@lobb-js/lobb-ext-auth 0.15.1 → 0.16.1

package/dist/index.js

@@ -3,7 +3,6 @@ import { onStartup, onRouteChange } from "./onStartup";
 import LoginPage from "./lib/components/pages/loginPage/index.svelte";
 import UserSettings from "./lib/components/pages/userSettings/index.svelte";
 import Settings from "./lib/components/pages/settings/index.svelte";
-import { isActionAllowed } from "./shared/permissions";
 // TODO we should export the extension object directly without a function at all. because we dont set configuration in here
 export default function extension(utils) {
     return {
@@ -44,7 +43,10 @@ export default function extension(utils) {
                         ? input.collection
                         : input.collection ? [input.collection] : [];
                     for (const collectionName of requiredCollections) {
-                        if (!isActionAllowed(collectionName, action, permissions)) {
+                        const collPerm = permissions[collectionName];
+                        if (collPerm === true)
+                            continue;
+                        if (!collPerm || collPerm[action] !== true) {
                             return ctx.takeOver(false);
                         }
                     }

package/extensions/auth/collections/activityFeed.ts

@@ -4,10 +4,10 @@ export const activityFeedCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     user_id: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",
@@ -31,8 +31,7 @@ export const activityFeedCollection: CollectionConfig = {
       required: true,
     },
     item_id: {
-      type: "string",
-      length: 255,
+      type: "id",
       required: true,
     },
     created_at: {

package/extensions/auth/collections/sessions.ts

@@ -4,10 +4,10 @@ export const sessionsCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     user_id: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",

package/extensions/auth/collections/shares.ts

@@ -10,7 +10,7 @@ export const sharesCollection: CollectionConfig = {
   indexes: {},
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     // Auto-generated server-side by the auth_generateShareToken workflow on
     // create — clients should not supply this; the generated token comes
@@ -49,7 +49,7 @@ export const sharesCollection: CollectionConfig = {
       ui: { hidden: true },
     },
     created_by: {
-      type: "integer",
+      type: "id",
       references: {
         collection: "auth_users",
         field: "id",

package/extensions/auth/collections/users.ts

@@ -14,7 +14,7 @@ export const usersCollection: NormalCollectionConfig = {
   },
   fields: {
     id: {
-      type: "integer",
+      type: "id",
     },
     email: {
       type: "string",
@@ -37,7 +37,7 @@ export const usersCollection: NormalCollectionConfig = {
     },
     role: {
       type: "string",
-      length: 255,
+      length: 100,
       required: true,
     },
   },

package/extensions/auth/config/extensionConfigSchema.d.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "@lobb-js/core";
+import type { CollectionConfig, CollectionField } from "@lobb-js/core";
 import type { CreatePermissionAction } from "./permissionsAction/create.ts";
 import type { ReadPermissionAction } from "./permissionsAction/read.ts";
 import type { UpdatePermissionAction } from "./permissionsAction/update.ts";
@@ -33,7 +33,7 @@ export type ExtensionConfig = {
     roles?: Record<string, RolesConfig | undefined>;
     extend_users?: {
         indexes?: CollectionConfig["indexes"];
-        fields?: Omit<CollectionConfig["fields"], "id">;
+        fields?: Record<string, CollectionField>;
     };
     studio?: {
         publicPaths?: string[];

package/extensions/auth/config/extensionConfigSchema.ts

@@ -1,4 +1,4 @@
-import type { CollectionConfig } from "@lobb-js/core";
+import type { CollectionConfig, CollectionField } from "@lobb-js/core";
 import type { CreatePermissionAction } from "./permissionsAction/create.ts";
 import type { ReadPermissionAction } from "./permissionsAction/read.ts";
 import type { UpdatePermissionAction } from "./permissionsAction/update.ts";
@@ -43,7 +43,7 @@ export type ExtensionConfig = {
   roles?: Record<string, RolesConfig | undefined>;
   extend_users?: {
     indexes?: CollectionConfig["indexes"];
-    fields?: Omit<CollectionConfig["fields"], "id">;
+    fields?: Record<string, CollectionField>;
   };
   studio?: {
     publicPaths?: string[];

package/extensions/auth/studio/index.ts

@@ -4,7 +4,6 @@ import { onStartup, onRouteChange } from "./onStartup";
 import LoginPage from "./lib/components/pages/loginPage/index.svelte";
 import UserSettings from "./lib/components/pages/userSettings/index.svelte";
 import Settings from "./lib/components/pages/settings/index.svelte";
-import { isActionAllowed } from "./shared/permissions";
 import type { CollectionPermissionActionsKeys } from "../config/extensionConfigSchema";
 
 // TODO we should export the extension object directly without a function at all. because we dont set configuration in here
@@ -48,7 +47,9 @@ export default function extension(utils: ExtensionUtils): Extension {
             : input.collection ? [input.collection] : [];
 
           for (const collectionName of requiredCollections) {
-            if (!isActionAllowed(collectionName, action, permissions)) {
+            const collPerm = permissions[collectionName];
+            if (collPerm === true) continue;
+            if (!collPerm || collPerm[action] !== true) {
               return ctx.takeOver(false);
             }
           }

package/extensions/auth/workflows/baseWorkflow.ts

@@ -3,7 +3,23 @@ import type { Context } from "hono";
 import type { ExtensionConfig } from "../config/extensionConfigSchema.ts";
 import { getBearerToken } from "../utils.ts";
 
-export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[] {
+// The admin user is identified by the configured admin email — its id is a uuid
+// now, no longer a predictable "1". Looks the target user up and compares.
+async function isAdminUser(id: any, ctx: any, adminEmail?: string): Promise<boolean> {
+  if (!adminEmail || id == null) return false;
+  try {
+    const user = (await ctx.lobb.collectionStore.findOne({
+      collectionName: "auth_users",
+      id: String(id),
+      params: { fields: "id,email" },
+    })).data;
+    return user?.email === adminEmail;
+  } catch {
+    return false;
+  }
+}
+
+export function getBaseWorkflows(extensionConfig: ExtensionConfig): Workflow[] {
   return [
   {
     name: "auth_preventAdminUserDeletion",
@@ -12,7 +28,7 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
       if (
         input.collectionName === "auth_users" &&
         input.triggeredBy === "API" &&
-        Number(input.id) === 1
+        await isAdminUser(input.id, ctx, extensionConfig.admin?.email)
       ) {
         throw new ctx.LobbError({
           code: "FORBIDDEN",
@@ -28,7 +44,7 @@ export function getBaseWorkflows(_extensionConfig: ExtensionConfig): Workflow[]
       if (
         input.collectionName === "auth_users" &&
         input.triggeredBy === "API" &&
-        Number(input.id) === 1
+        await isAdminUser(input.id, ctx, extensionConfig.admin?.email)
       ) {
         // Only the security-sensitive core fields are locked on the admin —
         // changing them could lock out or hijack the account. Other fields

package/extensions/auth/workflows/permissions.ts

@@ -0,0 +1,37 @@
+import type {
+  CollectionPermissionActionsKeys,
+  PermissionsConfig,
+} from "../config/extensionConfigSchema.ts";
+
+// Pure permission check used by the backend's `handlePolicy` (see utils.ts) to
+// gate collection actions. Walks the permissions tree and returns a yes/no;
+// handlePolicy then layers on the actual guards/filters/error-throwing.
+//
+// It used to live under studio/shared/ because the studio's `auth.canAccess`
+// workflow imported it too — now the studio inlines its own UI-gating check, so
+// this is backend-only.
+//
+// An object value for an action means "conditional access" (filter / fields
+// restrictions), which counts as allowed here; the real restriction is enforced
+// per-request by handlePolicy.
+export function isActionAllowed(
+  collection: string,
+  action: CollectionPermissionActionsKeys,
+  permissions: PermissionsConfig | undefined,
+): boolean {
+  if (permissions === true) return true;
+  if (!permissions) return false;
+  const collPerm = permissions[collection];
+  if (collPerm === true) return true;
+  if (!collPerm) return false;
+  const actionPerm = collPerm[action];
+  if (actionPerm === true) return true;
+  // A conditional grant must actually list at least one constraint
+  // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
+  // to "no grant" — explicit `true` is required for unconditional access.
+  return (
+    typeof actionPerm === "object" &&
+    actionPerm !== null &&
+    Object.keys(actionPerm).length > 0
+  );
+}

package/extensions/auth/workflows/utils.ts

@@ -6,7 +6,7 @@ import type {
   PermissionsConfig,
   User,
 } from "../config/extensionConfigSchema.ts";
-import { isActionAllowed } from "../studio/shared/permissions.ts";
+import { isActionAllowed } from "./permissions.ts";
 
 interface HandlePolicyOutput {
   filter?: Filter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.15.1",
+  "version": "0.16.1",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -20,6 +20,7 @@
   "scripts": {
     "test": "bun test tests",
     "test:lobb": "bun test tests",
+    "test:studio": "playwright test --config studio-e2e/playwright.config.ts",
     "dev": "bun run --watch lobb.ts",
     "dev:studio": "vite dev",
     "build": "vite build",
@@ -32,13 +33,13 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.44.0",
+    "@lobb-js/core": "^0.50.2",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@lobb-js/studio": "^0.53.1",
+    "@lobb-js/studio": "^0.60.2",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",

package/dist/shared/permissions.d.ts

@@ -1,2 +0,0 @@
-import type { CollectionPermissionActionsKeys, PermissionsConfig } from "../../config/extensionConfigSchema.ts";
-export declare function isActionAllowed(collection: string, action: CollectionPermissionActionsKeys, permissions: PermissionsConfig | undefined): boolean;

package/dist/shared/permissions.js

@@ -1,35 +0,0 @@
-// Lives under studio/ for packaging reasons — `svelte-package` only bundles
-// files inside its `--input` root, so anything the studio entry imports has
-// to be reachable from there. The backend imports this same file via
-// `../studio/shared/permissions` so there's still one source of truth.
-//
-// Anything in this folder must stay environment-neutral (no DOM, no Node-only
-// APIs, no top-level side effects) so it runs the same way on both sides.
-// Pure permission check shared by the server-side handlePolicy and the
-// studio's auth.canAccess workflow. Walks the permissions tree and returns
-// a yes/no — server-side then layers on guards/filters/error-throwing,
-// client-side uses the answer to decide whether to render UI.
-//
-// An object value for action permission means "conditional access" (filter
-// and/or fields restrictions). For UI gating that counts as allowed; the
-// server enforces the actual restrictions on real requests.
-export function isActionAllowed(collection, action, permissions) {
-    if (permissions === true)
-        return true;
-    if (!permissions)
-        return false;
-    const collPerm = permissions[collection];
-    if (collPerm === true)
-        return true;
-    if (!collPerm)
-        return false;
-    const actionPerm = collPerm[action];
-    if (actionPerm === true)
-        return true;
-    // A conditional grant must actually list at least one constraint
-    // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
-    // to "no grant" — explicit `true` is required for unconditional access.
-    return (typeof actionPerm === "object" &&
-        actionPerm !== null &&
-        Object.keys(actionPerm).length > 0);
-}

package/extensions/auth/studio/shared/permissions.ts

@@ -1,42 +0,0 @@
-// Lives under studio/ for packaging reasons — `svelte-package` only bundles
-// files inside its `--input` root, so anything the studio entry imports has
-// to be reachable from there. The backend imports this same file via
-// `../studio/shared/permissions` so there's still one source of truth.
-//
-// Anything in this folder must stay environment-neutral (no DOM, no Node-only
-// APIs, no top-level side effects) so it runs the same way on both sides.
-
-import type {
-  CollectionPermissionActionsKeys,
-  PermissionsConfig,
-} from "../../config/extensionConfigSchema.ts";
-
-// Pure permission check shared by the server-side handlePolicy and the
-// studio's auth.canAccess workflow. Walks the permissions tree and returns
-// a yes/no — server-side then layers on guards/filters/error-throwing,
-// client-side uses the answer to decide whether to render UI.
-//
-// An object value for action permission means "conditional access" (filter
-// and/or fields restrictions). For UI gating that counts as allowed; the
-// server enforces the actual restrictions on real requests.
-export function isActionAllowed(
-  collection: string,
-  action: CollectionPermissionActionsKeys,
-  permissions: PermissionsConfig | undefined,
-): boolean {
-  if (permissions === true) return true;
-  if (!permissions) return false;
-  const collPerm = permissions[collection];
-  if (collPerm === true) return true;
-  if (!collPerm) return false;
-  const actionPerm = collPerm[action];
-  if (actionPerm === true) return true;
-  // A conditional grant must actually list at least one constraint
-  // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
-  // to "no grant" — explicit `true` is required for unconditional access.
-  return (
-    typeof actionPerm === "object" &&
-    actionPerm !== null &&
-    Object.keys(actionPerm).length > 0
-  );
-}