        });
+        expect(deniedUpdateRes.status).toBe(403);
+        const allowedUpdateRes = await app.request("/api/globals/settings", {
+            method: "PATCH",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ siteName: "Updated", locked: true }),
+        });
+        expect(allowedUpdateRes.status).toBe(200);
+    });
+    it("collapses document-scoped schema access to false", async () => {
+        const app = await createDyrectedApp(defineConfig({
+            db: new InMemoryAdapter(),
+            collections: [
+                defineCollection({
+                    slug: "posts",
+                    access: {
+                        read: ({ user }) => ({ owner: { equals: user?.sub } }),
+                        create: "user != null",
+                    },
+                    fields: [{ name: "title", type: "text" }],
+                }),
+            ],
+            globals: [],
+        }));
+        const res = await app.request("/api/schemas");
+        expect(res.status).toBe(200);
+        const data = await res.json();
+        expect(data.collections[0].access.read).toBe(false);
+        expect(data.collections[0].access.create).toBe("user != null");
+    });
+});
+//# sourceMappingURL=access-parity.test.js.map

package/dist/__tests__/access-parity.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-parity.test.js","sourceRoot":"","sources":["../../src/__tests__/access-parity.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAE7C,SAAS,CAAC,GAAG,EAAE;IACb,OAAO,CAAC,GAAG,CAAC,mBAAmB,GAAG,aAAa,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC/D,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;SAChE,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;iBAClH,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;wBACtD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;wBACxD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;qBACzD;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;qBAChC;iBACF,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,mBAAmB;YAC1B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAElC,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACxE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACxE,MAAM,EAAE,QAAQ;YAChB,OAAO;SACR,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAExC,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE;YACtE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,GAAG,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;SAC3C,CAAC,CAAC;QACH,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEtC,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,KAAK,IAAI,EAAE;QAC7E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;YAC/D,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,QAAQ,CAAC,EAAE;SAChE,CAAC,CAAC;QACH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE;YACf,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE;YAChD,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;SACnD,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,IAAI,EAAE,IAAI;oBACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;iBAClH,CAAC;gBACF,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,IAAI,EAAE,iCAAiC;wBACvC,MAAM,EAAE,iCAAiC;wBACzC,MAAM,EAAE,iCAAiC;qBAC1C;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;qBAChC;iBACF,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC;YACtC,GAAG,EAAE,QAAQ;YACb,KAAK,EAAE,mBAAmB;YAC1B,UAAU,EAAE,OAAO;SACpB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAErD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAE3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC/E,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,+BAA+B,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACjF,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QAEjC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B;4BACE,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,MAAM;4BACZ,MAAM,EAAE;gCACN,IAAI,EAAE,KAAK;gCACX,MAAM,EAAE,KAAK;6BACd;yBACF;wBACD;4BACE,IAAI,EAAE,UAAU;4BAChB,IAAI,EAAE,QAAQ;4BACd,MAAM,EAAE;gCACN,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE;gCACjC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE;6BACzE;yBACF;qBACF;iBACF,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,MAAM;gBACb,MAAM,EAAE,YAAY;gBACpB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE;aAC/C,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEpD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAE3D,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;YACjF,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,EAAE;aAC3D,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QAE1D,MAAM,UAAU,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2DAA2D,EAAE,KAAK,IAAI,EAAE;QACzE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QAEjC,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;wBAC/B;4BACE,IAAI,EAAE,MAAM;4BACZ,IAAI,EAAE,MAAM;4BACZ,MAAM,EAAE;gCACN,MAAM,EAAE,KAAK;6BACd;yBACF;qBACF;iBACF,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,wBAAwB,EAAE;YAC5D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,MAAM;gBACb,IAAI,EAAE,UAAU;aACjB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,0BAA0B,OAAO,CAAC,EAAE,EAAE,EAAE;YAC1E,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,IAAI,EAAE,SAAS;aAChB,CAAC;SACH,CAAC,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACnC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEtC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,EAAE,CAAC,YAAY,CAAC;YACpB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;SACjE,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE,EAAE;YACf,OAAO,EAAE;gBACP,YAAY,CAAC;oBACX,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE;wBACN,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,UAAU,KAAK,QAAQ;wBAC/C,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,KAAK;qBAC7C;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;wBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;wBACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;qBACpC;iBACF,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE;YACjE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEzC,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAClE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,EAAE,CAAC,YAAY,CAAC;YACpB,IAAI,EAAE,UAAU;YAChB,IAAI,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE;SACjE,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE;YACF,WAAW,EAAE,EAAE;YACf,OAAO,EAAE;gBACP,YAAY,CAAC;oBACX,IAAI,EAAE,UAAU;oBAChB,MAAM,EAAE;wBACN,IAAI,EAAE,4BAA4B;wBAClC,MAAM,EAAE,sBAAsB;qBAC/B;oBACD,MAAM,EAAE;wBACN,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE;wBAClC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE;wBACpC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;qBACpC;iBACF,CAAC;aACH;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEhC,MAAM,eAAe,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE;YACjE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAEzC,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE;YAClE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SAC5D,CAAC,CAAC;QACH,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;QAChE,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC;YAC/C,EAAE,EAAE,IAAI,eAAe,EAAE;YACzB,WAAW,EAAE;gBACX,gBAAgB,CAAC;oBACf,IAAI,EAAE,OAAO;oBACb,MAAM,EAAE;wBACN,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;wBACtD,MAAM,EAAE,cAAc;qBACvB;oBACD,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;iBAC1C,CAAC;aACH;YACD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC,CAAC;QAEJ,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/__tests__/access.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access.test.d.ts.map

package/dist/__tests__/access.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/access.test.ts"],"names":[],"mappings":""}