@rpcbase/db 0.135.0 → 0.137.0

package/README.md

@@ -51,6 +51,15 @@ const ItemB = await models.get("Item", {
 
 `ctx.tenantId` is checked first, then fallback is `ctx.req.session.user.currentTenantId`.
 
+`models.get(...)` returns a model gateway. Bind the ability explicitly for each operation; `.acl(...)` returns a real Mongoose model backed by the rpcbase ACL driver:
+
+```ts
+const Item = await models.get("Item", { tenantId })
+const items = await Item.acl(ability).find({ status: "published" })
+```
+
+Calling a protected model without `.acl(...)` fails closed. Passing `ctx.ability` remains supported as a shorthand when one ability is used for every operation on that handle. Use `models.getUnsafe(...)` only after an explicit authorization for DDL, index management, or another non-filterable operation.
+
 ### Transactions (MongoDB / Mongoose sessions)
 
 `@rpcbase/db` supports MongoDB transactions via Mongoose sessions.
@@ -62,7 +71,10 @@ import { models, withTransaction } from "@rpcbase/db"
 
 await withTransaction({ tenantId }, async ({ session, ctx, db }) => {
   const Item = await models.get("Item", ctx.tenant)
-  const item = await Item.create({ uid: "u1", name: "Hello", createdAt: Date.now() }, { session })
+  const item = await Item.acl(ability).create(
+    { uid: "u1", name: "Hello", createdAt: Date.now() },
+    { session },
+  )
 
   const globalNative = db.global.db
   if (globalNative) {
@@ -110,12 +122,16 @@ import { buildSearchTextStage, ensureSearchIndex, searchMetaProjection } from "@
 Sample usage (sample-app) in `sample-app/src/api/search/items/handler.ts`:
 
 ```ts
-await ensureSearchIndex({ db: Item.db.db, collection: Item.collection.name, name: "item_name_text_v1", definition })
-const results = await Item.aggregate([
+const UnsafeItem = await models.getUnsafe("Item", { tenantId })
+await ensureSearchIndex({ db: UnsafeItem.db.db, collection: UnsafeItem.collection.name, name: "item_name_text_v1", definition })
+const Item = await models.get("Item", { tenantId })
+const results = await Item.acl(ability).aggregate([
   buildSearchTextStage({ index: "item_name_text_v1", query, path: "name", highlightPath: "name" }),
   { $limit: 20 },
   { $project: { name: 1, createdAt: 1, ...searchMetaProjection() } },
 ]).exec()
 ```
 
+The ACL driver secures operations made through models returned by `.acl(...)`. It is not an in-process sandbox: direct `mongoose`/`mongodb` imports, database credentials, and handles returned by `models.getUnsafe(...)` are privileged capabilities and must stay in trusted infrastructure code.
+
 Dans `sample-app`, la config se trouve dans `sample-app/infrastructure` (`compose.yml`, `mongot/config.yml`, `mongot/mongodb-init.js`, `ensure-mongot-*`).

package/dist/acl/index.d.ts

@@ -4,4 +4,5 @@ export * from './buildAbility';
 export * from './session';
 export * from './accessible';
 export * from './can';
+export type { AclMongooseModel } from './mongooseAclModel';
 //# sourceMappingURL=index.d.ts.map

package/dist/acl/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/acl/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,OAAO,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/acl/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAA;AACvB,cAAc,YAAY,CAAA;AAC1B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,WAAW,CAAA;AACzB,cAAc,cAAc,CAAA;AAC5B,cAAc,OAAO,CAAA;AACrB,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/acl/mongooseAclAggregate.d.ts

@@ -0,0 +1,8 @@
+import { default as mongoose } from 'mongoose';
+import { AclAction, AppAbility } from './types';
+type PipelineStageLike = Record<string, unknown>;
+export declare const injectAggregateMatch: (pipeline: PipelineStageLike[], match: Record<string, unknown>) => void;
+export declare const resolveAggregateModel: (sourceModel: mongoose.Model<unknown>, collectionName: string) => mongoose.Model<unknown>;
+export declare const secureAggregatePipeline: (pipeline: PipelineStageLike[], model: mongoose.Model<unknown>, ability: AppAbility | undefined, action: AclAction) => void;
+export {};
+//# sourceMappingURL=mongooseAclAggregate.d.ts.map

package/dist/acl/mongooseAclAggregate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseAclAggregate.d.ts","sourceRoot":"","sources":["../../src/acl/mongooseAclAggregate.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAK/B,OAAO,KAAK,EAAE,SAAS,EAAkB,UAAU,EAAE,MAAM,SAAS,CAAA;AAGpE,KAAK,iBAAiB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;AAiChD,eAAO,MAAM,oBAAoB,GAC/B,UAAU,iBAAiB,EAAE,EAC7B,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,IA2BF,CAAA;AAkBD,eAAO,MAAM,qBAAqB,GAChC,aAAa,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EACpC,gBAAgB,MAAM,KACrB,QAAQ,CAAC,KAAK,CAAC,OAAO,CAuBxB,CAAA;AAoID,eAAO,MAAM,uBAAuB,GAClC,UAAU,iBAAiB,EAAE,EAC7B,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9B,SAAS,UAAU,GAAG,SAAS,EAC/B,QAAQ,SAAS,KAChB,IAaF,CAAA"}

package/dist/acl/mongooseAclDriver.d.ts

@@ -0,0 +1,22 @@
+import { default as mongoose } from 'mongoose';
+import { AppAbility } from './types';
+type NativeMongooseCollection = mongoose.Collection & {
+    collection: unknown;
+    conn: mongoose.Connection;
+    modelName?: string;
+};
+type NativeMongooseCollectionConstructor = new (name: string, connection: mongoose.Connection, options?: Record<string, unknown>) => NativeMongooseCollection;
+declare const NativeCollection: NativeMongooseCollectionConstructor;
+export declare class AclMongooseCollection extends NativeCollection {
+    constructor(name: string, connection: mongoose.Connection, options?: Record<string, unknown>);
+}
+export declare const installMongooseAclDriver: () => void;
+export declare const runWithUnsafeMongooseAclDriver: <TResult>(callback: () => TResult) => TResult;
+export declare const _private: {
+    getCollectionModels: (collection: NativeMongooseCollection) => Map<string, mongoose.Model<unknown>>;
+    getCollectionModelName: (collection: NativeMongooseCollection) => string | null;
+    secureBulkWriteOperations: (ability: AppAbility, model: mongoose.Model<unknown>, value: unknown) => Array<Record<string, unknown>>;
+    secureCollectionArguments: (collection: NativeMongooseCollection, ability: AppAbility, modelName: string, methodName: string, input: unknown[]) => unknown[];
+};
+export {};
+//# sourceMappingURL=mongooseAclDriver.d.ts.map

package/dist/acl/mongooseAclDriver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseAclDriver.d.ts","sourceRoot":"","sources":["../../src/acl/mongooseAclDriver.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAa/B,OAAO,KAAK,EAAyC,UAAU,EAAE,MAAM,SAAS,CAAA;AAGhF,KAAK,wBAAwB,GAAG,QAAQ,CAAC,UAAU,GAAG;IACpD,UAAU,EAAE,OAAO,CAAA;IACnB,IAAI,EAAE,QAAQ,CAAC,UAAU,CAAA;IACzB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,KAAK,mCAAmC,GAAG,KACzC,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,QAAQ,CAAC,UAAU,EAC/B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,wBAAwB,CAAA;AAiB7B,QAAA,MAAM,gBAAgB,qCAA0B,CAAA;AA0rBhD,qBAAa,qBAAsB,SAAQ,gBAAgB;gBAEvD,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,QAAQ,CAAC,UAAU,EAC/B,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM;CAKxC;AAID,eAAO,MAAM,wBAAwB,QAAO,IAa3C,CAAA;AAED,eAAO,MAAM,8BAA8B,GAAI,OAAO,EACpD,UAAU,MAAM,OAAO,KACtB,OAAoF,CAAA;AAEvF,eAAO,MAAM,QAAQ;sCAnoBP,wBAAwB,KACnC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;yCAgBK,wBAAwB,KAAG,MAAM,GAAG,IAAI;yCA6JzE,UAAU,SACZ,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SACvB,OAAO,KACb,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;4CAyDnB,wBAAwB,WAC3B,UAAU,aACR,MAAM,cACL,MAAM,SACX,OAAO,EAAE,KACf,OAAO,EAAE;CAyZX,CAAA"}

package/dist/acl/mongooseAclDriverContext.d.ts

@@ -0,0 +1,17 @@
+import { AppAbility } from './types';
+export type MongooseAclDriverContext = {
+    mode: "ability";
+    ability: AppAbility;
+} | {
+    mode: "unbound";
+} | {
+    mode: "unsafe";
+};
+export declare const unsafeMongooseAclDriverContext: MongooseAclDriverContext;
+export declare const unboundMongooseAclDriverContext: MongooseAclDriverContext;
+export declare const bindMongooseAclDriverContext: (value: object, context: MongooseAclDriverContext) => void;
+export declare const getMongooseAclDriverContext: (value?: object) => MongooseAclDriverContext | undefined;
+export declare const bindMongooseAclRawConnection: (scopedConnection: object, rawConnection: object) => void;
+export declare const getMongooseAclRawConnection: <TConnection extends object>(connection: TConnection) => TConnection;
+export declare const runWithMongooseAclDriverContext: <TResult>(context: MongooseAclDriverContext, callback: () => TResult) => TResult;
+//# sourceMappingURL=mongooseAclDriverContext.d.ts.map

package/dist/acl/mongooseAclDriverContext.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseAclDriverContext.d.ts","sourceRoot":"","sources":["../../src/acl/mongooseAclDriverContext.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,MAAM,MAAM,wBAAwB,GAChC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,UAAU,CAAA;CAAE,GACxC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAA;AAMtB,eAAO,MAAM,8BAA8B,EAAE,wBAE3C,CAAA;AAEF,eAAO,MAAM,+BAA+B,EAAE,wBAE5C,CAAA;AAEF,eAAO,MAAM,4BAA4B,GACvC,OAAO,MAAM,EACb,SAAS,wBAAwB,KAChC,IAEF,CAAA;AAED,eAAO,MAAM,2BAA2B,GACtC,QAAQ,MAAM,KACb,wBAAwB,GAAG,SAE7B,CAAA;AAED,eAAO,MAAM,4BAA4B,GACvC,kBAAkB,MAAM,EACxB,eAAe,MAAM,KACpB,IAEF,CAAA;AAED,eAAO,MAAM,2BAA2B,GAAI,WAAW,SAAS,MAAM,EACpE,YAAY,WAAW,KACtB,WAA4E,CAAA;AAE/E,eAAO,MAAM,+BAA+B,GAAI,OAAO,EACrD,SAAS,wBAAwB,EACjC,UAAU,MAAM,OAAO,KACtB,OAAgD,CAAA"}

package/dist/acl/mongooseAclModel.d.ts

@@ -0,0 +1,31 @@
+import { default as mongoose } from 'mongoose';
+import { MongooseAclDriverContext } from './mongooseAclDriverContext';
+import { AppAbility } from './types';
+declare const mongooseAclModelBrand: unique symbol;
+declare module "mongoose" {
+    interface Model<TRawDocType, TQueryHelpers, TInstanceMethods, TVirtuals, THydratedDocumentType, TSchema, TLeanResultType> {
+        [mongooseAclModelBrand]?: [
+            TRawDocType,
+            TQueryHelpers,
+            TInstanceMethods,
+            TVirtuals,
+            THydratedDocumentType,
+            TSchema,
+            TLeanResultType
+        ];
+        acl: (ability: AppAbility) => this;
+    }
+}
+export declare const createAclMongooseModel: <TModel extends mongoose.Model<unknown>>(model: TModel, ability: AppAbility) => AclMongooseModel<TModel>;
+export type AclMongooseModel<TModel extends mongoose.Model<unknown>> = TModel & {
+    acl: (ability: AppAbility) => AclMongooseModel<TModel>;
+};
+export declare const createAclMongooseModelGateway: <TModel extends mongoose.Model<unknown>>(model: TModel) => AclMongooseModel<TModel>;
+export declare const createUnsafeMongooseModel: <TModel extends mongoose.Model<unknown>>(model: TModel) => TModel;
+export declare const _private: {
+    createAclModelWithContext: <TModel extends mongoose.Model<unknown>>(model: TModel, context: MongooseAclDriverContext) => TModel;
+    resolveModelNameForCollection: (connection: mongoose.Connection, collectionName: string) => string | undefined;
+    setNativeCollection: (collection: object, nativeCollection: object) => void;
+};
+export {};
+//# sourceMappingURL=mongooseAclModel.d.ts.map

package/dist/acl/mongooseAclModel.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseAclModel.d.ts","sourceRoot":"","sources":["../../src/acl/mongooseAclModel.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAM/B,OAAO,EAKL,KAAK,wBAAwB,EAC9B,MAAM,4BAA4B,CAAA;AAEnC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAA;AAGzC,OAAO,CAAC,MAAM,qBAAqB,EAAE,OAAO,MAAM,CAAA;AAElD,OAAO,QAAQ,UAAU,CAAC;IACxB,UAAU,KAAK,CACb,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,SAAS,EACT,qBAAqB,EACrB,OAAO,EACP,eAAe;QAEf,CAAC,qBAAqB,CAAC,CAAC,EAAE;YACxB,WAAW;YACX,aAAa;YACb,gBAAgB;YAChB,SAAS;YACT,qBAAqB;YACrB,OAAO;YACP,eAAe;SAChB,CAAA;QACD,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,IAAI,CAAA;KACnC;CACF;AAyfD,eAAO,MAAM,sBAAsB,GAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC3E,OAAO,MAAM,EACb,SAAS,UAAU,KAClB,gBAAgB,CAAC,MAAM,CAGG,CAAA;AAE7B,MAAM,MAAM,gBAAgB,CAAC,MAAM,SAAS,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,MAAM,GAAG;IAC9E,GAAG,EAAE,CAAC,OAAO,EAAE,UAAU,KAAK,gBAAgB,CAAC,MAAM,CAAC,CAAA;CACvD,CAAA;AAED,eAAO,MAAM,6BAA6B,GAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAClF,OAAO,MAAM,KACZ,gBAAgB,CAAC,MAAM,CAGG,CAAA;AAE7B,eAAO,MAAM,yBAAyB,GAAI,MAAM,SAAS,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9E,OAAO,MAAM,KACZ,MAA0E,CAAA;AAqB7E,eAAO,MAAM,QAAQ;gCAlWc,MAAM,SAAS,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,SAChE,MAAM,WACJ,wBAAwB,KAChC,MAAM;gDAnFK,QAAQ,CAAC,UAAU,kBACf,MAAM,KACrB,MAAM,GAAG,SAAS;sCAmbe,MAAM,oBAAoB,MAAM,KAAG,IAAI;CAI1E,CAAA"}

package/dist/acl/mongooseAclUtils.d.ts

@@ -0,0 +1,6 @@
+import { default as mongoose } from 'mongoose';
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
+export declare const mergeMongoQuery: (left: unknown, right: Record<string, unknown>) => Record<string, unknown>;
+export declare const cloneMongoValue: <TValue>(value: TValue) => TValue;
+export declare const castMongoQuery: (model: mongoose.Model<unknown>, query: Record<string, unknown>) => Record<string, unknown>;
+//# sourceMappingURL=mongooseAclUtils.d.ts.map

package/dist/acl/mongooseAclUtils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mongooseAclUtils.d.ts","sourceRoot":"","sources":["../../src/acl/mongooseAclUtils.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,UAAU,CAAA;AAGpC,eAAO,MAAM,QAAQ,GAAI,OAAO,OAAO,KAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CACH,CAAA;AAEtE,eAAO,MAAM,eAAe,GAC1B,MAAM,OAAO,EACb,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAQxB,CAAA;AAED,eAAO,MAAM,eAAe,GAAI,MAAM,EAAE,OAAO,MAAM,KAAG,MAyBvD,CAAA;AAED,eAAO,MAAM,cAAc,GACzB,OAAO,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,EAC9B,OAAO,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAMxB,CAAA"}

package/dist/ensureMongooseConnection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ensureMongooseConnection.d.ts","sourceRoot":"","sources":["../src/ensureMongooseConnection.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAqB/B,eAAO,MAAM,wBAAwB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CA+B1F,CAAA"}
+{"version":3,"file":"ensureMongooseConnection.d.ts","sourceRoot":"","sources":["../src/ensureMongooseConnection.ts"],"names":[],"mappings":"AAAA,OAAO,QAAQ,MAAM,UAAU,CAAA;AAwB/B,eAAO,MAAM,wBAAwB,GAAU,QAAQ,MAAM,KAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CA+B1F,CAAA"}