@voltro/plugin-rbac 0.81.0 → 0.82.0

package/dist/index.d.ts

@@ -54,7 +54,7 @@ export declare const compileRoles: (roleSlugs: ReadonlyArray<string>, roleMap: R
  * tenant-aware role assignments Just Work). Drop into
  * `rbacPlugin({ resolveRoles: dataStoreRoleResolver(userRoleStore(ds)) })`.
  */
-export declare const dataStoreRoleResolver: (store: UserRoleStore) => RoleResolver;
+export declare const dataStoreRoleResolver: (store?: UserRoleStore) => RoleResolver;
 
 /**
  * Compile a subject's roles + raw permissions into one resolved scope
@@ -260,9 +260,20 @@ export declare type RoleMap = Readonly<Record<string, ReadonlyArray<string>>>;
  * A resolver that yields the role slugs a subject holds. The default
  * reads `subject.metadata.roles` (a `string[]`) when present; a project
  * that assigns roles at runtime supplies its own (e.g. a DB lookup
- * filtered by `subject.tenantId`).
+ * filtered by `subject.tenantId`, reading `context.store`).
  */
-export declare type RoleResolver = (subject: Subject) => ReadonlyArray<string> | Promise<ReadonlyArray<string>>;
+export declare type RoleResolver = (subject: Subject, context?: RoleResolverContext) => ReadonlyArray<string> | Promise<ReadonlyArray<string>>;
+
+/** What a {@link RoleResolver} is handed beside the subject. */
+export declare interface RoleResolverContext {
+    /**
+     * The app's store, bound at boot (`bindDataStore`). `app.config.ts` is
+     * evaluated before any store exists, so a resolver that reads assignments
+     * takes it from here rather than closing over one. `undefined` only before
+     * boot has bound it.
+     */
+    readonly store?: UserRoleDataStore;
+}
 
 export declare const ROLES_TABLE = "_voltro_rbac_roles";
 

package/dist/index.js

@@ -10,12 +10,12 @@ var j = "_voltro_rbac_roles", M = "_voltro_rbac_user_roles", N = k(j, {
 	name: A(),
 	permissions: T(),
 	isDefault: S().default(!1)
-}).index("byRolesSlug", ["slug"]), P = (e = {}) => k(M, {
+}).index("_voltro_rbac_roles_by_slug", ["slug"]), P = (e = {}) => k(M, {
 	id: w({ prefix: "urole" }),
 	userId: A(),
 	tenantId: e.multitenant ? D(O(), { index: !1 }).nullable() : A().nullable(),
 	roleSlug: A()
-}).index("byUserTenant", ["userId", "tenantId"]).index("byRoleSlug", ["roleSlug"]), F = P(), I = (e = {}) => [N, P(e)], L = (e, t) => e.query({
+}).index("_voltro_rbac_user_roles_by_user_tenant", ["userId", "tenantId"]).index("_voltro_rbac_user_roles_by_role_slug", ["roleSlug"]), F = P(), I = (e = {}) => [N, P(e)], L = (e, t) => e.query({
 	table: M,
 	predicate: t,
 	order: [{
@@ -44,9 +44,11 @@ var j = "_voltro_rbac_roles", M = "_voltro_rbac_user_roles", N = k(j, {
 			return [...new Set(r)];
 		}
 	};
-}, z = (e) => e === null ? C("tenantId", null) : E(C("tenantId", e), C("tenantId", null)), B = (e) => (t) => {
-	let n = ("tenantId" in t ? t.tenantId : void 0) ?? null, r = ("id" in t ? t.id : void 0) ?? null;
-	return r ? e.rolesOf(r, n) : [];
+}, z = (e) => e === null ? C("tenantId", null) : E(C("tenantId", e), C("tenantId", null)), B = (e) => (t, n) => {
+	let r = ("tenantId" in t ? t.tenantId : void 0) ?? null, i = ("id" in t ? t.id : void 0) ?? null;
+	if (!i) return [];
+	let a = e ?? (n?.store === void 0 ? void 0 : R(n.store));
+	return a === void 0 ? [] : a.rolesOf(i, r);
 }, V = b({ scope: "@voltro/plugin-rbac" }), H = (e) => p.suspend(() => {
 	let t = e();
 	return t instanceof Promise ? p.promise(() => t) : p.succeed(t);
@@ -63,33 +65,36 @@ var j = "_voltro_rbac_roles", M = "_voltro_rbac_user_roles", N = k(j, {
 			cause: String(e)
 		}), p.succeed(!1)))));
 	}
-	let u = (n, r) => p.gen(function* () {
-		let s = yield* H(() => i(r.subject)).pipe(p.catchAllCause((e) => (V.warn("resolveRoles failed; falling back to raw subject scopes", {
+	let u, d = (n, r) => p.gen(function* () {
+		let s = yield* H(() => i(r.subject, { ...u === void 0 ? {} : { store: u } })).pipe(p.catchAllCause((e) => (V.warn("resolveRoles failed; falling back to raw subject scopes", {
 			tag: r.tag,
 			traceId: r.traceId,
 			cause: String(e)
 		}), p.succeed([])))), c = o ? yield* H(() => o(r.subject)).pipe(p.catchAllCause(() => p.succeed([]))) : [], l = e(r.subject, s, t.roles, c);
 		return a(r.subject, l, s), yield* n;
-	}), d = [
+	}), f = [
 		"rpc:intercept:mutation",
 		"rpc:intercept:query",
 		"rpc:intercept:action",
 		"rpc:intercept:workflow",
 		...c ? ["store:write"] : []
-	], f = o === void 0 ? r(t.roles) : void 0;
+	], h = o === void 0 ? r(t.roles) : void 0;
 	return _({
 		name: v({
 			base: U,
 			alias: t.alias
 		}),
 		baseName: U,
-		...f === void 0 ? {} : { declaredScopes: f },
+		...h === void 0 ? {} : { declaredScopes: h },
 		description: "Role-based access control — roles compile to scopes on top of the protocol scope system. Ships the permission() handler guard + a role→scope interceptor + a resource-aware guard resolver, failing with protocol's typed ScopeError (one denial tag framework-wide).",
-		permissions: d,
-		interceptMutation: u,
-		interceptQuery: u,
-		interceptAction: u,
-		interceptWorkflow: u,
+		permissions: f,
+		bindDataStore: (e) => {
+			u = e;
+		},
+		interceptMutation: d,
+		interceptQuery: d,
+		interceptAction: d,
+		interceptWorkflow: d,
 		errorSchemas: [{
 			schema: g,
 			import: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voltro/plugin-rbac",
-  "version": "0.81.0",
+  "version": "0.82.0",
   "description": "Role-based access control — roles compile to scopes on top of @voltro/protocol's scope system. Ships rbacPlugin() (role→scope interceptor + resource-aware guard resolver, failing with protocol's typed ScopeError), the permission()/assertPermission()/anyPermission() handler guards, the compileRoles() pure compiler, cross-dialect roles + userRoles tables. The UI gate lives in @voltro/client (useCan / useCanAny) — scopes are a framework concept, so gating a button must not require this plugin.",
   "keywords": [
     "voltro",
@@ -33,9 +33,9 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@voltro/database": "0.81.0",
-    "@voltro/logger": "0.81.0",
-    "@voltro/protocol": "0.81.0"
+    "@voltro/database": "0.82.0",
+    "@voltro/logger": "0.82.0",
+    "@voltro/protocol": "0.82.0"
   },
   "peerDependencies": {
     "effect": "^3.22.2",