@objectstack/runtime 9.5.1 → 9.6.0

package/dist/index.js

@@ -1,7 +1,12 @@
 var __defProp = Object.defineProperty;
 var __getOwnPropNames = Object.getOwnPropertyNames;
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+var __esm = (fn, res, err) => function __init() {
+  if (err) throw err[0];
+  try {
+    return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+  } catch (e) {
+    throw err = [e], e;
+  }
 };
 var __export = (target, all) => {
   for (var name in all)
@@ -1207,7 +1212,8 @@ var init_app_plugin = __esm({
             "ragPipelines",
             "data",
             "emailTemplates",
-            "docs"
+            "docs",
+            "books"
           ];
           const hasAppPayload = APP_CATEGORY_KEYS.some((k) => {
             const v = (bundle && bundle[k]) ?? (sys && sys[k]);
@@ -1860,6 +1866,35 @@ import { getEnv, resolveLocale } from "@objectstack/core";
 import { CoreServiceName } from "@objectstack/spec/system";
 import { pluralToSingular, PLURAL_TO_SINGULAR } from "@objectstack/spec/shared";
 
+// src/api-exposure.ts
+var ACTION_TO_API_METHOD = {
+  create: "create",
+  get: "get",
+  update: "update",
+  delete: "delete",
+  query: "list",
+  find: "list",
+  batch: "bulk"
+};
+function checkApiExposure(def, action) {
+  if (!def) return { allowed: true };
+  if (def.apiEnabled === false) {
+    return { allowed: false, status: 404, reason: "object is not exposed via the API" };
+  }
+  const whitelist = def.apiMethods;
+  if (Array.isArray(whitelist) && whitelist.length > 0) {
+    const method = ACTION_TO_API_METHOD[action];
+    if (method && !whitelist.includes(method)) {
+      return {
+        allowed: false,
+        status: 405,
+        reason: `API operation '${method}' is not allowed for this object`
+      };
+    }
+  }
+  return { allowed: true };
+}
+
 // src/security/api-key.ts
 import {
   API_KEY_PREFIX,
@@ -2148,6 +2183,19 @@ var _HttpDispatcher = class _HttpDispatcher {
    * @param scopeId - Optional project ID for scoped service resolution (SharedProjectPlugin mode)
    */
   async callData(action, params, dataDriver, scopeId, executionContext) {
+    if (!executionContext?.isSystem && params?.object) {
+      let def;
+      try {
+        const meta = await this.resolveService("metadata", scopeId);
+        def = await meta?.getObject?.(params.object);
+      } catch {
+        def = void 0;
+      }
+      const gate = checkApiExposure(def, action);
+      if (!gate.allowed) {
+        throw { statusCode: gate.status ?? 403, message: gate.reason ?? "API access denied" };
+      }
+    }
     const protocol = await this.resolveService("protocol", scopeId);
     const qlService = dataDriver ?? await this.getObjectQLService(scopeId);
     const ql = qlService ?? await this.resolveService("objectql", scopeId);