@webda/grpc 4.0.0-beta.4 → 4.0.0-beta.6

package/.webda/cache

@@ -1,8 +1,8 @@
 {
-  "sourceDigest": "0d9cee0297e34e1d85dc2891c5ab77ee",
-  "moduleDigest": "7e3441f5c16d35b42aeebaa1b3832f2b",
+  "sourceDigest": "2434da489c662daa01eb691dba3180bf",
+  "moduleDigest": "f6610a7c821cec29a3cdef273083e886",
   "generator": {
-    "@webda/compiler": "4.0.0-beta.4",
-    "@webda/content-mapper": "4.0.0-beta.4"
+    "@webda/compiler": "4.0.0-beta.6",
+    "@webda/content-mapper": "4.0.0-beta.6"
   }
 }

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## [4.0.0-beta.6](https://github.com/loopingz/webda.io/compare/grpc-v4.0.0-beta.5...grpc-v4.0.0-beta.6) (2026-10-09)
+
+
+### ⚠ BREAKING CHANGES
+
+* **ql:** DELETE, UPDATE, SELECT, SET and WHERE are reserved uppercase keywords; Query.type is required; parse().toString() prints the canonical query instead of the source tokens; the root parse rule is now `(statement | filterQuery) EOF` for code walking the ANTLR tree.
+
+### Features
+
+* **ql:** WebdaQL DELETE/UPDATE/SELECT statements, bulk deleteMany/updateMany, filter-only Query operations ([#818](https://github.com/loopingz/webda.io/issues/818)) ([add9503](https://github.com/loopingz/webda.io/commit/add95031aff982cd69a635c519b4ddaa6874ecbe))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * devDependencies
+    * @webda/compiler bumped to 4.0.0-beta.6
+    * @webda/core bumped to 4.0.0-beta.6
+    * @webda/test bumped to 4.0.0-beta.6
+    * @webda/utils bumped to 4.0.0-beta.6
+  * peerDependencies
+    * @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.6
+
+## [4.0.0-beta.5](https://github.com/loopingz/webda.io/compare/grpc-v4.0.0-beta.4...grpc-v4.0.0-beta.5) (2026-10-08)
+
+
+### ⚠ BREAKING CHANGES
+
+* **core:** models defining canAct are now enforced on REST, gRPC and MCP operations; refused calls return 403. Query pages can be shorter than their LIMIT. OwnerModel ignores a client supplied _user. ResourceAcl.canAct signature changed to (context, action) and entries need a principal.
+
+### Bug Fixes
+
+* **core:** enforce model permissions on every transport, deny by default ([#810](https://github.com/loopingz/webda.io/issues/810)) ([24c1182](https://github.com/loopingz/webda.io/commit/24c11824f38999ef28ec7795c8af8d0ba862d9be))
+* **packaging:** point every package's repository at its monorepo folder ([#812](https://github.com/loopingz/webda.io/issues/812)) ([3717b73](https://github.com/loopingz/webda.io/commit/3717b73c7a7b91348057d84c8e64ecf840c75cb1))
+
+
+### Dependencies
+
+* The following workspace dependencies were updated
+  * dependencies
+    * @webda/workout bumped to 4.0.0-beta.5
+  * devDependencies
+    * @webda/compiler bumped to 4.0.0-beta.5
+    * @webda/core bumped to 4.0.0-beta.5
+    * @webda/test bumped to 4.0.0-beta.5
+    * @webda/utils bumped to 4.0.0-beta.5
+  * peerDependencies
+    * @webda/core bumped from ^4.0.0-beta.1 to ^4.0.0-beta.5
+
 ## [4.0.0-beta.4](https://github.com/loopingz/webda.io/compare/grpc-v4.0.0-beta.3...grpc-v4.0.0-beta.4) (2026-10-08)
 
 

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "@webda/grpc",
-  "version": "4.0.0-beta.4",
+  "version": "4.0.0-beta.6",
   "description": "gRPC transport for Webda.io — exposes operations as gRPC services",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/index.d.ts",
   "dependencies": {
     "@grpc/proto-loader": "^0.7.0",
-    "@webda/workout": "4.0.0-beta.3"
+    "@webda/workout": "4.0.0-beta.5"
   },
   "peerDependencies": {
     "@webda/core": "^4.0.0-beta.1"
@@ -16,10 +16,10 @@
     "@vitest/coverage-v8": "^4.1.2",
     "vite": "^6.0.0",
     "vitest": "^4.0.0",
-    "@webda/compiler": "^4.0.0-beta.4",
-    "@webda/core": "^4.0.0-beta.4",
-    "@webda/test": "^4.0.0-beta.3",
-    "@webda/utils": "^4.0.0-beta.4"
+    "@webda/core": "^4.0.0-beta.6",
+    "@webda/compiler": "^4.0.0-beta.6",
+    "@webda/test": "^4.0.0-beta.6",
+    "@webda/utils": "^4.0.0-beta.6"
   },
   "webda": {
     "namespace": "Webda",
@@ -30,7 +30,7 @@
   "license": "LGPL-3.0-only",
   "repository": {
     "type": "git",
-    "url": "https://github.com/loopingz/webda.io.git",
+    "url": "git+https://github.com/loopingz/webda.io.git",
     "directory": "packages/grpc"
   },
   "scripts": {

package/src/query-statements.spec.ts

@@ -0,0 +1,91 @@
+import { suite, test } from "@webda/test";
+import * as assert from "assert";
+import {
+  CoreModel,
+  DomainService,
+  DomainServiceParameters,
+  MemoryRepository,
+  registerOperation,
+  registerRepository,
+  registerSchema,
+  useApplication
+} from "@webda/core";
+import { WebdaApplicationTest } from "@webda/core/lib/test/application.js";
+import { GrpcService } from "./grpcservice.service.js";
+import { GrpcStatus } from "./grpc-stream.js";
+
+/**
+ * Model open to everyone, queried through a real DomainService operation
+ */
+class GrpcNote extends CoreModel {
+  title: string = "";
+  static canAct(): boolean {
+    return true;
+  }
+}
+GrpcNote.registerSerializer();
+
+/**
+ * The gRPC unary dispatch with the real core: a Query operation takes a filter only
+ */
+@suite
+class GrpcQueryStatementsTest extends WebdaApplicationTest {
+  /**
+   * @returns an application without any configured service
+   */
+  getTestConfiguration(): any {
+    return { services: {} };
+  }
+
+  /**
+   * Send one message through the gRPC unary handler
+   * @param query - the query field of the request
+   * @returns the response or the gRPC error status
+   */
+  async unary(query: string): Promise<{ response?: any; status?: number; message?: string }> {
+    const service: any = Object.create(GrpcService.prototype);
+    const result: { response?: any; status?: number; message?: string } = {};
+    const stream = {
+      onMessage: (callback: (message: any) => void) => callback({ query }),
+      sendUnary: (response: any) => (result.response = response),
+      sendError: (status: number, message: string) => {
+        result.status = status;
+        result.message = message;
+      }
+    };
+    await service.handleUnary(stream, "GrpcNotes.Query", {});
+    return result;
+  }
+
+  @test
+  async queryRpcTakesAFilterOnly() {
+    const schema = { type: "object", properties: { query: { type: "string" } } };
+    useApplication().getSchemas()["grpcSearchRequest"] = schema;
+    try {
+      registerSchema("grpcSearchRequest", schema);
+    } catch {
+      // already registered
+    }
+    this.registerService(new DomainService("GrpcDomain", new DomainServiceParameters().load({})));
+    registerRepository(GrpcNote, new MemoryRepository(GrpcNote, ["uuid"]));
+    await GrpcNote.create({ uuid: "n1", title: "keep" } as any);
+    registerOperation("GrpcNotes.Query", {
+      service: "GrpcDomain",
+      method: "modelQuery",
+      input: "grpcSearchRequest",
+      output: "void",
+      context: { model: GrpcNote }
+    } as any);
+    for (const query of ["DELETE", "DELETE WHERE uuid = 'n1'", "UPDATE SET title = 'pwned'", "SELECT title"]) {
+      const res = await this.unary(query);
+      assert.strictEqual(res.status, GrpcStatus.INVALID_ARGUMENT, `${query}: ${res.message}`);
+    }
+    assert.strictEqual(((await GrpcNote.ref("n1").get()) as any).title, "keep");
+    const ok = await this.unary("title = 'keep'");
+    assert.strictEqual(ok.status, undefined, ok.message);
+    assert.deepStrictEqual(
+      ok.response.results.map((n: any) => n.uuid),
+      ["n1"]
+    );
+  }
+}

package/webda.module.json

@@ -67,10 +67,6 @@
       "additionalProperties": false,
       "description": "Represent a file to store",
       "properties": {
-        "challenge": {
-          "description": "Will be computed by the service\n\nhash of the content prefixed by 'WEBDA'",
-          "type": "string"
-        },
         "hash": {
           "description": "Will be computed by the service\n\nhash of the content",
           "type": "string"