@objectstack/rest 9.9.1 → 9.11.0

package/dist/index.d.cts

@@ -237,7 +237,8 @@ declare class RestServer {
     private sharingRulesServiceProvider?;
     private i18nServiceProvider?;
     private analyticsServiceProvider?;
-    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
+    private settingsServiceProvider?;
+    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
     /**
      * Resolve the protocol for a given request. When `environmentId` is present
      * and a KernelManager is wired, fetch the per-project kernel's

package/dist/index.d.ts

@@ -237,7 +237,8 @@ declare class RestServer {
     private sharingRulesServiceProvider?;
     private i18nServiceProvider?;
     private analyticsServiceProvider?;
-    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
+    private settingsServiceProvider?;
+    constructor(server: IHttpServer, protocol: ObjectStackProtocol, config?: RestServerConfig, kernelManager?: RestKernelManager, envRegistry?: RestEnvRegistry, defaultEnvironmentIdProvider?: () => string | undefined, authServiceProvider?: (environmentId?: string) => Promise<any | undefined>, objectQLProvider?: (environmentId?: string) => Promise<any | undefined>, emailServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingServiceProvider?: (environmentId?: string) => Promise<any | undefined>, reportsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, approvalsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, sharingRulesServiceProvider?: (environmentId?: string) => Promise<any | undefined>, i18nServiceProvider?: (environmentId?: string) => Promise<any | undefined>, analyticsServiceProvider?: (environmentId?: string) => Promise<any | undefined>, settingsServiceProvider?: (environmentId?: string) => Promise<any | undefined>);
     /**
      * Resolve the protocol for a given request. When `environmentId` is present
      * and a KernelManager is wired, fetch the per-project kernel's

package/dist/index.js

@@ -449,7 +449,7 @@ function rowsToCsv(fields, rows, includeHeader) {
   return lines.join("\r\n") + (lines.length > 0 ? "\r\n" : "");
 }
 var RestServer = class {
-  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider) {
+  constructor(server, protocol, config = {}, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider) {
     /**
      * Short-TTL cache for `hostname → environmentId` (P1-4). `resolveByHostname`
      * is a control-plane lookup (typically a DB query) that otherwise runs on
@@ -480,6 +480,7 @@ var RestServer = class {
     this.sharingRulesServiceProvider = sharingRulesServiceProvider;
     this.i18nServiceProvider = i18nServiceProvider;
     this.analyticsServiceProvider = analyticsServiceProvider;
+    this.settingsServiceProvider = settingsServiceProvider;
   }
   /**
    * Resolve the protocol for a given request. When `environmentId` is present
@@ -769,6 +770,7 @@ var RestServer = class {
       }
       let userId;
       let tenantId;
+      let email;
       const keyPrincipal = await resolveApiKeyPrincipal(identityQl, headers).catch(() => void 0);
       if (keyPrincipal) {
         userId = keyPrincipal.userId;
@@ -779,6 +781,11 @@ var RestServer = class {
         if (!session?.user?.id) return void 0;
         userId = session.user.id;
         tenantId = session.session?.activeOrganizationId ?? void 0;
+        if (session.user?.email) email = String(session.user.email);
+      }
+      if (!email && identityQl && typeof identityQl.find === "function") {
+        const urows = await identityQl.find("sys_user", { where: { id: userId }, limit: 1, context: { isSystem: true } }).catch(() => []);
+        if (urows?.[0]?.email) email = String(urows[0].email);
       }
       try {
         let ql;
@@ -869,14 +876,34 @@ var RestServer = class {
         } catch {
         }
       }
+      let timezone;
+      let locale;
+      try {
+        const settings = this.settingsServiceProvider ? await this.settingsServiceProvider(environmentId).catch(() => void 0) : void 0;
+        if (settings && typeof settings.get === "function") {
+          const sctx = { tenantId, userId };
+          const [tzRes, localeRes] = await Promise.all([
+            settings.get("localization", "timezone", sctx).catch(() => void 0),
+            settings.get("localization", "locale", sctx).catch(() => void 0)
+          ]);
+          const tzVal = tzRes?.value;
+          const localeVal = localeRes?.value;
+          if (typeof tzVal === "string" && tzVal.trim()) timezone = tzVal.trim();
+          if (typeof localeVal === "string" && localeVal.trim()) locale = localeVal.trim();
+        }
+      } catch {
+      }
       return {
         userId,
         tenantId,
+        email,
         roles,
         permissions,
         systemPermissions,
         isSystem: false,
-        org_user_ids
+        org_user_ids,
+        ...timezone ? { timezone } : {},
+        ...locale ? { locale } : {}
       };
     } catch {
       return void 0;
@@ -2943,6 +2970,7 @@ var RestServer = class {
             Object.assign(filteredData, rawBody);
           }
           const context = {
+            publicFormGrant: { object: match.object },
             permissions: ["guest_portal"],
             anonymous: true
           };
@@ -4409,6 +4437,13 @@ function createRestApiPlugin(config = {}) {
           return void 0;
         }
       };
+      const settingsServiceProvider = async (_environmentId) => {
+        try {
+          return ctx.getService("settings");
+        } catch {
+          return void 0;
+        }
+      };
       if (!server) {
         ctx.logger.warn(`RestApiPlugin: HTTP Server service '${serverService}' not found. REST routes skipped.`);
         return;
@@ -4419,9 +4454,14 @@ function createRestApiPlugin(config = {}) {
       }
       ctx.logger.info("Hydrating REST API from Protocol...");
       try {
-        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider);
+        const restServer = new RestServer(server, protocol, config.api, kernelManager, envRegistry, defaultEnvironmentIdProvider, authServiceProvider, objectQLProvider, emailServiceProvider, sharingServiceProvider, reportsServiceProvider, approvalsServiceProvider, sharingRulesServiceProvider, i18nServiceProvider, analyticsServiceProvider, settingsServiceProvider);
         restServer.registerRoutes();
         ctx.logger.info("REST API successfully registered");
+        if (!config.api?.requireAuth) {
+          ctx.logger.warn(
+            "[security] anonymous access to the data API is ALLOWED (api.requireAuth=false) \u2014 objects without OWD/RLS are world-readable. For secure-by-default set api.requireAuth=true and expose public records via share-links / publicSharing (ADR-0056 D2)."
+          );
+        }
       } catch (err) {
         ctx.logger.error("Failed to register REST API routes", { error: err.message });
         throw err;