@stacksjs/defaults 0.74.1 → 0.74.3

package/app/Models/Team.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, teamMembershipOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // The owner column is the primary key: a caller may write the team they are
+  // actually a member of, resolved by the same auth path every other
+  // team-scoped model uses (stacksjs/stacks#2375).
+  ownership: teamMembershipOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/User.ts

@@ -1,5 +1,5 @@
 import type { Attributes } from '@stacksjs/types'
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, selfOwnership } from '@stacksjs/orm'
 import { makeHash } from '@stacksjs/security'
 // soon, these will be auto-imported
 import { schema } from '@stacksjs/validation'
@@ -19,6 +19,11 @@ export default defineModel({
     },
   ],
 
+  // A caller may write their own row and no other (stacksjs/stacks#2375). The
+  // owner column IS the primary key here, so without this `User` is the worst
+  // case the issue describes: an authenticated caller able to PATCH any user.
+  ownership: selfOwnership(),
+
   traits: {
     useAuth: {
       usePasskey: true,

package/app/Models/commerce/Auction.ts

@@ -17,6 +17,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/AuctionItem.ts

@@ -13,6 +13,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Cart.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/CartItem.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the cart's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Cart decides ownership.
+  ownership: parentOwnership('Cart', 'cart_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Category.ts

@@ -8,6 +8,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Coupon.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/DeliveryRoute.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the courier, who is a user
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Courier decides ownership.
+  ownership: parentOwnership('Courier', 'courier_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/DeliveryStop.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -18,6 +18,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/GiftCard.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/LicenseKey.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/LoyaltyReward.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Manufacturer.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Order.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Payment.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/PrintDevice.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   hasMany: ['Receipt'],
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Product.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ProductUnit.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ProductVariant.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Review.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingMethod.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/ShippingZone.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/TaxRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/Transaction.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/WaitlistProduct.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['Product', 'Customer'],
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/commerce/WaitlistRestaurant.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['Customer'],
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/app/Models/realtime/Websocket.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useSeeder: {

package/ide/vscode/package.json

@@ -2,7 +2,7 @@
   "publisher": "Stacks",
   "name": "vscode-stacks",
   "displayName": "Stacks",
-  "version": "0.74.1",
+  "version": "0.74.3",
   "description": "A modern Stacks development environment.",
   "license": "MIT",
   "funding": "https://github.com/sponsors/chrisbbreuer",

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/defaults",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.1",
+  "version": "0.74.3",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/stacksjs/stacks.git",
@@ -54,7 +54,7 @@
   "dependencies": {
     "@iconify-json/f7": "^1.2.2",
     "@iconify-json/hugeicons": "^1.2.27",
-    "@stacksjs/mobile": "^0.74.1",
+    "@stacksjs/mobile": "^0.74.3",
     "@stacksjs/sanitizer": "^0.2.113",
     "ts-qr-codes": "^0.1.8"
   }

package/project/storage/framework/tsconfig.app.json

@@ -6,7 +6,10 @@
   "compilerOptions": {
     "lib": ["esnext", "dom"],
     "rootDir": "../..",
-    "tsBuildInfoFile": "./.cache/typescript/app.tsbuildinfo",
+    // Not incremental, for the reason spelled out in tsconfig.app.json: the
+    // cache reports a false green after the auto-import barrels are
+    // regenerated. stacksjs/stacks#2405.
+    "incremental": false,
     "paths": {
       "Actions/*": ["../../app/Actions/*"],
       "Commands/*": ["../../app/Commands/*"],