railcode 0.1.21 → 0.1.22

package/dist/index.js

@@ -983,13 +983,27 @@ declare const me: () => Promise<Me>;
 declare const appUsers: () => Promise<AppUser[]>;
 declare const roles: () => Promise<OrgRole[]>;
 declare const designSystem: () => Promise<string>;
-declare const db: { collection<T = unknown>(name: string): Collection<T> };
-declare const files: {
+type DbNamespace = { collection<T = unknown>(name: string): Collection<T> };
+type FilesNamespace = {
   upload(name: string, data: Blob | ArrayBuffer | ArrayBufferView, contentType?: string): Promise<FileMeta>;
   url(name: string): string;
   list(): Promise<FileMeta[]>;
   delete(name: string): Promise<void>;
 };
+// Storage scopes. Bare db/files are aliases for \`.shared\` (app-wide). \`.user\` is the
+// signed-in caller's own private namespace; \`.role(uuid)\` is one org role's namespace
+// (the caller must be a live member of that role — owner/admin may reach any). The same
+// (collection,key) / file name never collides across scopes.
+declare const db: DbNamespace & {
+  shared: DbNamespace;
+  user: DbNamespace;
+  role(uuid: string): DbNamespace;
+};
+declare const files: FilesNamespace & {
+  shared: FilesNamespace;
+  user: FilesNamespace;
+  role(uuid: string): FilesNamespace;
+};
 declare const data: DatabaseNamespace;
 declare const postgres: DatabaseNamespace;
 declare const bigquery: DatabaseNamespace;
@@ -5121,9 +5135,10 @@ class CliError extends Error {
 // dev — local development server (`railcode dev`)
 //
 // Serves the app on a single loopback origin and emulates the /_api/* data plane:
-// identity is synthetic, KV + files live on local disk. llm/sql/queries/connectors/email
-// proxy to the real instance as the signed-in user (their token + org grants) via the
-// org/user-scoped routes — no deploy needed. Mirrors railcode-core's dev.
+// identity is synthetic, KV + files live on local disk (isolated per storage scope —
+// shared/user/role — so `db.user`/`files.role(uuid)` behave like prod). llm/sql/queries/
+// connectors/email proxy to the real instance as the signed-in user (their token + org
+// grants) via the org/user-scoped routes — no deploy needed. Mirrors railcode-core's dev.
 // ---------------------------------------------------------------------------
 const DEFAULT_DEV_PORT = 7331;
 const DEFAULT_ASSET_PORT = 5173;
@@ -5160,8 +5175,9 @@ async function commandDev(args) {
         app: manifest.app,
         root: plan.root,
         sdkPath,
-        kv: new DevKvStore(join(stateDir, "kv.json")),
-        files: new DevFileStore(stateDir),
+        stateDir,
+        kvStores: new Map(),
+        fileStores: new Map(),
         port: requestedPort,
         config,
     };
@@ -5564,15 +5580,21 @@ class DevKvStore {
 }
 // ── local file store (bytes on disk, metadata in files.json) ──────────────────
 class DevFileStore {
-    dir;
-    constructor(dir) {
-        this.dir = dir;
+    blobRoot;
+    metaFile;
+    // Scope-aware, mirroring the backend's physical layout: shared keeps the legacy
+    // `files/` blob dir + `files.json` meta (byte-compatible with pre-scopes dev state);
+    // user/role nest under a per-scope blob dir + meta so namespaces never collide.
+    constructor(dir, scopeSlug) {
+        this.blobRoot = scopeSlug ? join(dir, `files-${scopeSlug}`) : join(dir, "files");
+        this.metaFile = scopeSlug ? join(dir, `files.${scopeSlug}.json`) : join(dir, "files.json");
+        mkdirSync(this.blobRoot, { recursive: true });
     }
     metaPath() {
-        return join(this.dir, "files.json");
+        return this.metaFile;
     }
     blobPath(name) {
-        return join(this.dir, "files", encodeURIComponent(name));
+        return join(this.blobRoot, encodeURIComponent(name));
     }
     readMeta() {
         const p = this.metaPath();
@@ -5675,7 +5697,79 @@ async function handleLocalApi(ctx, req, res, url) {
     }
     sendJson(res, 404, { detail: "not found" });
 }
+// role/user selectors are UUIDs on the backend (it resolves them to FK ids). Enforce
+// the same here so a selector can NEVER reach the filesystem as a path segment — the
+// slug feeds kv.<slug>.json / files-<slug>/, so an unvalidated "../.." would traverse
+// out of the dev state dir. UUIDs contain only hex + hyphens, so this closes it.
+const DEV_UUID_RE = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$/;
+function resolveDevScope(url) {
+    const scope = (url.searchParams.get("scope") || "shared").toLowerCase();
+    const role = url.searchParams.get("role");
+    const user = url.searchParams.get("user");
+    if (scope === "shared") {
+        if (role || user) {
+            return { ok: false, status: 400, detail: "shared scope takes no role or user selector" };
+        }
+        return { ok: true, scope: { key: "shared", slug: "shared" } };
+    }
+    if (scope === "user") {
+        if (role)
+            return { ok: false, status: 400, detail: "user scope takes no role selector" };
+        if (user !== null && !DEV_UUID_RE.test(user)) {
+            return { ok: false, status: 400, detail: "malformed user id" };
+        }
+        const uuid = user || DEV_USER_UUID;
+        return { ok: true, scope: { key: `user:${uuid}`, slug: `users-${uuid}` } };
+    }
+    if (scope === "role") {
+        if (user)
+            return { ok: false, status: 400, detail: "role scope takes no user selector" };
+        if (!role)
+            return { ok: false, status: 400, detail: "role scope requires a role id" };
+        if (!DEV_UUID_RE.test(role))
+            return { ok: false, status: 400, detail: "malformed role id" };
+        return { ok: true, scope: { key: `role:${role}`, slug: `roles-${role}` } };
+    }
+    return { ok: false, status: 400, detail: `invalid scope: ${scope}` };
+}
+function kvForScope(ctx, scope) {
+    let store = ctx.kvStores.get(scope.key);
+    if (!store) {
+        const path = scope.key === "shared"
+            ? join(ctx.stateDir, "kv.json")
+            : join(ctx.stateDir, `kv.${scope.slug}.json`);
+        store = new DevKvStore(path);
+        ctx.kvStores.set(scope.key, store);
+    }
+    return store;
+}
+function filesForScope(ctx, scope) {
+    let store = ctx.fileStores.get(scope.key);
+    if (!store) {
+        store = new DevFileStore(ctx.stateDir, scope.key === "shared" ? undefined : scope.slug);
+        ctx.fileStores.set(scope.key, store);
+    }
+    return store;
+}
+// Re-attach the request's scope selectors to a same-origin /_api URL (the local-proxy
+// blob upload URL, download URLs) so the follow-up call resolves the identical scope —
+// mirrors the backend's _scoped_url.
+function scopeQuerySuffix(url) {
+    const parts = [];
+    for (const k of ["scope", "role", "user"]) {
+        const v = url.searchParams.get(k);
+        if (v)
+            parts.push(`${k}=${encodeURIComponent(v)}`);
+    }
+    return parts.length ? `&${parts.join("&")}` : "";
+}
 async function handleKv(ctx, req, res, path, url) {
+    const resolved = resolveDevScope(url);
+    if (!resolved.ok) {
+        sendJson(res, resolved.status, { detail: resolved.detail });
+        return;
+    }
+    const kv = kvForScope(ctx, resolved.scope);
     // path: /kv/{collection} | /kv/{collection}/{key...}
     const rest = path.slice("/kv/".length);
     const slash = rest.indexOf("/");
@@ -5695,7 +5789,7 @@ async function handleKv(ctx, req, res, path, url) {
             return;
         }
         try {
-            const records = ctx.kv.records(collection);
+            const records = kv.records(collection);
             const params = parseKvParams(url);
             if (url.searchParams.get("count") === "true") {
                 sendJson(res, 200, { count: kvCount(records, params) });
@@ -5713,7 +5807,7 @@ async function handleKv(ctx, req, res, path, url) {
         return;
     }
     if (req.method === "GET") {
-        const rec = ctx.kv.get(collection, key);
+        const rec = kv.get(collection, key);
         if (!rec)
             sendJson(res, 404, { detail: "Key not found" });
         else
@@ -5734,11 +5828,11 @@ async function handleKv(ctx, req, res, path, url) {
             sendJson(res, 413, { detail: "Value too large" });
             return;
         }
-        sendJson(res, 200, ctx.kv.put(collection, key, payload.value));
+        sendJson(res, 200, kv.put(collection, key, payload.value));
         return;
     }
     if (req.method === "DELETE") {
-        ctx.kv.delete(collection, key);
+        kv.delete(collection, key);
         sendStatus(res, 204);
         return;
     }
@@ -5776,8 +5870,44 @@ function parseKvParams(url) {
     };
 }
 async function handleFiles(ctx, req, res, path, url) {
+    const resolved = resolveDevScope(url);
+    if (!resolved.ok) {
+        sendJson(res, resolved.status, { detail: resolved.detail });
+        return;
+    }
+    const files = filesForScope(ctx, resolved.scope);
+    const scopeSuffix = scopeQuerySuffix(url);
     if (path === "/files" && req.method === "GET") {
-        sendJson(res, 200, { items: ctx.files.list() });
+        sendJson(res, 200, { items: files.list() });
+        return;
+    }
+    if (path === "/files/urls" && req.method === "POST") {
+        const body = await readBody(req);
+        let payload;
+        try {
+            payload = JSON.parse(body.toString("utf8") || "{}");
+        }
+        catch {
+            sendJson(res, 400, { detail: "invalid JSON body" });
+            return;
+        }
+        const names = Array.isArray(payload.names)
+            ? payload.names.filter((n) => typeof n === "string")
+            : [];
+        // Local proxy: download URLs carry the scope so a later GET re-resolves it.
+        const scopeQuery = scopeSuffix ? `?${scopeSuffix.slice(1)}` : "";
+        const items = [];
+        const missing = [];
+        for (const name of [...new Set(names)]) {
+            const safe = devSafeName(name);
+            if (safe && files.get(safe)) {
+                items.push({ name, url: `/_api/files/${encodeURIComponent(safe)}${scopeQuery}`, expires_in: null });
+            }
+            else {
+                missing.push(name);
+            }
+        }
+        sendJson(res, 200, { items, missing });
         return;
     }
     if (path === "/files" && req.method === "POST") {
@@ -5795,10 +5925,12 @@ async function handleFiles(ctx, req, res, path, url) {
             sendJson(res, 400, { detail: "Invalid file name" });
             return;
         }
+        // The blob URL carries the scope selectors so the follow-up PUT lands in the
+        // same scope (mirrors the backend's _scoped_url on the proxy path).
         sendJson(res, 200, {
             mode: "proxy",
             method: "PUT",
-            url: `/_api/files/blob?name=${encodeURIComponent(safe)}`,
+            url: `/_api/files/blob?name=${encodeURIComponent(safe)}${scopeSuffix}`,
             object_key: safe,
             headers: {},
             expires_in: null,
@@ -5817,7 +5949,7 @@ async function handleFiles(ctx, req, res, path, url) {
             return;
         }
         const contentType = req.headers["content-type"] || "application/octet-stream";
-        sendJson(res, 200, ctx.files.put(safe, body, contentType));
+        sendJson(res, 200, files.put(safe, body, contentType));
         return;
     }
     if (path.startsWith("/files/")) {
@@ -5827,7 +5959,7 @@ async function handleFiles(ctx, req, res, path, url) {
             return;
         }
         if (req.method === "GET") {
-            const found = ctx.files.get(name);
+            const found = files.get(name);
             if (!found) {
                 sendJson(res, 404, { detail: "File not found" });
                 return;
@@ -5844,7 +5976,7 @@ async function handleFiles(ctx, req, res, path, url) {
             return;
         }
         if (req.method === "DELETE") {
-            ctx.files.delete(name);
+            files.delete(name);
             sendStatus(res, 204);
             return;
         }
@@ -6042,6 +6174,12 @@ function devSafeName(name) {
         return null;
     if (name.split("/").some((seg) => seg === "" || seg === "." || seg === ".."))
         return null;
+    // `users`/`roles` are reserved as the first path segment (mirrors the backend's
+    // _safe_name): the user/role file subtrees nest under the shared prefix, so a
+    // shared-scope name beginning with them would alias another scope's object.
+    const first = name.split("/", 1)[0].toLowerCase();
+    if (first === "users" || first === "roles")
+        return null;
     return name;
 }
 function readBody(req) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "railcode",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "Developer CLI for the multi-tenant Railcode platform: log in, scaffold, and deploy static apps.",
   "license": "MIT",
   "type": "module",