@everystack/cli 0.4.3 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-compile.ts

@@ -267,9 +267,12 @@ export function compileTableContract(model: ModelDescriptor, opts: CompileOption
     const anonUsing = sdGuard ?? 'true';
     policy(`${t}_select_anon`, 'SELECT', ['anon'], anonUsing, null);
 
-    let authedUsing = anonUsing;
-    if (sdGuard && rowPred) authedUsing = `(${sdGuard} OR ${rowPred})`;
-    else if (rowPred && !sdGuard) authedUsing = rowPred;
+    // The owner predicate may only ever WIDEN a public read (the soft-delete OR:
+    // owners also see their own deleted rows). It must never REPLACE it — an owner
+    // condition on a WRITE ability used to narrow the authenticated SELECT to
+    // own-rows-only, so anon saw the whole table and a signed-in user lost it.
+    // Without a soft-delete guard, `true OR owner` is just `true`.
+    const authedUsing = sdGuard && rowPred ? `(${sdGuard} OR ${rowPred})` : anonUsing;
     policy(`${t}_select_authenticated`, 'SELECT', ['authenticated'], authedUsing, null);
   } else if (hasOwnerRead && rowPred) {
     // owner-scoped read — no anon visibility; you see only the rows you own

package/src/cli/derived-compile.ts

@@ -319,11 +319,13 @@ export function compileDerived(models: readonly ModelDescriptor[], derived: read
 
   // Triggers declared on models and on views — the deps come free (execute fn; the
   // declaration-site view when it is itself derived). The function MUST be declared.
+  // `?? []` mirrors the first trigger walk above: a descriptor built by an older
+  // @everystack/model arrives without the key, and this walk crashed "not iterable".
   const triggerOwners: Array<{ schema: string; name: string; ownerIdentity: string | null; triggers: TriggerSpec[] }> = [
-    ...models.map((m) => ({ schema: m.schema, name: m.table, ownerIdentity: null, triggers: m.triggers })),
+    ...models.map((m) => ({ schema: m.schema, name: m.table, ownerIdentity: null, triggers: m.triggers ?? [] })),
     ...derived.filter((d): d is ViewDescriptor => d.kind === 'view').map((v) => {
       const q = parseQualified(v.name);
-      return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}`, triggers: v.triggers };
+      return { schema: q.schema, name: q.name, ownerIdentity: `${q.schema}.${q.name}`, triggers: v.triggers ?? [] };
     }),
   ];
   for (const owner of triggerOwners) {