@objectstack/rest 9.11.0 → 10.2.0

package/dist/index.d.cts

@@ -238,7 +238,11 @@ declare class RestServer {
     private i18nServiceProvider?;
     private analyticsServiceProvider?;
     private settingsServiceProvider?;
-    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
+    /** Sync probe: is a kernel service registered? Single-env path for nav
+     *  capability gates (ADR-0057 D10) — resolveExecCtx sets no kernel in
+     *  single-kernel deployments, so this prevents the gate failing open. */
+    private serviceExistsProvider?;
+    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, serviceExistsProvider?: (name: string) => boolean);
     /**
      * Resolve the protocol for a given request. When `environmentId` is present
      * and a KernelManager is wired, fetch the per-project kernel's
@@ -340,6 +344,14 @@ declare class RestServer {
      * is never mutated so cached metadata stays clean.
      */
     private filterAppForUser;
+    /**
+     * Probe which `requiresService` capability gates referenced anywhere in
+     * `items` are actually registered in the runtime kernel. Returns `null`
+     * when the kernel can't be probed — callers then SKIP service gating
+     * (fail-open, matching the prior "send everything, let the client hide"
+     * behaviour). ADR-0057 addendum D10.
+     */
+    private resolveRegisteredServices;
     /**
      * Build a `TranslationBundle` (`Record<locale, TranslationData>`) from an
      * `II18nService` instance. Returns `undefined` when no locales are

package/dist/index.d.ts

@@ -238,7 +238,11 @@ declare class RestServer {
     private i18nServiceProvider?;
     private analyticsServiceProvider?;
     private settingsServiceProvider?;
-    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
+    /** Sync probe: is a kernel service registered? Single-env path for nav
+     *  capability gates (ADR-0057 D10) — resolveExecCtx sets no kernel in
+     *  single-kernel deployments, so this prevents the gate failing open. */
+    private serviceExistsProvider?;
+    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, serviceExistsProvider?: (name: string) => boolean);
     /**
      * Resolve the protocol for a given request. When `environmentId` is present
      * and a KernelManager is wired, fetch the per-project kernel's
@@ -340,6 +344,14 @@ declare class RestServer {
      * is never mutated so cached metadata stays clean.
      */
     private filterAppForUser;
+    /**
+     * Probe which `requiresService` capability gates referenced anywhere in
+     * `items` are actually registered in the runtime kernel. Returns `null`
+     * when the kernel can't be probed — callers then SKIP service gating
+     * (fail-open, matching the prior "send everything, let the client hide"
+     * behaviour). ADR-0057 addendum D10.
+     */
+    private resolveRegisteredServices;
     /**
      * Build a `TranslationBundle` (`Record<locale, TranslationData>`) from an
      * `II18nService` instance. Returns `undefined` when no locales are

package/dist/index.js

@@ -308,6 +308,7 @@ function mapDataError(error, object) {
         error: `${field} is required`,
         code: "VALIDATION_FAILED",
         fields: [{ field, code: "required", message: `${field} is required` }],
+        hint: `If '${field}' is optional in your object metadata, the database column is still NOT NULL \u2014 the physical schema has drifted from metadata. Run 'os migrate' to reconcile (or reset the dev database).`,
         ...object ? { object } : {}
       }
     };
@@ -449,7 +450,7 @@ function rowsToCsv(fields, rows, includeHeader) {
   return lines.join("\r\n") + (lines.length > 0 ? "\r\n" : "");
 }
 var RestServer = class {
-  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider) {
+  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, serviceExistsProvider) {
     /**
      * Short-TTL cache for `hostname → environmentId` (P1-4). `resolveByHostname`
      * is a control-plane lookup (typically a DB query) that otherwise runs on
@@ -481,6 +482,7 @@ var RestServer = class {
     this.i18nServiceProvider = i18nServiceProvider;
     this.analyticsServiceProvider = analyticsServiceProvider;
     this.settingsServiceProvider = settingsServiceProvider;
+    this.serviceExistsProvider = serviceExistsProvider;
   }
   /**
    * Resolve the protocol for a given request. When `environmentId` is present
@@ -878,18 +880,22 @@ var RestServer = class {
       }
       let timezone;
       let locale;
+      let currency;
       try {
         const settings = this.settingsServiceProvider ? await this.settingsServiceProvider(environmentId).catch(() => void 0) : void 0;
         if (settings && typeof settings.get === "function") {
           const sctx = { tenantId, userId };
-          const [tzRes, localeRes] = await Promise.all([
+          const [tzRes, localeRes, currencyRes] = await Promise.all([
             settings.get("localization", "timezone", sctx).catch(() => void 0),
-            settings.get("localization", "locale", sctx).catch(() => void 0)
+            settings.get("localization", "locale", sctx).catch(() => void 0),
+            settings.get("localization", "currency", sctx).catch(() => void 0)
           ]);
           const tzVal = tzRes?.value;
           const localeVal = localeRes?.value;
+          const currencyVal = currencyRes?.value;
           if (typeof tzVal === "string" && tzVal.trim()) timezone = tzVal.trim();
           if (typeof localeVal === "string" && localeVal.trim()) locale = localeVal.trim();
+          if (typeof currencyVal === "string" && currencyVal.trim()) currency = currencyVal.trim().toUpperCase();
         }
       } catch {
       }
@@ -903,7 +909,12 @@ var RestServer = class {
         isSystem: false,
         org_user_ids,
         ...timezone ? { timezone } : {},
-        ...locale ? { locale } : {}
+        ...locale ? { locale } : {},
+        ...currency ? { currency } : {},
+        // Internal: resolved kernel so the nav-serving path can probe
+        // requiresService capability gates (ADR-0057 D10). NOT an
+        // authorization input — never read by RLS/permission logic.
+        __kernel: kernel
       };
     } catch {
       return void 0;
@@ -922,8 +933,12 @@ var RestServer = class {
    * shallow copy with a filtered `navigation` tree otherwise — the original
    * is never mutated so cached metadata stays clean.
    */
-  filterAppForUser(item, sysPerms) {
+  filterAppForUser(item, sysPerms, serviceGate) {
     if (!item || typeof item !== "object") return item;
+    if (isMetaEnvelope(item)) {
+      const body = this.filterAppForUser(item.item, sysPerms, serviceGate);
+      return body == null ? null : { ...item, item: body };
+    }
     if (item.hidden === true && !sysPerms.has("studio.access") && !sysPerms.has("setup.access")) {
       return null;
     }
@@ -931,6 +946,9 @@ var RestServer = class {
     if (reqApp.length > 0 && !reqApp.every((p) => sysPerms.has(p))) {
       return null;
     }
+    if (typeof item.requiresService === "string" && serviceGate && serviceGate(item.requiresService) === false) {
+      return null;
+    }
     const nav = Array.isArray(item.navigation) ? item.navigation : null;
     if (!nav) return item;
     const filterNav = (entries) => {
@@ -939,6 +957,7 @@ var RestServer = class {
         if (!e || typeof e !== "object") continue;
         const req = Array.isArray(e.requiredPermissions) ? e.requiredPermissions : [];
         if (req.length > 0 && !req.every((p) => sysPerms.has(p))) continue;
+        if (typeof e.requiresService === "string" && serviceGate && serviceGate(e.requiresService) === false) continue;
         if (Array.isArray(e.children) && e.children.length > 0) {
           const kids = filterNav(e.children);
           if (e.type === "group" && kids.length === 0) continue;
@@ -951,6 +970,53 @@ var RestServer = class {
     };
     return { ...item, navigation: filterNav(nav) };
   }
+  /**
+   * Probe which `requiresService` capability gates referenced anywhere in
+   * `items` are actually registered in the runtime kernel. Returns `null`
+   * when the kernel can't be probed — callers then SKIP service gating
+   * (fail-open, matching the prior "send everything, let the client hide"
+   * behaviour). ADR-0057 addendum D10.
+   */
+  async resolveRegisteredServices(kernel, items) {
+    let probe = null;
+    if (kernel && typeof kernel.getServiceAsync === "function") {
+      probe = async (name) => {
+        try {
+          return await kernel.getServiceAsync(name) != null;
+        } catch {
+          return false;
+        }
+      };
+    } else if (this.serviceExistsProvider) {
+      const exists = this.serviceExistsProvider;
+      probe = async (name) => {
+        try {
+          return exists(name) === true;
+        } catch {
+          return false;
+        }
+      };
+    }
+    if (!probe) return null;
+    const wanted = /* @__PURE__ */ new Set();
+    const walk = (e) => {
+      if (!e || typeof e !== "object") return;
+      if (isMetaEnvelope(e)) {
+        walk(e.item);
+        return;
+      }
+      if (typeof e.requiresService === "string") wanted.add(e.requiresService);
+      const kids = Array.isArray(e.navigation) ? e.navigation : Array.isArray(e.children) ? e.children : null;
+      if (kids) for (const k of kids) walk(k);
+    };
+    for (const it of items) walk(it);
+    if (wanted.size === 0) return /* @__PURE__ */ new Set();
+    const registered = /* @__PURE__ */ new Set();
+    for (const name of wanted) {
+      if (await probe(name)) registered.add(name);
+    }
+    return registered;
+  }
   /**
    * Build a `TranslationBundle` (`Record<locale, TranslationData>`) from an
    * `II18nService` instance. Returns `undefined` when no locales are
@@ -1561,7 +1627,9 @@ var RestServer = class {
                   const sysPerms = new Set(
                     Array.isArray(ctx.systemPermissions) ? ctx.systemPermissions : []
                   );
-                  const filtered = list.map((it) => this.filterAppForUser(it, sysPerms)).filter((it) => it != null);
+                  const registered = await this.resolveRegisteredServices(ctx.__kernel, list);
+                  const serviceGate = registered ? (n) => registered.has(n) : void 0;
+                  const filtered = list.map((it) => this.filterAppForUser(it, sysPerms, serviceGate)).filter((it) => it != null);
                   visible = Array.isArray(raw) ? filtered : { ...raw, items: filtered };
                 }
               }
@@ -1761,7 +1829,9 @@ var RestServer = class {
                   const sysPerms = new Set(
                     Array.isArray(ctx.systemPermissions) ? ctx.systemPermissions : []
                   );
-                  visible = this.filterAppForUser(item, sysPerms);
+                  const registered = await this.resolveRegisteredServices(ctx.__kernel, [item]);
+                  const serviceGate = registered ? (n) => registered.has(n) : void 0;
+                  visible = this.filterAppForUser(item, sysPerms, serviceGate);
                   if (visible == null) {
                     res.status(404).json({
                       error: "not_found",
@@ -4453,8 +4523,15 @@ function createRestApiPlugin(config = {}) {
         return;
       }
       ctx.logger.info("Hydrating REST API from Protocol...");
+      const serviceExistsProvider = (name) => {
+        try {
+          return ctx.getService(name) != null;
+        } catch {
+          return false;
+        }
+      };
       try {
-        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider);
+        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider, serviceExistsProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
         if (!config.api?.requireAuth) {