@omnifyjp/omnify 5.8.12 → 5.8.14

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnifyjp/omnify",
-  "version": "5.8.12",
+  "version": "5.8.14",
   "description": "Schema-driven code generation for Laravel, TypeScript, and SQL",
   "license": "MIT",
   "repository": {
@@ -36,10 +36,10 @@
     "zod": "^3.24.0"
   },
   "optionalDependencies": {
-    "@omnifyjp/omnify-darwin-arm64": "5.8.12",
-    "@omnifyjp/omnify-darwin-x64": "5.8.12",
-    "@omnifyjp/omnify-linux-x64": "5.8.12",
-    "@omnifyjp/omnify-linux-arm64": "5.8.12",
-    "@omnifyjp/omnify-win32-x64": "5.8.12"
+    "@omnifyjp/omnify-darwin-arm64": "5.8.14",
+    "@omnifyjp/omnify-darwin-x64": "5.8.14",
+    "@omnifyjp/omnify-linux-x64": "5.8.14",
+    "@omnifyjp/omnify-linux-arm64": "5.8.14",
+    "@omnifyjp/omnify-win32-x64": "5.8.14"
   }
 }

package/ts-dist/php/policy-generator.d.ts

@@ -7,7 +7,25 @@
 import { SchemaReader } from './schema-reader.js';
 import type { GeneratedFile, PhpConfig } from './types.js';
 import type { SchemaDefinition, SingleCondition } from '../types.js';
-/** Generate Laravel Policy classes for all schemas that have policies. */
+/** Generate Laravel Policy classes for project-owned visible schemas.
+ *
+ * Issue #98 v5.8.14: every `kind: object` schema now gets a generated
+ * policy base + editable stub by default — Laravel's policy
+ * auto-discovery (`App\\Models\\<Name>` → `App\\Policies\\<Name>Policy`)
+ * works out of the box without per-project Gate::policy(...) wiring.
+ *
+ * Skip rules:
+ *   - `kind: pivot` — pivots have no API surface
+ *   - `options.policy: false` — explicit per-schema opt-out
+ *
+ * Two code paths per schema:
+ *   - Explicit Cedar-style `policies: [...]` → existing rule-based body
+ *     generator (forbid / permit / when conditions).
+ *   - No `policies:` declared → standard CRUD scaffolding (viewAny /
+ *     view / create / update / delete + restore / forceDelete on
+ *     softDelete). Default body: `return true;`. Project secures by
+ *     overriding the method in the editable child.
+ */
 export declare function generatePolicies(reader: SchemaReader, config: PhpConfig): GeneratedFile[];
 /** Convert a single condition to a PHP expression. */
 export declare function conditionToPhp(cond: SingleCondition, schema: SchemaDefinition, reader: SchemaReader): string;

package/ts-dist/php/policy-generator.js

@@ -24,11 +24,31 @@ const RECORD_ACTIONS = new Set(['view', 'edit', 'delete']);
 // ============================================================================
 // Public API
 // ============================================================================
-/** Generate Laravel Policy classes for all schemas that have policies. */
+/** Generate Laravel Policy classes for project-owned visible schemas.
+ *
+ * Issue #98 v5.8.14: every `kind: object` schema now gets a generated
+ * policy base + editable stub by default — Laravel's policy
+ * auto-discovery (`App\\Models\\<Name>` → `App\\Policies\\<Name>Policy`)
+ * works out of the box without per-project Gate::policy(...) wiring.
+ *
+ * Skip rules:
+ *   - `kind: pivot` — pivots have no API surface
+ *   - `options.policy: false` — explicit per-schema opt-out
+ *
+ * Two code paths per schema:
+ *   - Explicit Cedar-style `policies: [...]` → existing rule-based body
+ *     generator (forbid / permit / when conditions).
+ *   - No `policies:` declared → standard CRUD scaffolding (viewAny /
+ *     view / create / update / delete + restore / forceDelete on
+ *     softDelete). Default body: `return true;`. Project secures by
+ *     overriding the method in the editable child.
+ */
 export function generatePolicies(reader, config) {
     const files = [];
     for (const [name, schema] of Object.entries(reader.getProjectVisibleObjectSchemas())) {
-        if (!schema.policies || schema.policies.length === 0)
+        if (schema.kind === 'pivot')
+            continue;
+        if (schema.options?.policy === false)
             continue;
         files.push(...generateForSchema(name, schema, reader, config));
     }
@@ -46,31 +66,49 @@ function generateForSchema(name, schema, reader, config) {
 function generateBasePolicyClass(name, schema, reader, config) {
     const modelName = toPascalCase(name);
     const baseNamespace = resolveModularBaseNamespace(config, name, 'Policies', config.policies.baseNamespace);
-    // Issue #98 v5.8.4: legacy structure groups Models by folder. The
-    // policy's `use ${modelNamespace}\\${modelName}` import must include
-    // the schema's group too, otherwise the policy fails to autoload at
-    // runtime when Laravel resolves it from the gate registration.
+    // Issue #98 v5.8.13: policy method signatures (`view(User $user,
+    // <Model> $record): bool`) must type-hint the USER-EDITABLE Model
+    // class. Same root cause + fix as the v5.8.11 service / controller
+    // signature fix — when the user-editable policy child overrides a
+    // base method with the editable Model type, PHP signature
+    // contravariance fires with a Fatal compile error if the parent
+    // typed against the BASE Model. Modular structure: per-Schema
+    // isolation already aligns base + editable on one namespace.
     const modelNamespace = config.structure === 'modular'
         ? config.models.namespace
-        : nestByGroup({ path: '', namespace: config.models.namespace }, schema.group).namespace;
-    const policies = schema.policies;
+        : (config.models.userEditableGroupByFolder
+            ? nestByGroup({ path: '', namespace: config.models.userEditableNamespace }, schema.group).namespace
+            : config.models.userEditableNamespace);
+    // Issue #98 v5.8.14: when no Cedar-style `policies:` array is defined,
+    // emit the standard CRUD scaffold with `return true;` bodies.
+    // The project secures the policy by overriding methods in the
+    // editable child (e.g. `return $user->hasPermission('manage.banner');`).
+    const policies = schema.policies ?? [];
+    const hasExplicitPolicies = policies.length > 0;
     const hasSoftDelete = schema.options?.softDelete ?? false;
-    const needsCidrHelper = policiesUseCidr(policies);
-    // Collect all actions that have policies
-    const expandedPolicies = expandWildcards(policies);
+    const needsCidrHelper = hasExplicitPolicies ? policiesUseCidr(policies) : false;
+    // Collect all actions that have policies (only relevant for the
+    // explicit-policy path; standard CRUD doesn't need wildcard expansion).
+    const expandedPolicies = hasExplicitPolicies ? expandWildcards(policies) : policies;
     // Build methods
     const methods = [];
     for (const action of ALL_ACTIONS) {
         const methodName = ACTION_METHOD_MAP[action];
         const hasRecord = RECORD_ACTIONS.has(action);
-        const body = generateMethodBody(action, expandedPolicies, schema, reader, hasRecord);
+        const body = hasExplicitPolicies
+            ? generateMethodBody(action, expandedPolicies, schema, reader, hasRecord)
+            : '        return true;';
         methods.push(buildMethod(methodName, modelName, hasRecord, body));
     }
     // SoftDelete: restore + forceDelete
     if (hasSoftDelete) {
-        const restoreBody = generateMethodBody('delete', expandedPolicies, schema, reader);
+        const restoreBody = hasExplicitPolicies
+            ? generateMethodBody('delete', expandedPolicies, schema, reader)
+            : '        return true;';
         methods.push(buildMethod('restore', modelName, true, restoreBody));
-        const forceDeleteBody = generateMethodBody('delete', expandedPolicies, schema, reader);
+        const forceDeleteBody = hasExplicitPolicies
+            ? generateMethodBody('delete', expandedPolicies, schema, reader)
+            : '        return true;';
         methods.push(buildMethod('forceDelete', modelName, true, forceDeleteBody));
     }
     const cidrHelper = needsCidrHelper ? buildCidrHelper() : '';

package/ts-dist/types.d.ts

@@ -208,6 +208,17 @@ export interface SchemaOptions {
      * generate time).
      */
     readonly service?: ServiceOptions | false;
+    /**
+     * Per-schema opt-out for the auto-generated Policy. Issue #98 v5.8.14:
+     * every `kind: object` schema gets a generated policy base + editable
+     * stub by default. Set `policy: false` on schemas that should NOT have
+     * an authorization policy (translation tables, internal sidecars, etc).
+     * Cedar-style ABAC `policies:` array on the root schema definition
+     * still drives the generated method bodies when present; otherwise the
+     * generator emits a standard 5-method CRUD scaffold with
+     * `return true;` bodies for the project to override in the editable.
+     */
+    readonly policy?: false;
     /** Schema-level default ordering — generates a global Eloquent scope. Issue #40. */
     readonly defaultOrder?: readonly OrderByItem[];
 }