From 508d698b281f078905891149c50eeaea6a1d25ad Mon Sep 17 00:00:00 2001
From: Neeraj Wahi <neeraj@retool.com>
Date: Tue, 10 Mar 2026 23:06:37 -0700
Subject: [PATCH 1/2] Add permissions support to registerModel

Allow callers to pass an optional `permissions` field to `registerModel`,
which gets forwarded to all 6 generated `rpc.register()` calls. This
enables restricting CRUD operations on registered Sequelize models to
specific groups or users.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 javascript/src/addons/sequelize.ts | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/javascript/src/addons/sequelize.ts b/javascript/src/addons/sequelize.ts
index 5c5f4c9..d02dd7c 100644
--- a/javascript/src/addons/sequelize.ts
+++ b/javascript/src/addons/sequelize.ts
@@ -7,6 +7,10 @@ type RegisterModelArgs = {
   readAttributes?: string[]
   writeAttributes?: string[]
   findByAttributes?: string[]
+  permissions?: {
+    groupNames?: string[]
+    userEmails?: string[]
+  }
 }
 
 export declare class MyMixinInterface {
@@ -35,6 +39,7 @@ function registerModel({
   readAttributes,
   writeAttributes,
   findByAttributes,
+  permissions,
 }: RegisterModelArgs & { rpc: RetoolRPC }) {
   const modelName = capitalize(model.name)
   // this will give us not just the name of the attribute, but also their type
@@ -57,6 +62,7 @@ function registerModel({
   rpc.register({
     name: `${modelName} > create`,
     arguments: writeAttributeArgs,
+    permissions,
     implementation: async (args) => {
       if (typeof args !== 'object' || Array.isArray(args)) {
         throw 'attributes must be an object'
@@ -76,6 +82,7 @@ function registerModel({
       primaryKey: { type: 'string', required: true },
       ...writeAttributeArgs,
     },
+    permissions,
     implementation: async ({ primaryKey, ...attributes }) => {
       return model.update(attributes, {
         where: {
@@ -91,6 +98,7 @@ function registerModel({
       findAttributes: { type: 'dict', required: true },
       ...writeAttributeArgs,
     },
+    permissions,
     implementation: async ({ findAttributes, ...writeAttributes }) => {
       // Note: this is susceptible to race condition if there is no unique index
       // on the find attributes. It's the user's responsibility to avoid
@@ -115,6 +123,7 @@ function registerModel({
       offset: { type: 'number' },
       limit: { type: 'number' },
     },
+    permissions,
     implementation: async ({ offset, limit }) => {
       return model.findAll({
         attributes: readAttributes,
@@ -130,6 +139,7 @@ function registerModel({
     arguments: {
       primaryKey: { type: 'string', required: true },
     },
+    permissions,
     implementation: async ({ primaryKey }) => {
       return model.findByPk(primaryKey, {
         attributes: readAttributes,
@@ -141,6 +151,7 @@ function registerModel({
   rpc.register({
     name: `${modelName} > findBy`,
     arguments: findByAttributeArgs,
+    permissions,
     implementation: async (attributesValues) => {
       return model.findAll({
         where: attributesValues,

From 780b47c265da9e1e51b06f42fe1e8b1f55f7d532 Mon Sep 17 00:00:00 2001
From: Neeraj Wahi <neeraj@retool.com>
Date: Tue, 10 Mar 2026 23:32:23 -0700
Subject: [PATCH 2/2] Bump Version to 0.1.8

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 javascript/package.json   | 2 +-
 javascript/src/version.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/javascript/package.json b/javascript/package.json
index 78424e2..c1d32b8 100644
--- a/javascript/package.json
+++ b/javascript/package.json
@@ -1,6 +1,6 @@
 {
   "name": "retoolrpc",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "TypeScript package for Retool RPC",
   "keywords": [],
   "homepage": "https://github.com/tryretool/retoolrpc#readme",
diff --git a/javascript/src/version.ts b/javascript/src/version.ts
index ab5620c..be8575a 100644
--- a/javascript/src/version.ts
+++ b/javascript/src/version.ts
@@ -1 +1 @@
-export const RetoolRPCVersion = '0.1.7'
+export const RetoolRPCVersion = '0.1.8'