@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/common/persistence/persistence-runtime.registry.js

@@ -0,0 +1,47 @@
+const models = new Map();
+const foreignColumns = new Map();
+const stores = new Map();
+const storesByModel = new WeakMap();
+let runtime;
+export function registerPersistedModel(registration) {
+    models.set(registration.name, registration);
+}
+export function getPersistedModels() {
+    return [...models.values()];
+}
+export function registerForeignColumns(table, columns) {
+    const known = foreignColumns.get(table) ?? new Set();
+    columns.forEach((column) => known.add(column));
+    foreignColumns.set(table, known);
+}
+export function isForeignColumn(table, column) {
+    return foreignColumns.get(table)?.has(column) ?? false;
+}
+export function registerDataStore(name, store) {
+    stores.set(name, store);
+}
+export function getRegisteredDataStore(name) {
+    return stores.get(name);
+}
+export function getModelStore(connection, name) {
+    if (!connection) {
+        return getRegisteredDataStore(name);
+    }
+    const model = connection.models?.[name];
+    return model ? getStoreForModel(model) : undefined;
+}
+export function bindStoreToModel(model, store) {
+    if (model && typeof model === 'function') {
+        storesByModel.set(model, store);
+    }
+}
+export function getStoreForModel(model) {
+    return model && typeof model === 'function' ? storesByModel.get(model) : undefined;
+}
+export function setPersistenceRuntime(value) {
+    runtime = value;
+}
+export function getPersistenceRuntime() {
+    return runtime;
+}
+//# sourceMappingURL=persistence-runtime.registry.js.map

package/dist/core/common/persistence/persistence-runtime.registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence-runtime.registry.js","sourceRoot":"","sources":["../../../../src/core/common/persistence/persistence-runtime.registry.ts"],"names":[],"mappings":"AAuEA,MAAM,MAAM,GAAG,IAAI,GAAG,EAAsC,CAAC;AAE7D,MAAM,cAAc,GAAG,IAAI,GAAG,EAAuB,CAAC;AACtD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAC;AAMjD,MAAM,aAAa,GAAG,IAAI,OAAO,EAA0B,CAAC;AAC5D,IAAI,OAAuC,CAAC;AAE5C,MAAM,UAAU,sBAAsB,CAAC,YAAwC;IAC7E,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;AAC9B,CAAC;AAMD,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,OAA0B;IAC9E,MAAM,KAAK,GAAG,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;IAC7D,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,cAAc,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,MAAc;IAC3D,OAAO,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC;AACzD,CAAC;AAGD,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAqB;IACnE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,IAAY;IACjD,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAOD,MAAM,UAAU,aAAa,CAC3B,UAAmE,EACnE,IAAY;IAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAMD,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,KAAqB;IACpE,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrF,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAqC;IACzE,OAAO,GAAG,KAAK,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/common/persistence/persistence.tokens.d.ts

@@ -0,0 +1 @@
+export declare function getStoreToken(modelName: string): string;

package/dist/core/common/persistence/persistence.tokens.js

@@ -0,0 +1,4 @@
+export function getStoreToken(modelName) {
+    return `DataStore:${modelName}`;
+}
+//# sourceMappingURL=persistence.tokens.js.map

package/dist/core/common/persistence/persistence.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persistence.tokens.js","sourceRoot":"","sources":["../../../../src/core/common/persistence/persistence.tokens.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,OAAO,aAAa,SAAS,EAAE,CAAC;AAClC,CAAC"}

package/dist/core/common/persistence/policies/audit.policy.d.ts

@@ -0,0 +1,8 @@
+export interface AuditFieldPresence {
+    createdBy: boolean;
+    updatedBy: boolean;
+}
+export declare function resolveAuditActorId(): string | undefined;
+export declare function stampAuditOnWrite(doc: Record<string, any>, actorId: string, fields: AuditFieldPresence, isNew: boolean): void;
+export declare function stampAuditOnUpdate(update: Record<string, any>, actorId: string, fields: AuditFieldPresence): void;
+export declare function stampAuditOnReplace(replacement: Record<string, any>, actorId: string, fields: AuditFieldPresence): void;

package/dist/core/common/persistence/policies/audit.policy.js

@@ -0,0 +1,37 @@
+import { RequestContext } from '../../services/request-context.service.js';
+export function resolveAuditActorId() {
+    return RequestContext.getCurrentUser()?.id || undefined;
+}
+export function stampAuditOnWrite(doc, actorId, fields, isNew) {
+    if (fields.createdBy && isNew && !doc['createdBy']) {
+        doc['createdBy'] = actorId;
+    }
+    if (fields.updatedBy) {
+        doc['updatedBy'] = actorId;
+    }
+}
+export function stampAuditOnUpdate(update, actorId, fields) {
+    if (fields.updatedBy) {
+        update['updatedBy'] = actorId;
+        if (update.$set) {
+            update.$set['updatedBy'] = actorId;
+        }
+    }
+    if (fields.createdBy && !update['createdBy'] && !update.$set?.['createdBy']) {
+        if (!update.$setOnInsert) {
+            update.$setOnInsert = {};
+        }
+        if (!update.$setOnInsert['createdBy']) {
+            update.$setOnInsert['createdBy'] = actorId;
+        }
+    }
+}
+export function stampAuditOnReplace(replacement, actorId, fields) {
+    if (fields.updatedBy) {
+        replacement['updatedBy'] = actorId;
+    }
+    if (fields.createdBy && !replacement['createdBy']) {
+        replacement['createdBy'] = actorId;
+    }
+}
+//# sourceMappingURL=audit.policy.js.map

package/dist/core/common/persistence/policies/audit.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.policy.js","sourceRoot":"","sources":["../../../../../src/core/common/persistence/policies/audit.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAoB3E,MAAM,UAAU,mBAAmB;IACjC,OAAO,cAAc,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,SAAS,CAAC;AAC1D,CAAC;AAMD,MAAM,UAAU,iBAAiB,CAC/B,GAAwB,EACxB,OAAe,EACf,MAA0B,EAC1B,KAAc;IAEd,IAAI,MAAM,CAAC,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAC7B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,GAAG,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IAC7B,CAAC;AACH,CAAC;AAOD,MAAM,UAAU,kBAAkB,CAAC,MAA2B,EAAE,OAAe,EAAE,MAA0B;IACzG,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QAC9B,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QACrC,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YACzB,MAAM,CAAC,YAAY,GAAG,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;QAC7C,CAAC;IACH,CAAC;AACH,CAAC;AAMD,MAAM,UAAU,mBAAmB,CACjC,WAAgC,EAChC,OAAe,EACf,MAA0B;IAE1B,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,WAAW,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,WAAW,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC;IACrC,CAAC;AACH,CAAC"}

package/dist/core/common/persistence/policies/password.policy.d.ts

@@ -0,0 +1,3 @@
+export declare function hashUpdatePassword(update: any): Promise<void>;
+export declare function resetSkipPatternsCache(): void;
+export declare function hashPassword(password: string): Promise<string>;

package/dist/core/common/persistence/policies/password.policy.js

@@ -0,0 +1,46 @@
+import bcrypt from 'bcrypt';
+import { sha256 } from 'js-sha256';
+import { ConfigService } from '../../services/config.service.js';
+export async function hashUpdatePassword(update) {
+    if (!update) {
+        return;
+    }
+    if (update.password) {
+        update.password = await hashPassword(update.password);
+    }
+    if (update.$set?.password) {
+        update.$set.password = await hashPassword(update.$set.password);
+    }
+}
+let compiledSkipPatterns = null;
+export function resetSkipPatternsCache() {
+    compiledSkipPatterns = null;
+}
+function getSkipPatterns() {
+    if (compiledSkipPatterns !== null) {
+        return compiledSkipPatterns;
+    }
+    const pluginConfig = ConfigService.configFastButReadOnly?.security?.mongoosePasswordPlugin;
+    if (pluginConfig && typeof pluginConfig === 'object' && 'skipPatterns' in pluginConfig && pluginConfig.skipPatterns) {
+        compiledSkipPatterns = pluginConfig.skipPatterns.map((p) => p instanceof RegExp ? p : new RegExp(p));
+    }
+    else {
+        compiledSkipPatterns = [];
+    }
+    return compiledSkipPatterns;
+}
+export async function hashPassword(password) {
+    if (/^\$2[aby]\$\d+\$/.test(password)) {
+        return password;
+    }
+    const skipPatterns = getSkipPatterns();
+    if (skipPatterns.some((pattern) => pattern.test(password))) {
+        return password;
+    }
+    const sha256Enabled = ConfigService.configFastButReadOnly?.sha256;
+    if (sha256Enabled && !/^[a-f0-9]{64}$/i.test(password)) {
+        password = sha256(password);
+    }
+    return bcrypt.hash(password, 10);
+}
+//# sourceMappingURL=password.policy.js.map

package/dist/core/common/persistence/policies/password.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.policy.js","sourceRoot":"","sources":["../../../../../src/core/common/persistence/policies/password.policy.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAQjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAW;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,MAAM,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,QAAQ,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAClE,CAAC;AACH,CAAC;AAGD,IAAI,oBAAoB,GAAoB,IAAI,CAAC;AAMjD,MAAM,UAAU,sBAAsB;IACpC,oBAAoB,GAAG,IAAI,CAAC;AAC9B,CAAC;AAED,SAAS,eAAe;IACtB,IAAI,oBAAoB,KAAK,IAAI,EAAE,CAAC;QAClC,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,MAAM,YAAY,GAAG,aAAa,CAAC,qBAAqB,EAAE,QAAQ,EAAE,sBAAsB,CAAC;IAC3F,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,cAAc,IAAI,YAAY,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;QACpH,oBAAoB,GAAI,YAAY,CAAC,YAAoC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClF,CAAC,YAAY,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CACxC,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,oBAAoB,GAAG,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IAEjD,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGD,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAGD,MAAM,aAAa,GAAG,aAAa,CAAC,qBAAqB,EAAE,MAAM,CAAC;IAClE,IAAI,aAAa,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACvD,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC"}

package/dist/core/common/persistence/policies/role-guard.policy.d.ts

@@ -0,0 +1,3 @@
+export declare function isRoleChangeAllowed(): boolean;
+export declare function updateChangesRoles(update: any): boolean;
+export declare function stripRoleChanges(update: any): void;

package/dist/core/common/persistence/policies/role-guard.policy.js

@@ -0,0 +1,46 @@
+import { RoleEnum } from '../../enums/role.enum.js';
+import { ConfigService } from '../../services/config.service.js';
+import { RequestContext } from '../../services/request-context.service.js';
+export function isRoleChangeAllowed() {
+    const currentUser = RequestContext.getCurrentUser();
+    if (!currentUser) {
+        return true;
+    }
+    if (RequestContext.isBypassRoleGuard()) {
+        return true;
+    }
+    if (currentUser.hasRole?.([RoleEnum.ADMIN]) || currentUser.roles?.includes(RoleEnum.ADMIN)) {
+        return true;
+    }
+    const pluginConfig = ConfigService.configFastButReadOnly?.security?.mongooseRoleGuardPlugin;
+    if (pluginConfig && typeof pluginConfig === 'object' && 'allowedRoles' in pluginConfig && pluginConfig.allowedRoles) {
+        const allowedRoles = pluginConfig.allowedRoles;
+        if (currentUser.roles?.some((role) => allowedRoles.includes(role))) {
+            return true;
+        }
+    }
+    return false;
+}
+export function updateChangesRoles(update) {
+    return !!(update?.roles ||
+        update?.$set?.roles ||
+        update?.$push?.roles ||
+        update?.$addToSet?.roles ||
+        update?.$pull?.roles);
+}
+export function stripRoleChanges(update) {
+    delete update.roles;
+    if (update.$set?.roles) {
+        delete update.$set.roles;
+    }
+    if (update.$push?.roles) {
+        delete update.$push.roles;
+    }
+    if (update.$addToSet?.roles) {
+        delete update.$addToSet.roles;
+    }
+    if (update.$pull?.roles) {
+        delete update.$pull.roles;
+    }
+}
+//# sourceMappingURL=role-guard.policy.js.map

package/dist/core/common/persistence/policies/role-guard.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-guard.policy.js","sourceRoot":"","sources":["../../../../../src/core/common/persistence/policies/role-guard.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAkB3E,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAG,cAAc,CAAC,cAAc,EAAE,CAAC;IAEpD,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAc,CAAC,iBAAiB,EAAE,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3F,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,MAAM,YAAY,GAAG,aAAa,CAAC,qBAAqB,EAAE,QAAQ,EAAE,uBAAuB,CAAC;IAC5F,IAAI,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,cAAc,IAAI,YAAY,IAAI,YAAY,CAAC,YAAY,EAAE,CAAC;QACpH,MAAM,YAAY,GAAa,YAAY,CAAC,YAAwB,CAAC;QACrE,IAAI,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,MAAW;IAC5C,OAAO,CAAC,CAAC,CACP,MAAM,EAAE,KAAK;QACb,MAAM,EAAE,IAAI,EAAE,KAAK;QACnB,MAAM,EAAE,KAAK,EAAE,KAAK;QACpB,MAAM,EAAE,SAAS,EAAE,KAAK;QACxB,MAAM,EAAE,KAAK,EAAE,KAAK,CACrB,CAAC;AACJ,CAAC;AAGD,MAAM,UAAU,gBAAgB,CAAC,MAAW;IAC1C,OAAO,MAAM,CAAC,KAAK,CAAC;IACpB,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAC5B,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC;IAChC,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC;IAC5B,CAAC;AACH,CAAC"}

package/dist/core/common/persistence/policies/system-role.policy.d.ts

@@ -0,0 +1,5 @@
+export declare function toRoleArray(value: unknown): string[];
+export declare function assertNoSystemRoles(roles: unknown, alreadyStored?: string[]): void;
+export declare function updateMayIntroduceSystemRoles(update: any): boolean;
+export declare function collectRoleValues(update: any): unknown[];
+export declare function assertUpdateHasNoSystemRoles(update: any, alreadyStored?: string[]): void;

package/dist/core/common/persistence/policies/system-role.policy.js

@@ -0,0 +1,46 @@
+import { BadRequestException } from '@nestjs/common';
+import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../enums/role.enum.js';
+export function toRoleArray(value) {
+    return Array.isArray(value) ? value.filter((entry) => typeof entry === 'string') : [];
+}
+export function assertNoSystemRoles(roles, alreadyStored = []) {
+    if (!Array.isArray(roles)) {
+        return;
+    }
+    const introduced = roles.filter((role) => looksLikeSystemRole(role) && !alreadyStored.includes(role));
+    if (introduced.length) {
+        throw new BadRequestException(`System roles (${SYSTEM_ROLE_PREFIX}*) must never be stored in user.roles: ${introduced.join(', ')}`);
+    }
+}
+export function updateMayIntroduceSystemRoles(update) {
+    return collectRoleValues(update).some((role) => looksLikeSystemRole(role));
+}
+export function collectRoleValues(update) {
+    const values = [
+        ...toRoleArray(update.roles),
+        ...toRoleArray(update.$set?.roles),
+        ...toRoleArray(update.$setOnInsert?.roles),
+    ];
+    for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
+        if (operator === undefined || operator === null) {
+            continue;
+        }
+        values.push(...(Array.isArray(operator?.$each) ? operator.$each : [operator]));
+    }
+    return values;
+}
+export function assertUpdateHasNoSystemRoles(update, alreadyStored = []) {
+    if (!update) {
+        return;
+    }
+    assertNoSystemRoles(update.roles, alreadyStored);
+    assertNoSystemRoles(update.$set?.roles, alreadyStored);
+    assertNoSystemRoles(update.$setOnInsert?.roles, alreadyStored);
+    for (const operator of [update.$push?.roles, update.$addToSet?.roles]) {
+        if (operator === undefined || operator === null) {
+            continue;
+        }
+        assertNoSystemRoles(Array.isArray(operator?.$each) ? operator.$each : [operator], alreadyStored);
+    }
+}
+//# sourceMappingURL=system-role.policy.js.map

package/dist/core/common/persistence/policies/system-role.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"system-role.policy.js","sourceRoot":"","sources":["../../../../../src/core/common/persistence/policies/system-role.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAErD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAWnF,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACzG,CAAC;AAgBD,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,gBAA0B,EAAE;IAC9E,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;IACT,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACtG,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,IAAI,mBAAmB,CAC3B,iBAAiB,kBAAkB,0CAA0C,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACrG,CAAC;IACJ,CAAC;AACH,CAAC;AAGD,MAAM,UAAU,6BAA6B,CAAC,MAAW;IACvD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAGD,MAAM,UAAU,iBAAiB,CAAC,MAAW;IAC3C,MAAM,MAAM,GAAc;QACxB,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC;QAC5B,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC;QAClC,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC;KAC3C,CAAC;IAEF,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAQD,MAAM,UAAU,4BAA4B,CAAC,MAAW,EAAE,gBAA0B,EAAE;IACpF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO;IACT,CAAC;IAED,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;IACjD,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IACvD,mBAAmB,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAG/D,KAAK,MAAM,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QACtE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;IACnG,CAAC;AACH,CAAC"}

package/dist/core/common/persistence/policies/tenant.policy.d.ts

@@ -0,0 +1,19 @@
+export declare function assertOwnTenant(value: unknown, ownTenantId: string, isNew: boolean): void;
+export declare function isTenantPolicyBypassed(modelName?: string): boolean;
+export declare function resolveTenantFilter(modelName?: string): Record<string, any> | undefined;
+export type TenantScope = {
+    kind: 'none';
+} | {
+    kind: 'system';
+} | {
+    kind: 'tenant';
+    tenantId: string;
+} | {
+    kind: 'tenants';
+    tenantIds: readonly string[];
+};
+export declare function resolveTenantScope(): TenantScope;
+export declare function resolveSingleTenantId(modelName?: string): string | undefined;
+export declare function allowedTenantIds(modelName?: string): readonly string[] | undefined;
+export declare function assertRowsInTenantScope(modelName: string | undefined, rows: unknown): void;
+export declare function assertUnfilterableCountAllowed(modelName?: string): void;

package/dist/core/common/persistence/policies/tenant.policy.js

@@ -0,0 +1,120 @@
+import { ForbiddenException, Logger } from '@nestjs/common';
+import { ConfigService } from '../../services/config.service.js';
+import { RequestContext } from '../../services/request-context.service.js';
+const isolationDisabledWarned = new Set();
+function warnIsolationDisabled(modelName) {
+    if (isolationDisabledWarned.has(modelName)) {
+        return;
+    }
+    isolationDisabledWarned.add(modelName);
+    const membershipModel = ConfigService.configFastButReadOnly?.multiTenancy?.membershipModel ?? 'TenantMember';
+    if (modelName === membershipModel) {
+        return;
+    }
+    new Logger('mongooseTenantPlugin').warn(`Tenant isolation is DISABLED for "${modelName}": the schema declares a tenantId field, but ` +
+        `"${modelName}" is listed in multiTenancy.excludeSchemas — so no tenant filter is applied and ` +
+        `every query on it sees every tenant's rows. Remove it from excludeSchemas unless this ` +
+        `collection is genuinely global.`);
+}
+export function assertOwnTenant(value, ownTenantId, isNew) {
+    if (value === undefined || value === null || value === ownTenantId) {
+        return;
+    }
+    throw new ForbiddenException(isNew
+        ? `Cannot create a document in a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`
+        : `Cannot move a document to a foreign tenant (got "${String(value)}", own tenant is "${ownTenantId}")`);
+}
+export function isTenantPolicyBypassed(modelName) {
+    const mtConfig = ConfigService.configFastButReadOnly?.multiTenancy;
+    if (!mtConfig || mtConfig.enabled === false)
+        return true;
+    const context = RequestContext.get();
+    if (!context)
+        return true;
+    if (context.bypassTenantGuard)
+        return true;
+    if (modelName && mtConfig.excludeSchemas?.includes(modelName)) {
+        warnIsolationDisabled(modelName);
+        return true;
+    }
+    return false;
+}
+export function resolveTenantFilter(modelName) {
+    if (isTenantPolicyBypassed(modelName))
+        return undefined;
+    const context = RequestContext.get();
+    const tenantId = context?.tenantId;
+    if (tenantId)
+        return { tenantId };
+    const tenantIds = context?.tenantIds;
+    if (tenantIds)
+        return { tenantId: { $in: tenantIds } };
+    if (context?.isAdminBypass)
+        return {};
+    throw new ForbiddenException('Tenant context required: this data is tenant-scoped but no valid tenant context was provided');
+}
+export function resolveTenantScope() {
+    if (isTenantPolicyBypassed()) {
+        return { kind: 'system' };
+    }
+    const context = RequestContext.get();
+    if (context?.tenantId) {
+        return { kind: 'tenant', tenantId: context.tenantId };
+    }
+    if (context?.tenantIds) {
+        return { kind: 'tenants', tenantIds: context.tenantIds };
+    }
+    if (context?.isAdminBypass) {
+        return { kind: 'system' };
+    }
+    return { kind: 'none' };
+}
+export function resolveSingleTenantId(modelName) {
+    if (isTenantPolicyBypassed(modelName))
+        return undefined;
+    return RequestContext.get()?.tenantId || undefined;
+}
+export function allowedTenantIds(modelName) {
+    if (isTenantPolicyBypassed(modelName))
+        return undefined;
+    const context = RequestContext.get();
+    if (context?.tenantId)
+        return [context.tenantId];
+    if (context?.tenantIds)
+        return context.tenantIds;
+    if (context?.isAdminBypass)
+        return undefined;
+    return [];
+}
+export function assertRowsInTenantScope(modelName, rows) {
+    const allowed = allowedTenantIds(modelName);
+    if (!allowed) {
+        return;
+    }
+    for (const row of Array.isArray(rows) ? rows : [rows]) {
+        if (!row || typeof row !== 'object') {
+            continue;
+        }
+        const tenantId = row.tenantId;
+        if (tenantId === undefined) {
+            continue;
+        }
+        if (tenantId === null || !allowed.includes(String(tenantId))) {
+            new Logger('TenantIsolation').error(`A read of "${modelName ?? 'unknown model'}" returned a row of a tenant outside the caller's scope — ` +
+                'the read filter did not hold on this path; the result was withheld');
+            throw new ForbiddenException('Tenant isolation: the result contains data of another tenant');
+        }
+    }
+}
+export function assertUnfilterableCountAllowed(modelName) {
+    if (isTenantPolicyBypassed(modelName)) {
+        return;
+    }
+    const context = RequestContext.get();
+    if (context?.isAdminBypass && !context?.tenantId) {
+        return;
+    }
+    throw new ForbiddenException("estimatedDocumentCount() cannot be tenant-filtered and would expose other tenants' row counts — " +
+        'use countDocuments() instead');
+}
+//# sourceMappingURL=tenant.policy.js.map

package/dist/core/common/persistence/policies/tenant.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant.policy.js","sourceRoot":"","sources":["../../../../../src/core/common/persistence/policies/tenant.policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,2CAA2C,CAAC;AAY3E,MAAM,uBAAuB,GAAG,IAAI,GAAG,EAAU,CAAC;AAoBlD,SAAS,qBAAqB,CAAC,SAAiB;IAC9C,IAAI,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,OAAO;IACT,CAAC;IACD,uBAAuB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAEvC,MAAM,eAAe,GAAG,aAAa,CAAC,qBAAqB,EAAE,YAAY,EAAE,eAAe,IAAI,cAAc,CAAC;IAC7G,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;QAClC,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CACrC,qCAAqC,SAAS,+CAA+C;QAC3F,IAAI,SAAS,kFAAkF;QAC/F,wFAAwF;QACxF,iCAAiC,CACpC,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,eAAe,CAAC,KAAc,EAAE,WAAmB,EAAE,KAAc;IACjF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,EAAE,CAAC;QACnE,OAAO;IACT,CAAC;IACD,MAAM,IAAI,kBAAkB,CAC1B,KAAK;QACH,CAAC,CAAC,sDAAsD,MAAM,CAAC,KAAK,CAAC,qBAAqB,WAAW,IAAI;QACzG,CAAC,CAAC,oDAAoD,MAAM,CAAC,KAAK,CAAC,qBAAqB,WAAW,IAAI,CAC1G,CAAC;AACJ,CAAC;AASD,MAAM,UAAU,sBAAsB,CAAC,SAAkB;IACvD,MAAM,QAAQ,GAAG,aAAa,CAAC,qBAAqB,EAAE,YAAY,CAAC;IACnE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IAEzD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,SAAS,IAAI,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9D,qBAAqB,CAAC,SAAS,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAeD,MAAM,UAAU,mBAAmB,CAAC,SAAkB;IACpD,IAAI,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IAGrC,MAAM,QAAQ,GAAG,OAAO,EAAE,QAAQ,CAAC;IACnC,IAAI,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAGlC,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,CAAC;IACrC,IAAI,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,CAAC;IAGvD,IAAI,OAAO,EAAE,aAAa;QAAE,OAAO,EAAE,CAAC;IAItC,MAAM,IAAI,kBAAkB,CAC1B,8FAA8F,CAC/F,CAAC;AACJ,CAAC;AAkBD,MAAM,UAAU,kBAAkB;IAChC,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,QAAQ,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,EAAE,aAAa,EAAE,CAAC;QAC3B,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAMD,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,IAAI,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAExD,OAAO,cAAc,CAAC,GAAG,EAAE,EAAE,QAAQ,IAAI,SAAS,CAAC;AACrD,CAAC;AAOD,MAAM,UAAU,gBAAgB,CAAC,SAAkB;IACjD,IAAI,sBAAsB,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAExD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,SAAS;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC;IACjD,IAAI,OAAO,EAAE,aAAa;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,EAAE,CAAC;AACZ,CAAC;AAaD,MAAM,UAAU,uBAAuB,CAAC,SAA6B,EAAE,IAAa;IAClF,MAAM,OAAO,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QACD,MAAM,QAAQ,GAAI,GAA8B,CAAC,QAAQ,CAAC;QAC1D,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,SAAS;QACX,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,CAAC,iBAAiB,CAAC,CAAC,KAAK,CACjC,cAAc,SAAS,IAAI,eAAe,4DAA4D;gBACpG,oEAAoE,CACvE,CAAC;YACF,MAAM,IAAI,kBAAkB,CAAC,8DAA8D,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC;AACH,CAAC;AAQD,MAAM,UAAU,8BAA8B,CAAC,SAAkB;IAC/D,IAAI,sBAAsB,CAAC,SAAS,CAAC,EAAE,CAAC;QACtC,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,EAAE,CAAC;IACrC,IAAI,OAAO,EAAE,aAAa,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACjD,OAAO;IACT,CAAC;IACD,MAAM,IAAI,kBAAkB,CAC1B,kGAAkG;QAChG,8BAA8B,CACjC,CAAC;AACJ,CAAC"}

package/dist/core/common/persistence/routed-model.guard.d.ts

@@ -0,0 +1,4 @@
+import type { DataStore } from './data-store.interface.js';
+export declare function guardRoutedModel(model: unknown, store: DataStore<any>): void;
+export declare function isStandInModel(model: unknown): boolean;
+export declare function standInModel(modelName: string, schema: unknown): unknown;

package/dist/core/common/persistence/routed-model.guard.js

@@ -0,0 +1,73 @@
+import { UnsupportedCapabilityError } from './unsupported-capability.error.js';
+const MODEL_DATA_METHODS = [
+    '$where',
+    'aggregate',
+    'bulkSave',
+    'bulkWrite',
+    'countDocuments',
+    'create',
+    'deleteMany',
+    'deleteOne',
+    'distinct',
+    'estimatedDocumentCount',
+    'exists',
+    'find',
+    'findAndCount',
+    'findById',
+    'findByIdAndDelete',
+    'findByIdAndUpdate',
+    'findOne',
+    'findOneAndDelete',
+    'findOneAndReplace',
+    'findOneAndUpdate',
+    'insertMany',
+    'insertOne',
+    'replaceOne',
+    'updateMany',
+    'updateOne',
+    'watch',
+    'where',
+];
+const DOCUMENT_DATA_METHODS = ['$save', 'deleteOne', 'replaceOne', 'save', 'updateOne'];
+export function guardRoutedModel(model, store) {
+    if (!model || typeof model !== 'function') {
+        return;
+    }
+    const target = model;
+    const refuse = (method) => function refused() {
+        throw new UnsupportedCapabilityError(`${target.modelName}.${method}() reaches MongoDB, but ${target.modelName} is stored on ${store.driver} — ` +
+            'use the data store (this.dataStore in a CrudService, or @InjectStore()) instead');
+    };
+    for (const method of MODEL_DATA_METHODS) {
+        if (typeof target[method] === 'function') {
+            Object.defineProperty(target, method, { configurable: true, value: refuse(method), writable: true });
+        }
+    }
+    for (const method of DOCUMENT_DATA_METHODS) {
+        Object.defineProperty(target.prototype, method, { configurable: true, value: refuse(method), writable: true });
+    }
+}
+const STAND_IN_MODEL = Symbol('lt:stand-in-model');
+export function isStandInModel(model) {
+    return !!model && model[STAND_IN_MODEL] === true;
+}
+export function standInModel(modelName, schema) {
+    const standIn = function StandInModel() {
+        throw new UnsupportedCapabilityError(`new ${modelName}() is a Mongoose document, and no MongoDB is configured`);
+    };
+    Object.defineProperty(standIn, 'modelName', { value: modelName });
+    Object.defineProperty(standIn, STAND_IN_MODEL, { value: true });
+    Object.defineProperty(standIn, 'schema', { value: schema });
+    const refuse = (method) => function refused() {
+        throw new UnsupportedCapabilityError(`${modelName}.${method}() reaches MongoDB, and no MongoDB is configured — use the data store ` +
+            '(this.dataStore in a CrudService, or @InjectStore())');
+    };
+    for (const method of MODEL_DATA_METHODS) {
+        Object.defineProperty(standIn, method, { configurable: true, value: refuse(method), writable: true });
+    }
+    for (const method of DOCUMENT_DATA_METHODS) {
+        Object.defineProperty(standIn.prototype, method, { configurable: true, value: refuse(method), writable: true });
+    }
+    return standIn;
+}
+//# sourceMappingURL=routed-model.guard.js.map

package/dist/core/common/persistence/routed-model.guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routed-model.guard.js","sourceRoot":"","sources":["../../../../src/core/common/persistence/routed-model.guard.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAM/E,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,WAAW;IACX,UAAU;IACV,WAAW;IACX,gBAAgB;IAChB,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,UAAU;IACV,wBAAwB;IACxB,QAAQ;IACR,MAAM;IACN,cAAc;IACd,UAAU;IACV,mBAAmB;IACnB,mBAAmB;IACnB,SAAS;IACT,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,OAAO;IACP,OAAO;CACC,CAAC;AAGX,MAAM,qBAAqB,GAAG,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,WAAW,CAAU,CAAC;AAYjG,MAAM,UAAU,gBAAgB,CAAC,KAAc,EAAE,KAAqB;IACpE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,UAAU,EAAE,CAAC;QAC1C,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,KAAsF,CAAC;IACtG,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,SAAS,OAAO;QACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,MAAM,CAAC,SAAS,IAAI,MAAM,2BAA2B,MAAM,CAAC,SAAS,iBAAiB,KAAK,CAAC,MAAM,KAAK;YACxG,iFAAiF,CACpF,CAAC;IACJ,CAAC,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,UAAU,EAAE,CAAC;YACzC,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACjH,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAC;AAGnD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,CAAC,CAAC,KAAK,IAAK,KAAiC,CAAC,cAAc,CAAC,KAAK,IAAI,CAAC;AAChF,CAAC;AAQD,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAe;IAC7D,MAAM,OAAO,GAAG,SAAS,YAAY;QACnC,MAAM,IAAI,0BAA0B,CAAC,OAAO,SAAS,yDAAyD,CAAC,CAAC;IAClH,CAA+D,CAAC;IAChE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAClE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAChE,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,EAAE,CAChC,SAAS,OAAO;QACd,MAAM,IAAI,0BAA0B,CAClC,GAAG,SAAS,IAAI,MAAM,wEAAwE;YAC5F,sDAAsD,CACzD,CAAC;IACJ,CAAC,CAAC;IACJ,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,MAAM,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/core/common/persistence/sql/mysql/mysql-data-store.d.ts

@@ -0,0 +1,46 @@
+import { Logger } from '@nestjs/common';
+import type { DataStoreUpdate, FindOptions, PushOptions, StoreCapabilities, StoredRecord, UpdateOptions, Where } from '../../data-store.interface.js';
+import type { FieldDescriptor, ModelDescriptor } from '../../model-descriptor.interface.js';
+import { SqlDataStore, type SqlDataStoreOptions } from '../sql-data-store.js';
+import { SqlParams } from '../sql-naming.js';
+import type { MysqlExecutor } from './mysql-executor.js';
+import type { MysqlVariant } from './mysql-session.js';
+export declare const MYSQL_STORE_CAPABILITIES: Readonly<StoreCapabilities>;
+export declare const MYSQL_ERRORS: {
+    readonly checkFailed: Record<MysqlVariant, number>;
+    readonly dataTooLong: 1406;
+    readonly duplicateEntry: 1062;
+};
+export declare class MysqlDataStore<T = Record<string, any>> extends SqlDataStore<T> {
+    readonly capabilities: Readonly<StoreCapabilities>;
+    readonly driver: string;
+    protected readonly logger: Logger;
+    private readonly variant;
+    constructor(executor: MysqlExecutor, model: ModelDescriptor, options?: SqlDataStoreOptions);
+    count(where?: Where<T>): Promise<number>;
+    sum(field: string, where?: Where<T>): Promise<{
+        count: number;
+        sum: number;
+    }>;
+    distinct(field: string, where?: Where<T>): Promise<unknown[]>;
+    find(where?: Where<T>, options?: FindOptions): Promise<StoredRecord<T>[]>;
+    insert(record: Partial<T>): Promise<StoredRecord<T>>;
+    updateById(id: string, update: DataStoreUpdate<T>, options?: UpdateOptions): Promise<null | StoredRecord<T>>;
+    updateOne(where: Where<T>, update: DataStoreUpdate<T>): Promise<null | StoredRecord<T>>;
+    deleteById(id: string): Promise<null | StoredRecord<T>>;
+    deleteOne(where: Where<T>): Promise<null | StoredRecord<T>>;
+    pushToArray(id: string, field: string, items: readonly unknown[], options?: PushOptions): Promise<void>;
+    pullFromArray(id: string, field: string, condition: unknown): Promise<void>;
+    protected quote(name: string): string;
+    protected compileWhere(where: Where, params: SqlParams): string;
+    protected compileUpdate(update: DataStoreUpdate, params: SqlParams): string[];
+    protected orderBy(options: FindOptions, params: SqlParams): string;
+    protected itemOrder(sort: Record<string, -1 | 1> | number, params: SqlParams): string;
+    protected toColumn(field: FieldDescriptor, path: string, value: unknown, params: SqlParams): string;
+    protected fromColumn(field: FieldDescriptor, value: unknown): unknown;
+    protected mapError(error: unknown): unknown;
+    private transaction;
+    private readById;
+    private lockFirst;
+    private deleteFirst;
+}