@stacksjs/auth 0.70.229 → 0.70.230

package/dist/rbac.d.ts

@@ -56,7 +56,11 @@ export declare function removeRole(user: UserModel | { id: number } | number, ro
  */
 export declare function removeAllRoles(user: UserModel | { id: number } | number): Promise<void>;
 /**
- * Sync roles for a user (replaces all current roles)
+ * Sync roles for a user within one guard.
+ *
+ * Roles belonging to other guards are preserved. The previous implementation
+ * resolved the requested names within `guardName`, then replaced the complete
+ * pivot set, which silently removed assignments from every other guard.
  */
 export declare function syncRoles(user: UserModel | { id: number } | number, roleNames: string[], guardName?: string): Promise<void>;
 /**
@@ -88,7 +92,9 @@ export declare function revokePermission(user: UserModel | { id: number } | numb
  */
 export declare function revokeAllPermissions(user: UserModel | { id: number } | number): Promise<void>;
 /**
- * Sync direct permissions for a user
+ * Sync direct permissions for a user within one guard.
+ *
+ * Direct permissions belonging to other guards are preserved.
  */
 export declare function syncPermissions(user: UserModel | { id: number } | number, permissionNames: string[], guardName?: string): Promise<void>;
 /**

package/dist/rbac.js

@@ -146,14 +146,14 @@ export async function removeAllRoles(user) {
   cache.userPermissions.delete(userId);
 }
 export async function syncRoles(user, roleNames, guardName = "web") {
-  const userId = getUserId(user), roleIds = [];
-  for (const name of roleNames) {
+  const userId = getUserId(user), preservedRoleIds = (await getUserRoles(userId)).filter((role) => role.guard_name !== guardName).map((role) => role.id), roleIds = [];
+  for (const name of new Set(roleNames)) {
     const role = await findRole(name, guardName);
     if (!role)
       throw Error(`Role '${name}' not found.`);
     roleIds.push(role.id);
   }
-  await getStore().syncUserRoles(userId, roleIds);
+  await getStore().syncUserRoles(userId, [...preservedRoleIds, ...roleIds]);
   cache.userRoles.delete(userId);
   cache.userPermissions.delete(userId);
 }
@@ -206,14 +206,14 @@ export async function revokeAllPermissions(user) {
   cache.userPermissions.delete(userId);
 }
 export async function syncPermissions(user, permissionNames, guardName = "web") {
-  const userId = getUserId(user), permissionIds = [];
-  for (const name of permissionNames) {
+  const userId = getUserId(user), preservedPermissionIds = (await getStore().getUserDirectPermissions(userId)).filter((permission) => permission.guard_name !== guardName).map((permission) => permission.id), permissionIds = [];
+  for (const name of new Set(permissionNames)) {
     const perm = await findPermission(name, guardName);
     if (!perm)
       throw Error(`Permission '${name}' not found.`);
     permissionIds.push(perm.id);
   }
-  await getStore().syncUserPermissions(userId, permissionIds);
+  await getStore().syncUserPermissions(userId, [...preservedPermissionIds, ...permissionIds]);
   cache.userPermissions.delete(userId);
 }
 export async function hasPermission(user, permissionName, guardName = "web") {

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/auth",
   "type": "module",
   "sideEffects": false,
-  "version": "0.70.229",
+  "version": "0.70.230",
   "description": "A more simplistic way to authenticate.",
   "author": "Chris Breuer",
   "contributors": [
@@ -51,12 +51,12 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/bun-router": "^0.0.20",
+    "@stacksjs/bun-router": "^0.0.21",
     "@stacksjs/ts-auth": "^0.4.3"
   },
   "devDependencies": {
     "better-dx": "^0.2.17",
-    "@stacksjs/error-handling": "0.70.229",
-    "@stacksjs/router": "0.70.229"
+    "@stacksjs/error-handling": "0.70.230",
+    "@stacksjs/router": "0.70.230"
   }
 }