sh3-server 0.13.0 → 0.13.2

package/dist/scope.d.ts

@@ -1,11 +1,16 @@
 /**
  * Scope-based route guards. Operate on the `caller` set by resolveCaller.
  *
- * scopeRequired(scope) — 403 unless caller has that scope or admin:*.
- * tenantRequired — 401 unless caller.tenantId is non-null.
+ * scopeRequired(scope) — 403 unless caller has that permission scope or admin:*.
+ * requireCallerScope — 401 unless caller.scopeId is non-null.
+ * scopeAccessMatch(param) — 403 unless the URL's :scope is in caller.accessibleScopes.
+ *
+ * Cross-scope access is no longer grantable via admin:*. Admin keys are
+ * management-only — they pass scopeRequired but fail scopeAccessMatch
+ * unless their accessibleScopes list includes the requested scope.
  */
 import type { MiddlewareHandler } from 'hono';
 import type { SettingsStore } from './settings.js';
 export declare function scopeRequired(scope: string): MiddlewareHandler;
-export declare const tenantRequired: MiddlewareHandler;
-export declare function tenantParamMatch(paramName: string, settings?: SettingsStore): MiddlewareHandler;
+export declare const requireCallerScope: MiddlewareHandler;
+export declare function scopeAccessMatch(paramName: string, settings?: SettingsStore): MiddlewareHandler;

package/dist/scope.js

@@ -1,8 +1,13 @@
 /**
  * Scope-based route guards. Operate on the `caller` set by resolveCaller.
  *
- * scopeRequired(scope) — 403 unless caller has that scope or admin:*.
- * tenantRequired — 401 unless caller.tenantId is non-null.
+ * scopeRequired(scope) — 403 unless caller has that permission scope or admin:*.
+ * requireCallerScope — 401 unless caller.scopeId is non-null.
+ * scopeAccessMatch(param) — 403 unless the URL's :scope is in caller.accessibleScopes.
+ *
+ * Cross-scope access is no longer grantable via admin:*. Admin keys are
+ * management-only — they pass scopeRequired but fail scopeAccessMatch
+ * unless their accessibleScopes list includes the requested scope.
  */
 export function scopeRequired(scope) {
     return async (c, next) => {
@@ -15,31 +20,28 @@ export function scopeRequired(scope) {
         return c.json({ error: `Missing required scope: ${scope}` }, 403);
     };
 }
-export const tenantRequired = async (c, next) => {
+export const requireCallerScope = async (c, next) => {
     const caller = c.get('caller');
     if (!caller)
         return c.json({ error: 'Caller not resolved' }, 500);
-    if (!caller.tenantId)
-        return c.json({ error: 'Tenant-scoped credentials required' }, 401);
+    if (!caller.scopeId)
+        return c.json({ error: 'Scope-bound credentials required' }, 401);
     return next();
 };
-export function tenantParamMatch(paramName, settings) {
+export function scopeAccessMatch(paramName, settings) {
     return async (c, next) => {
-        // Open / no-auth mode: admin has explicitly disabled tenant isolation.
+        // Open / no-auth mode: admin has explicitly disabled scope isolation.
         // Mirrors sessionAuth's open-mode bypass; required for Tauri sidecar mode.
         if (settings && !settings.get().auth.required)
             return next();
         const caller = c.get('caller');
         if (!caller)
             return c.json({ error: 'Caller not resolved' }, 500);
-        if (caller.scopes.includes('admin:*'))
-            return next();
-        if (!caller.tenantId)
-            return c.json({ error: 'Tenant-scoped credentials required' }, 401);
         const requested = c.req.param(paramName);
-        if (caller.tenantId !== requested) {
-            return c.json({ error: `Caller tenant does not match :${paramName}` }, 403);
-        }
-        return next();
+        if (!requested)
+            return c.json({ error: `Missing :${paramName} param` }, 400);
+        if (caller.accessibleScopes.includes(requested))
+            return next();
+        return c.json({ error: `Caller is not a member of scope "${requested}"` }, 403);
     };
 }

package/dist/shard-router.js

@@ -2,7 +2,7 @@
 import { Hono } from 'hono';
 import { mkdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { scopeRequired, tenantRequired } from './scope.js';
+import { scopeRequired, requireCallerScope } from './scope.js';
 import { pathToFileURL } from 'node:url';
 /** Middleware requiring the caller's scope set to include admin:*. */
 export function adminOnly(_keys, settings) {
@@ -151,7 +151,7 @@ export class ShardRouter {
             permissions,
             adminOnly: adminOnly(ctx.keys, ctx.settings),
             scopeRequired,
-            tenantRequired,
+            tenantRequired: requireCallerScope,
             wsRegister: ctx.wsRegister,
             tenants: () => docStore.listTenantsSync(),
             documents: (tenant) => makeTenantDocumentAPI(docStore, tenant, shardId, permissions),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sh3-server",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "type": "module",
   "bin": {
     "sh3-server": "dist/cli.js"