@isaijs/core 0.1.3 → 0.1.4

package/dist/auth/index.js

@@ -1,3 +1,3 @@
-import { t as Policy } from "../policies-CKIdBFKt.js";
-import { a as createAuth, t as Auth } from "../create-auth-Ci0PaBoX.js";
+import { t as Policy } from "../policies-D_G5Rmxv.js";
+import { a as createAuth, t as Auth } from "../create-auth-9y_43vJf.js";
 export { Auth, Policy, createAuth };

package/dist/cli/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { V as toKind, z as object } from "../validation-Cppmd0RV.js";
 import { M as dialectFor, m as emptySnapshot, r as sync, t as migrate, y as MigrationError } from "../migrator-BU3_PHk8.js";
-import { a as lookupsOf, i as filterableOf, n as isRequired, t as Resource, u as Route } from "../resource-CsYksjKc.js";
+import { a as lookupsOf, i as filterableOf, n as isRequired, t as Resource, u as Route } from "../resource-CkzoR3Rq.js";
 import { F as sensitivity, c as fieldOf, r as Model } from "../base64url-C5GTYIL5.js";
 import { t as kebabCase } from "../case-BnpcvhdW.js";
 import { i as makeMigrations, n as checkSteps, t as checkMigrations } from "../make-DKBn79cH.js";

package/dist/{create-auth-Ci0PaBoX.js → create-auth-9y_43vJf.js}

@@ -1,6 +1,6 @@
 import { t as fromBase64url } from "./base64url-C5GTYIL5.js";
 import { n as PROVIDERS } from "./tables-IrLjsomf.js";
-import { a as byRole, c as tenant, i as anyone, l as user, n as PolicyRegistry, o as owner, s as readsTenant } from "./policies-CKIdBFKt.js";
+import { a as byRole, c as tenant, i as anyone, l as user, n as PolicyRegistry, o as owner, s as readsTenant } from "./policies-D_G5Rmxv.js";
 //#region src/auth/create-auth.ts
 const methods = { oauth: (provider, options) => ({
 	kind: "oauth",

package/dist/index.js

@@ -1,13 +1,13 @@
 import { G as ValidationError, H as validate, V as toKind, h as line, o as fileTypeNames, p as email, z as object } from "./validation-Cppmd0RV.js";
 import { B as NeedsDatabase, C as database, D as planInsert, E as recordAction, F as systemClock, J as UniqueFailed, K as NotFound, L as PLATFORM, O as planUpdate, R as TENANT, S as clockOf, U as modelOfRow, V as evaluate, j as conditionOf, k as keyCondition, r as sync, t as migrate, w as decodeStored, z as checkTenancy } from "./migrator-BU3_PHk8.js";
-import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-CsYksjKc.js";
+import { C as tooLarge, E as fail, S as tenantSuspended, T as Rejected, _ as json, b as routeNotFound, c as fromBody, d as route, f as HttpError, g as fileTypeRefused, h as fileTooLarge, l as readInput, m as errorResponse, o as parseListQuery, p as crossSiteRequest, r as resource, s as BODY_LIMIT, t as Resource, u as Route, v as lengthRequired, w as tooManyRequests, x as signInRequired, y as methodNotAllowed } from "./resource-CkzoR3Rq.js";
 import { F as sensitivity, G as ulid, K as Scope, V as asActor, a as columnName, b as asCondition$1, c as fieldOf, f as Condition, m as Expr, n as toBase64url, r as Model, t as fromBase64url, u as rowOf } from "./base64url-C5GTYIL5.js";
 import { t as kebabCase } from "./case-BnpcvhdW.js";
 import { t as PLATFORM_PREFIX } from "./tables-IrLjsomf.js";
 import { t as Seed } from "./seed-BObmdKdP.js";
 import { n as notImplemented, t as NotImplementedError } from "./errors-mCNLlXg9.js";
-import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-CKIdBFKt.js";
-import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-Ci0PaBoX.js";
+import { d as afterUpdate, f as bindFor, h as ownerFieldOf, m as isFalse, p as check, u as FALSE } from "./policies-D_G5Rmxv.js";
+import { i as checkRoles, n as authPerms, r as checkAuth } from "./create-auth-9y_43vJf.js";
 import { _ as permissionsOf, a as hashOf, b as syncRoles, c as GoogleError, f as verifyIdToken, g as safeReturn, h as redirect, i as clearedCookie, l as consentUrl, m as cookieOf, n as authModels, o as sessions, p as cookie, t as makers, u as exchangeCode, v as roleKeys, y as seedAs } from "./makers-DeSNM0Nd.js";
 import { t as WrongSize } from "./storage-body-7dWyMszh.js";
 import { RegExpRouter } from "hono/router/reg-exp-router";

package/dist/{policies-CKIdBFKt.js → policies-D_G5Rmxv.js}

@@ -10,6 +10,11 @@ import { D as nodesOf, U as isRecorded, a as columnName, f as Condition, m as Ex
 *   user.<field>    → the user's value (null when anonymous)
 *   tenant.<field>  → the tenant's value
 *
+* A comparison with a value that's null now (`row.author.is(user.id)` for an anonymous asker) is
+* false now, as SQL's would be: so a rule that holds for no row is a denial (401 anonymous), not
+* an empty list. Only where the comparison counts as itself: under a `not` (or as a value) SQL's
+* "unknown" isn't false, so it's left to the database.
+*
 * A user's permissions are loaded once per request, on the first `byRole` that needs them.
 */
 const TRUE = {
@@ -32,7 +37,7 @@ function bindOperand(node, asker, holds, model) {
 		};
 		case "truth": return {
 			t: "truth",
-			condition: bindNode(node.condition, asker, holds, model)
+			condition: bindNode(node.condition, asker, holds, model, false)
 		};
 		case "math": return {
 			...node,
@@ -54,9 +59,9 @@ function bindOperand(node, asker, holds, model) {
 		default: return node;
 	}
 }
-function bindNode(node, asker, holds, model) {
+function bindNode(node, asker, holds, model, positive = true) {
 	const operand = (o) => bindOperand(o, asker, holds, model);
-	const condition = (c) => bindNode(c, asker, holds, model);
+	const condition = (c) => bindNode(c, asker, holds, model, positive);
 	switch (node.t) {
 		case "placeholder": {
 			if (node.name === "anyone") return TRUE;
@@ -69,7 +74,7 @@ function bindNode(node, asker, holds, model) {
 			...node,
 			left: operand(node.left),
 			right: operand(node.right)
-		});
+		}, positive);
 		case "isNull": return {
 			...node,
 			operand: operand(node.operand)
@@ -100,7 +105,7 @@ function bindNode(node, asker, holds, model) {
 			};
 		}
 		case "not": {
-			const item = condition(node.item);
+			const item = bindNode(node.item, asker, holds, model, false);
 			if (isTrue(item)) return FALSE;
 			if (isFalse(item)) return TRUE;
 			return {
@@ -110,8 +115,13 @@ function bindNode(node, asker, holds, model) {
 		}
 	}
 }
-/** A comparison of two values known now (`tenant.coupons.is(true)`) is decided now. */
-function simplifyCompare(node) {
+/**
+* A comparison of two values known now (`tenant.coupons.is(true)`) is decided now; so is one with a
+* value null now, where it counts as itself (`positive`): SQL's `x = NULL` matches no row.
+*/
+function simplifyCompare(node, positive) {
+	const isNullValue = (o) => o.t === "value" && (o.value === null || o.value === void 0);
+	if (isNullValue(node.left) || isNullValue(node.right)) return positive ? FALSE : node;
 	if (node.left.t !== "value" || node.right.t !== "value") return node;
 	const [a, b] = [node.left.value, node.right.value].map((v) => v instanceof Date ? v.getTime() : v);
 	if (a === null || b === null || a === void 0 || b === void 0) return FALSE;

package/dist/{resource-CsYksjKc.js → resource-CkzoR3Rq.js}

@@ -1,7 +1,7 @@
 import { G as ValidationError, H as validate, V as toKind, z as object } from "./validation-Cppmd0RV.js";
 import { J as UniqueFailed, K as NotFound, W as CheckFailed, q as ReferenceFailed } from "./migrator-BU3_PHk8.js";
 import { a as columnName, b as asCondition, j as IMPLICIT_FIELDS, l as computedFieldOf, m as Expr, p as Embed } from "./base64url-C5GTYIL5.js";
-import { r as actionsOf } from "./policies-CKIdBFKt.js";
+import { r as actionsOf } from "./policies-D_G5Rmxv.js";
 import { n as RESERVED, t as LOOKUPS } from "./syntax-CrUZFrS7.js";
 //#region src/api/fail.ts
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@isaijs/core",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "A batteries-included, type-safe TypeScript backend framework. Cloudflare first, no lock-in.",
   "type": "module",
   "license": "MIT",