@lobb-js/lobb-ext-auth 0.16.0 → 0.16.1

package/dist/index.js

@@ -3,7 +3,6 @@ import { onStartup, onRouteChange } from "./onStartup";
 import LoginPage from "./lib/components/pages/loginPage/index.svelte";
 import UserSettings from "./lib/components/pages/userSettings/index.svelte";
 import Settings from "./lib/components/pages/settings/index.svelte";
-import { isActionAllowed } from "./shared/permissions";
 // TODO we should export the extension object directly without a function at all. because we dont set configuration in here
 export default function extension(utils) {
     return {
@@ -44,7 +43,10 @@ export default function extension(utils) {
                         ? input.collection
                         : input.collection ? [input.collection] : [];
                     for (const collectionName of requiredCollections) {
-                        if (!isActionAllowed(collectionName, action, permissions)) {
+                        const collPerm = permissions[collectionName];
+                        if (collPerm === true)
+                            continue;
+                        if (!collPerm || collPerm[action] !== true) {
                             return ctx.takeOver(false);
                         }
                     }

package/extensions/auth/studio/index.ts

@@ -4,7 +4,6 @@ import { onStartup, onRouteChange } from "./onStartup";
 import LoginPage from "./lib/components/pages/loginPage/index.svelte";
 import UserSettings from "./lib/components/pages/userSettings/index.svelte";
 import Settings from "./lib/components/pages/settings/index.svelte";
-import { isActionAllowed } from "./shared/permissions";
 import type { CollectionPermissionActionsKeys } from "../config/extensionConfigSchema";
 
 // TODO we should export the extension object directly without a function at all. because we dont set configuration in here
@@ -48,7 +47,9 @@ export default function extension(utils: ExtensionUtils): Extension {
             : input.collection ? [input.collection] : [];
 
           for (const collectionName of requiredCollections) {
-            if (!isActionAllowed(collectionName, action, permissions)) {
+            const collPerm = permissions[collectionName];
+            if (collPerm === true) continue;
+            if (!collPerm || collPerm[action] !== true) {
               return ctx.takeOver(false);
             }
           }

package/extensions/auth/workflows/permissions.ts

@@ -0,0 +1,37 @@
+import type {
+  CollectionPermissionActionsKeys,
+  PermissionsConfig,
+} from "../config/extensionConfigSchema.ts";
+
+// Pure permission check used by the backend's `handlePolicy` (see utils.ts) to
+// gate collection actions. Walks the permissions tree and returns a yes/no;
+// handlePolicy then layers on the actual guards/filters/error-throwing.
+//
+// It used to live under studio/shared/ because the studio's `auth.canAccess`
+// workflow imported it too — now the studio inlines its own UI-gating check, so
+// this is backend-only.
+//
+// An object value for an action means "conditional access" (filter / fields
+// restrictions), which counts as allowed here; the real restriction is enforced
+// per-request by handlePolicy.
+export function isActionAllowed(
+  collection: string,
+  action: CollectionPermissionActionsKeys,
+  permissions: PermissionsConfig | undefined,
+): boolean {
+  if (permissions === true) return true;
+  if (!permissions) return false;
+  const collPerm = permissions[collection];
+  if (collPerm === true) return true;
+  if (!collPerm) return false;
+  const actionPerm = collPerm[action];
+  if (actionPerm === true) return true;
+  // A conditional grant must actually list at least one constraint
+  // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
+  // to "no grant" — explicit `true` is required for unconditional access.
+  return (
+    typeof actionPerm === "object" &&
+    actionPerm !== null &&
+    Object.keys(actionPerm).length > 0
+  );
+}

package/extensions/auth/workflows/utils.ts

@@ -6,7 +6,7 @@ import type {
   PermissionsConfig,
   User,
 } from "../config/extensionConfigSchema.ts";
-import { isActionAllowed } from "../studio/shared/permissions.ts";
+import { isActionAllowed } from "./permissions.ts";
 
 interface HandlePolicyOutput {
   filter?: Filter;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lobb-js/lobb-ext-auth",
-  "version": "0.16.0",
+  "version": "0.16.1",
   "license": "UNLICENSED",
   "type": "module",
   "publishConfig": {
@@ -20,6 +20,7 @@
   "scripts": {
     "test": "bun test tests",
     "test:lobb": "bun test tests",
+    "test:studio": "playwright test --config studio-e2e/playwright.config.ts",
     "dev": "bun run --watch lobb.ts",
     "dev:studio": "vite dev",
     "build": "vite build",
@@ -32,13 +33,13 @@
     "package": "svelte-package --input extensions/auth/studio"
   },
   "dependencies": {
-    "@lobb-js/core": "^0.50.0",
+    "@lobb-js/core": "^0.50.2",
     "argon2": "^0.40.3",
     "hono": "^4.7.0"
   },
   "devDependencies": {
     "@sveltejs/vite-plugin-svelte": "^7.1.2",
-    "@lobb-js/studio": "^0.60.0",
+    "@lobb-js/studio": "^0.60.2",
     "@lucide/svelte": "^0.563.1",
     "@sveltejs/adapter-node": "^5.5.4",
     "@sveltejs/kit": "^2.60.1",

package/dist/shared/permissions.d.ts

@@ -1,2 +0,0 @@
-import type { CollectionPermissionActionsKeys, PermissionsConfig } from "../../config/extensionConfigSchema.ts";
-export declare function isActionAllowed(collection: string, action: CollectionPermissionActionsKeys, permissions: PermissionsConfig | undefined): boolean;

package/dist/shared/permissions.js

@@ -1,35 +0,0 @@
-// Lives under studio/ for packaging reasons — `svelte-package` only bundles
-// files inside its `--input` root, so anything the studio entry imports has
-// to be reachable from there. The backend imports this same file via
-// `../studio/shared/permissions` so there's still one source of truth.
-//
-// Anything in this folder must stay environment-neutral (no DOM, no Node-only
-// APIs, no top-level side effects) so it runs the same way on both sides.
-// Pure permission check shared by the server-side handlePolicy and the
-// studio's auth.canAccess workflow. Walks the permissions tree and returns
-// a yes/no — server-side then layers on guards/filters/error-throwing,
-// client-side uses the answer to decide whether to render UI.
-//
-// An object value for action permission means "conditional access" (filter
-// and/or fields restrictions). For UI gating that counts as allowed; the
-// server enforces the actual restrictions on real requests.
-export function isActionAllowed(collection, action, permissions) {
-    if (permissions === true)
-        return true;
-    if (!permissions)
-        return false;
-    const collPerm = permissions[collection];
-    if (collPerm === true)
-        return true;
-    if (!collPerm)
-        return false;
-    const actionPerm = collPerm[action];
-    if (actionPerm === true)
-        return true;
-    // A conditional grant must actually list at least one constraint
-    // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
-    // to "no grant" — explicit `true` is required for unconditional access.
-    return (typeof actionPerm === "object" &&
-        actionPerm !== null &&
-        Object.keys(actionPerm).length > 0);
-}

package/extensions/auth/studio/shared/permissions.ts

@@ -1,42 +0,0 @@
-// Lives under studio/ for packaging reasons — `svelte-package` only bundles
-// files inside its `--input` root, so anything the studio entry imports has
-// to be reachable from there. The backend imports this same file via
-// `../studio/shared/permissions` so there's still one source of truth.
-//
-// Anything in this folder must stay environment-neutral (no DOM, no Node-only
-// APIs, no top-level side effects) so it runs the same way on both sides.
-
-import type {
-  CollectionPermissionActionsKeys,
-  PermissionsConfig,
-} from "../../config/extensionConfigSchema.ts";
-
-// Pure permission check shared by the server-side handlePolicy and the
-// studio's auth.canAccess workflow. Walks the permissions tree and returns
-// a yes/no — server-side then layers on guards/filters/error-throwing,
-// client-side uses the answer to decide whether to render UI.
-//
-// An object value for action permission means "conditional access" (filter
-// and/or fields restrictions). For UI gating that counts as allowed; the
-// server enforces the actual restrictions on real requests.
-export function isActionAllowed(
-  collection: string,
-  action: CollectionPermissionActionsKeys,
-  permissions: PermissionsConfig | undefined,
-): boolean {
-  if (permissions === true) return true;
-  if (!permissions) return false;
-  const collPerm = permissions[collection];
-  if (collPerm === true) return true;
-  if (!collPerm) return false;
-  const actionPerm = collPerm[action];
-  if (actionPerm === true) return true;
-  // A conditional grant must actually list at least one constraint
-  // (filter / fields / payloadGuard / mutate). Empty `{}` collapses back
-  // to "no grant" — explicit `true` is required for unconditional access.
-  return (
-    typeof actionPerm === "object" &&
-    actionPerm !== null &&
-    Object.keys(actionPerm).length > 0
-  );
-}