@stacksjs/orm 0.74.1 → 0.74.2

package/dist/models/Content/Menu.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -20,6 +20,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/Content/MenuItem.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -11,6 +11,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the menu's site, and so its team
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Menu decides ownership.
+  ownership: parentOwnership('Menu', 'menu_id'),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/Content/Page.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -28,6 +28,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/Content/Post.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,10 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/Content/Redirect.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -21,6 +21,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/EmailIdempotency.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/EmailList.ts

@@ -8,6 +8,12 @@ export default defineModel({
   autoIncrement: true,
   hasMany: ['EmailListSubscriber', 'Campaign', 'CampaignSend'],
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/EmailSuppression.ts

@@ -15,6 +15,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/EmailWebhookEvent.ts

@@ -15,6 +15,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/Forms/Form.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -23,6 +23,10 @@ export default defineModel({
     },
   ],
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/Forms/FormField.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -21,6 +21,11 @@ export default defineModel({
     },
   ],
 
+  // No owner of its own: these rows are owned by whoever owns the form's site, and so its team
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Form decides ownership.
+  ownership: parentOwnership('Form', 'form_id'),
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/MailPreference.ts

@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useApi: {

package/dist/models/Request.ts

@@ -22,6 +22,11 @@ export default defineModel({
     },
   ],
 
+  // An infrastructure table: rows are written by the system, not on behalf of a
+  // caller, so no row has a per-caller owner to scope by. Writes are gated by
+  // `middleware` instead. Declared rather than left silent (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useTimestamps: true,
     useSoftDeletes: true,

package/dist/models/SiteDomain.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, siteOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -14,6 +14,10 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Owned through the site, which belongs to a team, so the owner is the set of
+  // site ids the caller's team owns rather than a single id (stacksjs/stacks#2375).
+  ownership: siteOwnership(),
+
   traits: {
     useTimestamps: true,
     observe: true, // domain changes clear the host-resolution cache

package/dist/models/Tag.ts

@@ -25,6 +25,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/Team.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, teamMembershipOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // The owner column is the primary key: a caller may write the team they are
+  // actually a member of, resolved by the same auth path every other
+  // team-scoped model uses (stacksjs/stacks#2375).
+  ownership: teamMembershipOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/User.ts

@@ -1,5 +1,5 @@
 import type { Attributes } from '@stacksjs/types'
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, selfOwnership } from '@stacksjs/orm'
 import { makeHash } from '@stacksjs/security'
 // soon, these will be auto-imported
 import { schema } from '@stacksjs/validation'
@@ -19,6 +19,11 @@ export default defineModel({
     },
   ],
 
+  // A caller may write their own row and no other (stacksjs/stacks#2375). The
+  // owner column IS the primary key here, so without this `User` is the worst
+  // case the issue describes: an authenticated caller able to PATCH any user.
+  ownership: selfOwnership(),
+
   traits: {
     useAuth: {
       usePasskey: true,

package/dist/models/commerce/Auction.ts

@@ -17,6 +17,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/AuctionItem.ts

@@ -13,6 +13,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Cart.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/CartItem.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the cart's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Cart decides ownership.
+  ownership: parentOwnership('Cart', 'cart_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Category.ts

@@ -8,6 +8,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Coupon.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/DeliveryRoute.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the courier, who is a user
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Courier decides ownership.
+  ownership: parentOwnership('Courier', 'courier_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/DeliveryStop.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -18,6 +18,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/GiftCard.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/LicenseKey.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/LoyaltyReward.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Manufacturer.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Order.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Payment.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/PrintDevice.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   hasMany: ['Receipt'],
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Product.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/ProductUnit.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/ProductVariant.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Review.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // Rows belong to the caller's customer record, one hop from the user
+  // (stacksjs/stacks#2375). Without this the generated writes are reachable by
+  // any authenticated caller for any row.
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/ShippingMethod.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/ShippingRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/ShippingZone.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/TaxRate.ts

@@ -7,6 +7,12 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // A reference table: no row here has a per-caller owner, so there is nothing
+  // to scope by and writes are an administrative concern gated by `middleware`.
+  // Declared rather than left silent so `security.api.rowScoping: 'deny'` can
+  // tell "considered" from "nobody thought about it" (stacksjs/stacks#2375).
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Transaction.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,11 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+  // No owner of its own: these rows are owned by whoever owns the order's customer
+  // (stacksjs/stacks#2375). Resolved through the parent so it follows any change
+  // to how Order decides ownership.
+  ownership: parentOwnership('Order', 'order_id'),
+
   traits: {
     useUuid: true,
     useTimestamps: true,