@rvoh/psychic 3.5.0 → 3.7.0

package/dist/cjs/src/cli/index.js

@@ -132,8 +132,9 @@ ${INDENT}  pnpm psy g:sti-child --model-name=House Rental/House extends Rental
 ${INDENT}  pnpm psy g:sti-child --model-name=Condo Rental/Condo extends Rental`, false)
             .option('--owning-model <modelName>', `The model class that owns this resource. The generated controller will use \`associationQuery\` and \`createAssociation\` on the owning model to scope queries and create records.
 ${INDENT}
-${INDENT}Defaults to \`this.currentUser\` for non-admin/internal routes (e.g., \`this.currentUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
-${INDENT}Defaults to \`null\` for admin/internal namespaced controllers (e.g., \`Post.findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`this.currentUser\` for non-admin routes (e.g., \`this.currentUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`this.currentInternalUser\` for internal namespaced controllers (e.g., \`this.currentInternalUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`null\` for admin namespaced controllers (e.g., \`Post.findOrFail(this.castParam('id', 'uuid'))\`).
 ${INDENT}Supplying an owning-modle changes the the generated code in the controller to be relative to the owning model.
 ${INDENT}
 ${INDENT}Example:
@@ -152,7 +153,7 @@ ${INDENT}  # model is named GroupDanceLesson instead of LessonDanceGroup`)
             .option('--no-soft-delete', `skip generating the @SoftDelete() decorator and the corresponding nullable \`deleted_at\` column. By default, generated models use soft-delete semantics (rows are marked deleted via \`deleted_at\` instead of being removed from the database). Pass this flag when you want records to be hard-deleted.`)
             .argument('<path>', `The URL path for this resource's routes, relative to the root domain. Use \`\\{\\}\` as a placeholder for a parent resource's ID parameter when nesting.
 ${INDENT}
-${INDENT}The path determines the controller namespace hierarchy. Paths that begin with "admin" and "internal" remove the \`currentUser\` scoping of queries (\`--owning-model\` may be provided to apply query scoping). Each segment maps to a directory level in the controllers folder.
+${INDENT}The path determines the controller namespace hierarchy. Paths that begin with "internal" scope queries to \`this.currentInternalUser\` instead of \`this.currentUser\`. Paths that begin with "admin" remove owner scoping of queries entirely (\`--owning-model\` may be provided to apply query scoping). Each segment maps to a directory level in the controllers folder.
 ${INDENT}
 ${INDENT}Examples:
 ${INDENT}  v1/posts                          # /v1/posts, /v1/posts/:id

package/dist/cjs/src/generate/helpers/generateControllerContent.js

@@ -13,8 +13,10 @@ export default function generateControllerContent({ ancestorName, ancestorImport
     fullyQualifiedControllerName = DreamApp.system.standardizeFullyQualifiedModelName(fullyQualifiedControllerName);
     const additionalImports = [];
     const controllerClassName = DreamApp.system.globalClassNameFromFullyQualifiedModelName(fullyQualifiedControllerName);
-    // Determine user model variables
-    const actualOwningModel = owningModel || 'User';
+    // Determine user model variables. Internal-namespaced controllers scope to
+    // the current internal user the same way default controllers scope to the
+    // current user; only the Admin namespace bypasses owner scoping entirely.
+    const actualOwningModel = owningModel || (forInternal ? 'InternalUser' : 'User');
     const owningModelClassName = DreamApp.system.globalClassNameFromFullyQualifiedModelName(actualOwningModel);
     const owningModelProperty = `current${owningModelClassName}`;
     let modelClassName;
@@ -34,7 +36,7 @@ export default function generateControllerContent({ ancestorName, ancestorImport
             ? `
     serializerKey: 'internal',`
             : '';
-    const useDirectModelAccess = (forAdmin || forInternal) && !owningModel;
+    const useDirectModelAccess = forAdmin && !owningModel;
     const loadQueryBase = useDirectModelAccess
         ? (modelClassName ?? 'no-class-name')
         : `this.${owningModelProperty}.associationQuery('${pluralizedModelAttributeName}')`;

package/dist/cjs/src/generate/helpers/generateResourceControllerSpecContent.js

@@ -31,7 +31,7 @@ function createModelConfiguration(options) {
     const owningModelVariableName = options.owningModel
         ? camelize(DreamApp.system.standardizeFullyQualifiedModelName(options.owningModel).split('/').pop())
         : userVariableName;
-    const useDirectModelAccess = (options.forAdmin || options.forInternal) && !options.owningModel;
+    const useDirectModelAccess = options.forAdmin && !options.owningModel;
     const simpleCreationCommand = `const ${modelVariableName} = await create${modelClassName}(${useDirectModelAccess ? '' : `{ ${owningModelVariableName} }`})`;
     return {
         fullyQualifiedModelName,

package/dist/cjs/src/psychic-app/index.js

@@ -277,7 +277,7 @@ Try setting it to something valid, like:
     }
     _jsonOptions;
     /**
-     * Options passed through to `koa-bodyparser`. When unset, the upstream
+     * Options passed through to `@koa/bodyparser`. When unset, the upstream
      * defaults apply — notably `jsonLimit: '1mb'` and `formLimit: '56kb'`,
      * which cap request-body size at the framework boundary and defend against
      * unbounded-payload memory DoS even when no edge (WAF / API Gateway)
@@ -288,7 +288,7 @@ Try setting it to something valid, like:
      *
      * See https://github.com/koajs/bodyparser for the full option list
      * (`jsonLimit`, `formLimit`, `textLimit`, `xmlLimit`, `enableTypes`,
-     * `strict`, `detectJSON`, etc.).
+     * `jsonStrict`, `detectJSON`, etc.).
      */
     get jsonOptions() {
         return this._jsonOptions;

package/dist/cjs/src/server/index.js

@@ -1,8 +1,8 @@
+import { bodyParser } from '@koa/bodyparser';
 import cors from '@koa/cors';
 import etag from '@koa/etag';
 import { closeAllDbConnections } from '@rvoh/dream/db';
 import Koa from 'koa';
-import koaBodyparser from 'koa-bodyparser';
 import conditional from 'koa-conditional-get';
 import logIfDevelopment from '../controller/helpers/logIfDevelopment.js';
 import EnvInternal from '../helpers/EnvInternal.js';
@@ -200,7 +200,7 @@ export default class PsychicServer {
         this.koaApp.use(cors(corsOptions));
     }
     initializeJSON() {
-        this.koaApp.use(koaBodyparser(PsychicApp.getOrFail().jsonOptions));
+        this.koaApp.use(bodyParser(PsychicApp.getOrFail().jsonOptions));
     }
     async buildRoutes() {
         const r = new PsychicRouter(this.koaApp);

package/dist/esm/src/cli/index.js

@@ -132,8 +132,9 @@ ${INDENT}  pnpm psy g:sti-child --model-name=House Rental/House extends Rental
 ${INDENT}  pnpm psy g:sti-child --model-name=Condo Rental/Condo extends Rental`, false)
             .option('--owning-model <modelName>', `The model class that owns this resource. The generated controller will use \`associationQuery\` and \`createAssociation\` on the owning model to scope queries and create records.
 ${INDENT}
-${INDENT}Defaults to \`this.currentUser\` for non-admin/internal routes (e.g., \`this.currentUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
-${INDENT}Defaults to \`null\` for admin/internal namespaced controllers (e.g., \`Post.findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`this.currentUser\` for non-admin routes (e.g., \`this.currentUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`this.currentInternalUser\` for internal namespaced controllers (e.g., \`this.currentInternalUser.associationQuery('posts').findOrFail(this.castParam('id', 'uuid'))\`).
+${INDENT}Defaults to \`null\` for admin namespaced controllers (e.g., \`Post.findOrFail(this.castParam('id', 'uuid'))\`).
 ${INDENT}Supplying an owning-modle changes the the generated code in the controller to be relative to the owning model.
 ${INDENT}
 ${INDENT}Example:
@@ -152,7 +153,7 @@ ${INDENT}  # model is named GroupDanceLesson instead of LessonDanceGroup`)
             .option('--no-soft-delete', `skip generating the @SoftDelete() decorator and the corresponding nullable \`deleted_at\` column. By default, generated models use soft-delete semantics (rows are marked deleted via \`deleted_at\` instead of being removed from the database). Pass this flag when you want records to be hard-deleted.`)
             .argument('<path>', `The URL path for this resource's routes, relative to the root domain. Use \`\\{\\}\` as a placeholder for a parent resource's ID parameter when nesting.
 ${INDENT}
-${INDENT}The path determines the controller namespace hierarchy. Paths that begin with "admin" and "internal" remove the \`currentUser\` scoping of queries (\`--owning-model\` may be provided to apply query scoping). Each segment maps to a directory level in the controllers folder.
+${INDENT}The path determines the controller namespace hierarchy. Paths that begin with "internal" scope queries to \`this.currentInternalUser\` instead of \`this.currentUser\`. Paths that begin with "admin" remove owner scoping of queries entirely (\`--owning-model\` may be provided to apply query scoping). Each segment maps to a directory level in the controllers folder.
 ${INDENT}
 ${INDENT}Examples:
 ${INDENT}  v1/posts                          # /v1/posts, /v1/posts/:id

package/dist/esm/src/generate/helpers/generateControllerContent.js

@@ -13,8 +13,10 @@ export default function generateControllerContent({ ancestorName, ancestorImport
     fullyQualifiedControllerName = DreamApp.system.standardizeFullyQualifiedModelName(fullyQualifiedControllerName);
     const additionalImports = [];
     const controllerClassName = DreamApp.system.globalClassNameFromFullyQualifiedModelName(fullyQualifiedControllerName);
-    // Determine user model variables
-    const actualOwningModel = owningModel || 'User';
+    // Determine user model variables. Internal-namespaced controllers scope to
+    // the current internal user the same way default controllers scope to the
+    // current user; only the Admin namespace bypasses owner scoping entirely.
+    const actualOwningModel = owningModel || (forInternal ? 'InternalUser' : 'User');
     const owningModelClassName = DreamApp.system.globalClassNameFromFullyQualifiedModelName(actualOwningModel);
     const owningModelProperty = `current${owningModelClassName}`;
     let modelClassName;
@@ -34,7 +36,7 @@ export default function generateControllerContent({ ancestorName, ancestorImport
             ? `
     serializerKey: 'internal',`
             : '';
-    const useDirectModelAccess = (forAdmin || forInternal) && !owningModel;
+    const useDirectModelAccess = forAdmin && !owningModel;
     const loadQueryBase = useDirectModelAccess
         ? (modelClassName ?? 'no-class-name')
         : `this.${owningModelProperty}.associationQuery('${pluralizedModelAttributeName}')`;

package/dist/esm/src/generate/helpers/generateResourceControllerSpecContent.js

@@ -31,7 +31,7 @@ function createModelConfiguration(options) {
     const owningModelVariableName = options.owningModel
         ? camelize(DreamApp.system.standardizeFullyQualifiedModelName(options.owningModel).split('/').pop())
         : userVariableName;
-    const useDirectModelAccess = (options.forAdmin || options.forInternal) && !options.owningModel;
+    const useDirectModelAccess = options.forAdmin && !options.owningModel;
     const simpleCreationCommand = `const ${modelVariableName} = await create${modelClassName}(${useDirectModelAccess ? '' : `{ ${owningModelVariableName} }`})`;
     return {
         fullyQualifiedModelName,

package/dist/esm/src/psychic-app/index.js

@@ -277,7 +277,7 @@ Try setting it to something valid, like:
     }
     _jsonOptions;
     /**
-     * Options passed through to `koa-bodyparser`. When unset, the upstream
+     * Options passed through to `@koa/bodyparser`. When unset, the upstream
      * defaults apply — notably `jsonLimit: '1mb'` and `formLimit: '56kb'`,
      * which cap request-body size at the framework boundary and defend against
      * unbounded-payload memory DoS even when no edge (WAF / API Gateway)
@@ -288,7 +288,7 @@ Try setting it to something valid, like:
      *
      * See https://github.com/koajs/bodyparser for the full option list
      * (`jsonLimit`, `formLimit`, `textLimit`, `xmlLimit`, `enableTypes`,
-     * `strict`, `detectJSON`, etc.).
+     * `jsonStrict`, `detectJSON`, etc.).
      */
     get jsonOptions() {
         return this._jsonOptions;

package/dist/esm/src/server/index.js

@@ -1,8 +1,8 @@
+import { bodyParser } from '@koa/bodyparser';
 import cors from '@koa/cors';
 import etag from '@koa/etag';
 import { closeAllDbConnections } from '@rvoh/dream/db';
 import Koa from 'koa';
-import koaBodyparser from 'koa-bodyparser';
 import conditional from 'koa-conditional-get';
 import logIfDevelopment from '../controller/helpers/logIfDevelopment.js';
 import EnvInternal from '../helpers/EnvInternal.js';
@@ -200,7 +200,7 @@ export default class PsychicServer {
         this.koaApp.use(cors(corsOptions));
     }
     initializeJSON() {
-        this.koaApp.use(koaBodyparser(PsychicApp.getOrFail().jsonOptions));
+        this.koaApp.use(bodyParser(PsychicApp.getOrFail().jsonOptions));
     }
     async buildRoutes() {
         const r = new PsychicRouter(this.koaApp);

package/dist/types/src/package-exports/types.d.ts

@@ -1,3 +1,3 @@
-export { type PsychicAppInitOptions } from '../psychic-app/index.js';
+export { type BodyParserOptions, type PsychicAppInitOptions } from '../psychic-app/index.js';
 export { type UUID } from '../psychic-app/types.js';
 export { type HttpMethod } from '../router/types.js';

package/dist/types/src/psychic-app/index.d.ts

@@ -3,9 +3,9 @@ import { DreamApp } from '@rvoh/dream';
 import { OpenapiSchemaBody } from '@rvoh/dream/openapi';
 import { DreamAppAllowedPackageManagersEnum } from '@rvoh/dream/system';
 import { DreamAppInitOptions, DreamLogLevel, DreamLogger, EncryptOptions } from '@rvoh/dream/types';
+import { bodyParser } from '@koa/bodyparser';
 import { Command } from 'commander';
 import Koa from 'koa';
-import bodyParser from 'koa-bodyparser';
 import * as http from 'node:http';
 import * as https from 'node:https';
 import { OpenapiValidateTarget } from '../openapi-renderer/defaults.js';
@@ -14,6 +14,11 @@ import PsychicRouter from '../router/index.js';
 import { RouteConfig } from '../router/route-manager.js';
 import PsychicServer from '../server/index.js';
 import { PsychicAppInitializerCb, PsychicHookEventType, PsychicUseEventType } from './types.js';
+/**
+ * Options passed through to `@koa/bodyparser`. The package does not export its
+ * options type by name, so we derive it from the middleware's call signature.
+ */
+export type BodyParserOptions = NonNullable<Parameters<typeof bodyParser>[0]>;
 export default class PsychicApp {
     /**
      * Called by the initializePsychicApp function, which is built
@@ -165,7 +170,7 @@ export default class PsychicApp {
     get redirectAllowedHosts(): readonly string[];
     private _jsonOptions;
     /**
-     * Options passed through to `koa-bodyparser`. When unset, the upstream
+     * Options passed through to `@koa/bodyparser`. When unset, the upstream
      * defaults apply — notably `jsonLimit: '1mb'` and `formLimit: '56kb'`,
      * which cap request-body size at the framework boundary and defend against
      * unbounded-payload memory DoS even when no edge (WAF / API Gateway)
@@ -176,9 +181,9 @@ export default class PsychicApp {
      *
      * See https://github.com/koajs/bodyparser for the full option list
      * (`jsonLimit`, `formLimit`, `textLimit`, `xmlLimit`, `enableTypes`,
-     * `strict`, `detectJSON`, etc.).
+     * `jsonStrict`, `detectJSON`, etc.).
      */
-    get jsonOptions(): bodyParser.Options;
+    get jsonOptions(): BodyParserOptions;
     private _cookieOptions;
     get cookieOptions(): {
         maxAge: number;
@@ -255,7 +260,7 @@ export default class PsychicApp {
     plugin(cb: (app: PsychicApp) => void | Promise<void>): void;
     on<T extends PsychicHookEventType>(hookEventType: T, cb: T extends 'server:error' ? (err: Error, ctx: Koa.Context) => void | Promise<void> : T extends 'server:init:before-middleware' ? (psychicServer: PsychicServer) => void | Promise<void> : T extends 'server:init:after-middleware' ? (psychicServer: PsychicServer) => void | Promise<void> : T extends 'server:start' ? (psychicServer: PsychicServer) => void | Promise<void> : T extends 'server:shutdown' ? (psychicServer: PsychicServer) => void | Promise<void> : T extends 'server:init:after-routes' ? (psychicServer: PsychicServer) => void | Promise<void> : T extends 'cli:start' ? (program: Command) => void | Promise<void> : T extends 'cli:sync' ? () => any : (conf: PsychicApp) => void | Promise<void>): void;
     set(option: 'openapi', name: string, value: NamedPsychicOpenapiOptions): void;
-    set<Opt extends PsychicAppOption>(option: Opt, value: Opt extends 'appName' ? string : Opt extends 'apiOnly' ? boolean : Opt extends 'defaultResponseHeaders' ? Record<string, string | null> : Opt extends 'httpServerOptions' ? http.ServerOptions | https.ServerOptions : Opt extends 'encryption' ? PsychicAppEncryptionOptions : Opt extends 'cors' ? cors.Options : Opt extends 'cookie' ? CustomCookieOptions : Opt extends 'apiRoot' ? string : Opt extends 'importExtension' ? GeneratorImportStyle : Opt extends 'sessionCookieName' ? string : Opt extends 'json' ? bodyParser.Options : Opt extends 'logger' ? PsychicLogger : Opt extends 'ssl' ? PsychicSslCredentials : Opt extends 'openapi' ? DefaultPsychicOpenapiOptions : Opt extends 'paths' ? PsychicPathOptions : Opt extends 'port' ? number : Opt extends 'saltRounds' ? number : Opt extends 'packageManager' ? DreamAppAllowedPackageManagersEnum : Opt extends 'inflections' ? () => void | Promise<void> : Opt extends 'routes' ? (r: PsychicRouter) => void | Promise<void> : Opt extends 'redirectAllowedHosts' ? readonly string[] : never): void;
+    set<Opt extends PsychicAppOption>(option: Opt, value: Opt extends 'appName' ? string : Opt extends 'apiOnly' ? boolean : Opt extends 'defaultResponseHeaders' ? Record<string, string | null> : Opt extends 'httpServerOptions' ? http.ServerOptions | https.ServerOptions : Opt extends 'encryption' ? PsychicAppEncryptionOptions : Opt extends 'cors' ? cors.Options : Opt extends 'cookie' ? CustomCookieOptions : Opt extends 'apiRoot' ? string : Opt extends 'importExtension' ? GeneratorImportStyle : Opt extends 'sessionCookieName' ? string : Opt extends 'json' ? BodyParserOptions : Opt extends 'logger' ? PsychicLogger : Opt extends 'ssl' ? PsychicSslCredentials : Opt extends 'openapi' ? DefaultPsychicOpenapiOptions : Opt extends 'paths' ? PsychicPathOptions : Opt extends 'port' ? number : Opt extends 'saltRounds' ? number : Opt extends 'packageManager' ? DreamAppAllowedPackageManagersEnum : Opt extends 'inflections' ? () => void | Promise<void> : Opt extends 'routes' ? (r: PsychicRouter) => void | Promise<void> : Opt extends 'redirectAllowedHosts' ? readonly string[] : never): void;
     override<Override extends keyof PsychicAppOverrides>(override: Override, value: PsychicAppOverrides[Override]): void;
 }
 export type PsychicAppOption = 'appName' | 'apiOnly' | 'apiRoot' | 'httpServerOptions' | 'importExtension' | 'encryption' | 'sessionCookieName' | 'cookie' | 'cors' | 'defaultResponseHeaders' | 'inflections' | 'json' | 'logger' | 'openapi' | 'packageManager' | 'paths' | 'port' | 'redirectAllowedHosts' | 'routes' | 'saltRounds' | 'ssl';

package/package.json

@@ -2,7 +2,7 @@
   "type": "module",
   "name": "@rvoh/psychic",
   "description": "Typescript web framework",
-  "version": "3.5.0",
+  "version": "3.7.0",
   "author": "RVOHealth",
   "repository": {
     "type": "git",
@@ -72,23 +72,22 @@
     "yoctocolors": "^2.1.1"
   },
   "peerDependencies": {
+    "@koa/bodyparser": "^6.1.0",
     "@koa/cors": "^5.0.0",
     "@koa/etag": "^5.0.2",
     "@koa/router": "^15.3.0",
     "@rvoh/dream": "^2.10.0",
     "@types/koa": "^3.0.1",
-    "@types/koa-bodyparser": "^4.3.12",
     "@types/koa-conditional-get": "^2.0.3",
-    "@types/koa-etag": "^3.0.3",
     "@types/koa__cors": "^5.0.0",
     "@types/koa__router": "^12.0.5",
     "koa": "^3.1.2",
-    "koa-bodyparser": "^4.4.1",
     "koa-conditional-get": "^3.0.0",
     "openapi-typescript": "^7.8.0"
   },
   "devDependencies": {
     "@eslint/js": "^9.39.1",
+    "@koa/bodyparser": "^6.1.0",
     "@koa/cors": "^5.0.0",
     "@koa/etag": "^5.0.2",
     "@koa/router": "^15.3.1",
@@ -96,9 +95,7 @@
     "@rvoh/dream-spec-helpers": "^2.1.1",
     "@rvoh/psychic-spec-helpers": "3.0.0",
     "@types/koa": "^3.0.1",
-    "@types/koa-bodyparser": "^4.3.12",
     "@types/koa-conditional-get": "^2.0.3",
-    "@types/koa-etag": "^3.0.3",
     "@types/koa-passport": "^6.0.3",
     "@types/koa__cors": "^5.0.0",
     "@types/koa__router": "^12.0.5",
@@ -114,7 +111,6 @@
     "eslint": "^9.39.4",
     "jsdom": "^26.1.0",
     "koa": "^3.1.2",
-    "koa-bodyparser": "^4.4.1",
     "koa-conditional-get": "^3.0.0",
     "koa-passport": "^6.0.0",
     "koa-session": "^7.0.2",