@objectstack/plugin-security 9.8.0 → 9.9.0

package/dist/index.mjs

@@ -2261,17 +2261,29 @@ var defaultPermissionSets = [
         operation: "all",
         using: "organization_id = current_user.organization_id"
       },
+      // Owner-scoped writes/deletes for rank-and-file members: you may modify
+      // and delete the records you created, not other users'. Keyed on
+      // `created_by` — the column the engine stamps on EVERY record — rather
+      // than `owner_id`, which author-defined objects almost never declare. The
+      // old `owner_id` key referenced a missing column on real objects, so
+      // `computeRlsFilter` dropped the policy and the scoping silently no-op'd
+      // (any member could edit/delete any record — #1985). These policies are
+      // ENFORCED on writes via the security middleware's pre-image check (a
+      // by-id update/delete never builds an RLS `where`, so the predicate is
+      // verified against the target row before the mutation). Objects that
+      // model transferable ownership with a dedicated owner field should
+      // override these with a per-object policy.
       {
         name: "owner_only_writes",
         object: "*",
         operation: "update",
-        using: "owner_id = current_user.id"
+        using: "created_by = current_user.id"
       },
       {
         name: "owner_only_deletes",
         object: "*",
         operation: "delete",
-        using: "owner_id = current_user.id"
+        using: "created_by = current_user.id"
       },
       // ── better-auth system tables that lack `organization_id` and would
       //    otherwise be left unprotected by the wildcard rule above. ────
@@ -2703,6 +2715,40 @@ var SecurityPlugin = class {
           );
         }
       }
+      if ((opCtx.operation === "update" || opCtx.operation === "delete") && permissionSets.length > 0 && !!opCtx.context?.userId && this.ql) {
+        const targetId = this.extractSingleId(opCtx);
+        if (targetId != null) {
+          const writeFilter = await this.computeRlsFilter(
+            permissionSets,
+            opCtx.object,
+            opCtx.operation,
+            opCtx.context
+          );
+          if (writeFilter) {
+            let visible = null;
+            try {
+              visible = await this.ql.findOne(opCtx.object, {
+                where: { $and: [{ id: targetId }, writeFilter] },
+                context: opCtx.context
+              });
+            } catch {
+              visible = null;
+            }
+            if (!visible) {
+              throw new PermissionDeniedError(
+                `[Security] Access denied: not permitted to ${opCtx.operation} this '${opCtx.object}' record (row-level security)`,
+                {
+                  operation: opCtx.operation,
+                  object: opCtx.object,
+                  roles,
+                  permissionSets: explicitPermissionSets,
+                  recordId: targetId
+                }
+              );
+            }
+          }
+        }
+      }
       if ((opCtx.operation === "insert" || opCtx.operation === "update") && opCtx.data && permissionSets.length > 0) {
         const fieldPerms = this.permissionEvaluator.getFieldPermissions(
           opCtx.object,
@@ -2894,6 +2940,26 @@ var SecurityPlugin = class {
     }
     return permissionSets;
   }
+  /**
+   * Resolve a single scalar primary-key id from an update/delete operation
+   * context, mirroring the engine's "single-id vs predicate" rule
+   * (`engine.ts` update/delete): only a scalar `data.id` or `where.id`
+   * identifies one row. An operator object (`{ $in: [...] }`, …) is a
+   * multi-row predicate and returns `null` (multi-row writes route through the
+   * `*Many` paths, out of scope for the by-id pre-image check).
+   */
+  extractSingleId(opCtx) {
+    const isScalar = (v) => v !== null && (typeof v === "string" || typeof v === "number" || typeof v === "bigint");
+    const data = opCtx?.data;
+    if (data && typeof data === "object" && !Array.isArray(data) && isScalar(data.id)) {
+      return data.id;
+    }
+    const where = opCtx?.options?.where;
+    if (where && typeof where === "object" && "id" in where && isScalar(where.id)) {
+      return where.id;
+    }
+    return null;
+  }
   /**
    * Compile the applicable RLS policies for (object, operation) into a single
    * `FilterCondition`, applying the field-existence safety net (wildcard