@opensaas/stack-core 0.1.0

package/dist/access/engine.js

@@ -0,0 +1,244 @@
+/**
+ * Check if access control result is a boolean
+ */
+export function isBoolean(value) {
+    return typeof value === 'boolean';
+}
+/**
+ * Check if access control result is a Prisma filter
+ */
+export function isPrismaFilter(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Parse a relationship ref and get the related list configuration
+ * Relationship refs are in the format "ListName.fieldName"
+ *
+ * @param relationshipRef - The ref string (e.g., "Post.author")
+ * @param config - The OpenSaas configuration
+ * @returns The related list name and config, or null if not found
+ */
+export function getRelatedListConfig(relationshipRef, config) {
+    // Parse ref format: "ListName.fieldName"
+    const parts = relationshipRef.split('.');
+    if (parts.length !== 2) {
+        return null;
+    }
+    const listName = parts[0];
+    const listConfig = config.lists[listName];
+    if (!listConfig) {
+        return null;
+    }
+    return { listName, listConfig };
+}
+/**
+ * Execute an access control function
+ */
+export async function checkAccess(accessControl, args) {
+    // No access control means deny by default
+    if (!accessControl) {
+        return false;
+    }
+    // Execute the access control function
+    const result = await accessControl(args);
+    return result;
+}
+/**
+ * Merge user filter with access control filter
+ */
+export function mergeFilters(userFilter, accessFilter) {
+    // If access is denied, return null
+    if (accessFilter === false) {
+        return null;
+    }
+    // If access is fully granted, use user filter
+    if (accessFilter === true) {
+        return userFilter || {};
+    }
+    // Merge access filter with user filter
+    if (!userFilter) {
+        return accessFilter;
+    }
+    // Combine filters with AND
+    return {
+        AND: [accessFilter, userFilter],
+    };
+}
+/**
+ * Check field-level access for a specific operation
+ */
+export async function checkFieldAccess(fieldAccess, operation, args) {
+    if (!fieldAccess) {
+        return true; // No field access means allow
+    }
+    const accessControl = fieldAccess[operation];
+    if (!accessControl) {
+        return true; // No specific access control means allow
+    }
+    const result = await accessControl(args);
+    // If result is false, deny access
+    if (result === false) {
+        return false;
+    }
+    // If result is true, allow access
+    if (result === true) {
+        return true;
+    }
+    // If result is a filter object, check if the item matches
+    // For field-level access, we need to evaluate the filter against the item
+    if (typeof result === 'object' && args.item) {
+        return matchesFilter(args.item, result);
+    }
+    // Default to allowing access if we can't determine
+    return true;
+}
+/**
+ * Simple filter matching for field-level access
+ * Checks if an item matches a Prisma-like filter object
+ */
+function matchesFilter(item, filter) {
+    for (const [key, condition] of Object.entries(filter)) {
+        if (typeof condition === 'object' && condition !== null) {
+            // Handle nested conditions like { equals: value }
+            if ('equals' in condition) {
+                if (item[key] !== condition.equals) {
+                    return false;
+                }
+            }
+            else if ('not' in condition) {
+                if (item[key] === condition.not) {
+                    return false;
+                }
+            }
+            // Add more condition types as needed
+        }
+        else {
+            // Direct equality check
+            if (item[key] !== condition) {
+                return false;
+            }
+        }
+    }
+    return true;
+}
+/**
+ * Build Prisma include object with access control filters
+ * This allows us to filter relationships at the database level instead of in memory
+ */
+export async function buildIncludeWithAccessControl(fieldConfigs, args, config, depth = 0) {
+    const MAX_DEPTH = 5;
+    if (depth >= MAX_DEPTH) {
+        return undefined;
+    }
+    const include = {};
+    let hasRelationships = false;
+    for (const [fieldName, fieldConfig] of Object.entries(fieldConfigs)) {
+        if (fieldConfig?.type === 'relationship' && 'ref' in fieldConfig && fieldConfig.ref) {
+            hasRelationships = true;
+            const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
+            if (relatedConfig) {
+                // Check query access for the related list
+                const queryAccess = relatedConfig.listConfig.access?.operation?.query;
+                const accessResult = await checkAccess(queryAccess, {
+                    session: args.session,
+                    context: args.context,
+                });
+                // If access is completely denied, exclude this relationship
+                if (accessResult === false) {
+                    continue;
+                }
+                // Build the include entry
+                const includeEntry = {};
+                // If access returns a filter, add it to the where clause
+                if (typeof accessResult === 'object') {
+                    includeEntry.where = accessResult;
+                }
+                // Recursively build nested includes
+                const nestedInclude = await buildIncludeWithAccessControl(relatedConfig.listConfig.fields, args, config, depth + 1);
+                if (nestedInclude && Object.keys(nestedInclude).length > 0) {
+                    includeEntry.include = nestedInclude;
+                }
+                // Add to include object
+                include[fieldName] = Object.keys(includeEntry).length > 0 ? includeEntry : true;
+            }
+        }
+    }
+    return hasRelationships ? include : undefined;
+}
+/**
+ * Filter fields from an object based on read access
+ * Recursively applies access control to nested relationships
+ */
+export async function filterReadableFields(item, fieldConfigs, args, config, depth = 0) {
+    const filtered = {};
+    const MAX_DEPTH = 5; // Prevent infinite recursion
+    for (const [fieldName, value] of Object.entries(item)) {
+        const fieldConfig = fieldConfigs[fieldName];
+        // Always include id, createdAt, updatedAt
+        if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
+            filtered[fieldName] = value;
+            continue;
+        }
+        // Check field access
+        const canRead = await checkFieldAccess(fieldConfig?.access, 'read', {
+            ...args,
+            item,
+        });
+        if (!canRead) {
+            continue;
+        }
+        // Handle relationship fields - recursively filter fields within related items
+        // Note: Access control filtering is now done at database level via buildIncludeWithAccessControl
+        // This only handles field-level access (hiding sensitive fields)
+        if (config &&
+            fieldConfig?.type === 'relationship' &&
+            'ref' in fieldConfig &&
+            fieldConfig.ref &&
+            value !== null &&
+            value !== undefined &&
+            depth < MAX_DEPTH) {
+            const relatedConfig = getRelatedListConfig(fieldConfig.ref, config);
+            if (relatedConfig) {
+                // For many relationships (arrays) - recursively filter fields in each item
+                if (Array.isArray(value)) {
+                    filtered[fieldName] = await Promise.all(value.map((relatedItem) => filterReadableFields(relatedItem, relatedConfig.listConfig.fields, args, config, depth + 1)));
+                }
+                // For single relationships (objects) - recursively filter fields
+                else if (typeof value === 'object') {
+                    filtered[fieldName] = await filterReadableFields(value, relatedConfig.listConfig.fields, args, config, depth + 1);
+                }
+            }
+            else {
+                // Related config not found, include the value as-is
+                filtered[fieldName] = value;
+            }
+        }
+        else {
+            // Non-relationship field or no config provided
+            filtered[fieldName] = value;
+        }
+    }
+    return filtered;
+}
+/**
+ * Filter fields from input data based on write access (create/update)
+ */
+export async function filterWritableFields(data, fieldConfigs, operation, args) {
+    const filtered = {};
+    for (const [fieldName, value] of Object.entries(data)) {
+        const fieldConfig = fieldConfigs[fieldName];
+        // Skip system fields
+        if (['id', 'createdAt', 'updatedAt'].includes(fieldName)) {
+            continue;
+        }
+        // Check field access
+        const canWrite = await checkFieldAccess(fieldConfig?.access, operation, {
+            ...args,
+        });
+        if (canWrite) {
+            filtered[fieldName] = value;
+        }
+    }
+    return filtered;
+}
+//# sourceMappingURL=engine.js.map

package/dist/access/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/access/engine.ts"],"names":[],"mappings":"AAIA;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAA;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,eAAuB,EACvB,MAAsB;IAEtB,yCAAyC;IACzC,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;IACzB,MAAM,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;IAEzC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAA;AACjC,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAA2C,EAC3C,IAIC;IAED,0CAA0C;IAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,sCAAsC;IACtC,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAExC,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,UAAoC,EACpC,YAAoC;IAEpC,mCAAmC;IACnC,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8CAA8C;IAC9C,IAAI,YAAY,KAAK,IAAI,EAAE,CAAC;QAC1B,OAAO,UAAU,IAAI,EAAE,CAAA;IACzB,CAAC;IAED,uCAAuC;IACvC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,YAAY,CAAA;IACrB,CAAC;IAED,2BAA2B;IAC3B,OAAO;QACL,GAAG,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;KAChC,CAAA;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,WAAoC,EACpC,SAAuC,EACvC,IAIC;IAED,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAA,CAAC,8BAA8B;IAC5C,CAAC;IAED,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;IAC5C,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,IAAI,CAAA,CAAC,yCAAyC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAExC,kCAAkC;IAClC,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACrB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,kCAAkC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,OAAO,IAAI,CAAA;IACb,CAAC;IAED,0DAA0D;IAC1D,0EAA0E;IAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5C,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;IACzC,CAAC;IAED,mDAAmD;IACnD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,IAA6B,EAAE,MAA+B;IACnF,KAAK,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACxD,kDAAkD;YAClD,IAAI,QAAQ,IAAI,SAAS,EAAE,CAAC;gBAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,MAAM,EAAE,CAAC;oBACnC,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;iBAAM,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;gBAC9B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,GAAG,EAAE,CAAC;oBAChC,OAAO,KAAK,CAAA;gBACd,CAAC;YACH,CAAC;YACD,qCAAqC;QACvC,CAAC;aAAM,CAAC;YACN,wBAAwB;YACxB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,KAAK,CAAA;YACd,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,YAAyC,EACzC,IAGC,EACD,MAAsB,EACtB,QAAgB,CAAC;IAEjB,MAAM,SAAS,GAAG,CAAC,CAAA;IACnB,IAAI,KAAK,IAAI,SAAS,EAAE,CAAC;QACvB,OAAO,SAAS,CAAA;IAClB,CAAC;IAID,MAAM,OAAO,GAAiC,EAAE,CAAA;IAChD,IAAI,gBAAgB,GAAG,KAAK,CAAA;IAE5B,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACpE,IAAI,WAAW,EAAE,IAAI,KAAK,cAAc,IAAI,KAAK,IAAI,WAAW,IAAI,WAAW,CAAC,GAAG,EAAE,CAAC;YACpF,gBAAgB,GAAG,IAAI,CAAA;YACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,0CAA0C;gBAC1C,MAAM,WAAW,GAAG,aAAa,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;gBACrE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE;oBAClD,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,OAAO,EAAE,IAAI,CAAC,OAAO;iBACtB,CAAC,CAAA;gBAEF,4DAA4D;gBAC5D,IAAI,YAAY,KAAK,KAAK,EAAE,CAAC;oBAC3B,SAAQ;gBACV,CAAC;gBAED,0BAA0B;gBAC1B,MAAM,YAAY,GAA4B,EAAE,CAAA;gBAEhD,yDAAyD;gBACzD,IAAI,OAAO,YAAY,KAAK,QAAQ,EAAE,CAAC;oBACrC,YAAY,CAAC,KAAK,GAAG,YAAY,CAAA;gBACnC,CAAC;gBAED,oCAAoC;gBACpC,MAAM,aAAa,GAAG,MAAM,6BAA6B,CACvD,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CAAA;gBAED,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3D,YAAY,CAAC,OAAO,GAAG,aAAa,CAAA;gBACtC,CAAC;gBAED,wBAAwB;gBACxB,OAAO,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;YACjF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAA;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAO,EACP,YAAyC,EACzC,IAGC,EACD,MAAuB,EACvB,QAAgB,CAAC;IAEjB,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAC5C,MAAM,SAAS,GAAG,CAAC,CAAA,CAAC,6BAA6B;IAEjD,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE3C,0CAA0C;QAC1C,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;YAC3B,SAAQ;QACV,CAAC;QAED,qBAAqB;QACrB,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE;YAClE,GAAG,IAAI;YACP,IAAI;SACL,CAAC,CAAA;QAEF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,SAAQ;QACV,CAAC;QAED,8EAA8E;QAC9E,iGAAiG;QACjG,iEAAiE;QACjE,IACE,MAAM;YACN,WAAW,EAAE,IAAI,KAAK,cAAc;YACpC,KAAK,IAAI,WAAW;YACpB,WAAW,CAAC,GAAG;YACf,KAAK,KAAK,IAAI;YACd,KAAK,KAAK,SAAS;YACnB,KAAK,GAAG,SAAS,EACjB,CAAC;YACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;YAEnE,IAAI,aAAa,EAAE,CAAC;gBAClB,2EAA2E;gBAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;oBACzB,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CACrC,KAAK,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACxB,oBAAoB,CAClB,WAAW,EACX,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CACF,CACF,CAAA;gBACH,CAAC;gBACD,iEAAiE;qBAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACnC,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,oBAAoB,CAC9C,KAAgC,EAChC,aAAa,CAAC,UAAU,CAAC,MAAM,EAC/B,IAAI,EACJ,MAAM,EACN,KAAK,GAAG,CAAC,CACV,CAAA;gBACH,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,oDAAoD;gBACpD,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;YAC7B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,+CAA+C;YAC/C,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,QAAsB,CAAA;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAO,EACP,YAAsD,EACtD,SAA8B,EAC9B,IAIC;IAED,MAAM,QAAQ,GAA4B,EAAE,CAAA;IAE5C,KAAK,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;QAE3C,qBAAqB;QACrB,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACzD,SAAQ;QACV,CAAC;QAED,qBAAqB;QACrB,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE;YACtE,GAAG,IAAI;SACR,CAAC,CAAA;QAEF,IAAI,QAAQ,EAAE,CAAC;YACb,QAAQ,CAAC,SAAS,CAAC,GAAG,KAAK,CAAA;QAC7B,CAAC;IACH,CAAC;IAED,OAAO,QAAsB,CAAA;AAC/B,CAAC"}

package/dist/access/field-transforms.d.ts

@@ -0,0 +1,47 @@
+import type { OpenSaasConfig, FieldConfig } from '../config/types.js';
+import type { HashedPassword } from '../utils/password.js';
+/**
+ * Extract the return type of a field's afterOperation hook
+ * If the field has an afterOperation hook, infer its return type
+ * Otherwise, use the original type
+ */
+export type InferFieldReadType<TField extends FieldConfig, TOriginal> = TField extends {
+    hooks?: {
+        afterOperation?: (...args: any[]) => infer R;
+    };
+} ? R extends never ? TOriginal : R : TOriginal;
+/**
+ * Transform a Prisma model's field types based on OpenSaas field configs
+ * This applies afterOperation hook transformations to field types
+ */
+export type TransformModelFields<TModel extends Record<string, any>, TFields extends Record<string, FieldConfig>> = {
+    [K in keyof TModel]: K extends keyof TFields ? InferFieldReadType<TFields[K], TModel[K]> : TModel[K];
+};
+/**
+ * Get the field configs for a specific list from the OpenSaas config
+ */
+export type GetListFields<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists']> = TConfig['lists'][TListKey]['fields'];
+/**
+ * Transform a Prisma model result based on OpenSaas config
+ * Applies field hooks transformations
+ */
+export type TransformResult<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists'], TResult> = TResult extends Record<string, any> ? TransformModelFields<TResult, GetListFields<TConfig, TListKey>> : TResult;
+/**
+ * Transform a Prisma operation's return type
+ * Handles single results, arrays, and null cases
+ */
+export type TransformOperationResult<TConfig extends OpenSaasConfig, TListKey extends keyof TConfig['lists'], TResult> = TResult extends Promise<infer R> ? Promise<R extends Array<infer Item> ? Array<TransformResult<TConfig, TListKey, Item>> : R extends null ? null : TransformResult<TConfig, TListKey, R>> : never;
+/**
+ * Known field type mappings for afterOperation hooks
+ * These provide concrete type hints for common field transformations
+ */
+export interface FieldTypeTransforms {
+    password: HashedPassword;
+}
+/**
+ * Helper to infer field type based on field config type
+ */
+export type InferFieldTypeTransform<TField extends FieldConfig> = TField extends {
+    type: infer TType;
+} ? TType extends keyof FieldTypeTransforms ? FieldTypeTransforms[TType] : never : never;
+//# sourceMappingURL=field-transforms.d.ts.map

package/dist/access/field-transforms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-transforms.d.ts","sourceRoot":"","sources":["../../src/access/field-transforms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAE1D;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,CAAC,MAAM,SAAS,WAAW,EAAE,SAAS,IAAI,MAAM,SAAS;IAIrF,KAAK,CAAC,EAAE;QAAE,cAAc,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,MAAM,CAAC,CAAA;KAAE,CAAA;CACzD,GACG,CAAC,SAAS,KAAK,GACb,SAAS,GACT,CAAC,GACH,SAAS,CAAA;AAEb;;;GAGG;AACH,MAAM,MAAM,oBAAoB,CAI9B,MAAM,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAClC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,IACzC;KACD,CAAC,IAAI,MAAM,MAAM,GAAG,CAAC,SAAS,MAAM,OAAO,GACxC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,GACzC,MAAM,CAAC,CAAC,CAAC;CACd,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,CACvB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,IACrC,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAA;AAExC;;;GAGG;AACH,MAAM,MAAM,eAAe,CACzB,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAKP,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC/B,oBAAoB,CAAC,OAAO,EAAE,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,GAC/D,OAAO,CAAA;AAEb;;;GAGG;AACH,MAAM,MAAM,wBAAwB,CAClC,OAAO,SAAS,cAAc,EAC9B,QAAQ,SAAS,MAAM,OAAO,CAAC,OAAO,CAAC,EACvC,OAAO,IAEP,OAAO,SAAS,OAAO,CAAC,MAAM,CAAC,CAAC,GAC5B,OAAO,CACL,CAAC,SAAS,KAAK,CAAC,MAAM,IAAI,CAAC,GACvB,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,GAC/C,CAAC,SAAS,IAAI,GACZ,IAAI,GACJ,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAC5C,GACD,KAAK,CAAA;AAEX;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,cAAc,CAAA;CAIzB;AAED;;GAEG;AACH,MAAM,MAAM,uBAAuB,CAAC,MAAM,SAAS,WAAW,IAAI,MAAM,SAAS;IAC/E,IAAI,EAAE,MAAM,KAAK,CAAA;CAClB,GACG,KAAK,SAAS,MAAM,mBAAmB,GACrC,mBAAmB,CAAC,KAAK,CAAC,GAC1B,KAAK,GACP,KAAK,CAAA"}

package/dist/access/field-transforms.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=field-transforms.js.map

package/dist/access/field-transforms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"field-transforms.js","sourceRoot":"","sources":["../../src/access/field-transforms.ts"],"names":[],"mappings":""}

package/dist/access/index.d.ts

@@ -0,0 +1,3 @@
+export type { AccessControl, FieldAccess, Session, AccessContext, PrismaFilter, AccessControlledDB, PrismaClientLike, } from './types.js';
+export { checkAccess, mergeFilters, checkFieldAccess, filterReadableFields, filterWritableFields, isBoolean, isPrismaFilter, getRelatedListConfig, buildIncludeWithAccessControl, } from './engine.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/access/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,WAAW,EACX,OAAO,EACP,aAAa,EACb,YAAY,EACZ,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,aAAa,CAAA"}

package/dist/access/index.js

@@ -0,0 +1,2 @@
+export { checkAccess, mergeFilters, checkFieldAccess, filterReadableFields, filterWritableFields, isBoolean, isPrismaFilter, getRelatedListConfig, buildIncludeWithAccessControl, } from './engine.js';
+//# sourceMappingURL=index.js.map

package/dist/access/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/access/index.ts"],"names":[],"mappings":"AASA,OAAO,EACL,WAAW,EACX,YAAY,EACZ,gBAAgB,EAChB,oBAAoB,EACpB,oBAAoB,EACpB,SAAS,EACT,cAAc,EACd,oBAAoB,EACpB,6BAA6B,GAC9B,MAAM,aAAa,CAAA"}

package/dist/access/types.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Session type - can be extended by users
+ */
+export type Session = {
+    userId?: string;
+    [key: string]: unknown;
+} | null;
+/**
+ * Generic Prisma model delegate type
+ */
+export type PrismaModelDelegate = {
+    findUnique: (args: unknown) => Promise<unknown>;
+    findFirst: (args: unknown) => Promise<unknown>;
+    findMany: (args: unknown) => Promise<unknown[]>;
+    create: (args: unknown) => Promise<unknown>;
+    update: (args: unknown) => Promise<unknown>;
+    delete: (args: unknown) => Promise<unknown>;
+    count: (args?: unknown) => Promise<number>;
+};
+/**
+ * Generic Prisma client type
+ * This is intentionally permissive to allow actual PrismaClient types
+ * Uses `any` because Prisma generates highly complex client types that are difficult to constrain
+ * This type is used as a generic constraint and the actual type safety comes from TPrisma parameter
+ */
+export type PrismaClientLike = any;
+/**
+ * Map Prisma client to access-controlled database context
+ * Preserves Prisma's type information for each model
+ */
+export type AccessControlledDB<TPrisma extends PrismaClientLike> = {
+    [K in keyof TPrisma]: TPrisma[K] extends {
+        findUnique: any;
+        findMany: any;
+        create: any;
+        update: any;
+        delete: any;
+        count: any;
+    } ? {
+        findUnique: TPrisma[K]['findUnique'];
+        findMany: TPrisma[K]['findMany'];
+        create: TPrisma[K]['create'];
+        update: TPrisma[K]['update'];
+        delete: TPrisma[K]['delete'];
+        count: TPrisma[K]['count'];
+    } : never;
+} & {
+    [key: string]: any;
+};
+/**
+ * Context type (simplified for access control)
+ */
+export type AccessContext<TPrisma extends PrismaClientLike = PrismaClientLike> = {
+    session: Session;
+    prisma: TPrisma;
+    db: AccessControlledDB<TPrisma>;
+    [key: string]: unknown;
+};
+/**
+ * Prisma filter type - represents a where clause
+ * Uses Partial to allow filtering by any subset of fields
+ */
+export type PrismaFilter<T = Record<string, unknown>> = Partial<Record<keyof T, unknown>>;
+/**
+ * Access control function type
+ * Can return:
+ * - boolean: true = allow, false = deny
+ * - PrismaFilter: Prisma where clause to filter results
+ */
+export type AccessControl<T = Record<string, unknown>> = (args: {
+    session: Session;
+    item?: T;
+    context: AccessContext;
+}) => boolean | PrismaFilter<T> | Promise<boolean | PrismaFilter<T>>;
+/**
+ * Field-level access control
+ */
+export type FieldAccess = {
+    read?: AccessControl;
+    create?: AccessControl;
+    update?: AccessControl;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/access/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,MAAM,OAAO,GAAG;IACpB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,GAAG,IAAI,CAAA;AAER;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,UAAU,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC/C,SAAS,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC9C,QAAQ,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,EAAE,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,MAAM,EAAE,CAAC,IAAI,EAAE,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3C,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3C,CAAA;AAED;;;;;GAKG;AAEH,MAAM,MAAM,gBAAgB,GAAG,GAAG,CAAA;AAElC;;;GAGG;AACH,MAAM,MAAM,kBAAkB,CAAC,OAAO,SAAS,gBAAgB,IAAI;KAChE,CAAC,IAAI,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS;QAIvC,UAAU,EAAE,GAAG,CAAA;QAEf,QAAQ,EAAE,GAAG,CAAA;QAEb,MAAM,EAAE,GAAG,CAAA;QAEX,MAAM,EAAE,GAAG,CAAA;QAEX,MAAM,EAAE,GAAG,CAAA;QAEX,KAAK,EAAE,GAAG,CAAA;KACX,GACG;QACE,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAA;QACpC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QAChC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAA;QAC5B,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;KAC3B,GACD,KAAK;CACV,GAAG;IAIF,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAA;CACnB,CAAA;AAED;;GAEG;AACH,MAAM,MAAM,aAAa,CAAC,OAAO,SAAS,gBAAgB,GAAG,gBAAgB,IAAI;IAC/E,OAAO,EAAE,OAAO,CAAA;IAChB,MAAM,EAAE,OAAO,CAAA;IACf,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC/B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB,CAAA;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;AAEzF;;;;;GAKG;AACH,MAAM,MAAM,aAAa,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE;IAC9D,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE,CAAC,CAAA;IACR,OAAO,EAAE,aAAa,CAAA;CACvB,KAAK,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAA;AAEpE;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG;IACxB,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,MAAM,CAAC,EAAE,aAAa,CAAA;CACvB,CAAA"}

package/dist/access/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/access/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/access/types.ts"],"names":[],"mappings":""}

package/dist/config/index.d.ts

@@ -0,0 +1,39 @@
+import type { OpenSaasConfig, ListConfig, FieldConfig, OperationAccess, Hooks } from './types.js';
+/**
+ * Helper function to define configuration with type safety
+ */
+export declare function config(config: OpenSaasConfig): OpenSaasConfig;
+/**
+ * Helper function to define a list with type safety
+ *
+ * Accepts raw field configs and transforms them to inject the item type T
+ * This enables proper typing in field hooks where item: T
+ *
+ * @example
+ * ```typescript
+ * import type { User } from './.opensaas/types'
+ *
+ * User: list<User>({
+ *   fields: {
+ *     password: password({
+ *       hooks: {
+ *         resolveInput: async ({ inputValue, item }) => {
+ *           // item is typed as User | undefined
+ *           // inputValue is typed as string | undefined
+ *           return hashPassword(inputValue)
+ *         }
+ *       }
+ *     })
+ *   }
+ * })
+ * ```
+ */
+export declare function list<T = any>(config: {
+    fields: Record<string, FieldConfig>;
+    access?: {
+        operation?: OperationAccess<T>;
+    };
+    hooks?: Hooks<T>;
+}): ListConfig<T>;
+export type { OpenSaasConfig, ListConfig, FieldConfig, BaseFieldConfig, TextField, IntegerField, CheckboxField, TimestampField, PasswordField, SelectField, RelationshipField, OperationAccess, Hooks, FieldHooks, FieldsWithItemType, DatabaseConfig, SessionConfig, UIConfig, ThemeConfig, ThemePreset, ThemeColors, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAEjG;;GAEG;AACH,wBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,GAAG,cAAc,CAE7D;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,wBAAgB,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,MAAM,EAAE;IACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;IACnC,MAAM,CAAC,EAAE;QACP,SAAS,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC,CAAA;KAC/B,CAAA;IACD,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;CACjB,GAAG,UAAU,CAAC,CAAC,CAAC,CAIhB;AAGD,YAAY,EACV,cAAc,EACd,UAAU,EACV,WAAW,EACX,eAAe,EACf,SAAS,EACT,YAAY,EACZ,aAAa,EACb,cAAc,EACd,aAAa,EACb,WAAW,EACX,iBAAiB,EACjB,eAAe,EACf,KAAK,EACL,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,aAAa,EACb,QAAQ,EACR,WAAW,EACX,WAAW,EACX,WAAW,GACZ,MAAM,YAAY,CAAA"}

package/dist/config/index.js

@@ -0,0 +1,38 @@
+/**
+ * Helper function to define configuration with type safety
+ */
+export function config(config) {
+    return config;
+}
+/**
+ * Helper function to define a list with type safety
+ *
+ * Accepts raw field configs and transforms them to inject the item type T
+ * This enables proper typing in field hooks where item: T
+ *
+ * @example
+ * ```typescript
+ * import type { User } from './.opensaas/types'
+ *
+ * User: list<User>({
+ *   fields: {
+ *     password: password({
+ *       hooks: {
+ *         resolveInput: async ({ inputValue, item }) => {
+ *           // item is typed as User | undefined
+ *           // inputValue is typed as string | undefined
+ *           return hashPassword(inputValue)
+ *         }
+ *       }
+ *     })
+ *   }
+ * })
+ * ```
+ */
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+export function list(config) {
+    // At runtime, field configs are unchanged
+    // At type level, they're transformed to inject T as the item type
+    return config;
+}
+//# sourceMappingURL=index.js.map

package/dist/config/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,UAAU,MAAM,CAAC,MAAsB;IAC3C,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,8DAA8D;AAC9D,MAAM,UAAU,IAAI,CAAU,MAM7B;IACC,0CAA0C;IAC1C,kEAAkE;IAClE,OAAO,MAAuB,CAAA;AAChC,CAAC"}