/// <reference path="../pb_data/types.d.ts" />

// PocketBase's declarative API rules act as row-level filters for the
// "list"/"search" action: an unsatisfiable listRule (e.g. requiring auth)
// still returns 200 with an empty result set rather than an error, because
// the rule is just a SQL WHERE clause under the hood. See
// https://github.com/pocketbase/pocketbase/discussions/6492
//
// Bookshelf is a private, two-person library — no anonymous caller should
// ever get a 200 back from these endpoints, even an empty one, since some
// HTTP/JS clients treat "200 with []" as a successful, allowed request.
// This hook makes that explicit: anonymous list/search requests against the
// three app collections are rejected with 403, matching create/update/
// view/delete (which already 400/404 for unauthenticated callers via the
// declarative rules alone).
onRecordsListRequest((e) => {
  if (!e.auth) {
    throw new ForbiddenError("Authentication required.");
  }
  e.next();
}, "bookcases", "shelves", "books");