@objectstack/rest 11.0.0 → 11.1.0

package/dist/index.d.cts

@@ -227,6 +227,19 @@ declare class RestServer {
      */
     private readonly hostnameCache;
     private readonly hostnameCacheTtlMs;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    private readonly execCtxMemo;
     private defaultEnvironmentIdProvider?;
     private authServiceProvider?;
     private objectQLProvider?;
@@ -330,6 +343,8 @@ declare class RestServer {
      * to the protocol layer (the SecurityPlugin treats undefined as anon).
      */
     private resolveExecCtx;
+    /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+    private computeExecCtx;
     /**
      * Filter an `App` metadata item by the current user's `systemPermissions`.
      *

package/dist/index.d.ts

@@ -227,6 +227,19 @@ declare class RestServer {
      */
     private readonly hostnameCache;
     private readonly hostnameCacheTtlMs;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    private readonly execCtxMemo;
     private defaultEnvironmentIdProvider?;
     private authServiceProvider?;
     private objectQLProvider?;
@@ -330,6 +343,8 @@ declare class RestServer {
      * to the protocol layer (the SecurityPlugin treats undefined as anon).
      */
     private resolveExecCtx;
+    /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+    private computeExecCtx;
     /**
      * Filter an `App` metadata item by the current user's `systemPermissions`.
      *

package/dist/index.js

@@ -1,5 +1,5 @@
 // src/rest-server.ts
-import { resolveAuthzContext, resolveLocalizationContext } from "@objectstack/core";
+import { resolveAuthzContext, resolveLocalizationContext, isAuthGateAllowlisted } from "@objectstack/core";
 
 // src/route-manager.ts
 var RouteManager = class {
@@ -460,6 +460,19 @@ var RestServer = class {
      */
     this.hostnameCache = /* @__PURE__ */ new Map();
     this.hostnameCacheTtlMs = 3e4;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    this.execCtxMemo = /* @__PURE__ */ new WeakMap();
     /**
      * Lazily load the OpenAPI spec JSON shipped by @objectstack/spec.
      * Cached after first read. Resilient to missing files / parse errors
@@ -633,6 +646,11 @@ var RestServer = class {
    * requests (they're internal-only), so they cannot bypass this gate.
    */
   enforceAuth(req, res, context) {
+    const gate = context?.authGate;
+    if (gate && req?.method !== "OPTIONS" && !isAuthGateAllowlisted(req?.path)) {
+      res.status(403).json({ error: { code: gate.code, message: gate.message } });
+      return true;
+    }
     if (!this.config.api.requireAuth) return false;
     if (context?.userId) return false;
     if (req?.method === "OPTIONS") return false;
@@ -703,6 +721,21 @@ var RestServer = class {
    * to the protocol layer (the SecurityPlugin treats undefined as anon).
    */
   async resolveExecCtx(environmentId, req) {
+    if (!req || typeof req !== "object") return this.computeExecCtx(environmentId, req);
+    const key = environmentId ?? "\0default";
+    let perReq = this.execCtxMemo.get(req);
+    if (!perReq) {
+      perReq = /* @__PURE__ */ new Map();
+      this.execCtxMemo.set(req, perReq);
+    }
+    const cached = perReq.get(key);
+    if (cached) return cached;
+    const pending = this.computeExecCtx(environmentId, req);
+    perReq.set(key, pending);
+    return pending;
+  }
+  /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+  async computeExecCtx(environmentId, req) {
     try {
       if (!environmentId && req && this.envRegistry && this.kernelManager) {
         const host = this.extractHostname(req);
@@ -779,6 +812,14 @@ var RestServer = class {
         tenantId: authz.tenantId,
         userId: authz.userId
       });
+      let authGate;
+      try {
+        if (typeof authService.isAuthGateActive === "function" && authService.isAuthGateActive()) {
+          const gatedSession = await getSession(headers).catch(() => void 0);
+          if (gatedSession?.user?.authGate) authGate = gatedSession.user.authGate;
+        }
+      } catch {
+      }
       return {
         userId: authz.userId,
         tenantId: authz.tenantId,
@@ -789,6 +830,7 @@ var RestServer = class {
         ...authz.tabPermissions ? { tabPermissions: authz.tabPermissions } : {},
         isSystem: false,
         org_user_ids: authz.org_user_ids,
+        ...authGate ? { authGate } : {},
         ...localization.timezone ? { timezone: localization.timezone } : {},
         ...localization.locale ? { locale: localization.locale } : {},
         ...localization.currency ? { currency: localization.currency } : {},