bazis 0.96.6 → 0.97.0

package/cli/templates/module.ts

@@ -194,23 +194,24 @@ export class ${n.module}DbContext extends DbContext {
 }
 
 function serviceInterfaceFile(n: ModuleNaming): string {
-  return `import { createToken } from "bazis/core/di";
-import type { PageResult } from "bazis/core/orm";
+  return `import type { PageResult } from "bazis/core/orm";
 import type { ListQuery } from "bazis/library/jsonapi";
 import type { Create${n.entity}Request, Update${n.entity}Request } from "../http/contracts/${n.module}.requests";
 import type { ${n.entity}Response, ${n.module}Summary } from "../http/contracts/${n.module}.responses";
 
-export interface I${n.module}Service {
-  getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
-  summary(): Promise<${n.module}Summary>;
-  count(): Promise<number>;
-  getById(id: string): Promise<${n.entity}Response | null>;
-  create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
-  update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
-  delete(id: string): Promise<boolean>;
+/**
+ * Service contract. An abstract class, not an interface: it exists at runtime,
+ * so it is the DI token itself: \`scoped(I${n.module}Service, ${n.module}Service)\`.
+ */
+export abstract class I${n.module}Service {
+  abstract getAll(query: ListQuery): Promise<PageResult<${n.entity}Response>>;
+  abstract summary(): Promise<${n.module}Summary>;
+  abstract count(): Promise<number>;
+  abstract getById(id: string): Promise<${n.entity}Response | null>;
+  abstract create(body: Create${n.entity}Request): Promise<${n.entity}Response>;
+  abstract update(id: string, body: Update${n.entity}Request): Promise<${n.entity}Response | null>;
+  abstract delete(id: string): Promise<boolean>;
 }
-
-export const I${n.module}Service = createToken<I${n.module}Service>("I${n.module}Service");
 `;
 }
 

package/cli/templates/passport.ts

@@ -51,7 +51,7 @@ adapters that access it.
 | ${n.moduleClass} | [${n.module}.module.ts](${n.module}.module.ts) | host imports | ORM, DI, HTTP${profile === "full" ? ", background, AI" : ""} |
 | ${e} | [model/${m}.model.ts](model/${m}.model.ts) | Fields below | Table ${n.route} |
 | ${m}DbContext | [model/${m}.dbContext.ts](model/${m}.dbContext.ts) | Shared host ORM provider | DbSet ${n.collection} |
-| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [token](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
+| I${m}Service / ${m}Service | [services/${m}.service.ts](services/${m}.service.ts), [contract](services/I${m}.service.ts) | ${m}DbContext${profile === "full" ? ", ICache" : ""} | CRUD, count, summary |
 | ${m}Controller | [http/${m}.controller.ts](http/${m}.controller.ts) | I${m}Service, HTTP request | HTTP operations below |
 | Create${e}Request / Update${e}Request | [requests](http/contracts/${m}.requests.ts) | JSON body | RequestModel + Validator |
 | ${e}Response / ${m}Summary / to${e}Response | [responses](http/contracts/${m}.responses.ts) | ORM entity | Public data projection |

package/core/di/README.md

@@ -14,7 +14,7 @@ contracts are described in [MODULE.md](MODULE.md).
 - `ServiceCollection.ts`: service registration.
 - `ServiceScope.ts`: scoped resolve and scoped dispose.
 - `container.ts`: a compatible alias wrapper over `ServiceProvider`.
-- `token.ts`: DI tokens (`createToken`, open generic family).
+- `token.ts`: DI tokens: classes, abstract classes as service contracts, `createToken`, open generic family.
 
 ## Internals (do not use directly)
 

package/core/di/index.ts

@@ -75,6 +75,7 @@ export {
 export {
   createOpenGenericTokenFamily,
   createToken,
+  type AbstractClass,
   type Class,
   type InjectionToken,
   type OpenGenericTokenFamily,

package/core/di/token.ts

@@ -3,6 +3,14 @@
 // constructor deps is still validated by the container.
 export type Class<T> = new (...args: any[]) => T;
 
+/**
+ * A class usable only as a key: an abstract class declared as a contract
+ * (`export abstract class IClock { abstract now(): Date }`) and registered with
+ * `scoped(IClock, SystemClock)`. Unlike an interface it exists at runtime, so it
+ * needs no `createToken`. The container never constructs it.
+ */
+export type AbstractClass<T> = abstract new (...args: any[]) => T;
+
 export interface InjectionToken<T> {
   readonly id: symbol;
   readonly description: string;
@@ -18,7 +26,7 @@ export function createToken<T>(description: string): InjectionToken<T> {
   };
 }
 
-export type Token<T> = Class<T> | InjectionToken<T>;
+export type Token<T> = Class<T> | AbstractClass<T> | InjectionToken<T>;
 
 export interface OpenGenericTokenFamily<TArg, TResult> {
   readonly id: symbol;

package/core/http/Authorization/Authorize.ts

@@ -17,7 +17,8 @@ type ClassOrMethodDecorator = (
  * Protects a controller or a single action: the route gets the
  * {@link AuthorizeCheck} function. The HTTP kernel does not know *what* it
  * checks: JWT, login/password, Telegram sign-in and so on. Several checks
- * can be passed; all of them must pass.
+ * can be passed; all of them must pass. On a method of a protected controller
+ * the checks are added to the controller's ones: the class checks run first.
  *
  * ```ts
  * @Authorize(requireTokenKind(TokenKind.Admin))   // access token kind
@@ -40,7 +41,7 @@ export function Authorize(check: AuthorizeCheck, ...rest: AuthorizeCheck[]): Cla
   };
 }
 
-/** Public route: overrides `@Authorize` declared on the controller. */
+/** Public route: on a method, removes every check, including the controller's `@Authorize`. */
 export function AllowAnonymous(): ClassOrMethodDecorator {
   return (_value, context) => {
     if (context.kind === "class") {

package/core/http/Authorization/metadata.ts

@@ -122,15 +122,22 @@ export function setActionAllowAnonymous(metadata: object, methodName: string | s
   delete action.authorize;
 }
 
-/** Effective route requirement (the method overrides the controller). */
+/** Effective route requirement: the class and method checks combined. */
 export interface ResolvedAuthorizeMeta {
   readonly allowAnonymous: boolean;
   readonly authorize?: AuthorizeOptions;
 }
 
 /**
- * Resolves the authorization requirement of a specific action. Precedence:
- * `@AllowAnonymous`/`@Authorize` on the method override those declared on the class.
+ * Resolves the authorization requirement of a specific action:
+ *
+ * - `@AllowAnonymous` on the method opens it, whatever the class declares;
+ * - `@Authorize` on the class and on the method combine: the class checks run
+ *   first, then the method checks (a check repeated on both runs once);
+ * - `@AllowAnonymous` on the class opens the methods without their own `@Authorize`.
+ *
+ * Inheritance is different: a subclass's own class-level declaration replaces
+ * the base class's, and an overriding method's declaration replaces the base method's.
  */
 export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol): ResolvedAuthorizeMeta {
   const metadata = (ctor as { [key: symbol]: unknown })[Symbol.metadata as unknown as symbol] as
@@ -145,14 +152,13 @@ export function resolveAuthorizeMeta(ctor: object, methodName: string | symbol):
   if (action?.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (action?.authorize) {
-    return { allowAnonymous: false, authorize: action.authorize };
-  }
-  if (meta.allowAnonymous) {
+  const classChecks = meta.authorize?.checks ?? [];
+  const actionChecks = action?.authorize?.checks ?? [];
+  if (actionChecks.length === 0 && meta.allowAnonymous) {
     return { allowAnonymous: true };
   }
-  if (meta.authorize) {
-    return { allowAnonymous: false, authorize: meta.authorize };
-  }
-  return { allowAnonymous: false };
+  const checks = [...new Set([...classChecks, ...actionChecks])];
+  return checks.length === 0
+    ? { allowAnonymous: false }
+    : { allowAnonymous: false, authorize: { checks } };
 }

package/core/http/SPEC.md

@@ -804,8 +804,13 @@ Do not create a **new** middleware function per request, only at load/startup.
 `@Authorize(check, ...checks)` on a controller or a method compiles into the built-in
 authorization link [6]. A check is `(ctx) => boolean | Promise<boolean>`: `true` lets the
 request through, `false` gives `403`, and a thrown `HttpError` defines the response
-itself (for example `UnauthorizedError` → `401`). A method-level `@Authorize` or
-`@AllowAnonymous` overrides the controller's.
+itself (for example `UnauthorizedError` → `401`). Checks of the controller and of the
+method combine: the controller's run first, then the method's; a check repeated on both
+runs once. A method-level `@AllowAnonymous` removes every check, including the
+controller's. On an `@AllowAnonymous` controller only methods with their own
+`@Authorize` are protected. Inheritance replaces instead: a subclass's own class-level
+declaration replaces the base class's (since 0.97.0; before it a method-level
+`@Authorize` replaced the controller's checks).
 
 ```ts
 const isSignedIn: AuthorizeCheck = (ctx) => {

package/core/infra/connectors/codex/CodexAppServerClient.ts

@@ -232,7 +232,7 @@ export class CodexAppServerClient implements CodexClient {
         if (method === "account/updated") this.modelCache = undefined;
       }, () => { this.clearLogin(); this.modelCache = undefined; });
       const initialized = await client.request("initialize", {
-        clientInfo: { name: "bazis", title: "Bazis", version: "0.96.6" }, capabilities: { experimentalApi: true },
+        clientInfo: { name: "bazis", title: "Bazis", version: "0.97.0" }, capabilities: { experimentalApi: true },
       }, 15_000, signal);
       if (resolve(text(initialized.codexHome, 4096)) !== this.paths.home) throw new CodexError("PROTOCOL_ERROR");
       client.notify("initialized");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bazis",
-  "version": "0.96.6",
+  "version": "0.97.0",
   "description": "Modular backend framework for Bun in TypeScript: DI wired by codegen, HTTP, a PostgreSQL ORM, JWT, WebSocket, agents and a CLI.",
   "license": "MIT",
   "author": "Alexander Alenin",