@happyvertical/smrt-core 0.38.2 → 0.38.4

package/dist/vite-plugin/sveltekit-generator.js

@@ -1,6 +1,7 @@
 import { generateConditionalGetRouteHelper } from "../generators/conditional-get.js";
 import { AUTO_GENERATED_ROUTE_HEADER } from "./route-header.js";
 import { generateChangesRoute } from "./changes-route.js";
+import { generateEventsRoute } from "./events-route.js";
 import { generateSyncApplyRoute } from "./sync-apply-route.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
@@ -175,6 +176,59 @@ function getApiPublicAccess(apiConfig) {
 	if (value === true || value === "read") return value;
 	return false;
 }
+function toFieldColumnAlias(fieldName) {
+	return fieldName.replace(/([A-Z]+)([A-Z][a-z])/g, "$1_$2").replace(/([a-z\d])([A-Z])/g, "$1_$2").replace(/[-\s]+/g, "_").toLowerCase();
+}
+function manifestObjectKey(objectDef) {
+	return objectDef.qualifiedName ?? objectDef.className;
+}
+function manifestObjectExtends(objectDef, parent) {
+	const extendsQualified = objectDef.extendsQualified;
+	const extendsName = objectDef.extends;
+	return typeof extendsQualified === "string" && extendsQualified === parent.qualifiedName || typeof extendsName === "string" && (extendsName === parent.className || extendsName === parent.qualifiedName);
+}
+function findManifestParent(objectDef, manifest) {
+	return Object.values(manifest.objects).find((candidate) => manifestObjectExtends(objectDef, candidate));
+}
+function collectStiHierarchyObjects(objectDef, manifest) {
+	if (!manifest) return [objectDef];
+	let cursor = objectDef;
+	let stiBase = cursor.decoratorConfig?.tableStrategy === "sti" ? cursor : void 0;
+	while (cursor) {
+		const parent = findManifestParent(cursor, manifest);
+		if (!parent) break;
+		if (parent.decoratorConfig?.tableStrategy === "sti") stiBase = parent;
+		cursor = parent;
+	}
+	if (!stiBase) return [objectDef];
+	const members = /* @__PURE__ */ new Map();
+	const visit = (current) => {
+		const key = manifestObjectKey(current);
+		if (members.has(key)) return;
+		members.set(key, current);
+		for (const candidate of Object.values(manifest.objects)) {
+			if (candidate === current) continue;
+			if (manifestObjectExtends(candidate, current)) visit(candidate);
+		}
+	};
+	visit(stiBase);
+	return [...members.values()];
+}
+function collectReadPermissionFields(objectDef, manifest) {
+	const result = [];
+	const seen = /* @__PURE__ */ new Set();
+	for (const member of collectStiHierarchyObjects(objectDef, manifest)) for (const [name, def] of Object.entries(member.fields ?? {})) {
+		const permission = typeof def.readPermission === "string" ? def.readPermission : typeof def._meta?.readPermission === "string" ? def._meta.readPermission : void 0;
+		if (!permission) continue;
+		for (const fieldName of [name, toFieldColumnAlias(name)]) {
+			const key = `${fieldName}\0${permission}`;
+			if (seen.has(key)) continue;
+			seen.add(key);
+			result.push([fieldName, permission]);
+		}
+	}
+	return result;
+}
 /**
 * Emit the fail-closed authorization guard injected into generated route files
 * (#1540, 2c). Every generated CRUD/action handler calls `requireRouteAuth`,
@@ -182,12 +236,18 @@ function getApiPublicAccess(apiConfig) {
 * authenticated principal. Mirrors the knowledge-route `isKnowledgeAdmin`
 * precedent. Mutating verbs require auth even when reads are public.
 */
-function generateAuthGuardHelper(objectDef) {
+function generateAuthGuardHelper(objectDef, manifest) {
 	const publicAccess = getApiPublicAccess(objectDef.decoratorConfig?.api);
+	const readPermissionFields = collectReadPermissionFields(objectDef, manifest);
 	return `
 // Fail-closed authorization (#1540): generated routes require an authenticated
 // principal on \`locals\` unless explicitly marked \`@smrt({ api: { public } })\`.
 const PUBLIC_ACCESS: boolean | 'read' = ${JSON.stringify(publicAccess)};
+const READ_PERMISSION_FIELDS: Array<[string, string]> = ${JSON.stringify(readPermissionFields)};
+
+interface PublicJsonOptions {
+  permissions?: Iterable<string>;
+}
 
 function hasAuthenticatedPrincipal(locals: unknown): boolean {
   if (!locals || typeof locals !== 'object') return false;
@@ -215,13 +275,74 @@ function requireRouteAuth(locals: unknown, mutating: boolean): void {
   }
 }
 
+function getPublicJsonOptions(locals: unknown): PublicJsonOptions {
+  const l = readJsonRecord(locals);
+  const permissions = l.permissions ?? l.permissionSet ?? l.smrtPermissions;
+  if (Array.isArray(permissions) || permissions instanceof Set) {
+    return { permissions };
+  }
+  return {};
+}
+
+function hasReadPermission(
+  options: PublicJsonOptions,
+  permission: string,
+): boolean {
+  if (!options.permissions) return false;
+  for (const granted of options.permissions) {
+    if (granted === permission) return true;
+  }
+  return false;
+}
+
+function applyReadPermissionRedaction(
+  value: unknown,
+  options: PublicJsonOptions,
+  seen: WeakSet<object> = new WeakSet(),
+): unknown {
+  if (value === null || typeof value !== 'object') return value;
+  if (seen.has(value)) return null;
+  if (hasPublicJson(value)) {
+    seen.add(value);
+    return applyReadPermissionRedaction(
+      value.toPublicJSON(options),
+      options,
+      seen,
+    );
+  }
+  if (Array.isArray(value)) {
+    seen.add(value);
+    return value.map((entry) =>
+      applyReadPermissionRedaction(entry, options, seen),
+    );
+  }
+  const proto = Object.getPrototypeOf(value);
+  if (proto !== Object.prototype && proto !== null) return value;
+  seen.add(value);
+  const out = { ...(value as Record<string, unknown>) };
+  const metaData =
+    out._meta_data && typeof out._meta_data === 'object'
+      ? { ...(out._meta_data as Record<string, unknown>) }
+      : null;
+  for (const [fieldName, permission] of READ_PERMISSION_FIELDS) {
+    if (hasReadPermission(options, permission)) continue;
+    delete out[fieldName];
+    if (metaData) delete metaData[fieldName];
+  }
+  if (metaData) out._meta_data = metaData;
+  for (const [key, entry] of Object.entries(out)) {
+    out[key] = applyReadPermissionRedaction(entry, options, seen);
+  }
+  return out;
+}
+
 // Sensitive-field-safe serialization for custom-action results (#1540): a
 // custom method may return a SmrtObject (or one nested in an array/plain
 // object), so recurse and route each through toPublicJSON() rather than letting
 // JSON.stringify call toJSON(). Non-plain instances (Date, etc.) and primitives
 // pass through; a cycle guard prevents infinite loops.
 interface PublicJsonSource {
-  toPublicJSON(): unknown;
+  toPublicJSON(options?: PublicJsonOptions): unknown;
 }
 
 function hasPublicJson(value: object): value is PublicJsonSource {
@@ -238,17 +359,18 @@ function readJsonRecord(value: unknown): Record<string, unknown> {
 
 function toPublicResult(
   value: unknown,
+  options: PublicJsonOptions,
   seen: WeakSet<object> = new WeakSet(),
 ): unknown {
   if (value === null || typeof value !== 'object') return value;
   if (seen.has(value)) return null;
   if (hasPublicJson(value)) {
     seen.add(value);
-    return toPublicResult(value.toPublicJSON(), seen);
+    return toPublicResult(value.toPublicJSON(options), options, seen);
   }
   if (Array.isArray(value)) {
     seen.add(value);
-    return value.map((entry) => toPublicResult(entry, seen));
+    return value.map((entry) => toPublicResult(entry, options, seen));
   }
   const proto = Object.getPrototypeOf(value);
   if (proto !== Object.prototype && proto !== null) return value;
@@ -257,7 +379,7 @@ function toPublicResult(
   for (const [key, entry] of Object.entries(
     value as Record<string, unknown>,
   )) {
-    out[key] = toPublicResult(entry, seen);
+    out[key] = toPublicResult(entry, options, seen);
   }
   return out;
 }
@@ -293,7 +415,7 @@ function isTenantScoped(objectDef) {
 */
 function generateTenantContextHelper() {
 	return `
-import { enterTenantContext, hasTenantContext, isTenancyEnabled } from '@happyvertical/smrt-tenancy';
+import { enterTenantContext, getCurrentTenant, hasTenantContext, isSuperAdminBypass, isTenancyEnabled } from '@happyvertical/smrt-tenancy';
 
 function establishTenantContext(locals: unknown): void {
   if (hasTenantContext()) return;
@@ -319,6 +441,18 @@ function tenantReadScope(): { tenantId: null } | undefined {
     ? { tenantId: null }
     : undefined;
 }
+
+// Custom GET actions that accept a single options object may perform their
+// own reads instead of calling generated list/get handlers. Give those actions
+// an explicit tenant scope: active tenant when present, NULL-tenant global rows
+// when tenancy is enabled but no tenant context exists. Super-admin bypass
+// stays unscoped so admin callers keep deliberate cross-tenant access.
+function tenantReadOptionsScope(): { tenantId: string | null } | undefined {
+  if (!isTenancyEnabled() || isSuperAdminBypass()) {
+    return undefined;
+  }
+  return { tenantId: getCurrentTenant()?.tenantId ?? null };
+}
 `;
 }
 /**
@@ -388,10 +522,14 @@ function buildPathParamsObjectLiteral(pathParamNames) {
 ${pathParamNames.map((paramName) => `    ${buildObjectTypeProperty(paramName)}: ${buildRouteParamAccess(paramName)},`).join("\n")}
   }`;
 }
-function buildActionInvocationArgs(actionDef) {
+function hasSingleOptionsParameter(actionDef) {
+	const parameters = Array.isArray(actionDef.parameters) ? actionDef.parameters : [];
+	return parameters.length === 1 && parameters[0]?.name === "options";
+}
+function buildActionInvocationArgs(actionDef, optionsIdentifier = "options") {
 	const parameters = Array.isArray(actionDef.parameters) ? actionDef.parameters : [];
 	if (parameters.length === 0) return [];
-	if (parameters.length === 1 && parameters[0]?.name === "options") return ["options"];
+	if (hasSingleOptionsParameter(actionDef)) return [optionsIdentifier];
 	return parameters.map((parameter) => buildOptionsPropertyAccess(parameter.name));
 }
 function buildObjectTypeProperty(propertyName) {
@@ -456,6 +594,21 @@ function buildActionInvocationExpression(receiverExpression, actionName, invocat
 		"  )"
 	].join("\n");
 }
+function buildScopedOptionsForTenantRead(actionDef, routeConfig, tenantScoped) {
+	if (!tenantScoped || routeConfig.method !== "GET" || !hasSingleOptionsParameter(actionDef)) return {
+		source: "",
+		optionsIdentifier: "options"
+	};
+	return {
+		source: `  const readScope = tenantReadOptionsScope();
+  const scopedOptions = readScope
+    ? ({ ...options, ...readScope } as ActionArgs[0])
+    : options;
+
+`,
+		optionsIdentifier: "scopedOptions"
+	};
+}
 function findItemClassRegistryKey(className, objectDef, manifest) {
 	const itemClassName = objectDef.extendsTypeArg || (className.endsWith("Collection") ? className.slice(0, -10) : void 0);
 	if (!itemClassName) return className;
@@ -492,12 +645,13 @@ async function generateSvelteKitRoutes(projectRoot, manifest, options) {
 			}
 			continue;
 		}
-		await generateRoutesForObject(projectRoot, className, objectDef, options);
+		await generateRoutesForObject(projectRoot, className, objectDef, manifest, options);
 		generatedCount++;
 	}
 	if (options.knowledge?.api?.enabled) generateKnowledgeRoute(projectRoot, options);
 	generateSyncApplyRoute(projectRoot, manifest, options);
 	generateChangesRoute(projectRoot, manifest, options);
+	generateEventsRoute(projectRoot, manifest, options);
 	updateGitignore(projectRoot, options);
 	const skippedMsg = skippedCollections > 0 ? ` (skipped ${skippedCollections} collection classes)` : "";
 	console.log(`[smrt] Generated routes for ${generatedCount} SMRT objects${skippedMsg}`);
@@ -780,7 +934,7 @@ export async function getCollection<
 /**
 * Generates route files for a single SMRT object
 */
-async function generateRoutesForObject(projectRoot, className, objectDef, options) {
+async function generateRoutesForObject(projectRoot, className, objectDef, manifest, options) {
 	const collectionName = objectDef.collection;
 	const routeDir = join(projectRoot, options.routesDir, collectionName);
 	const apiConfig = objectDef.decoratorConfig?.api;
@@ -789,9 +943,9 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
 		return;
 	}
 	const includedActions = resolveStandardCrudActions(apiConfig);
-	if (includedActions.includes("list") || includedActions.includes("create")) writeRoute(routeDir, "+server.ts", generateCollectionRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir));
+	if (includedActions.includes("list") || includedActions.includes("create")) writeRoute(routeDir, "+server.ts", generateCollectionRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir));
 	if (includedActions.includes("get") || includedActions.includes("update") || includedActions.includes("delete")) {
-		const itemRoute = generateItemRouteTemplate(projectRoot, className, objectDef, includedActions, options, join(routeDir, "[id]"));
+		const itemRoute = generateItemRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, join(routeDir, "[id]"));
 		writeRoute(join(routeDir, "[id]"), "+server.ts", itemRoute);
 	}
 	const customActions = Object.entries(objectDef.methods).filter(([name, method]) => !STANDARD_API_ACTIONS.includes(name) && method.isPublic && shouldIncludeInApi(name, apiConfig));
@@ -816,7 +970,7 @@ async function generateRoutesForObject(projectRoot, className, objectDef, option
 			}
 		});
 	}
-	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, options));
+	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, manifest, options));
 }
 async function generateCollectionRoutesForObject(projectRoot, className, objectDef, manifest, options) {
 	const apiConfig = objectDef.decoratorConfig?.api;
@@ -851,7 +1005,7 @@ async function generateCollectionRoutesForObject(projectRoot, className, objectD
 		});
 	}
 	for (const [actionRouteDir, routeSpecs] of groupCustomActionRoutes(actionSpecs)) {
-		writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, options));
+		writeRoute(actionRouteDir, "+server.ts", generateActionRouteTemplate(projectRoot, actionRouteDir, routeSpecs, objectDef, manifest, options));
 		generatedAnyRoutes = true;
 	}
 	return generatedAnyRoutes;
@@ -998,13 +1152,15 @@ function isLocalObject(projectRoot, objectDef) {
 /**
 * Generates collection route template (GET list, POST create)
 */
-function generateCollectionRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
+function generateCollectionRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir) {
 	const hasGet = includedActions.includes("list");
 	const hasPost = includedActions.includes("create");
 	const modelType = resolveObjectTypeReference(projectRoot, className, objectDef, options, routeDir);
 	const serializers = resolveStandardRouteSerializers(objectDef.decoratorConfig?.api);
 	const serializerImports = serializers.importStatements.join("\n");
 	const listUsesSerializer = !!serializers.listItemSerializerName;
+	const listUsesPermissionScopedBody = collectReadPermissionFields(objectDef, manifest).length > 0;
+	const listUsesBodyHash = listUsesSerializer || listUsesPermissionScopedBody;
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
@@ -1012,10 +1168,11 @@ import { error${hasPost ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
 // Note: ${className} is auto-registered by the Vite plugin scanner
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+${generateAuthGuardHelper(objectDef, manifest)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPost ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
 		tenantScoped: isTenantScoped(objectDef),
+		permissionScoped: listUsesPermissionScopedBody,
 		modelName: className,
-		useBodyHash: listUsesSerializer
+		useBodyHash: listUsesBodyHash
 	}) : ""}`;
 	const listAndCount = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
   const items = await collection.list({ limit, offset, where: readScope });
@@ -1025,6 +1182,7 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 // List all ${className.toLowerCase()}s
 export const GET: RequestHandler = async ({ locals, url, request }) => {
 ${routeGuardPreamble(objectDef, false)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const limit = Number(url.searchParams.get('limit')) || 50;
   const offset = Number(url.searchParams.get('offset')) || 0;
 
@@ -1032,13 +1190,21 @@ ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${listUsesSerializer ? `${listAndCount}
   // Custom serializer may render related-table data → v1 body-hash ETag (#1765).
   const serializedItems = await Promise.all(
-    items.map((item) => ${serializers.listItemSerializerName}(item)),
+    items.map(async (item) =>
+      applyReadPermissionRedaction(
+        await ${serializers.listItemSerializerName}(item),
+        publicJsonOptions,
+      ),
+    ),
   );
-  return conditionalJson(request, { items: serializedItems, count, limit, offset });` : `  // ETag v2 (#1765): the table-version ETag is checked first; on a concrete
+  return conditionalJson(request, { items: serializedItems, count, limit, offset });` : listUsesPermissionScopedBody ? `${listAndCount}
+  // Field read permissions make the body vary by caller permissions → v1 body-hash ETag (#1565).
+  const items_public = items.map((item) => item.toPublicJSON(publicJsonOptions));
+  return conditionalJson(request, { items: items_public, count, limit, offset });` : `  // ETag v2 (#1765): the table-version ETag is checked first; on a concrete
   // If-None-Match the list query below never runs (zero-query 304).
   return conditionalVersionedRead(request, collection.db, collection.tableName, async () => {
 ${listAndCount}
-    const items_public = items.map((item) => item.toPublicJSON());
+    const items_public = items.map((item) => item.toPublicJSON(publicJsonOptions));
     return { items: items_public, count, limit, offset };
   });`}
 };
@@ -1047,6 +1213,7 @@ ${listAndCount}
 // Create new ${className.toLowerCase()}
 export const POST: RequestHandler = async ({ locals, request }) => {
 ${routeGuardPreamble(objectDef, true)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const body: unknown = await request.json();
   const data = applyWritablePolicy(body);
 
@@ -1056,8 +1223,11 @@ ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);
 
-  return json(serializedItem, { status: 201 });` : `
-  return json(item.toPublicJSON(), { status: 201 });`}
+  return json(
+    applyReadPermissionRedaction(serializedItem, publicJsonOptions),
+    { status: 201 },
+  );` : `
+  return json(item.toPublicJSON(publicJsonOptions), { status: 201 });`}
 };
 ` : "";
 	return imports + getHandler + postHandler;
@@ -1101,7 +1271,7 @@ function generateClassNotRegisteredError(className) {
 /**
 * Generates item route template (GET, PUT, DELETE)
 */
-function generateItemRouteTemplate(projectRoot, className, objectDef, includedActions, options, routeDir) {
+function generateItemRouteTemplate(projectRoot, className, objectDef, manifest, includedActions, options, routeDir) {
 	const hasGet = includedActions.includes("get");
 	const hasPut = includedActions.includes("update");
 	const hasDelete = includedActions.includes("delete");
@@ -1110,16 +1280,19 @@ function generateItemRouteTemplate(projectRoot, className, objectDef, includedAc
 	const serializers = resolveStandardRouteSerializers(objectDef.decoratorConfig?.api);
 	const serializerImports = serializers.importStatements.join("\n");
 	const getUsesSerializer = !!serializers.itemSerializerName;
+	const getUsesPermissionScopedBody = collectReadPermissionFields(objectDef, manifest).length > 0;
+	const getUsesBodyHash = getUsesSerializer || getUsesPermissionScopedBody;
 	const imports = `${AUTO_GENERATED_ROUTE_HEADER}
 // DO NOT EDIT - changes will be overwritten
 
 import { error${hasPut || hasDelete ? ", json" : ""} } from '@sveltejs/kit';
 ${serializerImports ? `${serializerImports}\n` : ""}import { getCollection } from '$lib/server/smrt';
 ${modelType.importStatement ? `${modelType.importStatement}\n` : ""}import type { RequestHandler } from './$types';
-${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
+${generateAuthGuardHelper(objectDef, manifest)}${isTenantScoped(objectDef) ? generateTenantContextHelper() : ""}${hasPut ? generateWritablePolicyHelper(objectDef) : ""}${hasGet ? generateConditionalGetRouteHelper(objectDef.decoratorConfig?.api, {
 		tenantScoped: isTenantScoped(objectDef),
+		permissionScoped: getUsesPermissionScopedBody,
 		modelName: className,
-		useBodyHash: getUsesSerializer
+		useBodyHash: getUsesBodyHash
 	}) : ""}`;
 	const getForRead = isTenantScoped(objectDef) ? `  const readScope = tenantReadScope();
   const item = await collection.get(
@@ -1129,18 +1302,25 @@ ${generateAuthGuardHelper(objectDef)}${isTenantScoped(objectDef) ? generateTenan
 // Get single ${simpleClassName.toLowerCase()}
 export const GET: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, false)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
 ${getUsesSerializer ? `${getForRead}
 ${generateNotFoundError(className)}
   // Custom serializer may render related-table data → v1 body-hash ETag (#1765).
   const serializedItem = await ${serializers.itemSerializerName}(item);
-  return conditionalJson(request, serializedItem);` : `  // ETag v2 (#1765): a concrete If-None-Match answers 304 without the row fetch
+  return conditionalJson(
+    request,
+    applyReadPermissionRedaction(serializedItem, publicJsonOptions),
+  );` : getUsesPermissionScopedBody ? `${getForRead}
+${generateNotFoundError(className)}
+  // Field read permissions make the body vary by caller permissions → v1 body-hash ETag (#1565).
+  return conditionalJson(request, item.toPublicJSON(publicJsonOptions));` : `  // ETag v2 (#1765): a concrete If-None-Match answers 304 without the row fetch
   // (a delete advances the version, so a since-deleted row can't false-match);
   // a wildcard \`*\` is deferred until the fetch confirms the row exists.
   return conditionalVersionedRead(request, collection.db, collection.tableName, async () => {
 ${getForRead}
 ${generateNotFoundError(className)}
-    return item.toPublicJSON();
+    return item.toPublicJSON(publicJsonOptions);
   });`}
 };
 ` : "";
@@ -1148,6 +1328,7 @@ ${generateNotFoundError(className)}
 // Update ${simpleClassName.toLowerCase()}
 export const PUT: RequestHandler = async ({ locals, params, request }) => {
 ${routeGuardPreamble(objectDef, true)}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(className, { typeName: modelType.typeName })}
   const item = await collection.get(params.id);
 ${generateNotFoundError(className)}
@@ -1159,8 +1340,8 @@ ${generateNotFoundError(className)}
 ${serializers.itemSerializerName ? `
   const serializedItem = await ${serializers.itemSerializerName}(item);
 
-  return json(serializedItem);` : `
-  return json(item.toPublicJSON());`}
+  return json(applyReadPermissionRedaction(serializedItem, publicJsonOptions));` : `
+  return json(item.toPublicJSON(publicJsonOptions));`}
 };
 ` : "";
 	const deleteHandler = hasDelete ? `
@@ -1180,7 +1361,7 @@ ${generateNotFoundError(className)}
 /**
 * Generates custom action route template
 */
-function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDef, options) {
+function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDef, manifest, options) {
 	if (routeSpecs.length === 0) throw new Error("Cannot generate a custom action route without handlers");
 	const [firstSpec] = routeSpecs;
 	const { lookupClassName, routeConfig, hostType } = firstSpec;
@@ -1200,7 +1381,7 @@ function generateActionRouteTemplate(projectRoot, routeDir, routeSpecs, objectDe
 // DO NOT EDIT - changes will be overwritten
 
 ${importBlock}
-${generateAuthGuardHelper(objectDef)}${tenantScoped ? generateTenantContextHelper() : ""}
+${generateAuthGuardHelper(objectDef, manifest)}${tenantScoped ? generateTenantContextHelper() : ""}
 ${handlers}`;
 }
 function generateActionRouteHandler(lookupClassName, actionName, actionDef, routeConfig, hostType, tenantScoped, lookupTypeName, hostTypeName) {
@@ -1209,53 +1390,73 @@ function generateActionRouteHandler(lookupClassName, actionName, actionDef, rout
 	if (tenantScoped) guardLines.push("  establishTenantContext(locals);");
 	const authGuardLine = guardLines.join("\n");
 	const needsRequest = actionDef.parameters.length > 0;
-	const invocationArgs = buildActionInvocationArgs(actionDef);
 	const collectionHandlerArgs = buildRouteHandlerArgs(routeConfig.pathParamNames.length > 0, needsRequest);
 	const itemHandlerArgs = buildRouteHandlerArgs(true, needsRequest);
 	if (hostType === "collection") {
 		const optionsLoad = buildActionOptionsLoad(actionName, actionDef, routeConfig, hostTypeName, actionDef.isStatic);
 		const receiverExpression = actionDef.isStatic ? "CollectionClass" : "typedCollection";
 		const staticTargetLoad = actionDef.isStatic ? `  const CollectionClass = typedCollection.constructor as typeof ${hostTypeName};\n` : "";
+		const scopedOptions = buildScopedOptionsForTenantRead(actionDef, routeConfig, tenantScoped);
+		const invocationArgs = buildActionInvocationArgs(actionDef, scopedOptions.optionsIdentifier);
 		return `// Custom collection method: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
   const typedCollection = collection as unknown as ${hostTypeName};
 ${generateCollectionNotRegisteredError(lookupClassName)}
 ${staticTargetLoad}
 
-${optionsLoad}  const result = ${buildActionInvocationExpression(receiverExpression, actionName, invocationArgs)};
+${optionsLoad}${scopedOptions.source}  const result = ${buildActionInvocationExpression(receiverExpression, actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 	}
 	if (routeConfig.scope === "collection") {
 		const optionsLoad = buildActionOptionsLoad(actionName, actionDef, routeConfig, hostTypeName, true);
+		const scopedOptions = buildScopedOptionsForTenantRead(actionDef, routeConfig, tenantScoped);
+		const invocationArgs = buildActionInvocationArgs(actionDef, scopedOptions.optionsIdentifier);
 		return `// Custom collection action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${collectionHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
   const registered = ObjectRegistry.getClass('${lookupClassName}');
 ${generateClassNotRegisteredError(lookupClassName)}
 
-${optionsLoad}  const ClassRef = registered.constructor as typeof ${hostTypeName};
+${optionsLoad}${scopedOptions.source}  const ClassRef = registered.constructor as typeof ${hostTypeName};
   const result = ${buildActionInvocationExpression("ClassRef", actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 	}
 	const optionsLoad = buildActionOptionsLoad(actionName, actionDef, routeConfig, hostTypeName, false);
+	const scopedItemLoad = tenantScoped && routeConfig.method === "GET" ? `  const readScope = tenantReadScope();
+  const item = await collection.get(
+    readScope ? { id: params.id, ...readScope } : params.id,
+  );` : "  const item = await collection.get(params.id);";
+	const invocationArgs = buildActionInvocationArgs(actionDef);
 	return `// Custom action: ${actionName}
 export const ${handlerName}: RequestHandler = async (${itemHandlerArgs}) => {
 ${authGuardLine}
+  const publicJsonOptions = getPublicJsonOptions(locals);
 ${generateCollectionLoad(lookupClassName, { typeName: lookupTypeName })}
-  const item = await collection.get(params.id);
+${scopedItemLoad}
 ${generateNotFoundError(lookupClassName)}
 
 ${optionsLoad}  const result = ${buildActionInvocationExpression("item", actionName, invocationArgs)};
 
-  return json({ action: '${actionName}', result: toPublicResult(result) });
+  return json({
+    action: '${actionName}',
+    result: toPublicResult(result, publicJsonOptions),
+  });
 };
 `;
 }