@palbase/backend 23.1.0 → 24.0.1

package/dist/openapi/index.d.cts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-c9h5jriX.cjs';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CqPK2Qby.cjs';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-CcQ1a36a.cjs';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-1X-skBNu.cjs';
 import '../stack.cjs';
 
 /** A controller class (constructor). Kept loose — the only contract is that it
@@ -39,7 +39,8 @@ interface FlatRoute {
      * (MembersController → "members"). "" when the derivation is empty — the
      * operationId then falls back to the flat verb-prefixed form. */
     controllerName: string;
-    /** Resolved auth: route option ?? controller default ?? true (secure). */
+    /** Resolved auth: route option ?? controller default ?? application default
+     * ?? true (secure) — the cascade lives in `resolveEffectiveAuth`. */
     effectiveAuth: AuthSpec;
     /** All parameter metas for this route (ordered by index). */
     params: ParamMeta[];
@@ -68,7 +69,8 @@ interface FlatRoute {
  * `<controllerName>.<fnName>` id (PlacesController.importNearby →
  * places.importNearby) — matching the Go runtime (extract_meta.js derives the
  * namespace from the class name; generator.go joins). Effective auth resolves
- * the cascade (route ?? controller default ?? secure-by-default).
+ * the cascade (route ?? controller default ?? application default ??
+ * secure-by-default) through the one resolver the route table asks too.
  */
 declare function flattenController(controller: ControllerClass): FlatRoute[];
 /** The operationId for a route — exposed so callers (convert/aggregate)

package/dist/openapi/index.d.ts

@@ -1,7 +1,7 @@
 import { OpenApiGeneratorV31 } from '@asteasolutions/zod-to-openapi';
 import { ZodTypeAny } from 'zod';
-import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-CVWXh6oG.js';
-import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-B3niOVYp.js';
+import { A as AuthSpec, R as RateLimitConfig } from '../endpoint-0_DGBajf.js';
+import { P as ParamMeta, T as ThrowDescriptor, U as UploadConfig, S as SseConfig } from '../registry-CEod_5sz.js';
 import '../stack.js';
 
 /** A controller class (constructor). Kept loose — the only contract is that it
@@ -39,7 +39,8 @@ interface FlatRoute {
      * (MembersController → "members"). "" when the derivation is empty — the
      * operationId then falls back to the flat verb-prefixed form. */
     controllerName: string;
-    /** Resolved auth: route option ?? controller default ?? true (secure). */
+    /** Resolved auth: route option ?? controller default ?? application default
+     * ?? true (secure) — the cascade lives in `resolveEffectiveAuth`. */
     effectiveAuth: AuthSpec;
     /** All parameter metas for this route (ordered by index). */
     params: ParamMeta[];
@@ -68,7 +69,8 @@ interface FlatRoute {
  * `<controllerName>.<fnName>` id (PlacesController.importNearby →
  * places.importNearby) — matching the Go runtime (extract_meta.js derives the
  * namespace from the class name; generator.go joins). Effective auth resolves
- * the cascade (route ?? controller default ?? secure-by-default).
+ * the cascade (route ?? controller default ?? application default ??
+ * secure-by-default) through the one resolver the route table asks too.
  */
 declare function flattenController(controller: ControllerClass): FlatRoute[];
 /** The operationId for a route — exposed so callers (convert/aggregate)

package/dist/openapi/index.js

@@ -1,13 +1,12 @@
 import {
   getErrorRegistry
-} from "../chunk-R3KN6RHD.js";
+} from "../chunk-T5IOSOE5.js";
 import {
+  getRoutes,
   isController,
-  resolveController
-} from "../chunk-HQRJDARQ.js";
-import {
-  getRoutes
-} from "../chunk-RCLNBJCM.js";
+  resolveController,
+  resolveEffectiveAuth
+} from "../chunk-H3JAISUY.js";
 import {
   __commonJS,
   __require,
@@ -5853,7 +5852,7 @@ function flattenController(controller) {
   const out = [];
   for (const route of routes) {
     const fullPath = joinControllerPath(meta.basePath, route.subpath);
-    const effectiveAuth = route.options.auth ?? meta.defaultAuth ?? true;
+    const effectiveAuth = resolveEffectiveAuth(route.options.auth, meta.defaultAuth);
     const inputSchemas = {};
     const pathParams = [];
     for (const p of route.params) {