fix(handler): add operation type to hook context

* Add ShouldSkipRowSecurity function to determine when to bypass row security
* Update ApplyRowSecurity to utilize operation context for enforcement

pkg/resolvespec/handler.go

@@ -311,6 +311,7 @@ func (h *Handler) handleRead(ctx context.Context, w common.ResponseWriter, id st
 			Schema:    schema,
 			Entity:    entity,
 			Model:     model,
+			Operation: "read",
 			Options:   options,
 			ID:        id,
 			Writer:    w,
@@ -727,6 +728,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 					Schema:    schema,
 					Entity:    entity,
 					Model:     model,
+					Operation: "create",
 					Options:   options,
 					Data:      v,
 					Writer:    w,
@@ -774,6 +776,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 				Schema:    schema,
 				Entity:    entity,
 				Model:     model,
+				Operation: "create",
 				Options:   options,
 				Data:      v,
 				Writer:    w,
@@ -856,6 +859,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 						Schema:    schema,
 						Entity:    entity,
 						Model:     model,
+						Operation: "create",
 						Options:   options,
 						Data:      item,
 						Writer:    w,
@@ -903,6 +907,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 					Schema:    schema,
 					Entity:    entity,
 					Model:     model,
+					Operation: "create",
 					Options:   options,
 					Data:      item,
 					Writer:    w,
@@ -987,6 +992,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 							Schema:    schema,
 							Entity:    entity,
 							Model:     model,
+							Operation: "create",
 							Options:   options,
 							Data:      itemMap,
 							Writer:    w,
@@ -1040,6 +1046,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 					Schema:    schema,
 					Entity:    entity,
 					Model:     model,
+					Operation: "create",
 					Options:   options,
 					Data:      itemMap,
 					Writer:    w,
@@ -1171,6 +1178,7 @@ func (h *Handler) handleUpdate(ctx context.Context, w common.ResponseWriter, url
 				Schema:    schema,
 				Entity:    entity,
 				Model:     model,
+				Operation: "update",
 				Options:   options,
 				ID:        urlID,
 				Data:      updates,
@@ -1392,6 +1400,7 @@ func (h *Handler) handleUpdate(ctx context.Context, w common.ResponseWriter, url
 						Schema:    schema,
 						Entity:    entity,
 						Model:     model,
+						Operation: "update",
 						Options:   options,
 						ID:        itemIDStr,
 						Data:      item,
@@ -1548,6 +1557,7 @@ func (h *Handler) handleUpdate(ctx context.Context, w common.ResponseWriter, url
 							Schema:    schema,
 							Entity:    entity,
 							Model:     model,
+							Operation: "update",
 							Options:   options,
 							ID:        itemIDStr,
 							Data:      itemMap,
@@ -1653,6 +1663,7 @@ func (h *Handler) handleDelete(ctx context.Context, w common.ResponseWriter, id
 		Schema:    schema,
 		Entity:    entity,
 		Model:     model,
+		Operation: "delete",
 		ID:        id,
 		Data:      data,
 		Writer:    w,

pkg/resolvespec/security_hooks.go

@@ -25,12 +25,18 @@ func RegisterSecurityHooks(handler *Handler, securityList *security.SecurityList
 	// Hook 1: BeforeRead - Load security rules
 	handler.Hooks().Register(BeforeRead, func(hookCtx *HookContext) error {
 		secCtx := newSecurityContext(hookCtx)
+		if security.IsModelSecurityDisabled(secCtx) {
+			return nil
+		}
 		return security.LoadSecurityRules(secCtx, securityList)
 	})
 
 	// Hook 2: BeforeScan - Apply row-level security filters
 	handler.Hooks().Register(BeforeScan, func(hookCtx *HookContext) error {
 		secCtx := newSecurityContext(hookCtx)
+		if security.ShouldSkipRowSecurity(secCtx, hookCtx.Operation) {
+			return nil
+		}
 		return security.ApplyRowSecurity(secCtx, securityList)
 	})
 
@@ -97,6 +103,10 @@ func (s *securityContext) GetEntity() string {
 	return s.ctx.Entity
 }
 
+func (s *securityContext) GetOperation() string {
+	return s.ctx.Operation
+}
+
 func (s *securityContext) GetModel() interface{} {
 	return s.ctx.Model
 }

pkg/restheadspec/handler.go

@@ -379,6 +379,7 @@ func (h *Handler) handleRead(ctx context.Context, w common.ResponseWriter, id st
 		Entity:    entity,
 		TableName: tableName,
 		Model:     model,
+		Operation: "read",
 		Options:   options,
 		ID:        id,
 		Writer:    w,
@@ -1236,6 +1237,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 		Entity:    entity,
 		TableName: tableName,
 		Model:     model,
+		Operation: "create",
 		Options:   options,
 		Data:      data,
 		Writer:    w,
@@ -1335,6 +1337,7 @@ func (h *Handler) handleCreate(ctx context.Context, w common.ResponseWriter, dat
 				Entity:    entity,
 				TableName: tableName,
 				Model:     model,
+				Operation: "create",
 				Options:   options,
 				Data:      modelValue,
 				Writer:    w,
@@ -1489,6 +1492,7 @@ func (h *Handler) handleUpdate(ctx context.Context, w common.ResponseWriter, id
 			TableName: tableName,
 			Tx:        tx,
 			Model:     model,
+			Operation: "update",
 			Options:   options,
 			ID:        id,
 			Data:      dataMap,
@@ -1686,6 +1690,7 @@ func (h *Handler) handleDelete(ctx context.Context, w common.ResponseWriter, id
 						Entity:    entity,
 						TableName: tableName,
 						Model:     model,
+						Operation: "delete",
 						ID:        itemID,
 						Writer:    w,
 						Tx:        tx,
@@ -1760,6 +1765,7 @@ func (h *Handler) handleDelete(ctx context.Context, w common.ResponseWriter, id
 						Entity:    entity,
 						TableName: tableName,
 						Model:     model,
+						Operation: "delete",
 						ID:        itemIDStr,
 						Writer:    w,
 						Tx:        tx,
@@ -1818,6 +1824,7 @@ func (h *Handler) handleDelete(ctx context.Context, w common.ResponseWriter, id
 							Entity:    entity,
 							TableName: tableName,
 							Model:     model,
+							Operation: "delete",
 							ID:        itemIDStr,
 							Writer:    w,
 							Tx:        tx,
@@ -1902,6 +1909,7 @@ func (h *Handler) handleDelete(ctx context.Context, w common.ResponseWriter, id
 		Entity:    entity,
 		TableName: tableName,
 		Model:     model,
+		Operation: "delete",
 		ID:        id,
 		Writer:    w,
 		Tx:        h.db,

pkg/security/hooks.go

@@ -232,9 +232,37 @@ func LoadSecurityRules(secCtx SecurityContext, securityList *SecurityList) error
 // ApplyRowSecurity is a public wrapper for applyRowSecurity that accepts a SecurityContext
 // This allows other packages to apply row-level security using the generic interface
 func ApplyRowSecurity(secCtx SecurityContext, securityList *SecurityList) error {
+	// Spec adapters that expose the dispatched operation can enforce the same
+	// model-rule bypass even when ApplyRowSecurity is called directly.
+	if operationCtx, ok := secCtx.(interface{ GetOperation() string }); ok &&
+		ShouldSkipRowSecurity(secCtx, operationCtx.GetOperation()) {
+		return nil
+	}
 	return applyRowSecurity(secCtx, securityList)
 }
 
+// ShouldSkipRowSecurity reports whether row-security enforcement should be
+// skipped for the operation. It uses the same model-rule resolution as
+// CheckModelAuthAllowed so the model registry remains the single source of
+// truth for security behavior.
+func ShouldSkipRowSecurity(secCtx SecurityContext, operation string) bool {
+	rules, ok := resolveModelRules(secCtx)
+	if !ok {
+		return false
+	}
+
+	return rules.SecurityDisabled || (operation == "read" && rules.CanPublicRead)
+}
+
+// IsModelSecurityDisabled reports whether all model-level security processing
+// is disabled for the model. This is distinct from ShouldSkipRowSecurity:
+// CanPublicRead skips row filtering for reads but must still allow other read
+// security, such as column masking, to be loaded.
+func IsModelSecurityDisabled(secCtx SecurityContext) bool {
+	rules, ok := resolveModelRules(secCtx)
+	return ok && rules.SecurityDisabled
+}
+
 // ApplyColumnSecurity is a public wrapper for applyColumnSecurity that accepts a SecurityContext
 // This allows other packages to apply column-level security using the generic interface
 func ApplyColumnSecurity(secCtx SecurityContext, securityList *SecurityList) error {
@@ -303,18 +331,8 @@ func checkModelDeleteAllowed(secCtx SecurityContext) error {
 //  7. Guest (UserID == 0) → return "authentication required".
 //  8. Authenticated user → allow (operation-specific checks remain in BeforeUpdate/BeforeDelete).
 func CheckModelAuthAllowed(secCtx SecurityContext, operation string) error {
-	rules, ok := GetModelRulesFromContext(secCtx.GetContext())
+	rules, ok := resolveModelRules(secCtx)
 	if !ok {
-		schema := secCtx.GetSchema()
-		entity := secCtx.GetEntity()
-		var err error
-		if schema != "" {
-			rules, err = modelregistry.GetModelRulesByName(fmt.Sprintf("%s.%s", schema, entity))
-		}
-		if err != nil || schema == "" {
-			rules, err = modelregistry.GetModelRulesByName(entity)
-		}
-		if err != nil {
 		// Model not registered - fall through to auth check
 		userID, _ := secCtx.GetUserID()
 		if userID == 0 {
@@ -322,7 +340,6 @@ func CheckModelAuthAllowed(secCtx SecurityContext, operation string) error {
 		}
 		return nil
 	}
-	}
 
 	if rules.SecurityDisabled {
 		return nil
@@ -347,6 +364,31 @@ func CheckModelAuthAllowed(secCtx SecurityContext, operation string) error {
 	return nil
 }
 
+// resolveModelRules returns model rules from the request context first, then
+// falls back to the schema-qualified and unqualified registry names.
+func resolveModelRules(secCtx SecurityContext) (modelregistry.ModelRules, bool) {
+	if rules, ok := GetModelRulesFromContext(secCtx.GetContext()); ok {
+		return rules, true
+	}
+
+	schema := secCtx.GetSchema()
+	entity := secCtx.GetEntity()
+	var err error
+	if schema != "" {
+		var rules modelregistry.ModelRules
+		rules, err = modelregistry.GetModelRulesByName(fmt.Sprintf("%s.%s", schema, entity))
+		if err == nil {
+			return rules, true
+		}
+	}
+
+	rules, err := modelregistry.GetModelRulesByName(entity)
+	if err != nil {
+		return modelregistry.ModelRules{}, false
+	}
+	return rules, true
+}
+
 // CheckModelUpdateAllowed is the public wrapper for checkModelUpdateAllowed.
 func CheckModelUpdateAllowed(secCtx SecurityContext) error {
 	return checkModelUpdateAllowed(secCtx)

pkg/server/quickproxy/quickproxy.go

@@ -26,6 +26,17 @@ type Rule struct {
 	// The incoming request path and query are forwarded unchanged; only the
 	// scheme and host are rewritten to Target's.
 	Target string
+
+	// Exclude is a list of URL path prefixes that this rule should not
+	// proxy, even though they fall under URLPrefix. Each entry is a full
+	// path from root and must itself start with URLPrefix (e.g. rule
+	// URLPrefix "/api" excluding a subpath must use "/api/health", not
+	// "/health"). A request matching an Exclude prefix is treated as if
+	// this rule didn't match at all: matching continues against any other
+	// configured rule, falling back if none match. This is typically used
+	// to carve out paths (e.g. "/health") from a catch-all "/" rule so
+	// they're served by the fallback handler instead of being proxied.
+	Exclude []string
 }
 
 // DefaultTimeout is the dial and response-header timeout applied to
@@ -51,9 +62,20 @@ func WithTimeout(d time.Duration) Option {
 // compiledRule pairs a Rule with its ready-to-use reverse proxy.
 type compiledRule struct {
 	prefix   string
+	excludes []string
 	proxy    *httputil.ReverseProxy
 }
 
+// excluded reports whether path falls under one of the rule's Exclude prefixes.
+func (r *compiledRule) excluded(path string) bool {
+	for _, ex := range r.excludes {
+		if strings.HasPrefix(path, ex) {
+			return true
+		}
+	}
+	return false
+}
+
 // Service holds a compiled set of proxy rules and performs longest-prefix
 // matching against them. A Service is safe for concurrent use once
 // returned from NewService; Handler must be called once per Service to
@@ -98,8 +120,18 @@ func NewService(rules []Rule, opts ...Option) (*Service, error) {
 			return nil, fmt.Errorf("quickproxy: invalid target %q for prefix %q", r.Target, r.URLPrefix)
 		}
 
+		for _, ex := range r.Exclude {
+			if !strings.HasPrefix(ex, "/") {
+				return nil, fmt.Errorf("quickproxy: exclude prefix %q for rule %q must start with /", ex, r.URLPrefix)
+			}
+			if !strings.HasPrefix(ex, r.URLPrefix) {
+				return nil, fmt.Errorf("quickproxy: exclude prefix %q for rule %q must itself start with the rule's URLPrefix", ex, r.URLPrefix)
+			}
+		}
+
 		compiled = append(compiled, compiledRule{
 			prefix:   r.URLPrefix,
+			excludes: r.Exclude,
 			proxy:    newReverseProxy(target, cfg.timeout),
 		})
 	}
@@ -174,11 +206,17 @@ func (s *Service) Handler(fallback http.Handler) http.Handler {
 }
 
 // match returns the longest-prefix rule matching path, or nil if none match.
+// A rule whose Exclude covers path is skipped, and matching continues
+// against the next-longest-prefix rule.
 func (s *Service) match(path string) *compiledRule {
 	for i := range s.rules {
-		if strings.HasPrefix(path, s.rules[i].prefix) {
-			return &s.rules[i]
+		if !strings.HasPrefix(path, s.rules[i].prefix) {
+			continue
 		}
+		if s.rules[i].excluded(path) {
+			continue
+		}
+		return &s.rules[i]
 	}
 	return nil
 }

pkg/server/quickproxy/quickproxy_test.go

@@ -23,7 +23,19 @@ func TestNewService_Validation(t *testing.T) {
 			{URLPrefix: "/api", Target: "http://localhost:1"},
 			{URLPrefix: "/api", Target: "http://localhost:2"},
 		}, true},
+		{"bad exclude prefix", []Rule{
+			{URLPrefix: "/", Target: "http://localhost:1", Exclude: []string{"health"}},
+		}, true},
+		{"exclude outside rule's URLPrefix", []Rule{
+			{URLPrefix: "/api", Target: "http://localhost:1", Exclude: []string{"/health"}},
+		}, true},
 		{"valid", []Rule{{URLPrefix: "/api", Target: "http://localhost:1"}}, false},
+		{"valid with exclude", []Rule{
+			{URLPrefix: "/", Target: "http://localhost:1", Exclude: []string{"/health"}},
+		}, false},
+		{"valid with nested exclude", []Rule{
+			{URLPrefix: "/api", Target: "http://localhost:1", Exclude: []string{"/api/health"}},
+		}, false},
 	}
 
 	for _, tt := range tests {
@@ -186,6 +198,81 @@ func TestHandler_LongestPrefixMatch(t *testing.T) {
 	}
 }
 
+func TestHandler_ExcludeFallsBackToFallback(t *testing.T) {
+	upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("upstream:" + r.URL.Path))
+	}))
+	defer upstream.Close()
+
+	svc, err := NewService([]Rule{
+		{URLPrefix: "/", Target: upstream.URL, Exclude: []string{"/health"}},
+	})
+	if err != nil {
+		t.Fatalf("NewService: %v", err)
+	}
+
+	handler := svc.Handler(fallbackHandler("fallback-content"))
+
+	req := httptest.NewRequest(http.MethodGet, "/health", nil)
+	rr := httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if got := rr.Body.String(); got != "fallback-content" {
+		t.Fatalf("body = %q, want fallback-content", got)
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/health/live", nil)
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if got := rr.Body.String(); got != "fallback-content" {
+		t.Fatalf("body = %q, want fallback-content", got)
+	}
+
+	req = httptest.NewRequest(http.MethodGet, "/other", nil)
+	rr = httptest.NewRecorder()
+	handler.ServeHTTP(rr, req)
+
+	if got := rr.Body.String(); got != "upstream:/other" {
+		t.Fatalf("body = %q, want upstream:/other", got)
+	}
+}
+
+func TestHandler_ExcludeFallsThroughToNextRule(t *testing.T) {
+	specific := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("specific"))
+	}))
+	defer specific.Close()
+
+	general := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_, _ = w.Write([]byte("general"))
+	}))
+	defer general.Close()
+
+	svc, err := NewService([]Rule{
+		{URLPrefix: "/api", Target: general.URL},
+		{URLPrefix: "/api/v1", Target: specific.URL, Exclude: []string{"/api/v1/health"}},
+	})
+	if err != nil {
+		t.Fatalf("NewService: %v", err)
+	}
+
+	handler := svc.Handler(fallbackHandler("fallback"))
+
+	for path, want := range map[string]string{
+		"/api/v1/thing":  "specific",
+		"/api/v1/health": "general",
+	} {
+		req := httptest.NewRequest(http.MethodGet, path, nil)
+		rr := httptest.NewRecorder()
+		handler.ServeHTTP(rr, req)
+
+		if got := rr.Body.String(); got != want {
+			t.Errorf("path %s: body = %q, want %q", path, got, want)
+		}
+	}
+}
+
 func TestHandler_NoMatchFallsBack(t *testing.T) {
 	svc, err := NewService([]Rule{{URLPrefix: "/api", Target: "http://127.0.0.1:1"}})
 	if err != nil {