@objectstack/rest 11.0.0 → 11.2.0

package/README.md

@@ -7,7 +7,7 @@
 
 ## Overview
 
-`@objectstack/rest` is registered as a kernel plugin and emits HTTP routes for every object defined in the protocol metadata. Framework adapters (`@objectstack/express`, `hono`, `fastify`, `nextjs`, `nuxt`, `nestjs`, `sveltekit`) invoke these routes through `HttpDispatcher` from `@objectstack/runtime`.
+`@objectstack/rest` is registered as a kernel plugin and emits HTTP routes for every object defined in the protocol metadata. The Hono framework adapter (`@objectstack/hono`) invokes these routes through `HttpDispatcher` from `@objectstack/runtime`.
 
 ## Installation
 

package/dist/index.cjs

@@ -500,6 +500,19 @@ var RestServer = class {
      */
     this.hostnameCache = /* @__PURE__ */ new Map();
     this.hostnameCacheTtlMs = 3e4;
+    /**
+     * Request-scoped memoization for `resolveExecCtx`. A single HTTP request
+     * resolves the SAME execution context (identity + RBAC/RLS + localization)
+     * many times — the data operation itself, app-nav RBAC filtering, dashboard
+     * widget gating, the auth gate, etc. Each resolution is ~16 sequential
+     * queries (the `resolveAuthzContext` aggregation plus localization), so a
+     * request that resolves twice pays for duplicate authz and repeated
+     * localization. Keyed by the per-request `req` object (a `WeakMap`, so the
+     * entry is collected with the request — naturally request-scoped, no TTL,
+     * no cross-request leak) and the input `environmentId`. We cache the
+     * in-flight Promise so concurrent callers share one resolution.
+     */
+    this.execCtxMemo = /* @__PURE__ */ new WeakMap();
     /**
      * Lazily load the OpenAPI spec JSON shipped by @objectstack/spec.
      * Cached after first read. Resilient to missing files / parse errors
@@ -673,6 +686,11 @@ var RestServer = class {
    * requests (they're internal-only), so they cannot bypass this gate.
    */
   enforceAuth(req, res, context) {
+    const gate = context?.authGate;
+    if (gate && req?.method !== "OPTIONS" && !(0, import_core.isAuthGateAllowlisted)(req?.path)) {
+      res.status(403).json({ error: { code: gate.code, message: gate.message } });
+      return true;
+    }
     if (!this.config.api.requireAuth) return false;
     if (context?.userId) return false;
     if (req?.method === "OPTIONS") return false;
@@ -743,6 +761,21 @@ var RestServer = class {
    * to the protocol layer (the SecurityPlugin treats undefined as anon).
    */
   async resolveExecCtx(environmentId, req) {
+    if (!req || typeof req !== "object") return this.computeExecCtx(environmentId, req);
+    const key = environmentId ?? "\0default";
+    let perReq = this.execCtxMemo.get(req);
+    if (!perReq) {
+      perReq = /* @__PURE__ */ new Map();
+      this.execCtxMemo.set(req, perReq);
+    }
+    const cached = perReq.get(key);
+    if (cached) return cached;
+    const pending = this.computeExecCtx(environmentId, req);
+    perReq.set(key, pending);
+    return pending;
+  }
+  /** Heavy path behind `resolveExecCtx` — resolve identity + RBAC/RLS + localization. */
+  async computeExecCtx(environmentId, req) {
     try {
       if (!environmentId && req && this.envRegistry && this.kernelManager) {
         const host = this.extractHostname(req);
@@ -819,6 +852,14 @@ var RestServer = class {
         tenantId: authz.tenantId,
         userId: authz.userId
       });
+      let authGate;
+      try {
+        if (typeof authService.isAuthGateActive === "function" && authService.isAuthGateActive()) {
+          const gatedSession = await getSession(headers).catch(() => void 0);
+          if (gatedSession?.user?.authGate) authGate = gatedSession.user.authGate;
+        }
+      } catch {
+      }
       return {
         userId: authz.userId,
         tenantId: authz.tenantId,
@@ -829,6 +870,7 @@ var RestServer = class {
         ...authz.tabPermissions ? { tabPermissions: authz.tabPermissions } : {},
         isSystem: false,
         org_user_ids: authz.org_user_ids,
+        ...authGate ? { authGate } : {},
         ...localization.timezone ? { timezone: localization.timezone } : {},
         ...localization.locale ? { locale: localization.locale } : {},
         ...localization.currency ? { currency: localization.currency } : {},