@happyvertical/smrt-core 0.37.7 → 0.37.9

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,5 +1,7 @@
 import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
+import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
 import { generateSyncApplyRoute } from "./sync-apply-route.js";
+import { generateChangesRoute } from "./changes-route.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
 //#region src/vite-plugin/sveltekit-generator.ts
@@ -8,7 +10,6 @@ import { join, relative } from "node:path";
 * Generates real TypeScript files in src/routes/api/ based on discovered SMRT objects
 */
 var BIOME_LINE_WIDTH = 80;
-var AUTO_GENERATED_ROUTE_HEADER = "// Auto-generated by @smrt/core vite plugin";
 var STANDARD_API_ACTIONS = [
 	"list",
 	"get",
@@ -271,24 +272,28 @@ function isTenantScoped(objectDef) {
 	return !!objectDef.decoratorConfig?.tenantScoped;
 }
 /**
-* Emit the tenant-context establishment helper for `@TenantScoped` objects
-* (#1540, facet 2). Generated handlers call `establishTenantContext(locals)`
-* after the auth guard so every collection query runs inside the tenant context
-* derived from the authenticated principal — engaging the `@TenantScoped`
-* interceptors that auto-filter by tenant.
+* Emit the tenant-context establishment + fail-closed read-scope helpers for
+* `@TenantScoped` objects (#1540 facet 2; #1782). Generated handlers call
+* `establishTenantContext(locals)` after the auth guard so every query runs
+* inside the tenant context derived from the authenticated principal — engaging
+* the `@TenantScoped` interceptors that auto-filter by tenant.
 *
-* Without this, an `optional`-mode scoped object queried over a generated route
-* with no active context returns rows from ALL tenants (the interceptor only
-* hard-fails `required` mode). We read the canonical `locals.tenantId` set by
-* the smrt-users auth hook (with `user`/`session` fallbacks). It is a no-op when
-* a context is already active (e.g. an upstream tenancy handle) or when the
-* principal carries no tenant (global/admin — preserving optional-mode global
-* access). Imported only for tenant-scoped routes, which already depend on
-* `@happyvertical/smrt-tenancy`.
+* `establishTenantContext` reads the canonical `locals.tenantId` set by the
+* smrt-users auth hook (with `user`/`session` fallbacks). It is a no-op when a
+* context is already active (e.g. an upstream tenancy handle) or when the
+* request carries no tenant (anonymous / global principal).
+*
+* When no context could be established, an `optional`-mode read would otherwise
+* fall through the interceptor UNFILTERED and return rows from ALL tenants (the
+* interceptor only hard-fails `required` mode) — the #1782 leak. So read
+* handlers additionally call `tenantReadScope()`, which restricts reads to
+* NULL-tenant (global) rows only when tenancy is enabled but no context is
+* active. Both helpers are imported only for tenant-scoped routes, which already
+* depend on `@happyvertical/smrt-tenancy`.
 */
 function generateTenantContextHelper() {
 	return `
-import { enterTenantContext, hasTenantContext } from '@happyvertical/smrt-tenancy';
+import { enterTenantContext, hasTenantContext, isTenancyEnabled } from '@happyvertical/smrt-tenancy';
 
 function establishTenantContext(locals: unknown): void {
   if (hasTenantContext()) return;
@@ -301,6 +306,19 @@ function establishTenantContext(locals: unknown): void {
     enterTenantContext({ tenantId });
   }
 }
+
+// Fail-closed read scope (#1782): a public/anonymous read on a @TenantScoped
+// model has no tenant context, so the tenancy interceptor (optional mode) would
+// pass the query through UNFILTERED and return every tenant's rows. When tenancy
+// is enabled but no context was established, restrict reads to NULL-tenant
+// (global) rows only — mirroring the dispatch resolver + _changes convention:
+// tenancy enforced with no context => global rows only. Returns undefined when a
+// context is active (the interceptor filters by it) or tenancy is disabled.
+function tenantReadScope(): { tenantId: null } | undefined {
+  return isTenancyEnabled() && !hasTenantContext()
+    ? { tenantId: null }
+    : undefined;
+}
 `;
 }
 /**
@@ -479,6 +497,7 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 	}
 	if (options.knowledge?.api?.enabled) generateKnowledgeRoute(projectRoot, options);
 	generateSyncApplyRoute(projectRoot, manifest, options);
+	generateChangesRoute(projectRoot, manifest, options);
 	updateGitignore(projectRoot, options);
 	const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
 	console.log(`[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`);
@@ -492,7 +511,7 @@ function clearGeneratedRouteFiles(routesRoot) {
 			continue;
 		}
 		if (!entry.isFile() || entry.name !== "+server.ts") continue;
-		if (readFileSync(entryPath, "utf-8").startsWith(AUTO_GENERATED_ROUTE_HEADER)) unlinkSync(entryPath);
+		if (readFileSync(entryPath, "utf-8").startsWith("// Auto-generated by @smrt/core vite plugin")) unlinkSync(entryPath);
 	}
 }
 function knowledgeRouteDir(projectRoot, options) {
@@ -509,7 +528,7 @@ function svelteKitRouteRoot(routesDir) {
 function clearGeneratedKnowledgeRoute(projectRoot, options) {
 	const routePath = join(knowledgeRouteDir(projectRoot, options), "+server.ts");
 	if (!existsSync(routePath)) return;
-	if (readFileSync(routePath, "utf-8").startsWith(AUTO_GENERATED_ROUTE_HEADER)) unlinkSync(routePath);
+	if (readFileSync(routePath, "utf-8").startsWith("// Auto-generated by @smrt/core vite plugin")) unlinkSync(routePath);
 }
 function generateKnowledgeRoute(projectRoot, options) {
 	writeRoute(knowledgeRouteDir(projectRoot, options), "+server.ts", generateKnowledgeRouteTemplate(options.knowledge ?? {}, readKnowledgeRouteArtifact(projectRoot)));
@@ -996,6 +1015,10 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 		tenantScoped: isTenantScoped(objectDef),
 		modelName: className
 	}) : ""}`;
+	const listAndCount = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
+  const items = await collection.list({ limit, offset, where: readScope });
+  const count = await collection.count({ where: readScope });` : `  const items = await collection.list({ limit, offset });
+  const count = await collection.count();`;
 	const getHandler = hasGet ? `
 // List all ${className.toLowerCase()}s
 export const GET: RequestHandler = async ({ locals, url, request }) => {
@@ -1004,8 +1027,7 @@ ${routeGuardPreamble(objectDef, false)}
   const offset = Number(url.searchParams.get('offset')) || 0;
 
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
-  const items = await collection.list({ limit, offset });
-  const count = await collection.count();
+${listAndCount}
 ${serializers.listItemSerializerName ? `
   const serializedItems = await Promise.all(
     items.map((item) => ${serializers.listItemSerializerName}(item)),
@@ -1092,12 +1114,16 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 		tenantScoped: isTenantScoped(objectDef),
 		modelName: className
 	}) : ""}`;
+	const getForRead = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
+  const item = await collection.get(
+    readScope ? { id: params.id, ...readScope } : params.id,
+  );` : `  const item = await collection.get(params.id);`;
 	const getHandler = hasGet ? `
 // Get single ${simpleClassName.toLowerCase()}
 export const GET: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, false)}
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
-  const item = await collection.get(params.id);
+${getForRead}
 ${generateNotFoundError(className)}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);