@proteinjs/db 1.21.9 → 1.22.0

package/index.ts

@@ -1,6 +1,7 @@
 export * from './src/Db';
 export * from './src/Table';
 export * from './src/auth/TableAuth';
+export * from './src/auth/TableServiceAuth';
 export * from './src/Columns';
 export * from './src/Record';
 export * from './src/reference/ReferenceArray';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/db",
-  "version": "1.21.9",
+  "version": "1.22.0",
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
   "exports": {
@@ -41,19 +41,19 @@
     "test": "jest --passWithNoTests"
   },
   "dependencies": {
-    "@proteinjs/db-query": "^1.4.7",
-    "@proteinjs/logger": "^1.0.18",
+    "@proteinjs/db-query": "^1.4.8",
+    "@proteinjs/logger": "^1.0.19",
     "@proteinjs/reflection": "^1.1.11",
-    "@proteinjs/serializer": "^1.1.7",
-    "@proteinjs/server-api": "^3.0.5",
-    "@proteinjs/service": "^1.2.14",
-    "@proteinjs/user-auth": "^1.1.12",
+    "@proteinjs/serializer": "^1.1.8",
+    "@proteinjs/server-api": "^3.0.6",
+    "@proteinjs/service": "^1.3.0",
+    "@proteinjs/user-auth": "^1.1.13",
     "@proteinjs/util": "^1.6.0",
     "moment": "2.29.4",
     "uuid": "8.3.0"
   },
   "devDependencies": {
-    "@proteinjs/reflection-build": "^1.4.6",
+    "@proteinjs/reflection-build": "^1.4.7",
     "@types/jest": "29.5.5",
     "@types/node": "14.0.27",
     "@types/uuid": "8.3.0",
@@ -66,5 +66,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.2.2"
   },
-  "gitHead": "75411714e31c9033803f328cb43fa922d77d9782"
+  "gitHead": "fe86509e0be8d89f7d6efd52b2e5af42ca3e2234"
 }

package/src/Table.ts

@@ -92,6 +92,15 @@ export abstract class Table<T extends Record> implements Loadable, CustomSeriali
   public auth?: {
     db?: TableOperationsAuth;
     service?: TableOperationsAuth;
+    /**
+     * Columns that can never be WRITTEN through the generic `DbService` RPC path: a service-path
+     * insert/update that sets one of these to a non-null value is rejected with a clean
+     * `ServiceError` before the operation runs (see `TableServiceAuth`). Server-side code using
+     * `Db` directly is unaffected. Use when a table must stay client-writable overall but a
+     * column's writes are reserved to server logic — e.g. `chat.parent`, which only
+     * `FlowConversation.createConversation` may set.
+     */
+    serviceProtectedColumns?: (keyof T & string)[];
     ui?: {
       recordTable?: Identity;
       recordForm?: Identity;

package/src/auth/TableAuth.ts

@@ -63,7 +63,7 @@ export class TableAuth {
   }
 
   canDelete(table: Table<any>, api: 'db' | 'service' = 'db'): void {
-    if (!this.canAccess(table, api, 'query')) {
+    if (!this.canAccess(table, api, 'delete')) {
       throw new Error(`User is not authorized to delete records from table: ${table.name}`);
     }
   }

package/src/auth/TableServiceAuth.ts

@@ -1,4 +1,5 @@
 import { Logger } from '@proteinjs/logger';
+import { ServiceError } from '@proteinjs/service';
 import { Table, isTable } from '../Table';
 import { TableAuth } from './TableAuth';
 
@@ -17,18 +18,47 @@ export class TableServiceAuth {
         tableAuth.canQuery(table as Table<any>, 'service');
       } else if (methodName === 'insert') {
         tableAuth.canInsert(table as Table<any>, 'service');
+        this.checkServiceProtectedColumns(table as Table<any>, args[1]);
       } else if (methodName === 'update') {
         tableAuth.canUpdate(table as Table<any>, 'service');
+        this.checkServiceProtectedColumns(table as Table<any>, args[1]);
       } else if (methodName === 'delete') {
         tableAuth.canDelete(table as Table<any>, 'service');
       } else {
         throw new Error(`User is not authorized to access unsupported Db service api: ${methodName}`);
       }
     } catch (error: any) {
+      // A protected-column rejection carries a client-safe message — let it surface as the 400
+      // body instead of collapsing into the generic authorization failure. Name check, not
+      // instanceof: `ServiceError extends Error` loses its prototype chain under the service
+      // package's compile target (same reason ServiceRouter's isServiceError checks `name`).
+      if (error?.name === 'ServiceError') {
+        throw error;
+      }
       this.logger.error({ message: `Failed evaluating auth for method: ${methodName}`, error });
       return false;
     }
 
     return true;
   }
+
+  /**
+   * Enforce `Table.auth.serviceProtectedColumns`: columns that may never be SET through the
+   * generic `DbService` RPC path. Setting one to `null`/leaving it absent passes (clearing is not
+   * a reserved write); any other value is rejected with a `ServiceError` so the client sees a
+   * specific, actionable error. Server-side `Db` usage never runs this check.
+   */
+  private checkServiceProtectedColumns(table: Table<any>, record: any): void {
+    const protectedColumns = table.auth?.serviceProtectedColumns;
+    if (!protectedColumns?.length || !record || typeof record !== 'object') {
+      return;
+    }
+
+    for (const column of protectedColumns) {
+      const value = record[column];
+      if (value !== undefined && value !== null) {
+        throw new ServiceError(`Column '${column}' cannot be written via the db service on table: ${table.name}`);
+      }
+    }
+  }
 }

package/test/TableServiceAuth.test.ts

@@ -0,0 +1,146 @@
+import { UserAuth } from '@proteinjs/user-auth';
+import { Table } from '../src/Table';
+import { withRecordColumns, Record } from '../src/Record';
+import { StringColumn } from '../src/Columns';
+import { TableServiceAuth } from '../src/auth/TableServiceAuth';
+
+/**
+ * Covers the service-path (RPC) table auth gate:
+ * - per-operation `service` grants (query stays open while writes are role-gated)
+ * - `canDelete` honoring the `delete` grant (not `query` — the pre-fix behavior let any
+ *   authenticated user delete from read-only tables)
+ * - `auth.serviceProtectedColumns`: columns that can never be SET via the service path,
+ *   rejected with a clean `ServiceError` (message passes through to the client verbatim)
+ *
+ * `UserAuth` reads from a static repo; tests stub it directly per identity — no server needed.
+ */
+
+interface Doc extends Record {
+  title: string;
+  owner?: string | null;
+}
+
+/** Mirrors the flow run-graph tables: reads authenticated, writes admin-only. */
+class ServerWrittenTable extends Table<Doc> {
+  public name = 'server_written_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { all: 'authenticated' },
+    service: { query: 'authenticated', insert: ['admin'], update: ['admin'], delete: ['admin'] },
+  };
+  public columns = withRecordColumns<Doc>({
+    title: new StringColumn('title'),
+    owner: new StringColumn('owner'),
+  });
+}
+
+/** Mirrors the chat table: client-writable, but `owner` is reserved to server code. */
+class ProtectedColumnTable extends Table<Doc> {
+  public name = 'protected_column_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { all: 'authenticated' },
+    service: { all: 'authenticated' },
+    serviceProtectedColumns: ['owner'],
+  };
+  public columns = withRecordColumns<Doc>({
+    title: new StringColumn('title'),
+    owner: new StringColumn('owner'),
+  });
+}
+
+/** Read-only intent: only `query` granted (the canDelete-regression shape). */
+class ReadOnlyTable extends Table<Doc> {
+  public name = 'read_only_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+    service: { query: 'authenticated' },
+  };
+  public columns = withRecordColumns<Doc>({
+    title: new StringColumn('title'),
+    owner: new StringColumn('owner'),
+  });
+}
+
+type UserAuthInternals = { userRepo?: { getUser: () => { email: string; roles: string[] } } };
+
+const setUser = (roles: string[]) => {
+  (UserAuth as unknown as UserAuthInternals).userRepo = {
+    getUser: () => ({ email: 'user@test.local', roles }),
+  };
+};
+
+const auth = () => new TableServiceAuth();
+
+describe('TableServiceAuth — per-operation service grants', () => {
+  afterEach(() => {
+    (UserAuth as unknown as UserAuthInternals).userRepo = undefined;
+  });
+
+  it('authenticated non-admin: reads allowed, writes denied on a server-written table', () => {
+    setUser([]);
+    const table = new ServerWrittenTable();
+    expect(auth().canAccess('query', [table, {}])).toBe(true);
+    expect(auth().canAccess('get', [table, { id: 'x' }])).toBe(true);
+    expect(auth().canAccess('getRowCount', [table, {}])).toBe(true);
+    expect(auth().canAccess('insert', [table, { title: 't' }])).toBe(false);
+    expect(auth().canAccess('update', [table, { id: 'x', title: 't' }])).toBe(false);
+    expect(auth().canAccess('delete', [table, { id: 'x' }])).toBe(false);
+  });
+
+  it('admin: writes allowed on a server-written table', () => {
+    setUser(['admin']);
+    const table = new ServerWrittenTable();
+    expect(auth().canAccess('insert', [table, { title: 't' }])).toBe(true);
+    expect(auth().canAccess('update', [table, { id: 'x', title: 't' }])).toBe(true);
+    expect(auth().canAccess('delete', [table, { id: 'x' }])).toBe(true);
+  });
+
+  it('delete requires the delete grant — a query-only table is not deletable', () => {
+    setUser([]);
+    const table = new ReadOnlyTable();
+    expect(auth().canAccess('query', [table, {}])).toBe(true);
+    expect(auth().canAccess('delete', [table, { id: 'x' }])).toBe(false);
+  });
+});
+
+describe('TableServiceAuth — serviceProtectedColumns', () => {
+  afterEach(() => {
+    (UserAuth as unknown as UserAuthInternals).userRepo = undefined;
+  });
+
+  it('rejects a service insert that sets a protected column, with a clean ServiceError', () => {
+    setUser([]);
+    const table = new ProtectedColumnTable();
+    // The rejection must be a ServiceError (name-tagged — instanceof is unreliable across the
+    // service package's compile target) so ServiceRouter returns its message verbatim as the 400.
+    let thrown: any;
+    try {
+      auth().canAccess('insert', [table, { title: 't', owner: 'someone' }]);
+    } catch (error) {
+      thrown = error;
+    }
+    expect(thrown?.name).toBe('ServiceError');
+    expect(thrown?.message).toBe("Column 'owner' cannot be written via the db service on table: protected_column_test");
+  });
+
+  it('rejects a service update that sets a protected column', () => {
+    setUser([]);
+    const table = new ProtectedColumnTable();
+    expect(() => auth().canAccess('update', [table, { id: 'x', owner: 'someone' }])).toThrow(
+      "Column 'owner' cannot be written via the db service"
+    );
+  });
+
+  it('allows service writes that leave the protected column absent or null', () => {
+    setUser([]);
+    const table = new ProtectedColumnTable();
+    expect(auth().canAccess('insert', [table, { title: 't' }])).toBe(true);
+    expect(auth().canAccess('insert', [table, { title: 't', owner: null }])).toBe(true);
+    expect(auth().canAccess('update', [table, { id: 'x', title: 't2', owner: undefined }])).toBe(true);
+  });
+
+  it('never gates reads', () => {
+    setUser([]);
+    const table = new ProtectedColumnTable();
+    expect(auth().canAccess('query', [table, { owner: 'someone' }])).toBe(true);
+  });
+});