@everystack/model 0.4.27 → 0.4.28

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@everystack/model` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.28] - 2026-11-05
+
+### BREAKING CHANGES
+
+- refuse a manage ability whose condition would be dropped
+
 ## [0.4.27] - 2026-11-04
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.27",
+  "version": "0.4.28",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/index.ts

@@ -53,6 +53,7 @@ export type {
 
 export { deriveHandlerConfig, deriveForceRlsCarveouts, deriveFunctionSchemas } from './derive';
 export { assertNoLegacySoftDelete } from './legacy-soft-delete';
+export { assertManageScope } from './manage-scope';
 export type { DerivedHandlerConfig, RelationConfig } from './derive';
 
 export { ENSURE_DESTROY_LOG_SQL, DESTROY_LOG_MARKER_BODIES, DESTROY_LOG_MARKER_LANGUAGES, DESTROY_LOG_MARKER_SEARCH_PATH } from './destroy-log';

package/src/manage-scope.ts

@@ -0,0 +1,30 @@
+import type { Ability } from './can';
+
+const CONDITION_KEYS = ['where', 'sql', 'check'] as const;
+
+/**
+ * A `manage` with no owner and no via compiles to an ALL policy USING true for its role, or, for
+ * an authenticated manage on a row-scoped model, to the model's own row scope. Neither path
+ * reads the ability's where / sql / check, so `can('manage', { role: 'editor', where })` would
+ * let the editor manage every row. Refuse it, whatever the value (`sql\`true\`` included).
+ *
+ * defineModel calls this, and so does compileTableContract, for a descriptor that never went
+ * through defineModel. One message, two callers.
+ */
+export function assertManageScope(table: string, abilities: readonly Ability[] | undefined): void {
+  for (const a of abilities ?? []) {
+    if (a.action !== 'manage' || a.condition.owner || a.condition.via) continue;
+    const keys = CONDITION_KEYS.filter((k) => a.condition[k] !== undefined);
+    if (keys.length === 0) continue;
+    const key = keys.join(', ');
+    const role = a.condition.role ?? 'authenticated';
+    throw new Error(
+      `model '${table}': can('manage', { role: '${role}', ${key} }) would grant every row: ` +
+        `a manage without owner or via ignores ${key}. ` +
+        // The resolved role, never a bare placeholder: a copied `can('read', { where })` with no
+        // role is a public read, wider than the manage it replaces.
+        `Declare the four abilities instead (can('read'|'create'|'update'|'delete', { role: '${role}', ${key} })), ` +
+        'or scope it with owner or via.',
+    );
+  }
+}

package/src/model.ts

@@ -22,6 +22,7 @@ import { lifecycleCascadeHarm } from './dependents';
 import type { RawSql } from './raw-sql';
 import { validateTriggersFor, type TriggerSpec, type DependsOnRef } from './derived';
 import { TABLE_PRIVILEGES, type TablePrivilege } from './privileges';
+import { assertManageScope } from './manage-scope';
 
 import { assertDeleteHookNames, assertDestroyHooks, type AfterLifecycleHook, type BeforeLifecycleHook, type DestroyHook } from './lifecycle-hooks';
 export type { AfterLifecycleHook, BeforeLifecycleHook, DestroyContext, DestroyHook, HookVeto, LifecycleContext } from './lifecycle-hooks';
@@ -467,6 +468,7 @@ function assertNoSoftDelete(table: string, def: ModelDefinition): void {
 
 export function defineModel(table: string, def: ModelDefinition): ModelDescriptor {
   assertNoSoftDelete(table, def);
+  assertManageScope(table, def.abilities);
   assertDeleteHookNames(table, def.hooks);
   assertDestroyHooks(table, def.hooks, isLifecycle(def));
   // Refuse first, then inject: the author-declared collisions are checked against what the author wrote.