@objectstack/rest 9.10.0 → 9.11.0

package/dist/index.js

@@ -770,6 +770,7 @@ var RestServer = class {
       }
       let userId;
       let tenantId;
+      let email;
       const keyPrincipal = await resolveApiKeyPrincipal(identityQl, headers).catch(() => void 0);
       if (keyPrincipal) {
         userId = keyPrincipal.userId;
@@ -780,6 +781,11 @@ var RestServer = class {
         if (!session?.user?.id) return void 0;
         userId = session.user.id;
         tenantId = session.session?.activeOrganizationId ?? void 0;
+        if (session.user?.email) email = String(session.user.email);
+      }
+      if (!email && identityQl && typeof identityQl.find === "function") {
+        const urows = await identityQl.find("sys_user", { where: { id: userId }, limit: 1, context: { isSystem: true } }).catch(() => []);
+        if (urows?.[0]?.email) email = String(urows[0].email);
       }
       try {
         let ql;
@@ -890,6 +896,7 @@ var RestServer = class {
       return {
         userId,
         tenantId,
+        email,
         roles,
         permissions,
         systemPermissions,
@@ -2963,6 +2970,7 @@ var RestServer = class {
             Object.assign(filteredData, rawBody);
           }
           const context = {
+            publicFormGrant: { object: match.object },
             permissions: ["guest_portal"],
             anonymous: true
           };
@@ -4449,6 +4457,11 @@ function createRestApiPlugin(config = {}) {
         const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
+        if (!config.api?.requireAuth) {
+          ctx.logger.warn(
+            "[security] anonymous access to the data API is ALLOWED (api.requireAuth=false) \u2014 objects without OWD/RLS are world-readable. For secure-by-default set api.requireAuth=true and expose public records via share-links / publicSharing (ADR-0056 D2)."
+          );
+        }
       } catch (err) {
         ctx.logger.error("Failed to register REST API routes", { error: err.message });
         throw err;