@nextage/nx-frame-be 1.0.44 → 1.0.46

package/build/common/base/base.model.d.ts

@@ -29,6 +29,36 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      * Get default parameters
      */
     get modelParams(): any;
+    /**
+     * The tenant scoping in force for THIS model, or `null` when there is none.
+     *
+     * Read on every call rather than resolved once in the constructor: an application
+     * registers its provider during boot, which may well happen after the models have been
+     * built, and a value captured too early would be `null` forever.
+     */
+    private get tenancy();
+    /**
+     * Constrains a filter to what this context may read. No-op without tenancy.
+     *
+     * The field is ALWAYS overwritten, never read: whatever the caller put there is a
+     * request, and honouring it would let a client name another tenant simply by adding a
+     * field to a query.
+     *
+     * @param filter  the filter, mutated in place
+     * @param context the request context
+     */
+    protected scopeFilter(filter: FilterParams, context: NxContext): FilterParams;
+    /**
+     * Asserts this context may write the document it just read. No-op without tenancy.
+     *
+     * Separate from the read filter, and it has to be: in a `shared` collection everybody
+     * reads the shared documents, so a scoped read says nothing about who may change them.
+     *
+     * @param doc     the stored document
+     * @param context the request context
+     * @throws when the write is not allowed
+     */
+    protected assertWritable(doc: NxObject | null, context: NxContext): void;
     /**
      *
      */
@@ -96,12 +126,21 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      */
     get(id: string, context?: NxContext): Promise<TDoc | null>;
     /**
+     * Decides whether a subscriber may see THIS event payload.
+     *
+     * Being authenticated is not being entitled: with tenancy in force the payload is a
+     * document, and a document has an owner. Left at "any authenticated user" - as it was -
+     * a single channel carried every tenant's documents to every subscriber.
      *
      * @param {*} item
      * @param {*} context
      */
     checkContextPermission(item: any, context?: NxContext): any;
     /**
+     * Decides whether a subscriber may listen on a channel carrying THIS payload.
+     *
+     * Note the parameter is the payload itself, not an id, whatever its name suggests:
+     * `getChannelSubscriber` hands over `payload[payloadId]`.
      *
      * @param {*} context
      */
@@ -127,18 +166,37 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      */
     findOneNative(params: FilterParams): Promise<mongoose.mongo.WithId<mongoose.mongo.BSON.Document> | null>;
     /**
+     * Scopes a read by id. Overriding this REPLACES the tenant scoping, it does not add to it.
      *
-     * @param id
+     * @param filter
      * @param context
-     * @returns
+     * @returns the filter the query must use - the RETURNED one, which is what `get` uses
      */
     beforeGet(filter: FilterParams, context: NxContext): Promise<FilterParams>;
     /**
+     * Stamps the owner and the audit on a new document.
+     *
+     * The value in the payload is a REQUEST, never an instruction: the provider decides what
+     * is actually written, and refuses rather than downgrade when the context is not
+     * entitled to the scope it asked for.
+     *
+     * Declared `async` because that refusal is a THROW, and the signature promises a promise:
+     * left synchronous, a caller reaching for `.catch()` would never see it, while one using
+     * `await` would - the same split contract that made `beforeGet` silently unsafe.
+     *
+     * Overriding this to set other fields is expected - denormalised data, defaults - but
+     * call `super`, or both the scoping and the audit silently stop happening for this model
+     * alone.
      *
      * @param {*} item
      */
     beforeCreate(item: TAttrs, context: NxContext): Promise<TAttrs>;
     /**
+     * Keeps an update from re-homing a document into another tenant, and stamps the audit.
+     *
+     * The owner is dropped from the payload rather than validated: an update never has a
+     * legitimate reason to move a document across tenants, so there is nothing to allow. The
+     * creation fields go the same way, for the same reason - a document is created once.
      *
      * @param {*} item
      */
@@ -149,6 +207,12 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      */
     beforeCopy(item: TAttrs, context: NxContext): Promise<TAttrs>;
     /**
+     * Asserts the caller may delete this document, BEFORE it is deleted.
+     *
+     * `remove` deletes by `_id` with no filter whatsoever, and `bulkRemove` is a loop over
+     * it: without this check any caller deletes another tenant's documents knowing only an
+     * id. The document is re-read unscoped on purpose - the point is to judge its real
+     * owner, and a scoped read would hide the very case being guarded against.
      *
      * @param {*} id
      */
@@ -179,6 +243,7 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      */
     manageFilterArrayParams(params: FilterParams): void;
     /**
+     * Scopes list / count / findOne / aggregate - the bulk of the read surface.
      *
      * @param {*} params
      * @param {*} context

package/build/common/base/base.model.js

@@ -30,6 +30,8 @@ const utils_1 = require("../utils");
 const constants_1 = require("../constants");
 const enums_1 = require("../enums");
 const errors_1 = require("../errors");
+const tenancy_1 = require("./tenancy");
+const audit_1 = require("./audit");
 const mongo_utils_1 = require("./mongo-utils");
 class BaseModel extends events_1.EventEmitter {
     constructor({ name, model, params, logger }) {
@@ -73,6 +75,50 @@ class BaseModel extends events_1.EventEmitter {
             return null;
         return (0, utils_1.clone)(this.defaultParams);
     }
+    /**
+     * The tenant scoping in force for THIS model, or `null` when there is none.
+     *
+     * Read on every call rather than resolved once in the constructor: an application
+     * registers its provider during boot, which may well happen after the models have been
+     * built, and a value captured too early would be `null` forever.
+     */
+    get tenancy() {
+        var _a;
+        return (0, tenancy_1.resolveTenancy)(constants_1.APP.tenancy, this.schema, (_a = this.defaultParams) === null || _a === void 0 ? void 0 : _a.tenancy);
+    }
+    /**
+     * Constrains a filter to what this context may read. No-op without tenancy.
+     *
+     * The field is ALWAYS overwritten, never read: whatever the caller put there is a
+     * request, and honouring it would let a client name another tenant simply by adding a
+     * field to a query.
+     *
+     * @param filter  the filter, mutated in place
+     * @param context the request context
+     */
+    scopeFilter(filter, context) {
+        const tenancy = this.tenancy;
+        if (tenancy && filter)
+            filter[tenancy.provider.field] = tenancy.provider.read(tenancy.mode, context);
+        return filter;
+    }
+    /**
+     * Asserts this context may write the document it just read. No-op without tenancy.
+     *
+     * Separate from the read filter, and it has to be: in a `shared` collection everybody
+     * reads the shared documents, so a scoped read says nothing about who may change them.
+     *
+     * @param doc     the stored document
+     * @param context the request context
+     * @throws when the write is not allowed
+     */
+    assertWritable(doc, context) {
+        const tenancy = this.tenancy;
+        if (!tenancy || !doc)
+            return;
+        if (!tenancy.provider.canWrite(tenancy.mode, doc[tenancy.provider.field], context))
+            throw new errors_1.ForbiddenError();
+    }
     /**
      *
      */
@@ -213,25 +259,50 @@ class BaseModel extends events_1.EventEmitter {
         return __awaiter(this, arguments, void 0, function* (id, context = {}) {
             if (!id)
                 return null;
-            const filter = { _id: (0, mongo_utils_1.toObjectId)(id) };
-            yield this.beforeGet(filter, context);
+            // The RETURNED filter is the one that counts. This used to discard it and query with
+            // the object built here, which worked only because every override mutates its argument:
+            // one written in pure style - `return { ...filter, tenantId }`, the shape this very
+            // signature invites - compiled, read across every tenant, and said nothing.
+            const filter = yield this.beforeGet({ _id: (0, mongo_utils_1.toObjectId)(id) }, context);
             return this.mgModel.findOne(filter, null, { session: context === null || context === void 0 ? void 0 : context.session });
         });
     }
     /**
+     * Decides whether a subscriber may see THIS event payload.
+     *
+     * Being authenticated is not being entitled: with tenancy in force the payload is a
+     * document, and a document has an owner. Left at "any authenticated user" - as it was -
+     * a single channel carried every tenant's documents to every subscriber.
      *
      * @param {*} item
      * @param {*} context
      */
     checkContextPermission(item, context = {}) {
-        return Promise.resolve((context.user) ? item : null);
+        if (!context.user)
+            return Promise.resolve(null);
+        const tenancy = this.tenancy;
+        if (!tenancy || !item)
+            return Promise.resolve(item);
+        const allowed = tenancy.provider.read(tenancy.mode, context);
+        return Promise.resolve((0, tenancy_1.matchesTenancy)(item[tenancy.provider.field], allowed) ? item : null);
     }
     /**
+     * Decides whether a subscriber may listen on a channel carrying THIS payload.
+     *
+     * Note the parameter is the payload itself, not an id, whatever its name suggests:
+     * `getChannelSubscriber` hands over `payload[payloadId]`.
      *
      * @param {*} context
      */
     checkChannelSubscriber(payloadId, context = {}) {
-        return Promise.resolve(!!(context.user));
+        if (!context.user)
+            return Promise.resolve(false);
+        const tenancy = this.tenancy;
+        const payload = payloadId;
+        if (!tenancy || !payload || typeof payload !== 'object')
+            return Promise.resolve(true);
+        const allowed = tenancy.provider.read(tenancy.mode, context);
+        return Promise.resolve((0, tenancy_1.matchesTenancy)(payload[tenancy.provider.field], allowed));
     }
     /**
      * Get document using Moongose wrapper method
@@ -265,28 +336,63 @@ class BaseModel extends events_1.EventEmitter {
         return this.mgModel.collection.findOne(params);
     }
     /**
+     * Scopes a read by id. Overriding this REPLACES the tenant scoping, it does not add to it.
      *
-     * @param id
+     * @param filter
      * @param context
-     * @returns
+     * @returns the filter the query must use - the RETURNED one, which is what `get` uses
      */
     beforeGet(filter, context) {
         return __awaiter(this, void 0, void 0, function* () {
-            return filter;
+            return this.scopeFilter(filter, context);
         });
     }
     /**
+     * Stamps the owner and the audit on a new document.
+     *
+     * The value in the payload is a REQUEST, never an instruction: the provider decides what
+     * is actually written, and refuses rather than downgrade when the context is not
+     * entitled to the scope it asked for.
+     *
+     * Declared `async` because that refusal is a THROW, and the signature promises a promise:
+     * left synchronous, a caller reaching for `.catch()` would never see it, while one using
+     * `await` would - the same split contract that made `beforeGet` silently unsafe.
+     *
+     * Overriding this to set other fields is expected - denormalised data, defaults - but
+     * call `super`, or both the scoping and the audit silently stop happening for this model
+     * alone.
      *
      * @param {*} item
      */
     beforeCreate(item, context) {
-        return Promise.resolve(item);
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const tenancy = this.tenancy;
+            if (tenancy && item) {
+                const field = tenancy.provider.field;
+                item[field] = tenancy.provider.write(tenancy.mode, item[field], context);
+            }
+            if (((_a = this.defaultParams) === null || _a === void 0 ? void 0 : _a.audit) !== false)
+                (0, audit_1.stampAudit)(item, this.schema, context, true);
+            return item;
+        });
     }
     /**
+     * Keeps an update from re-homing a document into another tenant, and stamps the audit.
+     *
+     * The owner is dropped from the payload rather than validated: an update never has a
+     * legitimate reason to move a document across tenants, so there is nothing to allow. The
+     * creation fields go the same way, for the same reason - a document is created once.
      *
      * @param {*} item
      */
     beforeUpdate(item, context) {
+        var _a;
+        const tenancy = this.tenancy;
+        if (tenancy && item)
+            delete item[tenancy.provider.field];
+        if (((_a = this.defaultParams) === null || _a === void 0 ? void 0 : _a.audit) !== false)
+            (0, audit_1.stampAudit)(item, this.schema, context, false);
         return Promise.resolve(item);
     }
     /**
@@ -297,11 +403,23 @@ class BaseModel extends events_1.EventEmitter {
         return Promise.resolve(item);
     }
     /**
+     * Asserts the caller may delete this document, BEFORE it is deleted.
+     *
+     * `remove` deletes by `_id` with no filter whatsoever, and `bulkRemove` is a loop over
+     * it: without this check any caller deletes another tenant's documents knowing only an
+     * id. The document is re-read unscoped on purpose - the point is to judge its real
+     * owner, and a scoped read would hide the very case being guarded against.
      *
      * @param {*} id
      */
     beforeRemove(id, context) {
-        return Promise.resolve(id);
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.tenancy && id) {
+                const doc = yield this.mgModel.findOne({ _id: (0, mongo_utils_1.toObjectId)(id) });
+                this.assertWritable(doc, context);
+            }
+            return id;
+        });
     }
     /**
      *
@@ -345,6 +463,7 @@ class BaseModel extends events_1.EventEmitter {
         }
     }
     /**
+     * Scopes list / count / findOne / aggregate - the bulk of the read surface.
      *
      * @param {*} params
      * @param {*} context
@@ -354,6 +473,7 @@ class BaseModel extends events_1.EventEmitter {
             var _a;
             if (!params)
                 params = {};
+            this.scopeFilter(params, context);
             this.manageFilterArrayParams(params);
             (_a = params.rangeDate) !== null && _a !== void 0 ? _a : (params.rangeDate = {});
             let and = [];
@@ -469,6 +589,9 @@ class BaseModel extends events_1.EventEmitter {
                 const itemDoc = yield this.get(id, context);
                 if (!itemDoc)
                     throw new errors_1.AppError('messages.notFound');
+                // A scoped READ is not a permission to WRITE: in a shared collection the document
+                // just read may well be one everybody sees and only the application tier may change.
+                this.assertWritable(itemDoc, context);
                 let toApply = item;
                 // complete merge with the freshly read document
                 if (mergeItem) {

package/build/common/base/mongo.types.d.ts

@@ -1,4 +1,5 @@
 import { NxObject } from '../interfaces';
+import { TenancyMode } from '../enums';
 export type ModelDef<TDoc, TMongoModel, TNxModel> = {
     classDef: new (params: ModelData<TDoc, TMongoModel>) => TNxModel;
     name: string;
@@ -18,4 +19,20 @@ export type ModelData<TDoc, TMongoModel> = {
 export type ModelDefParams = {
     sort?: NxObject;
     CRUDEvents?: boolean;
+    /**
+     * How this collection relates to tenants.
+     *
+     * Omitted, a schema declaring the tenant field is scoped to ONE tenant: the scoping is
+     * opt-OUT, so silence means isolated. Say `none` to exempt a collection, and say WHY
+     * next to it - an unexplained exemption cannot be told apart from an oversight.
+     */
+    tenancy?: TenancyMode;
+    /**
+     * Whether `createdBy`/`createdAt`/`updatedBy`/`updatedAt` are kept automatically.
+     *
+     * Omitted, they are - but only for the fields the schema actually declares, so a model
+     * that never wanted an audit gets none either way. Set `false` for a collection that
+     * declares the fields and fills them itself, which today is nothing.
+     */
+    audit?: boolean;
 };

package/build/common/base/tenancy.d.ts

@@ -0,0 +1,101 @@
+/*********************************************************************************************
+ *                                                                                           *
+ * TENANCY - the contract that lets `BaseModel` scope by tenant WITHOUT knowing what a       *
+ * tenant is.                                                                                *
+ *                                                                                           *
+ * Isolation used to be opt-IN: `BaseModel` scoped nothing, so a model owning a tenant       *
+ * field was isolated only for as long as somebody remembered to override five hooks in      *
+ * every single class. Forgetting one is silent - the collection simply answers every        *
+ * tenant - and it is a mistake that has already been made three times over.                 *
+ *                                                                                           *
+ * Here it is opt-OUT: a model whose schema declares the tenant field is scoped by           *
+ * default, and a model that must NOT be scoped has to say so.                               *
+ *                                                                                           *
+ * WHY A PROVIDER, AND NOT THE RULES THEMSELVES                                              *
+ *                                                                                           *
+ * "Which tenant is this request" is an application question: it depends on roles, on        *
+ * memberships, on grants - none of which this library knows, nor should. So the library     *
+ * asks, and the application answers by registering a provider on `APP.tenancy`.             *
+ *                                                                                           *
+ * IMPORTANT: with NO provider registered, every model behaves exactly as it did before      *
+ * this file existed. The scoping is inert until an application opts into it, which is       *
+ * what makes the change safe for consumers that know nothing about tenants.                 *
+ *                                                                                           *
+ *********************************************************************************************/
+import { NxContext, NxObject } from '../interfaces';
+import { TenancyMode } from '../enums';
+/**
+ * What the application must answer for the library to scope on its behalf.
+ *
+ * Every method takes the mode, so one provider serves every model: the rules of a `shared`
+ * collection differ from those of an `own` one, and the difference belongs to the
+ * application, not to a second provider.
+ */
+export interface TenancyProvider {
+    /** Schema field carrying the owner. */
+    field: string;
+    /**
+     * The value a READ must be constrained to - a plain id for `own`, typically an `$in`
+     * over the tenant and the shared marker for `shared`.
+     *
+     * @param mode    the model's declared mode
+     * @param context the request context
+     * @returns whatever mongo should match the field against
+     */
+    read(mode: TenancyMode, context: NxContext): unknown;
+    /**
+     * The value a NEW document must carry, and the place where a write is authorised.
+     *
+     * `requested` is whatever the payload carried under the tenant field: it is a REQUEST and
+     * never an instruction - honour it only for a context entitled to it, and refuse
+     * otherwise rather than silently downgrading, which would let a client discover the rule
+     * by trial.
+     *
+     * @param mode      the model's declared mode
+     * @param requested the value found in the payload, when any
+     * @param context   the request context
+     * @returns the value to stamp on the document
+     * @throws when the context may not write the requested scope
+     */
+    write(mode: TenancyMode, requested: unknown, context: NxContext): unknown;
+    /**
+     * Whether an EXISTING document may be modified or deleted by this context.
+     *
+     * Separate from `read` on purpose: in a `shared` collection everybody reads the shared
+     * documents and only the application tier writes them, so a filter alone - which is a
+     * read - cannot express the rule.
+     *
+     * @param mode    the model's declared mode
+     * @param current the value the stored document carries
+     * @param context the request context
+     */
+    canWrite(mode: TenancyMode, current: unknown, context: NxContext): boolean;
+}
+/**
+ * Reads the tenancy in force for a model, or `null` when there is none.
+ *
+ * Three conditions, all necessary: an application must have registered a provider, the
+ * model must not have opted out, and the schema must actually declare the field - a model
+ * without it has no owner to scope by.
+ *
+ * @param provider the registered provider, when any
+ * @param schema   the model's mongoose schema definition
+ * @param declared the mode declared in `ModelDefParams`, when any
+ */
+export declare function resolveTenancy(provider: TenancyProvider | undefined, schema: NxObject | undefined, declared?: TenancyMode): {
+    provider: TenancyProvider;
+    mode: TenancyMode;
+} | null;
+/**
+ * Whether a document's owner satisfies what a read allows.
+ *
+ * The allowed value is whatever `TenancyProvider.read` returned, so it is either a plain
+ * value or a mongo operator. Only `$in` is understood, and deliberately so: this is used
+ * where no query runs - filtering an event payload in memory - and quietly accepting an
+ * operator it cannot evaluate would let a document through unchecked. Anything else is
+ * refused, which fails closed.
+ *
+ * @param current the value carried by the document
+ * @param allowed what `read` returned for this context
+ */
+export declare function matchesTenancy(current: unknown, allowed: unknown): boolean;

package/build/common/base/tenancy.js

@@ -0,0 +1,66 @@
+"use strict";
+/*********************************************************************************************
+ *                                                                                           *
+ * TENANCY - the contract that lets `BaseModel` scope by tenant WITHOUT knowing what a       *
+ * tenant is.                                                                                *
+ *                                                                                           *
+ * Isolation used to be opt-IN: `BaseModel` scoped nothing, so a model owning a tenant       *
+ * field was isolated only for as long as somebody remembered to override five hooks in      *
+ * every single class. Forgetting one is silent - the collection simply answers every        *
+ * tenant - and it is a mistake that has already been made three times over.                 *
+ *                                                                                           *
+ * Here it is opt-OUT: a model whose schema declares the tenant field is scoped by           *
+ * default, and a model that must NOT be scoped has to say so.                               *
+ *                                                                                           *
+ * WHY A PROVIDER, AND NOT THE RULES THEMSELVES                                              *
+ *                                                                                           *
+ * "Which tenant is this request" is an application question: it depends on roles, on        *
+ * memberships, on grants - none of which this library knows, nor should. So the library     *
+ * asks, and the application answers by registering a provider on `APP.tenancy`.             *
+ *                                                                                           *
+ * IMPORTANT: with NO provider registered, every model behaves exactly as it did before      *
+ * this file existed. The scoping is inert until an application opts into it, which is       *
+ * what makes the change safe for consumers that know nothing about tenants.                 *
+ *                                                                                           *
+ *********************************************************************************************/
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveTenancy = resolveTenancy;
+exports.matchesTenancy = matchesTenancy;
+const enums_1 = require("../enums");
+/**
+ * Reads the tenancy in force for a model, or `null` when there is none.
+ *
+ * Three conditions, all necessary: an application must have registered a provider, the
+ * model must not have opted out, and the schema must actually declare the field - a model
+ * without it has no owner to scope by.
+ *
+ * @param provider the registered provider, when any
+ * @param schema   the model's mongoose schema definition
+ * @param declared the mode declared in `ModelDefParams`, when any
+ */
+function resolveTenancy(provider, schema, declared) {
+    if (!provider || declared === enums_1.TenancyMode.none)
+        return null;
+    if (!schema || !(provider.field in schema))
+        return null;
+    return { provider, mode: declared !== null && declared !== void 0 ? declared : enums_1.TenancyMode.own };
+}
+/**
+ * Whether a document's owner satisfies what a read allows.
+ *
+ * The allowed value is whatever `TenancyProvider.read` returned, so it is either a plain
+ * value or a mongo operator. Only `$in` is understood, and deliberately so: this is used
+ * where no query runs - filtering an event payload in memory - and quietly accepting an
+ * operator it cannot evaluate would let a document through unchecked. Anything else is
+ * refused, which fails closed.
+ *
+ * @param current the value carried by the document
+ * @param allowed what `read` returned for this context
+ */
+function matchesTenancy(current, allowed) {
+    if (allowed && typeof allowed === 'object') {
+        const values = allowed.$in;
+        return Array.isArray(values) ? values.includes(current) : false;
+    }
+    return current === allowed;
+}

package/build/common/crypto/index.d.ts

@@ -1,4 +1,5 @@
 export * from './crypto.interfaces';
+export * from './crypto.constants';
 export * from './crypto.classes';
 export * from './crypto.utils';
 export * from './crypto-legacy';

package/build/common/crypto/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./crypto.interfaces"), exports);
+__exportStar(require("./crypto.constants"), exports);
 __exportStar(require("./crypto.classes"), exports);
 __exportStar(require("./crypto.utils"), exports);
 __exportStar(require("./crypto-legacy"), exports);

package/build/common/enums.d.ts

@@ -59,3 +59,20 @@ export declare enum AuthIssuer {
     USER = "user",
     DEVICE = "device"
 }
+/**
+ * How a collection relates to tenants. Declared per model in `ModelDefParams.tenancy`.
+ *
+ *  - `own`    every document belongs to exactly ONE tenant. The default whenever the schema
+ *             declares the tenant field, because it is the safe reading of a tenant field:
+ *             assuming otherwise is what leaks.
+ *  - `shared` the collection holds BOTH documents shared by all tenants and documents owned
+ *             by one. Reads span the two, writes do not: see `TenancyProvider.write`.
+ *  - `none`   the collection carries the field but is NOT request-scoped. Always a decision,
+ *             never a default - state the reason next to it, because an unexplained `none`
+ *             is indistinguishable from an oversight.
+ */
+export declare enum TenancyMode {
+    own = "own",
+    shared = "shared",
+    none = "none"
+}

package/build/common/enums.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthIssuer = exports.ValueType = exports.DatePeriod = exports.ModelCrudEventType = exports.AppStatus = exports.AppMode = void 0;
+exports.TenancyMode = exports.AuthIssuer = exports.ValueType = exports.DatePeriod = exports.ModelCrudEventType = exports.AppStatus = exports.AppMode = void 0;
 var AppMode;
 (function (AppMode) {
     AppMode["DEV"] = "development";
@@ -73,3 +73,21 @@ var AuthIssuer;
     AuthIssuer["USER"] = "user";
     AuthIssuer["DEVICE"] = "device";
 })(AuthIssuer || (exports.AuthIssuer = AuthIssuer = {}));
+/**
+ * How a collection relates to tenants. Declared per model in `ModelDefParams.tenancy`.
+ *
+ *  - `own`    every document belongs to exactly ONE tenant. The default whenever the schema
+ *             declares the tenant field, because it is the safe reading of a tenant field:
+ *             assuming otherwise is what leaks.
+ *  - `shared` the collection holds BOTH documents shared by all tenants and documents owned
+ *             by one. Reads span the two, writes do not: see `TenancyProvider.write`.
+ *  - `none`   the collection carries the field but is NOT request-scoped. Always a decision,
+ *             never a default - state the reason next to it, because an unexplained `none`
+ *             is indistinguishable from an oversight.
+ */
+var TenancyMode;
+(function (TenancyMode) {
+    TenancyMode["own"] = "own";
+    TenancyMode["shared"] = "shared";
+    TenancyMode["none"] = "none";
+})(TenancyMode || (exports.TenancyMode = TenancyMode = {}));

package/build/common/index.d.ts

@@ -6,5 +6,7 @@ export * from './interfaces';
 export * from './types';
 export * from './manager';
 export * from './utils';
+export * from './base/tenancy';
+export * from './base/audit';
 export * from './express';
 export * from './crypto';

package/build/common/index.js

@@ -22,6 +22,8 @@ __exportStar(require("./interfaces"), exports);
 __exportStar(require("./types"), exports);
 __exportStar(require("./manager"), exports);
 __exportStar(require("./utils"), exports);
+__exportStar(require("./base/tenancy"), exports);
+__exportStar(require("./base/audit"), exports);
 // export * from './models';
 __exportStar(require("./express"), exports);
 // export * from './nx-disk-storage';

package/build/common/types.d.ts

@@ -9,6 +9,7 @@ import { NxObject, NxTypeObject } from './interfaces';
 import { PubSubManager } from './manager/pubsub-manager';
 import { ShutdownManager } from './manager/shutdown-manager';
 import { CryptoManager } from './manager/crypto-manager';
+import { TenancyProvider } from './base/tenancy';
 export type NxDateRage = {
     from?: Date;
     to?: Date;
@@ -32,6 +33,14 @@ export type AppData = {
     cryptoMng?: CryptoManager;
     streams: ChangeStreamData[];
     config: AppConfig;
+    /**
+     * Tenant scoping, registered by the application at boot.
+     *
+     * Left unset - as every consumer that knows nothing about tenants leaves it - the models
+     * behave exactly as they did before tenancy existed: the scoping is inert until somebody
+     * opts into it.
+     */
+    tenancy?: TenancyProvider;
 };
 export type AppConfig = {
     endpoint: AppEndpoint;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/nx-frame-be",
-  "version": "1.0.44",
+  "version": "1.0.46",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",