@objectstack/rest 10.3.0 → 11.1.0

package/dist/index.d.cts

@@ -227,6 +227,19 @@ declare class RestServer {
      */
     private readonly hostnameCache;
     private readonly hostnameCacheTtlMs;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    private readonly execCtxMemo;
     private defaultEnvironmentIdProvider?;
     private authServiceProvider?;
     private objectQLProvider?;
@@ -330,6 +343,8 @@ declare class RestServer {
      * to the protocol layer (the SecurityPlugin treats undefined as anon).
      */
     private resolveExecCtx;
+    /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+    private computeExecCtx;
     /**
      * Filter an `App` metadata item by the current user's `systemPermissions`.
      *
@@ -344,6 +359,19 @@ declare class RestServer {
      * is never mutated so cached metadata stays clean.
      */
     private filterAppForUser;
+    /**
+     * ADR-0057 D10 (dashboards): strip dashboard widgets whose `requiresService`
+     * capability gate names a kernel service that isn't registered — the same
+     * "server is the authoritative visibility gate" rule already applied to app
+     * nav entries (see {@link filterAppForUser}). Without this, a widget bound to
+     * an optional service renders a dead tile in deployments where the service is
+     * off (e.g. the Organizations KPI under multi-tenant `org-scoping`, which is
+     * absent in a single-tenant runtime while its nav entry is correctly hidden).
+     *
+     * Fail-open when the gate can't be probed (serviceGate undefined). Never
+     * mutates the original — returns a shallow copy only when a widget is dropped.
+     */
+    private filterDashboardForUser;
     /**
      * Probe which `requiresService` capability gates referenced anywhere in
      * `items` are actually registered in the runtime kernel. Returns `null`

package/dist/index.d.ts

@@ -227,6 +227,19 @@ declare class RestServer {
      */
     private readonly hostnameCache;
     private readonly hostnameCacheTtlMs;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    private readonly execCtxMemo;
     private defaultEnvironmentIdProvider?;
     private authServiceProvider?;
     private objectQLProvider?;
@@ -330,6 +343,8 @@ declare class RestServer {
      * to the protocol layer (the SecurityPlugin treats undefined as anon).
      */
     private resolveExecCtx;
+    /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+    private computeExecCtx;
     /**
      * Filter an `App` metadata item by the current user's `systemPermissions`.
      *
@@ -344,6 +359,19 @@ declare class RestServer {
      * is never mutated so cached metadata stays clean.
      */
     private filterAppForUser;
+    /**
+     * ADR-0057 D10 (dashboards): strip dashboard widgets whose `requiresService`
+     * capability gate names a kernel service that isn't registered — the same
+     * "server is the authoritative visibility gate" rule already applied to app
+     * nav entries (see {@link filterAppForUser}). Without this, a widget bound to
+     * an optional service renders a dead tile in deployments where the service is
+     * off (e.g. the Organizations KPI under multi-tenant `org-scoping`, which is
+     * absent in a single-tenant runtime while its nav entry is correctly hidden).
+     *
+     * Fail-open when the gate can't be probed (serviceGate undefined). Never
+     * mutates the original — returns a shallow copy only when a widget is dropped.
+     */
+    private filterDashboardForUser;
     /**
      * Probe which `requiresService` capability gates referenced anywhere in
      * `items` are actually registered in the runtime kernel. Returns `null`

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/rest-server.ts
-import { resolveApiKeyPrincipal } from "@objectstack/core";
+import { resolveAuthzContext, resolveLocalizationContext, isAuthGateAllowlisted } from "@objectstack/core";
 
 // src/route-manager.ts
 var RouteManager = class {
@@ -460,6 +460,19 @@ var RestServer = class {
      */
     this.hostnameCache = /* @__PURE__ */ new Map();
     this.hostnameCacheTtlMs = 3e4;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    this.execCtxMemo = /* @__PURE__ */ new WeakMap();
     /**
      * Lazily load the OpenAPI spec JSON shipped by @objectstack/spec.
      * Cached after first read. Resilient to missing files / parse errors
@@ -633,6 +646,11 @@ var RestServer = class {
    * requests (they're internal-only), so they cannot bypass this gate.
    */
   enforceAuth(req, res, context) {
+    const gate = context?.authGate;
+    if (gate && req?.method !== "OPTIONS" && !isAuthGateAllowlisted(req?.path)) {
+      res.status(403).json({ error: { code: gate.code, message: gate.message } });
+      return true;
+    }
     if (!this.config.api.requireAuth) return false;
     if (context?.userId) return false;
     if (req?.method === "OPTIONS") return false;
@@ -703,6 +721,21 @@ var RestServer = class {
    * to the protocol layer (the SecurityPlugin treats undefined as anon).
    */
   async resolveExecCtx(environmentId, req) {
+    if (!req || typeof req !== "object") return this.computeExecCtx(environmentId, req);
+    const key = environmentId ?? "\0default";
+    let perReq = this.execCtxMemo.get(req);
+    if (!perReq) {
+      perReq = /* @__PURE__ */ new Map();
+      this.execCtxMemo.set(req, perReq);
+    }
+    const cached = perReq.get(key);
+    if (cached) return cached;
+    const pending = this.computeExecCtx(environmentId, req);
+    perReq.set(key, pending);
+    return pending;
+  }
+  /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+  async computeExecCtx(environmentId, req) {
     try {
       if (!environmentId && req && this.envRegistry && this.kernelManager) {
         const host = this.extractHostname(req);
@@ -762,155 +795,45 @@ var RestServer = class {
       } else {
         return void 0;
       }
-      const permissions = [];
-      const systemPermissions = [];
-      const roles = [];
-      let identityQl;
-      if (kernel) identityQl = await kernel.getServiceAsync("objectql").catch(() => void 0);
-      if (!identityQl && this.objectQLProvider) {
-        identityQl = await this.objectQLProvider(environmentId).catch(() => void 0);
-      }
-      let userId;
-      let tenantId;
-      let email;
-      const keyPrincipal = await resolveApiKeyPrincipal(identityQl, headers).catch(() => void 0);
-      if (keyPrincipal) {
-        userId = keyPrincipal.userId;
-        tenantId = keyPrincipal.tenantId;
-        for (const s of keyPrincipal.scopes) if (!permissions.includes(s)) permissions.push(s);
-      } else {
-        const session = await api.getSession({ headers });
-        if (!session?.user?.id) return void 0;
-        userId = session.user.id;
-        tenantId = session.session?.activeOrganizationId ?? void 0;
-        if (session.user?.email) email = String(session.user.email);
-      }
-      if (!email && identityQl && typeof identityQl.find === "function") {
-        const urows = await identityQl.find("sys_user", { where: { id: userId }, limit: 1, context: { isSystem: true } }).catch(() => []);
-        if (urows?.[0]?.email) email = String(urows[0].email);
-      }
-      try {
-        let ql;
-        if (kernel) {
-          ql = await kernel.getServiceAsync("objectql").catch(() => void 0);
-        }
-        if (!ql && this.objectQLProvider) {
-          ql = await this.objectQLProvider(environmentId).catch(() => void 0);
-        }
-        if (ql && typeof ql.find === "function") {
-          const sysOpts = { context: { isSystem: true } };
-          const memberRows = await ql.find("sys_member", {
-            where: tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId },
-            limit: 50,
-            ...sysOpts
-          }).catch(() => []);
-          for (const m of memberRows ?? []) {
-            if (typeof m.role === "string") {
-              for (const r of m.role.split(",").map((s) => s.trim()).filter(Boolean)) {
-                if (!roles.includes(r)) roles.push(r);
-              }
-            }
-          }
-          const upsRows = await ql.find("sys_user_permission_set", {
-            where: { user_id: userId },
-            limit: 100,
-            ...sysOpts
-          }).catch(() => []);
-          const psIds = /* @__PURE__ */ new Set();
-          for (const r of upsRows ?? []) {
-            const orgScope = r.organization_id ?? null;
-            if (!orgScope || tenantId && orgScope === tenantId) {
-              const pid = r.permission_set_id ?? r.permissionSetId;
-              if (pid) psIds.add(pid);
-            }
-          }
-          if (psIds.size > 0) {
-            const psRows = await ql.find("sys_permission_set", {
-              where: { id: { $in: Array.from(psIds) } },
-              limit: 500,
-              ...sysOpts
-            }).catch(() => []);
-            for (const ps of psRows ?? []) {
-              if (ps.name && !permissions.includes(ps.name)) permissions.push(ps.name);
-              const rawSys = typeof ps.system_permissions === "string" ? (() => {
-                try {
-                  return JSON.parse(ps.system_permissions);
-                } catch {
-                  return [];
-                }
-              })() : ps.system_permissions ?? ps.systemPermissions;
-              if (Array.isArray(rawSys)) {
-                for (const sp of rawSys) {
-                  if (typeof sp === "string" && !systemPermissions.includes(sp)) {
-                    systemPermissions.push(sp);
-                  }
-                }
-              }
-            }
-          }
-        }
-      } catch {
-      }
-      let org_user_ids = [userId];
-      if (tenantId) {
+      const ql = kernel ? await kernel.getServiceAsync("objectql").catch(() => void 0) : this.objectQLProvider ? await this.objectQLProvider(environmentId).catch(() => void 0) : void 0;
+      const getSession = async (h) => {
         try {
-          let ql;
-          if (kernel) {
-            ql = await kernel.getServiceAsync("objectql").catch(() => void 0);
-          }
-          if (!ql && this.objectQLProvider) {
-            ql = await this.objectQLProvider(environmentId).catch(() => void 0);
-          }
-          if (ql && typeof ql.find === "function") {
-            const sysOpts = { context: { isSystem: true } };
-            const memberRows = await ql.find("sys_member", {
-              where: { organization_id: tenantId },
-              limit: 1e3,
-              ...sysOpts
-            }).catch(() => []);
-            const ids = /* @__PURE__ */ new Set([userId]);
-            for (const m of memberRows ?? []) {
-              const uid = m.user_id ?? m.userId;
-              if (typeof uid === "string" && uid.length > 0) ids.add(uid);
-            }
-            org_user_ids = Array.from(ids);
-          }
+          return await api.getSession({ headers: h });
         } catch {
+          return void 0;
         }
-      }
-      let timezone;
-      let locale;
-      let currency;
+      };
+      const authz = await resolveAuthzContext({ ql, headers, getSession });
+      if (!authz.userId) return void 0;
+      const settings = this.settingsServiceProvider ? await this.settingsServiceProvider(environmentId).catch(() => void 0) : void 0;
+      const localization = await resolveLocalizationContext({
+        ql,
+        settings,
+        tenantId: authz.tenantId,
+        userId: authz.userId
+      });
+      let authGate;
       try {
-        const settings = this.settingsServiceProvider ? await this.settingsServiceProvider(environmentId).catch(() => void 0) : void 0;
-        if (settings && typeof settings.get === "function") {
-          const sctx = { tenantId, userId };
-          const [tzRes, localeRes, currencyRes] = await Promise.all([
-            settings.get("localization", "timezone", sctx).catch(() => void 0),
-            settings.get("localization", "locale", sctx).catch(() => void 0),
-            settings.get("localization", "currency", sctx).catch(() => void 0)
-          ]);
-          const tzVal = tzRes?.value;
-          const localeVal = localeRes?.value;
-          const currencyVal = currencyRes?.value;
-          if (typeof tzVal === "string" && tzVal.trim()) timezone = tzVal.trim();
-          if (typeof localeVal === "string" && localeVal.trim()) locale = localeVal.trim();
-          if (typeof currencyVal === "string" && currencyVal.trim()) currency = currencyVal.trim().toUpperCase();
+        if (typeof authService.isAuthGateActive === "function" && authService.isAuthGateActive()) {
+          const gatedSession = await getSession(headers).catch(() => void 0);
+          if (gatedSession?.user?.authGate) authGate = gatedSession.user.authGate;
         }
       } catch {
       }
       return {
-        userId,
-        tenantId,
-        email,
-        roles,
-        permissions,
-        systemPermissions,
+        userId: authz.userId,
+        tenantId: authz.tenantId,
+        email: authz.email,
+        roles: authz.roles,
+        permissions: authz.permissions,
+        systemPermissions: authz.systemPermissions,
+        ...authz.tabPermissions ? { tabPermissions: authz.tabPermissions } : {},
         isSystem: false,
-        org_user_ids,
-        ...timezone ? { timezone } : {},
-        ...locale ? { locale } : {},
-        ...currency ? { currency } : {},
+        org_user_ids: authz.org_user_ids,
+        ...authGate ? { authGate } : {},
+        ...localization.timezone ? { timezone: localization.timezone } : {},
+        ...localization.locale ? { locale: localization.locale } : {},
+        ...localization.currency ? { currency: localization.currency } : {},
         // Internal: resolved kernel so the nav-serving path can probe
         // requiresService capability gates (ADR-0057 D10). NOT an
         // authorization input — never read by RLS/permission logic.
@@ -970,6 +893,30 @@ var RestServer = class {
     };
     return { ...item, navigation: filterNav(nav) };
   }
+  /**
+   * ADR-0057 D10 (dashboards): strip dashboard widgets whose `requiresService`
+   * capability gate names a kernel service that isn't registered — the same
+   * "server is the authoritative visibility gate" rule already applied to app
+   * nav entries (see {@link filterAppForUser}). Without this, a widget bound to
+   * an optional service renders a dead tile in deployments where the service is
+   * off (e.g. the Organizations KPI under multi-tenant `org-scoping`, which is
+   * absent in a single-tenant runtime while its nav entry is correctly hidden).
+   *
+   * Fail-open when the gate can't be probed (serviceGate undefined). Never
+   * mutates the original — returns a shallow copy only when a widget is dropped.
+   */
+  filterDashboardForUser(item, serviceGate) {
+    if (!item || typeof item !== "object" || !serviceGate) return item;
+    if (isMetaEnvelope(item)) {
+      const body = this.filterDashboardForUser(item.item, serviceGate);
+      return body === item.item ? item : { ...item, item: body };
+    }
+    if (!Array.isArray(item.widgets)) return item;
+    const widgets = item.widgets.filter(
+      (w) => !(w && typeof w.requiresService === "string" && serviceGate(w.requiresService) === false)
+    );
+    return widgets.length === item.widgets.length ? item : { ...item, widgets };
+  }
   /**
    * Probe which `requiresService` capability gates referenced anywhere in
    * `items` are actually registered in the runtime kernel. Returns `null`
@@ -1006,7 +953,7 @@ var RestServer = class {
         return;
       }
       if (typeof e.requiresService === "string") wanted.add(e.requiresService);
-      const kids = Array.isArray(e.navigation) ? e.navigation : Array.isArray(e.children) ? e.children : null;
+      const kids = Array.isArray(e.navigation) ? e.navigation : Array.isArray(e.children) ? e.children : Array.isArray(e.widgets) ? e.widgets : null;
       if (kids) for (const k of kids) walk(k);
     };
     for (const it of items) walk(it);
@@ -1294,10 +1241,10 @@ var RestServer = class {
       this.registerReportsEndpoints(bp);
       this.registerApprovalsEndpoints(bp);
       this.registerAnalyticsEndpoints(bp);
+      this.registerDataActionEndpoints(bp);
       if (this.config.api.enableCrud) {
         this.registerCrudEndpoints(bp);
       }
-      this.registerDataActionEndpoints(bp);
       if (this.config.api.enableBatch) {
         this.registerBatchEndpoints(bp);
       }
@@ -1634,6 +1581,19 @@ var RestServer = class {
                 }
               }
             }
+            if (req.params.type === "dashboard") {
+              const raw = visible;
+              const list = Array.isArray(raw) ? raw : raw && typeof raw === "object" && Array.isArray(raw.items) ? raw.items : null;
+              if (list) {
+                const ctx = await this.resolveExecCtx(environmentId, req).catch(() => void 0);
+                const registered = await this.resolveRegisteredServices(ctx?.__kernel, list);
+                const serviceGate = registered ? (n) => registered.has(n) : void 0;
+                if (serviceGate) {
+                  const filtered = list.map((it) => this.filterDashboardForUser(it, serviceGate));
+                  visible = Array.isArray(raw) ? filtered : { ...raw, items: filtered };
+                }
+              }
+            }
             if (req.params.type === "view" && req.query?.object) {
               const obj = String(req.query.object);
               const raw = visible;
@@ -1806,9 +1766,11 @@ var RestServer = class {
                 res.header("Last-Modified", new Date(result.lastModified).toUTCString());
               }
               if (result.cacheControl) {
-                const directives = result.cacheControl.directives.join(", ");
-                const maxAge = result.cacheControl.maxAge ? `, max-age=${result.cacheControl.maxAge}` : "";
-                res.header("Cache-Control", directives + maxAge);
+                const parts = result.cacheControl.directives.filter((d) => d !== "max-age");
+                if (result.cacheControl.maxAge != null) {
+                  parts.push(`max-age=${result.cacheControl.maxAge}`);
+                }
+                res.header("Cache-Control", parts.join(", "));
               }
               res.header("Vary", "Accept-Language");
               res.json(await this.translateMetaItem(req, req.params.type, environmentId, result.data, cacheI18n));
@@ -1841,6 +1803,12 @@ var RestServer = class {
                   }
                 }
               }
+              if (req.params.type === "dashboard" && visible) {
+                const ctx = await this.resolveExecCtx(environmentId, req).catch(() => void 0);
+                const registered = await this.resolveRegisteredServices(ctx?.__kernel, [visible]);
+                const serviceGate = registered ? (n) => registered.has(n) : void 0;
+                if (serviceGate) visible = this.filterDashboardForUser(visible, serviceGate);
+              }
               if (req.params.type === "doc" && visible) {
                 const locale = this.extractLocale(req);
                 const { resolveDocLocale } = await import("@objectstack/spec/system");
@@ -2969,7 +2937,7 @@ var RestServer = class {
             const allow = (name, cfg) => {
               const def = objectSchema?.fields?.[name];
               const t = def?.type;
-              if (t !== "lookup" && t !== "master_detail") return true;
+              if (t !== "lookup" && t !== "master_detail" && t !== "user") return true;
               return !!cfg?.publicPicker;
             };
             const sections = match.form.sections.map((sec) => {