@proteinjs/db 1.44.0 → 1.46.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/db",
-  "version": "1.44.0",
+  "version": "1.46.0",
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
   "exports": {
@@ -66,5 +66,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.2.2"
   },
-  "gitHead": "e58dd79705692df4325dc68b766aa2c9f7073881"
+  "gitHead": "93bcd1aaf8d85abf75c20478e324b6b5323baf2f"
 }

package/src/Table.ts

@@ -139,6 +139,14 @@ export abstract class Table<T extends Record> implements Loadable, CustomSeriali
        * migration ledger reads most-recently-run first, never-run rows last.
        */
       sort?: SortCriteria<T>[];
+      /**
+       * A table whose rows have their OWN page instead of the generic record form: the record table
+       * links each row here (replacing the generic form link), draws no New button and no selection
+       * Delete button, and the generic form page replace-navigates stale
+       * `/record/form?table=<name>&record=<id>` URLs to this link. Built from the id alone so the
+       * redirect never needs a row load.
+       */
+      recordLink?: (row: Pick<T, 'id'>) => string;
     };
   };
   public auth?: {

package/src/auth/TableAuth.ts

@@ -67,27 +67,19 @@ export class TableAuth {
     }
   }
 
-  private canAccess(
-    table: Table<any>,
-    api: 'db' | 'service',
-    operation: 'query' | 'insert' | 'update' | 'delete'
-  ): boolean {
-    const tableAuth = table.auth ? table.auth[api] : undefined;
-    if (!tableAuth || Object.keys(tableAuth).length == 0) {
-      return UserAuth.hasRole('admin');
+  /**
+   * Non-throwing read of ONE declared identity against the CURRENT user — the same grammar the
+   * table doors speak (`'public' | 'authenticated' | roles[] | { permission }`), for declared
+   * UI affordances that carry their own grant (a record form's declared panels, `Table.auth.ui`).
+   * An UNDECLARED identity is the default-deny made explicit: admin only. Fails closed (false)
+   * when no user can be resolved, like `canPerform`.
+   */
+  identityAllows(identity: Identity | undefined): boolean {
+    try {
+      return identity === undefined ? UserAuth.hasRole('admin') : this.allows(identity);
+    } catch {
+      return false;
     }
-
-    return (
-      tableAuth.all === 'public' ||
-      tableAuth[operation] === 'public' ||
-      (tableAuth.all === 'authenticated' && UserAuth.isLoggedIn()) ||
-      (tableAuth[operation] === 'authenticated' && UserAuth.isLoggedIn()) ||
-      (Array.isArray(tableAuth.all) && UserAuth.hasRoles(tableAuth.all, 'at least one')) ||
-      (Array.isArray(tableAuth[operation]) && UserAuth.hasRoles(tableAuth[operation] as string[], 'at least one')) ||
-      (isPermissionIdentity(tableAuth.all) && UserAuth.hasPermission(tableAuth.all.permission)) ||
-      (isPermissionIdentity(tableAuth[operation]) &&
-        UserAuth.hasPermission((tableAuth[operation] as PermissionIdentity).permission))
-    );
   }
 
   canQuery(table: Table<any>, api: 'db' | 'service' = 'db'): void {
@@ -113,4 +105,37 @@ export class TableAuth {
       throw new TableAuthError(`User is not authorized to delete records from table: ${table.name}`);
     }
   }
+
+  private canAccess(
+    table: Table<any>,
+    api: 'db' | 'service',
+    operation: 'query' | 'insert' | 'update' | 'delete'
+  ): boolean {
+    const tableAuth = table.auth ? table.auth[api] : undefined;
+    if (!tableAuth || Object.keys(tableAuth).length == 0) {
+      return UserAuth.hasRole('admin');
+    }
+
+    // Within a declared block an undeclared operation stays closed to everyone (the block is
+    // the whole declaration) — `allows` reads undefined as false, so the two doors are exactly
+    // the ones the table wrote down.
+    return this.allows(tableAuth.all) || this.allows(tableAuth[operation]);
+  }
+
+  /** One identity against the current user; undefined (nothing declared) is not a grant. */
+  private allows(identity: Identity | undefined): boolean {
+    if (identity === 'public') {
+      return true;
+    }
+    if (identity === 'authenticated') {
+      return UserAuth.isLoggedIn();
+    }
+    if (Array.isArray(identity)) {
+      return UserAuth.hasRoles(identity, 'at least one');
+    }
+    if (isPermissionIdentity(identity)) {
+      return UserAuth.hasPermission(identity.permission);
+    }
+    return false;
+  }
 }

package/test/TableAuthIdentity.test.ts

@@ -0,0 +1,115 @@
+import { UserAuth } from '@proteinjs/user-auth';
+import { Table } from '../src/Table';
+import { withRecordColumns, Record } from '../src/Record';
+import { StringColumn } from '../src/Columns';
+import { TableAuth } from '../src/auth/TableAuth';
+
+/**
+ * `TableAuth.identityAllows` — the one identity grammar (`'public' | 'authenticated' | roles[] |
+ * { permission }`) read for a DECLARED UI affordance that carries its own grant (a record form's
+ * declared panels, `Table.auth.ui`). Outcomes pinned:
+ * - each identity form resolves against the current user; 'admin' is break-glass throughout;
+ * - an UNDECLARED identity is admin-only (default-deny made explicit), never open;
+ * - it fails CLOSED when no user can be resolved;
+ * - the operation doors (`canPerform`) are byte-for-byte the pre-refactor semantics: within a
+ *   declared block an undeclared operation stays closed to everyone, admin included.
+ *
+ * `UserAuth` reads from a static repo; tests stub it directly per identity — no server needed.
+ */
+
+interface Doc extends Record {
+  title: string;
+}
+
+class QueryOnlyTable extends Table<Doc> {
+  public name = 'identity_query_only_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+const setUser = (roles: string[], email = 'user@test.local') => {
+  (UserAuth as any).userRepo = { getUser: () => ({ email, roles }) };
+};
+const setGuest = () => {
+  (UserAuth as any).userRepo = { getUser: () => ({ email: 'guest', roles: [] }) };
+};
+const setMapping = (mapping: { [permission: string]: string[] }) => {
+  (UserAuth as any).permissionRolesMapping = { getRoles: (permission: string) => mapping[permission] };
+};
+
+describe('TableAuth.identityAllows', () => {
+  beforeEach(() => {
+    setMapping({ usage: ['usage'] });
+  });
+
+  afterEach(() => {
+    (UserAuth as any).userRepo = undefined;
+    (UserAuth as any).permissionRolesMapping = undefined;
+  });
+
+  test("'public' admits anyone, including a guest", () => {
+    setGuest();
+    expect(new TableAuth().identityAllows('public')).toBe(true);
+  });
+
+  test("'authenticated' admits a signed-in user and refuses a guest", () => {
+    setUser([]);
+    expect(new TableAuth().identityAllows('authenticated')).toBe(true);
+    setGuest();
+    expect(new TableAuth().identityAllows('authenticated')).toBe(false);
+  });
+
+  test('a roles list admits a holder of at least one role', () => {
+    setUser(['ops']);
+    expect(new TableAuth().identityAllows(['users', 'ops'])).toBe(true);
+    setUser(['dev']);
+    expect(new TableAuth().identityAllows(['users', 'ops'])).toBe(false);
+  });
+
+  test('a permission identity resolves through the consumer mapping; admin is break-glass', () => {
+    setUser(['usage']);
+    expect(new TableAuth().identityAllows({ permission: 'usage' })).toBe(true);
+    setUser(['users']);
+    expect(new TableAuth().identityAllows({ permission: 'usage' })).toBe(false);
+    setUser(['admin']);
+    expect(new TableAuth().identityAllows({ permission: 'usage' })).toBe(true);
+  });
+
+  test('an undeclared identity is admin-only, never open', () => {
+    setUser(['usage', 'users', 'ops']);
+    expect(new TableAuth().identityAllows(undefined)).toBe(false);
+    setUser(['admin']);
+    expect(new TableAuth().identityAllows(undefined)).toBe(true);
+  });
+
+  test('fails closed when no user can be resolved', () => {
+    (UserAuth as any).userRepo = {
+      getUser: () => {
+        throw new Error('no session');
+      },
+    };
+    expect(new TableAuth().identityAllows('authenticated')).toBe(false);
+    expect(new TableAuth().identityAllows({ permission: 'usage' })).toBe(false);
+  });
+});
+
+describe('TableAuth operation doors keep their declared-block semantics', () => {
+  afterEach(() => {
+    (UserAuth as any).userRepo = undefined;
+    (UserAuth as any).permissionRolesMapping = undefined;
+  });
+
+  test('a declared operation opens to its identity', () => {
+    setUser([]);
+    expect(new TableAuth().canPerform(new QueryOnlyTable(), 'query')).toBe(true);
+  });
+
+  test('within a declared block an undeclared operation stays closed — admin included', () => {
+    setUser(['admin']);
+    expect(new TableAuth().canPerform(new QueryOnlyTable(), 'insert')).toBe(false);
+    setUser([]);
+    expect(new TableAuth().canPerform(new QueryOnlyTable(), 'insert')).toBe(false);
+  });
+});