@happyvertical/smrt-core 0.37.6 → 0.37.8

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,3 +1,5 @@
+import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
+import { generateSyncApplyRoute } from "./sync-apply-route.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
 //#region src/vite-plugin/sveltekit-generator.ts
@@ -269,24 +271,28 @@ function isTenantScoped(objectDef) {
 	return !!objectDef.decoratorConfig?.tenantScoped;
 }
 /**
-* Emit the tenant-context establishment helper for `@TenantScoped` objects
-* (#1540, facet 2). Generated handlers call `establishTenantContext(locals)`
-* after the auth guard so every collection query runs inside the tenant context
-* derived from the authenticated principal — engaging the `@TenantScoped`
-* interceptors that auto-filter by tenant.
+* Emit the tenant-context establishment + fail-closed read-scope helpers for
+* `@TenantScoped` objects (#1540 facet 2; #1782). Generated handlers call
+* `establishTenantContext(locals)` after the auth guard so every query runs
+* inside the tenant context derived from the authenticated principal — engaging
+* the `@TenantScoped` interceptors that auto-filter by tenant.
 *
-* Without this, an `optional`-mode scoped object queried over a generated route
-* with no active context returns rows from ALL tenants (the interceptor only
-* hard-fails `required` mode). We read the canonical `locals.tenantId` set by
-* the smrt-users auth hook (with `user`/`session` fallbacks). It is a no-op when
-* a context is already active (e.g. an upstream tenancy handle) or when the
-* principal carries no tenant (global/admin — preserving optional-mode global
-* access). Imported only for tenant-scoped routes, which already depend on
-* `@happyvertical/smrt-tenancy`.
+* `establishTenantContext` reads the canonical `locals.tenantId` set by the
+* smrt-users auth hook (with `user`/`session` fallbacks). It is a no-op when a
+* context is already active (e.g. an upstream tenancy handle) or when the
+* request carries no tenant (anonymous / global principal).
+*
+* When no context could be established, an `optional`-mode read would otherwise
+* fall through the interceptor UNFILTERED and return rows from ALL tenants (the
+* interceptor only hard-fails `required` mode) — the #1782 leak. So read
+* handlers additionally call `tenantReadScope()`, which restricts reads to
+* NULL-tenant (global) rows only when tenancy is enabled but no context is
+* active. Both helpers are imported only for tenant-scoped routes, which already
+* depend on `@happyvertical/smrt-tenancy`.
 */
 function generateTenantContextHelper() {
 	return `
-import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+import { enterTenantContext, hasTenantContext, isTenancyEnabled } from '@happyvertical/smrt-tenancy';
 
 function establishTenantContext(locals: unknown): void {
   if (hasTenantContext()) return;
@@ -299,6 +305,19 @@ function establishTenantContext(locals: unknown): void {
     enterTenantContext({ tenantId });
   }
 }
+
+// Fail-closed read scope (#1782): a public/anonymous read on a @TenantScoped
+// model has no tenant context, so the tenancy interceptor (optional mode) would
+// pass the query through UNFILTERED and return every tenant's rows. When tenancy
+// is enabled but no context was established, restrict reads to NULL-tenant
+// (global) rows only — mirroring the dispatch resolver + _changes convention:
+// tenancy enforced with no context => global rows only. Returns undefined when a
+// context is active (the interceptor filters by it) or tenancy is disabled.
+function tenantReadScope(): { tenantId: null } | undefined {
+  return isTenancyEnabled() && !hasTenantContext()
+    ? { tenantId: null }
+    : undefined;
+}
 `;
 }
 /**
@@ -476,6 +495,7 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 		generatedCount++;
 	}
 	if (options.knowledge?.api?.enabled) generateKnowledgeRoute(projectRoot, options);
+	generateSyncApplyRoute(projectRoot, manifest, options);
 	updateGitignore(projectRoot, options);
 	const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
 	console.log(`[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`);
@@ -985,29 +1005,35 @@ function generateCollectionRouteTemplate(projectRoot, className, objectDef, incl
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
-import { error, json } from '@sveltejs/kit';
+import { error${hasPost ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
 // Note: ${className} is auto-registered by the Vite plugin scanner
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}`;
+${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+		tenantScoped: isTenantScoped(objectDef),
+		modelName: className
+	}) : ""}`;
+	const listAndCount = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
+  const items = await collection.list({ limit, offset, where: readScope });
+  const count = await collection.count({ where: readScope });` : `  const items = await collection.list({ limit, offset });
+  const count = await collection.count();`;
 	const getHandler = hasGet ? `
 // List all ${className.toLowerCase()}s
-export const GET: RequestHandler = async ({ locals, url }) => {
+export const GET: RequestHandler = async ({ locals, url, request }) => {
 ${routeGuardPreamble(objectDef, false)}
   const limit = Number(url.searchParams.get('limit')) || 50;
   const offset = Number(url.searchParams.get('offset')) || 0;
 
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
-  const items = await collection.list({ limit, offset });
-  const count = await collection.count();
+${listAndCount}
 ${serializers.listItemSerializerName ? `
   const serializedItems = await Promise.all(
     items.map((item) => ${serializers.listItemSerializerName}(item)),
   );
 
-  return json({ items: serializedItems, count, limit, offset });` : `
+  return conditionalJson(request, { items: serializedItems, count, limit, offset });` : `
   const items_public = items.map((item) => item.toPublicJSON());
-  return json({ items: items_public, count, limit, offset });`}
+  return conditionalJson(request, { items: items_public, count, limit, offset });`}
 };
 ` : "";
 	const postHandler = hasPost ? `
@@ -1079,22 +1105,29 @@ function generateItemRouteTemplate(projectRoot, className, objectDef, includedAc
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
-import { error, json } from '@sveltejs/kit';
+import { error${hasPut || hasDelete ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}`;
+${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+		tenantScoped: isTenantScoped(objectDef),
+		modelName: className
+	}) : ""}`;
+	const getForRead = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
+  const item = await collection.get(
+    readScope ? { id: params.id, ...readScope } : params.id,
+  );` : `  const item = await collection.get(params.id);`;
 	const getHandler = hasGet ? `
 // Get single ${simpleClassName.toLowerCase()}
-export const GET: RequestHandler = async ({ locals, params }) => {
+export const GET: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, false)}
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
-  const item = await collection.get(params.id);
+${getForRead}
 ${generateNotFoundError(className)}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);
 
-  return json(serializedItem);` : `
-  return json(item.toPublicJSON());`}
+  return conditionalJson(request, serializedItem);` : `
+  return conditionalJson(request, item.toPublicJSON());`}
 };
 ` : "";
 	const putHandler = hasPut ? `