@stonyx/orm 0.3.2-alpha.94 → 0.3.2-alpha.95

package/README.md

@@ -323,15 +323,22 @@ export default class OwnerAccess {
 
   access(request) {
     // `access` runs after route matching, so `request.params` is populated and
-    // `id` has already been URL-decoded. Authorize on it.
+    // `id` has already been URL-decoded. Authorize on it, never on a URL.
     const { id } = request.params;
 
+    // `id` is still raw client text. Normalise it the way the record lookup
+    // does, or your predicate and the lookup disagree — see "Numeric ids" below.
+    // No radix on parseInt: that is deliberate, and it must stay that way.
+    const recordId = id === undefined ? undefined : (isNaN(id) ? id : parseInt(id));
+
     // Returning false explicitly denies access to this record
-    if (id === 'angela') return false;
+    if (recordId === 'angela') return false;
 
     // No `id` means the collection route. Returning a function plugs it in to
-    // the response object as a filter
-    if (id === undefined) return record => record.id !== 'angela';
+    // the response object as a filter. NOTE: a function return authorizes the
+    // request outright — the operations list below is not consulted — so this
+    // branch permits POST /owners as well as reads.
+    if (recordId === undefined) return record => record.id !== 'angela';
 
     // Returning a list of operations allows full access to everything else
     return ['read', 'create', 'update', 'delete'];
@@ -355,6 +362,41 @@ form that is safe to match on — `request.baseUrl` is the mount text as the
 client spelled it (`/OWNERS`), not the model. A class may still list several
 models in `models` when they share one rule.
 
+**Numeric ids: normalise before you compare.** `request.params.id` is raw text
+from the client. When it looks numeric the ORM coerces it — `isNaN(id) ? id :
+parseInt(id)` — *before* it resolves the record, so `7`, `007`, `7.0`, `7.9`,
+`7e0`, `0x7`, `+7`, `%207` (a leading space), `%09 7` (a tab) and `7%0A` (a
+trailing newline) all address record `7`, while a `===` against the raw text
+matches only the one spelling you wrote down. Every other spelling falls through
+to whatever your method returns next — which, in the shape above, is a full CRUD
+grant. All of them are plain address-bar requests.
+
+Two details are load-bearing. `parseInt` is called with **no radix**, so `0x7`
+is `7` and not `0`; writing `parseInt(id, 10)` in your predicate re-opens the
+hex spelling. And the coercion applies only when the id looks numeric, so a
+model with string ids (like `owner` above) is unaffected — which is exactly why
+this is easy to miss. Normalise the same way the lookup does:
+
+```javascript
+export default class AnimalAccess {
+  models = ['animal'];
+
+  access(request) {
+    const { id } = request.params;
+
+    // Agrees with the lookup for every spelling of 7 above. Compare the
+    // coerced value, which for a numeric-id model is a number, not a string.
+    const recordId = id === undefined ? undefined : (isNaN(id) ? id : parseInt(id));
+
+    if (recordId === 7) return false;
+
+    if (recordId === undefined) return record => record.id !== 7;
+
+    return ['read', 'create', 'update', 'delete'];
+  }
+}
+```
+
 The sample above is executed verbatim against a live server by
 `test/integration/readme-access/`, which reads it out of this file: the request
 `DELETE /owners/angela` is asserted to return 403 with the record intact, along

package/package.json

@@ -4,7 +4,7 @@
     "stonyx-async",
     "stonyx-module"
   ],
-  "version": "0.3.2-alpha.94",
+  "version": "0.3.2-alpha.95",
   "description": "",
   "main": "dist/index.js",
   "type": "module",