@gettersethya/mira 0.1.0-alpha.2 → 0.1.0-alpha.21

package/dist/tests/app/builder.test.js

@@ -1,11 +1,15 @@
-import { describe, it, expect } from "vitest";
+import { AuthCollection, BaseCollection, Field } from "@gettersethya/mira-client";
 import { Layer } from "effect";
-import { MiraBuilder } from "../../src/app/builder.js";
+import { describe, expect, it } from "vitest";
 import { MiraApp } from "../../src/app/app.js";
-import { ConsoleTelemetryLayer } from "../../src/telemetry/index.js";
-import { NodePlatform } from "../../src/platforms/node.js";
+import { MiraBuilder } from "../../src/app/builder.js";
+import { defineRule } from "../../src/app/index.js";
+import { MiraPlugin } from "../../src/app/plugin.js";
 import { SqliteDatabase } from "../../src/databases/sqlite.js";
+import { defaultCorsConfig } from "../../src/http/cors.js";
+import { NodePlatform } from "../../src/platforms/node.js";
 import { LocalFileStorage } from "../../src/storage/index.js";
+import { ConsoleTelemetryLayer } from "../../src/telemetry/index.js";
 // Use real presets as stubs — builder stores them without invoking them in unit tests
 const stubPlatform = NodePlatform;
 const stubDatabase = SqliteDatabase({ filename: ":memory:" });
@@ -55,15 +59,79 @@ describe("MiraBuilder", () => {
 describe("MiraApp.extend()", () => {
     it("returns this (chainable)", () => {
         const app = fullBuilder().build();
-        const result = app.extend(Layer.empty);
+        const result = app.extend(MiraPlugin.fromLayer(Layer.empty));
         expect(result).toBe(app);
     });
     it("accumulates extras in order", () => {
-        const layerA = Layer.empty;
-        const layerB = Layer.empty;
+        const pluginA = MiraPlugin.fromLayer(Layer.empty);
+        const pluginB = MiraPlugin.fromLayer(Layer.empty);
+        const app = fullBuilder().build();
+        app.extend(pluginA).extend(pluginB);
+        expect(app._getExtras()).toEqual([pluginA, pluginB]);
+    });
+});
+describe("MiraBuilder.rules()", () => {
+    const postsDef = BaseCollection.define("posts", { title: Field.text() });
+    it("stores rules on builder config", () => {
+        const rb = defineRule(postsDef, (R) => ({ list: R.public() }));
+        const b = fullBuilder().rules([rb]);
+        expect(b._getPartialConfig().rules).toEqual([rb]);
+    });
+    it("throws on duplicate collection names", () => {
+        const rb1 = defineRule(postsDef, (R) => ({ list: R.public() }));
+        const rb2 = defineRule(postsDef, (R) => ({ view: R.public() }));
+        expect(() => fullBuilder().rules([rb1, rb2])).toThrow('Duplicate rule binding for collection "posts"');
+    });
+    it("rules survive through build", () => {
+        const rb = defineRule(postsDef, (R) => ({ list: R.public() }));
+        const app = fullBuilder().rules([rb]).build();
+        expect(app._getConfig().rules).toEqual([rb]);
+    });
+});
+describe("MiraBuilder.cors()", () => {
+    it("stores cors on builder config", () => {
+        const cors = { allowedOrigins: ["http://localhost:3000"] };
+        const b = fullBuilder().cors(cors);
+        expect(b._getPartialConfig().cors).toEqual(cors);
+    });
+    it("defaults cors to defaultCorsConfig when .cors() not called", () => {
+        const app = fullBuilder().build();
+        expect(app._getConfig().cors).toBe(defaultCorsConfig);
+    });
+    it("custom cors survives through build", () => {
+        const cors = { allowedOrigins: ["http://localhost:3000"], credentials: true };
+        const app = fullBuilder().cors(cors).build();
+        expect(app._getConfig().cors).toEqual(cors);
+    });
+    it("throws on wildcard origin with credentials", () => {
+        expect(() => fullBuilder().cors({ allowedOrigins: ["*"], credentials: true })).toThrow("credentials: true requires explicit allowedOrigins");
+    });
+    it("throws on omitted origins with credentials", () => {
+        expect(() => fullBuilder().cors({ credentials: true })).toThrow("credentials: true requires explicit allowedOrigins");
+    });
+    it("allows explicit origin with credentials", () => {
+        const b = fullBuilder().cors({ allowedOrigins: ["http://localhost:3000"], credentials: true });
+        expect(b._getPartialConfig().cors).toBeDefined();
+    });
+});
+describe("MiraPlugin.adminCollections", () => {
+    const adminDef = AuthCollection.define("_admin", {});
+    it("auto-adds plugin admin collections to the app collection set", () => {
+        const plugin = MiraPlugin.define({ adminCollections: [adminDef] });
+        const app = fullBuilder().build().extend(plugin);
+        expect(app._resolveAdminCollections()).toEqual([adminDef]);
+    });
+    it("merges admin collections from multiple plugins", () => {
+        const otherDef = AuthCollection.define("_otheradmin", {});
+        const app = fullBuilder()
+            .build()
+            .extend(MiraPlugin.define({ adminCollections: [adminDef] }))
+            .extend(MiraPlugin.define({ adminCollections: [otherDef] }));
+        expect(app._resolveAdminCollections()).toEqual([adminDef, otherDef]);
+    });
+    it("there is no admin bypass when no plugin declares one", () => {
         const app = fullBuilder().build();
-        app.extend(layerA).extend(layerB);
-        expect(app._getExtras()).toEqual([layerA, layerB]);
+        expect(app._resolveAdminCollections()).toEqual([]);
     });
 });
 //# sourceMappingURL=builder.test.js.map

package/dist/tests/app/builder.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"builder.test.js","sourceRoot":"","sources":["../../../tests/app/builder.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAGrD,sFAAsF;AACtF,MAAM,YAAY,GAAG,YAAY,CAAA;AACjC,MAAM,YAAY,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;AACjE,MAAM,eAAe,GAAoC,EAAE,CAAA;AAE3D,MAAM,WAAW,GAAG,GAAG,EAAE,CACvB,IAAI,WAAW,EAAE;KACd,QAAQ,CAAC,YAAY,CAAC;KACtB,QAAQ,CAAC,YAAY,CAAC;KACtB,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,eAAe,CAAC,CAAA;AAEjC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAClD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAClD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAA;QACnC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAA;QAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAA;QAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAA;QAC1B,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAA;QAC1B,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"builder.test.js","sourceRoot":"","sources":["../../../tests/app/builder.test.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,2BAA2B,CAAA;AACjF,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAA;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAC,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE5C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAA;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,sFAAsF;AACtF,MAAM,YAAY,GAAG,YAAY,CAAA;AACjC,MAAM,YAAY,GAAG,cAAc,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC,CAAA;AAC7D,MAAM,WAAW,GAAG,gBAAgB,CAAC,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAA;AACjE,MAAM,eAAe,GAAoC,EAAE,CAAA;AAE3D,MAAM,WAAW,GAAG,GAAG,EAAE,CACvB,IAAI,WAAW,EAAE;KACd,QAAQ,CAAC,YAAY,CAAC;KACtB,QAAQ,CAAC,YAAY,CAAC;KACtB,OAAO,CAAC,WAAW,CAAC;KACpB,WAAW,CAAC,eAAe,CAAC,CAAA;AAEjC,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAClD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QAClD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAChD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,CAAC,GAAG,IAAI,WAAW,EAAE,CAAC,WAAW,CAAC,eAAe,CAAC,CAAA;QACxD,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACjE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAChE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,eAAe,GAAG,KAAK,CAAC,KAAK,CAAA;QACnC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,KAAK,EAAE,CAAA;QAC5D,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAA;QAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACpC,MAAM,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACzB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,0BAA0B,EAAE,GAAG,EAAE;QAClC,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,OAAO,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;QACjD,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QACnC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IAExE,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACnC,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/D,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/D,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CACnD,+CAA+C,CAChD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,EAAE,GAAG,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,CAAA;QAC7C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,CAAC,uBAAuB,CAAC,EAAE,CAAA;QAC1D,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oCAAoC,EAAE,GAAG,EAAE;QAC5C,MAAM,IAAI,GAAG,EAAE,cAAc,EAAE,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC7E,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,CAAA;QAC5C,MAAM,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CACpF,oDAAoD,CACrD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAC7D,oDAAoD,CACrD,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,cAAc,EAAE,CAAC,uBAAuB,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;QAC9F,MAAM,CAAC,CAAC,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;IAClD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,6BAA6B,EAAE,GAAG,EAAE;IAC3C,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAEpD,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;QAChD,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,QAAQ,GAAG,cAAc,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACzD,MAAM,GAAG,GAAG,WAAW,EAAE;aACtB,KAAK,EAAE;aACP,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;aAC3D,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAA;QAC9D,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;IACtE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,GAAG,GAAG,WAAW,EAAE,CAAC,KAAK,EAAE,CAAA;QACjC,MAAM,CAAC,GAAG,CAAC,wBAAwB,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/app/define-rule.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=define-rule.test.d.ts.map

package/dist/tests/app/define-rule.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-rule.test.d.ts","sourceRoot":"","sources":["../../../tests/app/define-rule.test.ts"],"names":[],"mappings":""}

package/dist/tests/app/define-rule.test.js

@@ -0,0 +1,147 @@
+import { AuthCollection, BaseCollection, Field, ViewCollection } from "@gettersethya/mira-client";
+import { describe, expect, it } from "vitest";
+import { applyRulesToCollections, defineRule } from "../../src/app/index.js";
+const Posts = BaseCollection.define("posts", {
+    title: Field.text({ maxLength: 200 }),
+});
+const Users = AuthCollection.define("users", {
+    name: Field.text(),
+});
+const ActivePosts = ViewCollection.define("active_posts", "SELECT id, seqId, title FROM posts WHERE status = 'active'", {
+    id: Field.text().view(),
+    seqId: Field.integer().view(),
+    title: Field.text().view(),
+});
+describe("defineRule", () => {
+    it("returns RuleBinding with correct collectionName", () => {
+        const rb = defineRule(Posts, (R) => ({ list: R.public() }));
+        expect(rb._tag).toBe("RuleBinding");
+        expect(rb.collectionName).toBe("posts");
+        expect(rb.ruleMap).toBeDefined();
+    });
+    it("ruleMap contains the rules returned by callback", () => {
+        const rb = defineRule(Posts, (R) => ({
+            list: R.public(),
+            view: R.field("title").eq(R.literal("hello")),
+        }));
+        expect(rb.ruleMap.list).toEqual({ op: "public" });
+        expect(rb.ruleMap.view).toEqual({
+            op: "eq",
+            left: { kind: "field", field: "title" },
+            right: { kind: "literal", value: "hello" },
+        });
+    });
+    it("callback receives RuleBuilder with collection fields", () => {
+        const rb = defineRule(Posts, (R) => {
+            const op = R.field("title");
+            expect(op).toMatchObject({ kind: "field", field: "title" });
+            return {};
+        });
+        expect(rb._tag).toBe("RuleBinding");
+    });
+    it("callback receives system fields on base collection", () => {
+        defineRule(Posts, (R) => {
+            expect(R.field("id")).toMatchObject({ kind: "field", field: "id" });
+            expect(R.field("created")).toMatchObject({ kind: "field", field: "created" });
+            expect(R.field("updated")).toMatchObject({ kind: "field", field: "updated" });
+            expect(R.field("seqId")).toMatchObject({ kind: "field", field: "seqId" });
+            return {};
+        });
+    });
+    it("callback receives auth system fields on auth collection", () => {
+        defineRule(Users, (R) => {
+            expect(R.field("email")).toMatchObject({ kind: "field", field: "email" });
+            expect(R.field("emailVerified")).toMatchObject({ kind: "field", field: "emailVerified" });
+            return {};
+        });
+    });
+    it("selfId() available for auth collections", () => {
+        defineRule(Users, (R) => {
+            expect(R.selfId()).toMatchObject({ kind: "authId", collection: "users" });
+            return {};
+        });
+    });
+    it("empty callback returns empty RuleMap", () => {
+        const rb = defineRule(Posts, () => ({}));
+        expect(rb.ruleMap).toEqual({});
+    });
+    it("view collection gets its declared fields", () => {
+        defineRule(ActivePosts, (R) => {
+            const idOp = R.field("id");
+            const seqIdOp = R.field("seqId");
+            const titleOp = R.field("title");
+            expect(idOp.kind).toBe("field");
+            expect(seqIdOp.kind).toBe("field");
+            expect(titleOp.kind).toBe("field");
+            return {};
+        });
+    });
+    it("view collection rule map keeps list and view only", () => {
+        const rb = defineRule(ActivePosts, (R) => ({
+            list: R.public(),
+            view: R.field("title").eq(R.literal("x")),
+        }));
+        expect(rb._tag).toBe("RuleBinding");
+        expect(rb.collectionName).toBe("active_posts");
+        expect(rb.ruleMap.list).toEqual({ op: "public" });
+        expect(rb.ruleMap.view).toEqual({
+            op: "eq",
+            left: { kind: "field", field: "title" },
+            right: { kind: "literal", value: "x" },
+        });
+        expect(rb.ruleMap.create).toBeUndefined();
+        expect(rb.ruleMap.update).toBeUndefined();
+        expect(rb.ruleMap.delete).toBeUndefined();
+    });
+    it("auth collection rule map supports all CRUD actions", () => {
+        const rb = defineRule(Users, (R) => ({
+            list: R.public(),
+            view: R.selfId().eq(R.literal("u1")),
+            create: R.public(),
+            update: R.selfId().eq(R.literal("u1")),
+            delete: R.selfId().eq(R.literal("u1")),
+        }));
+        expect(rb._tag).toBe("RuleBinding");
+        expect(rb.collectionName).toBe("users");
+        expect(rb.ruleMap.list).toEqual({ op: "public" });
+        expect(rb.ruleMap.view).toEqual({
+            op: "eq",
+            left: { kind: "authId", collection: "users" },
+            right: { kind: "literal", value: "u1" },
+        });
+        expect(rb.ruleMap.create).toEqual({ op: "public" });
+        expect(rb.ruleMap.update).toBeDefined();
+        expect(rb.ruleMap.delete).toBeDefined();
+    });
+});
+describe("applyRulesToCollections", () => {
+    it("merges rules into matching collection schema", () => {
+        const rb = defineRule(Posts, (R) => ({ list: R.public() }));
+        const [merged] = applyRulesToCollections([Posts], [rb]);
+        expect(merged.schema["x-rules"]).toBeDefined();
+        expect(merged.schema["x-rules"].list).toEqual({ op: "public" });
+    });
+    it("collection without RuleBinding has no x-rules", () => {
+        const merged = applyRulesToCollections([Posts, Users], []);
+        expect(merged[0].schema).not.toHaveProperty("x-rules");
+        expect(merged[1].schema).not.toHaveProperty("x-rules");
+    });
+    it("no rules array at all — all collections have no x-rules", () => {
+        const merged = applyRulesToCollections([Posts, Users], []);
+        for (const c of merged) {
+            expect(c.schema).not.toHaveProperty("x-rules");
+        }
+    });
+    it("RuleBinding for unknown collection name throws", () => {
+        const rb = defineRule(Posts, (R) => ({ list: R.public() }));
+        const unknown = { ...rb, collectionName: "nonexistent" };
+        expect(() => applyRulesToCollections([Posts], [unknown])).toThrow('RuleBinding references unknown collection "nonexistent"');
+    });
+    it("returns a new array with original collections unmodified", () => {
+        const rb = defineRule(Posts, (R) => ({ list: R.public() }));
+        const merged = applyRulesToCollections([Posts], [rb]);
+        expect(merged).not.toBe([Posts]);
+        expect(Posts.schema).not.toHaveProperty("x-rules");
+    });
+});
+//# sourceMappingURL=define-rule.test.js.map

package/dist/tests/app/define-rule.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-rule.test.js","sourceRoot":"","sources":["../../../tests/app/define-rule.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,KAAK,EAAC,cAAc,EAAE,MAAM,2BAA2B,CAAA;AAChG,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAE7C,OAAO,EAAE,uBAAuB,EAAC,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAEnE,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE;IAC3C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;CACtC,CAAC,CAAA;AACF,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,OAAO,EAAE;IAC3C,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;CACnB,CAAC,CAAA;AACF,MAAM,WAAW,GAAG,cAAc,CAAC,MAAM,CACvC,cAAc,EACd,4DAA4D,EAC5D;IACE,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;IACvB,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE;IAC7B,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE;CAC3B,CACF,CAAA;AAED,QAAQ,CAAC,YAAY,EAAE,GAAG,EAAE;IAC1B,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACnC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAA;IAClC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9C,CAAC,CAAC,CAAA;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC9B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YACvC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,OAAO,EAAE;SAC3C,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YACjC,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAC3B,MAAM,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YAC3D,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACrC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YACnE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC7E,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;YAC7E,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACzE,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;YACzE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAA;YACzF,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE;YACtB,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;YACzE,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sCAAsC,EAAE,GAAG,EAAE;QAC9C,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;QACxC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAChC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE;YAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC/B,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAClC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAClC,OAAO,EAAE,CAAA;QACX,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,EAAE,GAAG,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;SAC1C,CAAC,CAAC,CAAA;QACH,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACnC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAC9C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC9B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;YACvC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE;SACvC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;QACzC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;YAChB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACpC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;YAClB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACvC,CAAC,CAAC,CAAA;QACH,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACnC,MAAM,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACjD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;YAC9B,EAAE,EAAE,IAAI;YACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE;YAC7C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE;SACxC,CAAC,CAAA;QACF,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnD,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;QACvC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAA;IACzC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,CAAC,MAAM,CAAC,GAAG,uBAAuB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;QAC9C,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAE,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QACvD,MAAM,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;QAC1D,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;QAChD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE,CAAA;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAC/D,yDAAyD,CAC1D,CAAA;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAA;QAC3D,MAAM,MAAM,GAAG,uBAAuB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACrD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAQ,CAAC,CAAA;QACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,CAAA;IACpD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/cache/cached-collection.test.js

@@ -1,21 +1,26 @@
-import { SqlClient } from "@effect/sql";
-import { SqliteClient } from "@effect/sql-sqlite-node";
-import { Effect, Either, Layer } from "effect";
 import { performance } from "node:perf_hooks";
+import { SqliteClient } from "@effect/sql-sqlite-node";
 import { describe, it } from "@effect/vitest";
-import { expect } from "vitest";
+import { AuthCollection } from "@gettersethya/mira-client";
 import { BaseCollection } from "@gettersethya/mira-client";
 import { Field } from "@gettersethya/mira-client";
 import { ViewCollection } from "@gettersethya/mira-client";
-import { CollectionService } from "../../src/collection-service/collection-service.js";
-import { NotFoundError } from "../../src/collection-service/errors.js";
+import { Effect, Layer, Result } from "effect";
+import { SqlClient } from "effect/sql";
+import { expect } from "vitest";
+import { applyRulesToCollections, defineRule } from "../../src/app/index.js";
 import { makeCachedCollectionServiceLayer } from "../../src/cache/cached-collection.js";
+import { CollectionService } from "../../src/collection-service/collection-service.js";
+import { NodeCryptoLayer } from "../../src/crypto/node.js";
+import { Dialect } from "../../src/dialect/dialect.js";
+import { sqliteDialect } from "../../src/dialect/dialect-sqlite.js";
+import { NodeAuthServiceLayer } from "../../src/http/auth-node.js";
 import { RepositoryLive } from "../../src/repository/repository.js";
 import { FileStorage, FileStorageNotFound } from "../../src/storage/storage.js";
-import { NodeCryptoLayer } from "../../src/crypto/node.js";
-const Posts = BaseCollection.define("posts", {
+const postsDef = BaseCollection.define("posts", {
     title: Field.text({ maxLength: 100 }),
-}).rules((R) => ({
+});
+const postsRules = defineRule(postsDef, (R) => ({
     list: R.public(),
     view: R.public(),
     create: R.public(),
@@ -25,15 +30,63 @@ const Posts = BaseCollection.define("posts", {
 // Intentionally slow view: 100 000-step recursive CTE forces SQLite to do
 // significant work on every query, making the cache speedup clearly measurable.
 // SUM(n) requires visiting all 100 000 rows — SQLite cannot short-circuit it.
-const SLOW_SQL = `
-WITH RECURSIVE gen(n) AS (SELECT 1 UNION ALL SELECT n+1 FROM gen WHERE n < 100000)
+const SLOW_SQL = `
+WITH RECURSIVE gen(n) AS (SELECT 1 UNION ALL SELECT n+1 FROM gen WHERE n < 100000)
 SELECT 1 AS seqId, 'perf-test-id' AS id, CAST(SUM(n) AS TEXT) AS title FROM gen`;
-const SlowView = ViewCollection.define("slow_posts", SLOW_SQL.trim(), {
+const slowViewDef = ViewCollection.define("slow_posts", SLOW_SQL.trim(), {
     seqId: Field.integer().view(),
     id: Field.text().view(),
     title: Field.text().view(),
-}).rules((R) => ({ list: R.public(), view: R.public() }));
+});
+const slowViewRules = defineRule(slowViewDef, (R) => ({ list: R.public(), view: R.public() }));
 const noCtx = { headers: {}, query: {} };
+const adminCtx = { headers: {}, query: {}, admin: true };
+// Dummy collection — only its `.name` is used by Rule.authId(), never queried.
+const usersDef = BaseCollection.define("users", {
+    name: Field.text({ maxLength: 100 }),
+});
+const usersRules = defineRule(usersDef, (R) => ({
+    list: R.public(),
+    view: R.public(),
+    create: R.public(),
+    update: R.public(),
+    delete: R.public(),
+}));
+const Users = applyRulesToCollections([usersDef], [usersRules])[0];
+// Owner-only rule — scoped by the authenticated identity (@auth_id).
+const notesDef = BaseCollection.define("notes", {
+    ownerId: Field.text({ maxLength: 100 }),
+    body: Field.text({ maxLength: 200 }),
+});
+const notesRules = defineRule(notesDef, (R) => ({
+    list: R.public(),
+    view: R.field("ownerId").eq(R.authId(Users)),
+    create: R.public(),
+    update: R.public(),
+    delete: R.public(),
+}));
+// Tenant-scoped rule — bound by an incoming request query param (@request_query_tenantId).
+const tenantDocsDef = BaseCollection.define("tenant_docs", {
+    tenantId: Field.text({ maxLength: 100 }),
+    body: Field.text({ maxLength: 200 }),
+});
+const tenantDocsRules = defineRule(tenantDocsDef, (R) => ({
+    list: R.public(),
+    view: R.field("tenantId").eq(R.request("query", "tenantId")),
+    create: R.public(),
+    update: R.public(),
+    delete: R.public(),
+}));
+// Auth collection — `password` is x-hidden, stripped from non-admin responses only.
+const accountsDef = AuthCollection.define("accounts", {});
+const accountsRules = defineRule(accountsDef, (R) => ({
+    list: R.public(),
+    view: R.public(),
+    create: R.public(),
+    update: R.public(),
+    delete: R.public(),
+}));
+const [Posts, SlowView, Notes, TenantDocs, Accounts] = applyRulesToCollections([postsDef, slowViewDef, notesDef, tenantDocsDef, accountsDef], [postsRules, slowViewRules, notesRules, tenantDocsRules, accountsRules]);
 const FileStorageTest = Layer.succeed(FileStorage, FileStorage.of({
     upload: (key) => Effect.succeed(key),
     delete: () => Effect.void,
@@ -44,12 +97,13 @@ const FileStorageTest = Layer.succeed(FileStorage, FileStorage.of({
 }));
 const sqliteLayer = SqliteClient.layer({ filename: ":memory:" });
 const perfSqliteLayer = SqliteClient.layer({ filename: ":memory:" });
+const DialectTest = Layer.succeed(Dialect, sqliteDialect);
 const cachedServiceWithDeps = makeCachedCollectionServiceLayer([Posts], {
     recordTtlMs: 60_000,
     listTtlMs: 60_000,
     maxRecords: 100,
     maxLists: 100,
-}).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer));
+}).pipe(Layer.provide(RepositoryLive), Layer.provide(sqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
 // Expose CollectionService AND SqlClient so setupPostsTable can access SqlClient.SqlClient
 const testLayer = Layer.mergeAll(cachedServiceWithDeps, sqliteLayer, FileStorageTest, NodeCryptoLayer);
 const perfCachedServiceWithDeps = makeCachedCollectionServiceLayer([Posts, SlowView], {
@@ -57,40 +111,91 @@ const perfCachedServiceWithDeps = makeCachedCollectionServiceLayer([Posts, SlowV
     listTtlMs: 60_000,
     maxRecords: 100,
     maxLists: 100,
-}).pipe(Layer.provide(RepositoryLive), Layer.provide(perfSqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer));
+}).pipe(Layer.provide(RepositoryLive), Layer.provide(perfSqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
 const perfTestLayer = Layer.mergeAll(perfCachedServiceWithDeps, perfSqliteLayer, FileStorageTest, NodeCryptoLayer);
+const securitySqliteLayer = SqliteClient.layer({ filename: ":memory:" });
+const securityCachedServiceWithDeps = makeCachedCollectionServiceLayer([Notes, TenantDocs, Accounts], {
+    recordTtlMs: 60_000,
+    listTtlMs: 60_000,
+    maxRecords: 100,
+    maxLists: 100,
+}).pipe(Layer.provide(RepositoryLive), Layer.provide(securitySqliteLayer), Layer.provide(FileStorageTest), Layer.provide(NodeCryptoLayer), Layer.provide(DialectTest), Layer.provide(NodeAuthServiceLayer));
+const securityTestLayer = Layer.mergeAll(securityCachedServiceWithDeps, securitySqliteLayer, FileStorageTest, NodeCryptoLayer);
+const setupNotesTable = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "notes" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "ownerId" TEXT NOT NULL,
+      "body"    TEXT NOT NULL,
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
+  `);
+    yield* sql.unsafe(`DELETE FROM "notes"`);
+});
+const setupTenantDocsTable = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "tenant_docs" (
+      "seqId"    INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"       TEXT NOT NULL UNIQUE,
+      "tenantId" TEXT NOT NULL,
+      "body"     TEXT NOT NULL,
+      "created"  TEXT NOT NULL,
+      "updated"  TEXT NOT NULL
+    )
+  `);
+    yield* sql.unsafe(`DELETE FROM "tenant_docs"`);
+});
+const setupAccountsTable = Effect.gen(function* () {
+    const sql = yield* SqlClient.SqlClient;
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "accounts" (
+      "seqId"         INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"            TEXT NOT NULL UNIQUE,
+      "email"         TEXT NOT NULL UNIQUE,
+      "password"      TEXT NOT NULL,
+      "emailVerified" INTEGER NOT NULL DEFAULT 0,
+      "created"       TEXT NOT NULL,
+      "updated"       TEXT NOT NULL
+    )
+  `);
+    yield* sql.unsafe(`DELETE FROM "accounts"`);
+});
 const setupPostsTable = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
-    yield* sql.unsafe(`
-    CREATE TABLE IF NOT EXISTS "posts" (
-      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
-      "id"      TEXT NOT NULL UNIQUE,
-      "title"   TEXT NOT NULL,
-      "created" TEXT NOT NULL,
-      "updated" TEXT NOT NULL
-    )
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "posts" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "title"   TEXT NOT NULL,
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
   `);
     yield* sql.unsafe(`DELETE FROM "posts"`);
 });
 const setupPerfView = Effect.gen(function* () {
     const sql = yield* SqlClient.SqlClient;
     // posts table required by the layer even though SlowView doesn't query it
-    yield* sql.unsafe(`
-    CREATE TABLE IF NOT EXISTS "posts" (
-      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
-      "id"      TEXT NOT NULL UNIQUE,
-      "title"   TEXT NOT NULL,
-      "created" TEXT NOT NULL,
-      "updated" TEXT NOT NULL
-    )
+    yield* sql.unsafe(`
+    CREATE TABLE IF NOT EXISTS "posts" (
+      "seqId"   INTEGER PRIMARY KEY AUTOINCREMENT,
+      "id"      TEXT NOT NULL UNIQUE,
+      "title"   TEXT NOT NULL,
+      "created" TEXT NOT NULL,
+      "updated" TEXT NOT NULL
+    )
   `);
     yield* sql.unsafe(`DROP VIEW IF EXISTS "slow_posts"`);
     // This view is intentionally bad: the 100 000-step CTE forces SQLite to do
     // real work on every query execution. SUM(n) requires all rows — no early exit.
-    yield* sql.unsafe(`
-    CREATE VIEW "slow_posts" AS
-    WITH RECURSIVE gen(n) AS (SELECT 1 UNION ALL SELECT n+1 FROM gen WHERE n < 100000)
-    SELECT 1 AS seqId, 'perf-test-id' AS id, CAST(SUM(n) AS TEXT) AS title FROM gen
+    yield* sql.unsafe(`
+    CREATE VIEW "slow_posts" AS
+    WITH RECURSIVE gen(n) AS (SELECT 1 UNION ALL SELECT n+1 FROM gen WHERE n < 100000)
+    SELECT 1 AS seqId, 'perf-test-id' AS id, CAST(SUM(n) AS TEXT) AS title FROM gen
   `);
 });
 describe("CachedCollectionService", () => {
@@ -132,10 +237,10 @@ describe("CachedCollectionService", () => {
         // Delete via service — invalidates cache
         yield* svc.delete(Posts, id, noCtx);
         // View should fail with NotFoundError
-        const result = yield* Effect.either(svc.view(Posts, id, noCtx));
-        expect(Either.isLeft(result)).toBe(true);
-        if (Either.isLeft(result)) {
-            expect(result.left instanceof NotFoundError).toBe(true);
+        const result = yield* Effect.result(svc.view(Posts, id, noCtx));
+        expect(Result.isFailure(result)).toBe(true);
+        if (Result.isFailure(result)) {
+            expect(result.failure._tag).toBe("NotFoundError");
         }
     }).pipe(Effect.provide(testLayer)));
     it.effect("list cache hit — second list returns cached count after direct DB insert", () => Effect.gen(function* () {
@@ -184,7 +289,7 @@ describe("CachedCollectionService", () => {
     it.effect("list cache invalidated by delete — record no longer in list", () => Effect.gen(function* () {
         yield* setupPostsTable;
         const svc = yield* CollectionService;
-        const r1 = yield* svc.create(Posts, { title: "Keep" }, noCtx);
+        yield* svc.create(Posts, { title: "Keep" }, noCtx);
         const r2 = yield* svc.create(Posts, { title: "Remove" }, noCtx);
         const id2 = r2["id"];
         // Prime the list cache
@@ -200,6 +305,61 @@ describe("CachedCollectionService", () => {
         expect(titles).not.toContain("Remove");
     }).pipe(Effect.provide(testLayer)));
 });
+describe("Cache key authorization scoping (security)", () => {
+    it.effect("auth-identity-bound rule — cache must not leak a record across different owners", () => Effect.gen(function* () {
+        yield* setupNotesTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(Notes, { ownerId: "userA", body: "secret" }, noCtx);
+        const id = created["id"];
+        const ctxOwner = { headers: {}, query: {}, auth: { collection: "users", record: { id: "userA" } } };
+        const ctxOther = { headers: {}, query: {}, auth: { collection: "users", record: { id: "userB" } } };
+        // Owner views their own note — populates the cache
+        const ownerView = yield* svc.view(Notes, id, ctxOwner);
+        expect(ownerView["body"]).toBe("secret");
+        // A different identity requests the same id/select/expand within the TTL window.
+        // The rule (ownerId == @auth_id) denies userB at the DB layer — a cache hit must
+        // not bypass that check and hand back userA's row.
+        const otherView = yield* Effect.result(svc.view(Notes, id, ctxOther));
+        expect(Result.isFailure(otherView)).toBe(true);
+        if (Result.isFailure(otherView)) {
+            expect(otherView.failure._tag).toBe("NotFoundError");
+        }
+    }).pipe(Effect.provide(securityTestLayer)));
+    it.effect("request-query-bound rule — cache must not leak a record across different query values", () => Effect.gen(function* () {
+        yield* setupTenantDocsTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(TenantDocs, { tenantId: "tenant-1", body: "secret" }, noCtx);
+        const id = created["id"];
+        const ctxTenant1 = { headers: {}, query: { tenantId: "tenant-1" } };
+        const ctxTenant2 = { headers: {}, query: { tenantId: "tenant-2" } };
+        // tenant-1 views the doc — populates the cache
+        const tenant1View = yield* svc.view(TenantDocs, id, ctxTenant1);
+        expect(tenant1View["body"]).toBe("secret");
+        // tenant-2 requests the same id/select/expand within the TTL window.
+        // The rule (tenantId == @request_query_tenantId) denies tenant-2 at the DB layer —
+        // a cache hit must not bypass that check.
+        const tenant2View = yield* Effect.result(svc.view(TenantDocs, id, ctxTenant2));
+        expect(Result.isFailure(tenant2View)).toBe(true);
+        if (Result.isFailure(tenant2View)) {
+            expect(tenant2View.failure._tag).toBe("NotFoundError");
+        }
+    }).pipe(Effect.provide(securityTestLayer)));
+    it.effect("ctx.admin-bound field visibility — cache must not leak hidden fields to non-admin requests", () => Effect.gen(function* () {
+        yield* setupAccountsTable;
+        const svc = yield* CollectionService;
+        const created = yield* svc.create(Accounts, { email: "a@b.com", password: "hashed-secret" }, adminCtx);
+        const id = created["id"];
+        // Admin views the record — password is x-hidden but admin bypasses field hiding —
+        // populates the cache with the password included. The password is hashed on
+        // write, so assert presence rather than the literal seeded value.
+        const adminView = yield* svc.view(Accounts, id, adminCtx);
+        expect(typeof adminView["password"]).toBe("string");
+        // Non-admin requests the same id/select/expand within the TTL window.
+        // A cache hit must not hand back the admin's unfiltered response.
+        const nonAdminView = yield* svc.view(Accounts, id, noCtx);
+        expect(nonAdminView["password"]).toBeUndefined();
+    }).pipe(Effect.provide(securityTestLayer)));
+});
 describe("Performance — cache vs. DB", () => {
     // Each test uses a fresh :memory: DB and empty cache via perfTestLayer.
     // slow_posts VIEW forces 100 000 recursive CTE steps + full SUM aggregation