@rpcbase/server 0.476.0 → 0.477.0

package/dist/{index-Ckx0UHs6.js → rts/index.js}

@@ -1,6 +1,13 @@
 import { randomUUID } from "node:crypto";
-import { loadModel } from "@rpcbase/db";
+import { loadRbModel, loadModel } from "@rpcbase/db";
+import { buildAbilityFromSession, getTenantRolesFromSessionUser, buildAbility, getAccessibleByQuery } from "@rpcbase/db/acl";
 import { WebSocketServer } from "ws";
+const routes = Object.entries({
+  .../* @__PURE__ */ Object.assign({ "./api/changes/handler.ts": () => import("../handler-Dd20DHyz.js") })
+}).reduce((acc, [path, mod]) => {
+  acc[path.replace("./api/", "@rpcbase/server/rts/api/")] = mod;
+  return acc;
+}, {});
 const TENANT_ID_QUERY_PARAM = "rb-tenant-id";
 const USER_ID_HEADER = "rb-user-id";
 const QUERY_KEY_MAX_LEN = 4096;
@@ -150,14 +157,25 @@ const parseUpgradeMeta = async ({
     } else {
       throw new Error("Tenant not authorized for this session");
     }
-    return { tenantId, userId: sessionUserId };
+    const ability2 = buildAbilityFromSession({ tenantId, session: upgradeReq.session });
+    return { tenantId, userId: sessionUserId, ability: ability2 };
   }
   const raw = req.headers[USER_ID_HEADER];
   const headerUserId = Array.isArray(raw) ? raw[0] : raw;
   if (!headerUserId) {
     throw new Error("Missing rb-user-id header (reverse-proxy) and no session middleware configured");
   }
-  return { tenantId, userId: headerUserId };
+  const rbCtx = { req: { session: null } };
+  const User = await loadRbModel("RBUser", rbCtx);
+  const user = await User.findById(headerUserId, { tenants: 1, tenantRoles: 1 }).lean();
+  const tenantsRaw = user?.tenants;
+  const tenants = Array.isArray(tenantsRaw) ? tenantsRaw.map((t) => String(t)) : [];
+  if (!tenants.includes(tenantId)) {
+    throw new Error("Tenant not authorized for this session");
+  }
+  const roles = getTenantRolesFromSessionUser(user, tenantId);
+  const ability = buildAbility({ tenantId, userId: headerUserId, roles: roles.length ? roles : ["owner"] });
+  return { tenantId, userId: headerUserId, ability };
 };
 const getTenantModel = async (tenantId, modelName) => {
   const ctx = {
@@ -208,16 +226,28 @@ const scheduleDispatchSubscriptionsForModel = (tenantId, modelName) => {
 const runAndSendQuery = async ({
   tenantId,
   targetSocketIds,
+  ability,
   modelName,
   queryKey,
   query,
   options
 }) => {
+  if (!ability.can("read", modelName)) {
+    const payload2 = { type: "query_payload", modelName, queryKey, error: "forbidden" };
+    for (const socketId of targetSocketIds) {
+      const ws = sockets.get(socketId);
+      if (!ws) continue;
+      sendWs(ws, payload2);
+    }
+    return;
+  }
   const model = await getTenantModel(tenantId, modelName);
   const projection = options.projection ?? void 0;
   const sort = options.sort;
   const limit = normalizeLimit(options.limit);
-  const queryPromise = model.find(query, projection);
+  const accessQuery = getAccessibleByQuery(ability, "read", modelName);
+  const finalQuery = { $and: [query, accessQuery] };
+  const queryPromise = model.find(finalQuery, projection);
   if (sort && Object.keys(sort).length) {
     queryPromise.sort(sort);
   }
@@ -232,27 +262,35 @@ const runAndSendQuery = async ({
 };
 const dispatchSubscriptionsForModel = async (tenantId, modelName) => {
   const tenantSubs = subscriptions.get(tenantId);
-  const modelSubs = tenantSubs?.get(modelName);
-  if (!modelSubs || !modelSubs.size) return;
-  for (const [queryKey, sub] of modelSubs.entries()) {
-    const targetSocketIds = Array.from(sub.socketIds);
-    if (!targetSocketIds.length) continue;
-    try {
-      await runAndSendQuery({
-        tenantId,
-        targetSocketIds,
-        modelName,
-        queryKey,
-        query: sub.query,
-        options: sub.options
-      });
-    } catch (err) {
-      const error = redactErrorMessage(err);
-      const payload = { type: "query_payload", modelName, queryKey, error };
-      for (const socketId of targetSocketIds) {
-        const ws = sockets.get(socketId);
-        if (!ws) continue;
-        sendWs(ws, payload);
+  if (!tenantSubs || !tenantSubs.size) return;
+  for (const userSubs of tenantSubs.values()) {
+    const modelSubs = userSubs.get(modelName);
+    if (!modelSubs || !modelSubs.size) continue;
+    for (const [queryKey, sub] of modelSubs.entries()) {
+      const targetSocketIds = Array.from(sub.socketIds);
+      if (!targetSocketIds.length) continue;
+      const socketId = targetSocketIds[0];
+      const meta = socketMeta.get(socketId);
+      const ability = meta?.ability;
+      if (!ability) continue;
+      try {
+        await runAndSendQuery({
+          tenantId,
+          targetSocketIds,
+          ability,
+          modelName,
+          queryKey,
+          query: sub.query,
+          options: sub.options
+        });
+      } catch (err) {
+        const error = redactErrorMessage(err);
+        const payload = { type: "query_payload", modelName, queryKey, error };
+        for (const socketId2 of targetSocketIds) {
+          const ws = sockets.get(socketId2);
+          if (!ws) continue;
+          sendWs(ws, payload);
+        }
       }
     }
   }
@@ -286,6 +324,7 @@ const ensureChangeStream = async (tenantId, modelName) => {
 const addSocketSubscription = ({
   socketId,
   tenantId,
+  userId,
   modelName,
   queryKey,
   query,
@@ -293,8 +332,10 @@ const addSocketSubscription = ({
 }) => {
   const tenantSubs = subscriptions.get(tenantId) ?? /* @__PURE__ */ new Map();
   subscriptions.set(tenantId, tenantSubs);
-  const modelSubs = tenantSubs.get(modelName) ?? /* @__PURE__ */ new Map();
-  tenantSubs.set(modelName, modelSubs);
+  const userSubs = tenantSubs.get(userId) ?? /* @__PURE__ */ new Map();
+  tenantSubs.set(userId, userSubs);
+  const modelSubs = userSubs.get(modelName) ?? /* @__PURE__ */ new Map();
+  userSubs.set(modelName, modelSubs);
   const existing = modelSubs.get(queryKey);
   if (existing) {
     existing.socketIds.add(socketId);
@@ -314,11 +355,13 @@ const addSocketSubscription = ({
 const removeSocketSubscription = ({
   socketId,
   tenantId,
+  userId,
   modelName,
   queryKey
 }) => {
   const tenantSubs = subscriptions.get(tenantId);
-  const modelSubs = tenantSubs?.get(modelName);
+  const userSubs = tenantSubs?.get(userId);
+  const modelSubs = userSubs?.get(modelName);
   const sub = modelSubs?.get(queryKey);
   if (sub) {
     sub.socketIds.delete(socketId);
@@ -335,7 +378,21 @@ const removeSocketSubscription = ({
     }
   }
   if (modelSubs && modelSubs.size === 0) {
-    tenantSubs?.delete(modelName);
+    userSubs?.delete(modelName);
+  }
+  if (userSubs && userSubs.size === 0) {
+    tenantSubs?.delete(userId);
+  }
+  const hasAnyModelSubs = (() => {
+    const byUser = subscriptions.get(tenantId);
+    if (!byUser) return false;
+    for (const subs of byUser.values()) {
+      const modelSubs2 = subs.get(modelName);
+      if (modelSubs2 && modelSubs2.size > 0) return true;
+    }
+    return false;
+  })();
+  if (!hasAnyModelSubs) {
     const tenantStreams = changeStreams.get(tenantId);
     const stream = tenantStreams?.get(modelName);
     if (stream) {
@@ -361,6 +418,7 @@ const cleanupSocket = (socketId) => {
           removeSocketSubscription({
             socketId,
             tenantId: meta.tenantId,
+            userId: meta.userId,
             modelName,
             queryKey
           });
@@ -404,6 +462,7 @@ const handleClientMessage = async ({
     removeSocketSubscription({
       socketId,
       tenantId: meta.tenantId,
+      userId: meta.userId,
       modelName: message.modelName,
       queryKey: message.queryKey
     });
@@ -411,6 +470,11 @@ const handleClientMessage = async ({
   }
   if (!message.query || typeof message.query !== "object") return;
   const options = normalizeOptions(message.options);
+  const ability = meta.ability;
+  if (!ability.can("read", message.modelName)) {
+    sendWs(ws, { type: "query_payload", modelName: message.modelName, queryKey: message.queryKey, error: "forbidden" });
+    return;
+  }
   if (message.type === "registerQuery") {
     const existing = socketSubscriptions.get(socketId)?.get(message.modelName)?.has(message.queryKey) ?? false;
     if (!existing) {
@@ -427,6 +491,7 @@ const handleClientMessage = async ({
     addSocketSubscription({
       socketId,
       tenantId: meta.tenantId,
+      userId: meta.userId,
       modelName: message.modelName,
       queryKey: message.queryKey,
       query: message.query,
@@ -444,6 +509,7 @@ const handleClientMessage = async ({
     await runAndSendQuery({
       tenantId: meta.tenantId,
       targetSocketIds: [socketId],
+      ability,
       modelName: message.modelName,
       queryKey: message.queryKey,
       query: message.query,
@@ -556,7 +622,8 @@ const notifyRtsModelChanged = (tenantId, modelName) => {
   scheduleDispatchSubscriptionsForModel(tenantId, modelName);
 };
 export {
-  initRts as i,
-  notifyRtsModelChanged as n,
-  registerRtsHandler as r
+  initRts,
+  notifyRtsModelChanged,
+  registerRtsHandler,
+  routes
 };