@rpcbase/server 0.369.0 → 0.371.0

package/mongoose/plugins/object_id_plugin.ts

@@ -1,6 +1,7 @@
-import mongoose, { Schema } from "../"
+import mongoose, {Schema} from "../"
+
+import {get_object_id} from "../../get_object_id"
 
-import { get_object_id } from "../../get_object_id"
 
 export const object_id_plugin = (schema: Schema) => {
   if (schema.options._id === false) {
@@ -16,11 +17,12 @@ export const object_id_plugin = (schema: Schema) => {
     _id: {
       type: mongoose.Schema.Types.ObjectId,
       default: () => get_object_id(),
+      immutable: true,
     },
   })
 
   // Optional: Ensure the _id field is always set
-  schema.pre("save", function (next) {
+  schema.pre("save", function(next) {
     if (!this._id) {
       this._id = get_object_id()
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rpcbase/server",
-  "version": "0.369.0",
+  "version": "0.371.0",
   "license": "SSPL-1.0",
   "main": "./index.js",
   "scripts": {
@@ -61,24 +61,24 @@
   },
   "dependencies": {
     "@elastic/elasticsearch": "8.15.0",
-    "@sentry/node": "8.24.0",
+    "@sentry/node": "8.28.0",
     "bluebird": "3.7.2",
     "body-parser": "1.20.2",
-    "bull": "4.16.0",
+    "bull": "4.16.2",
     "connect-redis": "7.1.1",
     "cors": "2.8.5",
     "debug": "4.3.6",
     "dotenv": "16.4.5",
     "express": "4.19.2",
     "express-session": "1.18.0",
-    "firebase-admin": "12.3.0",
+    "firebase-admin": "12.4.0",
     "lodash": "4.17.21",
     "mkdirp": "3.0.1",
-    "mongoose": "8.5.2",
-    "openai": "4.56.0",
+    "mongoose": "8.6.1",
+    "openai": "4.57.3",
     "pdf2pic": "3.1.1",
-    "picocolors": "1.0.1",
-    "postmark": "4.0.4",
+    "picocolors": "1.1.0",
+    "postmark": "4.0.5",
     "redis": "4.7.0",
     "request-ip": "3.3.0",
     "sift": "17.1.3",

package/src/access-control/mongoose_plugin.js

@@ -7,6 +7,7 @@ const check_apply_permissions = require("./check_apply_permissions")
 // hooks
 const query_pre_delete = require("./hooks/query_pre_delete")
 
+
 const log = debug("rb")
 
 
@@ -59,7 +60,8 @@ const mongoose_plugin = (ac_config) => function rb_acl_plugin(schema, options) {
   // which can be a critical security risk
   schema.options.strictQuery = false
 
-  if (!schema.options.isSubSchema) {
+  // TODO: acl should be explicitly on by default and only if set to false in schema definition we remove it
+  if (!schema.options.isSubSchema && schema.options.acl !== false) {
     // Add Access Control fields to top level schemas
     schema.add(get_added_fields())
   }
@@ -73,7 +75,7 @@ const mongoose_plugin = (ac_config) => function rb_acl_plugin(schema, options) {
   schema.pre("findOneAndDelete", QUERY, query_pre_delete(ac_config, schema))
 
   // Documents create and save
-  schema.pre("save", DOC, function(next, options) {
+  schema.pre("save", DOC, function(next, save_options) {
     if (this.$isSubdocument) {
       return next()
     }
@@ -83,7 +85,7 @@ const mongoose_plugin = (ac_config) => function rb_acl_plugin(schema, options) {
       throw new Error("doc pre save model_name is undefined")
     }
 
-    const {ctx} = options
+    const {ctx} = save_options
 
     // when no context, assume admin mode and authorize op
     if (!ctx) {

package/src/api/stored-values/index.js

@@ -3,6 +3,6 @@ const get_stored_values = require("./get_stored_values")
 const set_stored_values = require("./set_stored_values")
 
 module.exports = (app) => {
-  app.handler("/api/v1/stored-values/get", get_stored_values)
-  app.handler("/api/v1/stored-values/set", set_stored_values)
+  app.handler("/rb-api/v1/stored-values/get", get_stored_values)
+  app.handler("/rb-api/v1/stored-values/set", set_stored_values)
 }

package/src/auth/index.js

@@ -11,14 +11,14 @@ const get_account = require("./get_account")
 
 
 module.exports = (app) => {
-  app.handler("/api/v1/auth/sign_in", sign_in)
-  app.handler("/api/v1/auth/sign_out", sign_out)
+  app.handler("/rb-api/v1/auth/sign_in", sign_in)
+  app.handler("/rb-api/v1/auth/sign_out", sign_out)
 
-  app.handler("/api/v1/auth/reset_password", reset_password)
-  app.handler("/api/v1/auth/set_new_password", set_new_password)
+  app.handler("/rb-api/v1/auth/reset_password", reset_password)
+  app.handler("/rb-api/v1/auth/set_new_password", set_new_password)
 
-  app.handler("/api/v1/auth/check_session", check_session)
+  app.handler("/rb-api/v1/auth/check_session", check_session)
 
-  app.handler("/api/v1/auth/get_account", get_account)
-  app.handler("/api/v1/auth/get_accounts", get_accounts)
+  app.handler("/rb-api/v1/auth/get_account", get_account)
+  app.handler("/rb-api/v1/auth/get_accounts", get_accounts)
 }