@stacksjs/types 0.73.3 → 0.74.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/security.d.ts +25 -0
- package/package.json +5 -3
package/dist/security.d.ts
CHANGED
|
@@ -10,9 +10,34 @@ export declare interface FirewallOptions {
|
|
|
10
10
|
useIpReputationLists: boolean
|
|
11
11
|
useKnownBadInputsRuleSet: boolean
|
|
12
12
|
}
|
|
13
|
+
export declare interface ApiSecurityOptions {
|
|
14
|
+
rowScoping: ApiRowScopingPolicy
|
|
15
|
+
}
|
|
13
16
|
export declare interface SecurityOptions {
|
|
14
17
|
driver: 'aws'
|
|
15
18
|
firewall: FirewallOptions
|
|
19
|
+
api: ApiSecurityOptions
|
|
16
20
|
}
|
|
17
21
|
export type FirewallConfig = Partial<FirewallOptions>;
|
|
22
|
+
/**
|
|
23
|
+
* **Row scoping for generated API routes**
|
|
24
|
+
*
|
|
25
|
+
* A model's `useApi` trait generates `store` / `update` / `destroy` routes.
|
|
26
|
+
* Whether those routes are scoped to a row the caller owns is decided by the
|
|
27
|
+
* model: an explicit `ownership` config, or a `team_id` column, which is
|
|
28
|
+
* auto-scoped to the caller's active team. A model that declares neither gets
|
|
29
|
+
* routes with no row-level check - correct for a public catalog table, and a
|
|
30
|
+
* footgun everywhere else, because declaring nothing is what a model does by
|
|
31
|
+
* accident as well as on purpose.
|
|
32
|
+
*
|
|
33
|
+
* - `'warn'` registers those routes and names the models at boot. This is the
|
|
34
|
+
* published behaviour and the current default.
|
|
35
|
+
* - `'deny'` does not register mutating routes for a model with no ownership
|
|
36
|
+
* config. Safer, and breaking: it removes routes an app may be relying on.
|
|
37
|
+
*
|
|
38
|
+
* The default is `'warn'` so nothing changes on upgrade, and an app that wants
|
|
39
|
+
* the safer posture can take it today rather than waiting for a major.
|
|
40
|
+
* stacksjs/stacks#2375.
|
|
41
|
+
*/
|
|
42
|
+
export type ApiRowScopingPolicy = 'warn' | 'deny';
|
|
18
43
|
export type SecurityConfig = DeepPartial<SecurityOptions>;
|
package/package.json
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@stacksjs/types",
|
|
3
3
|
"type": "module",
|
|
4
|
-
"version": "0.
|
|
4
|
+
"version": "0.74.0",
|
|
5
5
|
"description": "The Stacks framework types.",
|
|
6
6
|
"author": "Chris Breuer",
|
|
7
7
|
"contributors": [
|
|
@@ -57,8 +57,10 @@
|
|
|
57
57
|
},
|
|
58
58
|
"dependencies": {
|
|
59
59
|
"@stacksjs/bunpress": "^0.2.8",
|
|
60
|
-
"@stacksjs/events": "0.73.3",
|
|
61
60
|
"@stacksjs/clapp": "^0.2.12",
|
|
61
|
+
"@stacksjs/events": "0.74.0",
|
|
62
|
+
"@stacksjs/orm": "0.74.0",
|
|
63
|
+
"@stacksjs/strings": "0.74.0",
|
|
62
64
|
"@stacksjs/stx": "^0.2.246",
|
|
63
65
|
"@stacksjs/ts-validation": "^0.5.6",
|
|
64
66
|
"bun-query-builder": "^0.2.53"
|
|
@@ -72,7 +74,7 @@
|
|
|
72
74
|
}
|
|
73
75
|
},
|
|
74
76
|
"devDependencies": {
|
|
75
|
-
"@stacksjs/validation": "0.
|
|
77
|
+
"@stacksjs/validation": "0.74.0",
|
|
76
78
|
"better-dx": "^0.2.24",
|
|
77
79
|
"meilisearch": "^0.59.0"
|
|
78
80
|
},
|