cabloy 5.1.240 → 5.1.241

package/vona/src/suite/a-home/modules/home-user/test/account.test.ts

@@ -34,19 +34,22 @@ describe('account.test.ts', { concurrency: false }, () => {
             innerAccess: false,
           });
           assert.equal(current.name, fixture!.name);
+          assert.equal(current.displayName, undefined);
           assert.equal(current.hasSimpleAuth, true);
           assert.equal(current.canSendSetPasswordLink, false);
 
           const updated = await app.bean.executor.performAction('patch', profilePath, {
             innerAccess: false,
             body: {
-              name: `${fixture!.name}-updated`,
+              displayName: '  Updated display name  ',
+              name: `${fixture!.name}-must-not-rename`,
               locale: 'en_us',
               tz: 'America/New_York',
               ignored: 'must-not-persist',
             },
           });
-          assert.equal(updated.name, `${fixture!.name}-updated`);
+          assert.equal(updated.name, fixture!.name);
+          assert.equal(updated.displayName, 'Updated display name');
           assert.equal(updated.locale, 'en-us');
           assert.equal(updated.tz, 'America/New_York');
         } finally {
@@ -56,13 +59,23 @@ describe('account.test.ts', { concurrency: false }, () => {
 
       await app.bean.executor.mockCtx(async () => {
         const user = await app.bean.user.findOneById(fixture!.userId);
-        assert.equal(user?.name, `${fixture!.name}-updated`);
+        assert.equal(user?.name, fixture!.name);
+        assert.equal(user?.displayName, 'Updated display name');
         assert.ok(user);
         assert.equal('ignored' in user, false);
+        assert.equal(
+          await app.bean.user.findOneByName(`${fixture!.name}-must-not-rename`),
+          undefined,
+        );
       });
 
       await app.bean.executor.mockCtx(async () => {
-        await app.bean.passport.signinSystem('mock', -10002 as any, `${fixture!.name}-updated`);
+        const jwt = await app.bean.auth.authenticate('auth-simple:simple', {
+          clientName: 'default',
+          state: { intention: 'login' },
+          clientOptions: { username: fixture!.name, password: 'initial-password' },
+        });
+        assert.ok(jwt?.accessToken);
         try {
           const result = await app.bean.executor.performAction('post', passwordChangePath, {
             innerAccess: false,
@@ -91,6 +104,105 @@ describe('account.test.ts', { concurrency: false }, () => {
     }
   });
 
+  it('retains omitted displayName, clears null or blank, and validates the trimmed limit', async () => {
+    let fixture: IAccountFixture | undefined;
+    try {
+      fixture = await createFixture();
+      const displayName = 'd'.repeat(100);
+      const updated = await updateProfile(fixture, { displayName: `  ${displayName}  ` });
+      assert.equal(updated.displayName, displayName);
+      assert.equal(updated.name, fixture.name);
+
+      const retained = await updateProfile(fixture, { locale: 'en-us' });
+      assert.equal(retained.displayName, displayName);
+
+      await app.bean.executor.mockCtx(async () => {
+        await app.bean.passport.signinSystem('mock', -10005 as any, fixture!.name);
+        try {
+          const account = app.scope('home-user').service.account;
+          const result = await account.updateProfile({
+            name: `${fixture!.name}-service-must-not-rename`,
+          } as unknown as Parameters<typeof account.updateProfile>[0]);
+          assert.equal(result.name, fixture!.name);
+          assert.equal(result.displayName, displayName);
+        } finally {
+          await app.bean.passport.signout();
+        }
+      });
+
+      for (const invalid of ['d'.repeat(101), `  ${'d'.repeat(101)}  `]) {
+        await assert.rejects(
+          () => updateProfile(fixture!, { displayName: invalid }),
+          (error: { code?: number }) => error.code === 422,
+        );
+      }
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(fixture!.userId);
+        assert.equal(user?.name, fixture!.name);
+        assert.equal(user?.displayName, displayName);
+      });
+
+      for (const empty of [null, ' \t\n ', '']) {
+        await updateProfile(fixture, { displayName: 'Before clearing' });
+        const cleared = await updateProfile(fixture, { displayName: empty });
+        assert.equal(cleared.name, fixture.name);
+        assert.equal(cleared.displayName, undefined);
+        await app.bean.executor.mockCtx(async () => {
+          const user = await app.bean.user.findOneById(fixture!.userId);
+          assert.ok(user);
+          assert.ok(user.displayName == null);
+          await app.bean.passport.signinSystem('mock', -10006 as any, fixture!.name);
+          try {
+            const current = await app.bean.executor.performAction('get', currentPath, {
+              innerAccess: false,
+            });
+            assert.equal(current.displayName, undefined);
+          } finally {
+            await app.bean.passport.signout();
+          }
+        });
+      }
+    } finally {
+      if (fixture) await removeFixture(fixture);
+    }
+  });
+
+  it('allows two users to share displayName while retaining their original username logins', async () => {
+    const fixtures: IAccountFixture[] = [];
+    const displayName = `Shared ${crypto.randomUUID()}`;
+    try {
+      fixtures.push(await createFixture());
+      fixtures.push(await createFixture());
+      for (const fixture of fixtures) {
+        const updated = await updateProfile(fixture, { displayName });
+        assert.equal(updated.name, fixture.name);
+        assert.equal(updated.displayName, displayName);
+      }
+      for (const fixture of fixtures) {
+        await app.bean.executor.mockCtx(async () => {
+          try {
+            const jwt = await app.bean.auth.authenticate('auth-simple:simple', {
+              clientName: 'default',
+              state: { intention: 'login' },
+              clientOptions: { username: fixture.name, password: 'initial-password' },
+            });
+            assert.ok(jwt?.accessToken);
+            assert.equal(app.bean.passport.currentUser?.id.toString(), fixture.userId);
+            const current = await app.bean.executor.performAction('get', currentPath, {
+              innerAccess: false,
+            });
+            assert.equal(current.name, fixture.name);
+            assert.equal(current.displayName, displayName);
+          } finally {
+            await app.bean.passport.signout();
+          }
+        });
+      }
+    } finally {
+      for (const fixture of fixtures.reverse()) await removeFixture(fixture);
+    }
+  });
+
   it('accepts a freshly uploaded avatar during profile update', async () => {
     let fixture: IAccountFixture | undefined;
     let imageId: string | number | undefined;
@@ -133,7 +245,6 @@ describe('account.test.ts', { concurrency: false }, () => {
           const updated = await app.bean.executor.performAction('patch', profilePath, {
             innerAccess: false,
             body: {
-              name: fixture!.name,
               avatar: uploadedUrl,
             },
           });
@@ -145,7 +256,7 @@ describe('account.test.ts', { concurrency: false }, () => {
 
           const preserved = await app.bean.executor.performAction('patch', profilePath, {
             innerAccess: false,
-            body: { name: fixture!.name },
+            body: {},
           });
           assert.equal(preserved.avatar, uploadedUrl);
 
@@ -153,7 +264,6 @@ describe('account.test.ts', { concurrency: false }, () => {
           const thirdPartyUpdated = await app.bean.executor.performAction('patch', profilePath, {
             innerAccess: false,
             body: {
-              name: fixture!.name,
               avatar: thirdPartyAvatar,
             },
           });
@@ -161,7 +271,7 @@ describe('account.test.ts', { concurrency: false }, () => {
 
           const cleared = await app.bean.executor.performAction('patch', profilePath, {
             innerAccess: false,
-            body: { name: fixture!.name, avatar: null },
+            body: { avatar: null },
           });
           assert.equal(cleared.avatar, undefined);
         } finally {
@@ -214,6 +324,20 @@ describe('account.test.ts', { concurrency: false }, () => {
   });
 });
 
+async function updateProfile(fixture: IAccountFixture, body: Record<string, unknown>) {
+  return await app.bean.executor.mockCtx(async () => {
+    await app.bean.passport.signinSystem('mock', -10007 as any, fixture.name);
+    try {
+      return await app.bean.executor.performAction('patch', profilePath, {
+        innerAccess: false,
+        body,
+      });
+    } finally {
+      await app.bean.passport.signout();
+    }
+  });
+}
+
 async function createFixture(): Promise<IAccountFixture> {
   return await app.bean.executor.mockCtx(async () => {
     const name = `account-test-${crypto.randomUUID()}`;
@@ -244,6 +368,7 @@ async function removeFixture(fixture: IAccountFixture): Promise<void> {
   await app.bean.executor.mockCtx(async () => {
     await app.scope('a-auth').model.auth.deleteById(fixture.authId);
     await app.scope('auth-simple').model.authSimple.deleteById(fixture.authSimpleId);
+    await app.scope('home-user').model.roleUser.delete({ userId: fixture.userId });
     await app.bean.user.removeById(fixture.userId);
   });
 }

package/vona/src/suite/a-home/modules/home-user/test/accountOpenapi.test.ts

@@ -110,25 +110,38 @@ describe('accountOpenapi.test.ts', () => {
             assert.equal(property?.rest?.form?.required, true);
           }
         }
+        if (expectation.action === 'current' || expectation.action === 'updateProfile') {
+          const response = operation.responses?.['200'];
+          assert.ok(response && 'content' in response);
+          const body = resolveSchema(doc, response.content?.['application/json']?.schema);
+          const current = resolveSchema(doc, body.properties?.data);
+          assert.deepEqual(inlineSchema(current.properties?.displayName).type, ['string', 'null']);
+          assert.equal(current.required?.includes('displayName') ?? false, false);
+          assert.equal(inlineSchema(current.properties?.name).type, 'string');
+          assert.ok(current.required?.includes('name'));
+        }
         if (expectation.action === 'updateProfile') {
           const schemaResolved = requestSchema(doc, operation);
           assert.deepEqual(Object.keys(schemaResolved?.properties ?? {}), [
-            'name',
+            'displayName',
             'avatar',
             'locale',
             'tz',
           ]);
-          assert.deepEqual(schemaResolved?.required, ['name']);
+          assert.deepEqual(schemaResolved.required ?? [], []);
+          assert.equal(schemaResolved.properties?.name, undefined);
           for (const [field, title] of [
-            ['name', 'home-user::AccountDisplayName'],
+            ['displayName', 'home-user::AccountDisplayName'],
             ['avatar', 'home-user::AccountAvatar'],
             ['locale', 'home-user::AccountLocale'],
             ['tz', 'home-user::AccountTimezone'],
           ]) {
             assert.equal(inlineSchema(schemaResolved.properties?.[field]).title?.toString(), title);
           }
-          assert.equal(inlineSchema(schemaResolved.properties?.name).minLength, 1);
-          assert.equal(inlineSchema(schemaResolved.properties?.name).maxLength, 100);
+          const displayName = inlineSchema(schemaResolved.properties?.displayName);
+          assert.deepEqual(displayName.type, ['string', 'null']);
+          assert.equal(displayName.maxLength, 100);
+          assert.ok(!displayName.minLength);
           assert.deepEqual(inlineSchema(schemaResolved.properties?.avatar).type, [
             'string',
             'null',
@@ -154,6 +167,20 @@ function inlineSchema(
   return schema;
 }
 
+function resolveSchema(
+  doc: OpenAPIObject,
+  schema: ReferenceObject | SchemaObject | undefined,
+): ISchemaObjectExtensionField {
+  assert.ok(schema);
+  if ('$ref' in schema && typeof schema.$ref === 'string') {
+    return resolveSchema(
+      doc,
+      doc.components?.schemas?.[schema.$ref.replace('#/components/schemas/', '')],
+    );
+  }
+  return inlineSchema(schema);
+}
+
 function requestSchema(
   doc: OpenAPIObject,
   operation: OperationObject,

package/vona/src/suite/a-home/modules/home-user/test/passport.test.ts

@@ -1,5 +1,5 @@
 import type { SchemaObject } from 'openapi3-ts/oas31';
-import type { IPassport } from 'vona-module-a-user';
+import type { IAuthUserProfile, IPassport } from 'vona-module-a-user';
 
 import assert from 'node:assert';
 import { describe, it, mock } from 'node:test';
@@ -12,6 +12,7 @@ function createPassport(): IPassport {
     user: {
       id: 'passport-response-user',
       name: 'Passport response fixture',
+      displayName: 'Passport display name',
       activated: true,
       accountStatus: 'active',
       instanceId: 'untrusted-user-instance',
@@ -38,12 +39,26 @@ describe('passport.test.ts', { concurrency: false }, () => {
       assert.ok(result);
       assert.equal(result.instanceId, instanceId);
       assert.equal(result.user.id, passport.user!.id);
+      assert.equal(result.user.name, passport.user!.name);
+      assert.equal(result.user.displayName, passport.user!.displayName);
       assert.equal(result.auth, passport.auth);
       assert.equal(result.roles, passport.roles);
       assert.equal('instanceId' in result.user, false);
     });
   });
 
+  it('current leaves an absent displayName unset instead of falling back to the username', async () => {
+    await app.bean.executor.mockCtx(async () => {
+      const passport = createPassport();
+      delete passport.user!.displayName;
+      app.ctx.state.passport = passport;
+      const result = await app.bean._getBean(ControllerPassport).current();
+      assert.ok(result);
+      assert.equal(result.user.name, passport.user!.name);
+      assert.equal(result.user.displayName, undefined);
+    });
+  });
+
   it('current returns explicit null when the request has no instance', async () => {
     await app.bean.executor.mockCtx(
       async () => {
@@ -98,6 +113,8 @@ describe('passport.test.ts', { concurrency: false }, () => {
               assert.equal(response.passport.instanceId, app.ctx.instance?.id ?? null);
               assert.ok(Object.hasOwn(response.passport, 'instanceId'));
               assert.equal(response.passport.user.id, 'passport-response-user');
+              assert.equal(response.passport.user.displayName, 'Passport display name');
+              assert.equal(response.passport.user.name, 'Passport response fixture');
               assert.equal(response.jwt, jwt);
             }
             assert.equal(authenticate.mock.callCount(), 4);
@@ -112,6 +129,144 @@ describe('passport.test.ts', { concurrency: false }, () => {
     }
   });
 
+  it('userOfProfile maps only an actual trimmed provider displayName without name fallbacks', async () => {
+    const profile: IAuthUserProfile = {
+      id: 'display-name-profile',
+      username: 'provider-username',
+      name: { givenName: 'Given', familyName: 'Family' },
+      emails: [{ value: 'profile@example.test' }],
+      photos: [{ value: 'https://example.test/avatar.png' }],
+    };
+    for (const displayName of [undefined, '', ' \t ', '  Provider display name  ']) {
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.scope('home-user').service.userAdapter.userOfProfile({
+          ...profile,
+          ...(displayName === undefined ? {} : { displayName }),
+        });
+        assert.equal(user.name, profile.username);
+        assert.equal(user.displayName, displayName?.trim() || undefined);
+        assert.equal(user.email, profile.emails![0].value);
+        assert.equal(user.avatar, profile.photos![0].value);
+      });
+    }
+  });
+
+  it('OAuth creation maps displayName but existing login and linking preserve account profile fields', async () => {
+    const suffix = crypto.randomUUID();
+    const oauthName = `display-oauth-${suffix}`;
+    const linkedName = `display-linked-${suffix}`;
+    const profileId = `display-profile-${suffix}`;
+    const linkedProfileId = `display-link-${suffix}`;
+    const profile: IAuthUserProfile = {
+      id: profileId,
+      username: oauthName,
+      displayName: '  Initial provider display  ',
+      confirmed: true,
+    };
+    let oauthUserId: string | undefined;
+    let linkedUserId: string | undefined;
+    try {
+      await app.bean.executor.mockCtx(async () => {
+        const provider = await app.bean.authProvider.get({
+          providerName: 'auth-oauth:oauth',
+          clientName: 'github',
+        });
+        const passport = await app
+          .scope('a-auth')
+          .service.auth.issuePassport(profile, provider, {});
+        assert.ok(passport.user);
+        oauthUserId = passport.user.id.toString();
+        assert.equal(passport.user.name, oauthName);
+        assert.equal(passport.user.displayName, 'Initial provider display');
+        await app.bean.user.updateById(oauthUserId, { displayName: 'Account-owned display' });
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        const provider = await app.bean.authProvider.get({
+          providerName: 'auth-oauth:oauth',
+          clientName: 'github',
+        });
+        const passport = await app.scope('a-auth').service.auth.issuePassport(
+          { ...profile, username: `${oauthName}-changed`, displayName: 'Changed provider display' },
+          provider,
+          {},
+          {
+            intention: 'login',
+            authProviderId: provider.id,
+            instanceName: app.ctx.instanceName!,
+            locale: app.ctx.locale,
+            tz: app.ctx.tz,
+          },
+        );
+        assert.equal(passport.user?.id.toString(), oauthUserId);
+        assert.equal(passport.user?.name, oauthName);
+        assert.equal(passport.user?.displayName, 'Account-owned display');
+        const persisted = await app.bean.user.findOneById(oauthUserId!);
+        assert.equal(persisted?.displayName, 'Account-owned display');
+      });
+
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.register({ name: linkedName }, true);
+        linkedUserId = user.id.toString();
+      });
+      await app.bean.executor.mockCtx(async () => {
+        const user = await app.bean.user.findOneById(linkedUserId!);
+        assert.ok(user);
+        await app.bean.passport.setCurrent({ user });
+        try {
+          const provider = await app.bean.authProvider.get({
+            providerName: 'auth-oauth:oauth',
+            clientName: 'github',
+          });
+          const passport = await app.scope('a-auth').service.auth.issuePassport(
+            { ...profile, id: linkedProfileId },
+            provider,
+            {},
+            {
+              intention: 'associate',
+              authProviderId: provider.id,
+              instanceName: app.ctx.instanceName!,
+              locale: app.ctx.locale,
+              tz: app.ctx.tz,
+            },
+          );
+          assert.equal(passport.user?.id.toString(), linkedUserId);
+          assert.equal(passport.user?.name, linkedName);
+          assert.equal(passport.user?.displayName, undefined);
+          const persisted = await app.bean.user.findOneById(linkedUserId!);
+          assert.equal(persisted?.name, linkedName);
+          assert.equal(persisted?.displayName, undefined);
+          const auth = await app.scope('a-auth').model.auth.get({
+            authProviderId: provider.id,
+            profileId: linkedProfileId,
+          });
+          assert.equal(auth?.userId.toString(), linkedUserId);
+        } finally {
+          await app.bean.passport.setCurrent(undefined);
+        }
+      });
+    } finally {
+      await app.bean.executor.mockCtx(async () => {
+        const provider = await app.bean.authProvider.get({
+          providerName: 'auth-oauth:oauth',
+          clientName: 'github',
+        });
+        for (const id of [linkedProfileId, profileId]) {
+          await app
+            .scope('a-auth')
+            .model.auth.delete({ authProviderId: provider.id, profileId: id });
+        }
+        for (const name of [linkedName, oauthName]) {
+          const user = await app.bean.user.findOneByName(name);
+          if (user) {
+            await app.scope('home-user').model.roleUser.delete({ userId: user.id });
+            await app.bean.user.removeById(user.id);
+          }
+        }
+      });
+    }
+  });
+
   it('OpenAPI exposes a required nullable table identity on current and every Passport/JWT response', async () => {
     await app.bean.executor.mockCtx(async () => {
       const actions = [
@@ -148,6 +303,9 @@ describe('passport.test.ts', { concurrency: false }, () => {
         const instanceId = resolve(passport.properties?.instanceId as SchemaObject);
         const user = resolve(passport.properties?.user as SchemaObject);
         const userId = resolve(user.properties?.id as SchemaObject);
+        const displayName = resolve(user.properties?.displayName as SchemaObject);
+        assert.deepEqual(displayName.type, ['string', 'null']);
+        assert.equal(user.required?.includes('displayName') ?? false, false);
         const types = (schema: SchemaObject): string[] => {
           if (schema.anyOf)
             return schema.anyOf.flatMap(item => types(resolve(item as SchemaObject)));

package/vona/src/suite-vendor/a-cabloy/modules/a-rbac/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-rbac",
-  "version": "5.0.17",
+  "version": "5.0.18",
   "description": "",
   "keywords": [
     "Vona Module"

package/vona/src/suite-vendor/a-cabloy/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-suite-a-cabloy",
-  "version": "5.1.69",
+  "version": "5.1.70",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "author": "",
@@ -10,7 +10,7 @@
     "vona-module-a-cabloy": "workspace:^",
     "vona-module-a-layoutprofile": "^5.0.2",
     "vona-module-a-markdown": "^5.0.3",
-    "vona-module-a-rbac": "^5.0.17",
+    "vona-module-a-rbac": "^5.0.18",
     "vona-module-a-socket": "workspace:^",
     "vona-module-a-ssr": "workspace:^",
     "vona-module-a-ssrhmr": "workspace:^"

package/vona/src/suite-vendor/a-vona/modules/a-permission/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-permission",
-  "version": "5.1.33",
+  "version": "5.1.34",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-permission/src/bean/bean.permission.ts

@@ -11,7 +11,7 @@ import type { ContextRoute, IRecordResourceNameToRoutePathItem } from 'vona-modu
 import { appResource, BeanBase, beanFullNameFromOnionName } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import { Caching } from 'vona-module-a-caching';
-import { clearRbacDecision, setRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
+import { clearRbacDecision, getRbacDecision, SymbolRbacDecision } from 'vona-module-a-rbac';
 import {
   composeGuards,
   getCacheControllerRoutes,
@@ -107,6 +107,23 @@ export class BeanPermission extends BeanBase {
     return typeof permission === 'boolean' ? permission : permission.allowed;
   }
 
+  /**
+   * Checks current guards without permission events, result caches or matcher projection.
+   * A true result does not authorize individual records or prepare data scope/owner values.
+   * The target action's RBAC decision is not retained; scoped operations must authorize separately.
+   */
+  public async checkPermissionActionGuards(
+    resource: keyof IResourceRecord,
+    actionKey: string,
+  ): Promise<boolean> {
+    if (!Object.hasOwn(recordResourceNameToRoutePath, resource)) return false;
+    const routePathInfo = recordResourceNameToRoutePath[resource];
+    if (!routePathInfo || !appResource.getBean(routePathInfo.controller)) return false;
+    const route = this._getControllerActionRoute(resource, actionKey);
+    if (!route?.route?.meta || !this._matchPassportMeta(route.route.meta)) return false;
+    return await this._evaluatePermissionAction(route, true);
+  }
+
   public async retrievePermissionAction(
     resource: keyof IResourceRecord,
     actionKey: string,
@@ -201,12 +218,17 @@ export class BeanPermission extends BeanBase {
     return true;
   }
 
-  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction> {
+  private async _evaluatePermissionAction(route: ContextRoute, guardsOnly: true): Promise<boolean>;
+  private async _evaluatePermissionAction(route: ContextRoute): Promise<IOpenapiPermissionAction>;
+  private async _evaluatePermissionAction(
+    route: ContextRoute,
+    guardsOnly = false,
+  ): Promise<IOpenapiPermissionAction> {
     const ctx = this.ctx as any;
-    const routePrevious = ctx.route;
+    const routeDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'route');
+    const innerAccessDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, 'innerAccess');
     const innerAccessPrevious = ctx.innerAccess;
-    const rbacDecisionHadOwnProperty = Object.hasOwn(ctx, SymbolRbacDecision);
-    const rbacDecisionPrevious = ctx[SymbolRbacDecision];
+    const rbacDecisionDescriptorPrevious = Object.getOwnPropertyDescriptor(ctx, SymbolRbacDecision);
     try {
       ctx.route = route;
       ctx.innerAccess = false;
@@ -214,19 +236,43 @@ export class BeanPermission extends BeanBase {
       const result = await composeGuards(this.app, route)(this.ctx);
       if (result === false) return false;
       if (!route.route.meta?.[BeanFullNameGuardRbac]) return true;
+      if (guardsOnly) {
+        const action = this.bean.rbacCatalog.getAction(route);
+        const decision = getRbacDecision(this.ctx);
+        return Boolean(
+          action &&
+          Object.hasOwn(ctx, SymbolRbacDecision) &&
+          decision?.allowed === true &&
+          decision.actionKey === action.actionKey &&
+          decision.action?.actionKey === action.actionKey &&
+          decision.action.actionInheritKey === action.actionInheritKey &&
+          decision.action.controllerBeanFullName === action.controllerBeanFullName &&
+          decision.action.action === action.action,
+        );
+      }
       const rbacScopeCurrent = await this.bean.rbacScope.current();
       return rbacScopeCurrent.permissionProjection();
     } catch (err: any) {
       if ([401, 403].includes(err?.code)) return false;
       throw err;
     } finally {
-      if (rbacDecisionHadOwnProperty) {
-        setRbacDecision(ctx, rbacDecisionPrevious);
+      if (rbacDecisionDescriptorPrevious) {
+        Object.defineProperty(ctx, SymbolRbacDecision, rbacDecisionDescriptorPrevious);
       } else {
         clearRbacDecision(ctx);
       }
-      ctx.route = routePrevious;
+      if (routeDescriptorPrevious) {
+        Object.defineProperty(ctx, 'route', routeDescriptorPrevious);
+      } else {
+        delete ctx.route;
+      }
+      // Vona's inherited innerAccess accessor owns its value in a context symbol.
       ctx.innerAccess = innerAccessPrevious;
+      if (innerAccessDescriptorPrevious) {
+        Object.defineProperty(ctx, 'innerAccess', innerAccessDescriptorPrevious);
+      } else {
+        delete ctx.innerAccess;
+      }
     }
   }
 }