create-m5kdev 0.32.0 → 0.32.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-m5kdev",
-  "version": "0.32.0",
+  "version": "0.32.2",
   "license": "GPL-3.0-only",
   "repository": {
     "type": "git",

package/templates/minimal-app/.cursor/rules/module-grants-guide.mdc

@@ -35,7 +35,14 @@ Each `ResourceGrant` has four fields:
 | `action` | `string` | The permission action (`"read"`, `"write"`, `"delete"`, `"publish"`) |
 | `level` | `"user" \| "team" \| "organization"` | The scope level at which the grant applies |
 | `role` | `string` | The role that receives this grant (`"owner"`, `"admin"`, `"member"`) |
-| `access` | `"all" \| "own"` | `"all"` grants access to any entity; `"own"` requires ownership match |
+| `access` | `"all" \| "own" \| "org" \| "none"` | See Access modes below |
+
+### Access modes
+
+- `"all"` — any entity (no ownership/org check). Use for platform/user-level admins only.
+- `"own"` — ownership check (`userId`/`memberId`, `teamId`, or `organizationId` depending on grant level).
+- `"org"` — same-organization only (`entity.organizationId === actor.organizationId`). Prefer for org owner/admin instead of `"all"`.
+- `"none"` — explicit deny for that role/action (clearer than omitting the action).
 
 ## Example
 
@@ -43,6 +50,12 @@ Each `ResourceGrant` has four fields:
 import type { ResourceGrant } from "@m5kdev/backend/modules/base/base.grants";
 
 export const postsGrants: ResourceGrant[] = [
+  {
+    action: "read",
+    level: "team",
+    role: "owner",
+    access: "own",
+  },
   {
     action: "write",
     level: "team",
@@ -61,6 +74,12 @@ export const postsGrants: ResourceGrant[] = [
     role: "owner",
     access: "own",
   },
+  {
+    action: "read",
+    level: "organization",
+    role: "owner",
+    access: "own",
+  },
   {
     action: "write",
     level: "organization",
@@ -119,7 +138,14 @@ readonly update = this.procedure<UpdateInput>("update")
 The `.access()` step supports two entity resolution modes:
 
 - `entityStep` — reads entity from a previous `.use()` or `.loadResource()` step.
-- `entities` — inline function returning `{ userId?, organizationId?, teamId? }`.
+- `entities` — inline function returning `{ userId?, memberId?, organizationId?, teamId? }`.
+
+Behavior:
+
+- **Array entities** — soft-filtered to allowed rows (may be `[]`); filtered result is written back to `entityStep` state. Does not 403 the whole list.
+- **Single entity** — `FORBIDDEN` when denied (e.g. cross-org update with `"org"` grants).
+
+Prefer organization-level `"org"` (not `"all"`) for multi-tenant owner/admin roles so `findById` mutations cannot cross orgs.
 
 ## Service Choice
 

package/templates/minimal-app/.cursor/rules/module-service-guide.mdc

@@ -24,6 +24,14 @@ apps/<app>/server/src/modules/<module>/<module>.service.ts
 - Implement service methods as `readonly` procedures using the `this.procedure("name")` builder.
 - Propagate `ServerResultAsync` consistently with `err(...)`/`ok(...)` composition.
 
+## Avoid Trivial Service Delegation
+
+- Do not add a service method whose only behavior is calling another service.
+- Call the owning service directly when no business rule, authorization, validation, orchestration, transaction boundary, or meaningful domain translation is added.
+- Renaming the dependency method, repackaging arguments, constructing a prompt, or forwarding actor/context data alone does not justify a wrapper.
+- A delegating method is justified only when the current service genuinely owns the use case and adds behavior or protects a boundary callers must not bypass.
+- If removing the method and calling the dependency directly would lose nothing, do not add the method.
+
 ## Procedure Builder
 
 Each procedure declares its schemas from the DTO, then auth, resource loading,
@@ -38,25 +46,32 @@ access control, and the handler:
 
 ## Procedure Patterns
 
-### List — delegate to `queryList`, never hand-roll list logic
+### List — org context filter + optional access soft-filter
 
 ```typescript
 readonly list = this.procedure("list")
   .input(postSchemas.input.list)
   .output(postSchemas.output.list)
-  .requireAuth()
-  .handle(({ input }) => {
-    return this.repository.posts.queryList(input, {
+  .requireAuth("organization")
+  .addContextFilter(["organization"])
+  .loadResource("posts", ({ input }) =>
+    this.repository.posts.queryList(input, {
       globalSearchColumns: ["title", "excerpt", "content"],
-    });
-  });
+    })
+  )
+  .access({ action: "read", entityStep: "posts" })
+  .handle(({ state }) => state.posts);
 ```
 
+- Default list scoping: `addContextFilter(["organization"])`.
+- When grants are member-own only, prefer `addContextFilter(["member", "organization"])`.
+- `.access` on arrays soft-filters allowed rows (empty OK) and writes back to `state.posts`.
+
 ### Create with business logic
 
 ```typescript
 readonly create = this.procedure("create")
-  .requireAuth()
+  .requireAuth("organization")
   .input(postSchemas.input.create)
   .output(postSchemas.output.single)
   .access({ action: "write" })
@@ -67,8 +82,9 @@ readonly create = this.procedure("create")
     if (uniqueSlug.isErr()) return err(uniqueSlug.error);
 
     return this.repository.posts.create({
-      authorUserId: ctx.user.id,
-      organizationId: ctx.session.activeOrganizationId ?? null,
+      // Org-scoped assets: stamp memberId (+ organizationId). Personal resources: stamp userId.
+      memberId: ctx.actor.memberId,
+      organizationId: ctx.actor.organizationId,
       title: input.title.trim(),
       slug: uniqueSlug.value,
       content: input.content.trim(),
@@ -81,7 +97,7 @@ readonly create = this.procedure("create")
 
 ```typescript
 readonly update = this.procedure("update")
-  .requireAuth()
+  .requireAuth("organization")
   .input(postSchemas.input.update)
   .output(postSchemas.output.single)
   .loadResource("post", ({ input }) => this.repository.posts.findById(input.id))
@@ -114,8 +130,9 @@ readonly softDelete = this.procedure("softDelete")
 ## Access Control Modes
 
 - **`entityStep`** — references a value stored by `.loadResource()`/`.use()`;
-  the entity's `userId`, `organizationId`, and `teamId` are read automatically.
-- **`entities`** — inline function returning `{ userId?, organizationId?, teamId? }`
+  the entity's `userId`, `memberId`, `organizationId`, and `teamId` are read automatically.
+  Arrays are soft-filtered; singles return `FORBIDDEN` when denied. Filtered arrays are written back to the step state.
+- **`entities`** — inline function returning `{ userId?, memberId?, organizationId?, teamId? }`
   when the entity is not loaded into state.
 
 ## Permissions and Grants
@@ -123,6 +140,8 @@ readonly softDelete = this.procedure("softDelete")
 - Keep action names aligned with grants (`read`, `write`, `delete`, `publish`).
 - Do not use undeclared aliases (e.g. guarding `"update"` when grants define `"write"`).
 - If a module never uses `.access()`, extend `BaseService` instead of `BasePermissionService`.
+- Access modes: `"all"` (global), `"org"` (same organization), `"own"` (ownership), `"none"` (explicit deny).
+- Prefer `"org"` for org owner/admin grants so `findById` updates cannot cross organizations.
 
 ## Best Practices
 

package/templates/minimal-app/AGENTS.md.tpl

@@ -13,13 +13,15 @@
 - `apps/webapp` holds the React app shell, routes, providers, and the `posts` feature.
 - `apps/email` holds the email templates used by auth flows and local email delivery.
 
-## Backend Conventions
-
-- Keep repository, service, and transport layers separate inside each module.
-- Register modules in `apps/server/src/app.ts` via `createBackendApp(config, [modules])`.
-- Use `BaseModule` subclasses for app modules; the kernel wires repositories, services, and tRPC.
-- Keep tRPC files focused on input/output wiring and delegate logic to services.
-- Do not create Drizzle migrations by hand. Use the scaffolded config and your project migration workflow later if you need generated migrations.
+## Backend Conventions
+
+- Keep repository, service, and transport layers separate inside each module.
+- Register modules in `apps/server/src/app.ts` via `createBackendApp(config, [modules])`.
+- Use `BaseModule` subclasses for app modules; the kernel wires repositories, services, and tRPC.
+- Keep tRPC files focused on input/output wiring and delegate logic to services.
+- Do not add service methods that merely call another service. Call the owning service directly unless the method adds a business rule, authorization, validation, orchestration, a transaction boundary, or meaningful domain translation.
+- Renaming a dependency method, repackaging arguments, constructing a prompt, or forwarding actor/context data alone does not justify a service wrapper.
+- Do not create Drizzle migrations by hand. Use the scaffolded config and your project migration workflow later if you need generated migrations.
 
 ## Frontend Conventions
 

package/templates/minimal-app/apps/server/AGENTS.md.tpl

@@ -30,6 +30,13 @@ apps/server/src/modules/<module>/
 - tRPC files own transport only and must delegate to services.
 - Register modules in `apps/server/src/app.ts`; use `db.ts` and `lib/auth.ts` only for scripts that need direct DB or auth access.
 
+## Avoid Trivial Service Delegation
+
+- Do not add service methods that merely call another service.
+- Call the owning service directly unless the method adds a business rule, authorization, validation, orchestration, a transaction boundary, or meaningful domain translation.
+- Renaming a dependency method, repackaging arguments, constructing a prompt, or forwarding actor/context data alone does not justify a wrapper.
+- If removing the method and calling the dependency directly would lose no behavior or boundary, do not add it.
+
 ## Workflow, Redis, and push notifications
 
 - `WorkflowModule` and `NotificationModule` are registered in `app.ts`. Start **Redis** locally (`REDIS_URL`) before `pnpm dev` on the server, or background jobs will not run.

package/templates/minimal-app/pnpm-workspace.yaml.tpl

@@ -5,12 +5,12 @@ catalog:
   "@heroui/react": 3.0.3
   "@heroui/styles": 3.0.3
   "@libsql/client": 0.17.4
-  "@m5kdev/backend": 0.32.0
-  "@m5kdev/commons": 0.32.0
-  "@m5kdev/config": 0.32.0
-  "@m5kdev/email": 0.32.0
-  "@m5kdev/frontend": 0.32.0
-  "@m5kdev/web-ui": 0.32.0
+  "@m5kdev/backend": 0.32.2
+  "@m5kdev/commons": 0.32.2
+  "@m5kdev/config": 0.32.2
+  "@m5kdev/email": 0.32.2
+  "@m5kdev/frontend": 0.32.2
+  "@m5kdev/web-ui": 0.32.2
   "@playwright/test": 1.57.0
   "@react-email/components": 1.0.1
   "@tailwindcss/vite": 4.1.11