@everystack/model 0.4.19 → 0.4.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.19",
+  "version": "0.4.20",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/can.ts

@@ -138,6 +138,23 @@ export function isPublicReadAbility(ability: Ability): boolean {
     && (!ability.condition.role || ability.condition.role === 'anon');
 }
 
+/**
+ * The no-session audience a condition names, spelled as declared — or null.
+ *
+ * `role: 'anon'` IS the caller with no session; `policyRoles: 'public'` admits that caller. An
+ * `owner`/`via` scope compares the row to the caller's JWT claim, which neither can supply, so
+ * the pair never does what it says: under anon it matches no row, and under PUBLIC the compiler
+ * drops the open audience and emits the signed-in owner policy. ONE definition, because two
+ * surfaces enforce it: `defineModel` refuses the pair and `db:pull` never renders it.
+ */
+export function sessionlessAudience(
+  condition: Pick<AbilityCondition, 'role' | 'policyRoles'>,
+): "role: 'anon'" | "policyRoles: 'public'" | null {
+  if (condition.role === 'anon') return "role: 'anon'";
+  if (condition.policyRoles === 'public') return "policyRoles: 'public'";
+  return null;
+}
+
 /**
  * Does this ability hand out DELETE?
  *

package/src/index.ts

@@ -20,7 +20,7 @@ export type { TableConstraint } from './constraints';
 export { sql } from './raw-sql';
 export type { RawSql } from './raw-sql';
 
-export { can, isColumnAbility, isPublicReadAbility, isDeleteAbility, needsSoftDeleteDeclaration, privilegesGrantDelete } from './can';
+export { can, isColumnAbility, isPublicReadAbility, isDeleteAbility, needsSoftDeleteDeclaration, privilegesGrantDelete, sessionlessAudience } from './can';
 export type { SoftDeleteFacts } from './can';
 export type { Ability, AbilityCondition, Action } from './can';
 

package/src/model.ts

@@ -13,7 +13,7 @@
 
 import type { FieldBuilder } from './field';
 import type { Ability } from './can';
-import { isPublicReadAbility, isDeleteAbility, needsSoftDeleteDeclaration, privilegesGrantDelete } from './can';
+import { isPublicReadAbility, isDeleteAbility, needsSoftDeleteDeclaration, privilegesGrantDelete, sessionlessAudience } from './can';
 import type { Relation } from './relations';
 import type { TableConstraint } from './constraints';
 import type { RawSql } from './raw-sql';
@@ -317,6 +317,22 @@ export function defineModel(table: string, def: ModelDefinition): ModelDescripto
       }
     }
 
+    // `owner`/`via` compare a row column to the caller's JWT claim; a no-session audience has
+    // none. Truthiness matches the compiler, which treats `owner: ''` as no row scope.
+    const rowScope = a.condition.owner ? 'owner' : a.condition.via ? 'via' : null;
+    const audience = sessionlessAudience(a.condition);
+    if (rowScope && audience) {
+      const outcome = audience === "role: 'anon'"
+        ? 'can never match a row: anon has no session'
+        : 'is narrower than declared: PUBLIC admits callers with no session, so the open audience is dropped';
+      throw new Error(
+        `model '${table}': can('${a.action}', { ${audience}, ${rowScope}: '${a.condition[rowScope]}' }) ${outcome}. ` +
+          `${rowScope} compares the row to the signed-in user's claim. ` +
+          `Either drop ${audience} (the ability then applies to signed-in callers, their own rows), ` +
+          `or drop ${rowScope} and scope the anonymous read with columns or where.`,
+      );
+    }
+
     // `policyRoles` decouples the policy's AUDIENCE from its GRANTEES, and it is deliberately
     // amputated to one open set. Anything else would be a second spelling of the `role:` axis
     // and could name a role no grant backs — a policy that reads as access which does not