@everystack/model 0.4.8 → 0.4.9

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/model",
-  "version": "0.4.8",
+  "version": "0.4.9",
   "description": "Declare a table's schema, validation, and authorization once — compiled to migrations, RLS, and handler config",
   "license": "AGPL-3.0-only",
   "publishConfig": {

package/src/can.ts

@@ -28,6 +28,26 @@ export interface AbilityCondition {
   via?: string;
   /** Field in the JWT claims holding the owner id. Default: `sub`. */
   userField?: string;
+  /**
+   * The SQL expression that yields the signed-in user's id — the RIGHT side of the owner
+   * comparison. Default: the JWT claim read inline,
+   * `((current_setting('request.jwt.claims'::text, true))::jsonb ->> '<userField>'::text)`,
+   * cast to the owner column's type.
+   *
+   * Declare it when the database already has its own accessor — `auth.user_id()` is the
+   * common brownfield shape — so the compiled policy is the one that is already live
+   * rather than a semantically-similar rewrite of it. That matters more than it sounds:
+   * predicates are diffed as TEXT, so an equivalent-but-different expression is a
+   * DROP + CREATE on every owner policy in the schema, which is exactly the churn a
+   * first plan against an existing database must not produce.
+   *
+   * Deliberately per-ability, beside `userField`, and with no project-wide default: a
+   * single setting that silently repoints every owner policy in a schema is a worse
+   * security surface than saying it where it applies. When declared, the expression is
+   * emitted VERBATIM — no cast is added, because the accessor already returns the
+   * column's type (`auth.user_id() RETURNS integer` against an integer owner).
+   */
+  ownerExpr?: unknown;
   /**
    * Column-scoped exposure for a `read` ability. Names the field keys a role may read
    * (compiled to a `GRANT SELECT (cols)` column grant, not a table grant) instead of the