@objectstack/runtime 14.3.0 → 14.6.0

package/dist/index.cjs

@@ -2161,7 +2161,7 @@ function safeGet(ctx, name) {
 var import_core5 = require("@objectstack/core");
 var import_types3 = require("@objectstack/types");
 var import_system = require("@objectstack/spec/system");
-var import_ai = require("@objectstack/spec/ai");
+var import_ai2 = require("@objectstack/spec/ai");
 var import_shared2 = require("@objectstack/spec/shared");
 init_package_state_store();
 
@@ -2195,6 +2195,7 @@ function checkApiExposure(def, action) {
 }
 
 // src/security/resolve-execution-context.ts
+var import_ai = require("@objectstack/spec/ai");
 var import_core3 = require("@objectstack/core");
 function extractJwtBearer(headers) {
   const auth = headers.get("authorization");
@@ -2255,7 +2256,15 @@ async function resolveExecutionContext(opts) {
     isSystem: false
   };
   if (authz.userId) {
-    ctx.principalKind = "human";
+    if (oauthPrincipal?.clientId) {
+      ctx.principalKind = "agent";
+      ctx.onBehalfOf = { userId: authz.userId, principalKind: "human" };
+      ctx.permissions = (0, import_ai.scopesToAgentPermissionSets)(oauthPrincipal.scopes);
+      ctx.positions = [];
+      ctx.systemPermissions = oauthPrincipal.scopes?.includes(import_ai.MCP_OAUTH_SCOPE_ACTIONS) ? authz.systemPermissions ?? [] : [];
+    } else {
+      ctx.principalKind = "human";
+    }
   } else {
     ctx.principalKind = "guest";
     ctx.positions = ["guest"];
@@ -2331,6 +2340,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       }
     };
     this.enforceMembership = options?.enforceProjectMembership ?? true;
+    this.requireAuth = options?.requireAuth ?? false;
     this.kernelResolver = options?.kernelResolver ?? resolveService("kernel-resolver");
     this.scopeManager = options?.scopeManager ?? resolveService("scope-manager");
   }
@@ -2548,14 +2558,14 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response };
     }
     const grantedScopes = Array.isArray(ec.oauthScopes) ? ec.oauthScopes : void 0;
-    if (grantedScopes && !grantedScopes.some((s) => import_ai.MCP_OAUTH_SCOPES.includes(s))) {
+    if (grantedScopes && !grantedScopes.some((s) => import_ai2.MCP_OAUTH_SCOPES.includes(s))) {
       const resourceMetadataUrl = await this.getMcpResourceMetadataUrl(context);
       const response = this.error(
-        `Forbidden: the access token grants none of the MCP scopes (${import_ai.MCP_OAUTH_SCOPES.join(", ")})`,
+        `Forbidden: the access token grants none of the MCP scopes (${import_ai2.MCP_OAUTH_SCOPES.join(", ")})`,
         403
       );
       response.headers = {
-        "WWW-Authenticate": `Bearer error="insufficient_scope", scope="${import_ai.MCP_OAUTH_SCOPES.join(" ")}"` + (resourceMetadataUrl ? `, resource_metadata="${resourceMetadataUrl}"` : "")
+        "WWW-Authenticate": `Bearer error="insufficient_scope", scope="${import_ai2.MCP_OAUTH_SCOPES.join(" ")}"` + (resourceMetadataUrl ? `, resource_metadata="${resourceMetadataUrl}"` : "")
       };
       return { handled: true, response };
     }
@@ -3496,6 +3506,15 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Fallback for backward compat: /metadata (all objects), /metadata/:objectName (get object)
    */
   async handleMetadata(path, _context, method, body, query) {
+    if (this.requireAuth) {
+      const ec = _context.executionContext;
+      if (!ec?.userId && !ec?.isSystem) {
+        return {
+          handled: true,
+          response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+        };
+      }
+    }
     const parts = path.replace(/^\/+/, "").split("/").filter(Boolean);
     if (parts[0] === "types") {
       const protocol = await this.resolveService("protocol");
@@ -3795,13 +3814,13 @@ var _HttpDispatcher = class _HttpDispatcher {
    * Handles Analytics requests
    * path: sub-path after /analytics/
    */
-  async handleAnalytics(path, method, body, _context) {
+  async handleAnalytics(path, method, body, context) {
     const analyticsService = await this.getService(import_system.CoreServiceName.enum.analytics);
     if (!analyticsService) return { handled: false };
     const m = method.toUpperCase();
     const subPath = path.replace(/^\/+/, "");
     if (subPath === "query" && m === "POST") {
-      const result = await analyticsService.query(body);
+      const result = await analyticsService.query(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "meta" && m === "GET") {
@@ -3809,7 +3828,7 @@ var _HttpDispatcher = class _HttpDispatcher {
       return { handled: true, response: this.success(result) };
     }
     if (subPath === "sql" && m === "POST") {
-      const result = await analyticsService.generateSql(body);
+      const result = await analyticsService.generateSql(body, context?.executionContext);
       return { handled: true, response: this.success(result) };
     }
     return { handled: false };
@@ -4997,6 +5016,15 @@ var _HttpDispatcher = class _HttpDispatcher {
       if (route.method !== method) continue;
       const params = matchRoute(route.path, fullPath);
       if (params === null) continue;
+      if (this.requireAuth && route.auth !== false) {
+        const gec = context.executionContext;
+        if (!gec?.userId && !gec?.isSystem) {
+          return {
+            handled: true,
+            response: this.error("Authentication is required to access this endpoint.", 401, { code: "unauthenticated" })
+          };
+        }
+      }
       const ec = context.executionContext;
       const user = ec?.userId ? {
         userId: ec.userId,
@@ -5719,7 +5747,7 @@ function resolveErrorReporter(ctx, override) {
 }
 
 // src/dispatcher-plugin.ts
-function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser) {
+function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUser, requireAuth = false) {
   const handler = async (req, res) => {
     try {
       let user;
@@ -5729,6 +5757,17 @@ function mountRouteOnServer(route, server, routePath, securityHeaders, resolveUs
         } catch {
         }
       }
+      if (requireAuth && route.auth !== false && !user) {
+        res.status(401);
+        if (securityHeaders) {
+          for (const [k, v] of Object.entries(securityHeaders)) res.header(k, v);
+        }
+        res.json({
+          error: "unauthenticated",
+          message: "Authentication is required to access this endpoint."
+        });
+        return;
+      }
       const result = await route.handler({
         body: req.body,
         params: req.params,
@@ -5912,8 +5951,10 @@ function createDispatcherPlugin(config = {}) {
       if (!server) return;
       const kernel = ctx.getKernel();
       const enforceMembership = config.enforceProjectMembership ?? (config.scoping?.enableProjectScoping ?? false);
+      const requireAuth = config.requireAuth ?? config.scoping?.requireAuth ?? false;
       const dispatcher = new HttpDispatcher(kernel, void 0, {
-        enforceProjectMembership: enforceMembership
+        enforceProjectMembership: enforceMembership,
+        requireAuth
       });
       const prefix = config.prefix || "/api/v1";
       const securityHeaders = config.securityHeaders === false ? void 0 : buildSecurityHeaders(
@@ -6423,11 +6464,11 @@ function createDispatcherPlugin(config = {}) {
         const routePath = route.path.startsWith("/api/v1") ? route.path : `${prefix}${route.path}`;
         let count = 0;
         if (enableProjectScoping && projectResolution === "required") {
-          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
         } else {
-          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser)) count++;
+          if (mountRouteOnServer(route, server, routePath, securityHeaders, resolveRequestUser, requireAuth)) count++;
           if (enableProjectScoping) {
-            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser)) count++;
+            if (mountRouteOnServer(route, server, toScopedPath(routePath), securityHeaders, resolveRequestUser, requireAuth)) count++;
           }
         }
         return count;