@objectstack/core 11.0.0 → 11.1.0

package/dist/index.cjs

@@ -66,12 +66,14 @@ __export(index_exports, {
   createMemoryQueue: () => createMemoryQueue,
   createPluginConfigValidator: () => createPluginConfigValidator,
   createPluginPermissionEnforcer: () => createPluginPermissionEnforcer,
+  evaluateAuthGate: () => evaluateAuthGate,
   extractApiKey: () => extractApiKey,
   generateApiKey: () => generateApiKey,
   generateEd25519KeyPair: () => generateEd25519KeyPair,
   getEnv: () => getEnv,
   getMemoryUsage: () => getMemoryUsage,
   hashApiKey: () => hashApiKey,
+  isAuthGateAllowlisted: () => isAuthGateAllowlisted,
   isExpired: () => isExpired,
   isNode: () => isNode,
   parseScopes: () => parseScopes,
@@ -4126,9 +4128,19 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
+  let userRowLoaded = false;
+  let userRow;
+  const getUserRow = async () => {
+    if (!userRowLoaded) {
+      userRowLoaded = true;
+      const rows = await tryFind(ql, "sys_user", { id: userId }, 1);
+      userRow = rows[0];
+    }
+    return userRow;
+  };
   if (!ctx.email) {
-    const userRows = await tryFind(ql, "sys_user", { id: userId }, 1);
-    if (userRows[0]?.email) ctx.email = String(userRows[0].email);
+    const u = await getUserRow();
+    if (u?.email) ctx.email = String(u.email);
   }
   const memberWhere = tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId };
   const members = await tryFind(ql, "sys_member", memberWhere, 50);
@@ -4209,8 +4221,7 @@ async function resolveAuthzContext(input) {
     ctx.roles.unshift(import_spec.BUILTIN_ROLE_PLATFORM_ADMIN);
   }
   if (!ctx.permissions.includes("ai_seat")) {
-    const seatRows = await tryFind(ql, "sys_user", { id: userId }, 1);
-    const aiAccess = seatRows?.[0]?.ai_access;
+    const aiAccess = (await getUserRow())?.ai_access;
     if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
   }
   return ctx;
@@ -4252,13 +4263,45 @@ async function resolveLocalizationContext(input) {
     }
   } catch {
   }
-  const tzRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "timezone", scope: "tenant" }, 1);
-  const localeRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "locale", scope: "tenant" }, 1);
-  const currencyRows = await tryFind(ql, "sys_setting", { namespace: "localization", key: "currency", scope: "tenant" }, 1);
+  const rows = await tryFind(
+    ql,
+    "sys_setting",
+    { namespace: "localization", key: { $in: ["timezone", "locale", "currency"] }, scope: "tenant" },
+    10
+  );
+  const valueOf = (k) => rows.find((r) => r.key === k)?.value;
+  return {
+    timezone: coerceTimeZone(valueOf("timezone")) ?? "UTC",
+    locale: coerceLocale(valueOf("locale")) ?? "en-US",
+    currency: coerceCurrency(valueOf("currency"))
+  };
+}
+
+// src/security/auth-gate.ts
+var ALLOW_PREFIXES = ["/api/v1/auth/", "/api/auth/", "/auth/"];
+var ALLOW_SUFFIXES = ["/health", "/ready", "/discovery", "/me/apps", "/me/localization"];
+function isAuthGateAllowlisted(rawPath) {
+  if (!rawPath) return true;
+  let path = rawPath.split("?")[0] || "/";
+  let end = path.length;
+  while (end > 1 && path.charCodeAt(end - 1) === 47) end--;
+  path = path.slice(0, end) || "/";
+  if (path.includes("/auth/")) return true;
+  for (const p of ALLOW_PREFIXES) {
+    if (path.startsWith(p) || path === p.replace(/\/$/, "")) return true;
+  }
+  for (const s of ALLOW_SUFFIXES) {
+    if (path.endsWith(s)) return true;
+  }
+  return false;
+}
+function evaluateAuthGate(sessionUser, path) {
+  const gate = sessionUser?.authGate;
+  if (!gate || typeof gate.code !== "string") return null;
+  if (isAuthGateAllowlisted(path)) return null;
   return {
-    timezone: coerceTimeZone(tzRows[0]?.value) ?? "UTC",
-    locale: coerceLocale(localeRows[0]?.value) ?? "en-US",
-    currency: coerceCurrency(currencyRows[0]?.value)
+    code: gate.code,
+    message: typeof gate.message === "string" && gate.message ? gate.message : "Access is blocked by an authentication policy."
   };
 }
 
@@ -5238,12 +5281,14 @@ var NamespaceResolver = class {
   createMemoryQueue,
   createPluginConfigValidator,
   createPluginPermissionEnforcer,
+  evaluateAuthGate,
   extractApiKey,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
   getMemoryUsage,
   hashApiKey,
+  isAuthGateAllowlisted,
   isExpired,
   isNode,
   parseScopes,