@objectstack/runtime 10.2.0 → 10.3.0

package/dist/index.cjs

@@ -1593,6 +1593,7 @@ async function createStandaloneStack(config) {
     );
   } else {
     const { createDefaultDatasourceDriverFactory } = await import("@objectstack/service-datasource");
+    const factoryDev = cfg.dev ?? process.env.NODE_ENV === "development";
     let driverId;
     let driverConfig;
     if (dbDriver === "memory") {
@@ -1617,7 +1618,7 @@ async function createStandaloneStack(config) {
     }
     let driverHandle;
     try {
-      driverHandle = await createDefaultDatasourceDriverFactory().create({ driver: driverId, config: driverConfig });
+      driverHandle = await createDefaultDatasourceDriverFactory({ dev: factoryDev }).create({ driver: driverId, config: driverConfig });
     } catch (err) {
       if (dbDriver === "mongodb") {
         throw new Error(
@@ -1707,7 +1708,14 @@ var init_standalone_stack = __esm({
        * Explicit `databaseUrl` / `OS_DATABASE_URL` / `OS_HOME` still take
        * precedence over this default.
        */
-      projectRoot: import_zod.z.string().optional()
+      projectRoot: import_zod.z.string().optional(),
+      /**
+       * Dev gate for the sqlite driver factory's native-better-sqlite3 → wasm →
+       * in-memory step-down (#2229). When omitted, defaults to
+       * `process.env.NODE_ENV === 'development'`. In production a native load
+       * failure is NOT silently swapped for wasm/mingo (fail-closed).
+       */
+      dev: import_zod.z.boolean().optional()
     });
   }
 });
@@ -2233,14 +2241,12 @@ async function resolveExecutionContext(opts) {
   } else {
     ctx.org_user_ids = [userId];
   }
-  const upsRows = await tryFind(
-    ql,
-    "sys_user_permission_set",
-    tenantId ? { user_id: userId, organization_id: tenantId } : { user_id: userId },
-    100
-  );
+  const upsRows = await tryFind(ql, "sys_user_permission_set", { user_id: userId }, 100);
   const psIds = new Set(
-    upsRows.map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
+    upsRows.filter((r) => {
+      const org = r.organization_id ?? r.organizationId ?? null;
+      return !(org && tenantId && org !== tenantId);
+    }).map((r) => r.permission_set_id ?? r.permissionSetId).filter(Boolean)
   );
   if (ctx.roles.length > 0) {
     const roleRows = await tryFind(ql, "sys_role", { name: { $in: ctx.roles } }, 100);
@@ -4246,6 +4252,28 @@ var _HttpDispatcher = class _HttpDispatcher {
     if (!ql || typeof ql.executeAction !== "function") {
       return { handled: true, response: this.error("Data engine not available", 503) };
     }
+    try {
+      const actionSchema = (typeof ql.getSchema === "function" ? ql.getSchema(objectName) : void 0) ?? ql.registry?.getObject?.(objectName);
+      const actionDef = Array.isArray(actionSchema?.actions) ? actionSchema.actions.find((a) => a?.name === actionName) : void 0;
+      const required = Array.isArray(actionDef?.requiredPermissions) ? actionDef.requiredPermissions : [];
+      if (required.length > 0) {
+        const execCtx = _context?.executionContext;
+        if (!execCtx?.isSystem) {
+          const held = new Set(execCtx?.systemPermissions ?? []);
+          const missing = required.filter((perm) => !held.has(perm));
+          if (missing.length > 0) {
+            return {
+              handled: true,
+              response: this.error(
+                `Action '${actionName}' on '${objectName}' requires capability [${required.join(", ")}] \u2014 caller is missing [${missing.join(", ")}]`,
+                403
+              )
+            };
+          }
+        }
+      }
+    } catch {
+    }
     const tryExecute = async (obj) => {
       return ql.executeAction(obj, actionName, actionContext);
     };
@@ -5298,6 +5326,14 @@ function createDispatcherPlugin(config = {}) {
           errorResponse(err, res);
         }
       });
+      server.get(`${prefix}/ready`, async (_req, res) => {
+        try {
+          const result = await dispatcher.dispatch("GET", "/ready", void 0, {}, { request: _req });
+          sendResult(result, res);
+        } catch (err) {
+          errorResponse(err, res);
+        }
+      });
       server.post(`${prefix}/auth/login`, async (req, res) => {
         try {
           const result = await dispatcher.handleAuth("login", "POST", req.body, { request: req });