@svgrid/enterprise 2.3.0 → 2.3.2

package/src/sveltekit/index.ts

@@ -11,6 +11,7 @@ export {
   createKitHandlers,
   type KitDataSourceOptions,
   type KitHandlerOptions,
+  type KitScope,
   type KitHandlers,
   type KitMessage,
 } from './transport'

package/src/sveltekit/sql-source.ts

@@ -74,7 +74,7 @@ export function createSqlDataSource<TData extends RowData>(
   config: SqlDataSourceConfig<TData>,
 ): WritableDataSource<TData> & AggregateSource {
   nudgeEnterprise('Studio') // soft-gate; never blocks, safe on the server
-  const { schema, table, execute } = config
+  const { schema, execute } = config
   const dialect = config.dialect ?? {}
   const returning = config.returning ?? true
   const id = quoter(dialect)

package/src/sveltekit/transport-scope.test.ts

@@ -0,0 +1,125 @@
+/**
+ * Row scoping (`scope`) - the mechanism behind multi-tenancy.
+ *
+ * Scoping reads is the easy half and the useless half on its own: if create can
+ * plant a row in another tenant, or update/delete can reach one by guessing an
+ * id, the isolation is decorative. These tests cover all four paths plus the
+ * ways a client might try to talk its way out of the scope.
+ */
+import { describe, expect, it } from 'vitest'
+import type { ServerRequest } from '@svgrid/grid'
+import type { EntitySchema } from '../schema'
+import { createInMemoryDataSource } from './in-memory'
+import { createKitDataSource, createKitHandlers } from './transport'
+
+type Row = { id: string; name: string; tenantId: string }
+
+const schema: EntitySchema<Row> = {
+  name: 'notes',
+  fields: [
+    { field: 'id', type: 'text', primaryKey: true },
+    { field: 'name', type: 'text' },
+    { field: 'tenantId', type: 'text' },
+  ],
+}
+
+const seed: Row[] = [
+  { id: '1', name: 'Acme note', tenantId: 'acme' },
+  { id: '2', name: 'Acme second', tenantId: 'acme' },
+  { id: '3', name: 'Globex secret', tenantId: 'globex' },
+]
+
+/** Wire a client to handlers scoped to `tenant` (null = unscoped/super-admin). */
+function wire(tenant: string | null, opts: { throwOnResolve?: boolean } = {}) {
+  const backend = createInMemoryDataSource(seed.map((r) => ({ ...r })), schema)
+  const handlers = createKitHandlers({
+    schema,
+    source: backend,
+    scope: () => {
+      if (opts.throwOnResolve) throw new Error('no tenant on session')
+      return tenant ? { field: 'tenantId', value: tenant } : null
+    },
+  })
+  const fakeFetch = (url: string, init?: RequestInit) =>
+    handlers.handle(new Request(`http://localhost${url}`, init))
+  const client = createKitDataSource<Row>({ endpoint: '/api/notes', fetch: fakeFetch })
+  return { client, backend, handlers }
+}
+
+const req = (partial: Partial<ServerRequest> = {}): ServerRequest => ({
+  startRow: 0, endRow: 50, pageIndex: 0, pageSize: 50, sortModel: [], filterModel: {}, ...partial,
+})
+
+describe('row scoping: reads', () => {
+  it('returns only the caller tenant\'s rows', async () => {
+    const { client } = wire('acme')
+    const { rows } = await client.getRows(req())
+    expect(rows.map((r) => r.id)).toEqual(['1', '2'])
+  })
+
+  it('is unscoped when the resolver returns null', async () => {
+    const { client } = wire(null)
+    const { rows } = await client.getRows(req())
+    expect(rows).toHaveLength(3)
+  })
+
+  it('a client-supplied tenant filter cannot widen the scope', async () => {
+    const { client } = wire('acme')
+    // Ask for globex explicitly - the server's predicate is written last.
+    const { rows } = await client.getRows(
+      req({ filterModel: { columns: { tenantId: { operator: 'equals', value: 'globex' } } } }),
+    )
+    expect(rows.every((r) => r.tenantId === 'acme')).toBe(true)
+  })
+})
+
+describe('row scoping: writes', () => {
+  it('stamps the tenant on create, overriding what the client sent', async () => {
+    const { client, backend } = wire('acme')
+    const created = await client.createRow!({ id: '9', name: 'New', tenantId: 'globex' } as Partial<Row>)
+    expect(created.tenantId).toBe('acme')
+    const { rows } = await backend.getRows(req())
+    expect(rows.find((r) => r.id === '9')!.tenantId).toBe('acme')
+  })
+
+  it('rejects updating a row in another tenant', async () => {
+    const { client } = wire('acme')
+    await expect(client.updateRow!('3', { name: 'hacked' })).rejects.toThrow()
+  })
+
+  it('rejects deleting a row in another tenant', async () => {
+    const { client } = wire('acme')
+    await expect(client.deleteRow!('3')).rejects.toThrow()
+  })
+
+  it('leaves the other tenant\'s data untouched after a rejected write', async () => {
+    const { client, backend } = wire('acme')
+    await client.updateRow!('3', { name: 'hacked' }).catch(() => {})
+    await client.deleteRow!('3').catch(() => {})
+    const { rows } = await backend.getRows(req())
+    expect(rows.find((r) => r.id === '3')).toEqual({ id: '3', name: 'Globex secret', tenantId: 'globex' })
+  })
+
+  it('allows updating and deleting the caller\'s own rows', async () => {
+    const { client } = wire('acme')
+    const updated = await client.updateRow!('1', { name: 'Renamed' })
+    expect(updated.name).toBe('Renamed')
+    await expect(client.deleteRow!('2')).resolves.not.toThrow()
+  })
+
+  it('a patch cannot move a row into another tenant', async () => {
+    const { client, backend } = wire('acme')
+    await client.updateRow!('1', { tenantId: 'globex' } as Partial<Row>)
+    const { rows } = await backend.getRows(req())
+    expect(rows.find((r) => r.id === '1')!.tenantId).toBe('acme')
+  })
+})
+
+describe('row scoping: resolver failure', () => {
+  it('rejects rather than falling through to an unscoped query', async () => {
+    // The dangerous failure mode: "I cannot tell which tenant you are" must not
+    // mean "show everything".
+    const { client } = wire('acme', { throwOnResolve: true })
+    await expect(client.getRows(req())).rejects.toThrow()
+  })
+})

package/src/sveltekit/transport.ts

@@ -109,9 +109,29 @@ export type KitValidateContext<TData extends RowData> = {
   event: { request: Request; locals?: Record<string, unknown> }
 }
 
+/** A row-scoping rule: every row this caller may touch has `field === value`. */
+export type KitScope = { field: string; value: unknown }
+
 export type KitHandlerOptions<TData extends RowData> = {
   schema: EntitySchema<TData>
   source: ServerDataSource<TData>
+  /**
+   * Restrict every operation to rows matching one column - the mechanism behind
+   * multi-tenancy (`field: 'tenantId'`), and usable for any "you only see your
+   * own rows" rule.
+   *
+   * Enforced on all four paths, because scoping reads alone is not isolation:
+   * - **read**: the predicate is merged into the query's filter model;
+   * - **create**: the value is stamped onto the row, overriding whatever the
+   *   client sent;
+   * - **update / delete**: the target row is re-read under the scope first, and
+   *   the write is rejected with `403` if it isn't the caller's - otherwise
+   *   guessing an id would reach across tenants.
+   *
+   * Return `null` to apply no scope (e.g. a super-admin). Throwing rejects the
+   * request, which is the safer default when a tenant cannot be resolved.
+   */
+  scope?: (ctx: { event: { request: Request; locals?: Record<string, unknown> } }) => KitScope | null | Promise<KitScope | null>
   /**
    * Optional server-side guard run BEFORE every op. Return `false` (or throw) to
    * reject the request with `403`. Receives the SvelteKit event, so you can read
@@ -188,7 +208,7 @@ const actionOf = <TData extends RowData>(msg: KitMessage<TData>): KitAction =>
 export function createKitHandlers<TData extends RowData>(
   options: KitHandlerOptions<TData>,
 ): KitHandlers {
-  const { source, authorize, validate, audit, hooks } = options
+  const { source, authorize, validate, audit, hooks, scope } = options
   const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id'
   const rowId = (row: unknown): string | null => {
     const v = (row as Record<string, unknown> | null)?.[idField]
@@ -237,13 +257,62 @@ export function createKitHandlers<TData extends RowData>(
       }
     }
 
+    // Resolve the row scope once per request. A thrown resolver is a rejection,
+    // not a 500: "I can't tell which tenant you are" must not fall through to
+    // an unscoped query.
+    let activeScope: KitScope | null = null
+    if (scope) {
+      try {
+        activeScope = (await scope({ event: { request, locals: event?.locals } })) ?? null
+      } catch (err) {
+        return jsonResponse({ error: err instanceof Error ? err.message : 'forbidden' }, 403)
+      }
+    }
+    /** True when `id` exists AND belongs to the caller's scope. */
+    const ownsRow = async (id: string): Promise<boolean> => {
+      if (!activeScope) return true
+      const idField = options.schema.idField ?? options.schema.fields.find((f) => f.primaryKey)?.field ?? 'id'
+      const { rows } = await source.getRows({
+        startRow: 0,
+        endRow: 1,
+        pageIndex: 0,
+        pageSize: 1,
+        sortModel: [],
+        filterModel: {
+          columns: {
+            [idField]: { operator: 'equals' as const, value: id },
+            [activeScope.field]: { operator: 'equals' as const, value: String(activeScope.value) },
+          },
+        },
+      })
+      return rows.length > 0
+    }
+
     try {
       if (msg.kind === 'query') {
-        const result = await source.getRows(msg.request)
+        // Merge the scope into the requested filter. Written last so a client
+        // that sends its own `tenantId` filter cannot widen the scope.
+        const request = activeScope
+          ? {
+              ...msg.request,
+              filterModel: {
+                ...msg.request.filterModel,
+                columns: {
+                  ...(msg.request.filterModel?.columns ?? {}),
+                  [activeScope.field]: { operator: 'equals' as const, value: String(activeScope.value) },
+                },
+              },
+            }
+          : msg.request
+        const result = await source.getRows(request)
         return jsonResponse(result)
       }
       if (msg.kind === 'mutate') {
         const evt = { request, locals: event?.locals }
+        // Cross-tenant writes: reject before the source sees the id.
+        if (activeScope && (msg.op === 'update' || msg.op === 'delete')) {
+          if (!(await ownsRow(msg.id))) return jsonResponse({ error: 'forbidden' }, 403)
+        }
         // A `before*` hook throwing is a business-rule rejection -> 422 (not a 500).
         const runBefore = async <R>(fn: () => Promise<R>): Promise<R | Response> => {
           try { return await fn() } catch (err) { return jsonResponse({ error: err instanceof Error ? err.message : 'rejected' }, 422) }
@@ -256,6 +325,9 @@ export function createKitHandlers<TData extends RowData>(
             if (r instanceof Response) return r
             if (r) input = r as Partial<TData>
           }
+          // Stamp the scope LAST - after the before-hook - so neither the client
+          // nor a business rule can write a row into another tenant.
+          if (activeScope) input = { ...input, [activeScope.field]: activeScope.value } as Partial<TData>
           const row = await source.createRow(input)
           if (hooks?.afterCreate) await hooks.afterCreate({ row, event: evt })
           await fireAudit({ action: 'create', id: rowId(row), values: input, result: row, event: evt })
@@ -269,6 +341,8 @@ export function createKitHandlers<TData extends RowData>(
             if (r instanceof Response) return r
             if (r) patch = r as Partial<TData>
           }
+          // A patch must not be able to hand the row to another tenant.
+          if (activeScope) patch = { ...patch, [activeScope.field]: activeScope.value } as Partial<TData>
           const row = await source.updateRow(msg.id, patch)
           if (hooks?.afterUpdate) await hooks.afterUpdate({ id: msg.id, row, event: evt })
           await fireAudit({ action: 'update', id: msg.id, values: patch, result: row, event: evt })