@stacksjs/orm 0.74.24 → 0.74.26

package/dist/models/Board.ts

@@ -33,10 +33,23 @@ export default defineModel({
     useApi: {
       uri: 'boards',
       routes: ['index', 'store', 'show', 'update', 'destroy'],
-      middleware: ['auth'],
+      // Team-owned since #2412, so the active-team guard applies - the
+      // contract in tests/unit/default-team-api-scope-contract.test.ts.
+      middleware: ['auth', 'team'],
     },
   },
 
+  /*
+   * A board belongs to a team, which is what makes it - and everything on it -
+   * scopable. Without this, `Board` had no foreign key at all, so row scoping
+   * had nothing to resolve and withheld `store`/`update`/`destroy`: a kanban
+   * board with no create endpoint (stacksjs/stacks#2412).
+   *
+   * `BoardColumn` and `Label` chain to here, so this one column scopes all
+   * three.
+   */
+  belongsTo: ['Team'],
+
   hasMany: ['BoardColumn', 'Label'],
 
   attributes: {

package/dist/models/BoardColumn.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -40,6 +40,9 @@ export default defineModel({
   },
 
   belongsTo: ['Board'],
+
+  // Owned by whoever owns the board it sits on (stacksjs/stacks#2412).
+  ownership: parentOwnership('Board', 'board_id'),
   hasMany: ['Card'],
 
   attributes: {

package/dist/models/Label.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { defineModel, parentOwnership } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -39,6 +39,9 @@ export default defineModel({
 
   belongsTo: ['Board'],
 
+  // Owned by whoever owns the board it sits on (stacksjs/stacks#2412).
+  ownership: parentOwnership('Board', 'board_id'),
+
   attributes: {
     boardId: {
       order: 1,

package/dist/models/commerce/DigitalDelivery.ts

@@ -7,6 +7,17 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+
+  /*
+   * A delivery policy, not a delivery. Its columns are `name`,
+   * `downloadLimit`, `expiryDays`, `requiresLogin` and `automaticDelivery` -
+   * a reusable configuration attached to what is sold, with no customer, order
+   * or file on it. #2412 guessed this "almost certainly belongs to an order or
+   * a customer"; the attributes say otherwise, so it is declared a catalog
+   * record and its writes want an admin gate rather than row scoping.
+   */
+  ownership: false,
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/LoyaltyPoint.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 export default defineModel({
@@ -7,6 +7,18 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
 
+
+  /*
+   * Points belong to a customer. The model carried `walletId`, pointing at a
+   * `LoyaltyWallet` that was never built, so nothing resolved an owner and the
+   * writes stayed denied (stacksjs/stacks#2412). Scoping by customer is the
+   * additive half of that issue's second option; `walletId` is left alone
+   * because repointing an existing column is a data decision of its own.
+   */
+  belongsTo: ['Customer'],
+
+  ownership: customerOwnership(),
+
   traits: {
     useUuid: true,
     useTimestamps: true,

package/dist/models/commerce/Pledge.ts

@@ -1,4 +1,4 @@
-import { defineModel } from '@stacksjs/orm'
+import { customerOwnership, defineModel } from '@stacksjs/orm'
 import { schema } from '@stacksjs/validation'
 
 /**
@@ -34,7 +34,14 @@ export default defineModel({
     observe: true,
   },
 
-  belongsTo: ['Auction'],
+  /*
+   * A pledge is made BY someone. It chained only to `Auction`, an unscoped
+   * catalog, so there was no owner to resolve and its writes stayed denied
+   * (stacksjs/stacks#2412).
+   */
+  belongsTo: ['Auction', 'Customer'],
+
+  ownership: customerOwnership(),
 
   indexes: [
     { name: 'pledges_auction_id_index', columns: ['auction_id'] },

package/dist/models/commerce/Receipt.ts

@@ -18,6 +18,14 @@ export default defineModel({
   primaryKey: 'id',
   autoIncrement: true,
   belongsTo: ['PrintDevice'],
+
+  /*
+   * A receipt is a record OF a device, not of a customer - it chains to
+   * `PrintDevice`, an unscoped catalog. Saying so explicitly is the honest
+   * declaration; its writes want an admin gate rather than row scoping
+   * (stacksjs/stacks#2412).
+   */
+  ownership: false,
   traits: {
     useUuid: true,
     useTimestamps: true,

package/package.json

@@ -2,7 +2,7 @@
   "name": "@stacksjs/orm",
   "type": "module",
   "sideEffects": false,
-  "version": "0.74.24",
+  "version": "0.74.26",
   "description": "The Stacks ORM integration",
   "author": "Chris Breuer",
   "contributors": [
@@ -63,31 +63,31 @@
     "prepublishOnly": "bun run build"
   },
   "dependencies": {
-    "@stacksjs/cache": "0.74.24",
-    "@stacksjs/cli": "0.74.24",
-    "@stacksjs/config": "0.74.24",
-    "@stacksjs/database": "0.74.24",
-    "@stacksjs/env": "0.74.24",
-    "@stacksjs/error-handling": "0.74.24",
-    "@stacksjs/events": "0.74.24",
-    "@stacksjs/logging": "0.74.24",
-    "@stacksjs/model-meta": "0.74.24",
-    "@stacksjs/pagination": "0.74.24",
-    "@stacksjs/path": "0.74.24",
-    "@stacksjs/query-builder": "0.74.24",
-    "@stacksjs/realtime": "0.74.24",
-    "@stacksjs/router": "0.74.24",
-    "@stacksjs/storage": "0.74.24",
-    "@stacksjs/strings": "0.74.24",
+    "@stacksjs/cache": "0.74.26",
+    "@stacksjs/cli": "0.74.26",
+    "@stacksjs/config": "0.74.26",
+    "@stacksjs/database": "0.74.26",
+    "@stacksjs/env": "0.74.26",
+    "@stacksjs/error-handling": "0.74.26",
+    "@stacksjs/events": "0.74.26",
+    "@stacksjs/logging": "0.74.26",
+    "@stacksjs/model-meta": "0.74.26",
+    "@stacksjs/pagination": "0.74.26",
+    "@stacksjs/path": "0.74.26",
+    "@stacksjs/query-builder": "0.74.26",
+    "@stacksjs/realtime": "0.74.26",
+    "@stacksjs/router": "0.74.26",
+    "@stacksjs/storage": "0.74.26",
+    "@stacksjs/strings": "0.74.26",
     "@stacksjs/ts-validation": "^0.5.6",
-    "@stacksjs/validation": "0.74.24",
-    "bun-query-builder": "^0.2.62"
+    "@stacksjs/validation": "0.74.26",
+    "bun-query-builder": "^0.2.68"
   },
   "peerDependencies": {
-    "@stacksjs/auth": "0.74.24",
-    "@stacksjs/payments": "0.74.24",
-    "@stacksjs/queue": "0.74.24",
-    "@stacksjs/search-engine": "0.74.24",
+    "@stacksjs/auth": "0.74.26",
+    "@stacksjs/payments": "0.74.26",
+    "@stacksjs/queue": "0.74.26",
+    "@stacksjs/search-engine": "0.74.26",
     "stripe": "22.3.2"
   },
   "peerDependenciesMeta": {
@@ -108,7 +108,7 @@
     }
   },
   "devDependencies": {
-    "@stacksjs/types": "0.74.24",
+    "@stacksjs/types": "0.74.26",
     "better-dx": "^0.2.24",
     "stripe": "22.3.2"
   }