bunderstack 0.4.0 → 0.5.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "bunderstack",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Batteries-included backend framework for Bun: CRUD APIs, auth, file storage, realtime, tRPC, email, and validated env from a single Drizzle schema and config object.",
   "keywords": [
     "backend",

package/src/access.ts

@@ -75,7 +75,10 @@ export type TableAccessInput = {
   sortableColumns?: string[]
   /** Default list ordering when `?sort` is omitted. Defaults to `{ column: 'id', order: 'desc' }`. */
   defaultSort?: DefaultSort
-  scope?: ScopeResolver
+  scope?: {
+    read?: ScopeResolver
+    write?: ScopeResolver
+  }
 }
 
 export type ResolvedTableAccess = {
@@ -94,7 +97,8 @@ export type ResolvedTableAccess = {
   filterableColumns: string[]
   sortableColumns: string[]
   defaultSort: DefaultSort
-  scope?: ScopeResolver
+  readScope?: ScopeResolver
+  writeScope?: ScopeResolver
 }
 
 export type ResolvedAccess = Map<string, ResolvedTableAccess>
@@ -200,7 +204,8 @@ function resolveDefaults(
       ...(ownerColumn ? [ownerColumn] : []),
     ],
     searchableColumns: input.searchableColumns,
-    scope: input.scope,
+    readScope: input.scope?.read,
+    writeScope: input.scope?.write,
     ...listAccess,
   }
 }
@@ -306,7 +311,7 @@ export function validateAndResolveAccess<
       columns.includes('userId')
 
     if (!hasExplicitRules && !hasConventionOwner) continue
-    if (!ownerColumn && input?.crud !== true && !input?.scope) continue
+    if (!ownerColumn && input?.crud !== true && !input?.scope?.read && !input?.scope?.write) continue
 
     if (input?.ownerColumn && !columns.includes(input.ownerColumn)) {
       throw new Error(

package/src/crud.ts

@@ -16,6 +16,8 @@ import {
   type ResolvedAccess,
   type ResolvedTableAccess,
   type ScopeMap,
+  type ScopeResolver,
+  type AccessContext,
 } from './access'
 import { ErrorCode, apiError, ListQueryError } from './errors'
 import {
@@ -68,14 +70,9 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
   const idempotency = resolveIdempotencyConfig(options.idempotency)
 
   const scopeFor = (
-    tableAccess: ResolvedTableAccess,
-    ctx: {
-      user: AccessUser | null
-      session: { activeOrganizationId: string | null } | null
-      request: Request
-    },
-  ): ScopeMap | undefined =>
-    tableAccess.scope ? tableAccess.scope({ ...ctx }) : undefined
+    resolver: ScopeResolver | undefined,
+    ctx: AccessContext,
+  ): ScopeMap | undefined => (resolver ? resolver(ctx) : undefined)
 
   for (const table of Object.values(schema)) {
     if (!isTable(table)) continue
@@ -109,7 +106,7 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
 
       try {
         const params = parseListParams(new URL(c.req.url), tableAccess)
-        const scope = scopeFor(tableAccess, {
+        const scope = scopeFor(tableAccess.readScope, {
           user,
           session,
           request: c.req.raw,
@@ -164,7 +161,7 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
         )
       }
 
-      const scope = scopeFor(tableAccess, { user, session, request: c.req.raw })
+      const scope = scopeFor(tableAccess.readScope, { user, session, request: c.req.raw })
       if (
         scope &&
         !rowMatchesScope(rows[0] as Record<string, unknown>, scope)
@@ -241,7 +238,7 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
         user?.id ?? null,
       )
 
-      const scope = scopeFor(tableAccess, { user, session, request: c.req.raw })
+      const scope = scopeFor(tableAccess.writeScope, { user, session, request: c.req.raw, body: body as Record<string, unknown> })
       const stamped = scope ? stampScope(values, scope) : values
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const rows = await (db as any).insert(table).values(stamped).returning()
@@ -280,10 +277,10 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
         return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
       }
 
-      const scope = scopeFor(tableAccess, { user, session, request: c.req.raw })
+      const readScope = scopeFor(tableAccess.readScope, { user, session, request: c.req.raw })
       if (
-        scope &&
-        !rowMatchesScope(existing[0] as Record<string, unknown>, scope)
+        readScope &&
+        !rowMatchesScope(existing[0] as Record<string, unknown>, readScope)
       ) {
         return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
       }
@@ -320,10 +317,13 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
         user?.id ?? null,
       )
 
+      const writeScope = scopeFor(tableAccess.writeScope, { user, session, request: c.req.raw, body: body as Record<string, unknown> })
+      const stamped = writeScope ? stampScope(values, writeScope) : values
+
       // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const rows = await (db as any)
         .update(table)
-        .set(values)
+        .set(stamped)
         .where(eq(idCol as any, id))
         .returning()
       if (!rows[0]) {
@@ -350,7 +350,7 @@ export function buildCrudRouter<TSchema extends Record<string, unknown>>(
         return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
       }
 
-      const scope = scopeFor(tableAccess, { user, session, request: c.req.raw })
+      const scope = scopeFor(tableAccess.readScope, { user, session, request: c.req.raw })
       if (
         scope &&
         !rowMatchesScope(existing[0] as Record<string, unknown>, scope)

package/src/realtime/index.ts

@@ -84,8 +84,8 @@ function scopeOk(
   ctx: Parameters<typeof checkAccessSync>[1],
   record: Record<string, unknown>,
 ): boolean {
-  if (!entry.scope) return true
-  return rowMatchesScope(record, entry.scope(ctx))
+  if (!entry.readScope) return true
+  return rowMatchesScope(record, entry.readScope(ctx))
 }
 
 export function buildRealtimeRouter(

package/src/realtime/redis.ts

@@ -117,7 +117,7 @@ export function createRedisRealtimeBroker(opts: {
     if (typeof entry.get === 'function') return false
     if (!checkAccessSync(entry.get, ctx, entry.ownerColumn).allowed)
       return false
-    if (entry.scope && !rowMatchesScope(record, entry.scope(ctx))) return false
+    if (entry.readScope && !rowMatchesScope(record, entry.readScope(ctx))) return false
     return true
   }
 

package/src/storage/buckets.ts

@@ -25,7 +25,10 @@ export type BucketConfigInput = {
   }
   upload?: { maxSize?: string | number; accept?: string[] }
   transforms?: boolean
-  scope?: ScopeResolver
+  scope?: {
+    read?: ScopeResolver
+    write?: ScopeResolver
+  }
   quota?: { perUser?: string | number; perScope?: string | number }
 } & Partial<BucketBackendInput>
 
@@ -59,7 +62,8 @@ export type ResolvedBucket = {
   access: { create: OperationRule; get: OperationRule; delete: OperationRule }
   upload?: { maxSizeBytes?: number; accept?: string[] }
   transforms: boolean
-  scope?: ScopeResolver
+  readScope?: ScopeResolver
+  writeScope?: ScopeResolver
   quota?: { perUserBytes?: number; perScopeBytes?: number }
 }
 
@@ -248,7 +252,8 @@ function resolveSingleBucket(
     access,
     upload,
     transforms: input.transforms ?? false,
-    scope: input.scope,
+    readScope: input.scope?.read,
+    writeScope: input.scope?.write,
     quota,
   }
 }

package/src/storage/router.ts

@@ -165,7 +165,7 @@ export function buildBucketStorageRouter(
     const contentType =
       typeof body.contentType === 'string' ? body.contentType : undefined
 
-    const requesterScope = bucket.scope?.(ctx)
+    const requesterScope = bucket.writeScope?.(ctx)
     const scopeJson = scopeToJson(requesterScope)
 
     // Quota pre-check: reserve the configured max upload size.
@@ -252,7 +252,7 @@ export function buildBucketStorageRouter(
       return apiError(c, ErrorCode.VALIDATION_ERROR, 'File too large', 422)
     }
 
-    const requesterScope = bucket.scope?.(ctx)
+    const requesterScope = bucket.readScope?.(ctx)
     const scopeJson = scopeToJson(requesterScope)
 
     if (bucket.quota) {
@@ -395,7 +395,7 @@ export function buildBucketStorageRouter(
     const denied = await gate(bucket.access.get, ctx, c)
     if (denied) return denied
 
-    const requesterScope = bucket.scope?.(ctx)
+    const requesterScope = bucket.readScope?.(ctx)
     if (!fileMatchesScope(row, requesterScope)) {
       return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
     }
@@ -491,7 +491,7 @@ export function buildBucketStorageRouter(
     const denied = await gate(bucket.access.delete, ctx, c)
     if (denied) return denied
 
-    const requesterScope = bucket.scope?.(ctx)
+    const requesterScope = bucket.readScope?.(ctx)
     if (!fileMatchesScope(row, requesterScope)) {
       return apiError(c, ErrorCode.NOT_FOUND, 'Not found', 404)
     }