@objectstack/plugin-security 4.0.0 → 4.0.2

package/.turbo/turbo-build.log

@@ -1,22 +1,22 @@
 
-> @objectstack/plugin-security@4.0.0 build /home/runner/work/spec/spec/packages/plugins/plugin-security
+> @objectstack/plugin-security@4.0.2 build /home/runner/work/framework/framework/packages/plugins/plugin-security
 > tsup --config ../../../tsup.config.ts
 
 CLI Building entry: src/index.ts
 CLI Using tsconfig: tsconfig.json
 CLI tsup v8.5.1
-CLI Using tsup config: /home/runner/work/spec/spec/tsup.config.ts
+CLI Using tsup config: /home/runner/work/framework/framework/tsup.config.ts
 CLI Target: es2020
 CLI Cleaning output folder
 ESM Build start
 CJS Build start
-CJS dist/index.js     15.04 KB
-CJS dist/index.js.map 29.21 KB
-CJS ⚡️ Build success in 116ms
-ESM dist/index.mjs     13.65 KB
-ESM dist/index.mjs.map 28.58 KB
-ESM ⚡️ Build success in 116ms
+ESM dist/index.mjs     14.18 KB
+ESM dist/index.mjs.map 29.65 KB
+ESM ⚡️ Build success in 148ms
+CJS dist/index.js     15.57 KB
+CJS dist/index.js.map 30.28 KB
+CJS ⚡️ Build success in 153ms
 DTS Build start
-DTS ⚡️ Build success in 18573ms
-DTS dist/index.d.mts 166.78 KB
-DTS dist/index.d.ts  166.78 KB
+DTS ⚡️ Build success in 21244ms
+DTS dist/index.d.mts 164.76 KB
+DTS dist/index.d.ts  164.76 KB

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # @objectstack/plugin-security
 
+## 4.0.2
+
+### Patch Changes
+
+- Updated dependencies [5f659e9]
+  - @objectstack/spec@4.0.2
+  - @objectstack/core@4.0.2
+
 ## 4.0.0
 
 ### Patch Changes

package/dist/index.d.mts

@@ -441,11 +441,7 @@ declare const SysRole: Omit<{
     keyPrefix?: string | undefined;
     actions?: {
         name: string;
-        label: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        };
+        label: string;
         type: "url" | "script" | "modal" | "flow" | "api";
         refreshAfter: boolean;
         objectName?: string | undefined;
@@ -456,44 +452,24 @@ declare const SysRole: Omit<{
         execute?: string | undefined;
         params?: {
             name: string;
-            label: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            };
+            label: string;
             type: "number" | "boolean" | "date" | "lookup" | "file" | "url" | "json" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "datetime" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "location" | "address" | "code" | "color" | "rating" | "slider" | "signature" | "qrcode" | "progress" | "tags" | "vector";
             required: boolean;
             options?: {
-                label: string | {
-                    key: string;
-                    defaultValue?: string | undefined;
-                    params?: Record<string, string | number | boolean> | undefined;
-                };
+                label: string;
                 value: string;
             }[] | undefined;
         }[] | undefined;
         variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
-        confirmText?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
-        successMessage?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
+        confirmText?: string | undefined;
+        successMessage?: string | undefined;
         visible?: string | undefined;
         disabled?: string | boolean | undefined;
         shortcut?: string | undefined;
         bulkEnabled?: boolean | undefined;
         timeout?: number | undefined;
         aria?: {
-            ariaLabel?: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            } | undefined;
+            ariaLabel?: string | undefined;
             ariaDescribedBy?: string | undefined;
             role?: string | undefined;
         } | undefined;
@@ -2224,11 +2200,7 @@ declare const SysPermissionSet: Omit<{
     keyPrefix?: string | undefined;
     actions?: {
         name: string;
-        label: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        };
+        label: string;
         type: "url" | "script" | "modal" | "flow" | "api";
         refreshAfter: boolean;
         objectName?: string | undefined;
@@ -2239,44 +2211,24 @@ declare const SysPermissionSet: Omit<{
         execute?: string | undefined;
         params?: {
             name: string;
-            label: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            };
+            label: string;
             type: "number" | "boolean" | "date" | "lookup" | "file" | "url" | "json" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "datetime" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "location" | "address" | "code" | "color" | "rating" | "slider" | "signature" | "qrcode" | "progress" | "tags" | "vector";
             required: boolean;
             options?: {
-                label: string | {
-                    key: string;
-                    defaultValue?: string | undefined;
-                    params?: Record<string, string | number | boolean> | undefined;
-                };
+                label: string;
                 value: string;
             }[] | undefined;
         }[] | undefined;
         variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
-        confirmText?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
-        successMessage?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
+        confirmText?: string | undefined;
+        successMessage?: string | undefined;
         visible?: string | undefined;
         disabled?: string | boolean | undefined;
         shortcut?: string | undefined;
         bulkEnabled?: boolean | undefined;
         timeout?: number | undefined;
         aria?: {
-            ariaLabel?: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            } | undefined;
+            ariaLabel?: string | undefined;
             ariaDescribedBy?: string | undefined;
             role?: string | undefined;
         } | undefined;

package/dist/index.d.ts

@@ -441,11 +441,7 @@ declare const SysRole: Omit<{
     keyPrefix?: string | undefined;
     actions?: {
         name: string;
-        label: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        };
+        label: string;
         type: "url" | "script" | "modal" | "flow" | "api";
         refreshAfter: boolean;
         objectName?: string | undefined;
@@ -456,44 +452,24 @@ declare const SysRole: Omit<{
         execute?: string | undefined;
         params?: {
             name: string;
-            label: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            };
+            label: string;
             type: "number" | "boolean" | "date" | "lookup" | "file" | "url" | "json" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "datetime" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "location" | "address" | "code" | "color" | "rating" | "slider" | "signature" | "qrcode" | "progress" | "tags" | "vector";
             required: boolean;
             options?: {
-                label: string | {
-                    key: string;
-                    defaultValue?: string | undefined;
-                    params?: Record<string, string | number | boolean> | undefined;
-                };
+                label: string;
                 value: string;
             }[] | undefined;
         }[] | undefined;
         variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
-        confirmText?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
-        successMessage?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
+        confirmText?: string | undefined;
+        successMessage?: string | undefined;
         visible?: string | undefined;
         disabled?: string | boolean | undefined;
         shortcut?: string | undefined;
         bulkEnabled?: boolean | undefined;
         timeout?: number | undefined;
         aria?: {
-            ariaLabel?: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            } | undefined;
+            ariaLabel?: string | undefined;
             ariaDescribedBy?: string | undefined;
             role?: string | undefined;
         } | undefined;
@@ -2224,11 +2200,7 @@ declare const SysPermissionSet: Omit<{
     keyPrefix?: string | undefined;
     actions?: {
         name: string;
-        label: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        };
+        label: string;
         type: "url" | "script" | "modal" | "flow" | "api";
         refreshAfter: boolean;
         objectName?: string | undefined;
@@ -2239,44 +2211,24 @@ declare const SysPermissionSet: Omit<{
         execute?: string | undefined;
         params?: {
             name: string;
-            label: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            };
+            label: string;
             type: "number" | "boolean" | "date" | "lookup" | "file" | "url" | "json" | "text" | "textarea" | "email" | "phone" | "password" | "markdown" | "html" | "richtext" | "currency" | "percent" | "datetime" | "time" | "toggle" | "select" | "multiselect" | "radio" | "checkboxes" | "master_detail" | "tree" | "image" | "avatar" | "video" | "audio" | "formula" | "summary" | "autonumber" | "location" | "address" | "code" | "color" | "rating" | "slider" | "signature" | "qrcode" | "progress" | "tags" | "vector";
             required: boolean;
             options?: {
-                label: string | {
-                    key: string;
-                    defaultValue?: string | undefined;
-                    params?: Record<string, string | number | boolean> | undefined;
-                };
+                label: string;
                 value: string;
             }[] | undefined;
         }[] | undefined;
         variant?: "link" | "primary" | "secondary" | "danger" | "ghost" | undefined;
-        confirmText?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
-        successMessage?: string | {
-            key: string;
-            defaultValue?: string | undefined;
-            params?: Record<string, string | number | boolean> | undefined;
-        } | undefined;
+        confirmText?: string | undefined;
+        successMessage?: string | undefined;
         visible?: string | undefined;
         disabled?: string | boolean | undefined;
         shortcut?: string | undefined;
         bulkEnabled?: boolean | undefined;
         timeout?: number | undefined;
         aria?: {
-            ariaLabel?: string | {
-                key: string;
-                defaultValue?: string | undefined;
-                params?: Record<string, string | number | boolean> | undefined;
-            } | undefined;
+            ariaLabel?: string | undefined;
             ariaDescribedBy?: string | undefined;
             role?: string | undefined;
         } | undefined;

package/dist/index.js

@@ -392,7 +392,7 @@ var SecurityPlugin = class {
     ctx.registerService("security.permissions", this.permissionEvaluator);
     ctx.registerService("security.rls", this.rlsCompiler);
     ctx.registerService("security.fieldMasker", this.fieldMasker);
-    ctx.registerService("app.com.objectstack.security", {
+    ctx.getService("manifest").register({
       id: "com.objectstack.security",
       name: "Security",
       version: "1.0.0",
@@ -400,6 +400,20 @@ var SecurityPlugin = class {
       namespace: "sys",
       objects: [SysRole, SysPermissionSet]
     });
+    try {
+      const setupNav = ctx.getService("setupNav");
+      if (setupNav) {
+        setupNav.contribute({
+          areaId: "area_administration",
+          items: [
+            { id: "nav_roles", type: "object", label: "Roles", objectName: "role", icon: "shield-check", order: 60 },
+            { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "permission_set", icon: "lock", order: 70 }
+          ]
+        });
+        ctx.logger.info("Security navigation items contributed to Setup App");
+      }
+    } catch {
+    }
     ctx.logger.info("Security Plugin initialized");
   }
   async start(ctx) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/permission-evaluator.ts","../src/rls-compiler.ts","../src/field-masker.ts","../src/objects/sys-role.object.ts","../src/objects/sys-permission-set.object.ts","../src/security-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * @objectstack/plugin-security\n * \n * Security Plugin for ObjectStack\n * Provides RBAC, Row-Level Security (RLS), and Field-Level Security runtime.\n */\n\nexport { SecurityPlugin } from './security-plugin.js';\nexport { PermissionEvaluator } from './permission-evaluator.js';\nexport { RLSCompiler } from './rls-compiler.js';\nexport { FieldMasker } from './field-masker.js';\n\n// System Object Definitions (sys namespace)\nexport { SysRole, SysPermissionSet } from './objects/index.js';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { PermissionSet, ObjectPermission, FieldPermission } from '@objectstack/spec/security';\n\n/**\n * Operation type mapping to permission checks\n */\nconst OPERATION_TO_PERMISSION: Record<string, keyof ObjectPermission> = {\n  find: 'allowRead',\n  findOne: 'allowRead',\n  count: 'allowRead',\n  aggregate: 'allowRead',\n  insert: 'allowCreate',\n  update: 'allowEdit',\n  delete: 'allowDelete',\n};\n\n/**\n * PermissionEvaluator\n * \n * Runtime evaluator for PermissionSet definitions.\n * Resolves aggregated permissions from roles to concrete allow/deny decisions.\n */\nexport class PermissionEvaluator {\n  /**\n   * Check if an operation is allowed on an object for the given permission sets.\n   * Uses \"most permissive\" merging: if ANY permission set allows, it's allowed.\n   */\n  checkObjectPermission(\n    operation: string,\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): boolean {\n    const permKey = OPERATION_TO_PERMISSION[operation];\n    if (!permKey) return true; // Unknown operations are allowed by default\n\n    for (const ps of permissionSets) {\n      const objPerm = ps.objects?.[objectName];\n      if (objPerm) {\n        // Check if modifyAllRecords is set (super-user bypass for write ops)\n        if (['allowEdit', 'allowDelete'].includes(permKey) && objPerm.modifyAllRecords) {\n          return true;\n        }\n        // Check if viewAllRecords is set (super-user bypass for read ops)\n        if (permKey === 'allowRead' && (objPerm.viewAllRecords || objPerm.modifyAllRecords)) {\n          return true;\n        }\n        // Check the specific permission\n        if (objPerm[permKey]) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Get the merged field permissions for an object.\n   * Returns a map of field names to their effective permissions.\n   * Uses \"most permissive\" merging.\n   */\n  getFieldPermissions(\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): Record<string, FieldPermission> {\n    const result: Record<string, FieldPermission> = {};\n\n    for (const ps of permissionSets) {\n      if (!ps.fields) continue;\n\n      for (const [key, perm] of Object.entries(ps.fields)) {\n        // Field keys are in format: \"object_name.field_name\"\n        if (!key.startsWith(`${objectName}.`)) continue;\n        const fieldName = key.substring(objectName.length + 1);\n\n        if (!result[fieldName]) {\n          result[fieldName] = { readable: false, editable: false };\n        }\n\n        // Most permissive merge\n        if (perm.readable) result[fieldName].readable = true;\n        if (perm.editable) result[fieldName].editable = true;\n      }\n    }\n\n    return result;\n  }\n\n  /**\n   * Resolve permission sets for a list of role names from metadata.\n   */\n  resolvePermissionSets(\n    roles: string[],\n    metadataService: any\n  ): PermissionSet[] {\n    const result: PermissionSet[] = [];\n\n    // Get all permission sets from metadata\n    const allPermSets = metadataService.list?.('permissions') || [];\n\n    for (const ps of allPermSets) {\n      // A permission set is relevant if it's a profile assigned to any of the user's roles,\n      // or if the role name matches the permission set name\n      if (roles.includes(ps.name)) {\n        result.push(ps);\n      }\n    }\n\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\n/**\n * RLS User Context\n * Variables available for RLS expression evaluation.\n */\ninterface RLSUserContext {\n  id?: string;\n  tenant_id?: string;\n  roles?: string[];\n  [key: string]: unknown;\n}\n\n/**\n * RLSCompiler\n * \n * Compiles Row-Level Security policy expressions into query filters.\n * Converts `using` / `check` expressions into ObjectQL-compatible filter conditions.\n */\nexport class RLSCompiler {\n  /**\n   * Compile RLS policies into a query filter for the given user context.\n   * Multiple policies for the same object/operation are OR-combined (any match allows access).\n   */\n  compileFilter(\n    policies: RowLevelSecurityPolicy[],\n    executionContext?: ExecutionContext\n  ): Record<string, unknown> | null {\n    if (policies.length === 0) return null;\n\n    const userCtx: RLSUserContext = {\n      id: executionContext?.userId,\n      tenant_id: executionContext?.tenantId,\n      roles: executionContext?.roles,\n    };\n\n    const filters: Record<string, unknown>[] = [];\n\n    for (const policy of policies) {\n      if (!policy.using) continue;\n      const filter = this.compileExpression(policy.using, userCtx);\n      if (filter) {\n        filters.push(filter);\n      }\n    }\n\n    if (filters.length === 0) return null;\n    if (filters.length === 1) return filters[0];\n\n    // Multiple policies: OR-combine (any policy allows access)\n    return { $or: filters };\n  }\n\n  /**\n   * Compile a single RLS expression into a query filter.\n   * \n   * Supports simple expressions like:\n   * - \"field_name = current_user.property\"\n   * - \"field_name IN (current_user.array_property)\"\n   * - \"field_name = 'literal_value'\"\n   */\n  compileExpression(\n    expression: string,\n    userCtx: RLSUserContext\n  ): Record<string, unknown> | null {\n    if (!expression) return null;\n\n    // Handle simple equality: \"field = current_user.property\"\n    const eqMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*current_user\\.(\\w+)\\s*$/);\n    if (eqMatch) {\n      const [, field, prop] = eqMatch;\n      const value = userCtx[prop];\n      if (value === undefined) return null;\n      return { [field]: value };\n    }\n\n    // Handle literal equality: \"field = 'value'\"\n    const litMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*'([^']*)'\\s*$/);\n    if (litMatch) {\n      const [, field, value] = litMatch;\n      return { [field]: value };\n    }\n\n    // Handle IN: \"field IN (current_user.array_property)\"\n    const inMatch = expression.match(/^\\s*(\\w+)\\s+IN\\s+\\(\\s*current_user\\.(\\w+)\\s*\\)\\s*$/i);\n    if (inMatch) {\n      const [, field, prop] = inMatch;\n      const value = userCtx[prop];\n      if (!Array.isArray(value)) return null;\n      return { [field]: { $in: value } };\n    }\n\n    // Unsupported expression: return null (no additional RLS filter applied).\n    // Note: callers should treat absence of RLS policies as \"allow all\" only when\n    // no policies are defined. If policies exist but cannot be compiled, the caller\n    // may want to deny access as a safety measure.\n    return null;\n  }\n\n  /**\n   * Get applicable RLS policies for a given object and operation.\n   */\n  getApplicablePolicies(\n    objectName: string,\n    operation: string,\n    allPolicies: RowLevelSecurityPolicy[]\n  ): RowLevelSecurityPolicy[] {\n    // Map engine operation to RLS operation type\n    const rlsOp = this.mapOperationToRLS(operation);\n\n    return allPolicies.filter(policy => {\n      // Check object match\n      if (policy.object !== objectName && policy.object !== '*') return false;\n\n      // Check operation match\n      if (policy.operation === 'all') return true;\n      if (policy.operation === rlsOp) return true;\n\n      return false;\n    });\n  }\n\n  private mapOperationToRLS(operation: string): string {\n    switch (operation) {\n      case 'find':\n      case 'findOne':\n      case 'count':\n      case 'aggregate':\n        return 'select';\n      case 'insert':\n        return 'insert';\n      case 'update':\n        return 'update';\n      case 'delete':\n        return 'delete';\n      default:\n        return 'select';\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { FieldPermission } from '@objectstack/spec/security';\n\n/**\n * FieldMasker\n * \n * Applies field-level security by stripping restricted fields from query results.\n */\nexport class FieldMasker {\n  /**\n   * Mask fields in query results based on field permissions.\n   * Removes fields that the user does not have read access to.\n   */\n  maskResults(\n    results: any | any[],\n    fieldPermissions: Record<string, FieldPermission>,\n    _objectName: string\n  ): any | any[] {\n    // If no field permissions defined, return results as-is\n    if (Object.keys(fieldPermissions).length === 0) return results;\n\n    // Get list of non-readable fields\n    const hiddenFields = Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.readable)\n      .map(([field]) => field);\n\n    if (hiddenFields.length === 0) return results;\n\n    if (Array.isArray(results)) {\n      return results.map(record => this.maskRecord(record, hiddenFields));\n    }\n\n    return this.maskRecord(results, hiddenFields);\n  }\n\n  /**\n   * Get non-editable fields for use in write operations.\n   * Returns a list of field names that should be stripped from incoming data.\n   */\n  getNonEditableFields(\n    fieldPermissions: Record<string, FieldPermission>\n  ): string[] {\n    return Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.editable)\n      .map(([field]) => field);\n  }\n\n  /**\n   * Strip non-editable fields from write data.\n   */\n  stripNonEditableFields(\n    data: Record<string, any>,\n    fieldPermissions: Record<string, FieldPermission>\n  ): Record<string, any> {\n    const nonEditable = this.getNonEditableFields(fieldPermissions);\n    if (nonEditable.length === 0) return data;\n\n    const result = { ...data };\n    for (const field of nonEditable) {\n      delete result[field];\n    }\n    return result;\n  }\n\n  private maskRecord(record: any, hiddenFields: string[]): any {\n    if (!record || typeof record !== 'object') return record;\n\n    const result = { ...record };\n    for (const field of hiddenFields) {\n      delete result[field];\n    }\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n    \n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n    }),\n    \n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { PermissionSet, RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport { PermissionEvaluator } from './permission-evaluator.js';\nimport { RLSCompiler } from './rls-compiler.js';\nimport { FieldMasker } from './field-masker.js';\nimport { SysRole, SysPermissionSet } from './objects/index.js';\n\n/**\n * SecurityPlugin\n * \n * Provides RBAC, Row-Level Security, and Field-Level Security runtime.\n * Registers as an engine middleware on the ObjectQL engine.\n * \n * This plugin is fully optional — without it, the system operates\n * without permission checks (same as current behavior).\n * \n * Dependencies:\n * - objectql service (ObjectQL engine with middleware support)\n * - metadata service (MetadataFacade for reading permission sets and RLS policies)\n */\nexport class SecurityPlugin implements Plugin {\n  name = 'com.objectstack.security';\n  type = 'standard';\n  version = '1.0.0';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private permissionEvaluator = new PermissionEvaluator();\n  private rlsCompiler = new RLSCompiler();\n  private fieldMasker = new FieldMasker();\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Initializing Security Plugin...');\n\n    // Register security services\n    ctx.registerService('security.permissions', this.permissionEvaluator);\n    ctx.registerService('security.rls', this.rlsCompiler);\n    ctx.registerService('security.fieldMasker', this.fieldMasker);\n\n    // Register security system objects so ObjectQLPlugin auto-discovers them\n    ctx.registerService('app.com.objectstack.security', {\n      id: 'com.objectstack.security',\n      name: 'Security',\n      version: '1.0.0',\n      type: 'plugin',\n      namespace: 'sys',\n      objects: [SysRole, SysPermissionSet],\n    });\n\n    ctx.logger.info('Security Plugin initialized');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Starting Security Plugin...');\n\n    // Get required services\n    let ql: any;\n    let metadata: any;\n\n    try {\n      ql = ctx.getService('objectql');\n      metadata = ctx.getService('metadata');\n    } catch (e) {\n      ctx.logger.warn('ObjectQL or metadata service not available, security middleware not registered');\n      return;\n    }\n\n    if (!ql || typeof ql.registerMiddleware !== 'function') {\n      ctx.logger.warn('ObjectQL engine does not support middleware, security middleware not registered');\n      return;\n    }\n\n    // Register security middleware\n    ql.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {\n      // System operations bypass security\n      if (opCtx.context?.isSystem) {\n        return next();\n      }\n\n      const roles = opCtx.context?.roles ?? [];\n\n      // Skip security checks if no roles (anonymous/unauthenticated)\n      // The auth middleware should handle authentication separately\n      if (roles.length === 0 && !opCtx.context?.userId) {\n        return next();\n      }\n\n      // 1. Resolve permission sets for the user's roles\n      let permissionSets: PermissionSet[] = [];\n      try {\n        permissionSets = this.permissionEvaluator.resolvePermissionSets(roles, metadata);\n      } catch (e) {\n        // If metadata service is misconfigured, log and continue without permission checks\n        // rather than blocking all operations\n        return next();\n      }\n\n      // 2. CRUD permission check\n      if (permissionSets.length > 0) {\n        const allowed = this.permissionEvaluator.checkObjectPermission(\n          opCtx.operation,\n          opCtx.object,\n          permissionSets\n        );\n\n        if (!allowed) {\n          throw new Error(\n            `[Security] Access denied: operation '${opCtx.operation}' on object '${opCtx.object}' ` +\n            `is not permitted for roles [${roles.join(', ')}]`\n          );\n        }\n      }\n\n      // 3. RLS filter injection\n      const allRlsPolicies = this.collectRLSPolicies(permissionSets, opCtx.object, opCtx.operation);\n      if (allRlsPolicies.length > 0 && opCtx.ast) {\n        const rlsFilter = this.rlsCompiler.compileFilter(allRlsPolicies, opCtx.context);\n        if (rlsFilter) {\n          if (opCtx.ast.where) {\n            opCtx.ast.where = { $and: [opCtx.ast.where, rlsFilter] };\n          } else {\n            opCtx.ast.where = rlsFilter;\n          }\n        }\n      }\n\n      await next();\n\n      // 4. Field-level security: mask restricted fields in read results\n      if (opCtx.result && ['find', 'findOne'].includes(opCtx.operation)) {\n        const fieldPerms = this.permissionEvaluator.getFieldPermissions(opCtx.object, permissionSets);\n        if (Object.keys(fieldPerms).length > 0) {\n          opCtx.result = this.fieldMasker.maskResults(opCtx.result, fieldPerms, opCtx.object);\n        }\n      }\n    });\n\n    ctx.logger.info('Security middleware registered on ObjectQL engine');\n  }\n\n  async destroy(): Promise<void> {\n    // No cleanup needed\n  }\n\n  /**\n   * Collect all RLS policies from permission sets applicable to the given object/operation.\n   */\n  private collectRLSPolicies(\n    permissionSets: PermissionSet[],\n    objectName: string,\n    operation: string\n  ): RowLevelSecurityPolicy[] {\n    const allPolicies: RowLevelSecurityPolicy[] = [];\n\n    for (const ps of permissionSets) {\n      if (ps.rowLevelSecurity) {\n        allPolicies.push(...ps.rowLevelSecurity);\n      }\n    }\n\n    return this.rlsCompiler.getApplicablePolicies(objectName, operation, allPolicies);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,IAAM,0BAAkE;AAAA,EACtE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAQO,IAAM,sBAAN,MAA0B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/B,sBACE,WACA,YACA,gBACS;AACT,UAAM,UAAU,wBAAwB,SAAS;AACjD,QAAI,CAAC,QAAS,QAAO;AAErB,eAAW,MAAM,gBAAgB;AAC/B,YAAM,UAAU,GAAG,UAAU,UAAU;AACvC,UAAI,SAAS;AAEX,YAAI,CAAC,aAAa,aAAa,EAAE,SAAS,OAAO,KAAK,QAAQ,kBAAkB;AAC9E,iBAAO;AAAA,QACT;AAEA,YAAI,YAAY,gBAAgB,QAAQ,kBAAkB,QAAQ,mBAAmB;AACnF,iBAAO;AAAA,QACT;AAEA,YAAI,QAAQ,OAAO,GAAG;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBACE,YACA,gBACiC;AACjC,UAAM,SAA0C,CAAC;AAEjD,eAAW,MAAM,gBAAgB;AAC/B,UAAI,CAAC,GAAG,OAAQ;AAEhB,iBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,MAAM,GAAG;AAEnD,YAAI,CAAC,IAAI,WAAW,GAAG,UAAU,GAAG,EAAG;AACvC,cAAM,YAAY,IAAI,UAAU,WAAW,SAAS,CAAC;AAErD,YAAI,CAAC,OAAO,SAAS,GAAG;AACtB,iBAAO,SAAS,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM;AAAA,QACzD;AAGA,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAChD,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAAA,MAClD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,OACA,iBACiB;AACjB,UAAM,SAA0B,CAAC;AAGjC,UAAM,cAAc,gBAAgB,OAAO,aAAa,KAAK,CAAC;AAE9D,eAAW,MAAM,aAAa;AAG5B,UAAI,MAAM,SAAS,GAAG,IAAI,GAAG;AAC3B,eAAO,KAAK,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACzFO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,cACE,UACA,kBACgC;AAChC,QAAI,SAAS,WAAW,EAAG,QAAO;AAElC,UAAM,UAA0B;AAAA,MAC9B,IAAI,kBAAkB;AAAA,MACtB,WAAW,kBAAkB;AAAA,MAC7B,OAAO,kBAAkB;AAAA,IAC3B;AAEA,UAAM,UAAqC,CAAC;AAE5C,eAAW,UAAU,UAAU;AAC7B,UAAI,CAAC,OAAO,MAAO;AACnB,YAAM,SAAS,KAAK,kBAAkB,OAAO,OAAO,OAAO;AAC3D,UAAI,QAAQ;AACV,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAG1C,WAAO,EAAE,KAAK,QAAQ;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBACE,YACA,SACgC;AAChC,QAAI,CAAC,WAAY,QAAO;AAGxB,UAAM,UAAU,WAAW,MAAM,yCAAyC;AAC1E,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,WAAW,WAAW,MAAM,+BAA+B;AACjE,QAAI,UAAU;AACZ,YAAM,CAAC,EAAE,OAAO,KAAK,IAAI;AACzB,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,UAAU,WAAW,MAAM,qDAAqD;AACtF,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE;AAAA,IACnC;AAMA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,YACA,WACA,aAC0B;AAE1B,UAAM,QAAQ,KAAK,kBAAkB,SAAS;AAE9C,WAAO,YAAY,OAAO,YAAU;AAElC,UAAI,OAAO,WAAW,cAAc,OAAO,WAAW,IAAK,QAAO;AAGlE,UAAI,OAAO,cAAc,MAAO,QAAO;AACvC,UAAI,OAAO,cAAc,MAAO,QAAO;AAEvC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEQ,kBAAkB,WAA2B;AACnD,YAAQ,WAAW;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;ACrIO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,YACE,SACA,kBACA,aACa;AAEb,QAAI,OAAO,KAAK,gBAAgB,EAAE,WAAW,EAAG,QAAO;AAGvD,UAAM,eAAe,OAAO,QAAQ,gBAAgB,EACjD,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAEzB,QAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,QAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,aAAO,QAAQ,IAAI,YAAU,KAAK,WAAW,QAAQ,YAAY,CAAC;AAAA,IACpE;AAEA,WAAO,KAAK,WAAW,SAAS,YAAY;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBACE,kBACU;AACV,WAAO,OAAO,QAAQ,gBAAgB,EACnC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,uBACE,MACA,kBACqB;AACrB,UAAM,cAAc,KAAK,qBAAqB,gBAAgB;AAC9D,QAAI,YAAY,WAAW,EAAG,QAAO;AAErC,UAAM,SAAS,EAAE,GAAG,KAAK;AACzB,eAAW,SAAS,aAAa;AAC/B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,QAAa,cAA6B;AAC3D,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,UAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,eAAW,SAAS,cAAc;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;;;ACxEA,kBAAoC;AAU7B,IAAM,UAAU,yBAAa,OAAO;AAAA,EACzC,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,kBAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,kBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,kBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,kBAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,kBAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,kBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,aAAa,kBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,kBAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,IAED,YAAY,kBAAM,QAAQ;AAAA,MACxB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;AC1FD,IAAAA,eAAoC;AAW7B,IAAM,mBAAmB,0BAAa,OAAO;AAAA,EAClD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,mBAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,mBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,mBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,mBAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,mBAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,mBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,oBAAoB,mBAAM,SAAS;AAAA,MACjC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,mBAAmB,mBAAM,SAAS;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,mBAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;ACvEM,IAAM,iBAAN,MAAuC;AAAA,EAAvC;AACL,gBAAO;AACP,gBAAO;AACP,mBAAU;AACV,wBAAe,CAAC,iCAAiC;AAEjD,SAAQ,sBAAsB,IAAI,oBAAoB;AACtD,SAAQ,cAAc,IAAI,YAAY;AACtC,SAAQ,cAAc,IAAI,YAAY;AAAA;AAAA,EAEtC,MAAM,KAAK,KAAmC;AAC5C,QAAI,OAAO,KAAK,iCAAiC;AAGjD,QAAI,gBAAgB,wBAAwB,KAAK,mBAAmB;AACpE,QAAI,gBAAgB,gBAAgB,KAAK,WAAW;AACpD,QAAI,gBAAgB,wBAAwB,KAAK,WAAW;AAG5D,QAAI,gBAAgB,gCAAgC;AAAA,MAClD,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW;AAAA,MACX,SAAS,CAAC,SAAS,gBAAgB;AAAA,IACrC,CAAC;AAED,QAAI,OAAO,KAAK,6BAA6B;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,OAAO,KAAK,6BAA6B;AAG7C,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,WAAK,IAAI,WAAW,UAAU;AAC9B,iBAAW,IAAI,WAAW,UAAU;AAAA,IACtC,SAAS,GAAG;AACV,UAAI,OAAO,KAAK,gFAAgF;AAChG;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,OAAO,GAAG,uBAAuB,YAAY;AACtD,UAAI,OAAO,KAAK,iFAAiF;AACjG;AAAA,IACF;AAGA,OAAG,mBAAmB,OAAO,OAAY,SAA8B;AAErE,UAAI,MAAM,SAAS,UAAU;AAC3B,eAAO,KAAK;AAAA,MACd;AAEA,YAAM,QAAQ,MAAM,SAAS,SAAS,CAAC;AAIvC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,SAAS,QAAQ;AAChD,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,iBAAkC,CAAC;AACvC,UAAI;AACF,yBAAiB,KAAK,oBAAoB,sBAAsB,OAAO,QAAQ;AAAA,MACjF,SAAS,GAAG;AAGV,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,eAAe,SAAS,GAAG;AAC7B,cAAM,UAAU,KAAK,oBAAoB;AAAA,UACvC,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAEA,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI;AAAA,YACR,wCAAwC,MAAM,SAAS,gBAAgB,MAAM,MAAM,iCACpD,MAAM,KAAK,IAAI,CAAC;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,iBAAiB,KAAK,mBAAmB,gBAAgB,MAAM,QAAQ,MAAM,SAAS;AAC5F,UAAI,eAAe,SAAS,KAAK,MAAM,KAAK;AAC1C,cAAM,YAAY,KAAK,YAAY,cAAc,gBAAgB,MAAM,OAAO;AAC9E,YAAI,WAAW;AACb,cAAI,MAAM,IAAI,OAAO;AACnB,kBAAM,IAAI,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,EAAE;AAAA,UACzD,OAAO;AACL,kBAAM,IAAI,QAAQ;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK;AAGX,UAAI,MAAM,UAAU,CAAC,QAAQ,SAAS,EAAE,SAAS,MAAM,SAAS,GAAG;AACjE,cAAM,aAAa,KAAK,oBAAoB,oBAAoB,MAAM,QAAQ,cAAc;AAC5F,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACtC,gBAAM,SAAS,KAAK,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,MAAM;AAAA,QACpF;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,KAAK,mDAAmD;AAAA,EACrE;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,gBACA,YACA,WAC0B;AAC1B,UAAM,cAAwC,CAAC;AAE/C,eAAW,MAAM,gBAAgB;AAC/B,UAAI,GAAG,kBAAkB;AACvB,oBAAY,KAAK,GAAG,GAAG,gBAAgB;AAAA,MACzC;AAAA,IACF;AAEA,WAAO,KAAK,YAAY,sBAAsB,YAAY,WAAW,WAAW;AAAA,EAClF;AACF;","names":["import_data"]}
+{"version":3,"sources":["../src/index.ts","../src/permission-evaluator.ts","../src/rls-compiler.ts","../src/field-masker.ts","../src/objects/sys-role.object.ts","../src/objects/sys-permission-set.object.ts","../src/security-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\n/**\n * @objectstack/plugin-security\n * \n * Security Plugin for ObjectStack\n * Provides RBAC, Row-Level Security (RLS), and Field-Level Security runtime.\n */\n\nexport { SecurityPlugin } from './security-plugin.js';\nexport { PermissionEvaluator } from './permission-evaluator.js';\nexport { RLSCompiler } from './rls-compiler.js';\nexport { FieldMasker } from './field-masker.js';\n\n// System Object Definitions (sys namespace)\nexport { SysRole, SysPermissionSet } from './objects/index.js';\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { PermissionSet, ObjectPermission, FieldPermission } from '@objectstack/spec/security';\n\n/**\n * Operation type mapping to permission checks\n */\nconst OPERATION_TO_PERMISSION: Record<string, keyof ObjectPermission> = {\n  find: 'allowRead',\n  findOne: 'allowRead',\n  count: 'allowRead',\n  aggregate: 'allowRead',\n  insert: 'allowCreate',\n  update: 'allowEdit',\n  delete: 'allowDelete',\n};\n\n/**\n * PermissionEvaluator\n * \n * Runtime evaluator for PermissionSet definitions.\n * Resolves aggregated permissions from roles to concrete allow/deny decisions.\n */\nexport class PermissionEvaluator {\n  /**\n   * Check if an operation is allowed on an object for the given permission sets.\n   * Uses \"most permissive\" merging: if ANY permission set allows, it's allowed.\n   */\n  checkObjectPermission(\n    operation: string,\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): boolean {\n    const permKey = OPERATION_TO_PERMISSION[operation];\n    if (!permKey) return true; // Unknown operations are allowed by default\n\n    for (const ps of permissionSets) {\n      const objPerm = ps.objects?.[objectName];\n      if (objPerm) {\n        // Check if modifyAllRecords is set (super-user bypass for write ops)\n        if (['allowEdit', 'allowDelete'].includes(permKey) && objPerm.modifyAllRecords) {\n          return true;\n        }\n        // Check if viewAllRecords is set (super-user bypass for read ops)\n        if (permKey === 'allowRead' && (objPerm.viewAllRecords || objPerm.modifyAllRecords)) {\n          return true;\n        }\n        // Check the specific permission\n        if (objPerm[permKey]) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Get the merged field permissions for an object.\n   * Returns a map of field names to their effective permissions.\n   * Uses \"most permissive\" merging.\n   */\n  getFieldPermissions(\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): Record<string, FieldPermission> {\n    const result: Record<string, FieldPermission> = {};\n\n    for (const ps of permissionSets) {\n      if (!ps.fields) continue;\n\n      for (const [key, perm] of Object.entries(ps.fields)) {\n        // Field keys are in format: \"object_name.field_name\"\n        if (!key.startsWith(`${objectName}.`)) continue;\n        const fieldName = key.substring(objectName.length + 1);\n\n        if (!result[fieldName]) {\n          result[fieldName] = { readable: false, editable: false };\n        }\n\n        // Most permissive merge\n        if (perm.readable) result[fieldName].readable = true;\n        if (perm.editable) result[fieldName].editable = true;\n      }\n    }\n\n    return result;\n  }\n\n  /**\n   * Resolve permission sets for a list of role names from metadata.\n   */\n  resolvePermissionSets(\n    roles: string[],\n    metadataService: any\n  ): PermissionSet[] {\n    const result: PermissionSet[] = [];\n\n    // Get all permission sets from metadata\n    const allPermSets = metadataService.list?.('permissions') || [];\n\n    for (const ps of allPermSets) {\n      // A permission set is relevant if it's a profile assigned to any of the user's roles,\n      // or if the role name matches the permission set name\n      if (roles.includes(ps.name)) {\n        result.push(ps);\n      }\n    }\n\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\n/**\n * RLS User Context\n * Variables available for RLS expression evaluation.\n */\ninterface RLSUserContext {\n  id?: string;\n  tenant_id?: string;\n  roles?: string[];\n  [key: string]: unknown;\n}\n\n/**\n * RLSCompiler\n * \n * Compiles Row-Level Security policy expressions into query filters.\n * Converts `using` / `check` expressions into ObjectQL-compatible filter conditions.\n */\nexport class RLSCompiler {\n  /**\n   * Compile RLS policies into a query filter for the given user context.\n   * Multiple policies for the same object/operation are OR-combined (any match allows access).\n   */\n  compileFilter(\n    policies: RowLevelSecurityPolicy[],\n    executionContext?: ExecutionContext\n  ): Record<string, unknown> | null {\n    if (policies.length === 0) return null;\n\n    const userCtx: RLSUserContext = {\n      id: executionContext?.userId,\n      tenant_id: executionContext?.tenantId,\n      roles: executionContext?.roles,\n    };\n\n    const filters: Record<string, unknown>[] = [];\n\n    for (const policy of policies) {\n      if (!policy.using) continue;\n      const filter = this.compileExpression(policy.using, userCtx);\n      if (filter) {\n        filters.push(filter);\n      }\n    }\n\n    if (filters.length === 0) return null;\n    if (filters.length === 1) return filters[0];\n\n    // Multiple policies: OR-combine (any policy allows access)\n    return { $or: filters };\n  }\n\n  /**\n   * Compile a single RLS expression into a query filter.\n   * \n   * Supports simple expressions like:\n   * - \"field_name = current_user.property\"\n   * - \"field_name IN (current_user.array_property)\"\n   * - \"field_name = 'literal_value'\"\n   */\n  compileExpression(\n    expression: string,\n    userCtx: RLSUserContext\n  ): Record<string, unknown> | null {\n    if (!expression) return null;\n\n    // Handle simple equality: \"field = current_user.property\"\n    const eqMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*current_user\\.(\\w+)\\s*$/);\n    if (eqMatch) {\n      const [, field, prop] = eqMatch;\n      const value = userCtx[prop];\n      if (value === undefined) return null;\n      return { [field]: value };\n    }\n\n    // Handle literal equality: \"field = 'value'\"\n    const litMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*'([^']*)'\\s*$/);\n    if (litMatch) {\n      const [, field, value] = litMatch;\n      return { [field]: value };\n    }\n\n    // Handle IN: \"field IN (current_user.array_property)\"\n    const inMatch = expression.match(/^\\s*(\\w+)\\s+IN\\s+\\(\\s*current_user\\.(\\w+)\\s*\\)\\s*$/i);\n    if (inMatch) {\n      const [, field, prop] = inMatch;\n      const value = userCtx[prop];\n      if (!Array.isArray(value)) return null;\n      return { [field]: { $in: value } };\n    }\n\n    // Unsupported expression: return null (no additional RLS filter applied).\n    // Note: callers should treat absence of RLS policies as \"allow all\" only when\n    // no policies are defined. If policies exist but cannot be compiled, the caller\n    // may want to deny access as a safety measure.\n    return null;\n  }\n\n  /**\n   * Get applicable RLS policies for a given object and operation.\n   */\n  getApplicablePolicies(\n    objectName: string,\n    operation: string,\n    allPolicies: RowLevelSecurityPolicy[]\n  ): RowLevelSecurityPolicy[] {\n    // Map engine operation to RLS operation type\n    const rlsOp = this.mapOperationToRLS(operation);\n\n    return allPolicies.filter(policy => {\n      // Check object match\n      if (policy.object !== objectName && policy.object !== '*') return false;\n\n      // Check operation match\n      if (policy.operation === 'all') return true;\n      if (policy.operation === rlsOp) return true;\n\n      return false;\n    });\n  }\n\n  private mapOperationToRLS(operation: string): string {\n    switch (operation) {\n      case 'find':\n      case 'findOne':\n      case 'count':\n      case 'aggregate':\n        return 'select';\n      case 'insert':\n        return 'insert';\n      case 'update':\n        return 'update';\n      case 'delete':\n        return 'delete';\n      default:\n        return 'select';\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { FieldPermission } from '@objectstack/spec/security';\n\n/**\n * FieldMasker\n * \n * Applies field-level security by stripping restricted fields from query results.\n */\nexport class FieldMasker {\n  /**\n   * Mask fields in query results based on field permissions.\n   * Removes fields that the user does not have read access to.\n   */\n  maskResults(\n    results: any | any[],\n    fieldPermissions: Record<string, FieldPermission>,\n    _objectName: string\n  ): any | any[] {\n    // If no field permissions defined, return results as-is\n    if (Object.keys(fieldPermissions).length === 0) return results;\n\n    // Get list of non-readable fields\n    const hiddenFields = Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.readable)\n      .map(([field]) => field);\n\n    if (hiddenFields.length === 0) return results;\n\n    if (Array.isArray(results)) {\n      return results.map(record => this.maskRecord(record, hiddenFields));\n    }\n\n    return this.maskRecord(results, hiddenFields);\n  }\n\n  /**\n   * Get non-editable fields for use in write operations.\n   * Returns a list of field names that should be stripped from incoming data.\n   */\n  getNonEditableFields(\n    fieldPermissions: Record<string, FieldPermission>\n  ): string[] {\n    return Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.editable)\n      .map(([field]) => field);\n  }\n\n  /**\n   * Strip non-editable fields from write data.\n   */\n  stripNonEditableFields(\n    data: Record<string, any>,\n    fieldPermissions: Record<string, FieldPermission>\n  ): Record<string, any> {\n    const nonEditable = this.getNonEditableFields(fieldPermissions);\n    if (nonEditable.length === 0) return data;\n\n    const result = { ...data };\n    for (const field of nonEditable) {\n      delete result[field];\n    }\n    return result;\n  }\n\n  private maskRecord(record: any, hiddenFields: string[]): any {\n    if (!record || typeof record !== 'object') return record;\n\n    const result = { ...record };\n    for (const field of hiddenFields) {\n      delete result[field];\n    }\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n    \n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n    }),\n    \n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { PermissionSet, RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport { PermissionEvaluator } from './permission-evaluator.js';\nimport { RLSCompiler } from './rls-compiler.js';\nimport { FieldMasker } from './field-masker.js';\nimport { SysRole, SysPermissionSet } from './objects/index.js';\n\n/**\n * SecurityPlugin\n * \n * Provides RBAC, Row-Level Security, and Field-Level Security runtime.\n * Registers as an engine middleware on the ObjectQL engine.\n * \n * This plugin is fully optional — without it, the system operates\n * without permission checks (same as current behavior).\n * \n * Dependencies:\n * - objectql service (ObjectQL engine with middleware support)\n * - metadata service (MetadataFacade for reading permission sets and RLS policies)\n */\nexport class SecurityPlugin implements Plugin {\n  name = 'com.objectstack.security';\n  type = 'standard';\n  version = '1.0.0';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private permissionEvaluator = new PermissionEvaluator();\n  private rlsCompiler = new RLSCompiler();\n  private fieldMasker = new FieldMasker();\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Initializing Security Plugin...');\n\n    // Register security services\n    ctx.registerService('security.permissions', this.permissionEvaluator);\n    ctx.registerService('security.rls', this.rlsCompiler);\n    ctx.registerService('security.fieldMasker', this.fieldMasker);\n\n    // Register security system objects via the manifest service.\n    ctx.getService<{ register(m: any): void }>('manifest').register({\n      id: 'com.objectstack.security',\n      name: 'Security',\n      version: '1.0.0',\n      type: 'plugin',\n      namespace: 'sys',\n      objects: [SysRole, SysPermissionSet],\n    });\n\n    // Contribute navigation items to the Setup App (if SetupPlugin is loaded).\n    try {\n      const setupNav = ctx.getService<{ contribute(c: any): void }>('setupNav');\n      if (setupNav) {\n        setupNav.contribute({\n          areaId: 'area_administration',\n          items: [\n            { id: 'nav_roles', type: 'object', label: 'Roles', objectName: 'role', icon: 'shield-check', order: 60 },\n            { id: 'nav_permission_sets', type: 'object', label: 'Permission Sets', objectName: 'permission_set', icon: 'lock', order: 70 },\n          ],\n        });\n        ctx.logger.info('Security navigation items contributed to Setup App');\n      }\n    } catch {\n      // SetupPlugin not loaded — skip silently\n    }\n\n    ctx.logger.info('Security Plugin initialized');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Starting Security Plugin...');\n\n    // Get required services\n    let ql: any;\n    let metadata: any;\n\n    try {\n      ql = ctx.getService('objectql');\n      metadata = ctx.getService('metadata');\n    } catch (e) {\n      ctx.logger.warn('ObjectQL or metadata service not available, security middleware not registered');\n      return;\n    }\n\n    if (!ql || typeof ql.registerMiddleware !== 'function') {\n      ctx.logger.warn('ObjectQL engine does not support middleware, security middleware not registered');\n      return;\n    }\n\n    // Register security middleware\n    ql.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {\n      // System operations bypass security\n      if (opCtx.context?.isSystem) {\n        return next();\n      }\n\n      const roles = opCtx.context?.roles ?? [];\n\n      // Skip security checks if no roles (anonymous/unauthenticated)\n      // The auth middleware should handle authentication separately\n      if (roles.length === 0 && !opCtx.context?.userId) {\n        return next();\n      }\n\n      // 1. Resolve permission sets for the user's roles\n      let permissionSets: PermissionSet[] = [];\n      try {\n        permissionSets = this.permissionEvaluator.resolvePermissionSets(roles, metadata);\n      } catch (e) {\n        // If metadata service is misconfigured, log and continue without permission checks\n        // rather than blocking all operations\n        return next();\n      }\n\n      // 2. CRUD permission check\n      if (permissionSets.length > 0) {\n        const allowed = this.permissionEvaluator.checkObjectPermission(\n          opCtx.operation,\n          opCtx.object,\n          permissionSets\n        );\n\n        if (!allowed) {\n          throw new Error(\n            `[Security] Access denied: operation '${opCtx.operation}' on object '${opCtx.object}' ` +\n            `is not permitted for roles [${roles.join(', ')}]`\n          );\n        }\n      }\n\n      // 3. RLS filter injection\n      const allRlsPolicies = this.collectRLSPolicies(permissionSets, opCtx.object, opCtx.operation);\n      if (allRlsPolicies.length > 0 && opCtx.ast) {\n        const rlsFilter = this.rlsCompiler.compileFilter(allRlsPolicies, opCtx.context);\n        if (rlsFilter) {\n          if (opCtx.ast.where) {\n            opCtx.ast.where = { $and: [opCtx.ast.where, rlsFilter] };\n          } else {\n            opCtx.ast.where = rlsFilter;\n          }\n        }\n      }\n\n      await next();\n\n      // 4. Field-level security: mask restricted fields in read results\n      if (opCtx.result && ['find', 'findOne'].includes(opCtx.operation)) {\n        const fieldPerms = this.permissionEvaluator.getFieldPermissions(opCtx.object, permissionSets);\n        if (Object.keys(fieldPerms).length > 0) {\n          opCtx.result = this.fieldMasker.maskResults(opCtx.result, fieldPerms, opCtx.object);\n        }\n      }\n    });\n\n    ctx.logger.info('Security middleware registered on ObjectQL engine');\n  }\n\n  async destroy(): Promise<void> {\n    // No cleanup needed\n  }\n\n  /**\n   * Collect all RLS policies from permission sets applicable to the given object/operation.\n   */\n  private collectRLSPolicies(\n    permissionSets: PermissionSet[],\n    objectName: string,\n    operation: string\n  ): RowLevelSecurityPolicy[] {\n    const allPolicies: RowLevelSecurityPolicy[] = [];\n\n    for (const ps of permissionSets) {\n      if (ps.rowLevelSecurity) {\n        allPolicies.push(...ps.rowLevelSecurity);\n      }\n    }\n\n    return this.rlsCompiler.getApplicablePolicies(objectName, operation, allPolicies);\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACOA,IAAM,0BAAkE;AAAA,EACtE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAQO,IAAM,sBAAN,MAA0B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/B,sBACE,WACA,YACA,gBACS;AACT,UAAM,UAAU,wBAAwB,SAAS;AACjD,QAAI,CAAC,QAAS,QAAO;AAErB,eAAW,MAAM,gBAAgB;AAC/B,YAAM,UAAU,GAAG,UAAU,UAAU;AACvC,UAAI,SAAS;AAEX,YAAI,CAAC,aAAa,aAAa,EAAE,SAAS,OAAO,KAAK,QAAQ,kBAAkB;AAC9E,iBAAO;AAAA,QACT;AAEA,YAAI,YAAY,gBAAgB,QAAQ,kBAAkB,QAAQ,mBAAmB;AACnF,iBAAO;AAAA,QACT;AAEA,YAAI,QAAQ,OAAO,GAAG;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBACE,YACA,gBACiC;AACjC,UAAM,SAA0C,CAAC;AAEjD,eAAW,MAAM,gBAAgB;AAC/B,UAAI,CAAC,GAAG,OAAQ;AAEhB,iBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,MAAM,GAAG;AAEnD,YAAI,CAAC,IAAI,WAAW,GAAG,UAAU,GAAG,EAAG;AACvC,cAAM,YAAY,IAAI,UAAU,WAAW,SAAS,CAAC;AAErD,YAAI,CAAC,OAAO,SAAS,GAAG;AACtB,iBAAO,SAAS,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM;AAAA,QACzD;AAGA,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAChD,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAAA,MAClD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,OACA,iBACiB;AACjB,UAAM,SAA0B,CAAC;AAGjC,UAAM,cAAc,gBAAgB,OAAO,aAAa,KAAK,CAAC;AAE9D,eAAW,MAAM,aAAa;AAG5B,UAAI,MAAM,SAAS,GAAG,IAAI,GAAG;AAC3B,eAAO,KAAK,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACzFO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,cACE,UACA,kBACgC;AAChC,QAAI,SAAS,WAAW,EAAG,QAAO;AAElC,UAAM,UAA0B;AAAA,MAC9B,IAAI,kBAAkB;AAAA,MACtB,WAAW,kBAAkB;AAAA,MAC7B,OAAO,kBAAkB;AAAA,IAC3B;AAEA,UAAM,UAAqC,CAAC;AAE5C,eAAW,UAAU,UAAU;AAC7B,UAAI,CAAC,OAAO,MAAO;AACnB,YAAM,SAAS,KAAK,kBAAkB,OAAO,OAAO,OAAO;AAC3D,UAAI,QAAQ;AACV,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAG1C,WAAO,EAAE,KAAK,QAAQ;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBACE,YACA,SACgC;AAChC,QAAI,CAAC,WAAY,QAAO;AAGxB,UAAM,UAAU,WAAW,MAAM,yCAAyC;AAC1E,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,WAAW,WAAW,MAAM,+BAA+B;AACjE,QAAI,UAAU;AACZ,YAAM,CAAC,EAAE,OAAO,KAAK,IAAI;AACzB,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,UAAU,WAAW,MAAM,qDAAqD;AACtF,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE;AAAA,IACnC;AAMA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,YACA,WACA,aAC0B;AAE1B,UAAM,QAAQ,KAAK,kBAAkB,SAAS;AAE9C,WAAO,YAAY,OAAO,YAAU;AAElC,UAAI,OAAO,WAAW,cAAc,OAAO,WAAW,IAAK,QAAO;AAGlE,UAAI,OAAO,cAAc,MAAO,QAAO;AACvC,UAAI,OAAO,cAAc,MAAO,QAAO;AAEvC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEQ,kBAAkB,WAA2B;AACnD,YAAQ,WAAW;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;ACrIO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,YACE,SACA,kBACA,aACa;AAEb,QAAI,OAAO,KAAK,gBAAgB,EAAE,WAAW,EAAG,QAAO;AAGvD,UAAM,eAAe,OAAO,QAAQ,gBAAgB,EACjD,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAEzB,QAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,QAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,aAAO,QAAQ,IAAI,YAAU,KAAK,WAAW,QAAQ,YAAY,CAAC;AAAA,IACpE;AAEA,WAAO,KAAK,WAAW,SAAS,YAAY;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBACE,kBACU;AACV,WAAO,OAAO,QAAQ,gBAAgB,EACnC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,uBACE,MACA,kBACqB;AACrB,UAAM,cAAc,KAAK,qBAAqB,gBAAgB;AAC9D,QAAI,YAAY,WAAW,EAAG,QAAO;AAErC,UAAM,SAAS,EAAE,GAAG,KAAK;AACzB,eAAW,SAAS,aAAa;AAC/B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,QAAa,cAA6B;AAC3D,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,UAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,eAAW,SAAS,cAAc;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;;;ACxEA,kBAAoC;AAU7B,IAAM,UAAU,yBAAa,OAAO;AAAA,EACzC,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,kBAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,kBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,kBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,kBAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,kBAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,kBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,aAAa,kBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,kBAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,IAED,YAAY,kBAAM,QAAQ;AAAA,MACxB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;AC1FD,IAAAA,eAAoC;AAW7B,IAAM,mBAAmB,0BAAa,OAAO;AAAA,EAClD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,mBAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,mBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,mBAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,mBAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,mBAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,mBAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,oBAAoB,mBAAM,SAAS;AAAA,MACjC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,mBAAmB,mBAAM,SAAS;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,mBAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;ACvEM,IAAM,iBAAN,MAAuC;AAAA,EAAvC;AACL,gBAAO;AACP,gBAAO;AACP,mBAAU;AACV,wBAAe,CAAC,iCAAiC;AAEjD,SAAQ,sBAAsB,IAAI,oBAAoB;AACtD,SAAQ,cAAc,IAAI,YAAY;AACtC,SAAQ,cAAc,IAAI,YAAY;AAAA;AAAA,EAEtC,MAAM,KAAK,KAAmC;AAC5C,QAAI,OAAO,KAAK,iCAAiC;AAGjD,QAAI,gBAAgB,wBAAwB,KAAK,mBAAmB;AACpE,QAAI,gBAAgB,gBAAgB,KAAK,WAAW;AACpD,QAAI,gBAAgB,wBAAwB,KAAK,WAAW;AAG5D,QAAI,WAAuC,UAAU,EAAE,SAAS;AAAA,MAC9D,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW;AAAA,MACX,SAAS,CAAC,SAAS,gBAAgB;AAAA,IACrC,CAAC;AAGD,QAAI;AACF,YAAM,WAAW,IAAI,WAAyC,UAAU;AACxE,UAAI,UAAU;AACZ,iBAAS,WAAW;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO;AAAA,YACL,EAAE,IAAI,aAAa,MAAM,UAAU,OAAO,SAAS,YAAY,QAAQ,MAAM,gBAAgB,OAAO,GAAG;AAAA,YACvG,EAAE,IAAI,uBAAuB,MAAM,UAAU,OAAO,mBAAmB,YAAY,kBAAkB,MAAM,QAAQ,OAAO,GAAG;AAAA,UAC/H;AAAA,QACF,CAAC;AACD,YAAI,OAAO,KAAK,oDAAoD;AAAA,MACtE;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,OAAO,KAAK,6BAA6B;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,OAAO,KAAK,6BAA6B;AAG7C,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,WAAK,IAAI,WAAW,UAAU;AAC9B,iBAAW,IAAI,WAAW,UAAU;AAAA,IACtC,SAAS,GAAG;AACV,UAAI,OAAO,KAAK,gFAAgF;AAChG;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,OAAO,GAAG,uBAAuB,YAAY;AACtD,UAAI,OAAO,KAAK,iFAAiF;AACjG;AAAA,IACF;AAGA,OAAG,mBAAmB,OAAO,OAAY,SAA8B;AAErE,UAAI,MAAM,SAAS,UAAU;AAC3B,eAAO,KAAK;AAAA,MACd;AAEA,YAAM,QAAQ,MAAM,SAAS,SAAS,CAAC;AAIvC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,SAAS,QAAQ;AAChD,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,iBAAkC,CAAC;AACvC,UAAI;AACF,yBAAiB,KAAK,oBAAoB,sBAAsB,OAAO,QAAQ;AAAA,MACjF,SAAS,GAAG;AAGV,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,eAAe,SAAS,GAAG;AAC7B,cAAM,UAAU,KAAK,oBAAoB;AAAA,UACvC,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAEA,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI;AAAA,YACR,wCAAwC,MAAM,SAAS,gBAAgB,MAAM,MAAM,iCACpD,MAAM,KAAK,IAAI,CAAC;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,iBAAiB,KAAK,mBAAmB,gBAAgB,MAAM,QAAQ,MAAM,SAAS;AAC5F,UAAI,eAAe,SAAS,KAAK,MAAM,KAAK;AAC1C,cAAM,YAAY,KAAK,YAAY,cAAc,gBAAgB,MAAM,OAAO;AAC9E,YAAI,WAAW;AACb,cAAI,MAAM,IAAI,OAAO;AACnB,kBAAM,IAAI,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,EAAE;AAAA,UACzD,OAAO;AACL,kBAAM,IAAI,QAAQ;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK;AAGX,UAAI,MAAM,UAAU,CAAC,QAAQ,SAAS,EAAE,SAAS,MAAM,SAAS,GAAG;AACjE,cAAM,aAAa,KAAK,oBAAoB,oBAAoB,MAAM,QAAQ,cAAc;AAC5F,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACtC,gBAAM,SAAS,KAAK,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,MAAM;AAAA,QACpF;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,KAAK,mDAAmD;AAAA,EACrE;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,gBACA,YACA,WAC0B;AAC1B,UAAM,cAAwC,CAAC;AAE/C,eAAW,MAAM,gBAAgB;AAC/B,UAAI,GAAG,kBAAkB;AACvB,oBAAY,KAAK,GAAG,GAAG,gBAAgB;AAAA,MACzC;AAAA,IACF;AAEA,WAAO,KAAK,YAAY,sBAAsB,YAAY,WAAW,WAAW;AAAA,EAClF;AACF;","names":["import_data"]}

package/dist/index.mjs

@@ -361,7 +361,7 @@ var SecurityPlugin = class {
     ctx.registerService("security.permissions", this.permissionEvaluator);
     ctx.registerService("security.rls", this.rlsCompiler);
     ctx.registerService("security.fieldMasker", this.fieldMasker);
-    ctx.registerService("app.com.objectstack.security", {
+    ctx.getService("manifest").register({
       id: "com.objectstack.security",
       name: "Security",
       version: "1.0.0",
@@ -369,6 +369,20 @@ var SecurityPlugin = class {
       namespace: "sys",
       objects: [SysRole, SysPermissionSet]
     });
+    try {
+      const setupNav = ctx.getService("setupNav");
+      if (setupNav) {
+        setupNav.contribute({
+          areaId: "area_administration",
+          items: [
+            { id: "nav_roles", type: "object", label: "Roles", objectName: "role", icon: "shield-check", order: 60 },
+            { id: "nav_permission_sets", type: "object", label: "Permission Sets", objectName: "permission_set", icon: "lock", order: 70 }
+          ]
+        });
+        ctx.logger.info("Security navigation items contributed to Setup App");
+      }
+    } catch {
+    }
     ctx.logger.info("Security Plugin initialized");
   }
   async start(ctx) {

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/permission-evaluator.ts","../src/rls-compiler.ts","../src/field-masker.ts","../src/objects/sys-role.object.ts","../src/objects/sys-permission-set.object.ts","../src/security-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { PermissionSet, ObjectPermission, FieldPermission } from '@objectstack/spec/security';\n\n/**\n * Operation type mapping to permission checks\n */\nconst OPERATION_TO_PERMISSION: Record<string, keyof ObjectPermission> = {\n  find: 'allowRead',\n  findOne: 'allowRead',\n  count: 'allowRead',\n  aggregate: 'allowRead',\n  insert: 'allowCreate',\n  update: 'allowEdit',\n  delete: 'allowDelete',\n};\n\n/**\n * PermissionEvaluator\n * \n * Runtime evaluator for PermissionSet definitions.\n * Resolves aggregated permissions from roles to concrete allow/deny decisions.\n */\nexport class PermissionEvaluator {\n  /**\n   * Check if an operation is allowed on an object for the given permission sets.\n   * Uses \"most permissive\" merging: if ANY permission set allows, it's allowed.\n   */\n  checkObjectPermission(\n    operation: string,\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): boolean {\n    const permKey = OPERATION_TO_PERMISSION[operation];\n    if (!permKey) return true; // Unknown operations are allowed by default\n\n    for (const ps of permissionSets) {\n      const objPerm = ps.objects?.[objectName];\n      if (objPerm) {\n        // Check if modifyAllRecords is set (super-user bypass for write ops)\n        if (['allowEdit', 'allowDelete'].includes(permKey) && objPerm.modifyAllRecords) {\n          return true;\n        }\n        // Check if viewAllRecords is set (super-user bypass for read ops)\n        if (permKey === 'allowRead' && (objPerm.viewAllRecords || objPerm.modifyAllRecords)) {\n          return true;\n        }\n        // Check the specific permission\n        if (objPerm[permKey]) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Get the merged field permissions for an object.\n   * Returns a map of field names to their effective permissions.\n   * Uses \"most permissive\" merging.\n   */\n  getFieldPermissions(\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): Record<string, FieldPermission> {\n    const result: Record<string, FieldPermission> = {};\n\n    for (const ps of permissionSets) {\n      if (!ps.fields) continue;\n\n      for (const [key, perm] of Object.entries(ps.fields)) {\n        // Field keys are in format: \"object_name.field_name\"\n        if (!key.startsWith(`${objectName}.`)) continue;\n        const fieldName = key.substring(objectName.length + 1);\n\n        if (!result[fieldName]) {\n          result[fieldName] = { readable: false, editable: false };\n        }\n\n        // Most permissive merge\n        if (perm.readable) result[fieldName].readable = true;\n        if (perm.editable) result[fieldName].editable = true;\n      }\n    }\n\n    return result;\n  }\n\n  /**\n   * Resolve permission sets for a list of role names from metadata.\n   */\n  resolvePermissionSets(\n    roles: string[],\n    metadataService: any\n  ): PermissionSet[] {\n    const result: PermissionSet[] = [];\n\n    // Get all permission sets from metadata\n    const allPermSets = metadataService.list?.('permissions') || [];\n\n    for (const ps of allPermSets) {\n      // A permission set is relevant if it's a profile assigned to any of the user's roles,\n      // or if the role name matches the permission set name\n      if (roles.includes(ps.name)) {\n        result.push(ps);\n      }\n    }\n\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\n/**\n * RLS User Context\n * Variables available for RLS expression evaluation.\n */\ninterface RLSUserContext {\n  id?: string;\n  tenant_id?: string;\n  roles?: string[];\n  [key: string]: unknown;\n}\n\n/**\n * RLSCompiler\n * \n * Compiles Row-Level Security policy expressions into query filters.\n * Converts `using` / `check` expressions into ObjectQL-compatible filter conditions.\n */\nexport class RLSCompiler {\n  /**\n   * Compile RLS policies into a query filter for the given user context.\n   * Multiple policies for the same object/operation are OR-combined (any match allows access).\n   */\n  compileFilter(\n    policies: RowLevelSecurityPolicy[],\n    executionContext?: ExecutionContext\n  ): Record<string, unknown> | null {\n    if (policies.length === 0) return null;\n\n    const userCtx: RLSUserContext = {\n      id: executionContext?.userId,\n      tenant_id: executionContext?.tenantId,\n      roles: executionContext?.roles,\n    };\n\n    const filters: Record<string, unknown>[] = [];\n\n    for (const policy of policies) {\n      if (!policy.using) continue;\n      const filter = this.compileExpression(policy.using, userCtx);\n      if (filter) {\n        filters.push(filter);\n      }\n    }\n\n    if (filters.length === 0) return null;\n    if (filters.length === 1) return filters[0];\n\n    // Multiple policies: OR-combine (any policy allows access)\n    return { $or: filters };\n  }\n\n  /**\n   * Compile a single RLS expression into a query filter.\n   * \n   * Supports simple expressions like:\n   * - \"field_name = current_user.property\"\n   * - \"field_name IN (current_user.array_property)\"\n   * - \"field_name = 'literal_value'\"\n   */\n  compileExpression(\n    expression: string,\n    userCtx: RLSUserContext\n  ): Record<string, unknown> | null {\n    if (!expression) return null;\n\n    // Handle simple equality: \"field = current_user.property\"\n    const eqMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*current_user\\.(\\w+)\\s*$/);\n    if (eqMatch) {\n      const [, field, prop] = eqMatch;\n      const value = userCtx[prop];\n      if (value === undefined) return null;\n      return { [field]: value };\n    }\n\n    // Handle literal equality: \"field = 'value'\"\n    const litMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*'([^']*)'\\s*$/);\n    if (litMatch) {\n      const [, field, value] = litMatch;\n      return { [field]: value };\n    }\n\n    // Handle IN: \"field IN (current_user.array_property)\"\n    const inMatch = expression.match(/^\\s*(\\w+)\\s+IN\\s+\\(\\s*current_user\\.(\\w+)\\s*\\)\\s*$/i);\n    if (inMatch) {\n      const [, field, prop] = inMatch;\n      const value = userCtx[prop];\n      if (!Array.isArray(value)) return null;\n      return { [field]: { $in: value } };\n    }\n\n    // Unsupported expression: return null (no additional RLS filter applied).\n    // Note: callers should treat absence of RLS policies as \"allow all\" only when\n    // no policies are defined. If policies exist but cannot be compiled, the caller\n    // may want to deny access as a safety measure.\n    return null;\n  }\n\n  /**\n   * Get applicable RLS policies for a given object and operation.\n   */\n  getApplicablePolicies(\n    objectName: string,\n    operation: string,\n    allPolicies: RowLevelSecurityPolicy[]\n  ): RowLevelSecurityPolicy[] {\n    // Map engine operation to RLS operation type\n    const rlsOp = this.mapOperationToRLS(operation);\n\n    return allPolicies.filter(policy => {\n      // Check object match\n      if (policy.object !== objectName && policy.object !== '*') return false;\n\n      // Check operation match\n      if (policy.operation === 'all') return true;\n      if (policy.operation === rlsOp) return true;\n\n      return false;\n    });\n  }\n\n  private mapOperationToRLS(operation: string): string {\n    switch (operation) {\n      case 'find':\n      case 'findOne':\n      case 'count':\n      case 'aggregate':\n        return 'select';\n      case 'insert':\n        return 'insert';\n      case 'update':\n        return 'update';\n      case 'delete':\n        return 'delete';\n      default:\n        return 'select';\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { FieldPermission } from '@objectstack/spec/security';\n\n/**\n * FieldMasker\n * \n * Applies field-level security by stripping restricted fields from query results.\n */\nexport class FieldMasker {\n  /**\n   * Mask fields in query results based on field permissions.\n   * Removes fields that the user does not have read access to.\n   */\n  maskResults(\n    results: any | any[],\n    fieldPermissions: Record<string, FieldPermission>,\n    _objectName: string\n  ): any | any[] {\n    // If no field permissions defined, return results as-is\n    if (Object.keys(fieldPermissions).length === 0) return results;\n\n    // Get list of non-readable fields\n    const hiddenFields = Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.readable)\n      .map(([field]) => field);\n\n    if (hiddenFields.length === 0) return results;\n\n    if (Array.isArray(results)) {\n      return results.map(record => this.maskRecord(record, hiddenFields));\n    }\n\n    return this.maskRecord(results, hiddenFields);\n  }\n\n  /**\n   * Get non-editable fields for use in write operations.\n   * Returns a list of field names that should be stripped from incoming data.\n   */\n  getNonEditableFields(\n    fieldPermissions: Record<string, FieldPermission>\n  ): string[] {\n    return Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.editable)\n      .map(([field]) => field);\n  }\n\n  /**\n   * Strip non-editable fields from write data.\n   */\n  stripNonEditableFields(\n    data: Record<string, any>,\n    fieldPermissions: Record<string, FieldPermission>\n  ): Record<string, any> {\n    const nonEditable = this.getNonEditableFields(fieldPermissions);\n    if (nonEditable.length === 0) return data;\n\n    const result = { ...data };\n    for (const field of nonEditable) {\n      delete result[field];\n    }\n    return result;\n  }\n\n  private maskRecord(record: any, hiddenFields: string[]): any {\n    if (!record || typeof record !== 'object') return record;\n\n    const result = { ...record };\n    for (const field of hiddenFields) {\n      delete result[field];\n    }\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n    \n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n    }),\n    \n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { PermissionSet, RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport { PermissionEvaluator } from './permission-evaluator.js';\nimport { RLSCompiler } from './rls-compiler.js';\nimport { FieldMasker } from './field-masker.js';\nimport { SysRole, SysPermissionSet } from './objects/index.js';\n\n/**\n * SecurityPlugin\n * \n * Provides RBAC, Row-Level Security, and Field-Level Security runtime.\n * Registers as an engine middleware on the ObjectQL engine.\n * \n * This plugin is fully optional — without it, the system operates\n * without permission checks (same as current behavior).\n * \n * Dependencies:\n * - objectql service (ObjectQL engine with middleware support)\n * - metadata service (MetadataFacade for reading permission sets and RLS policies)\n */\nexport class SecurityPlugin implements Plugin {\n  name = 'com.objectstack.security';\n  type = 'standard';\n  version = '1.0.0';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private permissionEvaluator = new PermissionEvaluator();\n  private rlsCompiler = new RLSCompiler();\n  private fieldMasker = new FieldMasker();\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Initializing Security Plugin...');\n\n    // Register security services\n    ctx.registerService('security.permissions', this.permissionEvaluator);\n    ctx.registerService('security.rls', this.rlsCompiler);\n    ctx.registerService('security.fieldMasker', this.fieldMasker);\n\n    // Register security system objects so ObjectQLPlugin auto-discovers them\n    ctx.registerService('app.com.objectstack.security', {\n      id: 'com.objectstack.security',\n      name: 'Security',\n      version: '1.0.0',\n      type: 'plugin',\n      namespace: 'sys',\n      objects: [SysRole, SysPermissionSet],\n    });\n\n    ctx.logger.info('Security Plugin initialized');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Starting Security Plugin...');\n\n    // Get required services\n    let ql: any;\n    let metadata: any;\n\n    try {\n      ql = ctx.getService('objectql');\n      metadata = ctx.getService('metadata');\n    } catch (e) {\n      ctx.logger.warn('ObjectQL or metadata service not available, security middleware not registered');\n      return;\n    }\n\n    if (!ql || typeof ql.registerMiddleware !== 'function') {\n      ctx.logger.warn('ObjectQL engine does not support middleware, security middleware not registered');\n      return;\n    }\n\n    // Register security middleware\n    ql.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {\n      // System operations bypass security\n      if (opCtx.context?.isSystem) {\n        return next();\n      }\n\n      const roles = opCtx.context?.roles ?? [];\n\n      // Skip security checks if no roles (anonymous/unauthenticated)\n      // The auth middleware should handle authentication separately\n      if (roles.length === 0 && !opCtx.context?.userId) {\n        return next();\n      }\n\n      // 1. Resolve permission sets for the user's roles\n      let permissionSets: PermissionSet[] = [];\n      try {\n        permissionSets = this.permissionEvaluator.resolvePermissionSets(roles, metadata);\n      } catch (e) {\n        // If metadata service is misconfigured, log and continue without permission checks\n        // rather than blocking all operations\n        return next();\n      }\n\n      // 2. CRUD permission check\n      if (permissionSets.length > 0) {\n        const allowed = this.permissionEvaluator.checkObjectPermission(\n          opCtx.operation,\n          opCtx.object,\n          permissionSets\n        );\n\n        if (!allowed) {\n          throw new Error(\n            `[Security] Access denied: operation '${opCtx.operation}' on object '${opCtx.object}' ` +\n            `is not permitted for roles [${roles.join(', ')}]`\n          );\n        }\n      }\n\n      // 3. RLS filter injection\n      const allRlsPolicies = this.collectRLSPolicies(permissionSets, opCtx.object, opCtx.operation);\n      if (allRlsPolicies.length > 0 && opCtx.ast) {\n        const rlsFilter = this.rlsCompiler.compileFilter(allRlsPolicies, opCtx.context);\n        if (rlsFilter) {\n          if (opCtx.ast.where) {\n            opCtx.ast.where = { $and: [opCtx.ast.where, rlsFilter] };\n          } else {\n            opCtx.ast.where = rlsFilter;\n          }\n        }\n      }\n\n      await next();\n\n      // 4. Field-level security: mask restricted fields in read results\n      if (opCtx.result && ['find', 'findOne'].includes(opCtx.operation)) {\n        const fieldPerms = this.permissionEvaluator.getFieldPermissions(opCtx.object, permissionSets);\n        if (Object.keys(fieldPerms).length > 0) {\n          opCtx.result = this.fieldMasker.maskResults(opCtx.result, fieldPerms, opCtx.object);\n        }\n      }\n    });\n\n    ctx.logger.info('Security middleware registered on ObjectQL engine');\n  }\n\n  async destroy(): Promise<void> {\n    // No cleanup needed\n  }\n\n  /**\n   * Collect all RLS policies from permission sets applicable to the given object/operation.\n   */\n  private collectRLSPolicies(\n    permissionSets: PermissionSet[],\n    objectName: string,\n    operation: string\n  ): RowLevelSecurityPolicy[] {\n    const allPolicies: RowLevelSecurityPolicy[] = [];\n\n    for (const ps of permissionSets) {\n      if (ps.rowLevelSecurity) {\n        allPolicies.push(...ps.rowLevelSecurity);\n      }\n    }\n\n    return this.rlsCompiler.getApplicablePolicies(objectName, operation, allPolicies);\n  }\n}\n"],"mappings":";AAOA,IAAM,0BAAkE;AAAA,EACtE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAQO,IAAM,sBAAN,MAA0B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/B,sBACE,WACA,YACA,gBACS;AACT,UAAM,UAAU,wBAAwB,SAAS;AACjD,QAAI,CAAC,QAAS,QAAO;AAErB,eAAW,MAAM,gBAAgB;AAC/B,YAAM,UAAU,GAAG,UAAU,UAAU;AACvC,UAAI,SAAS;AAEX,YAAI,CAAC,aAAa,aAAa,EAAE,SAAS,OAAO,KAAK,QAAQ,kBAAkB;AAC9E,iBAAO;AAAA,QACT;AAEA,YAAI,YAAY,gBAAgB,QAAQ,kBAAkB,QAAQ,mBAAmB;AACnF,iBAAO;AAAA,QACT;AAEA,YAAI,QAAQ,OAAO,GAAG;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBACE,YACA,gBACiC;AACjC,UAAM,SAA0C,CAAC;AAEjD,eAAW,MAAM,gBAAgB;AAC/B,UAAI,CAAC,GAAG,OAAQ;AAEhB,iBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,MAAM,GAAG;AAEnD,YAAI,CAAC,IAAI,WAAW,GAAG,UAAU,GAAG,EAAG;AACvC,cAAM,YAAY,IAAI,UAAU,WAAW,SAAS,CAAC;AAErD,YAAI,CAAC,OAAO,SAAS,GAAG;AACtB,iBAAO,SAAS,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM;AAAA,QACzD;AAGA,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAChD,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAAA,MAClD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,OACA,iBACiB;AACjB,UAAM,SAA0B,CAAC;AAGjC,UAAM,cAAc,gBAAgB,OAAO,aAAa,KAAK,CAAC;AAE9D,eAAW,MAAM,aAAa;AAG5B,UAAI,MAAM,SAAS,GAAG,IAAI,GAAG;AAC3B,eAAO,KAAK,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACzFO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,cACE,UACA,kBACgC;AAChC,QAAI,SAAS,WAAW,EAAG,QAAO;AAElC,UAAM,UAA0B;AAAA,MAC9B,IAAI,kBAAkB;AAAA,MACtB,WAAW,kBAAkB;AAAA,MAC7B,OAAO,kBAAkB;AAAA,IAC3B;AAEA,UAAM,UAAqC,CAAC;AAE5C,eAAW,UAAU,UAAU;AAC7B,UAAI,CAAC,OAAO,MAAO;AACnB,YAAM,SAAS,KAAK,kBAAkB,OAAO,OAAO,OAAO;AAC3D,UAAI,QAAQ;AACV,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAG1C,WAAO,EAAE,KAAK,QAAQ;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBACE,YACA,SACgC;AAChC,QAAI,CAAC,WAAY,QAAO;AAGxB,UAAM,UAAU,WAAW,MAAM,yCAAyC;AAC1E,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,WAAW,WAAW,MAAM,+BAA+B;AACjE,QAAI,UAAU;AACZ,YAAM,CAAC,EAAE,OAAO,KAAK,IAAI;AACzB,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,UAAU,WAAW,MAAM,qDAAqD;AACtF,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE;AAAA,IACnC;AAMA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,YACA,WACA,aAC0B;AAE1B,UAAM,QAAQ,KAAK,kBAAkB,SAAS;AAE9C,WAAO,YAAY,OAAO,YAAU;AAElC,UAAI,OAAO,WAAW,cAAc,OAAO,WAAW,IAAK,QAAO;AAGlE,UAAI,OAAO,cAAc,MAAO,QAAO;AACvC,UAAI,OAAO,cAAc,MAAO,QAAO;AAEvC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEQ,kBAAkB,WAA2B;AACnD,YAAQ,WAAW;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;ACrIO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,YACE,SACA,kBACA,aACa;AAEb,QAAI,OAAO,KAAK,gBAAgB,EAAE,WAAW,EAAG,QAAO;AAGvD,UAAM,eAAe,OAAO,QAAQ,gBAAgB,EACjD,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAEzB,QAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,QAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,aAAO,QAAQ,IAAI,YAAU,KAAK,WAAW,QAAQ,YAAY,CAAC;AAAA,IACpE;AAEA,WAAO,KAAK,WAAW,SAAS,YAAY;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBACE,kBACU;AACV,WAAO,OAAO,QAAQ,gBAAgB,EACnC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,uBACE,MACA,kBACqB;AACrB,UAAM,cAAc,KAAK,qBAAqB,gBAAgB;AAC9D,QAAI,YAAY,WAAW,EAAG,QAAO;AAErC,UAAM,SAAS,EAAE,GAAG,KAAK;AACzB,eAAW,SAAS,aAAa;AAC/B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,QAAa,cAA6B;AAC3D,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,UAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,eAAW,SAAS,cAAc;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;;;ACxEA,SAAS,cAAc,aAAa;AAU7B,IAAM,UAAU,aAAa,OAAO;AAAA,EACzC,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,MAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,MAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,MAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,MAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,MAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,MAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,aAAa,MAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,MAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,IAED,YAAY,MAAM,QAAQ;AAAA,MACxB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;AC1FD,SAAS,gBAAAA,eAAc,SAAAC,cAAa;AAW7B,IAAM,mBAAmBD,cAAa,OAAO;AAAA,EAClD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAIC,OAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAYA,OAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAYA,OAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAMA,OAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAOA,OAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAaA,OAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,oBAAoBA,OAAM,SAAS;AAAA,MACjC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,mBAAmBA,OAAM,SAAS;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQA,OAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;ACvEM,IAAM,iBAAN,MAAuC;AAAA,EAAvC;AACL,gBAAO;AACP,gBAAO;AACP,mBAAU;AACV,wBAAe,CAAC,iCAAiC;AAEjD,SAAQ,sBAAsB,IAAI,oBAAoB;AACtD,SAAQ,cAAc,IAAI,YAAY;AACtC,SAAQ,cAAc,IAAI,YAAY;AAAA;AAAA,EAEtC,MAAM,KAAK,KAAmC;AAC5C,QAAI,OAAO,KAAK,iCAAiC;AAGjD,QAAI,gBAAgB,wBAAwB,KAAK,mBAAmB;AACpE,QAAI,gBAAgB,gBAAgB,KAAK,WAAW;AACpD,QAAI,gBAAgB,wBAAwB,KAAK,WAAW;AAG5D,QAAI,gBAAgB,gCAAgC;AAAA,MAClD,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW;AAAA,MACX,SAAS,CAAC,SAAS,gBAAgB;AAAA,IACrC,CAAC;AAED,QAAI,OAAO,KAAK,6BAA6B;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,OAAO,KAAK,6BAA6B;AAG7C,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,WAAK,IAAI,WAAW,UAAU;AAC9B,iBAAW,IAAI,WAAW,UAAU;AAAA,IACtC,SAAS,GAAG;AACV,UAAI,OAAO,KAAK,gFAAgF;AAChG;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,OAAO,GAAG,uBAAuB,YAAY;AACtD,UAAI,OAAO,KAAK,iFAAiF;AACjG;AAAA,IACF;AAGA,OAAG,mBAAmB,OAAO,OAAY,SAA8B;AAErE,UAAI,MAAM,SAAS,UAAU;AAC3B,eAAO,KAAK;AAAA,MACd;AAEA,YAAM,QAAQ,MAAM,SAAS,SAAS,CAAC;AAIvC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,SAAS,QAAQ;AAChD,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,iBAAkC,CAAC;AACvC,UAAI;AACF,yBAAiB,KAAK,oBAAoB,sBAAsB,OAAO,QAAQ;AAAA,MACjF,SAAS,GAAG;AAGV,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,eAAe,SAAS,GAAG;AAC7B,cAAM,UAAU,KAAK,oBAAoB;AAAA,UACvC,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAEA,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI;AAAA,YACR,wCAAwC,MAAM,SAAS,gBAAgB,MAAM,MAAM,iCACpD,MAAM,KAAK,IAAI,CAAC;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,iBAAiB,KAAK,mBAAmB,gBAAgB,MAAM,QAAQ,MAAM,SAAS;AAC5F,UAAI,eAAe,SAAS,KAAK,MAAM,KAAK;AAC1C,cAAM,YAAY,KAAK,YAAY,cAAc,gBAAgB,MAAM,OAAO;AAC9E,YAAI,WAAW;AACb,cAAI,MAAM,IAAI,OAAO;AACnB,kBAAM,IAAI,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,EAAE;AAAA,UACzD,OAAO;AACL,kBAAM,IAAI,QAAQ;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK;AAGX,UAAI,MAAM,UAAU,CAAC,QAAQ,SAAS,EAAE,SAAS,MAAM,SAAS,GAAG;AACjE,cAAM,aAAa,KAAK,oBAAoB,oBAAoB,MAAM,QAAQ,cAAc;AAC5F,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACtC,gBAAM,SAAS,KAAK,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,MAAM;AAAA,QACpF;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,KAAK,mDAAmD;AAAA,EACrE;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,gBACA,YACA,WAC0B;AAC1B,UAAM,cAAwC,CAAC;AAE/C,eAAW,MAAM,gBAAgB;AAC/B,UAAI,GAAG,kBAAkB;AACvB,oBAAY,KAAK,GAAG,GAAG,gBAAgB;AAAA,MACzC;AAAA,IACF;AAEA,WAAO,KAAK,YAAY,sBAAsB,YAAY,WAAW,WAAW;AAAA,EAClF;AACF;","names":["ObjectSchema","Field"]}
+{"version":3,"sources":["../src/permission-evaluator.ts","../src/rls-compiler.ts","../src/field-masker.ts","../src/objects/sys-role.object.ts","../src/objects/sys-permission-set.object.ts","../src/security-plugin.ts"],"sourcesContent":["// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { PermissionSet, ObjectPermission, FieldPermission } from '@objectstack/spec/security';\n\n/**\n * Operation type mapping to permission checks\n */\nconst OPERATION_TO_PERMISSION: Record<string, keyof ObjectPermission> = {\n  find: 'allowRead',\n  findOne: 'allowRead',\n  count: 'allowRead',\n  aggregate: 'allowRead',\n  insert: 'allowCreate',\n  update: 'allowEdit',\n  delete: 'allowDelete',\n};\n\n/**\n * PermissionEvaluator\n * \n * Runtime evaluator for PermissionSet definitions.\n * Resolves aggregated permissions from roles to concrete allow/deny decisions.\n */\nexport class PermissionEvaluator {\n  /**\n   * Check if an operation is allowed on an object for the given permission sets.\n   * Uses \"most permissive\" merging: if ANY permission set allows, it's allowed.\n   */\n  checkObjectPermission(\n    operation: string,\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): boolean {\n    const permKey = OPERATION_TO_PERMISSION[operation];\n    if (!permKey) return true; // Unknown operations are allowed by default\n\n    for (const ps of permissionSets) {\n      const objPerm = ps.objects?.[objectName];\n      if (objPerm) {\n        // Check if modifyAllRecords is set (super-user bypass for write ops)\n        if (['allowEdit', 'allowDelete'].includes(permKey) && objPerm.modifyAllRecords) {\n          return true;\n        }\n        // Check if viewAllRecords is set (super-user bypass for read ops)\n        if (permKey === 'allowRead' && (objPerm.viewAllRecords || objPerm.modifyAllRecords)) {\n          return true;\n        }\n        // Check the specific permission\n        if (objPerm[permKey]) {\n          return true;\n        }\n      }\n    }\n\n    return false;\n  }\n\n  /**\n   * Get the merged field permissions for an object.\n   * Returns a map of field names to their effective permissions.\n   * Uses \"most permissive\" merging.\n   */\n  getFieldPermissions(\n    objectName: string,\n    permissionSets: PermissionSet[]\n  ): Record<string, FieldPermission> {\n    const result: Record<string, FieldPermission> = {};\n\n    for (const ps of permissionSets) {\n      if (!ps.fields) continue;\n\n      for (const [key, perm] of Object.entries(ps.fields)) {\n        // Field keys are in format: \"object_name.field_name\"\n        if (!key.startsWith(`${objectName}.`)) continue;\n        const fieldName = key.substring(objectName.length + 1);\n\n        if (!result[fieldName]) {\n          result[fieldName] = { readable: false, editable: false };\n        }\n\n        // Most permissive merge\n        if (perm.readable) result[fieldName].readable = true;\n        if (perm.editable) result[fieldName].editable = true;\n      }\n    }\n\n    return result;\n  }\n\n  /**\n   * Resolve permission sets for a list of role names from metadata.\n   */\n  resolvePermissionSets(\n    roles: string[],\n    metadataService: any\n  ): PermissionSet[] {\n    const result: PermissionSet[] = [];\n\n    // Get all permission sets from metadata\n    const allPermSets = metadataService.list?.('permissions') || [];\n\n    for (const ps of allPermSets) {\n      // A permission set is relevant if it's a profile assigned to any of the user's roles,\n      // or if the role name matches the permission set name\n      if (roles.includes(ps.name)) {\n        result.push(ps);\n      }\n    }\n\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport type { ExecutionContext } from '@objectstack/spec/kernel';\n\n/**\n * RLS User Context\n * Variables available for RLS expression evaluation.\n */\ninterface RLSUserContext {\n  id?: string;\n  tenant_id?: string;\n  roles?: string[];\n  [key: string]: unknown;\n}\n\n/**\n * RLSCompiler\n * \n * Compiles Row-Level Security policy expressions into query filters.\n * Converts `using` / `check` expressions into ObjectQL-compatible filter conditions.\n */\nexport class RLSCompiler {\n  /**\n   * Compile RLS policies into a query filter for the given user context.\n   * Multiple policies for the same object/operation are OR-combined (any match allows access).\n   */\n  compileFilter(\n    policies: RowLevelSecurityPolicy[],\n    executionContext?: ExecutionContext\n  ): Record<string, unknown> | null {\n    if (policies.length === 0) return null;\n\n    const userCtx: RLSUserContext = {\n      id: executionContext?.userId,\n      tenant_id: executionContext?.tenantId,\n      roles: executionContext?.roles,\n    };\n\n    const filters: Record<string, unknown>[] = [];\n\n    for (const policy of policies) {\n      if (!policy.using) continue;\n      const filter = this.compileExpression(policy.using, userCtx);\n      if (filter) {\n        filters.push(filter);\n      }\n    }\n\n    if (filters.length === 0) return null;\n    if (filters.length === 1) return filters[0];\n\n    // Multiple policies: OR-combine (any policy allows access)\n    return { $or: filters };\n  }\n\n  /**\n   * Compile a single RLS expression into a query filter.\n   * \n   * Supports simple expressions like:\n   * - \"field_name = current_user.property\"\n   * - \"field_name IN (current_user.array_property)\"\n   * - \"field_name = 'literal_value'\"\n   */\n  compileExpression(\n    expression: string,\n    userCtx: RLSUserContext\n  ): Record<string, unknown> | null {\n    if (!expression) return null;\n\n    // Handle simple equality: \"field = current_user.property\"\n    const eqMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*current_user\\.(\\w+)\\s*$/);\n    if (eqMatch) {\n      const [, field, prop] = eqMatch;\n      const value = userCtx[prop];\n      if (value === undefined) return null;\n      return { [field]: value };\n    }\n\n    // Handle literal equality: \"field = 'value'\"\n    const litMatch = expression.match(/^\\s*(\\w+)\\s*=\\s*'([^']*)'\\s*$/);\n    if (litMatch) {\n      const [, field, value] = litMatch;\n      return { [field]: value };\n    }\n\n    // Handle IN: \"field IN (current_user.array_property)\"\n    const inMatch = expression.match(/^\\s*(\\w+)\\s+IN\\s+\\(\\s*current_user\\.(\\w+)\\s*\\)\\s*$/i);\n    if (inMatch) {\n      const [, field, prop] = inMatch;\n      const value = userCtx[prop];\n      if (!Array.isArray(value)) return null;\n      return { [field]: { $in: value } };\n    }\n\n    // Unsupported expression: return null (no additional RLS filter applied).\n    // Note: callers should treat absence of RLS policies as \"allow all\" only when\n    // no policies are defined. If policies exist but cannot be compiled, the caller\n    // may want to deny access as a safety measure.\n    return null;\n  }\n\n  /**\n   * Get applicable RLS policies for a given object and operation.\n   */\n  getApplicablePolicies(\n    objectName: string,\n    operation: string,\n    allPolicies: RowLevelSecurityPolicy[]\n  ): RowLevelSecurityPolicy[] {\n    // Map engine operation to RLS operation type\n    const rlsOp = this.mapOperationToRLS(operation);\n\n    return allPolicies.filter(policy => {\n      // Check object match\n      if (policy.object !== objectName && policy.object !== '*') return false;\n\n      // Check operation match\n      if (policy.operation === 'all') return true;\n      if (policy.operation === rlsOp) return true;\n\n      return false;\n    });\n  }\n\n  private mapOperationToRLS(operation: string): string {\n    switch (operation) {\n      case 'find':\n      case 'findOne':\n      case 'count':\n      case 'aggregate':\n        return 'select';\n      case 'insert':\n        return 'insert';\n      case 'update':\n        return 'update';\n      case 'delete':\n        return 'delete';\n      default:\n        return 'select';\n    }\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport type { FieldPermission } from '@objectstack/spec/security';\n\n/**\n * FieldMasker\n * \n * Applies field-level security by stripping restricted fields from query results.\n */\nexport class FieldMasker {\n  /**\n   * Mask fields in query results based on field permissions.\n   * Removes fields that the user does not have read access to.\n   */\n  maskResults(\n    results: any | any[],\n    fieldPermissions: Record<string, FieldPermission>,\n    _objectName: string\n  ): any | any[] {\n    // If no field permissions defined, return results as-is\n    if (Object.keys(fieldPermissions).length === 0) return results;\n\n    // Get list of non-readable fields\n    const hiddenFields = Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.readable)\n      .map(([field]) => field);\n\n    if (hiddenFields.length === 0) return results;\n\n    if (Array.isArray(results)) {\n      return results.map(record => this.maskRecord(record, hiddenFields));\n    }\n\n    return this.maskRecord(results, hiddenFields);\n  }\n\n  /**\n   * Get non-editable fields for use in write operations.\n   * Returns a list of field names that should be stripped from incoming data.\n   */\n  getNonEditableFields(\n    fieldPermissions: Record<string, FieldPermission>\n  ): string[] {\n    return Object.entries(fieldPermissions)\n      .filter(([, perm]) => !perm.editable)\n      .map(([field]) => field);\n  }\n\n  /**\n   * Strip non-editable fields from write data.\n   */\n  stripNonEditableFields(\n    data: Record<string, any>,\n    fieldPermissions: Record<string, FieldPermission>\n  ): Record<string, any> {\n    const nonEditable = this.getNonEditableFields(fieldPermissions);\n    if (nonEditable.length === 0) return data;\n\n    const result = { ...data };\n    for (const field of nonEditable) {\n      delete result[field];\n    }\n    return result;\n  }\n\n  private maskRecord(record: any, hiddenFields: string[]): any {\n    if (!record || typeof record !== 'object') return record;\n\n    const result = { ...record };\n    for (const field of hiddenFields) {\n      delete result[field];\n    }\n    return result;\n  }\n}\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_role — System Role Object\n *\n * RBAC role definition for the ObjectStack platform.\n * Roles group permissions and are assigned to users or members.\n *\n * @namespace sys\n */\nexport const SysRole = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'role',\n  label: 'Role',\n  pluralLabel: 'Roles',\n  icon: 'shield',\n  isSystem: true,\n  description: 'Role definitions for RBAC access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Role ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the role (e.g. admin, editor, viewer)',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    permissions: Field.textarea({\n      label: 'Permissions',\n      required: false,\n      description: 'JSON-serialized array of permission strings',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n    \n    is_default: Field.boolean({\n      label: 'Default Role',\n      defaultValue: false,\n      description: 'Automatically assigned to new users',\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { ObjectSchema, Field } from '@objectstack/spec/data';\n\n/**\n * sys_permission_set — System Permission Set Object\n *\n * Named groupings of fine-grained permissions.\n * Permission sets can be assigned to roles or directly to users\n * for granular access control.\n *\n * @namespace sys\n */\nexport const SysPermissionSet = ObjectSchema.create({\n  namespace: 'sys',\n  name: 'permission_set',\n  label: 'Permission Set',\n  pluralLabel: 'Permission Sets',\n  icon: 'lock',\n  isSystem: true,\n  description: 'Named permission groupings for fine-grained access control',\n  titleFormat: '{name}',\n  compactLayout: ['name', 'label', 'active'],\n  \n  fields: {\n    id: Field.text({\n      label: 'Permission Set ID',\n      required: true,\n      readonly: true,\n    }),\n    \n    created_at: Field.datetime({\n      label: 'Created At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    updated_at: Field.datetime({\n      label: 'Updated At',\n      defaultValue: 'NOW()',\n      readonly: true,\n    }),\n    \n    name: Field.text({\n      label: 'API Name',\n      required: true,\n      searchable: true,\n      maxLength: 100,\n      description: 'Unique machine name for the permission set',\n    }),\n    \n    label: Field.text({\n      label: 'Display Name',\n      required: true,\n      maxLength: 255,\n    }),\n    \n    description: Field.textarea({\n      label: 'Description',\n      required: false,\n    }),\n    \n    object_permissions: Field.textarea({\n      label: 'Object Permissions',\n      required: false,\n      description: 'JSON-serialized object-level CRUD permissions',\n    }),\n    \n    field_permissions: Field.textarea({\n      label: 'Field Permissions',\n      required: false,\n      description: 'JSON-serialized field-level read/write permissions',\n    }),\n    \n    active: Field.boolean({\n      label: 'Active',\n      defaultValue: true,\n    }),\n  },\n  \n  indexes: [\n    { fields: ['name'], unique: true },\n    { fields: ['active'] },\n  ],\n  \n  enable: {\n    trackHistory: true,\n    searchable: true,\n    apiEnabled: true,\n    apiMethods: ['get', 'list', 'create', 'update', 'delete'],\n    trash: true,\n    mru: true,\n  },\n});\n","// Copyright (c) 2025 ObjectStack. Licensed under the Apache-2.0 license.\n\nimport { Plugin, PluginContext } from '@objectstack/core';\nimport type { PermissionSet, RowLevelSecurityPolicy } from '@objectstack/spec/security';\nimport { PermissionEvaluator } from './permission-evaluator.js';\nimport { RLSCompiler } from './rls-compiler.js';\nimport { FieldMasker } from './field-masker.js';\nimport { SysRole, SysPermissionSet } from './objects/index.js';\n\n/**\n * SecurityPlugin\n * \n * Provides RBAC, Row-Level Security, and Field-Level Security runtime.\n * Registers as an engine middleware on the ObjectQL engine.\n * \n * This plugin is fully optional — without it, the system operates\n * without permission checks (same as current behavior).\n * \n * Dependencies:\n * - objectql service (ObjectQL engine with middleware support)\n * - metadata service (MetadataFacade for reading permission sets and RLS policies)\n */\nexport class SecurityPlugin implements Plugin {\n  name = 'com.objectstack.security';\n  type = 'standard';\n  version = '1.0.0';\n  dependencies = ['com.objectstack.engine.objectql'];\n\n  private permissionEvaluator = new PermissionEvaluator();\n  private rlsCompiler = new RLSCompiler();\n  private fieldMasker = new FieldMasker();\n\n  async init(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Initializing Security Plugin...');\n\n    // Register security services\n    ctx.registerService('security.permissions', this.permissionEvaluator);\n    ctx.registerService('security.rls', this.rlsCompiler);\n    ctx.registerService('security.fieldMasker', this.fieldMasker);\n\n    // Register security system objects via the manifest service.\n    ctx.getService<{ register(m: any): void }>('manifest').register({\n      id: 'com.objectstack.security',\n      name: 'Security',\n      version: '1.0.0',\n      type: 'plugin',\n      namespace: 'sys',\n      objects: [SysRole, SysPermissionSet],\n    });\n\n    // Contribute navigation items to the Setup App (if SetupPlugin is loaded).\n    try {\n      const setupNav = ctx.getService<{ contribute(c: any): void }>('setupNav');\n      if (setupNav) {\n        setupNav.contribute({\n          areaId: 'area_administration',\n          items: [\n            { id: 'nav_roles', type: 'object', label: 'Roles', objectName: 'role', icon: 'shield-check', order: 60 },\n            { id: 'nav_permission_sets', type: 'object', label: 'Permission Sets', objectName: 'permission_set', icon: 'lock', order: 70 },\n          ],\n        });\n        ctx.logger.info('Security navigation items contributed to Setup App');\n      }\n    } catch {\n      // SetupPlugin not loaded — skip silently\n    }\n\n    ctx.logger.info('Security Plugin initialized');\n  }\n\n  async start(ctx: PluginContext): Promise<void> {\n    ctx.logger.info('Starting Security Plugin...');\n\n    // Get required services\n    let ql: any;\n    let metadata: any;\n\n    try {\n      ql = ctx.getService('objectql');\n      metadata = ctx.getService('metadata');\n    } catch (e) {\n      ctx.logger.warn('ObjectQL or metadata service not available, security middleware not registered');\n      return;\n    }\n\n    if (!ql || typeof ql.registerMiddleware !== 'function') {\n      ctx.logger.warn('ObjectQL engine does not support middleware, security middleware not registered');\n      return;\n    }\n\n    // Register security middleware\n    ql.registerMiddleware(async (opCtx: any, next: () => Promise<void>) => {\n      // System operations bypass security\n      if (opCtx.context?.isSystem) {\n        return next();\n      }\n\n      const roles = opCtx.context?.roles ?? [];\n\n      // Skip security checks if no roles (anonymous/unauthenticated)\n      // The auth middleware should handle authentication separately\n      if (roles.length === 0 && !opCtx.context?.userId) {\n        return next();\n      }\n\n      // 1. Resolve permission sets for the user's roles\n      let permissionSets: PermissionSet[] = [];\n      try {\n        permissionSets = this.permissionEvaluator.resolvePermissionSets(roles, metadata);\n      } catch (e) {\n        // If metadata service is misconfigured, log and continue without permission checks\n        // rather than blocking all operations\n        return next();\n      }\n\n      // 2. CRUD permission check\n      if (permissionSets.length > 0) {\n        const allowed = this.permissionEvaluator.checkObjectPermission(\n          opCtx.operation,\n          opCtx.object,\n          permissionSets\n        );\n\n        if (!allowed) {\n          throw new Error(\n            `[Security] Access denied: operation '${opCtx.operation}' on object '${opCtx.object}' ` +\n            `is not permitted for roles [${roles.join(', ')}]`\n          );\n        }\n      }\n\n      // 3. RLS filter injection\n      const allRlsPolicies = this.collectRLSPolicies(permissionSets, opCtx.object, opCtx.operation);\n      if (allRlsPolicies.length > 0 && opCtx.ast) {\n        const rlsFilter = this.rlsCompiler.compileFilter(allRlsPolicies, opCtx.context);\n        if (rlsFilter) {\n          if (opCtx.ast.where) {\n            opCtx.ast.where = { $and: [opCtx.ast.where, rlsFilter] };\n          } else {\n            opCtx.ast.where = rlsFilter;\n          }\n        }\n      }\n\n      await next();\n\n      // 4. Field-level security: mask restricted fields in read results\n      if (opCtx.result && ['find', 'findOne'].includes(opCtx.operation)) {\n        const fieldPerms = this.permissionEvaluator.getFieldPermissions(opCtx.object, permissionSets);\n        if (Object.keys(fieldPerms).length > 0) {\n          opCtx.result = this.fieldMasker.maskResults(opCtx.result, fieldPerms, opCtx.object);\n        }\n      }\n    });\n\n    ctx.logger.info('Security middleware registered on ObjectQL engine');\n  }\n\n  async destroy(): Promise<void> {\n    // No cleanup needed\n  }\n\n  /**\n   * Collect all RLS policies from permission sets applicable to the given object/operation.\n   */\n  private collectRLSPolicies(\n    permissionSets: PermissionSet[],\n    objectName: string,\n    operation: string\n  ): RowLevelSecurityPolicy[] {\n    const allPolicies: RowLevelSecurityPolicy[] = [];\n\n    for (const ps of permissionSets) {\n      if (ps.rowLevelSecurity) {\n        allPolicies.push(...ps.rowLevelSecurity);\n      }\n    }\n\n    return this.rlsCompiler.getApplicablePolicies(objectName, operation, allPolicies);\n  }\n}\n"],"mappings":";AAOA,IAAM,0BAAkE;AAAA,EACtE,MAAM;AAAA,EACN,SAAS;AAAA,EACT,OAAO;AAAA,EACP,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,QAAQ;AACV;AAQO,IAAM,sBAAN,MAA0B;AAAA;AAAA;AAAA;AAAA;AAAA,EAK/B,sBACE,WACA,YACA,gBACS;AACT,UAAM,UAAU,wBAAwB,SAAS;AACjD,QAAI,CAAC,QAAS,QAAO;AAErB,eAAW,MAAM,gBAAgB;AAC/B,YAAM,UAAU,GAAG,UAAU,UAAU;AACvC,UAAI,SAAS;AAEX,YAAI,CAAC,aAAa,aAAa,EAAE,SAAS,OAAO,KAAK,QAAQ,kBAAkB;AAC9E,iBAAO;AAAA,QACT;AAEA,YAAI,YAAY,gBAAgB,QAAQ,kBAAkB,QAAQ,mBAAmB;AACnF,iBAAO;AAAA,QACT;AAEA,YAAI,QAAQ,OAAO,GAAG;AACpB,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,oBACE,YACA,gBACiC;AACjC,UAAM,SAA0C,CAAC;AAEjD,eAAW,MAAM,gBAAgB;AAC/B,UAAI,CAAC,GAAG,OAAQ;AAEhB,iBAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,GAAG,MAAM,GAAG;AAEnD,YAAI,CAAC,IAAI,WAAW,GAAG,UAAU,GAAG,EAAG;AACvC,cAAM,YAAY,IAAI,UAAU,WAAW,SAAS,CAAC;AAErD,YAAI,CAAC,OAAO,SAAS,GAAG;AACtB,iBAAO,SAAS,IAAI,EAAE,UAAU,OAAO,UAAU,MAAM;AAAA,QACzD;AAGA,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAChD,YAAI,KAAK,SAAU,QAAO,SAAS,EAAE,WAAW;AAAA,MAClD;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,OACA,iBACiB;AACjB,UAAM,SAA0B,CAAC;AAGjC,UAAM,cAAc,gBAAgB,OAAO,aAAa,KAAK,CAAC;AAE9D,eAAW,MAAM,aAAa;AAG5B,UAAI,MAAM,SAAS,GAAG,IAAI,GAAG;AAC3B,eAAO,KAAK,EAAE;AAAA,MAChB;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AACF;;;ACzFO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,cACE,UACA,kBACgC;AAChC,QAAI,SAAS,WAAW,EAAG,QAAO;AAElC,UAAM,UAA0B;AAAA,MAC9B,IAAI,kBAAkB;AAAA,MACtB,WAAW,kBAAkB;AAAA,MAC7B,OAAO,kBAAkB;AAAA,IAC3B;AAEA,UAAM,UAAqC,CAAC;AAE5C,eAAW,UAAU,UAAU;AAC7B,UAAI,CAAC,OAAO,MAAO;AACnB,YAAM,SAAS,KAAK,kBAAkB,OAAO,OAAO,OAAO;AAC3D,UAAI,QAAQ;AACV,gBAAQ,KAAK,MAAM;AAAA,MACrB;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,QAAI,QAAQ,WAAW,EAAG,QAAO,QAAQ,CAAC;AAG1C,WAAO,EAAE,KAAK,QAAQ;AAAA,EACxB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,kBACE,YACA,SACgC;AAChC,QAAI,CAAC,WAAY,QAAO;AAGxB,UAAM,UAAU,WAAW,MAAM,yCAAyC;AAC1E,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,UAAU,OAAW,QAAO;AAChC,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,WAAW,WAAW,MAAM,+BAA+B;AACjE,QAAI,UAAU;AACZ,YAAM,CAAC,EAAE,OAAO,KAAK,IAAI;AACzB,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAGA,UAAM,UAAU,WAAW,MAAM,qDAAqD;AACtF,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,OAAO,IAAI,IAAI;AACxB,YAAM,QAAQ,QAAQ,IAAI;AAC1B,UAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO;AAClC,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE;AAAA,IACnC;AAMA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA,EAKA,sBACE,YACA,WACA,aAC0B;AAE1B,UAAM,QAAQ,KAAK,kBAAkB,SAAS;AAE9C,WAAO,YAAY,OAAO,YAAU;AAElC,UAAI,OAAO,WAAW,cAAc,OAAO,WAAW,IAAK,QAAO;AAGlE,UAAI,OAAO,cAAc,MAAO,QAAO;AACvC,UAAI,OAAO,cAAc,MAAO,QAAO;AAEvC,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAAA,EAEQ,kBAAkB,WAA2B;AACnD,YAAQ,WAAW;AAAA,MACjB,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AAAA,MACL,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT,KAAK;AACH,eAAO;AAAA,MACT;AACE,eAAO;AAAA,IACX;AAAA,EACF;AACF;;;ACrIO,IAAM,cAAN,MAAkB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKvB,YACE,SACA,kBACA,aACa;AAEb,QAAI,OAAO,KAAK,gBAAgB,EAAE,WAAW,EAAG,QAAO;AAGvD,UAAM,eAAe,OAAO,QAAQ,gBAAgB,EACjD,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAEzB,QAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,QAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,aAAO,QAAQ,IAAI,YAAU,KAAK,WAAW,QAAQ,YAAY,CAAC;AAAA,IACpE;AAEA,WAAO,KAAK,WAAW,SAAS,YAAY;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBACE,kBACU;AACV,WAAO,OAAO,QAAQ,gBAAgB,EACnC,OAAO,CAAC,CAAC,EAAE,IAAI,MAAM,CAAC,KAAK,QAAQ,EACnC,IAAI,CAAC,CAAC,KAAK,MAAM,KAAK;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,uBACE,MACA,kBACqB;AACrB,UAAM,cAAc,KAAK,qBAAqB,gBAAgB;AAC9D,QAAI,YAAY,WAAW,EAAG,QAAO;AAErC,UAAM,SAAS,EAAE,GAAG,KAAK;AACzB,eAAW,SAAS,aAAa;AAC/B,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,QAAa,cAA6B;AAC3D,QAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,UAAM,SAAS,EAAE,GAAG,OAAO;AAC3B,eAAW,SAAS,cAAc;AAChC,aAAO,OAAO,KAAK;AAAA,IACrB;AACA,WAAO;AAAA,EACT;AACF;;;ACxEA,SAAS,cAAc,aAAa;AAU7B,IAAM,UAAU,aAAa,OAAO;AAAA,EACzC,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAI,MAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,MAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAY,MAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAM,MAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAO,MAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAa,MAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,aAAa,MAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQ,MAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,IAED,YAAY,MAAM,QAAQ;AAAA,MACxB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;AC1FD,SAAS,gBAAAA,eAAc,SAAAC,cAAa;AAW7B,IAAM,mBAAmBD,cAAa,OAAO;AAAA,EAClD,WAAW;AAAA,EACX,MAAM;AAAA,EACN,OAAO;AAAA,EACP,aAAa;AAAA,EACb,MAAM;AAAA,EACN,UAAU;AAAA,EACV,aAAa;AAAA,EACb,aAAa;AAAA,EACb,eAAe,CAAC,QAAQ,SAAS,QAAQ;AAAA,EAEzC,QAAQ;AAAA,IACN,IAAIC,OAAM,KAAK;AAAA,MACb,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAYA,OAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,YAAYA,OAAM,SAAS;AAAA,MACzB,OAAO;AAAA,MACP,cAAc;AAAA,MACd,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,MAAMA,OAAM,KAAK;AAAA,MACf,OAAO;AAAA,MACP,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,aAAa;AAAA,IACf,CAAC;AAAA,IAED,OAAOA,OAAM,KAAK;AAAA,MAChB,OAAO;AAAA,MACP,UAAU;AAAA,MACV,WAAW;AAAA,IACb,CAAC;AAAA,IAED,aAAaA,OAAM,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AAAA,IAED,oBAAoBA,OAAM,SAAS;AAAA,MACjC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,mBAAmBA,OAAM,SAAS;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,aAAa;AAAA,IACf,CAAC;AAAA,IAED,QAAQA,OAAM,QAAQ;AAAA,MACpB,OAAO;AAAA,MACP,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAAA,EAEA,SAAS;AAAA,IACP,EAAE,QAAQ,CAAC,MAAM,GAAG,QAAQ,KAAK;AAAA,IACjC,EAAE,QAAQ,CAAC,QAAQ,EAAE;AAAA,EACvB;AAAA,EAEA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,YAAY,CAAC,OAAO,QAAQ,UAAU,UAAU,QAAQ;AAAA,IACxD,OAAO;AAAA,IACP,KAAK;AAAA,EACP;AACF,CAAC;;;ACvEM,IAAM,iBAAN,MAAuC;AAAA,EAAvC;AACL,gBAAO;AACP,gBAAO;AACP,mBAAU;AACV,wBAAe,CAAC,iCAAiC;AAEjD,SAAQ,sBAAsB,IAAI,oBAAoB;AACtD,SAAQ,cAAc,IAAI,YAAY;AACtC,SAAQ,cAAc,IAAI,YAAY;AAAA;AAAA,EAEtC,MAAM,KAAK,KAAmC;AAC5C,QAAI,OAAO,KAAK,iCAAiC;AAGjD,QAAI,gBAAgB,wBAAwB,KAAK,mBAAmB;AACpE,QAAI,gBAAgB,gBAAgB,KAAK,WAAW;AACpD,QAAI,gBAAgB,wBAAwB,KAAK,WAAW;AAG5D,QAAI,WAAuC,UAAU,EAAE,SAAS;AAAA,MAC9D,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,SAAS;AAAA,MACT,MAAM;AAAA,MACN,WAAW;AAAA,MACX,SAAS,CAAC,SAAS,gBAAgB;AAAA,IACrC,CAAC;AAGD,QAAI;AACF,YAAM,WAAW,IAAI,WAAyC,UAAU;AACxE,UAAI,UAAU;AACZ,iBAAS,WAAW;AAAA,UAClB,QAAQ;AAAA,UACR,OAAO;AAAA,YACL,EAAE,IAAI,aAAa,MAAM,UAAU,OAAO,SAAS,YAAY,QAAQ,MAAM,gBAAgB,OAAO,GAAG;AAAA,YACvG,EAAE,IAAI,uBAAuB,MAAM,UAAU,OAAO,mBAAmB,YAAY,kBAAkB,MAAM,QAAQ,OAAO,GAAG;AAAA,UAC/H;AAAA,QACF,CAAC;AACD,YAAI,OAAO,KAAK,oDAAoD;AAAA,MACtE;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,OAAO,KAAK,6BAA6B;AAAA,EAC/C;AAAA,EAEA,MAAM,MAAM,KAAmC;AAC7C,QAAI,OAAO,KAAK,6BAA6B;AAG7C,QAAI;AACJ,QAAI;AAEJ,QAAI;AACF,WAAK,IAAI,WAAW,UAAU;AAC9B,iBAAW,IAAI,WAAW,UAAU;AAAA,IACtC,SAAS,GAAG;AACV,UAAI,OAAO,KAAK,gFAAgF;AAChG;AAAA,IACF;AAEA,QAAI,CAAC,MAAM,OAAO,GAAG,uBAAuB,YAAY;AACtD,UAAI,OAAO,KAAK,iFAAiF;AACjG;AAAA,IACF;AAGA,OAAG,mBAAmB,OAAO,OAAY,SAA8B;AAErE,UAAI,MAAM,SAAS,UAAU;AAC3B,eAAO,KAAK;AAAA,MACd;AAEA,YAAM,QAAQ,MAAM,SAAS,SAAS,CAAC;AAIvC,UAAI,MAAM,WAAW,KAAK,CAAC,MAAM,SAAS,QAAQ;AAChD,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,iBAAkC,CAAC;AACvC,UAAI;AACF,yBAAiB,KAAK,oBAAoB,sBAAsB,OAAO,QAAQ;AAAA,MACjF,SAAS,GAAG;AAGV,eAAO,KAAK;AAAA,MACd;AAGA,UAAI,eAAe,SAAS,GAAG;AAC7B,cAAM,UAAU,KAAK,oBAAoB;AAAA,UACvC,MAAM;AAAA,UACN,MAAM;AAAA,UACN;AAAA,QACF;AAEA,YAAI,CAAC,SAAS;AACZ,gBAAM,IAAI;AAAA,YACR,wCAAwC,MAAM,SAAS,gBAAgB,MAAM,MAAM,iCACpD,MAAM,KAAK,IAAI,CAAC;AAAA,UACjD;AAAA,QACF;AAAA,MACF;AAGA,YAAM,iBAAiB,KAAK,mBAAmB,gBAAgB,MAAM,QAAQ,MAAM,SAAS;AAC5F,UAAI,eAAe,SAAS,KAAK,MAAM,KAAK;AAC1C,cAAM,YAAY,KAAK,YAAY,cAAc,gBAAgB,MAAM,OAAO;AAC9E,YAAI,WAAW;AACb,cAAI,MAAM,IAAI,OAAO;AACnB,kBAAM,IAAI,QAAQ,EAAE,MAAM,CAAC,MAAM,IAAI,OAAO,SAAS,EAAE;AAAA,UACzD,OAAO;AACL,kBAAM,IAAI,QAAQ;AAAA,UACpB;AAAA,QACF;AAAA,MACF;AAEA,YAAM,KAAK;AAGX,UAAI,MAAM,UAAU,CAAC,QAAQ,SAAS,EAAE,SAAS,MAAM,SAAS,GAAG;AACjE,cAAM,aAAa,KAAK,oBAAoB,oBAAoB,MAAM,QAAQ,cAAc;AAC5F,YAAI,OAAO,KAAK,UAAU,EAAE,SAAS,GAAG;AACtC,gBAAM,SAAS,KAAK,YAAY,YAAY,MAAM,QAAQ,YAAY,MAAM,MAAM;AAAA,QACpF;AAAA,MACF;AAAA,IACF,CAAC;AAED,QAAI,OAAO,KAAK,mDAAmD;AAAA,EACrE;AAAA,EAEA,MAAM,UAAyB;AAAA,EAE/B;AAAA;AAAA;AAAA;AAAA,EAKQ,mBACN,gBACA,YACA,WAC0B;AAC1B,UAAM,cAAwC,CAAC;AAE/C,eAAW,MAAM,gBAAgB;AAC/B,UAAI,GAAG,kBAAkB;AACvB,oBAAY,KAAK,GAAG,GAAG,gBAAgB;AAAA,MACzC;AAAA,IACF;AAEA,WAAO,KAAK,YAAY,sBAAsB,YAAY,WAAW,WAAW;AAAA,EAClF;AACF;","names":["ObjectSchema","Field"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@objectstack/plugin-security",
-  "version": "4.0.0",
+  "version": "4.0.2",
   "license": "Apache-2.0",
   "description": "Security Plugin for ObjectStack — RBAC, RLS, and Field-Level Security Runtime",
   "main": "dist/index.js",
@@ -13,11 +13,11 @@
     }
   },
   "dependencies": {
-    "@objectstack/core": "4.0.0",
-    "@objectstack/spec": "4.0.0"
+    "@objectstack/core": "4.0.2",
+    "@objectstack/spec": "4.0.2"
   },
   "devDependencies": {
-    "@types/node": "^25.5.0",
+    "@types/node": "^25.5.2",
     "typescript": "^6.0.2",
     "vitest": "^4.1.2"
   },

package/src/security-plugin.test.ts

@@ -21,23 +21,32 @@ describe('SecurityPlugin', () => {
 
   it('should register services during init', async () => {
     const plugin = new SecurityPlugin();
+    const manifestService = { register: vi.fn() };
     const ctx: any = {
       logger: { info: vi.fn(), warn: vi.fn() },
       registerService: vi.fn(),
-      getService: vi.fn(),
+      getService: vi.fn().mockImplementation((name: string) => {
+        if (name === 'manifest') return manifestService;
+        return undefined;
+      }),
     };
     await plugin.init(ctx);
     expect(ctx.registerService).toHaveBeenCalledWith('security.permissions', expect.any(PermissionEvaluator));
     expect(ctx.registerService).toHaveBeenCalledWith('security.rls', expect.any(RLSCompiler));
     expect(ctx.registerService).toHaveBeenCalledWith('security.fieldMasker', expect.any(FieldMasker));
+    expect(manifestService.register).toHaveBeenCalled();
   });
 
   it('should warn and return when objectql service is missing', async () => {
     const plugin = new SecurityPlugin();
+    const manifestService = { register: vi.fn() };
     const ctx: any = {
       logger: { info: vi.fn(), warn: vi.fn() },
       registerService: vi.fn(),
-      getService: vi.fn().mockImplementation(() => { throw new Error('not found'); }),
+      getService: vi.fn().mockImplementation((name: string) => {
+        if (name === 'manifest') return manifestService;
+        throw new Error('not found');
+      }),
     };
     await plugin.init(ctx);
     await plugin.start(ctx);
@@ -46,10 +55,14 @@ describe('SecurityPlugin', () => {
 
   it('should warn when objectql does not support middleware', async () => {
     const plugin = new SecurityPlugin();
+    const manifestService = { register: vi.fn() };
     const ctx: any = {
       logger: { info: vi.fn(), warn: vi.fn() },
       registerService: vi.fn(),
-      getService: vi.fn().mockReturnValue({}), // no registerMiddleware
+      getService: vi.fn().mockImplementation((name: string) => {
+        if (name === 'manifest') return manifestService;
+        return {}; // objectql without registerMiddleware
+      }),
     };
     await plugin.init(ctx);
     await plugin.start(ctx);
@@ -59,10 +72,14 @@ describe('SecurityPlugin', () => {
   it('should register middleware when objectql supports it', async () => {
     const plugin = new SecurityPlugin();
     const registerMiddleware = vi.fn();
+    const manifestService = { register: vi.fn() };
     const ctx: any = {
       logger: { info: vi.fn(), warn: vi.fn() },
       registerService: vi.fn(),
-      getService: vi.fn().mockReturnValue({ registerMiddleware }),
+      getService: vi.fn().mockImplementation((name: string) => {
+        if (name === 'manifest') return manifestService;
+        return { registerMiddleware };
+      }),
     };
     await plugin.init(ctx);
     await plugin.start(ctx);

package/src/security-plugin.ts

@@ -38,8 +38,8 @@ export class SecurityPlugin implements Plugin {
     ctx.registerService('security.rls', this.rlsCompiler);
     ctx.registerService('security.fieldMasker', this.fieldMasker);
 
-    // Register security system objects so ObjectQLPlugin auto-discovers them
-    ctx.registerService('app.com.objectstack.security', {
+    // Register security system objects via the manifest service.
+    ctx.getService<{ register(m: any): void }>('manifest').register({
       id: 'com.objectstack.security',
       name: 'Security',
       version: '1.0.0',
@@ -48,6 +48,23 @@ export class SecurityPlugin implements Plugin {
       objects: [SysRole, SysPermissionSet],
     });
 
+    // Contribute navigation items to the Setup App (if SetupPlugin is loaded).
+    try {
+      const setupNav = ctx.getService<{ contribute(c: any): void }>('setupNav');
+      if (setupNav) {
+        setupNav.contribute({
+          areaId: 'area_administration',
+          items: [
+            { id: 'nav_roles', type: 'object', label: 'Roles', objectName: 'role', icon: 'shield-check', order: 60 },
+            { id: 'nav_permission_sets', type: 'object', label: 'Permission Sets', objectName: 'permission_set', icon: 'lock', order: 70 },
+          ],
+        });
+        ctx.logger.info('Security navigation items contributed to Setup App');
+      }
+    } catch {
+      // SetupPlugin not loaded — skip silently
+    }
+
     ctx.logger.info('Security Plugin initialized');
   }