tina4-nodejs 3.13.104 → 3.13.108

package/types/core/src/router.d.ts

@@ -17,6 +17,8 @@ interface MatchResult {
     secure?: boolean;
     cached?: boolean;
     noAuth?: boolean;
+    requiredRoles?: string[][];
+    requiredPerms?: string[][];
 }
 interface CompiledRoute {
     pattern: string;
@@ -36,6 +38,9 @@ interface CompiledRoute {
     }>;
     cacheTtl?: number;
     template?: string;
+    /** RBAC guard groups (Feature 138): OR within a group, AND across groups. */
+    requiredRoles?: string[][];
+    requiredPerms?: string[][];
 }
 /**
  * Thin reference to a registered WebSocket route, enabling chained modifiers
@@ -63,6 +68,17 @@ export declare class RouteRef {
     secure(): this;
     /** Opt out of secure-by-default auth (for public write routes). */
     noAuth(): this;
+    /**
+     * RBAC: require ONE of the named roles (OR). Reads the verified JWT `roles`
+     * claim. Chain .role()/.can() for AND. Implies auth. Feature 138 / ADR-0058.
+     */
+    role(...names: string[]): this;
+    /**
+     * RBAC: require ONE of the named permissions (OR). Reads the verified JWT
+     * `permissions` claim; granted-side wildcards (`posts.*`, `*`) satisfy a
+     * concrete requirement. Chain for AND. Implies auth. Feature 138.
+     */
+    can(...permissions: string[]): this;
     /** Mark this route's response as cacheable. */
     cache(): this;
     /**

package/types/core/src/types.d.ts

@@ -146,6 +146,10 @@ export interface RouteDefinition {
     cached?: boolean;
     /** Opt out of secure-by-default auth on write routes */
     noAuth?: boolean;
+    /** RBAC role guard groups (Feature 138): OR within a group, AND across groups */
+    requiredRoles?: string[][];
+    /** RBAC permission guard groups (Feature 138) */
+    requiredPerms?: string[][];
 }
 export interface RouteMeta {
     summary?: string;

package/types/orm/src/baseModel.d.ts

@@ -339,11 +339,16 @@ export declare class BaseModel {
     /**
      * Invalidate every cached query that touches this model's table.
      *
-     * Tag-scoped, NOT a wholesale flush: a cached JOIN on another model that reads
-     * this table is busted too (it carries this table's tag), while a query that
-     * never touches this table is left intact. Called after every ORM write
-     * (save/delete/forceDelete/restore) so a read-after-write never serves a
-     * stale/deleted row (CACHE-DEC-01).
+     * Tag-scoped in the ORM layer (a cached JOIN on another model that reads
+     * this table is busted too because it carries this table's tag; a query
+     * that never touches this table is left intact), then cascaded to the
+     * DB layer on this model's bound connection so an out-of-band write /
+     * deliberate refresh / race-with-another-process cannot leave stale rows
+     * in db.fetch()'s persistent cache. Called after every ORM write
+     * (save/delete/forceDelete/restore) so a read-after-write never serves
+     * a stale/deleted row (CACHE-DEC-01). PY-06-22 (3.13.105) added the
+     * DB-layer cascade -- previously the two cache layers disagreed under
+     * TINA4_AUTO_CACHING=true + TINA4_DB_CACHE=true.
      */
     static clearCache(): void;
     /**