@sixb/core 0.1.21 → 0.1.22

package/src/objects/object/upsert.ts

@@ -2,8 +2,13 @@
  * Leaf operation: upsert a single object through the ontology Materializer.
  */
 
-import { assertCanEdit } from "../../authorization"
 import type { ObjectRow } from "../../storage"
+import {
+  assertCanEditType,
+  expectSeen,
+  findWrittenObjects,
+  writeFoundObject,
+} from "../conditional-writes"
 import type { ResolvedObjectContext } from "../context"
 import {
   commitRuntimeOperations,
@@ -18,9 +23,10 @@ export async function upsertObject(
   ctx: ResolvedObjectContext,
   properties: Record<string, unknown>
 ): Promise<ObjectRow> {
-  assertCanEdit(ctx, ctx.objectType.id)
+  await assertCanEditType(ctx, ctx.objectType.id)
   const { objectType, primaryPropertyId, ontology } = ctx
   const redact = await ctx.objectReader.writtenRowRedactor(objectType.id)
+  const checkUniqueValues = await ctx.objectReader.uniqueValueWriteCheck(objectType.id)
 
   const normalized = normalizeRuntimeObject({
     objectType,
@@ -28,12 +34,24 @@ export async function upsertObject(
     properties,
     valueTypesById: ontology.getValueTypesById(),
   })
+  checkUniqueValues(normalized.properties)
   const ref = { objectTypeId: objectType.id, primaryId: normalized.primaryId }
+  const write = { id: runtimeOperationId(0), ref, properties: normalized.properties }
+
+  if (ctx.objectReader.viewsThroughCondition(objectType.id)) {
+    // Only an object the writer sees is updated. Anything else is a create, which returns the row
+    // as sent: no value of an object the writer did not see is merged into it.
+    const found = await findWrittenObjects(ctx, objectType.id, [ref.primaryId])
+    const commit = await commitRuntimeOperations(
+      ctx,
+      [writeFoundObject({ ...write, primaryPropertyId, found: found.get(ref.primaryId) })],
+      expectSeen(found.values())
+    )
+    return redact(toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0])))
+  }
 
   // The Materializer classifies this as an independent create, a patch over source authority, or a
   // restore plus patch inside its own transaction.
-  const commit = await commitRuntimeOperations(ctx, [
-    objectUpsertOperation({ id: runtimeOperationId(0), ref, properties: normalized.properties }),
-  ])
+  const commit = await commitRuntimeOperations(ctx, [objectUpsertOperation(write)])
   return redact(toObjectRow(ctx.projectId, requireEffectiveObject(commit.outcomes[0])))
 }

package/src/objects/query/current-user.ts

@@ -0,0 +1,76 @@
+import { isCurrentUser, type UserRef } from "../../ontology/user-ref"
+import type { ObjectQuery, ObjectQueryPredicate } from "./ir"
+
+/**
+ * Replace every `currentUser()` of a validated query with the reader's user reference.
+ *
+ * Validation admits the placeholder only where a predicate compares user references, so storage
+ * never receives it. Without a user, as for a service account, a schedule, or a share, `eq`, `in`
+ * and `contains` become a constant that matches nothing, and `neq` one that matches every row: it
+ * stays the complement of `eq`.
+ *
+ * The bound query is valid again and holds no placeholder: the executor validates parts of it
+ * once more, and binding it twice changes nothing.
+ */
+export function bindCurrentUser(query: ObjectQuery, user: UserRef | undefined): ObjectQuery {
+  switch (query.kind) {
+    case "start":
+    case "refs":
+      return query
+    case "filter":
+      return {
+        ...query,
+        input: bindCurrentUser(query.input, user),
+        predicate: bindCurrentUserPredicate(query.predicate, user),
+      }
+    case "set":
+      return { ...query, inputs: query.inputs.map((input) => bindCurrentUser(input, user)) }
+    default:
+      return { ...query, input: bindCurrentUser(query.input, user) }
+  }
+}
+
+/** Replace every `currentUser()` of a validated predicate, with the rules of {@link bindCurrentUser}. */
+export function bindCurrentUserPredicate(
+  predicate: ObjectQueryPredicate,
+  user: UserRef | undefined
+): ObjectQueryPredicate {
+  switch (predicate.op) {
+    case "and":
+    case "or":
+      return {
+        ...predicate,
+        items: predicate.items.map((item) => bindCurrentUserPredicate(item, user)),
+      }
+    case "not":
+      return { ...predicate, item: bindCurrentUserPredicate(predicate.item, user) }
+    case "exists":
+    case "constant":
+      return predicate
+    case "in": {
+      if (!predicate.values.some(isCurrentUser)) return predicate
+
+      const values = predicate.values.flatMap((value) =>
+        isCurrentUser(value) ? (user ? [user] : []) : [value]
+      )
+      return values.length > 0 ? { ...predicate, values } : NO_ROW
+    }
+    case "contains": {
+      if (!isCurrentUser(predicate.value)) return predicate
+      if (user) return { ...predicate, value: user }
+
+      return NO_ROW
+    }
+    default: {
+      if (!isCurrentUser(predicate.value)) return predicate
+      if (user) return { ...predicate, value: user }
+
+      return predicate.op === "neq" ? EVERY_ROW : NO_ROW
+    }
+  }
+}
+
+// A constant rather than a comparison with a reserved user id: auth strategies choose user ids, so
+// any id could one day name a real user.
+const NO_ROW: ObjectQueryPredicate = Object.freeze({ op: "constant", value: false })
+const EVERY_ROW: ObjectQueryPredicate = Object.freeze({ op: "constant", value: true })

package/src/objects/query/executor.ts

@@ -2,6 +2,7 @@ import { type AuthorizationContext, assertAuthorized } from "../../authorization
 import type { RuntimeAuthorization } from "../../execution/types"
 import type { EmbeddingModelCatalog, RerankingModelCatalog } from "../../models/catalog"
 import type { OntologyRegistry } from "../../ontology"
+import type { UserRef } from "../../ontology/user-ref"
 import type {
   CountObjectsResult,
   ExistsObjectsResult,
@@ -19,6 +20,7 @@ import type {
 } from "../../storage"
 import { linkBatchKey, MAX_OBJECT_READ_FACETS, objectBatchKey } from "../../storage"
 import { resolveVectorSearchText } from "../vectors/resolve-query"
+import { bindCurrentUser } from "./current-user"
 import {
   ObjectQueryExecutionError,
   ObjectQueryPlanningError,
@@ -27,17 +29,17 @@ import {
 import type {
   ObjectExpansion,
   ObjectQuery,
-  ObjectQueryPredicate,
   ObjectQueryResultShape,
   ObjectQuerySortField,
-  QueryScalarKind,
 } from "./ir"
+import { matchesPredicate } from "./matches-predicate"
 import { normalizeObjectQuery } from "./normalize"
 import { type ObjectQueryPlan, type ObjectQueryPlanningOptions, planObjectQuery } from "./planner"
 import { usePrimaryIdLookups } from "./primary-id"
 import { rerankObjectCandidates } from "./reranking-executor"
 import { findQueryReranking } from "./reranking-query"
-import { compareQueryScalarValues, queryScalarValuesEqual } from "./scalar-values"
+import { compareQueryScalarValues } from "./scalar-values"
+import { withoutUserExpansions } from "./user-expansions"
 import {
   type AdmittedObjectQuery,
   type ObjectQuerySemanticAdmission,
@@ -76,8 +78,22 @@ export interface QueryExecutorOptions
   authorization?: AuthorizationContext
   /** Registered execution capability for queries reached through a bound Sixb SDK. */
   runtimeAuthorization?: RuntimeAuthorization
+  /**
+   * The object types the reader reads, decided by the reader itself. The authorized object reader
+   * passes its own, which hold the types its storage reads through a condition. When present, it
+   * decides in place of the grants of `authorization` and `runtimeAuthorization`.
+   */
+  readableObjectTypes?: ReadableObjectTypes
   /** Reader-specific admission applied after grants, such as marking clearances. */
   admission?: ObjectQuerySemanticAdmission
+  /** The user `currentUser()` stands for; absent when the reader is not a user. */
+  requestingUser?: UserRef
+}
+
+export interface ReadableObjectTypes {
+  /** Throw unless the reader reads every one of these object types. */
+  assert(objectTypeIds: readonly string[]): void
+  has(objectTypeId: string): boolean
 }
 
 export interface ExecuteObjectQueryInput {
@@ -413,11 +429,13 @@ export async function facetObjects(
 }
 
 /**
- * Validate, authorize the touched types, then admit the query for the reader.
+ * Validate, authorize the touched types, admit the query for the reader, then bind
+ * `currentUser()` to the reader's user.
  *
  * Grants are checked first so a denial never describes properties of a type the caller cannot
  * view. The admitted query is the one executed: an admission may narrow it, as markings narrow
- * default text fields.
+ * default text fields. Its user expansions are removed: storage never resolves profiles. Binding
+ * comes last, so storage and the fallback never see the placeholder.
  */
 function validateExecutableQuery(
   input: { readonly projectId: string; readonly query: ObjectQuery },
@@ -433,8 +451,13 @@ function validateExecutableQuery(
   const normalized = normalizeObjectQuery(input.query)
   const validated = validateObjectQuery(normalized, validationOptions)
   assertQueryViewable(input.projectId, validated, options)
-  if (!options.admission) return { ...validated, admissionState: {} }
-  return validateObjectQueryWithAdmission(normalized, validationOptions, options.admission)
+
+  const admitted = options.admission
+    ? validateObjectQueryWithAdmission(normalized, validationOptions, options.admission)
+    : { ...validated, admissionState: {} }
+
+  const executable = withoutUserExpansions(admitted.query)
+  return { ...admitted, query: bindCurrentUser(executable, options.requestingUser) }
 }
 
 // Authorization happens at planning time: a scoped query must hold a view
@@ -442,8 +465,16 @@ function validateExecutableQuery(
 function assertQueryViewable(
   projectId: string,
   validated: ValidatedObjectQuery,
-  authorization: Pick<QueryExecutorOptions, "authorization" | "runtimeAuthorization">
+  authorization: Pick<
+    QueryExecutorOptions,
+    "authorization" | "runtimeAuthorization" | "readableObjectTypes"
+  >
 ): void {
+  if (authorization.readableObjectTypes) {
+    authorization.readableObjectTypes.assert(validated.touchedObjectTypeIds)
+    return
+  }
+
   // The query engine is also a storage-level utility. Authorization is activated by a runtime
   // context; execution SDKs always provide a registered capability, including auth-disabled ones.
   if (!authorization.runtimeAuthorization && !authorization.authorization) return
@@ -1088,97 +1119,6 @@ function completeFallbackEvaluation(entries: FallbackEntry[]): FallbackEvaluatio
   }
 }
 
-function matchesPredicate(row: ObjectRow, predicate: ObjectQueryPredicate): boolean {
-  switch (predicate.op) {
-    case "and":
-      return predicate.items.every((item) => matchesPredicate(row, item))
-    case "or":
-      return predicate.items.some((item) => matchesPredicate(row, item))
-    case "not":
-      return !matchesPredicate(row, predicate.item)
-    case "eq":
-      return queryScalarValuesEqual(
-        row.properties[predicate.propertyId],
-        predicate.value,
-        predicate.scalarKind
-      )
-    case "neq":
-      return !queryScalarValuesEqual(
-        row.properties[predicate.propertyId],
-        predicate.value,
-        predicate.scalarKind
-      )
-    case "lt":
-      return (
-        compareQueryScalarValues(
-          row.properties[predicate.propertyId],
-          predicate.value,
-          predicate.scalarKind
-        ) < 0
-      )
-    case "lte":
-      return (
-        compareQueryScalarValues(
-          row.properties[predicate.propertyId],
-          predicate.value,
-          predicate.scalarKind
-        ) <= 0
-      )
-    case "gt":
-      return (
-        compareQueryScalarValues(
-          row.properties[predicate.propertyId],
-          predicate.value,
-          predicate.scalarKind
-        ) > 0
-      )
-    case "gte":
-      return (
-        compareQueryScalarValues(
-          row.properties[predicate.propertyId],
-          predicate.value,
-          predicate.scalarKind
-        ) >= 0
-      )
-    case "in":
-      return predicate.values.some((value) =>
-        queryScalarValuesEqual(row.properties[predicate.propertyId], value, predicate.scalarKind)
-      )
-    case "exists": {
-      const exists =
-        Object.hasOwn(row.properties, predicate.propertyId) &&
-        row.properties[predicate.propertyId] !== undefined
-      return predicate.value ? exists : !exists
-    }
-    case "contains":
-      return containsValue(
-        row.properties[predicate.propertyId],
-        predicate.value,
-        predicate.scalarKind
-      )
-  }
-}
-
-function containsValue(
-  actual: unknown,
-  expected: unknown,
-  itemScalarKind: QueryScalarKind | undefined
-): boolean {
-  if (typeof actual === "string" && typeof expected === "string") {
-    return actual.includes(expected)
-  }
-
-  if (Array.isArray(actual)) {
-    return actual.some((item) => queryScalarValuesEqual(item, expected, itemScalarKind))
-  }
-
-  if (isPlainObject(actual) && typeof expected === "string") {
-    return Object.hasOwn(actual, expected)
-  }
-
-  return false
-}
-
 function sortEntries(
   entries: readonly FallbackEntry[],
   fields: readonly ObjectQuerySortField[]
@@ -1432,7 +1372,3 @@ function decodePageOffset(token: string | undefined): number {
   }
   return offset
 }
-
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value)
-}

package/src/objects/query/explain.ts

@@ -199,20 +199,31 @@ function buildExplainNode(query: ObjectQuery, path: string): ObjectQueryExplainN
       return {
         path,
         kind: query.kind,
-        summary: `expand ${query.expansions.map(summarizeExpansion).join(", ")}`,
-        details: { expansions: query.expansions },
+        summary: `expand ${summarizeExpanded(query.expansions, query.users).join(", ")}`,
+        details: {
+          expansions: query.expansions,
+          ...(query.users === undefined ? {} : { users: query.users }),
+        },
         children: [buildExplainNode(query.input, `${path}.input`)],
       }
   }
 }
 
+// Links by id, then user properties as `@property`.
+function summarizeExpanded(
+  expansions: readonly ObjectExpansion[],
+  users: readonly string[] | undefined
+): string[] {
+  return [
+    ...expansions.map(summarizeExpansion),
+    ...(users ?? []).map((propertyId) => `@${propertyId}`),
+  ]
+}
+
 function summarizeExpansion(expansion: ObjectExpansion): string {
   const head = expansion.direction === "incoming" ? `<-${expansion.linkId}` : expansion.linkId
-  const nested =
-    expansion.expand && expansion.expand.length > 0
-      ? `(${expansion.expand.map(summarizeExpansion).join(", ")})`
-      : ""
-  return `${head}${nested}`
+  const nested = summarizeExpanded(expansion.expand ?? [], expansion.users)
+  return nested.length > 0 ? `${head}(${nested.join(", ")})` : head
 }
 
 function summarizePredicate(predicate: ObjectQueryPredicate): string {
@@ -228,6 +239,8 @@ function summarizePredicate(predicate: ObjectQueryPredicate): string {
       return `${predicate.propertyId} exists=${predicate.value}`
     case "contains":
       return `${predicate.propertyId} contains`
+    case "constant":
+      return String(predicate.value)
     default:
       return `${predicate.propertyId} ${predicate.op}`
   }

package/src/objects/query/index.ts

@@ -16,6 +16,7 @@ export type {
   ExecuteObjectQueryInput,
   ExecuteObjectQueryResult,
   QueryExecutorOptions,
+  ReadableObjectTypes,
 } from "./executor"
 export {
   countObjects,
@@ -40,6 +41,7 @@ export type {
   ObjectQueryPage,
   ObjectQueryPredicate,
   ObjectQueryPredicateComparison,
+  ObjectQueryPredicateConstant,
   ObjectQueryPredicateContains,
   ObjectQueryPredicateExists,
   ObjectQueryPredicateGroup,

package/src/objects/query/ir.ts

@@ -155,6 +155,12 @@ export interface ObjectQueryExpand {
   kind: "expand"
   input: ObjectQuery
   expansions: readonly ObjectExpansion[]
+  /**
+   * `ref.user()` properties whose members' profiles attach under each row's `users`, keyed by
+   * property id. Profiles come from the member directory, not object storage: the core executor
+   * removes this field before planning, so storage providers never receive it.
+   */
+  users?: readonly string[]
 }
 
 export interface ObjectExpansion {
@@ -169,6 +175,8 @@ export interface ObjectExpansion {
   orderBy?: readonly ObjectQuerySortField[]
   /** Nested expansions, hydrated from the target objects of this expansion. */
   expand?: readonly ObjectExpansion[]
+  /** `ref.user()` properties of the target objects whose profiles attach under their `users`. */
+  users?: readonly string[]
   /**
    * Resolved link cardinality, driving the attached value shape: `"one"` yields a
    * single object (or `null`), `"many"` yields an array.
@@ -189,6 +197,7 @@ export type ObjectQueryPredicate =
   | ObjectQueryPredicateIn
   | ObjectQueryPredicateExists
   | ObjectQueryPredicateContains
+  | ObjectQueryPredicateConstant
 
 export interface ObjectQueryPredicateGroup {
   op: "and" | "or"
@@ -233,6 +242,17 @@ export interface ObjectQueryPredicateContains {
   scalarKind?: QueryScalarKind
 }
 
+/**
+ * Matches every row or none, reading no property.
+ *
+ * Core-produced, never authored: binding a query can settle a predicate before storage runs it,
+ * and a literal lets the database planner skip the scan. The HTTP schema does not accept it.
+ */
+export interface ObjectQueryPredicateConstant {
+  op: "constant"
+  value: boolean
+}
+
 export type ObjectQuerySortField =
   | {
       kind: "property"

package/src/objects/query/links.ts

@@ -249,6 +249,14 @@ function assertLinkSelectorShape(query: ObjectQuery, path = "$.query", root = tr
 }
 
 function visibleEndpointTypeIds(options: QueryExecutorOptions): readonly string[] | undefined {
+  const readable = options.readableObjectTypes
+  if (readable) {
+    return options.ontology
+      .listObjectTypes()
+      .map((objectType) => objectType.id)
+      .filter((objectTypeId) => readable.has(objectTypeId))
+  }
+
   if (!options.authorization) return undefined
   return options.ontology
     .listObjectTypes()

package/src/objects/query/matches-predicate.ts

@@ -0,0 +1,108 @@
+import type { ObjectRow } from "../../storage"
+import type { ObjectQueryPredicate, QueryScalarKind } from "./ir"
+import { compareQueryScalarValues, queryScalarValuesEqual } from "./scalar-values"
+
+/**
+ * Whether an object's properties match a validated predicate, with the semantics every object
+ * storage implements: the in-memory store and the query executor's fallback evaluate it here, and
+ * so does anything that decides on an object's state without reading it.
+ */
+export function matchesPredicate(
+  row: Pick<ObjectRow, "properties">,
+  predicate: ObjectQueryPredicate
+): boolean {
+  switch (predicate.op) {
+    case "and":
+      return predicate.items.every((item) => matchesPredicate(row, item))
+    case "or":
+      return predicate.items.some((item) => matchesPredicate(row, item))
+    case "not":
+      return !matchesPredicate(row, predicate.item)
+    case "constant":
+      return predicate.value
+    case "eq":
+      return queryScalarValuesEqual(
+        row.properties[predicate.propertyId],
+        predicate.value,
+        predicate.scalarKind
+      )
+    case "neq":
+      return !queryScalarValuesEqual(
+        row.properties[predicate.propertyId],
+        predicate.value,
+        predicate.scalarKind
+      )
+    case "lt":
+      return (
+        compareQueryScalarValues(
+          row.properties[predicate.propertyId],
+          predicate.value,
+          predicate.scalarKind
+        ) < 0
+      )
+    case "lte":
+      return (
+        compareQueryScalarValues(
+          row.properties[predicate.propertyId],
+          predicate.value,
+          predicate.scalarKind
+        ) <= 0
+      )
+    case "gt":
+      return (
+        compareQueryScalarValues(
+          row.properties[predicate.propertyId],
+          predicate.value,
+          predicate.scalarKind
+        ) > 0
+      )
+    case "gte":
+      return (
+        compareQueryScalarValues(
+          row.properties[predicate.propertyId],
+          predicate.value,
+          predicate.scalarKind
+        ) >= 0
+      )
+    case "in":
+      return predicate.values.some((value) =>
+        queryScalarValuesEqual(row.properties[predicate.propertyId], value, predicate.scalarKind)
+      )
+    case "exists": {
+      const exists =
+        Object.hasOwn(row.properties, predicate.propertyId) &&
+        row.properties[predicate.propertyId] !== undefined
+      return predicate.value ? exists : !exists
+    }
+    case "contains":
+      return containsValue(
+        row.properties[predicate.propertyId],
+        predicate.value,
+        predicate.scalarKind
+      )
+  }
+}
+
+function containsValue(
+  actual: unknown,
+  expected: unknown,
+  itemScalarKind: QueryScalarKind | undefined
+): boolean {
+  if (typeof actual === "string" && typeof expected === "string") {
+    return actual.includes(expected)
+  }
+
+  if (Array.isArray(actual)) {
+    return actual.some((item) => queryScalarValuesEqual(item, expected, itemScalarKind))
+  }
+
+  if (isPlainObject(actual) && typeof expected === "string") {
+    return Object.hasOwn(actual, expected)
+  }
+
+  return false
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value)
+}