@objectstack/rest 11.9.0 → 12.0.0

package/dist/index.cjs

@@ -1924,7 +1924,8 @@ var RestServer = class {
         enableSearch: api.enableSearch ?? true,
         enableProjectScoping: api.enableProjectScoping ?? false,
         projectResolution: api.projectResolution ?? "auto",
-        requireAuth: api.requireAuth ?? false,
+        requireAuth: api.requireAuth ?? true,
+        // secure-by-default (ADR-0056 D2; mirrors RestApiConfigSchema)
         documentation: api.documentation,
         responseFormat: api.responseFormat
       },
@@ -5577,9 +5578,14 @@ function createRestApiPlugin(config = {}) {
         const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, serviceExistsProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
-        if (!config.api?.requireAuth) {
+        if (config.api?.api?.requireAuth === false) {
           ctx.logger.warn(
-            "[security] anonymous access to the data API is ALLOWED (api.requireAuth=false) \u2014 objects without OWD/RLS are world-readable. For secure-by-default set api.requireAuth=true and expose public records via share-links / publicSharing (ADR-0056 D2)."
+            "[security] anonymous access to the data API is ALLOWED (api.requireAuth=false, explicit opt-out) \u2014 objects without OWD/RLS are world-readable. Remove the opt-out for secure-by-default and expose public records via share-links / publicSharing / public forms (ADR-0056 D2)."
+          );
+        }
+        if (config.api?.requireAuth !== void 0) {
+          ctx.logger.warn(
+            `[security] \`api.requireAuth\` is set at the WRONG nesting level and has NO effect \u2014 move it to \`api.api.requireAuth\` (RestServerConfig.api.requireAuth). The effective value this boot is ${config.api?.api?.requireAuth ?? true}.`
           );
         }
       } catch (err) {