@vsaas/loopback 12.2.5 → 12.3.1

package/dist/lib/application.cjs

@@ -253,6 +253,21 @@ var require_application = /* @__PURE__ */ require_runtime.__commonJSMin(((export
 	*/
 	app.dataSources = app.datasources = {};
 	/**
+	* Decide whether the caller of a remote invocation is authenticated.
+	*
+	* An ACL denial for an authenticated caller uses `aclErrorStatus`; an
+	* anonymous caller is always denied with 401. By default only a LoopBack
+	* access token authenticates. Applications that authenticate callers by other
+	* means (API keys, device tokens, server keys) override this method so their
+	* denials are reported as the configured status instead of 401.
+	*
+	* @param {Object} ctx The remoting context.
+	* @returns {boolean}
+	*/
+	app.isRequestAuthenticated = function(ctx) {
+		return Boolean(ctx.req && ctx.req.accessToken);
+	};
+	/**
 	* Enable app wide authentication.
 	*/
 	app.enableAuth = function(options) {
@@ -291,7 +306,7 @@ var require_application = /* @__PURE__ */ require_runtime.__commonJSMin(((export
 			const modelId = modelInstance && modelInstance.id || (req.params && req.params.id !== void 0 ? req.params.id : req.body && req.body.id !== void 0 ? req.body.id : req.query && req.query.id !== void 0 ? req.query.id : void 0);
 			const modelName = Model.modelName;
 			let errStatusCode = (Model.settings || {}).aclErrorStatus || app.get("aclErrorStatus") || 401;
-			if (!req.accessToken) errStatusCode = 401;
+			if (!app.isRequestAuthenticated(ctx)) errStatusCode = 401;
 			if (Model.checkAccess) utils.invokeWithCallback(Model.checkAccess, Model, [
 				req.accessToken,
 				modelId,

package/dist/package.cjs

@@ -2,7 +2,7 @@
 var require_package = /* @__PURE__ */ require("./_virtual/_rolldown/runtime.cjs").__commonJSMin(((exports, module) => {
 	module.exports = {
 		"name": "@vsaas/loopback",
-		"version": "12.2.5",
+		"version": "12.3.1",
 		"description": "Fork of LoopBack 3 framework for building APIs and microservices in Node.js",
 		"keywords": [
 			"StrongLoop",
@@ -117,7 +117,7 @@ var require_package = /* @__PURE__ */ require("./_virtual/_rolldown/runtime.cjs"
 			"express": "catalog:",
 			"isemail": "^3.2.0",
 			"loopback-filters": "^1.1.1",
-			"nodemailer": "^9.0.5",
+			"nodemailer": "catalog:",
 			"otplib": "catalog:",
 			"serve-favicon": "^2.5.1"
 		},

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vsaas/loopback",
-  "version": "12.2.5",
+  "version": "12.3.1",
   "description": "Fork of LoopBack 3 framework for building APIs and microservices in Node.js",
   "keywords": [
     "StrongLoop",
@@ -98,15 +98,15 @@
     "debug": "^2.6.9",
     "depd": "^1.1.2",
     "ejs": "5.0.1",
-    "express": "4.22.2",
+    "express": "4.22.3",
     "isemail": "^3.2.0",
     "loopback-filters": "^1.1.1",
-    "nodemailer": "^9.0.5",
+    "nodemailer": "^9.1.1",
     "otplib": "13.4.1",
     "serve-favicon": "^2.5.1",
-    "@vsaas/loopback-connector-remote": "^12.0.2",
-    "@vsaas/remoting": "^13.0.1",
-    "@vsaas/loopback-datasource-juggler": "^13.0.1"
+    "@vsaas/remoting": "^13.0.2",
+    "@vsaas/loopback-datasource-juggler": "^13.0.3",
+    "@vsaas/loopback-connector-remote": "^12.0.2"
   },
   "devDependencies": {
     "@types/node": "25.5.0",
@@ -124,8 +124,8 @@
     "tsdown": "0.22.14",
     "typescript": "6.0.2",
     "vitest": "4.1.11",
-    "@vsaas/error-handler": "^12.0.1",
-    "@vsaas/loopback-boot": "^12.0.2"
+    "@vsaas/loopback-boot": "^12.0.2",
+    "@vsaas/error-handler": "^12.0.1"
   },
   "engines": {
     "node": ">=24"