@palbase/backend 23.1.0 → 24.0.0

package/dist/openapi/index.cjs

@@ -5869,6 +5869,11 @@ function getErrorRegistry() {
       ["forbidden", 403, "Forbidden"],
       ["not_found", 404, "NotFound"],
       ["conflict", 409, "Conflict"],
+      // The engine's own 23505 conversion (engine/db.ts) throws this, and an
+      // author may too. Registered like every other built-in so the spec
+      // emitter resolves it — an unregistered code is SKIPPED silently there
+      // (openapi/convert.ts) and would degrade to the client's `.other` case.
+      ["unique_violation", 409, "UniqueViolation"],
       ["too_many_requests", 429, "TooManyRequests"]
     ]) {
       const dataSchema = BUILTIN_DATA_SCHEMAS[code];
@@ -5948,6 +5953,16 @@ function getRoutes(ctor) {
 
 // src/decorators/controller.ts
 var CONTROLLER_META = /* @__PURE__ */ Symbol.for("palbase.backend.controllerMeta");
+var APP_DEFAULT_AUTH = /* @__PURE__ */ Symbol.for("palbase.backend.appDefaultAuth");
+function appAuthSlot() {
+  return globalThis;
+}
+function getDefaultAuth() {
+  return appAuthSlot()[APP_DEFAULT_AUTH];
+}
+function resolveEffectiveAuth(routeAuth, controllerAuth) {
+  return routeAuth ?? controllerAuth ?? getDefaultAuth() ?? true;
+}
 function isController(value) {
   if (typeof value !== "function" && (typeof value !== "object" || value === null)) {
     return false;
@@ -6031,7 +6046,7 @@ function flattenController(controller) {
   const out = [];
   for (const route of routes) {
     const fullPath = joinControllerPath(meta.basePath, route.subpath);
-    const effectiveAuth = route.options.auth ?? meta.defaultAuth ?? true;
+    const effectiveAuth = resolveEffectiveAuth(route.options.auth, meta.defaultAuth);
     const inputSchemas = {};
     const pathParams = [];
     for (const p of route.params) {