@omnifyjp/ts 5.8.13 → 5.8.14

package/dist/php/policy-generator.d.ts

@@ -7,7 +7,25 @@
 import { SchemaReader } from './schema-reader.js';
 import type { GeneratedFile, PhpConfig } from './types.js';
 import type { SchemaDefinition, SingleCondition } from '../types.js';
-/** Generate Laravel Policy classes for all schemas that have policies. */
+/** Generate Laravel Policy classes for project-owned visible schemas.
+ *
+ * Issue #98 v5.8.14: every `kind: object` schema now gets a generated
+ * policy base + editable stub by default — Laravel's policy
+ * auto-discovery (`App\\Models\\<Name>` → `App\\Policies\\<Name>Policy`)
+ * works out of the box without per-project Gate::policy(...) wiring.
+ *
+ * Skip rules:
+ *   - `kind: pivot` — pivots have no API surface
+ *   - `options.policy: false` — explicit per-schema opt-out
+ *
+ * Two code paths per schema:
+ *   - Explicit Cedar-style `policies: [...]` → existing rule-based body
+ *     generator (forbid / permit / when conditions).
+ *   - No `policies:` declared → standard CRUD scaffolding (viewAny /
+ *     view / create / update / delete + restore / forceDelete on
+ *     softDelete). Default body: `return true;`. Project secures by
+ *     overriding the method in the editable child.
+ */
 export declare function generatePolicies(reader: SchemaReader, config: PhpConfig): GeneratedFile[];
 /** Convert a single condition to a PHP expression. */
 export declare function conditionToPhp(cond: SingleCondition, schema: SchemaDefinition, reader: SchemaReader): string;

package/dist/php/policy-generator.js

@@ -24,11 +24,31 @@ const RECORD_ACTIONS = new Set(['view', 'edit', 'delete']);
 // ============================================================================
 // Public API
 // ============================================================================
-/** Generate Laravel Policy classes for all schemas that have policies. */
+/** Generate Laravel Policy classes for project-owned visible schemas.
+ *
+ * Issue #98 v5.8.14: every `kind: object` schema now gets a generated
+ * policy base + editable stub by default — Laravel's policy
+ * auto-discovery (`App\\Models\\<Name>` → `App\\Policies\\<Name>Policy`)
+ * works out of the box without per-project Gate::policy(...) wiring.
+ *
+ * Skip rules:
+ *   - `kind: pivot` — pivots have no API surface
+ *   - `options.policy: false` — explicit per-schema opt-out
+ *
+ * Two code paths per schema:
+ *   - Explicit Cedar-style `policies: [...]` → existing rule-based body
+ *     generator (forbid / permit / when conditions).
+ *   - No `policies:` declared → standard CRUD scaffolding (viewAny /
+ *     view / create / update / delete + restore / forceDelete on
+ *     softDelete). Default body: `return true;`. Project secures by
+ *     overriding the method in the editable child.
+ */
 export function generatePolicies(reader, config) {
     const files = [];
     for (const [name, schema] of Object.entries(reader.getProjectVisibleObjectSchemas())) {
-        if (!schema.policies || schema.policies.length === 0)
+        if (schema.kind === 'pivot')
+            continue;
+        if (schema.options?.policy === false)
             continue;
         files.push(...generateForSchema(name, schema, reader, config));
     }
@@ -59,24 +79,36 @@ function generateBasePolicyClass(name, schema, reader, config) {
         : (config.models.userEditableGroupByFolder
             ? nestByGroup({ path: '', namespace: config.models.userEditableNamespace }, schema.group).namespace
             : config.models.userEditableNamespace);
-    const policies = schema.policies;
+    // Issue #98 v5.8.14: when no Cedar-style `policies:` array is defined,
+    // emit the standard CRUD scaffold with `return true;` bodies.
+    // The project secures the policy by overriding methods in the
+    // editable child (e.g. `return $user->hasPermission('manage.banner');`).
+    const policies = schema.policies ?? [];
+    const hasExplicitPolicies = policies.length > 0;
     const hasSoftDelete = schema.options?.softDelete ?? false;
-    const needsCidrHelper = policiesUseCidr(policies);
-    // Collect all actions that have policies
-    const expandedPolicies = expandWildcards(policies);
+    const needsCidrHelper = hasExplicitPolicies ? policiesUseCidr(policies) : false;
+    // Collect all actions that have policies (only relevant for the
+    // explicit-policy path; standard CRUD doesn't need wildcard expansion).
+    const expandedPolicies = hasExplicitPolicies ? expandWildcards(policies) : policies;
     // Build methods
     const methods = [];
     for (const action of ALL_ACTIONS) {
         const methodName = ACTION_METHOD_MAP[action];
         const hasRecord = RECORD_ACTIONS.has(action);
-        const body = generateMethodBody(action, expandedPolicies, schema, reader, hasRecord);
+        const body = hasExplicitPolicies
+            ? generateMethodBody(action, expandedPolicies, schema, reader, hasRecord)
+            : '        return true;';
         methods.push(buildMethod(methodName, modelName, hasRecord, body));
     }
     // SoftDelete: restore + forceDelete
     if (hasSoftDelete) {
-        const restoreBody = generateMethodBody('delete', expandedPolicies, schema, reader);
+        const restoreBody = hasExplicitPolicies
+            ? generateMethodBody('delete', expandedPolicies, schema, reader)
+            : '        return true;';
         methods.push(buildMethod('restore', modelName, true, restoreBody));
-        const forceDeleteBody = generateMethodBody('delete', expandedPolicies, schema, reader);
+        const forceDeleteBody = hasExplicitPolicies
+            ? generateMethodBody('delete', expandedPolicies, schema, reader)
+            : '        return true;';
         methods.push(buildMethod('forceDelete', modelName, true, forceDeleteBody));
     }
     const cidrHelper = needsCidrHelper ? buildCidrHelper() : '';

package/dist/types.d.ts

@@ -208,6 +208,17 @@ export interface SchemaOptions {
      * generate time).
      */
     readonly service?: ServiceOptions | false;
+    /**
+     * Per-schema opt-out for the auto-generated Policy. Issue #98 v5.8.14:
+     * every `kind: object` schema gets a generated policy base + editable
+     * stub by default. Set `policy: false` on schemas that should NOT have
+     * an authorization policy (translation tables, internal sidecars, etc).
+     * Cedar-style ABAC `policies:` array on the root schema definition
+     * still drives the generated method bodies when present; otherwise the
+     * generator emits a standard 5-method CRUD scaffold with
+     * `return true;` bodies for the project to override in the editable.
+     */
+    readonly policy?: false;
     /** Schema-level default ordering — generates a global Eloquent scope. Issue #40. */
     readonly defaultOrder?: readonly OrderByItem[];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@omnifyjp/ts",
-  "version": "5.8.13",
+  "version": "5.8.14",
   "description": "TypeScript model type generator from Omnify schemas.json",
   "type": "module",
   "main": "dist/index.js",