@guren/server 1.0.0-rc.13 → 1.0.0-rc.15

package/dist/authorization/index.d.ts

@@ -1,5 +1,5 @@
-import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CNkBYf8m.js';
-export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CNkBYf8m.js';
+import { f as Policy$1, A as AuthUser, a as AuthorizationResponse, G as Gate, b as AuthorizeOptions } from '../Gate-CynjZCtS.js';
+export { c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, R as Response, j as ResponseBuilder, k as authorize, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from '../Gate-CynjZCtS.js';
 import { Context } from 'hono';
 import { M as Middleware } from '../index-9_Jzj5jo.js';
 

package/dist/authorization/index.js

@@ -364,13 +364,29 @@ var Gate = class {
   }
   /**
    * Check a policy for the given ability.
+   *
+   * The subject may be a class instance (policy resolved via its constructor)
+   * or a `[ModelClass, record]` / `['key', record]` tuple. The tuple form is
+   * required for plain records returned by the ORM, which carry no constructor
+   * information.
    */
   async checkPolicy(ability, user, model, additionalArgs) {
-    const modelConstructor = model?.constructor;
-    if (!modelConstructor) {
+    let policyKey;
+    let subject = model;
+    let hasSubject = true;
+    if (Array.isArray(model) && model.length === 2 && (typeof model[0] === "function" || typeof model[0] === "string")) {
+      policyKey = model[0];
+      subject = model[1];
+    } else if (typeof model === "function") {
+      policyKey = model;
+      hasSubject = false;
+    } else {
+      policyKey = model?.constructor;
+    }
+    if (!policyKey) {
       return void 0;
     }
-    const policyClass = this.policies.get(modelConstructor);
+    const policyClass = this.policies.get(policyKey);
     if (!policyClass) {
       return void 0;
     }
@@ -383,7 +399,7 @@ var Gate = class {
     }
     const method = policy[ability];
     if (typeof method === "function") {
-      return method.call(policy, user, model, ...additionalArgs);
+      return hasSubject ? method.call(policy, user, subject, ...additionalArgs) : method.call(policy, user, ...additionalArgs);
     }
     return void 0;
   }

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-DtWDHXr1.js';
-export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getJob, aP as getNotificationManager, aQ as getQueueDriver, aR as getRegisteredJobs, aS as getValidatedData, aT as inertia, aU as parseRequestPayload, aV as registerJob, aW as resolve, aX as setContainer, aY as setExceptionHandler, aZ as setInertiaSharedProps, a_ as setNotificationManager, a$ as setQueueDriver, b0 as validate, b1 as validateRequest, b2 as validateRequestWith, b3 as validateSafe, b4 as verifyCsrfToken } from './Application-DtWDHXr1.js';
+import { E as ErrorResponse, S as ServiceProvider, C as Container, c as ServiceBindings, Q as QueueManager, N as NotificationManager } from './Application-CddorcPa.js';
+export { A as Application, d as ApplicationListenOptions, e as AuthPayload, f as CSRF_FORM_FIELD, g as CSRF_HEADER_NAME, h as CSRF_TOKEN_KEY, P as ContainerProvider, i as ContextualBinding, j as ContextualBindingBuilder, k as ContextualNeedsBuilder, m as Controller, n as ControllerInertiaProps, o as CsrfOptions, p as DatabaseChannelOptions, q as DatabaseNotification, r as ExceptionClass, t as ExceptionHandler, u as ExceptionHandlerOptions, v as ExceptionRenderer, w as ExceptionReporter, F as FailedJob, H as HostAuthorizationOptions, x as HstsOptions, I as InertiaOptions, y as InertiaPagePayload, z as InertiaResponse, B as InertiaSharedProps, J as InertiaSsrContext, K as InertiaSsrOptions, L as InertiaSsrRenderer, M as InertiaSsrResult, O as InferInertiaProps, R as Job, T as JobClass, U as JobFailureHandler, V as JobHandler, W as JobOptions, X as Notifiable, Y as Notification, Z as NotificationAttachment, _ as NotificationChannel, $ as NotificationChannelFactory, a0 as NotificationClass, a1 as NotificationMailMessage, a2 as NotificationManagerOptions, a3 as ProviderManager, a4 as QueueConfig, a5 as QueueDriver, a6 as QueueDriverFactory, a7 as QueuedJob, a8 as RendererRegistration, a9 as ResolvedSharedInertiaProps, aa as ResourceRouteOptions, ab as RouteBuilder, ac as RouteContractOptions, ad as RouteDefinition, ae as RouteOpenApiMetadata, af as RouteResourceAction, ag as Router, ah as SecurityHeadersOptions, ai as SentNotification, aj as ServiceBinding, ak as ServiceClass, al as ServiceFactory, am as ServiceProviderClass, an as ServiceProviderConstructor, ao as ServiceProviderOptions, ap as SharedInertiaPropsResolver, aq as SlackAttachment, ar as SlackBlock, as as SlackMessage, at as VALIDATED_DATA_KEY, au as ValidateRequestOptions, av as ValidationSchema, aw as WorkerOptions, ax as abort, ay as abortIf, az as abortUnless, aA as clearJobRegistry, aB as createApp, aC as createContainer, aD as createCsrfMiddleware, aE as createExceptionHandler, aF as createHostAuthorizationMiddleware, aG as createNotificationManager, aH as createQueueManager, aI as createSecurityHeaders, aJ as csrfField, aK as formatValidationErrors, aL as getContainer, aM as getCsrfToken, aN as getExceptionHandler, aO as getJob, aP as getNotificationManager, aQ as getQueueDriver, aR as getRegisteredJobs, aS as getValidatedData, aT as inertia, aU as parseRequestPayload, aV as registerJob, aW as resolve, aX as setContainer, aY as setExceptionHandler, aZ as setInertiaSharedProps, a_ as setNotificationManager, a$ as setQueueDriver, b0 as validate, b1 as validateRequest, b2 as validateRequestWith, b3 as validateSafe, b4 as verifyCsrfToken } from './Application-CddorcPa.js';
 import * as hono from 'hono';
 import { Context, MiddlewareHandler } from 'hono';
 export { Context } from 'hono';
-import { a as AuthContext } from './api-token-JOif2CtG.js';
-export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, e as AuthCredentials, A as AuthManager, f as AuthManagerOptions, g as Authenticatable, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, G as Guard, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, n as MemorySessionStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, S as Session, z as SessionData, D as SessionStore, U as UserProvider, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, R as createSessionMiddleware, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Y as getSessionFromContext, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from './api-token-JOif2CtG.js';
+import { a as AuthContext } from './api-token-BGOsfuI9.js';
+export { c as API_TOKEN_KEY, b as ApiToken, d as ApiTokenStore, e as AuthCredentials, A as AuthManager, f as AuthManagerOptions, g as Authenticatable, B as BaseUserProvider, h as BearerTokenMiddlewareOptions, i as CreateApiTokenOptions, j as CreateApiTokenResult, G as Guard, k as GuardContext, l as GuardFactory, M as MemoryApiTokenStore, m as MemoryOAuthStateStore, n as MemorySessionStore, o as ModelUserProvider, p as OAuthAuthorizeOptions, q as OAuthCallbackPayload, O as OAuthManager, r as OAuthManagerOptions, s as OAuthProviderConfig, t as OAuthProviderFactoryInput, u as OAuthStateConfig, v as OAuthStatePayload, w as OAuthStateStore, x as OAuthTokenResult, y as OAuthUserProfile, P as ProviderFactory, S as Session, z as SessionData, D as SessionStore, U as UserProvider, E as buildOAuthAuthorizeUrl, F as buildOAuthRedirectUrl, H as createApiToken, I as createBearerTokenMiddleware, J as createDiscordOAuthProviderConfig, K as createGitHubOAuthProviderConfig, L as createGoogleOAuthProviderConfig, N as createOAuthManager, Q as createOAuthState, R as createSessionMiddleware, T as exchangeOAuthCode, V as fetchOAuthUserProfile, W as getApiToken, X as getApiTokenOrFail, Y as getSessionFromContext, Z as getUserApiTokens, _ as parseApiToken, $ as parseOAuthRedirectUrl, a0 as revokeAllApiTokens, a1 as revokeApiToken, a2 as tokenCan, a3 as tokenCanAll, a4 as tokenCanAny, a5 as verifyApiToken, a6 as verifyOAuthState } from './api-token-BGOsfuI9.js';
 export { AuthenticatableModel, EmailVerificationConfig, EmailVerificationToken, EmailVerificationTokenResult, EmailVerificationTokenStore, ScryptHasher as Hash, MemoryEmailVerificationStore, MemoryPasswordResetStore, NodeHasher, PasswordResetConfig, PasswordResetTokenResult, PasswordResetTokenStore, ScryptHasher, SessionGuard, buildPasswordResetUrl, buildVerificationUrl, completeEmailVerification, completePasswordReset, createEmailVerificationToken, createPasswordResetToken, isEmailVerified, parsePasswordResetUrl, parseVerificationUrl, requireVerifiedEmail, verifyEmailToken, verifyPasswordResetToken } from './auth/index.js';
 export { M as Middleware, d as defineMiddleware, j as jsonResponse } from './index-9_Jzj5jo.js';
 import { E as EventManager } from './EventManager-CmIoLt7r.js';
@@ -35,15 +35,16 @@ export { DatabaseChannel, MailChannel, MailChannelOptions, MemoryChannel, SlackC
 import { B as BroadcastManager } from './BroadcastManager-AkIWUGJo.js';
 export { A as AuthMiddlewareOptions, a as BroadcastDriver, b as BroadcastDriverFactory, c as BroadcastEvent, d as BroadcastManagerOptions, e as BroadcastableEvent, C as Channel, f as ChannelAuthorizer, g as ChannelRegistration, P as PresenceBroadcastDriver, h as PresenceChannel, i as PresenceChannelAuthorizer, j as PresenceMember, k as PrivateChannel, S as SSEClient, l as SSEMiddlewareOptions, W as WebSocketClient, m as createBroadcastManager, n as getBroadcastManager, s as setBroadcastManager } from './BroadcastManager-AkIWUGJo.js';
 export { RedisClient as BroadcastRedisClient, RedisDriverOptions as BroadcastRedisDriverOptions, MemoryDriver as MemoryBroadcastDriver, RedisDriver as RedisBroadcastDriver, createTypedBroadcaster } from './broadcasting/index.js';
-import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-CqCVrdZs.js';
-export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-CqCVrdZs.js';
+import { I as InputInterface, P as ParsedSignature, O as OptionDefinition, a as CommandInstance, b as OutputInterface } from './ConsoleKernel-BlCJEZTR.js';
+export { A as ArgumentDefinition, c as CommandClass, C as ConsoleKernel, d as ConsoleKernelOptions, e as ProgressInterface, f as PromptInterface, S as ScheduledCommand, g as createConsoleKernel } from './ConsoleKernel-BlCJEZTR.js';
 import * as readline from 'readline';
-export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CNkBYf8m.js';
+export { R as AuthResponse, A as AuthUser, a as AuthorizationResponse, b as AuthorizeOptions, G as Gate, c as GateCallback, d as GateDefinition, e as GateOptions, P as PolicyClass, f as PolicyInterface, g as PolicyMethod, h as PolicyRegistration, i as ResourceAction, j as ResponseBuilder, k as authorizeAbility, l as can, m as cannot, n as createGate, o as defineGate, p as getGate, s as setGate } from './Gate-CynjZCtS.js';
 export { AuthorizedContext, Policy, authorizeAllMiddleware, authorizeMiddleware, authorizeResourceMiddleware, definePolicy, withAuthorization } from './authorization/index.js';
 export { A as AppKeyring, D as DecryptOptions, a as EncryptOptions, b as EncryptedPayload, E as Encrypter, c as EncrypterConfig, H as HashAlgorithm, d as HmacOptions, P as PasswordHashOptions, R as RandomStringOptions, e as createEncrypter, f as decrypt, g as deriveAppKey, h as deriveAppKeyring, i as encrypt, j as generateAppKey, k as generateKey, l as getAppKeyringFromEnv, m as getEncrypter, n as normalizeAppKey, p as parseAppKey, o as parsePreviousAppKeys, s as setEncrypter } from './app-key-CsBfRC_Q.js';
 export { MessageSigner, SignMessageOptions, SignedMessageClaims, SignedUrlOptions, VerifySignedMessageOptions, VerifySignedUrlOptions, check as checkHash, generateOtp, generatePassword, generateSlug, hash, hashPassword, hmac, md5, needsRehash, pick, random, randomBase64, randomBase64Url, randomHex, randomInt, randomString, sample, secureCompare, sha256, sha512, shuffle, signUrl, urlSafeToken, uuid, verifyHmac, verifyPassword, verifySignedUrl } from './encryption/index.js';
 import Redis, { RedisOptions } from 'ioredis';
 import 'vite';
+import '@guren/orm';
 
 interface RequireAuthOptions {
     redirectTo?: string;
@@ -160,6 +161,17 @@ interface RateLimitOptions {
      * @default 'rl:'
      */
     keyPrefix?: string;
+    /**
+     * Trust reverse-proxy headers for client IP resolution, checked in order:
+     * `CF-Connecting-IP`, `True-Client-IP`, `X-Real-IP`, then the first entry
+     * of `X-Forwarded-For`. Falls back to `server.requestIP()` when none are set.
+     *
+     * Enable ONLY when every request passes through a proxy that sets or strips
+     * these headers — on direct deployments clients can spoof them to bypass
+     * per-client limits. Ignored when a custom `keyGenerator` is supplied.
+     * @default false
+     */
+    trustProxy?: boolean;
 }
 /**
  * Create a rate limiting middleware.
@@ -732,11 +744,6 @@ declare class MethodNotAllowedException extends HttpException {
     static forMethod(method: string, allowedMethods: string[]): MethodNotAllowedException;
 }
 
-/**
- * Generate a production-friendly HTML error page.
- * Shows status code, a generic message, and a link back to the home page.
- * No stack traces or internal details are exposed.
- */
 declare function renderErrorPage(statusCode: number, message?: string): string;
 
 type ViewRenderer = (template: string, props: Record<string, unknown>) => Response | Promise<Response>;
@@ -868,7 +875,9 @@ declare class SchedulingServiceProvider extends ServiceProvider {
 }
 
 /**
- * Binds the Gate as a singleton in the container.
+ * Binds the Gate as a singleton in the container and exposes it as the
+ * global gate so `getGate()`, `can()`, and controller authorization helpers
+ * work without manual wiring.
  */
 declare class AuthorizationServiceProvider extends ServiceProvider {
     register(): void;