@restura/core 0.2.1 → 1.0.0-beta.1

package/dist/index.mjs

@@ -1,35 +1,5 @@
 var __defProp = Object.defineProperty;
-var __defProps = Object.defineProperties;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
-var __getOwnPropSymbols = Object.getOwnPropertySymbols;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __propIsEnum = Object.prototype.propertyIsEnumerable;
-var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
-var __spreadValues = (a, b) => {
-  for (var prop in b || (b = {}))
-    if (__hasOwnProp.call(b, prop))
-      __defNormalProp(a, prop, b[prop]);
-  if (__getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(b)) {
-      if (__propIsEnum.call(b, prop))
-        __defNormalProp(a, prop, b[prop]);
-    }
-  return a;
-};
-var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
-var __objRest = (source, exclude) => {
-  var target = {};
-  for (var prop in source)
-    if (__hasOwnProp.call(source, prop) && exclude.indexOf(prop) < 0)
-      target[prop] = source[prop];
-  if (source != null && __getOwnPropSymbols)
-    for (var prop of __getOwnPropSymbols(source)) {
-      if (exclude.indexOf(prop) < 0 && __propIsEnum.call(source, prop))
-        target[prop] = source[prop];
-    }
-  return target;
-};
 var __decorateClass = (decorators, target, key, kind) => {
   var result = kind > 1 ? void 0 : kind ? __getOwnPropDesc(target, key) : target;
   for (var i = decorators.length - 1, decorator; i >= 0; i--)
@@ -45,13 +15,12 @@ import winston from "winston";
 import { format } from "logform";
 
 // src/logger/loggerConfigSchema.ts
-import { z } from "zod";
+import { z } from "zod/v4";
 var loggerConfigSchema = z.object({
   level: z.enum(["info", "warn", "error", "debug", "silly"]).default("info")
 });
 
 // src/logger/logger.ts
-var loggerConfig = config.validate("logger", loggerConfigSchema);
 var consoleFormat = format.combine(
   format.timestamp({
     format: "YYYY-MM-DD HH:mm:ss.sss"
@@ -60,11 +29,11 @@ var consoleFormat = format.combine(
   format.padLevels(),
   format.colorize({ all: true }),
   format.printf((info) => {
-    return `[${info.timestamp}] ${info.level}  ${info.message}`;
+    return `[${info.timestamp}] ${info.level} ${info.message}`;
   })
 );
 var logger = winston.createLogger({
-  level: loggerConfig.level,
+  level: "info",
   format: format.combine(
     format.timestamp({
       format: "YYYY-MM-DD HH:mm:ss.sss"
@@ -72,29 +41,30 @@ var logger = winston.createLogger({
     format.errors({ stack: true }),
     format.json()
   ),
-  //defaultMeta: { service: 'user-service' },
-  transports: [
-    //
-    // - Write to all logs with level `info` and below to `combined.log`
-    // - Write all logs error (and below) to `error.log`.
-    // - Write all logs to standard out.
-    //
-    // new winston.transports.File({ filename: 'error.log', level: 'error' }),
-    // new winston.transports.File({ filename: 'combined.log' }),
-    new winston.transports.Console({ format: consoleFormat })
-  ]
+  transports: [new winston.transports.Console({ format: consoleFormat })]
 });
+(async () => {
+  try {
+    const loggerConfig = await config.validate("logger", loggerConfigSchema);
+    if (loggerConfig.level) {
+      logger.level = loggerConfig.level;
+    }
+  } catch (error) {
+    console.error("Failed to load logger config:", error);
+    throw new Error(
+      `Failed to initialize logger configuration: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+})();
 
 // src/restura/eventManager.ts
 import Bluebird from "bluebird";
 var EventManager = class {
-  constructor() {
-    this.actionHandlers = {
-      DATABASE_ROW_DELETE: [],
-      DATABASE_ROW_INSERT: [],
-      DATABASE_COLUMN_UPDATE: []
-    };
-  }
+  actionHandlers = {
+    DATABASE_ROW_DELETE: [],
+    DATABASE_ROW_INSERT: [],
+    DATABASE_COLUMN_UPDATE: []
+  };
   addRowInsertHandler(onInsert, filter) {
     this.actionHandlers.DATABASE_ROW_INSERT.push({
       callback: onInsert,
@@ -291,6 +261,10 @@ var HtmlStatusCodes = /* @__PURE__ */ ((HtmlStatusCodes2) => {
   return HtmlStatusCodes2;
 })(HtmlStatusCodes || {});
 var RsError = class _RsError {
+  err;
+  msg;
+  status;
+  stack;
   constructor(errCode, message) {
     this.err = errCode;
     this.msg = message || "";
@@ -443,9 +417,7 @@ import fs from "fs";
 import path from "path";
 import { FileUtils } from "@restura/internal";
 var CustomApiFactory = class {
-  constructor() {
-    this.customApis = {};
-  }
+  customApis = {};
   async loadApiFiles(baseFolderPath) {
     const apiVersions = ["v1"];
     for (const apiVersion of apiVersions) {
@@ -459,11 +431,10 @@ var CustomApiFactory = class {
     return this.customApis[customApiName];
   }
   async addDirectory(directoryPath, apiVersion) {
-    var _a2;
     const entries = await fs.promises.readdir(directoryPath, {
       withFileTypes: true
     });
-    const isTsx2 = (_a2 = process.argv[1]) == null ? void 0 : _a2.endsWith(".ts");
+    const isTsx2 = process.argv[1]?.endsWith(".ts");
     const isTsNode2 = process.env.TS_NODE_DEV || process.env.TS_NODE_PROJECT;
     const extension = isTsx2 || isTsNode2 ? "ts" : "js";
     const shouldEndWith = `.api.${apiVersion}.${extension}`;
@@ -528,6 +499,8 @@ var SqlUtils = class _SqlUtils {
 
 // src/restura/validators/ResponseValidator.ts
 var ResponseValidator = class _ResponseValidator {
+  rootMap;
+  database;
   constructor(schema) {
     this.database = schema.database;
     this.rootMap = {};
@@ -603,7 +576,7 @@ var ResponseValidator = class _ResponseValidator {
     if (path5.length === 0 || path5.length > 2 || path5[0] === "") return { validator: "any", isOptional: false };
     const tableName = path5.length == 2 ? path5[0] : name, columnName = path5.length == 2 ? path5[1] : path5[0];
     const table = this.database.find((t) => t.name == tableName);
-    const column = table == null ? void 0 : table.columns.find((c) => c.name == columnName);
+    const column = table?.columns.find((c) => c.name == columnName);
     if (!table || !column) return { validator: "any", isOptional: false };
     let validator = SqlUtils.convertDatabaseTypeToTypescript(
       column.type,
@@ -687,10 +660,12 @@ var ResponseValidator = class _ResponseValidator {
 var ApiTree = class _ApiTree {
   constructor(namespace, database) {
     this.database = database;
-    this.data = [];
     this.namespace = namespace;
     this.children = /* @__PURE__ */ new Map();
   }
+  namespace;
+  data = [];
+  children;
   static createRootNode(database) {
     return new _ApiTree(null, database);
   }
@@ -834,7 +809,7 @@ var ApiTree = class _ApiTree {
       tableName = tableAliasSplit[1];
       table = this.database.find((t) => t.name == tableName);
     }
-    const column = table == null ? void 0 : table.columns.find((c) => c.name == columnName);
+    const column = table?.columns.find((c) => c.name == columnName);
     if (!table || !column) return { responseType: "any", isNullable: false };
     return {
       responseType: SqlUtils.convertDatabaseTypeToTypescript(column.type, column.value),
@@ -865,16 +840,17 @@ function apiGenerator(schema) {
 			${schema.customTypes.join("\n")}
 		}`;
   }
-  return prettier.format(apiString, __spreadValues({
-    parser: "typescript"
-  }, {
-    trailingComma: "none",
-    tabWidth: 4,
-    useTabs: true,
-    endOfLine: "lf",
-    printWidth: 120,
-    singleQuote: true
-  }));
+  return prettier.format(apiString, {
+    parser: "typescript",
+    ...{
+      trailingComma: "none",
+      tabWidth: 4,
+      useTabs: true,
+      endOfLine: "lf",
+      printWidth: 120,
+      singleQuote: true
+    }
+  });
 }
 
 // src/restura/generators/customTypeValidationGenerator.ts
@@ -885,7 +861,7 @@ import * as TJS from "typescript-json-schema";
 function customTypeValidationGenerator(currentSchema) {
   const schemaObject = {};
   const customInterfaceNames = currentSchema.customTypes.map((customType) => {
-    const matches = customType.match(new RegExp("(?<=interface\\s)(\\w+)|(?<=type\\s)(\\w+)", "g"));
+    const matches = customType.match(/(?<=interface\s)(\w+)|(?<=type\s)(\w+)/g);
     if (matches && matches.length > 0) return matches[0];
     return "";
   }).filter(Boolean);
@@ -929,16 +905,17 @@ function modelGenerator(schema) {
     modelString += convertTable(table);
   }
   modelString += `}`;
-  return prettier2.format(modelString, __spreadValues({
-    parser: "typescript"
-  }, {
-    trailingComma: "none",
-    tabWidth: 4,
-    useTabs: true,
-    endOfLine: "lf",
-    printWidth: 120,
-    singleQuote: true
-  }));
+  return prettier2.format(modelString, {
+    parser: "typescript",
+    ...{
+      trailingComma: "none",
+      tabWidth: 4,
+      useTabs: true,
+      endOfLine: "lf",
+      printWidth: 120,
+      singleQuote: true
+    }
+  });
 }
 function convertTable(table) {
   let modelString = `	export interface ${StringUtils2.capitalizeFirst(table.name)} {
@@ -990,20 +967,21 @@ function addApiResponseFunctions(req, res, next) {
         htmlStatusCode = 500;
       }
     }
-    const errorData = __spreadValues({
+    const errorData = {
       err: shortError,
-      msg
-    }, restura.resturaConfig.sendErrorStackTrace && stack ? { stack } : {});
+      msg,
+      ...restura.resturaConfig.sendErrorStackTrace && stack ? { stack } : {}
+    };
     res.status(htmlStatusCode).send(errorData);
   };
   next();
 }
 
-// src/restura/middleware/authenticateUser.ts
-function authenticateUser(applicationAuthenticateHandler) {
+// src/restura/middleware/authenticateRequester.ts
+function authenticateRequester(applicationAuthenticateHandler) {
   return (req, res, next) => {
-    applicationAuthenticateHandler(req, res, (userDetails) => {
-      req.requesterDetails = __spreadValues({ host: req.hostname, ipAddress: req.ip || "" }, userDetails);
+    applicationAuthenticateHandler(req, res, (authenticatedRequesterDetails) => {
+      req.requesterDetails = { host: req.hostname, ipAddress: req.ip || "", ...authenticatedRequesterDetails };
       next();
     });
   };
@@ -1058,22 +1036,7 @@ var groupBySchema = z3.object({
 var whereDataSchema = z3.object({
   tableName: z3.string().optional(),
   columnName: z3.string().optional(),
-  operator: z3.enum([
-    "=",
-    "<",
-    ">",
-    "<=",
-    ">=",
-    "!=",
-    "LIKE",
-    "NOT LIKE",
-    "IN",
-    "NOT IN",
-    "STARTS WITH",
-    "ENDS WITH",
-    "IS",
-    "IS NOT"
-  ]).optional(),
+  operator: z3.enum(["=", "<", ">", "<=", ">=", "!=", "LIKE", "IN", "NOT IN", "STARTS WITH", "ENDS WITH", "IS", "IS NOT"]).optional(),
   value: z3.string().or(z3.number()).optional(),
   custom: z3.string().optional(),
   conjunction: z3.enum(["AND", "OR"]).optional()
@@ -1109,13 +1072,15 @@ var responseDataSchema = z3.object({
     orderBy: orderBySchema.optional()
   }).optional(),
   type: z3.string().optional()
+  // Type allows you to override the type of the response, used in custom selectors
 }).strict();
 var routeDataBaseSchema = z3.object({
   method: z3.enum(["GET", "POST", "PUT", "PATCH", "DELETE"]),
   name: z3.string(),
   description: z3.string(),
   path: z3.string(),
-  roles: z3.array(z3.string())
+  roles: z3.array(z3.string()),
+  scopes: z3.array(z3.string())
 }).strict();
 var standardRouteSchema = routeDataBaseSchema.extend({
   type: z3.enum(["ONE", "ARRAY", "PAGED"]),
@@ -1255,6 +1220,7 @@ var columnDataSchema = z3.object({
   ]),
   isNullable: z3.boolean(),
   roles: z3.array(z3.string()),
+  scopes: z3.array(z3.string()),
   comment: z3.string().optional(),
   default: z3.string().optional(),
   value: z3.string().optional(),
@@ -1301,6 +1267,7 @@ var tableDataSchema = z3.object({
   foreignKeys: z3.array(foreignKeyDataSchema),
   checkConstraints: z3.array(checkConstraintDataSchema),
   roles: z3.array(z3.string()),
+  scopes: z3.array(z3.string()),
   notify: z3.union([z3.literal("ALL"), z3.array(z3.string())]).optional()
 }).strict();
 var endpointDataSchema = z3.object({
@@ -1314,6 +1281,7 @@ var resturaSchema = z3.object({
   endpoints: z3.array(endpointDataSchema),
   globalParams: z3.array(z3.string()),
   roles: z3.array(z3.string()),
+  scopes: z3.array(z3.string()),
   customTypes: z3.array(z3.string())
 }).strict();
 async function isSchemaValid(schemaToCheck) {
@@ -1411,7 +1379,7 @@ function isValidType(type, requestValue) {
   try {
     expectValidType(type, requestValue);
     return true;
-  } catch (e) {
+  } catch {
     return false;
   }
 }
@@ -1447,7 +1415,7 @@ function performTypeCheck(requestValue, validator, requestParamName) {
   }
   try {
     validatorDataSchemeValue.parse(validator.value);
-  } catch (e) {
+  } catch {
     throw new RsError("SCHEMA_ERROR", `Schema validator value (${validator.value}) is not a valid type`);
   }
 }
@@ -1538,9 +1506,8 @@ async function schemaValidation(req, res, next) {
 }
 
 // src/restura/schemas/resturaConfigSchema.ts
-import { z as z5 } from "zod";
-var _a;
-var isTsx = (_a = process.argv[1]) == null ? void 0 : _a.endsWith(".ts");
+import { z as z5 } from "zod/v4";
+var isTsx = process.argv[1]?.endsWith(".ts");
 var isTsNode = process.env.TS_NODE_DEV || process.env.TS_NODE_PROJECT;
 var customApiFolderPath = isTsx || isTsNode ? "/src/api" : "/dist/api";
 var resturaConfigSchema = z5.object({
@@ -1549,7 +1516,8 @@ var resturaConfigSchema = z5.object({
   schemaFilePath: z5.string().default(process.cwd() + "/restura.schema.json"),
   customApiFolderPath: z5.string().default(process.cwd() + customApiFolderPath),
   generatedTypesPath: z5.string().default(process.cwd() + "/src/@types"),
-  fileTempCachePath: z5.string().optional()
+  fileTempCachePath: z5.string().optional(),
+  scratchDatabaseSuffix: z5.string().optional()
 });
 
 // src/restura/sql/PsqlEngine.ts
@@ -1635,13 +1603,14 @@ function SQL(strings, ...values) {
 
 // src/restura/sql/PsqlConnection.ts
 var PsqlConnection = class {
+  instanceId;
   constructor(instanceId) {
     this.instanceId = instanceId || crypto.randomUUID();
   }
   // eslint-disable-next-line  @typescript-eslint/no-explicit-any
   async queryOne(query, options, requesterDetails) {
     const formattedQuery = questionMarksToOrderedParams(query);
-    const meta = __spreadValues({ connectionInstanceId: this.instanceId }, requesterDetails);
+    const meta = { connectionInstanceId: this.instanceId, ...requesterDetails };
     this.logSqlStatement(formattedQuery, options, meta);
     const queryMetadata = `--QUERY_METADATA(${JSON.stringify(meta)})
 `;
@@ -1654,7 +1623,7 @@ var PsqlConnection = class {
       return response.rows[0];
     } catch (error) {
       if (RsError.isRsError(error)) throw error;
-      if ((error == null ? void 0 : error.routine) === "_bt_check_unique") {
+      if (error?.routine === "_bt_check_unique") {
         throw new RsError("DUPLICATE", error.message);
       }
       throw new RsError("DATABASE_ERROR", `${error.message}`);
@@ -1663,7 +1632,7 @@ var PsqlConnection = class {
   // eslint-disable-next-line  @typescript-eslint/no-explicit-any
   async runQuery(query, options, requesterDetails) {
     const formattedQuery = questionMarksToOrderedParams(query);
-    const meta = __spreadValues({ connectionInstanceId: this.instanceId }, requesterDetails);
+    const meta = { connectionInstanceId: this.instanceId, ...requesterDetails };
     this.logSqlStatement(formattedQuery, options, meta);
     const queryMetadata = `--QUERY_METADATA(${JSON.stringify(meta)})
 `;
@@ -1673,7 +1642,7 @@ var PsqlConnection = class {
       this.logQueryDuration(startTime);
       return response.rows;
     } catch (error) {
-      if ((error == null ? void 0 : error.routine) === "_bt_check_unique") {
+      if (error?.routine === "_bt_check_unique") {
         throw new RsError("DUPLICATE", error.message);
       }
       throw new RsError("DATABASE_ERROR", `${error.message}`);
@@ -1723,13 +1692,20 @@ var PsqlPool = class extends PsqlConnection {
     super();
     this.poolConfig = poolConfig;
     this.pool = new Pool(poolConfig);
-    this.queryOne("SELECT NOW();", [], { isSystemUser: true, role: "", host: "localhost", ipAddress: "" }).then(() => {
+    this.queryOne("SELECT NOW();", [], {
+      isSystemUser: true,
+      role: "",
+      host: "localhost",
+      ipAddress: "",
+      scopes: []
+    }).then(() => {
       logger.info("Connected to PostgreSQL database");
     }).catch((error) => {
       logger.error("Error connecting to database", error);
       process.exit(1);
     });
   }
+  pool;
   async query(query, values) {
     return this.pool.query(query, values);
   }
@@ -1739,7 +1715,12 @@ var PsqlPool = class extends PsqlConnection {
 import { ObjectUtils as ObjectUtils3 } from "@redskytech/core-utils";
 var SqlEngine = class {
   async runQueryForRoute(req, routeData, schema) {
-    if (!this.doesRoleHavePermissionToTable(req.requesterDetails.role, schema, routeData.table))
+    if (!this.canRequesterAccessTable(
+      req.requesterDetails.role,
+      req.requesterDetails.scopes,
+      schema,
+      routeData.table
+    ))
       throw new RsError("FORBIDDEN", "You do not have permission to access this table");
     switch (routeData.method) {
       case "POST":
@@ -1758,7 +1739,7 @@ var SqlEngine = class {
     if (!tableSchema) throw new RsError("SCHEMA_ERROR", `Table ${tableName} not found in schema`);
     return tableSchema;
   }
-  doesRoleHavePermissionToColumn(role, schema, item, joins) {
+  canRequesterAccessColumn(requesterRole, requesterScopes, schema, item, joins) {
     if (item.type) return true;
     if (item.selector) {
       let tableName = item.selector.split(".")[0];
@@ -1774,26 +1755,36 @@ var SqlEngine = class {
       const columnSchema = tableSchema.columns.find((item2) => item2.name === columnName);
       if (!columnSchema)
         throw new RsError("SCHEMA_ERROR", `Column ${columnName} not found in table ${tableName}`);
-      const doesColumnHaveRoles = ObjectUtils3.isArrayWithData(columnSchema.roles);
-      if (!doesColumnHaveRoles) return true;
-      if (!role) return false;
-      return columnSchema.roles.includes(role);
+      if (ObjectUtils3.isArrayWithData(columnSchema.roles)) {
+        if (!requesterRole) return false;
+        return columnSchema.roles.includes(requesterRole);
+      }
+      if (ObjectUtils3.isArrayWithData(columnSchema.scopes)) {
+        if (!requesterScopes) return false;
+        return columnSchema.scopes.some((scope) => requesterScopes.includes(scope));
+      }
+      return true;
     }
     if (item.subquery) {
       return ObjectUtils3.isArrayWithData(
         item.subquery.properties.filter((nestedItem) => {
-          return this.doesRoleHavePermissionToColumn(role, schema, nestedItem, joins);
+          return this.canRequesterAccessColumn(requesterRole, requesterScopes, schema, nestedItem, joins);
         })
       );
     }
     return false;
   }
-  doesRoleHavePermissionToTable(userRole, schema, tableName) {
+  canRequesterAccessTable(requesterRole, requesterScopes, schema, tableName) {
     const tableSchema = this.getTableSchema(schema, tableName);
-    const doesTableHaveRoles = ObjectUtils3.isArrayWithData(tableSchema.roles);
-    if (!doesTableHaveRoles) return true;
-    if (!userRole) return false;
-    return tableSchema.roles.includes(userRole);
+    if (ObjectUtils3.isArrayWithData(tableSchema.roles)) {
+      if (!requesterRole) return false;
+      return tableSchema.roles.includes(requesterRole);
+    }
+    if (ObjectUtils3.isArrayWithData(tableSchema.scopes)) {
+      if (!requesterScopes) return false;
+      return tableSchema.scopes.some((scope) => requesterScopes.includes(scope));
+    }
+    return true;
   }
   replaceParamKeywords(value, routeData, req, sqlParams) {
     let returnValue = value;
@@ -1802,11 +1793,10 @@ var SqlEngine = class {
     return returnValue;
   }
   replaceLocalParamKeywords(value, routeData, req, sqlParams) {
-    var _a2;
     if (!routeData.request) return value;
     const data = req.data;
     if (typeof value === "string") {
-      (_a2 = value.match(/\$[a-zA-Z][a-zA-Z0-9_]+/g)) == null ? void 0 : _a2.forEach((param) => {
+      value.match(/\$[a-zA-Z][a-zA-Z0-9_]+/g)?.forEach((param) => {
         const requestParam = routeData.request.find((item) => {
           return item.name === param.replace("$", "");
         });
@@ -1819,9 +1809,8 @@ var SqlEngine = class {
     return value;
   }
   replaceGlobalParamKeywords(value, routeData, req, sqlParams) {
-    var _a2;
     if (typeof value === "string") {
-      (_a2 = value.match(/#[a-zA-Z][a-zA-Z0-9_]+/g)) == null ? void 0 : _a2.forEach((param) => {
+      value.match(/#[a-zA-Z][a-zA-Z0-9_]+/g)?.forEach((param) => {
         param = param.replace("#", "");
         const globalParamValue = req.requesterDetails[param];
         if (!globalParamValue)
@@ -1911,10 +1900,32 @@ negate = "!"
 operator = "and"i / "or"i
 
 	   
-column = left:text "." right:text { return  \`\${quoteSqlIdentity(left)}.\${quoteSqlIdentity(right)}\`; } 
-    / 
-    text:text { return quoteSqlIdentity(text); } 
+column = first:text rest:("." text)* { 
+    const partsArray = [first];
+    if (rest && rest.length > 0) {
+        partsArray.push(...rest.map(item => item[1]));
+    }
     
+    if (partsArray.length > 3) {
+        throw new SyntaxError('Column path cannot have more than 3 parts (table.column.jsonField)');
+    }
+    
+    if (partsArray.length === 1) {
+        return quoteSqlIdentity(partsArray[0]);
+    }
+    const tableName = quoteSqlIdentity(partsArray[0]);
+    
+    // If we only have two parts (table.column), use regular dot notation
+    if (partsArray.length === 2) {
+        return tableName + "." + quoteSqlIdentity(partsArray[1]);
+    }
+    
+    // For JSON paths (more than 2 parts), first part is a column, last part uses ->>
+    const jsonColumn = quoteSqlIdentity(partsArray[1]);
+    const lastPart = partsArray[partsArray.length - 1];
+    const result = tableName + "." + jsonColumn + "->>'" + lastPart + "'";
+    return result;
+}
 
 text = text:[a-z0-9 \\t\\r\\n\\-_:@']i+ { return text.join(""); }
 
@@ -1944,19 +1955,24 @@ var filterPsqlParser_default = filterPsqlParser;
 var { Client, types } = pg2;
 var systemUser = {
   role: "",
+  scopes: [],
   host: "",
   ipAddress: "",
   isSystemUser: true
 };
 var PsqlEngine = class extends SqlEngine {
-  constructor(psqlConnectionPool, shouldListenForDbTriggers = false) {
+  constructor(psqlConnectionPool, shouldListenForDbTriggers = false, scratchDatabaseSuffix = "") {
     super();
     this.psqlConnectionPool = psqlConnectionPool;
     this.setupPgReturnTypes();
     if (shouldListenForDbTriggers) {
       this.setupTriggerListeners = this.listenForDbTriggers();
     }
+    this.scratchDbName = `${psqlConnectionPool.poolConfig.database}_scratch${scratchDatabaseSuffix ? `_${scratchDatabaseSuffix}` : ""}`;
   }
+  setupTriggerListeners;
+  triggerClient;
+  scratchDbName = "";
   async close() {
     if (this.triggerClient) {
       await this.triggerClient.end();
@@ -2085,27 +2101,22 @@ var PsqlEngine = class extends SqlEngine {
     sqlStatements.push(triggers.join("\n"));
     return sqlStatements.join("\n\n");
   }
-  async getScratchPool() {
-    var _a2, _b;
+  async getNewPublicSchemaAndScratchPool() {
     const scratchDbExists = await this.psqlConnectionPool.runQuery(
       `SELECT *
              FROM pg_database
-             WHERE datname = '${this.psqlConnectionPool.poolConfig.database}_scratch';`,
+             WHERE datname = '${this.scratchDbName}';`,
       [],
       systemUser
     );
     if (scratchDbExists.length === 0) {
-      await this.psqlConnectionPool.runQuery(
-        `CREATE DATABASE ${this.psqlConnectionPool.poolConfig.database}_scratch;`,
-        [],
-        systemUser
-      );
+      await this.psqlConnectionPool.runQuery(`CREATE DATABASE ${this.scratchDbName};`, [], systemUser);
     }
     const scratchPool = new PsqlPool({
       host: this.psqlConnectionPool.poolConfig.host,
       port: this.psqlConnectionPool.poolConfig.port,
       user: this.psqlConnectionPool.poolConfig.user,
-      database: this.psqlConnectionPool.poolConfig.database + "_scratch",
+      database: this.scratchDbName,
       password: this.psqlConnectionPool.poolConfig.password,
       max: this.psqlConnectionPool.poolConfig.max,
       idleTimeoutMillis: this.psqlConnectionPool.poolConfig.idleTimeoutMillis,
@@ -2118,16 +2129,17 @@ var PsqlEngine = class extends SqlEngine {
       systemUser
     );
     const schemaComment = await this.psqlConnectionPool.runQuery(
-      `SELECT pg_description.description
-                                                                                               FROM pg_description
-                                                                                                        JOIN pg_namespace ON pg_namespace.oid = pg_description.objoid
-                                                                                   WHERE pg_namespace.nspname = 'public';`,
+      `
+			SELECT pg_description.description
+			FROM pg_description
+			JOIN pg_namespace ON pg_namespace.oid = pg_description.objoid
+			WHERE pg_namespace.nspname = 'public';`,
       [],
       systemUser
     );
-    if ((_a2 = schemaComment[0]) == null ? void 0 : _a2.description) {
+    if (schemaComment[0]?.description) {
       await scratchPool.runQuery(
-        `COMMENT ON SCHEMA public IS '${(_b = schemaComment[0]) == null ? void 0 : _b.description}';`,
+        `COMMENT ON SCHEMA public IS '${schemaComment[0]?.description}';`,
         [],
         systemUser
       );
@@ -2135,7 +2147,7 @@ var PsqlEngine = class extends SqlEngine {
     return scratchPool;
   }
   async diffDatabaseToSchema(schema) {
-    const scratchPool = await this.getScratchPool();
+    const scratchPool = await this.getNewPublicSchemaAndScratchPool();
     await this.createDatabaseFromSchema(schema, scratchPool);
     const originalClient = new Client({
       database: this.psqlConnectionPool.poolConfig.database,
@@ -2145,7 +2157,7 @@ var PsqlEngine = class extends SqlEngine {
       port: this.psqlConnectionPool.poolConfig.port
     });
     const scratchClient = new Client({
-      database: this.psqlConnectionPool.poolConfig.database + "_scratch",
+      database: this.scratchDbName,
       user: this.psqlConnectionPool.poolConfig.user,
       password: this.psqlConnectionPool.poolConfig.password,
       host: this.psqlConnectionPool.poolConfig.host,
@@ -2160,24 +2172,30 @@ var PsqlEngine = class extends SqlEngine {
     await Promise.all(endPromises);
     return diff.join("\n");
   }
-  createNestedSelect(req, schema, item, routeData, userRole, sqlParams) {
+  createNestedSelect(req, schema, item, routeData, sqlParams) {
     if (!item.subquery) return "";
     if (!ObjectUtils4.isArrayWithData(
       item.subquery.properties.filter((nestedItem) => {
-        return this.doesRoleHavePermissionToColumn(req.requesterDetails.role, schema, nestedItem, [
-          ...routeData.joins,
-          ...item.subquery.joins
-        ]);
+        return this.canRequesterAccessColumn(
+          req.requesterDetails.role,
+          req.requesterDetails.scopes,
+          schema,
+          nestedItem,
+          [...routeData.joins, ...item.subquery.joins]
+        );
       })
     )) {
       return "'[]'";
     }
     return `COALESCE((SELECT JSON_AGG(JSON_BUILD_OBJECT(
 			${item.subquery.properties.map((nestedItem) => {
-      if (!this.doesRoleHavePermissionToColumn(req.requesterDetails.role, schema, nestedItem, [
-        ...routeData.joins,
-        ...item.subquery.joins
-      ])) {
+      if (!this.canRequesterAccessColumn(
+        req.requesterDetails.role,
+        req.requesterDetails.scopes,
+        schema,
+        nestedItem,
+        [...routeData.joins, ...item.subquery.joins]
+      )) {
         return;
       }
       if (nestedItem.subquery) {
@@ -2187,7 +2205,6 @@ var PsqlEngine = class extends SqlEngine {
           schema,
           nestedItem,
           routeData,
-          userRole,
           sqlParams
         )}`;
       }
@@ -2196,7 +2213,7 @@ var PsqlEngine = class extends SqlEngine {
 						)) 
 						FROM
 							"${item.subquery.table}"
-							${this.generateJoinStatements(req, item.subquery.joins, item.subquery.table, routeData, schema, userRole, sqlParams)}
+							${this.generateJoinStatements(req, item.subquery.joins, item.subquery.table, routeData, schema, sqlParams)}
 							${this.generateWhereClause(req, item.subquery.where, routeData, sqlParams)}
 					), '[]')`;
   }
@@ -2206,7 +2223,7 @@ var PsqlEngine = class extends SqlEngine {
     (routeData.assignments || []).forEach((assignment) => {
       parameterObj[assignment.name] = this.replaceParamKeywords(assignment.value, routeData, req, sqlParams);
     });
-    const query = insertObjectQuery(routeData.table, __spreadValues(__spreadValues({}, req.data), parameterObj));
+    const query = insertObjectQuery(routeData.table, { ...req.data, ...parameterObj });
     const createdItem = await this.psqlConnectionPool.queryOne(
       query,
       sqlParams,
@@ -2221,24 +2238,29 @@ var PsqlEngine = class extends SqlEngine {
     };
     const whereData = [whereId];
     req.data = { id: insertId };
-    return this.executeGetRequest(req, __spreadProps(__spreadValues({}, routeData), { where: whereData }), schema);
+    return this.executeGetRequest(req, { ...routeData, where: whereData }, schema);
   }
   async executeGetRequest(req, routeData, schema) {
     const DEFAULT_PAGED_PAGE_NUMBER = 0;
     const DEFAULT_PAGED_PER_PAGE_NUMBER = 25;
     const sqlParams = [];
-    const userRole = req.requesterDetails.role;
     let sqlStatement = "";
     const selectColumns = [];
     routeData.response.forEach((item) => {
-      if (item.subquery || this.doesRoleHavePermissionToColumn(userRole, schema, item, routeData.joins))
+      if (item.subquery || this.canRequesterAccessColumn(
+        req.requesterDetails.role,
+        req.requesterDetails.scopes,
+        schema,
+        item,
+        routeData.joins
+      ))
         selectColumns.push(item);
     });
     if (!selectColumns.length) throw new RsError("FORBIDDEN", `You do not have permission to access this data.`);
     let selectStatement = "SELECT \n";
     selectStatement += `	${selectColumns.map((item) => {
       if (item.subquery) {
-        return `${this.createNestedSelect(req, schema, item, routeData, userRole, sqlParams)} AS ${escapeColumnName(
+        return `${this.createNestedSelect(req, schema, item, routeData, sqlParams)} AS ${escapeColumnName(
           item.name
         )}`;
       }
@@ -2253,7 +2275,6 @@ var PsqlEngine = class extends SqlEngine {
       routeData.table,
       routeData,
       schema,
-      userRole,
       sqlParams
     );
     sqlStatement += this.generateWhereClause(req, routeData.where, routeData, sqlParams);
@@ -2297,7 +2318,7 @@ var PsqlEngine = class extends SqlEngine {
   }
   async executeUpdateRequest(req, routeData, schema) {
     const sqlParams = [];
-    const _a2 = req.body, { id } = _a2, bodyNoId = __objRest(_a2, ["id"]);
+    const { id, ...bodyNoId } = req.body;
     const table = schema.database.find((item) => {
       return item.name === routeData.table;
     });
@@ -2326,7 +2347,6 @@ var PsqlEngine = class extends SqlEngine {
       routeData.table,
       routeData,
       schema,
-      req.requesterDetails.role,
       sqlParams
     );
     const whereClause = this.generateWhereClause(req, routeData.where, routeData, sqlParams);
@@ -2338,10 +2358,15 @@ DELETE FROM "${routeData.table}" ${joinStatement} ${whereClause}`;
     await this.psqlConnectionPool.runQuery(deleteStatement, sqlParams, req.requesterDetails);
     return true;
   }
-  generateJoinStatements(req, joins, baseTable, routeData, schema, userRole, sqlParams) {
+  generateJoinStatements(req, joins, baseTable, routeData, schema, sqlParams) {
     let joinStatements = "";
     joins.forEach((item) => {
-      if (!this.doesRoleHavePermissionToTable(userRole, schema, item.table))
+      if (!this.canRequesterAccessTable(
+        req.requesterDetails.role,
+        req.requesterDetails.scopes,
+        schema,
+        item.table
+      ))
         throw new RsError("FORBIDDEN", "You do not have permission to access this table");
       if (item.custom) {
         const customReplaced = this.replaceParamKeywords(item.custom, routeData, req, sqlParams);
@@ -2396,41 +2421,36 @@ DELETE FROM "${routeData.table}" ${joinStatement} ${whereClause}`;
           `Invalid where clause in route ${routeData.name}, missing required fields if not custom`
         );
       let operator = item.operator;
-      let value = item.value;
       if (operator === "LIKE") {
-        value = `'%${value}%'`;
-      } else if (operator === "NOT LIKE") {
-        value = `'%${value}%'`;
+        item.value = `'%${item.value}%'`;
       } else if (operator === "STARTS WITH") {
         operator = "LIKE";
-        value = `'${value}%'`;
+        item.value = `'${item.value}%'`;
       } else if (operator === "ENDS WITH") {
         operator = "LIKE";
-        value = `'%${value}'`;
+        item.value = `'%${item.value}'`;
       }
-      const replacedValue = this.replaceParamKeywords(value, routeData, req, sqlParams);
+      const replacedValue = this.replaceParamKeywords(item.value, routeData, req, sqlParams);
       whereClause += `	${item.conjunction || ""} "${item.tableName}"."${item.columnName}" ${operator.replace("LIKE", "ILIKE")} ${["IN", "NOT IN"].includes(operator) ? `(${replacedValue})` : replacedValue}
 `;
     });
     const data = req.data;
-    if (routeData.type === "PAGED" && !!(data == null ? void 0 : data.filter)) {
+    if (routeData.type === "PAGED" && !!data?.filter) {
       let statement = data.filter.replace(/\$[a-zA-Z][a-zA-Z0-9_]+/g, (value) => {
-        var _a2;
         const requestParam = routeData.request.find((item) => {
           return item.name === value.replace("$", "");
         });
         if (!requestParam)
           throw new RsError("SCHEMA_ERROR", `Invalid route keyword in route ${routeData.name}`);
-        return ((_a2 = data[requestParam.name]) == null ? void 0 : _a2.toString()) || "";
+        return data[requestParam.name]?.toString() || "";
       });
       statement = statement.replace(/#[a-zA-Z][a-zA-Z0-9_]+/g, (value) => {
-        var _a2;
         const requestParam = routeData.request.find((item) => {
           return item.name === value.replace("#", "");
         });
         if (!requestParam)
           throw new RsError("SCHEMA_ERROR", `Invalid route keyword in route ${routeData.name}`);
-        return ((_a2 = data[requestParam.name]) == null ? void 0 : _a2.toString()) || "";
+        return data[requestParam.name]?.toString() || "";
       });
       statement = filterPsqlParser_default.parse(statement);
       if (whereClause.startsWith("WHERE")) {
@@ -2671,8 +2691,9 @@ import { FileUtils as FileUtils2 } from "@restura/internal";
 import Bluebird3 from "bluebird";
 import * as os2 from "os";
 var TempCache = class {
+  location;
+  maxDurationDays = 7;
   constructor(location) {
-    this.maxDurationDays = 7;
     this.location = location || os2.tmpdir();
     FileUtils2.ensureDir(this.location).catch((e) => {
       throw e;
@@ -2697,15 +2718,24 @@ var TempCache = class {
 
 // src/restura/restura.ts
 var ResturaEngine = class {
-  constructor() {
-    this.publicEndpoints = {
-      GET: [],
-      POST: [],
-      PUT: [],
-      PATCH: [],
-      DELETE: []
-    };
-  }
+  // Make public so other modules can access without re-parsing the config
+  resturaConfig;
+  multerCommonUpload;
+  resturaRouter;
+  publicEndpoints = {
+    GET: [],
+    POST: [],
+    PUT: [],
+    PATCH: [],
+    DELETE: []
+  };
+  expressApp;
+  schema;
+  responseValidator;
+  authenticationHandler;
+  customTypeValidation;
+  psqlConnectionPool;
+  psqlEngine;
   /**
    * Initializes the Restura engine with the provided Express application.
    *
@@ -2713,11 +2743,11 @@ var ResturaEngine = class {
    * @returns A promise that resolves when the initialization is complete.
    */
   async init(app, authenticationHandler, psqlConnectionPool) {
-    this.resturaConfig = config2.validate("restura", resturaConfigSchema);
+    this.resturaConfig = await config2.validate("restura", resturaConfigSchema);
     this.multerCommonUpload = getMulterUpload(this.resturaConfig.fileTempCachePath);
     new TempCache(this.resturaConfig.fileTempCachePath);
     this.psqlConnectionPool = psqlConnectionPool;
-    this.psqlEngine = new PsqlEngine(this.psqlConnectionPool, true);
+    this.psqlEngine = new PsqlEngine(this.psqlConnectionPool, true, this.resturaConfig.scratchDatabaseSuffix);
     await customApiFactory_default.loadApiFiles(this.resturaConfig.customApiFolderPath);
     this.authenticationHandler = authenticationHandler;
     app.use(compression());
@@ -2726,7 +2756,7 @@ var ResturaEngine = class {
     app.use(cookieParser());
     app.disable("x-powered-by");
     app.use("/", addApiResponseFunctions);
-    app.use("/api/", authenticateUser(this.authenticationHandler));
+    app.use("/api/", authenticateRequester(this.authenticationHandler));
     app.use("/restura", this.resturaAuthentication);
     app.put(
       "/restura/v1/schema",
@@ -2747,7 +2777,7 @@ var ResturaEngine = class {
   }
   /**
    * Determines if a given endpoint is public based on the HTTP method and full URL. This
-   * is determined on whether the endpoint in the schema has no roles assigned to it.
+   * is determined on whether the endpoint in the schema has no roles or scopes assigned to it.
    *
    * @param method - The HTTP method (e.g., 'GET', 'POST', 'PUT', 'PATCH', 'DELETE').
    * @param fullUrl - The full URL of the endpoint.
@@ -2836,7 +2866,8 @@ var ResturaEngine = class {
         route.path = route.path.startsWith("/") ? route.path : `/${route.path}`;
         route.path = route.path.endsWith("/") ? route.path.slice(0, -1) : route.path;
         const fullUrl = `${baseUrl}${route.path}`;
-        if (route.roles.length === 0) this.publicEndpoints[route.method].push(fullUrl);
+        if (route.roles.length === 0 && route.scopes.length === 0)
+          this.publicEndpoints[route.method].push(fullUrl);
         this.resturaRouter[route.method.toLowerCase()](
           route.path,
           // <-- Notice we only use path here since the baseUrl is already added to the router.
@@ -2886,10 +2917,10 @@ var ResturaEngine = class {
     );
     this.generateResturaGlobalTypes(path4.join(this.resturaConfig.generatedTypesPath, "restura.d.ts"));
   }
-  async getSchema(req, res) {
+  async getSchema(_req, res) {
     res.send({ data: this.schema });
   }
-  async getSchemaAndTypes(req, res) {
+  async getSchemaAndTypes(_req, res) {
     try {
       const schema = await this.getLatestFileSystemSchema();
       const apiText = await apiGenerator(schema);
@@ -2900,8 +2931,7 @@ var ResturaEngine = class {
     }
   }
   async getMulterFilesIfAny(req, res, routeData) {
-    var _a2;
-    if (!((_a2 = req.header("content-type")) == null ? void 0 : _a2.includes("multipart/form-data"))) return;
+    if (!req.header("content-type")?.includes("multipart/form-data")) return;
     if (!this.isCustomRoute(routeData)) return;
     if (!routeData.fileUploadType) {
       throw new RsError("BAD_REQUEST", "File upload type not defined for route");
@@ -2964,16 +2994,17 @@ var ResturaEngine = class {
     await customFunction(req, res, routeData);
   }
   async storeFileSystemSchema() {
-    const schemaPrettyStr = await prettier3.format(JSON.stringify(this.schema), __spreadValues({
-      parser: "json"
-    }, {
-      trailingComma: "none",
-      tabWidth: 4,
-      useTabs: true,
-      endOfLine: "lf",
-      printWidth: 120,
-      singleQuote: true
-    }));
+    const schemaPrettyStr = await prettier3.format(JSON.stringify(this.schema), {
+      parser: "json",
+      ...{
+        trailingComma: "none",
+        tabWidth: 4,
+        useTabs: true,
+        endOfLine: "lf",
+        printWidth: 120,
+        singleQuote: true
+      }
+    });
     fs4.writeFileSync(this.resturaConfig.schemaFilePath, schemaPrettyStr);
   }
   resetPublicEndpoints() {
@@ -2986,9 +3017,13 @@ var ResturaEngine = class {
     };
   }
   validateAuthorization(req, routeData) {
-    const role = req.requesterDetails.role;
-    if (routeData.roles.length === 0 || !role) return;
-    if (!routeData.roles.includes(role)) throw new RsError("FORBIDDEN", "Not authorized to access this endpoint");
+    const requesterRole = req.requesterDetails.role;
+    const requesterScopes = req.requesterDetails.scopes;
+    if (routeData.roles.length === 0 && routeData.scopes.length === 0) return;
+    if (requesterRole && routeData.roles.length > 0 && !routeData.roles.includes(requesterRole))
+      throw new RsError("FORBIDDEN", "Not authorized to access this endpoint");
+    if (requesterScopes.length > 0 && routeData.scopes.length > 0 && !routeData.scopes.some((scope) => requesterScopes.includes(scope)))
+      throw new RsError("FORBIDDEN", "Not authorized to access this endpoint");
   }
   getRouteData(method, baseUrl, path5) {
     const endpoint = this.schema.endpoints.find((item) => {
@@ -3042,6 +3077,9 @@ var PsqlTransaction = class extends PsqlConnection {
     this.connectPromise = this.client.connect();
     this.beginTransactionPromise = this.beginTransaction();
   }
+  client;
+  beginTransactionPromise;
+  connectPromise;
   async close() {
     if (this.client) {
       await this.client.end();