@stacksjs/defaults 0.74.0 → 0.74.2

package/app/Models/AnalyticsEvent.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/Content/Menu.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -20,6 +20,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/Content/MenuItem.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -11,6 +11,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the menu's site, and so its team
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Menu decides ownership.
+  ownership: parentOwnership('Menu', 'menu_id'),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/Content/Page.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -28,6 +28,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/Content/Post.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,10 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/Content/Redirect.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -21,6 +21,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/EmailIdempotency.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/EmailList.ts

@@ -8,6 +8,12 @@ export default defineModel({
   autoIncrement: true,
   hasMany: ['EmailListSubscriber', 'Campaign', 'CampaignSend'],
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/EmailSuppression.ts

@@ -15,6 +15,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/EmailWebhookEvent.ts

@@ -15,6 +15,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/Forms/Form.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -23,6 +23,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/Forms/FormField.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -21,6 +21,11 @@ export default defineModel({
     },
   ],
 
+  // No owner of its own: these rows are owned by whoever owns the form's site, and so its team
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Form decides ownership.
+  ownership: parentOwnership('Form', 'form_id'),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/MailPreference.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/app/Models/Request.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useSoftDeletes: true,

package/app/Models/SiteDomain.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -14,6 +14,10 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     observe: true, // domain changes clear the host-resolution cache

package/app/Models/Tag.ts

@@ -25,6 +25,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/Team.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, teamMembershipOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // The owner column is the primary key: a caller may write the team they are
+  // actually a member of, resolved by the same auth path every other
+  // team-scoped model uses (stacksjs/stacks#2375).
+  ownership: teamMembershipOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/User.ts

@@ -1,5 +1,5 @@
 import type { Attributes } from '@stacksjs/types'
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, selfOwnership } from '@stacksjs/orm'
 import { makeHash } from '@stacksjs/security'
 // soon, these will be auto-imported
 import { schema } from '@stacksjs/validation'
@@ -19,6 +19,11 @@ export default defineModel({
     },
   ],
 
+  // A caller may write their own row and no other (stacksjs/stacks#2375). The
+  // owner column IS the primary key here, so without this `User` is the worst
+  // case the issue describes: an authenticated caller able to PATCH any user.
+  ownership: selfOwnership(),
+
   traits: {
     useAuth: {
       usePasskey: true,

package/app/Models/commerce/Auction.ts

@@ -17,6 +17,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/AuctionItem.ts

@@ -13,6 +13,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Cart.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/CartItem.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the cart's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Cart decides ownership.
+  ownership: parentOwnership('Cart', 'cart_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Category.ts

@@ -8,6 +8,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Coupon.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/DeliveryRoute.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the courier, who is a user
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Courier decides ownership.
+  ownership: parentOwnership('Courier', 'courier_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/DeliveryStop.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -18,6 +18,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/GiftCard.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/LicenseKey.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/LoyaltyReward.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Manufacturer.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Order.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Payment.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/PrintDevice.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   hasMany: ['Receipt'],
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Product.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ProductUnit.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ProductVariant.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Review.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingMethod.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingZone.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/TaxRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Transaction.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/WaitlistProduct.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['Product', 'Customer'],
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/WaitlistRestaurant.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['Customer'],
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/realtime/Websocket.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useSeeder: {

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.0",
+  "version": "0.74.2",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.0",
+  "version": "0.74.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -54,7 +54,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.0",
+    "@stacksjs/mobile": "^0.74.2",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/project/storage/framework/tsconfig.app.json

@@ -6,7 +6,10 @@
   "compilerOptions": {
     "lib": ["esnext", "dom"],
     "rootDir": "../..",
-    "tsBuildInfoFile": "./.cache/typescript/app.tsbuildinfo",
+    // Not incremental, for the reason spelled out in tsconfig.app.json: the
+    // cache reports a false green after the auto-import barrels are
+    // regenerated. stacksjs/stacks#2405.
+    "incremental": false,
     "paths": {
       "Actions/*": ["../../app/Actions/*"],
       "Commands/*": ["../../app/Commands/*"],

package/resources/views/cms/blocks/form.stx

@@ -18,6 +18,12 @@
   const sending = state(false)
   const done = state('')
   const openedAt = Date.now()
+  // Field names with an upload in flight, so each file input can disable
+  // itself and the submit button can wait for all of them.
+  const uploading = reactive<Record<string, boolean>>({})
+  // The chosen file's name per field, so the person can see what was attached
+  // rather than only the storage path the server answered with.
+  const attached = reactive<Record<string, string>>({})
 
   effect(() => {
     if (!host() || definition())
@@ -52,10 +58,87 @@
     return conditions.action === 'show' ? matched : !matched
   }
 
+  /**
+   * Upload one file and record the storage path it returns.
+   *
+   * The submitted value for a `file` field is that path, not the file: the
+   * server checks it sits under this form's upload prefix before accepting the
+   * submission, so a path this endpoint did not issue is rejected.
+   *
+   * Size and type are enforced server-side from `config/forms.ts`; `accept` on
+   * the input is only a picker convenience, since a file dialog filter is a
+   * suggestion and not a check.
+   */
+  async function uploadFile(field: PublicFormField, event: Event): Promise<void> {
+    const input = event.target as HTMLInputElement
+    const file = input.files?.[0]
+    if (!file)
+      return
+
+    uploading[field.name] = true
+    errors.set({ ...errors(), [field.name]: '' })
+
+    try {
+      const uuid = host()?.dataset.formUuid
+      const payload = new FormData()
+      payload.append('field', field.name)
+      payload.append('file', file)
+
+      const reply = await fetch(`/api/forms/${uuid}/uploads`, {
+        method: 'POST',
+        credentials: 'same-origin',
+        body: payload,
+      })
+      const body = await reply.json().catch(() => ({}))
+
+      if (!reply.ok) {
+        // Clear the input as well as the value: leaving a rejected file
+        // showing next to its own error message reads as though it was taken.
+        input.value = ''
+        delete values[field.name]
+        delete attached[field.name]
+        errors.set({ ...errors(), [field.name]: body.message ?? 'That file could not be uploaded.' })
+        return
+      }
+
+      values[field.name] = body.path
+      attached[field.name] = file.name
+    }
+    catch {
+      input.value = ''
+      errors.set({ ...errors(), [field.name]: 'That file could not be uploaded.' })
+    }
+    finally {
+      uploading[field.name] = false
+    }
+  }
+
+  /**
+   * The `accept` attribute for a field's picker.
+   *
+   * A convenience only - a file dialog filter is a suggestion, and the server
+   * enforces the real allowlist from `config/forms.ts`. Built here rather than
+   * inline in the template so the extension parameter has a type.
+   */
+  function acceptAttr(field: PublicFormField): string {
+    return (field.options.accept ?? []).map((extension: string) => `.${extension}`).join(',')
+  }
+
+  /** True while any upload is still in flight. */
+  function anyUploading(): boolean {
+    return Object.values(uploading).some(Boolean)
+  }
+
   async function submit(event: Event): Promise<void> {
     event.preventDefault()
     if (sending())
       return
+    // A submission sent mid-upload would carry no path for that field and read
+    // as a missing required answer, which is not what happened.
+    if (anyUploading()) {
+      errors.set({ _form: 'Please wait for the upload to finish.' })
+      return
+    }
     sending.set(true)
     errors.set({})
 
@@ -119,6 +202,14 @@
                 <input type="checkbox" @change="values[field.name] = $event.target.checked" class="h-4 w-4 rounded">
                 {{ field.options.placeholder ?? 'Yes' }}
               </label>
+              {{-- A file field used to fall through to the text input below, so
+                   a person typed prose into what should have been a picker and
+                   the submission could never satisfy it. --}}
+              <div :else-if="field.type === 'file'" class="mt-1.5">
+                <input type="file" :required="field.required && !values[field.name]" :disabled="uploading[field.name]" accept="{{ acceptAttr(field) }}" @change="uploadFile(field, $event)" class="block w-full text-[15px] file:mr-3 file:rounded-lg file:border-0 file:bg-gray-100 file:px-3.5 file:py-2 file:text-[14px] file:font-medium">
+                <p :if="uploading[field.name]" class="mt-1.5 text-[13px] text-gray-500">Uploading...</p>
+                <p :else-if="attached[field.name]" class="mt-1.5 text-[13px] text-green-700">Attached {{ attached[field.name] }}</p>
+              </div>
               <input :else type="{{ field.type === 'email' ? 'email' : (field.type === 'phone' ? 'tel' : (field.type === 'date' ? 'date' : (field.type === 'currency' ? 'number' : 'text'))) }}" :required="field.required" placeholder="{{ field.options.placeholder ?? '' }}" @input="values[field.name] = field.type === 'currency' ? Math.round(Number($event.target.value) * 100) : $event.target.value" class="mt-1.5 w-full rounded-lg border border-gray-300 px-3.5 py-2.5 text-[15px]">
               <p :if="errors()[field.name]" class="mt-1.5 text-[13px] text-red-600">{{ errors()[field.name] }}</p>
             </template>
@@ -128,7 +219,7 @@
 
       <input type="text" name="website" tabindex="-1" autocomplete="off" aria-hidden="true" class="hidden" @input="values._hp = $event.target.value">
 
-      <button type="submit" :disabled="sending()" class="mt-7 rounded-lg px-6 py-3 font-medium bg-gray-900 text-white transition-transform active:scale-[0.98] disabled:opacity-60">
+      <button type="submit" :disabled="sending() || anyUploading()" class="mt-7 rounded-lg px-6 py-3 font-medium bg-gray-900 text-white transition-transform active:scale-[0.98] disabled:opacity-60">
         {{ sending() ? 'Sending...' : (definition()?.submitLabel ?? 'Submit') }}
       </button>
     </form>

package/routes/forms.ts

@@ -35,6 +35,52 @@ route.get('/api/forms/{uuid}', async (request: any) => {
   return response.json(publicDefinition(form))
 }).rateLimit(60, 'minute')
 
+/**
+ * File uploads for a form's `file` fields.
+ *
+ * Proxied through the server rather than presigned, because this is where the
+ * ceilings in `config/forms.ts` can actually be applied: a presigned policy can
+ * express a size cap but not a real type check (S3 sees only the Content-Type
+ * the client declared), and a proxied upload works on a local disk too. A
+ * public form is not a bulk-upload surface. stacksjs/stacks#2406.
+ *
+ * The stored path is returned for the submit step, which checks it sits under
+ * this form's prefix before accepting it.
+ */
+route.post('/api/forms/{uuid}/uploads', async (request: any) => {
+  const { checkUpload, fileFieldNamed, formUploadPrefix, loadFormByUuid, resolveUploadLimits } = await import('@stacksjs/forms')
+
+  const form = await loadFormByUuid(String(request.params?.uuid ?? request.param?.('uuid') ?? ''), await siteIdForRequest(request))
+  if (!form || form.status === 'draft')
+    return response.notFound('Form not found')
+
+  // Same gate the submit endpoint applies: a closed form does not take files
+  // either, and accepting them would leave orphans nothing ever references.
+  if (form.status !== 'active')
+    return response.json({ message: 'This form is not accepting responses.' }, { status: 409 })
+
+  const field = fileFieldNamed(form, request.get?.('field') ?? request.input?.('field'))
+  if (!field)
+    return response.json({ message: 'Unknown upload field.' }, { status: 422 })
+
+  const file = request.file?.('file')
+  if (!file)
+    return response.json({ message: `${field.label} is required.` }, { status: 422 })
+
+  const limits = resolveUploadLimits(field)
+  const rejection = checkUpload(field, { name: file.name, size: file.size }, limits)
+  if (rejection)
+    return response.json({ message: rejection.message }, { status: rejection.status })
+
+  const { Storage } = await import('@stacksjs/storage')
+  const stored = await Storage.put(file, {
+    ...(limits.disk ? { disk: limits.disk } : {}),
+    dir: formUploadPrefix(form),
+  })
+
+  return response.json({ path: stored.path }, { status: 201 })
+}).rateLimit(20, 'minute')
+
 route.post('/api/forms/{uuid}/submissions', async (request: any) => {
   const { dispatchSubmissionNotifications, loadFormByUuid, submitForm } = await import('@stacksjs/forms')