alepha 0.19.1 → 0.19.2

package/src/orm/__tests__/organization-tests.ts

@@ -0,0 +1,200 @@
+import { type Alepha, t } from "alepha";
+import { currentUserAtom } from "alepha/security";
+import { expect } from "vitest";
+import { $entity, $repository, db } from "../core/index.ts";
+
+const entity = $entity({
+  name: "test_org_entity",
+  schema: t.object({
+    id: db.primaryKey(),
+    organization: db.organization(),
+    name: t.optional(t.text()),
+  }),
+});
+
+class App {
+  repository = $repository(entity);
+}
+
+const setup = async (alepha: Alepha) => {
+  const app = alepha.inject(App);
+  await alepha.start();
+  return { repository: app.repository, alepha };
+};
+
+export const testOrgUserSeesOwnAndGlobalRows = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  // Create rows for org-a, org-b, and global (null)
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+  await repository.create({
+    name: "org-b-row",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+  await repository.create({ name: "global-row" });
+
+  // User in org-a should see org-a + global
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  const results = await repository.findMany();
+  expect(results).toHaveLength(2);
+  expect(results.map((r: any) => r.name).sort()).toEqual([
+    "global-row",
+    "org-a-row",
+  ]);
+
+  // Count should also be filtered
+  expect(await repository.count()).toEqual(2);
+};
+
+export const testMasterUserSeesEverything = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+  await repository.create({
+    name: "org-b-row",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+  await repository.create({ name: "global-row" });
+
+  // Master user (no org) sees everything
+  app.store.set(currentUserAtom, {
+    id: "master-user",
+  });
+
+  const results = await repository.findMany();
+  expect(results).toHaveLength(3);
+  expect(await repository.count()).toEqual(3);
+};
+
+export const testNoUserSeesEverything = async (alepha: Alepha) => {
+  const { repository } = await setup(alepha);
+
+  await repository.create({
+    name: "org-a-row",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+  await repository.create({ name: "global-row" });
+
+  // No user in context = no filter
+  const results = await repository.findMany();
+  expect(results).toHaveLength(2);
+};
+
+export const testAutoStampOnCreate = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  // Create without specifying organization — should be auto-stamped
+  const entity = await repository.create({ name: "auto-stamped" });
+  expect(entity.organization).toEqual("a0000000-0000-0000-0000-000000000001");
+};
+
+export const testAutoStampNullForMasterUser = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  app.store.set(currentUserAtom, {
+    id: "master-user",
+  });
+
+  // Master user creates a row — org stays null (global)
+  const entity = await repository.create({ name: "master-row" });
+  expect(entity.organization).toBeUndefined();
+};
+
+export const testAutoStampDoesNotOverrideExplicit = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  // Explicitly set organization — should not be overridden
+  const entity = await repository.create({
+    name: "explicit-org",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+  expect(entity.organization).toEqual("b0000000-0000-0000-0000-000000000002");
+};
+
+export const testAutoStampOnCreateMany = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  const entities = await repository.createMany([
+    { name: "row-1" },
+    { name: "row-2" },
+  ]);
+  expect(entities[0].organization).toEqual(
+    "a0000000-0000-0000-0000-000000000001",
+  );
+  expect(entities[1].organization).toEqual(
+    "a0000000-0000-0000-0000-000000000001",
+  );
+};
+
+export const testOrgFilterOnUpdateOne = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  const row = await repository.create({
+    name: "org-b-row",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+
+  // User in org-a cannot update org-b row
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  const updated = await repository.updateMany(
+    { id: { eq: row.id } },
+    { name: "hacked" },
+  );
+  expect(updated).toHaveLength(0);
+
+  // Verify row is unchanged (read as master)
+  app.store.set(currentUserAtom, { id: "master" });
+  const check = await repository.getById(row.id);
+  expect(check.name).toEqual("org-b-row");
+};
+
+export const testOrgFilterOnDelete = async (alepha: Alepha) => {
+  const { repository, alepha: app } = await setup(alepha);
+
+  const row = await repository.create({
+    name: "org-b-row",
+    organization: "b0000000-0000-0000-0000-000000000002",
+  });
+
+  // User in org-a cannot delete org-b row
+  app.store.set(currentUserAtom, {
+    id: "user-1",
+    organization: "a0000000-0000-0000-0000-000000000001",
+  });
+
+  const deleted = await repository.deleteMany({ id: { eq: row.id } });
+  expect(deleted).toHaveLength(0);
+
+  // Verify row still exists
+  app.store.set(currentUserAtom, { id: "master" });
+  expect(await repository.count()).toEqual(1);
+};

package/src/orm/__tests__/organization.spec.ts

@@ -0,0 +1,103 @@
+import { Alepha } from "alepha";
+import { describe, it } from "vitest";
+import { AlephaOrmPostgres } from "../postgres/index.ts";
+import {
+  testAutoStampDoesNotOverrideExplicit,
+  testAutoStampNullForMasterUser,
+  testAutoStampOnCreate,
+  testAutoStampOnCreateMany,
+  testMasterUserSeesEverything,
+  testNoUserSeesEverything,
+  testOrgFilterOnDelete,
+  testOrgFilterOnUpdateOne,
+  testOrgUserSeesOwnAndGlobalRows,
+} from "./organization-tests.ts";
+
+describe("organization", () => {
+  it("org user sees own + global rows (sqlite)", async () => {
+    await testOrgUserSeesOwnAndGlobalRows(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("org user sees own + global rows (postgres)", async () => {
+    await testOrgUserSeesOwnAndGlobalRows(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
+
+  it("master user sees everything (sqlite)", async () => {
+    await testMasterUserSeesEverything(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("master user sees everything (postgres)", async () => {
+    await testMasterUserSeesEverything(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("no user sees everything (sqlite)", async () => {
+    await testNoUserSeesEverything(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("no user sees everything (postgres)", async () => {
+    await testNoUserSeesEverything(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("auto-stamps organization on create (sqlite)", async () => {
+    await testAutoStampOnCreate(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("auto-stamps organization on create (postgres)", async () => {
+    await testAutoStampOnCreate(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("auto-stamps null for master user (sqlite)", async () => {
+    await testAutoStampNullForMasterUser(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("auto-stamps null for master user (postgres)", async () => {
+    await testAutoStampNullForMasterUser(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
+
+  it("does not override explicit organization (sqlite)", async () => {
+    await testAutoStampDoesNotOverrideExplicit(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("does not override explicit organization (postgres)", async () => {
+    await testAutoStampDoesNotOverrideExplicit(
+      Alepha.create().with(AlephaOrmPostgres),
+    );
+  });
+
+  it("auto-stamps on createMany (sqlite)", async () => {
+    await testAutoStampOnCreateMany(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("auto-stamps on createMany (postgres)", async () => {
+    await testAutoStampOnCreateMany(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("org filter on updateMany (sqlite)", async () => {
+    await testOrgFilterOnUpdateOne(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("org filter on updateMany (postgres)", async () => {
+    await testOrgFilterOnUpdateOne(Alepha.create().with(AlephaOrmPostgres));
+  });
+
+  it("org filter on delete (sqlite)", async () => {
+    await testOrgFilterOnDelete(
+      Alepha.create({ env: { DATABASE_URL: "sqlite://:memory:" } }),
+    );
+  });
+  it("org filter on delete (postgres)", async () => {
+    await testOrgFilterOnDelete(Alepha.create().with(AlephaOrmPostgres));
+  });
+});

package/src/orm/core/{providers/drivers → __tests__}/BunSqliteProvider.bun.spec.ts

@@ -1,7 +1,10 @@
 import { afterEach, describe, expect, it } from "bun:test";
 import { Alepha, t } from "alepha";
-import { $entity, $repository, DatabaseProvider, db } from "../../index.ts";
-import { BunSqliteProvider, bunSqliteOptions } from "./BunSqliteProvider.ts";
+import { $entity, $repository, DatabaseProvider, db } from "../index.ts";
+import {
+  BunSqliteProvider,
+  bunSqliteOptions,
+} from "../providers/drivers/BunSqliteProvider.ts";
 
 // -------------------------------------------------------------------------------------------------------------------
 

package/src/orm/core/constants/PG_SYMBOLS.ts

@@ -15,6 +15,7 @@ export const PG_IDENTITY = Symbol.for("Alepha.Postgres.Identity");
 export const PG_ENUM = Symbol.for("Alepha.Postgres.Enum");
 export const PG_REF = Symbol.for("Alepha.Postgres.Ref");
 export const PG_GENERATED = Symbol.for("Alepha.Postgres.Generated");
+export const PG_ORGANIZATION = Symbol.for("Alepha.Postgres.Organization");
 
 /**
  * @deprecated Use `PG_IDENTITY` instead.
@@ -36,6 +37,7 @@ export type PgSymbols = {
   [PG_REF]: PgRefOptions;
   [PG_ENUM]: PgEnumOptions;
   [PG_GENERATED]: PgGeneratedOptions;
+  [PG_ORGANIZATION]: {};
 
   /**
    * @deprecated Use `PG_IDENTITY` instead.

package/src/orm/core/index.shared.ts

@@ -4,6 +4,7 @@ export {
   pageQuerySchema,
   pageSchema,
 } from "alepha";
+export { sql } from "drizzle-orm";
 export * from "./errors/DbColumnNotFoundError.ts";
 export * from "./errors/DbConnectionError.ts";
 export * from "./errors/DbDeadlockError.ts";

package/src/orm/core/primitives/$entity.ts

@@ -90,6 +90,37 @@ export interface EntityPrimitiveOptions<
          */
         where?: SQL;
       }
+    | {
+        /**
+         * SQL expressions for expression-based indexes.
+         *
+         * Can include column references and SQL functions like `LOWER()`, `UPPER()`, etc.
+         * Columns and expressions can be mixed together.
+         *
+         * @example
+         * ```ts
+         * // Case-insensitive unique username per realm
+         * indexes: [{
+         *   expressions: (self) => [self.realm, sql`LOWER(${self.username})`],
+         *   unique: true,
+         *   name: "users_realm_username_lower_idx",
+         * }]
+         * ```
+         */
+        expressions: (self: Record<Keys & string, any>) => (SQL | any)[];
+        /**
+         * Whether this should be a unique index (enforces uniqueness constraint).
+         */
+        unique?: boolean;
+        /**
+         * Custom name for the index. If not provided, generates name automatically.
+         */
+        name: string;
+        /**
+         * Partial index condition. Only rows matching this SQL expression are indexed.
+         */
+        where?: SQL;
+      }
   )[];
 
   /**

package/src/orm/core/providers/DatabaseTypeProvider.ts

@@ -22,6 +22,7 @@ import {
   PG_DELETED_AT,
   PG_ENUM,
   PG_IDENTITY,
+  PG_ORGANIZATION,
   PG_PRIMARY_KEY,
   PG_REF,
   PG_UPDATED_AT,
@@ -187,6 +188,16 @@ export class DatabaseTypeProvider {
   public readonly deletedAt = (options?: TStringOptions) =>
     pgAttr(t.optional(t.datetime(options)), PG_DELETED_AT);
 
+  /**
+   * Creates an organization column for multi-tenant row scoping.
+   *
+   * When present, queries are automatically filtered by the current user's organization.
+   * Rows with `null` organization are considered global and visible to everyone.
+   * On create, the column is auto-stamped with the current user's organization.
+   */
+  public readonly organization = () =>
+    pgAttr(t.optional(t.uuid()), PG_ORGANIZATION);
+
   /**
    * Creates a Postgres ENUM type.
    *

package/src/orm/core/providers/DrizzleKitProvider.ts

@@ -63,7 +63,7 @@ export class DrizzleKitProvider {
     }
 
     this.log.info(
-      `Sync with '${provider.name}' OK [${this.dateTime.nowMillis() - now}ms]`,
+      `Synchronization of '${provider.name}' OK [${this.dateTime.nowMillis() - now}ms]`,
     );
   }
 

package/src/orm/core/providers/drivers/BunSqliteProvider.ts

@@ -6,7 +6,7 @@ import {
   $env,
   $hook,
   $inject,
-  $use,
+  $state,
   AlephaError,
   type Static,
   t,
@@ -74,7 +74,7 @@ declare module "alepha" {
 export class BunSqliteProvider extends DatabaseProvider {
   protected readonly env = $env(envSchema);
   protected readonly builder = $inject(SqliteModelBuilder);
-  protected readonly options = $use(bunSqliteOptions);
+  protected readonly options = $state(bunSqliteOptions);
 
   protected sqlite?: Database;
   protected bunDb?: BunSQLiteDatabase;

package/src/orm/core/providers/drivers/NodeSqliteProvider.ts

@@ -7,7 +7,7 @@ import {
   $env,
   $hook,
   $inject,
-  $use,
+  $state,
   AlephaError,
   type Static,
   t,
@@ -81,7 +81,7 @@ declare module "alepha" {
 export class NodeSqliteProvider extends DatabaseProvider {
   protected readonly env = $env(envSchema);
   protected readonly builder = $inject(SqliteModelBuilder);
-  protected readonly options = $use(nodeSqliteOptions);
+  protected readonly options = $state(nodeSqliteOptions);
 
   protected sqlite!: DatabaseSync;
   protected drizzleDb!: any;
@@ -182,7 +182,7 @@ export class NodeSqliteProvider extends DatabaseProvider {
         await this.migrate();
       }
 
-      this.log.info(`SQLite database OK`, { at: filepath });
+      this.log.info(`Sqlite connection OK`, { at: filepath });
     },
   });
 

package/src/orm/core/services/ModelBuilder.ts

@@ -136,6 +136,17 @@ export abstract class ModelBuilder {
                 }
                 configs.push(idx);
               }
+            } else if ("expressions" in indexDef) {
+              const parts = indexDef.expressions(self as any);
+              if (parts.length > 0) {
+                let idx = indexDef.unique
+                  ? builders.uniqueIndex(indexDef.name).on(...parts)
+                  : builders.index(indexDef.name).on(...parts);
+                if ("where" in indexDef && indexDef.where) {
+                  idx = (idx as any).where(indexDef.where);
+                }
+                configs.push(idx);
+              }
             } else if ("columns" in indexDef) {
               const columnNames = indexDef.columns.map((col: any) =>
                 this.toColumnName(col as string),

package/src/orm/core/services/QueryManager.ts

@@ -338,11 +338,25 @@ export class QueryManager {
     }
 
     if (operator?.ilike != null) {
-      conditions.push(ilike(column, encodeValue(operator.ilike)));
+      if (dialect === "sqlite") {
+        // SQLite doesn't have ilike, use LOWER() for case-insensitive matching
+        conditions.push(
+          sql`LOWER(${column}) LIKE LOWER(${encodeValue(operator.ilike)})`,
+        );
+      } else {
+        conditions.push(ilike(column, encodeValue(operator.ilike)));
+      }
     }
 
     if (operator?.notIlike != null) {
-      conditions.push(notIlike(column, encodeValue(operator.notIlike)));
+      if (dialect === "sqlite") {
+        // SQLite doesn't have ilike, use LOWER() for case-insensitive matching
+        conditions.push(
+          sql`LOWER(${column}) NOT LIKE LOWER(${encodeValue(operator.notIlike)})`,
+        );
+      } else {
+        conditions.push(notIlike(column, encodeValue(operator.notIlike)));
+      }
     }
 
     if (operator?.contains != null) {

package/src/orm/core/services/Repository.ts

@@ -12,6 +12,7 @@ import {
 } from "alepha";
 import { type DateTime, DateTimeProvider } from "alepha/datetime";
 import { $logger } from "alepha/logger";
+import { currentUserAtom } from "alepha/security";
 import {
   asc,
   avg,
@@ -43,6 +44,7 @@ import type {
 import type { PgTransactionConfig } from "drizzle-orm/pg-core/session";
 import {
   PG_DELETED_AT,
+  PG_ORGANIZATION,
   PG_PRIMARY_KEY,
   PG_UPDATED_AT,
   PG_VERSION,
@@ -388,9 +390,8 @@ export abstract class Repository<T extends TObject> {
       );
     }
 
-    const where = this.withDeletedAt(
-      (query.where ?? {}) as PgQueryWhere<T>,
-      opts,
+    const where = this.withOrganization(
+      this.withDeletedAt((query.where ?? {}) as PgQueryWhere<T>, opts),
     );
 
     builder.where(() => this.toSQL(where, joins));
@@ -565,9 +566,8 @@ export abstract class Repository<T extends TObject> {
     );
 
     if (opts.count) {
-      const countWhere = this.withDeletedAt(
-        (query.where ?? {}) as PgQueryWhere<T>,
-        opts,
+      const countWhere = this.withOrganization(
+        this.withDeletedAt((query.where ?? {}) as PgQueryWhere<T>, opts),
       );
 
       tasks.push(
@@ -662,6 +662,7 @@ export abstract class Repository<T extends TObject> {
     opts: StatementOptions = {},
   ): Promise<Static<T>> {
     this.assertWritable();
+    this.stampOrganization(data);
     await this.alepha.events.emit("repository:create:before", {
       tableName: this.tableName,
       data,
@@ -705,6 +706,10 @@ export abstract class Repository<T extends TObject> {
       return [];
     }
 
+    for (const value of values) {
+      this.stampOrganization(value);
+    }
+
     await this.alepha.events.emit("repository:create:before", {
       tableName: this.tableName,
       data: values,
@@ -774,6 +779,7 @@ export abstract class Repository<T extends TObject> {
     } = {},
   ): Promise<Static<T>> {
     this.assertWritable();
+    this.stampOrganization(data);
     await this.alepha.events.emit("repository:create:before", {
       tableName: this.tableName,
       data,
@@ -862,7 +868,7 @@ export abstract class Repository<T extends TObject> {
         opts.now ?? this.dateTimeProvider.nowISOString();
     }
 
-    where = this.withDeletedAt(where, opts);
+    where = this.withOrganization(this.withDeletedAt(where, opts));
     row = this.cast(row, false) as any;
 
     // do not update the ID field
@@ -1025,7 +1031,7 @@ export abstract class Repository<T extends TObject> {
         opts.now ?? this.dateTimeProvider.nowISOString();
     }
 
-    where = this.withDeletedAt(where, opts);
+    where = this.withOrganization(this.withDeletedAt(where, opts));
     data = this.cast(data, false) as any;
     try {
       const entities = await this.rawUpdate(opts)
@@ -1070,6 +1076,8 @@ export abstract class Repository<T extends TObject> {
       );
     }
 
+    where = this.withOrganization(where);
+
     await this.alepha.events.emit("repository:delete:before", {
       tableName: this.tableName,
       where,
@@ -1170,7 +1178,7 @@ export abstract class Repository<T extends TObject> {
     where: PgQueryWhereOrSQL<T> = {},
     opts: StatementOptions = {},
   ): Promise<number> {
-    where = this.withDeletedAt(where, opts);
+    where = this.withOrganization(this.withDeletedAt(where, opts));
     const db = opts.tx === null ? this.provider.db : (opts.tx ?? this.db);
     return db.$count(this.table, this.toSQL(where));
   }
@@ -1234,7 +1242,9 @@ export abstract class Repository<T extends TObject> {
 
     // WHERE
     if (query.where) {
-      const where = this.withDeletedAt(query.where as any, opts);
+      const where = this.withOrganization(
+        this.withDeletedAt(query.where as any, opts),
+      );
       builder = builder.where(this.toSQL(where)) as any;
     }
 
@@ -1458,6 +1468,56 @@ export abstract class Repository<T extends TObject> {
     return undefined;
   }
 
+  protected withOrganization(
+    where: PgQueryWhereOrSQL<T>,
+  ): PgQueryWhereOrSQL<T> {
+    const orgField = this.organizationField();
+    if (!orgField) {
+      return where;
+    }
+
+    const user = this.alepha.store.get(currentUserAtom);
+    if (!user?.organization) {
+      return where;
+    }
+
+    return {
+      and: [
+        where,
+        {
+          or: [
+            { [orgField.key]: { eq: user.organization } },
+            { [orgField.key]: { isNull: true } },
+          ],
+        } as any,
+      ],
+    } as PgQueryWhereOrSQL<T>;
+  }
+
+  protected stampOrganization(data: any): void {
+    const orgField = this.organizationField();
+    if (!orgField) {
+      return;
+    }
+
+    if (data[orgField.key] != null) {
+      return;
+    }
+
+    const user = this.alepha.store.get(currentUserAtom);
+    if (user?.organization) {
+      data[orgField.key] = user.organization;
+    }
+  }
+
+  protected organizationField(): PgAttrField | undefined {
+    const fields = getAttrFields(this.entity.schema, PG_ORGANIZATION);
+    if (fields.length > 0) {
+      return fields[0];
+    }
+    return undefined;
+  }
+
   /**
    * Convert something to valid Pg Insert Value.
    */

package/src/orm/postgres/{providers → __tests__}/BunPostgresProvider.bun.spec.ts

@@ -1,7 +1,7 @@
 import { afterEach, describe, expect, it } from "bun:test";
 import { Alepha, t } from "alepha";
 import { $entity, $repository, DatabaseProvider, db } from "alepha/orm";
-import { BunPostgresProvider } from "./BunPostgresProvider.ts";
+import { BunPostgresProvider } from "../providers/BunPostgresProvider.ts";
 
 // -------------------------------------------------------------------------------------------------------------------