@lobb-js/lobb-ext-auth 0.14.0 → 0.15.0

package/dist/index.js

@@ -19,36 +19,36 @@ export default function extension(utils) {
             {
                 // Generic auth primitive: callers ask "can the current user access X?"
                 // and pass any combination of { collection, action, role }. The handler
-                // returns a boolean directly; callers read that and decide what to render.
-                // Note: returning a boolean means downstream handlers can't read the
-                // original request — if you ever need multiple extensions to influence
-                // this decision, switch back to a `{ ...input, allowed }` object shape.
+                // takes over with a boolean (`ctx.takeOver(bool)`); callers read that
+                // and decide what to render. A take-over is required because the
+                // dispatch ignores plain returns — a bare `return false` would be
+                // dropped and the caller would default to allow.
                 eventName: "auth.canAccess",
-                handler: async (input) => {
+                handler: async (input, ctx) => {
                     // Admin shortcut — admins bypass everything, regardless of how
                     // their permissions snapshot was populated.
                     const user = utils.ctx.extensions.auth?.user;
                     if (user?.role === "admin")
-                        return true;
+                        return ctx.takeOver(true);
                     // Walk the permissions snapshot. Works for both logged-in non-admin
                     // users (snapshot from their role) and share-token recipients
                     // (snapshot from the share's embedded permissions). If nothing
                     // is populated — anonymous viewer — default to deny.
                     const permissions = utils.ctx.extensions.auth?.permissions;
                     if (permissions === undefined || permissions === null)
-                        return false;
+                        return ctx.takeOver(false);
                     if (permissions === true)
-                        return true;
+                        return ctx.takeOver(true);
                     const action = input.action ?? "read";
                     const requiredCollections = Array.isArray(input.collection)
                         ? input.collection
                         : input.collection ? [input.collection] : [];
                     for (const collectionName of requiredCollections) {
                         if (!isActionAllowed(collectionName, action, permissions)) {
-                            return false;
+                            return ctx.takeOver(false);
                         }
                     }
-                    return true;
+                    return ctx.takeOver(true);
                 },
             },
         ],

package/extensions/auth/studio/index.ts

@@ -22,24 +22,24 @@ export default function extension(utils: ExtensionUtils): Extension {
       {
         // Generic auth primitive: callers ask "can the current user access X?"
         // and pass any combination of { collection, action, role }. The handler
-        // returns a boolean directly; callers read that and decide what to render.
-        // Note: returning a boolean means downstream handlers can't read the
-        // original request — if you ever need multiple extensions to influence
-        // this decision, switch back to a `{ ...input, allowed }` object shape.
+        // takes over with a boolean (`ctx.takeOver(bool)`); callers read that
+        // and decide what to render. A take-over is required because the
+        // dispatch ignores plain returns — a bare `return false` would be
+        // dropped and the caller would default to allow.
         eventName: "auth.canAccess",
-        handler: async (input) => {
+        handler: async (input, ctx) => {
           // Admin shortcut — admins bypass everything, regardless of how
           // their permissions snapshot was populated.
           const user = utils.ctx.extensions.auth?.user;
-          if (user?.role === "admin") return true;
+          if (user?.role === "admin") return ctx.takeOver(true);
 
           // Walk the permissions snapshot. Works for both logged-in non-admin
           // users (snapshot from their role) and share-token recipients
           // (snapshot from the share's embedded permissions). If nothing
           // is populated — anonymous viewer — default to deny.
           const permissions = utils.ctx.extensions.auth?.permissions;
-          if (permissions === undefined || permissions === null) return false;
-          if (permissions === true) return true;
+          if (permissions === undefined || permissions === null) return ctx.takeOver(false);
+          if (permissions === true) return ctx.takeOver(true);
 
           const action: CollectionPermissionActionsKeys = input.action ?? "read";
 
@@ -49,11 +49,11 @@ export default function extension(utils: ExtensionUtils): Extension {
 
           for (const collectionName of requiredCollections) {
             if (!isActionAllowed(collectionName, action, permissions)) {
-              return false;
+              return ctx.takeOver(false);
             }
           }
 
-          return true;
+          return ctx.takeOver(true);
         },
       },
     ],

package/extensions/auth/workflows/actionController.ts

@@ -15,19 +15,20 @@ export function getAuthActionControllerWorkflows(): Workflow[] {
       name: "authLogoutActionController",
       eventName: "core.actions.controller.override",
       handler: async (input, ctx) => {
-        if (input.name !== "auth_logout") return;
+        if (input.name === "auth_logout") {
+          const context = input.context as Context;
+          const token = getBearerToken(context);
+          if (!token) {
+            throw new ctx.LobbError({
+              code: "BAD_REQUEST",
+              message:
+                "You should pass session's token through the bearer header",
+            });
+          }
 
-        const context = input.context as Context;
-        const token = getBearerToken(context);
-        if (!token) {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message: "You should pass session's token through the bearer header",
-          });
+          await ctx.lobb.runAction("auth_logout", { token });
+          return ctx.takeOver(context.body(null, 204));
         }
-
-        await ctx.lobb.runAction("auth_logout", { token });
-        return context.body(null, 204);
       },
     },
   ];

package/extensions/auth/workflows/baseWorkflow.ts

@@ -9,32 +9,42 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
     name: "auth_preventAdminUserDeletion",
     eventName: "core.store.preDeleteOne",
     handler: async (input, ctx) => {
-      if (input.collectionName !== "auth_users") return input;
-      if (input.triggeredBy !== "API") return input;
-
-      if (Number(input.id) === 1) {
+      if (
+        input.collectionName === "auth_users" &&
+        input.triggeredBy === "API" &&
+        Number(input.id) === 1
+      ) {
         throw new ctx.LobbError({
           code: "FORBIDDEN",
           message: "The admin user cannot be deleted.",
         });
       }
-      return input;
     },
   },
   {
     name: "auth_preventAdminUserUpdate",
     eventName: "core.store.preUpdateOne",
     handler: async (input, ctx) => {
-      if (input.collectionName !== "auth_users") return input;
-      if (input.triggeredBy !== "API") return input;
-
-      if (Number(input.id) === 1) {
-        throw new ctx.LobbError({
-          code: "FORBIDDEN",
-          message: "The admin user cannot be updated.",
-        });
+      if (
+        input.collectionName === "auth_users" &&
+        input.triggeredBy === "API" &&
+        Number(input.id) === 1
+      ) {
+        // Only the security-sensitive core fields are locked on the admin —
+        // changing them could lock out or hijack the account. Other fields
+        // (e.g. extension-added ones) are fine to update.
+        const protectedFields = ["email", "password", "role"];
+        const touched = Object.keys(input.data ?? {}).filter((field) =>
+          protectedFields.includes(field)
+        );
+        if (touched.length) {
+          throw new ctx.LobbError({
+            code: "FORBIDDEN",
+            message:
+              `The admin user's ${touched.join(", ")} cannot be updated.`,
+          });
+        }
       }
-      return input;
     },
   },
   ...baseWorkflows,
@@ -51,58 +61,55 @@ export const baseWorkflows: Workflow[] = [
     eventName: "core.webserver.middlwares.pre",
     handler: async (input, ctx) => {
       const token = getBearerToken(input.context);
-      if (!token) return input;
-
-      const context = input.context as Context;
-
-      // 1) Try the token as a normal user session.
-      const sessionsResult = await ctx.workflows.collectionStore({
-        method: "findAll",
-        props: {
-          collectionName: "auth_sessions",
-          params: { filter: { token } },
-        },
-      });
-      const session = sessionsResult.data[0];
+      if (token) {
+        const context = input.context as Context;
 
-      if (session) {
-        const usersResult = await ctx.workflows.collectionStore({
+        // 1) Try the token as a normal user session.
+        const sessionsResult = await ctx.workflows.collectionStore({
           method: "findAll",
           props: {
-            collectionName: "auth_users",
-            params: { filter: { id: session.user_id } },
+            collectionName: "auth_sessions",
+            params: { filter: { token } },
           },
         });
-        const user = usersResult.data[0];
+        const session = sessionsResult.data[0];
 
-        context.set("auth_session", session);
-        context.set("auth_user", user);
-        return input;
-      }
+        if (session) {
+          const usersResult = await ctx.workflows.collectionStore({
+            method: "findAll",
+            props: {
+              collectionName: "auth_users",
+              params: { filter: { id: session.user_id } },
+            },
+          });
+          const user = usersResult.data[0];
 
-      // 2) Otherwise try the token as a share. Shares carry their own
-      //    permissions snapshot and have a fixed expiry — no user identity.
-      const sharesResult = await ctx.workflows.collectionStore({
-        method: "findAll",
-        props: {
-          collectionName: "auth_shares",
-          params: { filter: { token } },
-        },
-      });
-      const share = sharesResult.data[0];
+          context.set("auth_session", session);
+          context.set("auth_user", user);
+        } else {
+          // 2) Otherwise try the token as a share. Shares carry their own
+          //    permissions snapshot and have a fixed expiry — no user identity.
+          const sharesResult = await ctx.workflows.collectionStore({
+            method: "findAll",
+            props: {
+              collectionName: "auth_shares",
+              params: { filter: { token } },
+            },
+          });
+          const share = sharesResult.data[0];
 
-      if (share && new Date(share.expires_at) > new Date()) {
-        let permissions: any = {};
-        try {
-          permissions = JSON.parse(share.permissions ?? "{}");
-        } catch {
-          // malformed permissions — treat as no access
-          permissions = {};
+          if (share && new Date(share.expires_at) > new Date()) {
+            let permissions: any = {};
+            try {
+              permissions = JSON.parse(share.permissions ?? "{}");
+            } catch {
+              // malformed permissions — treat as no access
+              permissions = {};
+            }
+            context.set("auth_share", { ...share, permissions });
+          }
         }
-        context.set("auth_share", { ...share, permissions });
       }
-
-      return input;
     },
   },
 ];

package/extensions/auth/workflows/currentUserPermissionsWorkflow.ts

@@ -15,18 +15,19 @@ export function getCurrentUserPermissionsWorkflow(
     name: "auth_attachCurrentUserPermissions",
     eventName: "core.controllers.findOne",
     handler: async (input) => {
-      if (input.collectionName !== "auth_users") return input;
       const context = input.context as Context | undefined;
-      if (context?.req.param("id") !== "me") return input;
-
-      const role = input.response?.data?.role;
-      // Strip functions (e.g. dynamic filter predicates) — they can't be
-      // serialised to the client.
-      const permissions = JSON.parse(JSON.stringify(
-        extensionConfig.roles?.[role]?.permissions ?? {},
-      ));
-      input.response = { ...input.response, permissions };
-      return input;
+      if (
+        input.collectionName === "auth_users" &&
+        context?.req.param("id") === "me"
+      ) {
+        const role = input.response?.data?.role;
+        // Strip functions (e.g. dynamic filter predicates) — they can't be
+        // serialised to the client.
+        const permissions = JSON.parse(JSON.stringify(
+          extensionConfig.roles?.[role]?.permissions ?? {},
+        ));
+        input.response = { ...input.response, permissions };
+      }
     },
   };
 }

package/extensions/auth/workflows/meAliasWorkflows.ts

@@ -22,14 +22,15 @@ function resolveMeAlias(input: any, ctx: EventContext): number {
 
 export const meAliasWorkflows: Workflow[] = [
   {
-    name: "auth_userFindOneMeAlias",
-    eventName: "core.store.preFindOne",
+    // Share bearers don't have an auth_users row to fetch — take over the /me
+    // findOne at the controller boundary with the share's permissions snapshot.
+    // Studio uses the same /me endpoint to learn what the current bearer can do
+    // regardless of bearer type. Done at the controller level (not the store)
+    // so the HTTP response never originates from the data layer; the store-level
+    // resolveMeAlias below only runs for real users (where it resolves the id).
+    name: "auth_userFindOneMeShare",
+    eventName: "core.controllers.preFindOne",
     handler: async (input, ctx) => {
-      // Share bearers don't have an auth_users row to fetch — short-circuit
-      // the findOne with the share's permissions snapshot. Studio uses the
-      // same /me endpoint to learn what the current bearer can do regardless
-      // of bearer type. Falls through to resolveMeAlias otherwise (which
-      // handles the session case and throws for unauthenticated requests).
       if (input.collectionName === "auth_users" && input.id === "me") {
         const context = input.context as Context;
         const user = context.get("auth_user") as User | undefined;
@@ -38,7 +39,7 @@ export const meAliasWorkflows: Workflow[] = [
             | { permissions: any }
             | undefined;
           if (share) {
-            throw new Response(
+            return ctx.takeOver(new Response(
               JSON.stringify({
                 data: null,
                 permissions: share.permissions,
@@ -47,12 +48,17 @@ export const meAliasWorkflows: Workflow[] = [
                 status: 200,
                 headers: { "Content-Type": "application/json" },
               },
-            );
+            ));
           }
         }
       }
+    },
+  },
+  {
+    name: "auth_userFindOneMeAlias",
+    eventName: "core.store.preFindOne",
+    handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
   {
@@ -60,7 +66,6 @@ export const meAliasWorkflows: Workflow[] = [
     eventName: "core.store.preUpdateOne",
     handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
   {
@@ -68,7 +73,6 @@ export const meAliasWorkflows: Workflow[] = [
     eventName: "core.store.preDeleteOne",
     handler: async (input, ctx) => {
       input.id = resolveMeAlias(input, ctx);
-      return input;
     },
   },
 ];

package/extensions/auth/workflows/policiesWorkflows.ts

@@ -33,7 +33,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.payload) input.data = output.payload;
       }
-      return input;
     },
   },
   {
@@ -60,7 +59,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.filter) input.filter = output.filter;
       }
-      return input;
     },
   },
   {
@@ -88,7 +86,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         });
         if (output?.payload) input.data = output.payload;
       }
-      return input;
     },
   },
   {
@@ -114,7 +111,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
           recordId: input.id,
         });
       }
-      return input;
     },
   },
   // Post-fetch field-level filtering using the role/share's `read.fields`
@@ -132,7 +128,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -148,7 +143,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -164,7 +158,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   {
@@ -180,7 +173,6 @@ export function getPoliciesWorkflows(extensionConfig: ExtensionConfig): Workflow
         );
         input.data = handleReadFields(permissions, input.collectionName, input.data);
       }
-      return input;
     },
   },
   ];

package/extensions/auth/workflows/sharesWorkflows.ts

@@ -22,7 +22,6 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
         if (input.collectionName === "auth_shares") {
           input.data.token = generateRandomId();
         }
-        return input;
       },
     },
     // Normalize the two ways a caller can specify share lifetime into the
@@ -37,30 +36,28 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
       eventName: "core.store.preCreateOne",
       order: "pre",
       handler: async (input, ctx) => {
-        if (input.collectionName !== "auth_shares") return input;
+        if (input.collectionName === "auth_shares") {
+          const seconds = input.data.expires_in_seconds;
+          if (typeof seconds === "number") {
+            if (!Number.isFinite(seconds) || seconds <= 0) {
+              throw new ctx.LobbError({
+                code: "BAD_REQUEST",
+                message: "expires_in_seconds must be a positive number.",
+              });
+            }
+            input.data.expires_at = new Date(Date.now() + seconds * 1000)
+              .toISOString();
+            delete input.data.expires_in_seconds;
+          }
 
-        const seconds = input.data.expires_in_seconds;
-        if (typeof seconds === "number") {
-          if (!Number.isFinite(seconds) || seconds <= 0) {
+          if (!input.data.expires_at) {
             throw new ctx.LobbError({
               code: "BAD_REQUEST",
-              message: "expires_in_seconds must be a positive number.",
+              message:
+                "Must provide either expires_at or expires_in_seconds when creating a share.",
             });
           }
-          input.data.expires_at = new Date(Date.now() + seconds * 1000)
-            .toISOString();
-          delete input.data.expires_in_seconds;
-        }
-
-        if (!input.data.expires_at) {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message:
-              "Must provide either expires_at or expires_in_seconds when creating a share.",
-          });
         }
-
-        return input;
       },
     },
     // Auto-set created_by from the authenticated request user so callers
@@ -71,12 +68,14 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
       name: "auth_setShareCreatedBy",
       eventName: "core.store.preCreateOne",
       handler: async (input) => {
-        if (input.collectionName !== "auth_shares") return input;
-        if (input.triggeredBy !== "API") return input;
-        const context = input.context as Context;
-        const user = context.get("auth_user") as User | undefined;
-        if (user) input.data.created_by = user.id;
-        return input;
+        if (
+          input.collectionName === "auth_shares" &&
+          input.triggeredBy === "API"
+        ) {
+          const context = input.context as Context;
+          const user = context.get("auth_user") as User | undefined;
+          if (user) input.data.created_by = user.id;
+        }
       },
     },
     // Intersection guard: a share's embedded permissions snapshot must be a
@@ -88,35 +87,35 @@ export function getSharesWorkflows(extensionConfig: ExtensionConfig): Workflow[]
       name: "auth_validateShareSubset",
       eventName: "core.store.preCreateOne",
       handler: async (input, ctx) => {
-        if (input.collectionName !== "auth_shares") return input;
-        if (input.triggeredBy !== "API") return input;
+        if (
+          input.collectionName === "auth_shares" &&
+          input.triggeredBy === "API"
+        ) {
+          const context = input.context as Context;
+          const { permissions: creatorPermissions } = resolveRequestPermissions(
+            context,
+            extensionConfig,
+            ctx,
+          );
 
-        const context = input.context as Context;
-        const { permissions: creatorPermissions } = resolveRequestPermissions(
-          context,
-          extensionConfig,
-          ctx,
-        );
-
-        let sharePermissions: PermissionsConfig;
-        try {
-          sharePermissions = JSON.parse(input.data.permissions);
-        } catch {
-          throw new ctx.LobbError({
-            code: "BAD_REQUEST",
-            message: "Share permissions must be valid JSON.",
-          });
-        }
+          let sharePermissions: PermissionsConfig;
+          try {
+            sharePermissions = JSON.parse(input.data.permissions);
+          } catch {
+            throw new ctx.LobbError({
+              code: "BAD_REQUEST",
+              message: "Share permissions must be valid JSON.",
+            });
+          }
 
-        if (!isShareSubsetOfCreator(sharePermissions, creatorPermissions)) {
-          throw new ctx.LobbError({
-            code: "FORBIDDEN",
-            message:
-              "Cannot create a share with broader permissions than your own.",
-          });
+          if (!isShareSubsetOfCreator(sharePermissions, creatorPermissions)) {
+            throw new ctx.LobbError({
+              code: "FORBIDDEN",
+              message:
+                "Cannot create a share with broader permissions than your own.",
+            });
+          }
         }
-
-        return input;
       },
     },
     // Hourly housekeeping: delete shares whose expires_at is in the past.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -32,12 +32,12 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.41.0",
+    "@lobb-js/core": "^0.42.0",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
-    "@lobb-js/studio": "^0.49.0",
+    "@lobb-js/studio": "^0.50.0",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",