@nextage/nx-frame-be 1.0.46 → 1.0.47

package/build/common/base/__test__/tenancy-opt-out.test.js

@@ -32,6 +32,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const constants_1 = require("../../constants");
 const base_model_1 = require("../base.model");
 const mongo_utils_1 = require("../mongo-utils");
+const mongo_utils_2 = require("../mongo-utils");
 const enums_1 = require("../../enums");
 /** Marks a document every tenant shares, as an application would mark it. */
 const SHARED = '__GLOBAL__';
@@ -125,6 +126,17 @@ describe('a model that overrides nothing is scoped anyway', () => {
         yield expect(unaware.remove(doc.id, outsider)).rejects.toBeDefined();
         expect(yield unaware.mgModel.collection.countDocuments({})).toBe(1);
     }));
+    // A refusal that only happens when the document EXISTS is an oracle: delete an id at
+    // random and the answer tells you whether it names something in somebody else's tenant.
+    // The two outcomes must therefore be indistinguishable - the existence of another
+    // tenant's document is not a fact this caller is entitled to learn.
+    it('refuses a delete the same way whether the document is missing or another tenant\'s', () => __awaiter(void 0, void 0, void 0, function* () {
+        const doc = yield unaware.create({ code: 'A' }, owner);
+        const missing = (0, mongo_utils_2.genObjectId)().toHexString();
+        const foreign = yield unaware.remove(doc.id, outsider).then(() => null, (e) => e.constructor.name);
+        const absent = yield unaware.remove(missing, outsider).then(() => null, (e) => e.constructor.name);
+        expect(absent).toBe(foreign);
+    }));
     it('refuses to update another tenant document', () => __awaiter(void 0, void 0, void 0, function* () {
         const doc = yield unaware.create({ code: 'A' }, owner);
         yield expect(unaware.update(doc.id, { code: 'B' }, outsider)).rejects.toBeDefined();

package/build/common/base/base.model.d.ts

@@ -214,6 +214,13 @@ export declare class BaseModel<TAttrs, TDoc extends BaseMongoDoc, TMongoModel ex
      * id. The document is re-read unscoped on purpose - the point is to judge its real
      * owner, and a scoped read would hide the very case being guarded against.
      *
+     * A MISSING document is refused in exactly the same way as a foreign one, and that is
+     * not defensive coding: refusing only when the document exists turns this hook into an
+     * oracle. Delete an id at random and the outcome answers a question the caller was
+     * never entitled to ask - whether that id names something in somebody else's tenant.
+     * The two cases are therefore made indistinguishable, which costs nothing: deleting an
+     * id that matches nothing had no effect to begin with.
+     *
      * @param {*} id
      */
     beforeRemove(id: string, context: NxContext): Promise<string>;

package/build/common/base/base.model.js

@@ -410,12 +410,21 @@ class BaseModel extends events_1.EventEmitter {
      * id. The document is re-read unscoped on purpose - the point is to judge its real
      * owner, and a scoped read would hide the very case being guarded against.
      *
+     * A MISSING document is refused in exactly the same way as a foreign one, and that is
+     * not defensive coding: refusing only when the document exists turns this hook into an
+     * oracle. Delete an id at random and the outcome answers a question the caller was
+     * never entitled to ask - whether that id names something in somebody else's tenant.
+     * The two cases are therefore made indistinguishable, which costs nothing: deleting an
+     * id that matches nothing had no effect to begin with.
+     *
      * @param {*} id
      */
     beforeRemove(id, context) {
         return __awaiter(this, void 0, void 0, function* () {
             if (this.tenancy && id) {
                 const doc = yield this.mgModel.findOne({ _id: (0, mongo_utils_1.toObjectId)(id) });
+                if (!doc)
+                    throw new errors_1.ForbiddenError();
                 this.assertWritable(doc, context);
             }
             return id;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nextage/nx-frame-be",
-  "version": "1.0.46",
+  "version": "1.0.47",
   "description": "",
   "main": "./build/index.js",
   "types": "./build/index.d.ts",