@web-ts-toolkit/access-router 0.34.2 → 0.35.0

package/README.md

@@ -32,6 +32,8 @@ import acl, { permissionsPlugin } from '@web-ts-toolkit/access-router';
 // 1. Configure how request permissions are resolved globally.
 acl.setGlobalOptions({
   requestPermissionField: '_permissions',
+  // Set to false only when legacy clients populate models without createRouter().
+  requireRegisteredPopulateModels: true,
   globalPermissions(req) {
     return req.headers.user === 'admin' ? ['isAdmin'] : [];
   },

package/advanced.d.mts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers-D9B9dS0p.mjs';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers--DZcTstL.mjs';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.d.ts

@@ -1,4 +1,4 @@
-export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers-D9B9dS0p.js';
+export { A as AccessRouterBaseRequest, a as AccessRouterFieldKey, b as AccessRouterLogger, c as AccessRouterRequest, d as AccessRouterRequestExtensions, e as AdvancedCreateBody, f as AdvancedListBody, g as AdvancedReadBody, h as AdvancedReadFilterBody, i as AdvancedUpdateBody, j as AdvancedUpsertBody, k as AfterPersistAccess, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, p as ArkTypeProblemLike, B as BaseFilterAccess, C as Change, q as Codes, r as CountBody, s as CreateArgs, t as CreateOptions, u as CreateQueryInput, v as CustomHeaders, D as DATA_MIDDLEWARE, w as DataBaseFilterHook, x as DataFilter, y as DataFindArgs, z as DataFindOneArgs, E as DataFindOneOptions, F as DataFindOptions, G as DataHook, H as DataHookContext, I as DataIdentifierHook, J as DataListHook, K as DataOverrideFilterHook, L as DataRequest, M as DataRequestSchemas, N as DataRouterOptions, O as DecorateAccess, P as DecorateAllAccess, Q as DeepFieldPath, R as DefaultModelRouterOptions, S as Defaults, T as DistinctArgs, U as DistinctBody, V as DocPermissionsAccess, W as ErrorResult, X as ExistsOptions, Y as ExtendedDataRouterOptions, Z as ExtendedDefaultModelRouterOptions, _ as ExtendedModelRouterOptions, $ as Filter, a0 as FilterOperator, a1 as FindAccess, a2 as FindArgs, a3 as FindByIdArgs, a4 as FindByIdOptions, a5 as FindOneArgs, a6 as FindOneOptions, a7 as FindOptions, a8 as GlobalOptions, a9 as GlobalPermissionValue, aa as GuardHook, ab as IdentifierHook, ac as Include, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, ai as KeyValueProjection, aj as ListQueryInput, ak as ListResult, al as MIDDLEWARE, am as MaybePromise, an as ModelBaseFilterHook, ao as ModelChangeHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, ar as ModelDocument, as as ModelDocumentHook, at as ModelHook, au as ModelHookContext, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, ay as ModelRequest, az as ModelRouterOptions, aA as ModelValidateHook, aB as PERMISSIONS, aC as PERMISSION_KEYS, aD as PathValue, aE as PermissionSchema, aF as Populate, aG as PopulateAccess, aH as PrepareAccess, aI as Projection, aJ as PublicCreateArgs, aK as PublicCreateOptions, aL as PublicErrorResult, aM as PublicListArgs, aN as PublicListOptions, aO as PublicListResult, aP as PublicOutput, aQ as PublicReadArgs, aR as PublicReadOptions, aS as PublicServiceResult, aT as PublicSingleResult, aU as PublicUpdateArgs, aV as PublicUpdateOptions, aW as PublicUpsertArgs, aX as PublicUpsertOptions, aY as ReadQueryInput, aZ as Request, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, b6 as RequestSchemas, b7 as RootDataListQueryEntry, b8 as RootDataOperation, b9 as RootDataReadByFilterQueryEntry, ba as RootDataReadByIdQueryEntry, bb as RootModelCountQueryEntry, bc as RootModelCreateQueryEntry, bd as RootModelDeleteQueryEntry, be as RootModelDistinctQueryEntry, bf as RootModelListQueryEntry, bg as RootModelNewQueryEntry, bh as RootModelOperation, bi as RootModelReadByFilterQueryEntry, bj as RootModelReadByIdQueryEntry, bk as RootModelSubBulkUpdateQueryEntry, bl as RootModelSubCreateQueryEntry, bm as RootModelSubDeleteQueryEntry, bn as RootModelSubListQueryEntry, bo as RootModelSubReadQueryEntry, bp as RootModelSubUpdateQueryEntry, bq as RootModelUpdateQueryEntry, br as RootModelUpsertQueryEntry, bs as RootOperationResult, bt as RootQueryEntry, bu as RootRouterOptions, bv as RootSubOperation, bw as RootTarget, bx as RouteGuardAccess, by as SelectAccess, bz as SelectedPopulatedPublicOutput, bA as SelectedPublicOutput, bB as ServiceResult, bC as SingleResult, bD as Sort, bE as SortOrder, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, bM as StatusCodes, bN as SubListBody, bO as SubPopulate, bP as SubQueryEntry, bQ as SubReadBody, bR as SubdocumentBulkRecord, bS as SubdocumentBulkUpdateInput, bT as SubdocumentCreateInput, bU as SubdocumentCreateOptions, bV as SubdocumentId, bW as SubdocumentListOptions, bX as SubdocumentName, bY as SubdocumentParentArgs, bZ as SubdocumentParentOptions, b_ as SubdocumentReadOptions, b$ as SubdocumentRecord, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, c2 as Task, c3 as TransformAccess, c4 as TypedFilter, c5 as UpdateByIdArgs, c6 as UpdateByIdOptions, c7 as UpdateOneArgs, c8 as UpdateOneOptions, c9 as UpdateQueryInput, ca as UpsertArgs, cb as UpsertOptions, cc as UpsertQueryInput, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, ch as ValidateAccess, ci as ValidateRule, cj as Validation, ck as ValidationError, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod, cB as parseBody, cC as parseBodyWithSchema, cD as parseNestedBodyWithSchema, cE as parsePathParam, cF as parseQuery } from './parsers--DZcTstL.js';
 import { z } from 'zod';
 import 'mongoose';
 import 'express';

package/advanced.js

@@ -755,6 +755,7 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
+      requireRegisteredPopulateModels: true,
       logger: defaultLogger,
       requestComplexity: defaultRequestComplexity
     }).build();

package/advanced.mjs

@@ -684,6 +684,7 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
+      requireRegisteredPopulateModels: true,
       logger: defaultLogger,
       requestComplexity: defaultRequestComplexity
     }).build();

package/index.d.mts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, cG as AccessRuntime, N as DataRouterOptions, L as DataRequest, cH as DataService, cI as Model, az as ModelRouterOptions, cJ as Service, cK as PublicService, _ as ExtendedModelRouterOptions, cj as Validation, bu as RootRouterOptions, cL as OpenApiRouterOptions, cM as OpenApiRegistryOptions, cN as OpenApiRouteDescriptor, cO as OpenApiDocumentOptions, cP as OpenApiParameter, cQ as OpenApiSchema, cR as OpenApiResponses, a8 as GlobalOptions, R as DefaultModelRouterOptions, Z as ExtendedDefaultModelRouterOptions } from './parsers-D9B9dS0p.mjs';
-export { cS as AccessRouterPermissionMap, cT as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cU as OpenApiMethod, cV as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cW as defaultRuntime, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers-D9B9dS0p.mjs';
+import { A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, cG as AccessRuntime, N as DataRouterOptions, L as DataRequest, cH as DataService, cI as Model, az as ModelRouterOptions, cJ as Service, cK as PublicService, _ as ExtendedModelRouterOptions, cj as Validation, bu as RootRouterOptions, cL as OpenApiRouterOptions, cM as OpenApiRegistryOptions, cN as OpenApiRouteDescriptor, cO as OpenApiDocumentOptions, cP as OpenApiParameter, cQ as OpenApiSchema, cR as OpenApiResponses, a8 as GlobalOptions, R as DefaultModelRouterOptions, Z as ExtendedDefaultModelRouterOptions } from './parsers--DZcTstL.mjs';
+export { cS as AccessRouterPermissionMap, cT as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cU as OpenApiMethod, cV as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cW as defaultRuntime, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers--DZcTstL.mjs';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 

package/index.d.ts

@@ -1,7 +1,7 @@
 import mongoose, { Schema } from 'mongoose';
 import { Response, NextFunction, RequestHandler, Router } from 'express';
-import { A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, cG as AccessRuntime, N as DataRouterOptions, L as DataRequest, cH as DataService, cI as Model, az as ModelRouterOptions, cJ as Service, cK as PublicService, _ as ExtendedModelRouterOptions, cj as Validation, bu as RootRouterOptions, cL as OpenApiRouterOptions, cM as OpenApiRegistryOptions, cN as OpenApiRouteDescriptor, cO as OpenApiDocumentOptions, cP as OpenApiParameter, cQ as OpenApiSchema, cR as OpenApiResponses, a8 as GlobalOptions, R as DefaultModelRouterOptions, Z as ExtendedDefaultModelRouterOptions } from './parsers-D9B9dS0p.js';
-export { cS as AccessRouterPermissionMap, cT as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cU as OpenApiMethod, cV as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cW as defaultRuntime, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers-D9B9dS0p.js';
+import { A as AccessRouterBaseRequest, aa as GuardHook, ay as ModelRequest, cG as AccessRuntime, N as DataRouterOptions, L as DataRequest, cH as DataService, cI as Model, az as ModelRouterOptions, cJ as Service, cK as PublicService, _ as ExtendedModelRouterOptions, cj as Validation, bu as RootRouterOptions, cL as OpenApiRouterOptions, cM as OpenApiRegistryOptions, cN as OpenApiRouteDescriptor, cO as OpenApiDocumentOptions, cP as OpenApiParameter, cQ as OpenApiSchema, cR as OpenApiResponses, a8 as GlobalOptions, R as DefaultModelRouterOptions, Z as ExtendedDefaultModelRouterOptions } from './parsers--DZcTstL.js';
+export { cS as AccessRouterPermissionMap, cT as AccessRouterPermissions, c as AccessRouterRequest, d as AccessRouterRequestExtensions, l as AjvErrorObjectLike, m as AjvValidatorLike, n as ArkTypeErrorsLike, o as ArkTypeLike, a9 as GlobalPermissionValue, ad as IoTsContextEntryLike, ae as IoTsDecodeErrorLike, af as IoTsDecoderLike, ag as JoiSchemaLike, ah as JoiValidationErrorDetailLike, am as MaybePromise, an as ModelBaseFilterHook, ap as ModelDeleteHook, aq as ModelDocPermissionsHook, as as ModelDocumentHook, at as ModelHook, av as ModelIdentifierHook, aw as ModelListHook, ax as ModelOverrideFilterHook, aA as ModelValidateHook, cU as OpenApiMethod, cV as Permissions, a_ as RequestSchemaAdapter, a$ as RequestSchemaFailure, b0 as RequestSchemaIssue, b1 as RequestSchemaLike, b2 as RequestSchemaOptions, b3 as RequestSchemaResult, b4 as RequestSchemaSuccess, b5 as RequestSchemaValidator, bF as StandardSchemaFailure, bG as StandardSchemaInferOutput, bH as StandardSchemaIssue, bI as StandardSchemaPathSegment, bJ as StandardSchemaResult, bK as StandardSchemaSuccess, bL as StandardSchemaV1, c0 as SuperstructFailureLike, c1 as SuperstructValidateLike, cd as ValibotIssueLike, ce as ValibotPathItemLike, cf as ValibotSafeParseLike, cg as ValibotSafeParseResult, cl as VineValidationErrorLike, cm as VineValidationMessageLike, cn as VineValidatorLike, co as YupSchemaLike, cp as YupValidationErrorLike, cW as defaultRuntime, cq as defineRequestSchema, cr as fromAjv, cs as fromArkType, ct as fromIoTs, cu as fromJoi, cv as fromStandardSchema, cw as fromSuperstruct, cx as fromValibot, cy as fromVine, cz as fromYup, cA as fromZod } from './parsers--DZcTstL.js';
 import JsonRouter from '@web-ts-toolkit/express-json-router';
 import 'zod';
 

package/index.js

@@ -958,6 +958,7 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
+      requireRegisteredPopulateModels: true,
       logger: defaultLogger,
       requestComplexity: defaultRequestComplexity
     }).build();
@@ -3866,7 +3867,7 @@ var Core = class {
           const refModelName = getModelRef(modelName, ret.path);
           if (!refModelName) return null;
           const runtime = getActiveRuntime();
-          if (runtime && !runtime.hasModel(refModelName)) {
+          if (getGlobalOption("requireRegisteredPopulateModels", true) && runtime && !runtime.hasModel(refModelName)) {
             return null;
           }
           const allowedTargetOperation = await this.req.macl.isAllowed(refModelName, populateAccess);

package/index.mjs

@@ -901,6 +901,7 @@ var AccessRuntime = class {
     this.globalOptions = new OptionsManager({
       requestPermissionField: "_permissions",
       globalPermissions: () => ({}),
+      requireRegisteredPopulateModels: true,
       logger: defaultLogger,
       requestComplexity: defaultRequestComplexity
     }).build();
@@ -3840,7 +3841,7 @@ var Core = class {
           const refModelName = getModelRef(modelName, ret.path);
           if (!refModelName) return null;
           const runtime = getActiveRuntime();
-          if (runtime && !runtime.hasModel(refModelName)) {
+          if (getGlobalOption("requireRegisteredPopulateModels", true) && runtime && !runtime.hasModel(refModelName)) {
             return null;
           }
           const allowedTargetOperation = await this.req.macl.isAllowed(refModelName, populateAccess);

package/package.json

@@ -2,7 +2,7 @@
   "name": "@web-ts-toolkit/access-router",
   "description": "ACL-aware Express routers and in-memory data services for Mongoose-backed APIs",
   "homepage": "https://web-ts-toolkit.pages.dev/docs/packages/access-router",
-  "version": "0.34.2",
+  "version": "0.35.0",
   "sideEffects": [
     "./**/index.js",
     "./**/index.mjs",
@@ -45,8 +45,8 @@
     "node": ">=22"
   },
   "dependencies": {
-    "@web-ts-toolkit/express-json-router": "0.34.2",
-    "@web-ts-toolkit/utils": "0.34.2",
+    "@web-ts-toolkit/express-json-router": "0.35.0",
+    "@web-ts-toolkit/utils": "0.35.0",
     "just-diff": "^6.0.2",
     "mongoose-schema-jsonschema": "^4.0.1",
     "sift": "^17.1.3",

package/{parsers-D9B9dS0p.d.mts → parsers--DZcTstL.d.mts}

@@ -1458,6 +1458,8 @@ interface AccessRouterLogger {
 interface GlobalOptions {
     requestPermissionField?: string;
     globalPermissions?: (this: AccessRouterRequest, req: AccessRouterRequest) => MaybePromise<GlobalPermissionValue>;
+    /** Require populate target models to be registered in the active runtime. Defaults to `true`. */
+    requireRegisteredPopulateModels?: boolean;
     logger?: AccessRouterLogger;
     requestComplexity?: RequestComplexityOptions;
 }

package/{parsers-D9B9dS0p.d.ts → parsers--DZcTstL.d.ts}

@@ -1458,6 +1458,8 @@ interface AccessRouterLogger {
 interface GlobalOptions {
     requestPermissionField?: string;
     globalPermissions?: (this: AccessRouterRequest, req: AccessRouterRequest) => MaybePromise<GlobalPermissionValue>;
+    /** Require populate target models to be registered in the active runtime. Defaults to `true`. */
+    requireRegisteredPopulateModels?: boolean;
     logger?: AccessRouterLogger;
     requestComplexity?: RequestComplexityOptions;
 }