@objectstack/core 16.0.0 → 17.0.0-rc.0

package/dist/index.js

@@ -1252,6 +1252,7 @@ function createMemoryMetadata() {
 }
 
 // src/fallbacks/authored-translation-sync.ts
+import { LEGACY_OBJECT_FIRST_KEYS } from "@objectstack/spec/system";
 var OWNER_PROP = "__authoredTranslationSyncOwner";
 var LOCALE_LIKE = /^[a-z]{2,3}([_-]([A-Za-z]{4}|[A-Za-z]{2}|[0-9]{3}))?$/;
 async function readAuthoredTranslationLayer(engine, logger) {
@@ -1281,14 +1282,32 @@ async function readAuthoredTranslationLayer(engine, logger) {
       continue;
     }
     if (!data || typeof data !== "object") continue;
-    const locale = typeof data?._meta?.locale === "string" && data._meta.locale || typeof data?.locale === "string" && data.locale || (typeof row?.name === "string" && LOCALE_LIKE.test(row.name) ? row.name : void 0) || void 0;
+    const legacyKeys = LEGACY_OBJECT_FIRST_KEYS.filter((key) => data[key] !== void 0);
+    if (legacyKeys.length > 0) {
+      logger?.warn?.(
+        `[i18n] authored translation '${row?.name}' uses the retired object-first shape (${legacyKeys.join(", ")}) \u2014 nothing resolves from it; re-author it under 'objects.<object_name>' with a top-level 'locale' \u2014 skipped`
+      );
+      continue;
+    }
+    const locale = typeof data?.locale === "string" && data.locale || (typeof row?.name === "string" && LOCALE_LIKE.test(row.name) ? row.name : void 0) || void 0;
     if (!locale) {
       logger?.warn?.(
-        `[i18n] authored translation '${row?.name}' has no resolvable locale (set _meta.locale, or name the item after its BCP-47 locale) \u2014 skipped`
+        `[i18n] authored translation '${row?.name}' has no resolvable locale (set the top-level 'locale', or name the item after its BCP-47 locale) \u2014 skipped`
       );
       continue;
     }
-    const { name: _n, locale: _l, _packageId: _p, _provenance: _pr, _lock: _lk, ...payload } = data;
+    const {
+      name: _n,
+      locale: _l,
+      _packageId: _p,
+      _packageVersion: _pv,
+      _provenance: _pr,
+      _lock: _lk,
+      _lockReason: _lr,
+      _lockDocsUrl: _ld,
+      _lockSource: _ls,
+      ...payload
+    } = data;
     byLocale[locale] = deepMerge(byLocale[locale] ?? {}, payload);
   }
   return byLocale;
@@ -4212,7 +4231,7 @@ import {
   mapMembershipRole,
   BUILTIN_IDENTITY_PLATFORM_ADMIN,
   ADMIN_FULL_ACCESS,
-  ORGANIZATION_ADMIN
+  ORGANIZATION_ADMIN_GRANTS
 } from "@objectstack/spec";
 
 // src/security/grant-validity.ts
@@ -4320,7 +4339,8 @@ async function resolveAuthzContext(input) {
     positions: [],
     permissions: [],
     systemPermissions: [],
-    org_user_ids: []
+    org_user_ids: [],
+    accessible_org_ids: []
   };
   let userId;
   let tenantId;
@@ -4346,6 +4366,33 @@ async function resolveAuthzContext(input) {
   ctx.userId = userId;
   if (tenantId) ctx.tenantId = tenantId;
   if (!ql || typeof ql.find !== "function") return ctx;
+  const grants = await resolveUserAuthzGrants(ql, userId, {
+    tenantId,
+    nowMs: input.nowMs,
+    seedPermissions: ctx.permissions,
+    seedEmail: ctx.email
+  });
+  ctx.positions = grants.positions;
+  ctx.permissions = grants.permissions;
+  ctx.systemPermissions = grants.systemPermissions;
+  ctx.org_user_ids = grants.org_user_ids;
+  ctx.accessible_org_ids = grants.accessible_org_ids;
+  if (grants.tabPermissions) ctx.tabPermissions = grants.tabPermissions;
+  if (grants.posture) ctx.posture = grants.posture;
+  if (grants.email && !ctx.email) ctx.email = grants.email;
+  return ctx;
+}
+async function resolveUserAuthzGrants(ql, userId, opts = {}) {
+  const { tenantId } = opts;
+  const grants = {
+    positions: [],
+    permissions: Array.isArray(opts.seedPermissions) ? [...opts.seedPermissions] : [],
+    systemPermissions: [],
+    org_user_ids: [userId],
+    accessible_org_ids: []
+  };
+  if (opts.seedEmail) grants.email = opts.seedEmail;
+  if (!ql || typeof ql.find !== "function") return grants;
   let userRowLoaded = false;
   let userRow;
   const getUserRow = async () => {
@@ -4356,28 +4403,35 @@ async function resolveAuthzContext(input) {
     }
     return userRow;
   };
-  if (!ctx.email) {
+  if (!grants.email) {
     const u = await getUserRow();
-    if (u?.email) ctx.email = String(u.email);
+    if (u?.email) grants.email = String(u.email);
   }
-  const memberWhere = tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId };
-  const members = await tryFind(ql, "sys_member", memberWhere, 50);
+  const nowMs = opts.nowMs ?? Date.now();
+  const members = await tryFind(ql, "sys_member", { user_id: userId }, 200);
+  const accessibleOrgIds = /* @__PURE__ */ new Set();
   for (const m of members) {
+    if (!isGrantActive(m, nowMs)) continue;
+    const org = m.organization_id ?? m.organizationId;
+    if (typeof org === "string" && org) accessibleOrgIds.add(org);
+  }
+  grants.accessible_org_ids = Array.from(accessibleOrgIds);
+  const activeMembers = tenantId ? members.filter((m) => (m.organization_id ?? m.organizationId) === tenantId) : members;
+  for (const m of activeMembers) {
     if (m.role && typeof m.role === "string") {
       for (const raw of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
         const r = mapMembershipRole(raw);
-        if (!ctx.positions.includes(r)) ctx.positions.push(r);
+        if (!grants.positions.includes(r)) grants.positions.push(r);
       }
     }
   }
-  const nowMs = input.nowMs ?? Date.now();
   const userPositionRows = await tryFind(ql, "sys_user_position", { user_id: userId }, 200);
   for (const ur of userPositionRows) {
     const org = ur.organization_id ?? null;
     if (org && tenantId && org !== tenantId) continue;
     if (!isGrantActive(ur, nowMs)) continue;
     const r = ur.position;
-    if (typeof r === "string" && r && !ctx.positions.includes(r)) ctx.positions.push(r);
+    if (typeof r === "string" && r && !grants.positions.includes(r)) grants.positions.push(r);
   }
   if (tenantId) {
     const orgMembers = await tryFind(ql, "sys_member", { organization_id: tenantId }, 1e3);
@@ -4385,9 +4439,7 @@ async function resolveAuthzContext(input) {
       orgMembers.map((m) => m.user_id ?? m.userId).filter((v) => typeof v === "string" && v.length > 0)
     );
     ids.add(userId);
-    ctx.org_user_ids = Array.from(ids);
-  } else {
-    ctx.org_user_ids = [userId];
+    grants.org_user_ids = Array.from(ids);
   }
   const upsRowsAll = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const upsRows = upsRowsAll.filter((r) => isGrantActive(r, nowMs));
@@ -4401,9 +4453,9 @@ async function resolveAuthzContext(input) {
     upsRows.filter((r) => (r.organization_id ?? r.organizationId ?? null) === null).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   let hasPlatformAdminGrant = false;
-  if (!ctx.positions.includes("everyone")) ctx.positions.push("everyone");
-  if (ctx.positions.length > 0) {
-    const positionRows = await tryFind(ql, "sys_position", { name: { $in: ctx.positions } }, 100);
+  if (!grants.positions.includes("everyone")) grants.positions.push("everyone");
+  if (grants.positions.length > 0) {
+    const positionRows = await tryFind(ql, "sys_position", { name: { $in: grants.positions } }, 100);
     const positionIds = positionRows.map((r) => r.id).filter(Boolean);
     if (positionIds.length > 0) {
       const rpsRows = await tryFind(ql, "sys_position_permission_set", { position_id: { $in: positionIds } }, 500);
@@ -4418,12 +4470,12 @@ async function resolveAuthzContext(input) {
     const tabRank = { hidden: 0, default_off: 1, default_on: 2, visible: 3 };
     const mergedTabs = {};
     for (const ps of psRows) {
-      if (ps.name && !ctx.permissions.includes(ps.name)) ctx.permissions.push(ps.name);
+      if (ps.name && !grants.permissions.includes(ps.name)) grants.permissions.push(ps.name);
       if (ps.name === ADMIN_FULL_ACCESS && unscopedUserPsIds.has(ps.id)) hasPlatformAdminGrant = true;
       const sysPerms = typeof ps.system_permissions === "string" ? safeJsonParse2(ps.system_permissions, []) : ps.system_permissions ?? ps.systemPermissions;
       if (Array.isArray(sysPerms)) {
         for (const p of sysPerms) {
-          if (typeof p === "string" && !ctx.systemPermissions.includes(p)) ctx.systemPermissions.push(p);
+          if (typeof p === "string" && !grants.systemPermissions.includes(p)) grants.systemPermissions.push(p);
         }
       }
       const tabs = typeof ps.tab_permissions === "string" ? safeJsonParse2(ps.tab_permissions, {}) : ps.tab_permissions ?? ps.tabPermissions;
@@ -4437,20 +4489,22 @@ async function resolveAuthzContext(input) {
         }
       }
     }
-    if (Object.keys(mergedTabs).length > 0) ctx.tabPermissions = mergedTabs;
+    if (Object.keys(mergedTabs).length > 0) grants.tabPermissions = mergedTabs;
   }
-  if (hasPlatformAdminGrant && !ctx.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
-    ctx.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
+  if (hasPlatformAdminGrant && !grants.positions.includes(BUILTIN_IDENTITY_PLATFORM_ADMIN)) {
+    grants.positions.unshift(BUILTIN_IDENTITY_PLATFORM_ADMIN);
   }
-  ctx.posture = derivePosture({
+  grants.posture = derivePosture({
     isPlatformAdmin: hasPlatformAdminGrant,
-    isTenantAdmin: ctx.permissions.includes(ORGANIZATION_ADMIN)
+    // [ADR-0105 D4] Either org-admin capability set resolves the rung — the
+    // wall-less variant differs only by withholding the superuser bits.
+    isTenantAdmin: ORGANIZATION_ADMIN_GRANTS.some((n) => grants.permissions.includes(n))
   });
-  if (!ctx.permissions.includes("ai_seat")) {
+  if (!grants.permissions.includes("ai_seat")) {
     const aiAccess = (await getUserRow())?.ai_access;
-    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") ctx.permissions.push("ai_seat");
+    if (aiAccess === true || aiAccess === 1 || aiAccess === "1") grants.permissions.push("ai_seat");
   }
-  return ctx;
+  return grants;
 }
 function isValidTimeZone(tz) {
   try {
@@ -4575,8 +4629,8 @@ function calendarPartsInTzOrUtc(d, tz) {
     day: d.getUTCDate()
   };
 }
-function zonedDateStartToUtcMs(ymd, tz) {
-  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd);
+function zonedDateStartToUtcMs(ymd2, tz) {
+  const m = /^(\d{4})-(\d{2})-(\d{2})$/.exec(ymd2);
   const wallAsUtc = m ? Date.UTC(Number(m[1]), Number(m[2]) - 1, Number(m[3])) : NaN;
   if (!tz || tz === "UTC" || Number.isNaN(wallAsUtc)) return wallAsUtc;
   try {
@@ -4792,6 +4846,212 @@ async function bulkWrite(rows, opts) {
   return results;
 }
 
+// src/utils/filter-tokens.ts
+import {
+  classifyFilterToken,
+  parseDateMacroParam
+} from "@objectstack/spec/data";
+var UnknownFilterTokenError = class extends Error {
+  constructor(token, suggestion) {
+    super(
+      `Unresolvable filter placeholder "{${token}}". ` + (suggestion ? `Did you mean "{${suggestion}}"? ` : "Resolvable placeholders are the context tokens ({current_user_id}, {current_org_id}) and the date macros ({today}, {current_quarter_start}, {30_days_ago}, \u2026). ") + "Sending it to the data engine verbatim would compare it as a literal string and match nothing, which is indistinguishable from an empty result."
+    );
+    this.status = 400;
+    this.code = "FILTER_TOKEN_UNKNOWN";
+    this.name = "UnknownFilterTokenError";
+    this.token = token;
+    this.suggestion = suggestion;
+  }
+};
+var UnresolvedFilterTokenError = class extends Error {
+  constructor(token, detail) {
+    super(`Filter placeholder "{${token}}" cannot be resolved: ${detail}`);
+    /** 400, not 500 — see {@link UnknownFilterTokenError}. */
+    this.status = 400;
+    this.code = "FILTER_TOKEN_UNRESOLVED";
+    this.name = "UnresolvedFilterTokenError";
+    this.token = token;
+  }
+};
+function ymd(year, month, day) {
+  const p = (n) => String(n).padStart(2, "0");
+  return `${year}-${p(month)}-${p(day)}`;
+}
+function proxyDay(now, timezone) {
+  const { year, month, day } = calendarPartsInTzOrUtc(now, timezone);
+  return new Date(Date.UTC(year, month - 1, day));
+}
+var asYmd = (d) => ymd(d.getUTCFullYear(), d.getUTCMonth() + 1, d.getUTCDate());
+function startOfPeriod(kind, d) {
+  const r = new Date(d.getTime());
+  switch (kind) {
+    case "week": {
+      const dow = (r.getUTCDay() + 6) % 7;
+      r.setUTCDate(r.getUTCDate() - dow);
+      return r;
+    }
+    case "month":
+      return new Date(Date.UTC(r.getUTCFullYear(), r.getUTCMonth(), 1));
+    case "quarter":
+      return new Date(Date.UTC(r.getUTCFullYear(), Math.floor(r.getUTCMonth() / 3) * 3, 1));
+    case "year":
+      return new Date(Date.UTC(r.getUTCFullYear(), 0, 1));
+  }
+}
+function daysInMonth(year, month) {
+  return new Date(Date.UTC(year, month + 1, 0)).getUTCDate();
+}
+function addMonthsClamped(d, n) {
+  const year = d.getUTCFullYear();
+  const month = d.getUTCMonth() + n;
+  const targetYear = year + Math.floor(month / 12);
+  const targetMonth = (month % 12 + 12) % 12;
+  const day = Math.min(d.getUTCDate(), daysInMonth(targetYear, targetMonth));
+  return new Date(Date.UTC(
+    targetYear,
+    targetMonth,
+    day,
+    d.getUTCHours(),
+    d.getUTCMinutes(),
+    d.getUTCSeconds(),
+    d.getUTCMilliseconds()
+  ));
+}
+function addPeriods(kind, d, n) {
+  switch (kind) {
+    case "week": {
+      const r = new Date(d.getTime());
+      r.setUTCDate(r.getUTCDate() + n * 7);
+      return r;
+    }
+    case "month":
+      return addMonthsClamped(d, n);
+    case "quarter":
+      return addMonthsClamped(d, n * 3);
+    case "year":
+      return addMonthsClamped(d, n * 12);
+  }
+}
+function addUnits(unit, d, n) {
+  const r = new Date(d.getTime());
+  switch (unit) {
+    case "minute":
+      r.setUTCMinutes(r.getUTCMinutes() + n);
+      return r;
+    case "hour":
+      r.setUTCHours(r.getUTCHours() + n);
+      return r;
+    case "day":
+      r.setUTCDate(r.getUTCDate() + n);
+      return r;
+    case "week":
+      r.setUTCDate(r.getUTCDate() + n * 7);
+      return r;
+    // Month/year steps clamp rather than overflow — see addMonthsClamped.
+    case "month":
+      return addMonthsClamped(d, n);
+    case "year":
+      return addMonthsClamped(d, n * 12);
+  }
+}
+var PERIOD_RE = /^(?:(current|last|next)_)?(week|month|quarter|year)_(start|end)$/;
+function resolvePeriodToken(token, today) {
+  const m = PERIOD_RE.exec(token);
+  if (!m) return void 0;
+  const rel = m[1] ?? "current";
+  const kind = m[2];
+  const bound = m[3];
+  const offset = rel === "last" ? -1 : rel === "next" ? 1 : 0;
+  const periodStart = startOfPeriod(kind, addPeriods(kind, startOfPeriod(kind, today), offset));
+  if (bound === "start") return asYmd(periodStart);
+  const next = addPeriods(kind, periodStart, 1);
+  next.setUTCDate(next.getUTCDate() - 1);
+  return asYmd(next);
+}
+function resolveFilterToken(token, ctx = {}) {
+  const now = ctx.now ?? /* @__PURE__ */ new Date();
+  if (token === "current_user_id") {
+    if (!ctx.userId) {
+      throw new UnresolvedFilterTokenError(
+        token,
+        "the request has no authenticated user. A filter scoped to the signed-in user cannot run for an anonymous or system caller \u2014 gate the surface on authentication, or drop the token from the filter."
+      );
+    }
+    return ctx.userId;
+  }
+  if (token === "current_org_id") {
+    if (!ctx.orgId) {
+      throw new UnresolvedFilterTokenError(
+        token,
+        "the request carries no active organization (ExecutionContext.tenantId is unset). Set the active org on the request, or drop the token from the filter."
+      );
+    }
+    return ctx.orgId;
+  }
+  const today = proxyDay(now, ctx.timezone);
+  switch (token) {
+    case "now":
+      return now.toISOString();
+    case "today":
+      return asYmd(today);
+    case "yesterday":
+      return asYmd(addUnits("day", today, -1));
+    case "tomorrow":
+      return asYmd(addUnits("day", today, 1));
+  }
+  const period = resolvePeriodToken(token, today);
+  if (period !== void 0) return period;
+  const param = parseDateMacroParam(token);
+  if (param) {
+    const sign = param.direction === "ago" ? -1 : 1;
+    if (param.unit === "minute" || param.unit === "hour") {
+      return addUnits(param.unit, now, sign * param.n).toISOString();
+    }
+    return asYmd(addUnits(param.unit, today, sign * param.n));
+  }
+  return void 0;
+}
+function hasFilterToken(node) {
+  if (typeof node === "string") return classifyFilterToken(node) !== null;
+  if (Array.isArray(node)) return node.some(hasFilterToken);
+  if (node && typeof node === "object" && !(node instanceof Date)) {
+    return Object.values(node).some(hasFilterToken);
+  }
+  return false;
+}
+function resolveFilterTokens(filter, ctx = {}) {
+  if (filter == null) return filter;
+  if (!hasFilterToken(filter)) return filter;
+  const pinned = { ...ctx, now: ctx.now ?? /* @__PURE__ */ new Date() };
+  const walk = (node) => {
+    if (typeof node === "string") {
+      const cls = classifyFilterToken(node);
+      if (!cls) return node;
+      if (cls.kind === "unknown") throw new UnknownFilterTokenError(cls.token, cls.suggestion);
+      const resolved = resolveFilterToken(cls.token, pinned);
+      if (resolved === void 0) throw new UnknownFilterTokenError(cls.token);
+      return resolved;
+    }
+    if (Array.isArray(node)) return node.map(walk);
+    if (node && typeof node === "object") {
+      if (node instanceof Date) return node;
+      const out = {};
+      for (const [k, v] of Object.entries(node)) out[k] = walk(v);
+      return out;
+    }
+    return node;
+  };
+  return walk(filter);
+}
+function filterTokenContextFrom(execCtx, now) {
+  return {
+    now,
+    timezone: execCtx?.timezone,
+    userId: execCtx?.userId,
+    orgId: execCtx?.tenantId
+  };
+}
+
 // src/health-monitor.ts
 var PluginHealthMonitor = class {
   constructor(logger) {
@@ -5736,6 +5996,8 @@ export {
   SecurePluginContext,
   SemanticVersionManager,
   ServiceLifecycle,
+  UnknownFilterTokenError,
+  UnresolvedFilterTokenError,
   bucketKeyToCalendarRange,
   buildPermissionsFromGrants,
   bulkWrite,
@@ -5756,6 +6018,7 @@ export {
   derivePosture,
   evaluateAuthGate,
   extractApiKey,
+  filterTokenContextFrom,
   generateApiKey,
   generateEd25519KeyPair,
   getEnv,
@@ -5772,8 +6035,11 @@ export {
   readAuthoredTranslationLayer,
   resolveApiKeyPrincipal,
   resolveAuthzContext,
+  resolveFilterToken,
+  resolveFilterTokens,
   resolveLocale,
   resolveLocalizationContext,
+  resolveUserAuthzGrants,
   safeExit,
   shouldDenyAnonymous,
   signPayload,