velocious 1.0.445 → 1.0.447

package/src/frontend-models/preloader.js

@@ -15,7 +15,7 @@ export default class FrontendModelPreloader {
   /**
    * Runs preload.
    * @param {Array<import("./base.js").default>} models - Frontend model instances to preload onto.
-   * @param {import("./query.js").default<typeof import("./base.js").default> | import("../database/query/index.js").NestedPreloadRecord | string | Array<string | import("../database/query/index.js").NestedPreloadRecord>} queryOrSpec - A query built via `Model.preload(...).select(...)`, or a raw preload spec.
+   * @param {import("./query.js").default<import("./base.js").FrontendModelClass> | import("../database/query/index.js").NestedPreloadRecord | string | Array<string | import("../database/query/index.js").NestedPreloadRecord>} queryOrSpec - A query built via `Model.preload(...).select(...)`, or a raw preload spec.
    * @param {{force?: boolean}} [options] - Options.
    * @returns {Promise<void>} - Resolves when preloading completes.
    */
@@ -24,12 +24,12 @@ export default class FrontendModelPreloader {
 
     const modelClass = /**
                         * Narrows the runtime value to the documented type.
-                         @type {typeof import("./base.js").default} */ (models[0].constructor)
+                         @type {import("./base.js").FrontendModelClass} */ (models[0].constructor)
     const isQuery = Boolean(queryOrSpec) && typeof queryOrSpec === "object" && "_preload" in queryOrSpec
     const query = isQuery
       ? /**
          * Narrows the runtime value to the documented type.
-          @type {import("./query.js").default<typeof import("./base.js").default>} */ (queryOrSpec)
+          @type {import("./query.js").default<import("./base.js").FrontendModelClass>} */ (queryOrSpec)
       : modelClass.preload(/**
                             * Narrows the runtime value to the documented type.
                              @type {?} */ (queryOrSpec))
@@ -85,10 +85,10 @@ export default class FrontendModelPreloader {
   /**
    * Runs model needs reload.
    * @param {object} args - Options object.
-   * @param {typeof import("./base.js").default} args.modelClass - Model class the preload graph is rooted at.
+   * @param {import("./base.js").FrontendModelClass} args.modelClass - Model class the preload graph is rooted at.
    * @param {import("./base.js").default} args.model - Model instance.
    * @param {import("../database/query/index.js").NestedPreloadRecord} args.preload - Preload sub-graph to satisfy.
-   * @param {import("./query.js").default<typeof import("./base.js").default>} args.query - Source query carrying select/selectsExtra.
+   * @param {import("./query.js").default<import("./base.js").FrontendModelClass>} args.query - Source query carrying select/selectsExtra.
    * @param {boolean} args.force - Whether to reload regardless of cached state.
    * @returns {boolean} - Whether the model needs a reload request.
    */
@@ -110,11 +110,11 @@ export default class FrontendModelPreloader {
    * client-unknown default attributes plus the extras), so it always reloads.
    * With no select and no nested preload, being preloaded is enough.
    * @param {object} args - Options object.
-   * @param {typeof import("./base.js").default} args.modelClass - Model class owning the relationship.
+   * @param {import("./base.js").FrontendModelClass} args.modelClass - Model class owning the relationship.
    * @param {import("./base.js").default} args.model - Model instance.
    * @param {string} args.relationshipName - Relationship name.
    * @param {import("../database/query/index.js").NestedPreloadRecord[string]} args.subPreload - Preload value for this relationship (`true` or a nested record).
-   * @param {import("./query.js").default<typeof import("./base.js").default>} args.query - Source query carrying select/selectsExtra.
+   * @param {import("./query.js").default<import("./base.js").FrontendModelClass>} args.query - Source query carrying select/selectsExtra.
    * @returns {boolean} - Whether the relationship is already satisfied.
    */
   static _relationshipSatisfied({modelClass, model, relationshipName, subPreload, query}) {

package/src/frontend-models/query.js

@@ -37,11 +37,11 @@ import isPlainObject from "../utils/plain-object.js"
  */
 /**
  * Defines this typedef.
- * @typedef {FrontendModelProjectionOptions & {query?: FrontendModelQuery<typeof import("./base.js").default>}} FrontendModelEventOptionsObject
+ * @typedef {FrontendModelProjectionOptions & {query?: FrontendModelQuery<import("./base.js").FrontendModelClass>}} FrontendModelEventOptionsObject
  */
 /**
  * FrontendModelEventOptions type.
- * @typedef {FrontendModelEventOptionsObject | FrontendModelQuery<typeof import("./base.js").default>} FrontendModelEventOptions
+ * @typedef {FrontendModelEventOptionsObject | FrontendModelQuery<import("./base.js").FrontendModelClass>} FrontendModelEventOptions
  */
 /**
  * FrontendModelProjectionPayload type.
@@ -955,7 +955,7 @@ export function normalizePluck(pluck) {
 
 /**
  * Runs frontend model resource attributes.
- * @param {typeof import("./base.js").default} modelClass - Model class.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Model class.
  * @returns {Set<string>} - Resource attribute names.
  */
 function frontendModelResourceAttributes(modelClass) {
@@ -977,9 +977,9 @@ function frontendModelResourceAttributes(modelClass) {
 
 /**
  * Runs frontend model pluck target model class.
- * @param {typeof import("./base.js").default} modelClass - Root model class.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Root model class.
  * @param {string[]} path - Relationship path.
- * @returns {typeof import("./base.js").default} - Target model class for path.
+ * @returns {import("./base.js").FrontendModelClass} - Target model class for path.
  */
 function frontendModelPluckTargetModelClass(modelClass, path) {
   let targetModelClass = modelClass
@@ -1011,7 +1011,7 @@ function frontendModelPluckTargetModelClass(modelClass, path) {
 /**
  * Runs validate pluck definitions.
  * @param {object} args - Pluck validation args.
- * @param {typeof import("./base.js").default} args.modelClass - Root model class.
+ * @param {import("./base.js").FrontendModelClass} args.modelClass - Root model class.
  * @param {FrontendModelPluck[]} args.pluck - Pluck descriptors.
  * @returns {FrontendModelPluck[]} - Validated pluck descriptors.
  */
@@ -1075,7 +1075,7 @@ function reverseSortDirection(direction) {
 
 /**
  * Query wrapper for frontend model commands.
- * @template {typeof import("./base.js").default} T
+ * @template {import("./base.js").FrontendModelClass} T
  */
 export default class FrontendModelQuery {
   /**
@@ -2145,7 +2145,7 @@ function frontendModelEventFilterKey(payload) {
 
 /**
  * Runs apply frontend model projection options.
- * @param {FrontendModelQuery<typeof import("./base.js").default>} query - Query receiving projection options.
+ * @param {FrontendModelQuery<import("./base.js").FrontendModelClass>} query - Query receiving projection options.
  * @param {FrontendModelProjectionOptions} options - Projection options.
  * @returns {void}
  */
@@ -2160,8 +2160,8 @@ function applyFrontendModelProjectionOptions(query, options) {
 
 /**
  * Runs assert frontend model event query class.
- * @param {typeof import("./base.js").default} modelClass - Expected frontend model class.
- * @param {FrontendModelQuery<typeof import("./base.js").default>} query - Event query.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Expected frontend model class.
+ * @param {FrontendModelQuery<import("./base.js").FrontendModelClass>} query - Event query.
  * @returns {void}
  */
 function assertFrontendModelEventQueryClass(modelClass, query) {
@@ -2183,9 +2183,9 @@ function assertFrontendModelEventOptionsObject(options) {
 
 /**
  * Runs cloned frontend model event query.
- * @param {typeof import("./base.js").default} modelClass - Frontend model class.
- * @param {FrontendModelQuery<typeof import("./base.js").default>} query - Event query.
- * @returns {FrontendModelQuery<typeof import("./base.js").default>} - Cloned query used by event subscriptions.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Frontend model class.
+ * @param {FrontendModelQuery<import("./base.js").FrontendModelClass>} query - Event query.
+ * @returns {FrontendModelQuery<import("./base.js").FrontendModelClass>} - Cloned query used by event subscriptions.
  */
 function clonedFrontendModelEventQuery(modelClass, query) {
   assertFrontendModelEventQueryClass(modelClass, query)
@@ -2195,9 +2195,9 @@ function clonedFrontendModelEventQuery(modelClass, query) {
 
 /**
  * Runs frontend model event query from options object.
- * @param {typeof import("./base.js").default} modelClass - Frontend model class.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Frontend model class.
  * @param {FrontendModelEventOptionsObject} options - Event options object.
- * @returns {FrontendModelQuery<typeof import("./base.js").default>} - Query used by event subscriptions.
+ * @returns {FrontendModelQuery<import("./base.js").FrontendModelClass>} - Query used by event subscriptions.
  */
 function frontendModelEventQueryFromOptionsObject(modelClass, options) {
   if (options.query !== undefined && !(options.query instanceof FrontendModelQuery)) {
@@ -2215,9 +2215,9 @@ function frontendModelEventQueryFromOptionsObject(modelClass, options) {
 
 /**
  * Runs frontend model event query.
- * @param {typeof import("./base.js").default} modelClass - Frontend model class.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Frontend model class.
  * @param {FrontendModelEventOptions} [options] - Event query or projection options.
- * @returns {FrontendModelQuery<typeof import("./base.js").default>} - Normalized query used by event subscriptions.
+ * @returns {FrontendModelQuery<import("./base.js").FrontendModelClass>} - Normalized query used by event subscriptions.
  */
 function frontendModelEventQuery(modelClass, options = {}) {
   if (options instanceof FrontendModelQuery) return clonedFrontendModelEventQuery(modelClass, options)
@@ -2236,7 +2236,7 @@ function frontendModelEventQuery(modelClass, options = {}) {
 
 /**
  * Runs the frontendModelEventOptionsPayload helper.
- * @param {typeof import("./base.js").default} modelClass - Frontend model class.
+ * @param {import("./base.js").FrontendModelClass} modelClass - Frontend model class.
  * @param {FrontendModelEventOptions} [options] - Event query or projection options.
  * @returns {FrontendModelEventOptionsPayload} - Normalized event subscription payload.
  */

package/src/frontend-models/use-created-event.js

@@ -2,7 +2,7 @@
 
 import useModelClassEvent from "./use-model-class-event.js"
 
-/** @typedef {typeof import("./base.js").default} FrontendModelClass */
+/** @typedef {import("./base.js").FrontendModelClass} FrontendModelClass */
 /** @typedef {import("./use-model-class-event.js").FrontendModelCreateUpdateEventPayload} FrontendModelCreateEventPayload */
 /** @typedef {import("./use-model-class-event.js").UseModelClassEventOptions} UseCreatedEventOptions */
 /** @typedef {(payload: FrontendModelCreateEventPayload) => void} FrontendModelCreateEventCallback */

package/src/frontend-models/use-destroyed-event.js

@@ -9,7 +9,7 @@ import useModelClassEvent from "./use-model-class-event.js"
 
 /**
  * FrontendModelClass type.
-  @typedef {typeof import("./base.js").default} FrontendModelClass */
+  @typedef {import("./base.js").FrontendModelClass} FrontendModelClass */
 /**
  * FrontendModelInstance type.
   @typedef {import("./base.js").default} FrontendModelInstance */

package/src/frontend-models/use-model-class-event.js

@@ -7,7 +7,7 @@ import clearPendingDebouncedCallback from "./clear-pending-debounced-callback.js
 
 /**
  * FrontendModelClass type.
-  @typedef {typeof import("./base.js").default} FrontendModelClass */
+  @typedef {import("./base.js").FrontendModelClass} FrontendModelClass */
 /**
  * FrontendModelInstance type.
   @typedef {InstanceType<FrontendModelClass>} FrontendModelInstance */

package/src/frontend-models/use-updated-event.js

@@ -9,7 +9,7 @@ import useModelClassEvent from "./use-model-class-event.js"
 
 /**
  * FrontendModelClass type.
-  @typedef {typeof import("./base.js").default} FrontendModelClass */
+  @typedef {import("./base.js").FrontendModelClass} FrontendModelClass */
 /**
  * FrontendModelInstance type.
   @typedef {import("./base.js").default} FrontendModelInstance */

package/src/frontend-models/websocket-channel.js

@@ -61,7 +61,11 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
     if (!ModelClass) return false
 
     const ability = await configuration.resolveAbility?.({
-      params: {model: modelName},
+      // Forward the subscriber's params (e.g. authenticationToken) so token-authenticated clients
+      // resolve the same ability they would over HTTP. Without this only session/cookie auth on the
+      // upgrade request works, and param-based auth (like a scanner passing an authenticationToken)
+      // is dropped — leaving such subscribers with a guest ability and no read rule.
+      params: {...this.params, model: modelName},
       request: /**
                 * Narrows the runtime value to the documented type.
                  @type {import("../http-server/client/request.js").default} */ (this._syntheticRequest()),
@@ -116,6 +120,15 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
     const hasEventFilters = this._hasEventFilterParams()
 
     if (!this._hasProjectionParams() && !hasEventFilters) {
+      // Even unfiltered subscriptions must respect the subscriber's ability. A create/update carries
+      // the record, so only deliver it when the record is within the authenticated ability's scope.
+      // Destroys (and bodies without a usable id) carry no record, so pass them through unchanged.
+      if (body && typeof body === "object" && (body.action === "create" || body.action === "update") && body.id !== undefined && body.id !== null) {
+        const FrontendModelController = await this._frontendModelControllerClass()
+
+        if (!await this._eventIsAccessible(body.id, FrontendModelController)) return
+      }
+
       this.sendMessage(body, meta)
       return
     }
@@ -343,6 +356,25 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
     return controller
   }
 
+  /**
+   * Whether the broadcast record is within the subscriber's authenticated ability scope. Used to gate
+   * unfiltered/unprojected create/update delivery so a scoped token never receives a record it cannot read.
+   * @param {string | number} id - Event record id.
+   * @param {typeof import("../frontend-model-controller.js").default} FrontendModelController - Server-side frontend-model controller class.
+   * @returns {Promise<boolean>} True when the record is readable by this subscription.
+   */
+  async _eventIsAccessible(id, FrontendModelController) {
+    const controller = this._frontendModelController(FrontendModelController)
+
+    await controller.ensureFrontendModelClassInitialized()
+
+    const ModelClass = controller.frontendModelClass()
+    const primaryKey = ModelClass.primaryKey()
+    const query = controller.frontendModelAuthorizedQuery("find").where({[ModelClass.tableName()]: {[primaryKey]: id}})
+
+    return Boolean(await query.first())
+  }
+
   /**
    * Runs matched event filter keys for event id.
    * @param {string | number} id - Event record id.
@@ -389,7 +421,9 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
     const primaryKey = ModelClass.primaryKey()
     const where = controller.frontendModelWhere()
     const joins = controller.frontendModelJoins()
-    let query = ModelClass.where({[ModelClass.tableName()]: {[primaryKey]: id}})
+    // Start from the subscriber's authorized scope so a filter can only ever match records the
+    // subscription's ability permits to read.
+    let query = controller.frontendModelAuthorizedQuery("find").where({[ModelClass.tableName()]: {[primaryKey]: id}})
 
     if (where) controller.applyFrontendModelWhere({query, where})
     if (joins) controller.applyFrontendModelJoins({joins, query})
@@ -414,7 +448,9 @@ export default class FrontendModelWebsocketChannel extends VelociousWebsocketCha
 
     const ModelClass = controller.frontendModelClass()
     const primaryKey = ModelClass.primaryKey()
-    let query = ModelClass.where({[ModelClass.tableName()]: {[primaryKey]: id}})
+    // Reload through the subscriber's authorized scope so projected records are only ever sent for
+    // rows the subscription's ability permits to read.
+    let query = controller.frontendModelAuthorizedQuery("find").where({[ModelClass.tableName()]: {[primaryKey]: id}})
     const preload = controller.frontendModelPreload()
 
     if (preload) query = query.preload(preload)

package/src/routes/resolver.js

@@ -120,9 +120,9 @@ export default class VelociousRoutesResolver {
     }
 
     const routeResolverHookMatch = await this.resolveRouteResolverHooks(currentPath, {hasMatchingCustomRoute})
-    const skipControllerConnections = routeResolverHookMatch?.skipControllerConnections === true
-    const skipAbilityResolution = routeResolverHookMatch?.skipAbilityResolution === true
-    const skipTenantResolution = routeResolverHookMatch?.skipTenantResolution === true
+    let skipControllerConnections = routeResolverHookMatch?.skipControllerConnections === true
+    let skipAbilityResolution = routeResolverHookMatch?.skipAbilityResolution === true
+    let skipTenantResolution = routeResolverHookMatch?.skipTenantResolution === true
     const matchResult = routeResolverHookMatch || !currentRoute ? undefined : this.matchPathWithRoutes(currentRoute, currentPath)
     const actionParam = this.params.action
     const controllerParam = this.params.controller
@@ -151,21 +151,24 @@ export default class VelociousRoutesResolver {
       viewPath = routeHookViewPath || `${this.configuration.getDirectory()}/src/routes/${controller}`
       this.routeHookControllerClass = routeHookControllerClass
     } else if (!matchResult) {
-        const __filename = fileURLToPath(import.meta.url)
-        const __dirname = dirname(__filename)
-        const requestedPath = currentPath.replace(/^\//, "") || "_root"
-        const attemptedControllerPath = `${this.configuration.getDirectory()}/src/routes/${requestedPath}/controller.js`
+      const __filename = fileURLToPath(import.meta.url)
+      const __dirname = dirname(__filename)
+      const requestedPath = currentPath.replace(/^\//, "") || "_root"
+      const attemptedControllerPath = `${this.configuration.getDirectory()}/src/routes/${requestedPath}/controller.js`
 
-        const logger = this.logger
+      const logger = this.logger
 
-        if (!logger) throw new Error("Logger not initialized")
+      if (!logger) throw new Error("Logger not initialized")
 
-        await logger.warn(`No route matched for ${rawPath}. Tried controller at ${attemptedControllerPath}`)
+      await logger.warn(`No route matched for ${rawPath}. Tried controller at ${attemptedControllerPath}`)
 
-        controller = "errors"
-        controllerPath = "./built-in/errors/controller.js"
-        action = "notFound"
-        viewPath = await fs.realpath(`${__dirname}/built-in/errors`)
+      controller = "errors"
+      controllerPath = "./built-in/errors/controller.js"
+      action = "notFound"
+      skipAbilityResolution = true
+      skipControllerConnections = true
+      skipTenantResolution = true
+      viewPath = await fs.realpath(`${__dirname}/built-in/errors`)
     } else if (action) {
       if (!controller) controller = "_root"
 

package/src/utils/model-scope.js

@@ -7,7 +7,7 @@ const MODEL_SCOPE_DESCRIPTOR_MARKER = "velociousModelScopeDescriptor"
  * @typedef {object} ModelScopeDescriptor
  * @property {true} [velociousModelScopeDescriptor] - Internal marker.
  * @property {(...args: Array<?>) => ?} callback - Scope callback.
- * @property {typeof import("../database/record/index.js").default | typeof import("../frontend-models/base.js").default} modelClass - Owning model class.
+ * @property {typeof import("../database/record/index.js").default | import("../frontend-models/base.js").FrontendModelClass} modelClass - Owning model class.
  * @property {Array<?>} scopeArgs - Scope arguments.
  */
 
@@ -15,7 +15,7 @@ const MODEL_SCOPE_DESCRIPTOR_MARKER = "velociousModelScopeDescriptor"
  * Runs the defineModelScope helper.
  * @param {object} args - Definition arguments.
  * @param {(...args: Array<?>) => ?} args.callback - Scope callback.
- * @param {typeof import("../database/record/index.js").default | typeof import("../frontend-models/base.js").default} args.modelClass - Owning model class.
+ * @param {typeof import("../database/record/index.js").default | import("../frontend-models/base.js").FrontendModelClass} args.modelClass - Owning model class.
  * @param {() => ?} args.startQuery - Factory that returns a fresh query for the owning model class.
  * @returns {((...args: Array<?>) => ?) & {scope: (...args: Array<?>) => ModelScopeDescriptor}} - Scope helper.
  */

package/src/utils/ransack.js

@@ -16,7 +16,7 @@ import {resolveFrontendModelClass} from "../frontend-models/model-registry.js"
 
 /**
  * RansackModelClass type.
- * @typedef {typeof import("../database/record/index.js").default | typeof import("../frontend-models/base.js").default} RansackModelClass
+ * @typedef {typeof import("../database/record/index.js").default | import("../frontend-models/base.js").FrontendModelClass} RansackModelClass
  */
 
 /**