@askdb/core 1.0.0-beta.42 → 1.0.0-beta.43
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -4
- package/dist/ask.d.ts +92 -4
- package/dist/ask.d.ts.map +1 -1
- package/dist/ask.js +234 -23
- package/dist/ask.js.map +1 -1
- package/dist/errors.d.ts +41 -5
- package/dist/errors.d.ts.map +1 -1
- package/dist/errors.js +9 -0
- package/dist/errors.js.map +1 -1
- package/dist/index.d.ts +5 -4
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +2 -1
- package/dist/index.js.map +1 -1
- package/dist/schema/v2/index.d.ts +1 -1
- package/dist/schema/v2/index.d.ts.map +1 -1
- package/dist/schema/v2/loader.d.ts +9 -1
- package/dist/schema/v2/loader.d.ts.map +1 -1
- package/dist/schema/v2/loader.js +171 -49
- package/dist/schema/v2/loader.js.map +1 -1
- package/dist/schema/v2/normalized.d.ts +33 -0
- package/dist/schema/v2/normalized.d.ts.map +1 -1
- package/dist/schema/v2/parser.d.ts +9 -0
- package/dist/schema/v2/parser.d.ts.map +1 -1
- package/dist/schema/v2/parser.js +18 -2
- package/dist/schema/v2/parser.js.map +1 -1
- package/dist/schema/v2/tenant-policy-loader.d.ts.map +1 -1
- package/dist/schema/v2/tenant-policy-loader.js +7 -3
- package/dist/schema/v2/tenant-policy-loader.js.map +1 -1
- package/dist/schema/v2/tenant-policy.d.ts +28 -21
- package/dist/schema/v2/tenant-policy.d.ts.map +1 -1
- package/dist/schema/v2/tenant-policy.js +67 -11
- package/dist/schema/v2/tenant-policy.js.map +1 -1
- package/dist/sql/bind.d.ts +17 -15
- package/dist/sql/bind.d.ts.map +1 -1
- package/dist/sql/bind.js +34 -172
- package/dist/sql/bind.js.map +1 -1
- package/dist/sql/dialect-spec.d.ts +21 -2
- package/dist/sql/dialect-spec.d.ts.map +1 -1
- package/dist/sql/dialect-spec.js +74 -3
- package/dist/sql/dialect-spec.js.map +1 -1
- package/dist/sql/generate.d.ts +12 -0
- package/dist/sql/generate.d.ts.map +1 -1
- package/dist/sql/generate.js +24 -16
- package/dist/sql/generate.js.map +1 -1
- package/dist/sql/lexer.d.ts +114 -0
- package/dist/sql/lexer.d.ts.map +1 -0
- package/dist/sql/lexer.js +397 -0
- package/dist/sql/lexer.js.map +1 -0
- package/dist/sql/sensitive-guardrail.d.ts +18 -3
- package/dist/sql/sensitive-guardrail.d.ts.map +1 -1
- package/dist/sql/sensitive-guardrail.js +440 -153
- package/dist/sql/sensitive-guardrail.js.map +1 -1
- package/dist/sql/tenant-guardrail.d.ts +70 -8
- package/dist/sql/tenant-guardrail.d.ts.map +1 -1
- package/dist/sql/tenant-guardrail.js +799 -52
- package/dist/sql/tenant-guardrail.js.map +1 -1
- package/dist/sql/tenant-hierarchy.d.ts +19 -0
- package/dist/sql/tenant-hierarchy.d.ts.map +1 -0
- package/dist/sql/tenant-hierarchy.js +53 -0
- package/dist/sql/tenant-hierarchy.js.map +1 -0
- package/dist/sql/tenant-placeholders.d.ts +60 -10
- package/dist/sql/tenant-placeholders.d.ts.map +1 -1
- package/dist/sql/tenant-placeholders.js +229 -58
- package/dist/sql/tenant-placeholders.js.map +1 -1
- package/dist/sql/tenant-prompt.d.ts +4 -0
- package/dist/sql/tenant-prompt.d.ts.map +1 -1
- package/dist/sql/tenant-prompt.js +79 -11
- package/dist/sql/tenant-prompt.js.map +1 -1
- package/dist/sql/tenant-scope-validate.d.ts +3 -1
- package/dist/sql/tenant-scope-validate.d.ts.map +1 -1
- package/dist/sql/tenant-scope-validate.js +5 -2
- package/dist/sql/tenant-scope-validate.js.map +1 -1
- package/dist/sql/validate.d.ts +24 -4
- package/dist/sql/validate.d.ts.map +1 -1
- package/dist/sql/validate.js +123 -37
- package/dist/sql/validate.js.map +1 -1
- package/package.json +6 -5
- package/dist/exec/postgres.d.ts +0 -6
- package/dist/exec/postgres.d.ts.map +0 -1
- package/dist/exec/postgres.js +0 -30
- package/dist/exec/postgres.js.map +0 -1
- package/dist/modes/post-execute-log.d.ts +0 -9
- package/dist/modes/post-execute-log.d.ts.map +0 -1
- package/dist/modes/post-execute-log.js +0 -26
- package/dist/modes/post-execute-log.js.map +0 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-placeholders.js","sourceRoot":"","sources":["../../src/sql/tenant-placeholders.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AAyBnB,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,OAAO,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,MAAM,CAAC;AAC1E,CAAC;AAED,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CAAC,GAAW;IACnD,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAQD,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAA8B,EAC9B,KAAkB;IAElB,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6C,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,kBAAkB,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE;YACrD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,SAAS;YACZ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM;QACR,KAAK,YAAY;YACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAa,EAAE,OAA+C;IACpF,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,QAA+B,EAC/B,OAA+C;IAE/C,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QACjC,MAAM,OAAO,GACX,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAChB,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,EAAE,OAAO,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;QAEvE,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,UAAU,6BAA6B,CAC3C,GAAW,EACX,QAA+B,EAC/B,aAAqB,CAAC;IAEtB,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,UAAU,CAAC;IAErB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEjC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC,CAAC;YACvB,GAAG,EAAE,CAAC;QACR,CAAC;aAAM,CAAC;YACN,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;YAC/C,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9C,MAAM,GAAG,oBAAoB,CAAC,MAAM,EAAE,CAAC,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;YACtE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,SAAS,oBAAoB,CAC3B,GAAW,EACX,WAAmB,EACnB,WAAmB,EACnB,UAAmB;IAEnB,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,QAAQ,WAAW,CAAC,WAAW,CAAC,EAAE,EAClC,GAAG,CACJ,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,EAAE,CAAC,CAAC;QAElD,MAAM,SAAS,GAAG,IAAI,MAAM,CAC1B,gBAAgB,WAAW,CAAC,WAAW,CAAC,SAAS,EACjD,IAAI,CACL,CAAC;QACF,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,CAAC,CAAC;IAC1E,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAS;IAC5B,OAAO,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA4B,UAAU,EACtC,kBAA0B,CAAC,EAC3B,OAA+C;IAE/C,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC,CAAC;IAEJ,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,+BAA+B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC5D,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,CAAC,CAAC;IAClF,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,eAAe;KAChB,CAAC;AACJ,CAAC"}
|
|
1
|
+
{"version":3,"file":"tenant-placeholders.js","sourceRoot":"","sources":["../../src/sql/tenant-placeholders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,wBAAwB,GAIzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,cAAc,EAAE,kBAAkB,EAAoB,MAAM,mBAAmB,CAAC;AACzF,OAAO,EACL,gBAAgB,EAChB,sBAAsB,EACtB,YAAY,EACZ,qBAAqB,EACrB,sBAAsB,EACtB,gBAAgB,GAGjB,MAAM,WAAW,CAAC;AAwCnB,6FAA6F;AAC7F,SAAS,YAAY,CACnB,OAAqC;IAErC,OAAO,OAAO,EAAE,EAAE,KAAK,SAAS;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,CAAC;AACrE,CAAC;AAED,8EAA8E;AAC9E,oFAAoF;AACpF,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,wBAAwB,EAAE,CAAC;AAExD,8EAA8E;AAC9E,qEAAqE;AACrE,8EAA8E;AAE9E,MAAM,UAAU,yBAAyB,CAAC,GAAW,EAAE,OAA0B;IAC/E,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC;AACtB,CAAC;AAQD,MAAM,UAAU,mBAAmB,CACjC,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA0B;IAE1B,MAAM,YAAY,GAAG,yBAAyB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAEzC,oFAAoF;IACpF,oFAAoF;IACpF,oFAAoF;IACpF,8BAA8B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA6C,CAAC;IAChF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,kBAAkB,CAAC,GAAG,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE;YACrD,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,KAAK,MAAM,EAAE,IAAI,YAAY,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,QAAQ,CAAC,IAAI,CAAC;YACZ,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,QAAQ,CAAC,KAAK;YACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,GAAG;SACJ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,MAAM,CAAC,GAAG,IAAI,GAAG,EAAoB,CAAC;IACtC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YACrC,MAAM;QACR,KAAK,SAAS;YACZ,yEAAyE;YACzE,MAAM,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QACxE,KAAK,YAAY;YACf,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;gBAC3C,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/C,CAAC;YACD,MAAM;QACR,KAAK,QAAQ;YACX,MAAM;IACV,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAAkB,EAClB,MAAyD;IAEzD,OAAO,IAAI,gBAAgB,CACzB,qDAAqD,UAAU,MAAM,MAAM,iBAAiB;QAC1F,yEAAyE;QACzE,0FAA0F;QAC1F,qFAAqF,EACvF,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAa,EAAE,OAA0B;IAC/D,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAChD,IAAI,gBAAgB,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC;QACjG,gBAAgB,GAAG,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,gBAAgB,CAAC;IACjE,CAAC;IACD,IAAI,gBAAgB,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,2EAA2E;QAC3E,kEAAkE;QAClE,MAAM,IAAI,gBAAgB,CACxB,kDAAkD,OAAO,CAAC,EAAE,IAAI,SAAS,iBAAiB;YACxF,yFAAyF;YACzF,oCAAoC,EACtC,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC;AACvD,CAAC;AAID;;;;;;;;;;;;;;;GAeG;AACH,SAAS,4BAA4B,CACnC,GAAW,EACX,QAA+B,EAC/B,MAA4C,EAC5C,OAA0B;IAE1B,mCAAmC,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACvE,MAAM,KAAK,GAAW,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QACrE,MAAM,CAAC,GAAG,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,IAAI,gBAAgB,CACxB,CAAC;gBACC,CAAC,CAAC,4BAA4B,GAAG,CAAC,WAAW,yCAAyC;oBAClF,oBAAoB,CAAC,CAAC,MAAM,mEAAmE;gBACnG,CAAC,CAAC,4BAA4B,GAAG,CAAC,WAAW,gDAAgD;oBACzF,gEAAgE,EACtE,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,GAAG,GAAG,GAAG,CAAC;IACd,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3D,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gGAAgG;AAChG,MAAM,uBAAuB,GAAG,4BAA4B,CAAC;AAE7D;;;;;;GAMG;AACH,SAAS,mCAAmC,CAAC,GAAW,EAAE,OAA0B;IAClF,mFAAmF;IACnF,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,GAAG,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAChE,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QACnC,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YACnB,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;YACjC,IAAI,IAAI,KAAK,KAAK,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,SAAS;YACvE,MAAM,IAAI,gBAAgB,CACxB,4BAA4B,CAAC,CAAC,CAAC,CAAC,2DAA2D;gBACzF,YAAY,KAAK,kEAAkE,EACrF,+BAA+B,CAChC,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,cAAc,GAAG,gBAAgB,CAAC;AACxC,MAAM,iBAAiB,GAAG,QAAQ,CAAC;AACnC,MAAM,iBAAiB,GAAG,oDAAoD,CAAC;AAC/E,MAAM,iBAAiB,GAAG,uCAAuC,CAAC;AAElE;;;;;;;;;GASG;AACH,SAAS,QAAQ,CAAC,GAAW,EAAE,GAA0B,EAAE,KAAe;IACxE,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAE5C,IAAI,KAAK,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QACzC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,UAAU,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC;QAChD,MAAM,QAAQ,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,UAAU,KAAK,KAAK,CAAC;QACrE,MAAM,QAAQ,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,UAAU,KAAK,KAAK,CAAC;QACtE,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3B,MAAM,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,UAAU,KAAK,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAChD,OAAO;YACL,KAAK;YACL,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,MAAM;YAC/B,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,GAAG,CAAC;SACpE,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,GAAG,UAAU,CAAC,CAAC,CAAE,CAAC,MAAM,CAAC;QAChD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3E,CAAC;QACD,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,IAAI,GAAG,CAAC,EAAE,CAAC;QAC/E,CAAC;QACD,MAAM,oBAAoB,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,oBAAoB,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;AAC7C,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,GAAW,EAAE,KAAa,EAAE,IAAY;IACtD,OAAO,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAA0B,EAAE,EAAsB;IAC9E,MAAM,KAAK,GACT,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC,kBAAkB,EAAE,GAAG,CAAC;IACjF,OAAO,IAAI,gBAAgB,CACzB,sBAAsB,GAAG,CAAC,WAAW,IAAI,KAAK,iDAAiD;QAC7F,wFAAwF;QACxF,wDAAwD,EAC1D,8BAA8B,CAC/B,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,yDAAyD;AACzD,8EAA8E;AAE9E,MAAM,UAAU,+BAA+B,CAC7C,GAAW,EACX,QAA+B,EAC/B,OAA0B;IAE1B,OAAO,4BAA4B,CACjC,GAAG,EACH,QAAQ,EACR,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,cAAc,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,EACrD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,kEAAkE;AAClE,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,OAAqC;IAC9D,MAAM,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IACvB,OAAO,EAAE,KAAK,SAAS,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC3F,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAkB,EAAE,OAAe;IACvD,OAAO,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,6BAA6B,CAC3C,GAAW,EACX,QAA+B,EAC/B,aAAqB,CAAC,EACtB,OAA0B;IAE1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,GAAG,UAAU,CAAC;IACrB,MAAM,GAAG,GAAG,4BAA4B,CACtC,GAAG,EACH,QAAQ,EACR,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;QACf,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,CAAC,CAAC,EACJ,OAAO,CACR,CAAC;IACF,OAAO,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,GAAW,EACX,MAA8B,EAC9B,KAAkB,EAClB,OAA4B,UAAU,EACtC,kBAA0B,CAAC,EAC3B,OAA0B;IAE1B,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,sBAAsB,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,KAAK,UAAU;YACxB,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,QAAQ,EAAE,EAAE,EAAE;YACzC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,eAAe,EAAE,CAAC;IAC7E,CAAC;IAED,MAAM,QAAQ,GAAG,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAClE,MAAM,QAAQ,GAAoB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACrD,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,GAAG,EAAE,CAAC,CAAC,GAAG;KACX,CAAC,CAAC,CAAC;IAEJ,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;QACxB,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,GAAG,EAAE,+BAA+B,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC;YAC5D,QAAQ;SACT,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,6BAA6B,CAAC,GAAG,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC3F,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,GAAG,EAAE,WAAW,CAAC,GAAG;QACpB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,QAAQ;QACR,eAAe;KAChB,CAAC;AACJ,CAAC"}
|
|
@@ -3,6 +3,10 @@ import type { TenantScope } from "../schema/v2/tenant-policy.js";
|
|
|
3
3
|
/**
|
|
4
4
|
* Build the tenant policy + runtime scope block for NL→SQL prompts.
|
|
5
5
|
* This block is always injected when a tenant policy exists (security boundary).
|
|
6
|
+
*
|
|
7
|
+
* A `subtree` scope must be expanded into per-root IDs first (`ask()` does this
|
|
8
|
+
* through `resolveTenantDescendants`); an unexpanded one throws
|
|
9
|
+
* `SUBTREE_NOT_RESOLVABLE`.
|
|
6
10
|
*/
|
|
7
11
|
export declare function buildTenantPromptBlock(policy: NormalizedTenantPolicy, scope: TenantScope): string;
|
|
8
12
|
//# sourceMappingURL=tenant-prompt.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-prompt.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;
|
|
1
|
+
{"version":3,"file":"tenant-prompt.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AAQjE;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,WAAW,GACjB,MAAM,CAiJR"}
|
|
@@ -1,6 +1,14 @@
|
|
|
1
|
+
import { placeholderForTenantRoot } from "../schema/v2/tenant-policy.js";
|
|
2
|
+
import { unexpandedSubtreeError } from "./tenant-placeholders.js";
|
|
3
|
+
const NEVER_CROSS_ROOTS = " The same ID value can name different tenants in different root tables: " +
|
|
4
|
+
"never compare one root's placeholder with another root's column.";
|
|
1
5
|
/**
|
|
2
6
|
* Build the tenant policy + runtime scope block for NL→SQL prompts.
|
|
3
7
|
* This block is always injected when a tenant policy exists (security boundary).
|
|
8
|
+
*
|
|
9
|
+
* A `subtree` scope must be expanded into per-root IDs first (`ask()` does this
|
|
10
|
+
* through `resolveTenantDescendants`); an unexpanded one throws
|
|
11
|
+
* `SUBTREE_NOT_RESOLVABLE`.
|
|
4
12
|
*/
|
|
5
13
|
export function buildTenantPromptBlock(policy, scope) {
|
|
6
14
|
const lines = [];
|
|
@@ -58,25 +66,45 @@ export function buildTenantPromptBlock(policy, scope) {
|
|
|
58
66
|
switch (access.kind) {
|
|
59
67
|
case "ids": {
|
|
60
68
|
const rootLabel = policy.roots.find((r) => r.id === access.tenantRoot)?.label ?? access.tenantRoot;
|
|
61
|
-
const placeholder =
|
|
69
|
+
const placeholder = placeholderForTenantRoot({ id: access.tenantRoot, label: rootLabel });
|
|
62
70
|
lines.push(` Access: ${rootLabel} IDs = ${placeholder}`);
|
|
71
|
+
// With several roots the model also sees other roots' columns (an expanded
|
|
72
|
+
// subtree with IDs at its root only is an `ids` scope), so pair this one too.
|
|
73
|
+
// A single-root policy keeps its block unchanged.
|
|
74
|
+
const pairColumns = policy.roots.length > 1;
|
|
75
|
+
if (pairColumns) {
|
|
76
|
+
const columns = columnsHoldingRootIds(policy, access.tenantRoot);
|
|
77
|
+
if (columns.length > 0)
|
|
78
|
+
lines.push(` columns: ${columns.join(", ")}`);
|
|
79
|
+
}
|
|
63
80
|
lines.push(` Use ${placeholder} as the parameter placeholder for tenant predicates.`);
|
|
81
|
+
if (pairColumns)
|
|
82
|
+
lines.push(NEVER_CROSS_ROOTS);
|
|
64
83
|
break;
|
|
65
84
|
}
|
|
66
|
-
case "subtree":
|
|
67
|
-
|
|
68
|
-
const placeholder = `:tenant_${rootLabel.toLowerCase().replace(/[^a-z0-9]+/g, "_")}_ids`;
|
|
69
|
-
lines.push(` Access: ${rootLabel} subtree from IDs = ${placeholder} (include all descendants)`);
|
|
70
|
-
lines.push(` Use ${placeholder} as the parameter placeholder for tenant predicates.`);
|
|
71
|
-
break;
|
|
72
|
-
}
|
|
85
|
+
case "subtree":
|
|
86
|
+
throw unexpandedSubtreeError(access.tenantRoot, "buildTenantPromptBlock()");
|
|
73
87
|
case "multi_root": {
|
|
74
|
-
|
|
88
|
+
// Each root table has its own ID space (an expanded subtree is a multi_root
|
|
89
|
+
// scope), so name the columns each placeholder may be compared with.
|
|
90
|
+
lines.push(" Access: multiple roots. Each placeholder holds the IDs of one tenant root; " +
|
|
91
|
+
"compare it only with the columns listed under it:");
|
|
92
|
+
// The tenant guardrail checks every root the scope names as a root table (#341), so a
|
|
93
|
+
// child root in the scope can't be filtered through its parent's foreign key: don't
|
|
94
|
+
// offer that column under the parent's placeholder.
|
|
95
|
+
const covered = new Set(access.scopes.map((s) => s.tenantRoot));
|
|
75
96
|
for (const s of access.scopes) {
|
|
76
97
|
const rootLabel = policy.roots.find((r) => r.id === s.tenantRoot)?.label ?? s.tenantRoot;
|
|
77
|
-
|
|
78
|
-
|
|
98
|
+
// A level an expanded subtree covers with no IDs: its placeholder binds nothing.
|
|
99
|
+
const empty = s.ids.length === 0 ? " (no IDs in this scope: don't read this table)" : "";
|
|
100
|
+
lines.push(` - ${rootLabel} IDs = ${placeholderForTenantRoot({ id: s.tenantRoot, label: rootLabel })}${empty}`);
|
|
101
|
+
const columns = columnsHoldingRootIds(policy, s.tenantRoot, covered);
|
|
102
|
+
if (columns.length > 0)
|
|
103
|
+
lines.push(` columns: ${columns.join(", ")}`);
|
|
79
104
|
}
|
|
105
|
+
lines.push(NEVER_CROSS_ROOTS);
|
|
106
|
+
lines.push(" A root table listed here that the query reads must itself be filtered with its own placeholder; " +
|
|
107
|
+
"filtering it only through its parent's foreign key or a joined ancestor is not enough.");
|
|
80
108
|
break;
|
|
81
109
|
}
|
|
82
110
|
case "global":
|
|
@@ -124,4 +152,44 @@ export function buildTenantPromptBlock(policy, scope) {
|
|
|
124
152
|
lines.push("--- END TENANT POLICY ---");
|
|
125
153
|
return lines.join("\n");
|
|
126
154
|
}
|
|
155
|
+
/**
|
|
156
|
+
* The columns whose values are IDs of `rootId`, per the policy, in a stable order:
|
|
157
|
+
* the root's own `tenantIdColumn`; each child root's foreign key to it
|
|
158
|
+
* (`roots[].parent`, `hierarchy[]`), unless that child is in `coveredRoots` (the guardrail
|
|
159
|
+
* checks a covered child on its own placeholder); each scoped table's direct column for it;
|
|
160
|
+
* and each polymorphic ID column, with the discriminator value that points at it.
|
|
161
|
+
* A table scoped through a join path is filtered on the root's own column after
|
|
162
|
+
* the join, as the join-path lines of the prompt say, so it adds no column here.
|
|
163
|
+
*/
|
|
164
|
+
function columnsHoldingRootIds(policy, rootId, coveredRoots = new Set()) {
|
|
165
|
+
const root = policy.roots.find((r) => r.id === rootId);
|
|
166
|
+
const columns = [];
|
|
167
|
+
const add = (column) => {
|
|
168
|
+
if (!columns.includes(column))
|
|
169
|
+
columns.push(column);
|
|
170
|
+
};
|
|
171
|
+
if (root)
|
|
172
|
+
add(root.tenantIdColumn);
|
|
173
|
+
for (const child of policy.roots) {
|
|
174
|
+
if (child.parent?.root === rootId && !coveredRoots.has(child.id))
|
|
175
|
+
add(child.parent.foreignKey);
|
|
176
|
+
}
|
|
177
|
+
for (const edge of policy.hierarchy) {
|
|
178
|
+
if (edge.parent === rootId && !coveredRoots.has(edge.child))
|
|
179
|
+
add(edge.foreignKey);
|
|
180
|
+
}
|
|
181
|
+
for (const st of policy.scopedTables) {
|
|
182
|
+
for (const path of st.scopeThrough) {
|
|
183
|
+
if (path.root === rootId && "column" in path)
|
|
184
|
+
add(path.column);
|
|
185
|
+
}
|
|
186
|
+
}
|
|
187
|
+
for (const pt of policy.polymorphicTables) {
|
|
188
|
+
for (const [typeValue, target] of Object.entries(pt.mapping)) {
|
|
189
|
+
if (target === rootId)
|
|
190
|
+
add(`${pt.idColumn} (where ${pt.typeColumn} = '${typeValue}')`);
|
|
191
|
+
}
|
|
192
|
+
}
|
|
193
|
+
return columns;
|
|
194
|
+
}
|
|
127
195
|
//# sourceMappingURL=tenant-prompt.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-prompt.js","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"tenant-prompt.js","sourceRoot":"","sources":["../../src/sql/tenant-prompt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,MAAM,iBAAiB,GACrB,2EAA2E;IAC3E,kEAAkE,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA8B,EAC9B,KAAkB;IAElB,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;IAC7F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,YAAY;IACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM;YAC5B,CAAC,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,MAAO,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,GAAG;YAClG,CAAC,CAAC,cAAc,CAAC;QACnB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,IAAI,UAAU,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,uDAAuD,CAAC,CAAC;QACpE,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC;gBACnF,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;oBACrB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,IAAI,CAAC,MAAM,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC9E,CAAC;qBAAM,CAAC;oBACN,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;oBACzE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,iBAAiB,QAAQ,KAAK,SAAS,SAAS,CAAC,CAAC;gBAC3E,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,qBAAqB;IACrB,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxC,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QAClF,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC1C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,UAAU,iBAAiB,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvF,KAAK,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE,KAAK,IAAI,UAAU,CAAC;gBACrF,KAAK,CAAC,IAAI,CAAC,UAAU,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,IAAI,MAAM,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QACvD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC1B,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,gBAAgB;IAChB,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC;YACnG,MAAM,WAAW,GAAG,wBAAwB,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;YAC1F,KAAK,CAAC,IAAI,CAAC,aAAa,SAAS,UAAU,WAAW,EAAE,CAAC,CAAC;YAC1D,2EAA2E;YAC3E,8EAA8E;YAC9E,kDAAkD;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC;gBACjE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,sDAAsD,CAAC,CAAC;YACvF,IAAI,WAAW;gBAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC/C,MAAM;QACR,CAAC;QACD,KAAK,SAAS;YACZ,MAAM,sBAAsB,CAAC,MAAM,CAAC,UAAU,EAAE,0BAA0B,CAAC,CAAC;QAC9E,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,4EAA4E;YAC5E,qEAAqE;YACrE,KAAK,CAAC,IAAI,CACR,+EAA+E;gBAC7E,mDAAmD,CACtD,CAAC;YACF,sFAAsF;YACtF,oFAAoF;YACpF,oDAAoD;YACpD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC9B,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,IAAI,CAAC,CAAC,UAAU,CAAC;gBACzF,iFAAiF;gBACjF,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,EAAE,CAAC;gBACzF,KAAK,CAAC,IAAI,CAAC,SAAS,SAAS,UAAU,wBAAwB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,CAAC;gBACnH,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;gBACrE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;oBAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;YAC9B,KAAK,CAAC,IAAI,CACR,oGAAoG;gBAClG,wFAAwF,CAC3F,CAAC;YACF,MAAM;QACR,CAAC;QACD,KAAK,QAAQ;YACX,KAAK,CAAC,IAAI,CAAC,6BAA6B,MAAM,CAAC,MAAM,kCAAkC,CAAC,CAAC;YACzF,MAAM;IACV,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,mBAAmB;IACnB,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC;QAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,IAAI,GAAG,CAAC,IAAI;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,GAAG,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACpD,IAAI,GAAG,CAAC,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,IAAI,GAAG,CAAC,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YACnB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACjC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IACxF,KAAK,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;IAClF,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;IAC/F,KAAK,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;IACvE,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACnC,KAAK,CAAC,IAAI,CAAC,2EAA2E,CAAC,CAAC;IAC1F,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,MAA8B,EAC9B,MAAc,EACd,eAAoC,IAAI,GAAG,EAAE;IAE7C,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;IACvD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,GAAG,GAAG,CAAC,MAAc,EAAE,EAAE;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC,CAAC;IACF,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;YACnC,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,IAAI,IAAI;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,IAAI,MAAM,KAAK,MAAM;gBAAE,GAAG,CAAC,GAAG,EAAE,CAAC,QAAQ,WAAW,EAAE,CAAC,UAAU,OAAO,SAAS,IAAI,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}
|
|
@@ -2,7 +2,9 @@ import type { NormalizedTenantPolicy } from "../schema/v2/tenant-policy.js";
|
|
|
2
2
|
import { type TenantScope } from "../schema/v2/tenant-policy.js";
|
|
3
3
|
/**
|
|
4
4
|
* Validate a `TenantScope` input against a tenant policy before prompt generation.
|
|
5
|
-
* Throws `TenantScopeError` on failure
|
|
5
|
+
* Throws `TenantScopeError` on failure, and `SchemaParseError` when two of the
|
|
6
|
+
* policy's roots derive the same placeholder (the loader rejects that too; this
|
|
7
|
+
* covers a policy built in code).
|
|
6
8
|
*/
|
|
7
9
|
export declare function validateTenantScope(tenantPolicy: NormalizedTenantPolicy, tenantScope: TenantScope | undefined): void;
|
|
8
10
|
//# sourceMappingURL=tenant-scope-validate.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-scope-validate.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,
|
|
1
|
+
{"version":3,"file":"tenant-scope-validate.d.ts","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE,WAAW,GAAG,SAAS,GACnC,IAAI,CA6DN"}
|
|
@@ -1,10 +1,13 @@
|
|
|
1
1
|
import { TenantScopeError } from "../errors.js";
|
|
2
|
-
import { tenantScopeSchema } from "../schema/v2/tenant-policy.js";
|
|
2
|
+
import { assertDistinctRootPlaceholders, tenantScopeSchema, } from "../schema/v2/tenant-policy.js";
|
|
3
3
|
/**
|
|
4
4
|
* Validate a `TenantScope` input against a tenant policy before prompt generation.
|
|
5
|
-
* Throws `TenantScopeError` on failure
|
|
5
|
+
* Throws `TenantScopeError` on failure, and `SchemaParseError` when two of the
|
|
6
|
+
* policy's roots derive the same placeholder (the loader rejects that too; this
|
|
7
|
+
* covers a policy built in code).
|
|
6
8
|
*/
|
|
7
9
|
export function validateTenantScope(tenantPolicy, tenantScope) {
|
|
10
|
+
assertDistinctRootPlaceholders(tenantPolicy.roots);
|
|
8
11
|
// Fail closed: policy exists but no scope
|
|
9
12
|
if (!tenantScope) {
|
|
10
13
|
throw new TenantScopeError("Tenant policy is active but no tenantScope was provided. " +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"tenant-scope-validate.js","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,
|
|
1
|
+
{"version":3,"file":"tenant-scope-validate.js","sourceRoot":"","sources":["../../src/sql/tenant-scope-validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EACL,8BAA8B,EAC9B,iBAAiB,GAElB,MAAM,+BAA+B,CAAC;AAEvC;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,YAAoC,EACpC,WAAoC;IAEpC,8BAA8B,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAEnD,0CAA0C;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,gBAAgB,CACxB,2DAA2D;YACzD,gFAAgF,EAClF,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,gBAAgB,CACxB,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,EACpD,qBAAqB,CACtB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;IAElC,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,KAAK;YACR,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,SAAS;YACZ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;gBACpC,MAAM,IAAI,gBAAgB,CACxB,sDAAsD,MAAM,CAAC,UAAU,KAAK;oBAC1E,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;YACJ,CAAC;YACD,MAAM;QAER,KAAK,YAAY;YACf,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;oBACnC,MAAM,IAAI,gBAAgB,CACxB,6DAA6D,KAAK,CAAC,UAAU,KAAK;wBAChF,gBAAgB,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC3C,qBAAqB,CACtB,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,MAAM;QAER,KAAK,QAAQ;YACX,kDAAkD;YAClD,MAAM;IACV,CAAC;AACH,CAAC"}
|
package/dist/sql/validate.d.ts
CHANGED
|
@@ -1,8 +1,28 @@
|
|
|
1
|
-
import type
|
|
1
|
+
import { type DialectSpec } from "./dialect-spec.js";
|
|
2
2
|
/**
|
|
3
|
-
*
|
|
4
|
-
*
|
|
5
|
-
*
|
|
3
|
+
* Read-only SELECT check for model-generated SQL. It is **defense in depth**, not a
|
|
4
|
+
* security boundary: it lexes SQL the way the target engine does and rejects shapes
|
|
5
|
+
* that are clearly not a single read-only query, but it is not a SQL parser and cannot
|
|
6
|
+
* prove a statement is harmless. Run generated SQL under a database role that can only
|
|
7
|
+
* read what the caller may see.
|
|
8
|
+
*
|
|
9
|
+
* Checks, in order (the first failure throws {@link SqlValidationError}):
|
|
10
|
+
*
|
|
11
|
+
* 1. `SQL_EMPTY` — nothing left after trimming.
|
|
12
|
+
* 2. `SQL_UNTERMINATED` — a string, quoted identifier, dollar-quoted string, or block
|
|
13
|
+
* comment never closes. Fails closed rather than guessing where it ends.
|
|
14
|
+
* 3. `SQL_MULTI_STATEMENT` — any `;` other than a single trailing one.
|
|
15
|
+
* 4. `SQL_COMMENT` — any comment (`--`, `/* *\/`, and MySQL `#`).
|
|
16
|
+
* 5. `SQL_NOT_SELECT_OR_WITH` — the first token (after any `(`) is not `SELECT`/`WITH`.
|
|
17
|
+
* 6. `SQL_FORBIDDEN_KEYWORD` — an unquoted keyword from the shared denylist or the
|
|
18
|
+
* dialect's `extraForbiddenKeywords`.
|
|
19
|
+
* 7. `SQL_FORBIDDEN_FUNCTION` — a call (`name(`) to a function in the dialect's
|
|
20
|
+
* `blockedFunctions` (side-effecting or file/network/sleep functions).
|
|
21
|
+
*
|
|
22
|
+
* Then the dialect's `extraValidate` runs on the normalized SQL (trailing `;` removed).
|
|
23
|
+
*
|
|
24
|
+
* The lexer follows `dialect.id`. When the id is not a built-in engine family, the SQL
|
|
25
|
+
* must pass under every built-in lexer with every built-in denylist.
|
|
6
26
|
*/
|
|
7
27
|
export declare function validateSelectSql(dialect: DialectSpec, sql: string): string;
|
|
8
28
|
/** Explanation of guardrails satisfied by a string already passing {@link validateSelectSql}. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,
|
|
1
|
+
{"version":3,"file":"validate.d.ts","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AACA,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAwCxE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CA0B3E;AAuHD,iGAAiG;AACjG,MAAM,MAAM,sBAAsB,GAAG;IACnC,aAAa,EAAE,QAAQ,GAAG,MAAM,CAAC;IACjC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,eAAe,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,6FAA6F;AAC7F,wBAAgB,+BAA+B,CAAC,YAAY,EAAE,MAAM,GAAG,sBAAsB,CAiB5F"}
|
package/dist/sql/validate.js
CHANGED
|
@@ -1,5 +1,14 @@
|
|
|
1
1
|
import { SqlValidationError } from "../errors.js";
|
|
2
|
-
import {
|
|
2
|
+
import { BUILT_IN_DIALECTS } from "./dialect-spec.js";
|
|
3
|
+
import { ENGINE_LEXER_PROFILES, GENERIC_LEXER, lexSql, lexerProfileFor, } from "./lexer.js";
|
|
4
|
+
/**
|
|
5
|
+
* Keywords rejected in every dialect. Matched against unquoted word tokens only, so
|
|
6
|
+
* `deleted_at`, `"delete"`, and `'delete me'` are unaffected.
|
|
7
|
+
*
|
|
8
|
+
* `into` covers `SELECT … INTO new_table` (creates a table), MySQL `INTO OUTFILE` /
|
|
9
|
+
* `INTO DUMPFILE` / `INTO @var`, and T-SQL `SELECT … INTO`. No read-only SELECT needs it.
|
|
10
|
+
* `merge` covers data-modifying `MERGE` inside a CTE (Postgres 17+) and T-SQL `MERGE`.
|
|
11
|
+
*/
|
|
3
12
|
const BASE_FORBIDDEN = [
|
|
4
13
|
"insert",
|
|
5
14
|
"update",
|
|
@@ -14,71 +23,148 @@ const BASE_FORBIDDEN = [
|
|
|
14
23
|
"analyze",
|
|
15
24
|
"copy",
|
|
16
25
|
"call",
|
|
26
|
+
"merge",
|
|
27
|
+
"into",
|
|
17
28
|
];
|
|
18
29
|
function validationError(rule, summary, hint) {
|
|
19
30
|
return new SqlValidationError(summary, rule, hint);
|
|
20
31
|
}
|
|
21
32
|
/**
|
|
22
|
-
*
|
|
23
|
-
*
|
|
24
|
-
*
|
|
33
|
+
* Read-only SELECT check for model-generated SQL. It is **defense in depth**, not a
|
|
34
|
+
* security boundary: it lexes SQL the way the target engine does and rejects shapes
|
|
35
|
+
* that are clearly not a single read-only query, but it is not a SQL parser and cannot
|
|
36
|
+
* prove a statement is harmless. Run generated SQL under a database role that can only
|
|
37
|
+
* read what the caller may see.
|
|
38
|
+
*
|
|
39
|
+
* Checks, in order (the first failure throws {@link SqlValidationError}):
|
|
40
|
+
*
|
|
41
|
+
* 1. `SQL_EMPTY` — nothing left after trimming.
|
|
42
|
+
* 2. `SQL_UNTERMINATED` — a string, quoted identifier, dollar-quoted string, or block
|
|
43
|
+
* comment never closes. Fails closed rather than guessing where it ends.
|
|
44
|
+
* 3. `SQL_MULTI_STATEMENT` — any `;` other than a single trailing one.
|
|
45
|
+
* 4. `SQL_COMMENT` — any comment (`--`, `/* *\/`, and MySQL `#`).
|
|
46
|
+
* 5. `SQL_NOT_SELECT_OR_WITH` — the first token (after any `(`) is not `SELECT`/`WITH`.
|
|
47
|
+
* 6. `SQL_FORBIDDEN_KEYWORD` — an unquoted keyword from the shared denylist or the
|
|
48
|
+
* dialect's `extraForbiddenKeywords`.
|
|
49
|
+
* 7. `SQL_FORBIDDEN_FUNCTION` — a call (`name(`) to a function in the dialect's
|
|
50
|
+
* `blockedFunctions` (side-effecting or file/network/sleep functions).
|
|
51
|
+
*
|
|
52
|
+
* Then the dialect's `extraValidate` runs on the normalized SQL (trailing `;` removed).
|
|
53
|
+
*
|
|
54
|
+
* The lexer follows `dialect.id`. When the id is not a built-in engine family, the SQL
|
|
55
|
+
* must pass under every built-in lexer with every built-in denylist.
|
|
25
56
|
*/
|
|
26
57
|
export function validateSelectSql(dialect, sql) {
|
|
27
58
|
const trimmed = sql.trim();
|
|
28
59
|
if (!trimmed) {
|
|
29
60
|
throw validationError("SQL_EMPTY", "Generated SQL is empty after extraction.", "The model reply had no usable ```sql fenced block or the block was blank. Retry with a clearer question or inspect the raw model output with logging.");
|
|
30
61
|
}
|
|
31
|
-
const
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
62
|
+
const profile = lexerProfileFor(dialect);
|
|
63
|
+
let tokens;
|
|
64
|
+
if (profile) {
|
|
65
|
+
tokens = checkWithProfile(trimmed, profile, forbiddenKeywordsFor(dialect), blockedFunctionsFor(dialect));
|
|
66
|
+
}
|
|
67
|
+
else {
|
|
68
|
+
// Unknown engine: every plausible reading of the SQL must be safe.
|
|
69
|
+
const keywords = new Set([...forbiddenKeywordsFor(dialect), ...allBuiltInKeywords()]);
|
|
70
|
+
const functions = new Set([...blockedFunctionsFor(dialect), ...allBuiltInFunctions()]);
|
|
71
|
+
tokens = [];
|
|
72
|
+
for (const p of ENGINE_LEXER_PROFILES)
|
|
73
|
+
tokens = checkWithProfile(trimmed, p, keywords, functions);
|
|
74
|
+
}
|
|
75
|
+
const last = tokens[tokens.length - 1];
|
|
76
|
+
const normalized = isPunct(last, ";") ? trimmed.slice(0, last.start).trim() : trimmed;
|
|
77
|
+
dialect.extraValidate?.(normalized);
|
|
78
|
+
return normalized;
|
|
79
|
+
}
|
|
80
|
+
function checkWithProfile(sql, profile, keywords, functions) {
|
|
81
|
+
const tokens = lexSql(sql, profile);
|
|
82
|
+
const open = tokens.find((t) => t.unterminated);
|
|
83
|
+
if (open) {
|
|
84
|
+
throw validationError("SQL_UNTERMINATED", `Generated SQL has an unterminated ${describeToken(open)}.`, "A quote, dollar-quote, or block comment never closes, so where the statement ends is ambiguous. Regenerate the query; the validator fails closed rather than guessing.");
|
|
85
|
+
}
|
|
86
|
+
tokens.forEach((t, idx) => {
|
|
87
|
+
if (isPunct(t, ";") && idx !== tokens.length - 1) {
|
|
35
88
|
throw validationError("SQL_MULTI_STATEMENT", "Multiple SQL statements are not allowed (semicolon separates more than one statement).", "Ask for a single SELECT (WITH … SELECT allowed). Split analytical steps into separate questions or use a CTE instead of multiple statements.");
|
|
36
89
|
}
|
|
90
|
+
});
|
|
91
|
+
const commentLike = tokens.some((t, idx) => t.kind === "comment" ||
|
|
92
|
+
// `--` / `/*` that this dialect lexes as operators (MySQL `1--1`) are still rejected,
|
|
93
|
+
// matching the historical "no comment markers" policy.
|
|
94
|
+
(t.kind === "punct" &&
|
|
95
|
+
((t.text === "-" && isAdjacentPunct(t, tokens[idx + 1], "-")) ||
|
|
96
|
+
(t.text === "/" && isAdjacentPunct(t, tokens[idx + 1], "*")))));
|
|
97
|
+
if (commentLike) {
|
|
98
|
+
throw validationError("SQL_COMMENT", "SQL comments (-- or /* … */, and # in MySQL) are not allowed under current guardrails.", "Remove comments from generated SQL; rely on clear column aliases and CTE names instead.");
|
|
37
99
|
}
|
|
38
|
-
|
|
39
|
-
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
if (head !== "select" && head !== "with") {
|
|
43
|
-
throw validationError("SQL_NOT_SELECT_OR_WITH", `SQL must start with SELECT or WITH (got '${head || "none"}').`, "Regenerate as a read-only SELECT (optionally with WITH). INSERT/UPDATE/DELETE and procedural calls are blocked in dev guardrails.");
|
|
100
|
+
const head = headToken(tokens);
|
|
101
|
+
if (head?.kind !== "word" || (head.lower !== "select" && head.lower !== "with")) {
|
|
102
|
+
const got = head ? head.value.toLowerCase() : "";
|
|
103
|
+
throw validationError("SQL_NOT_SELECT_OR_WITH", `SQL must start with SELECT or WITH (got '${got || "none"}').`, "Regenerate as a read-only SELECT (optionally with WITH). INSERT/UPDATE/DELETE and procedural calls are blocked in dev guardrails.");
|
|
44
104
|
}
|
|
45
|
-
const
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
const re = new RegExp(`\\b${word}\\b`, "i");
|
|
49
|
-
if (re.test(lower)) {
|
|
50
|
-
throw validationError("SQL_FORBIDDEN_KEYWORD", `Forbidden keyword in generated SQL: ${word.toUpperCase()}.`, `Matched whole-word guardrail keyword "${word}". This build allows read-only SELECT shape only; DDL/DML and similar verbs are rejected.`);
|
|
105
|
+
for (const t of tokens) {
|
|
106
|
+
if (t.kind === "word" && keywords.has(t.lower)) {
|
|
107
|
+
throw validationError("SQL_FORBIDDEN_KEYWORD", `Forbidden keyword in generated SQL: ${t.lower.toUpperCase()}.`, `Matched whole-word guardrail keyword "${t.lower}". This build allows read-only SELECT shape only; DDL/DML, SELECT … INTO, and similar verbs are rejected.`);
|
|
51
108
|
}
|
|
52
109
|
}
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
110
|
+
tokens.forEach((t, idx) => {
|
|
111
|
+
const nameLike = t.kind === "word" || t.kind === "quoted_identifier" || (t.kind === "string" && t.quote === '"');
|
|
112
|
+
if (!nameLike)
|
|
113
|
+
return;
|
|
114
|
+
const name = t.kind === "string" ? t.text.slice(1, -1).toLowerCase() : t.lower;
|
|
115
|
+
if (functions.has(name) && isPunct(tokens[idx + 1], "(")) {
|
|
116
|
+
throw validationError("SQL_FORBIDDEN_FUNCTION", `Forbidden function in generated SQL: ${name}().`, `"${name}" has side effects (writes, file or network access, sleeping, session changes) and is blocked for this dialect. Remove the call.`);
|
|
117
|
+
}
|
|
118
|
+
});
|
|
119
|
+
return tokens;
|
|
120
|
+
}
|
|
121
|
+
function forbiddenKeywordsFor(dialect) {
|
|
122
|
+
return new Set([...BASE_FORBIDDEN, ...(dialect.extraForbiddenKeywords ?? [])].map((w) => w.toLowerCase()));
|
|
123
|
+
}
|
|
124
|
+
function blockedFunctionsFor(dialect) {
|
|
125
|
+
return new Set((dialect.blockedFunctions ?? []).map((w) => w.toLowerCase()));
|
|
126
|
+
}
|
|
127
|
+
function allBuiltInKeywords() {
|
|
128
|
+
return Object.values(BUILT_IN_DIALECTS).flatMap((d) => [...(d.extraForbiddenKeywords ?? [])]);
|
|
129
|
+
}
|
|
130
|
+
function allBuiltInFunctions() {
|
|
131
|
+
return Object.values(BUILT_IN_DIALECTS).flatMap((d) => [...(d.blockedFunctions ?? [])]);
|
|
132
|
+
}
|
|
133
|
+
function isPunct(t, text) {
|
|
134
|
+
return t?.kind === "punct" && t.text === text;
|
|
135
|
+
}
|
|
136
|
+
function isAdjacentPunct(t, next, text) {
|
|
137
|
+
return isPunct(next, text) && next.start === t.end;
|
|
138
|
+
}
|
|
139
|
+
/** First significant token, skipping leading `(` so `(SELECT …) UNION (SELECT …)` passes. */
|
|
140
|
+
function headToken(tokens) {
|
|
141
|
+
return tokens.find((t) => !isPunct(t, "("));
|
|
142
|
+
}
|
|
143
|
+
function describeToken(t) {
|
|
144
|
+
if (t.kind === "comment")
|
|
145
|
+
return "block comment";
|
|
146
|
+
if (t.kind === "quoted_identifier")
|
|
147
|
+
return "quoted identifier";
|
|
148
|
+
if (t.quote?.startsWith("$"))
|
|
149
|
+
return "dollar-quoted string";
|
|
150
|
+
return "string literal";
|
|
56
151
|
}
|
|
57
152
|
/** Build a structured summary for hosts/CLI `--explain`; input must already be validated. */
|
|
58
153
|
export function buildSelectGuardrailExplanation(validatedSql) {
|
|
59
|
-
const
|
|
60
|
-
const
|
|
61
|
-
const statementKind = head === "with" ? "with" : "select";
|
|
154
|
+
const head = headToken(lexSql(validatedSql.trim(), GENERIC_LEXER));
|
|
155
|
+
const statementKind = head?.lower === "with" ? "with" : "select";
|
|
62
156
|
return {
|
|
63
157
|
statementKind,
|
|
64
158
|
checksVerified: [
|
|
65
159
|
"non_empty_sql",
|
|
160
|
+
"no_unterminated_literals_or_comments",
|
|
66
161
|
"single_statement",
|
|
67
162
|
"no_line_or_block_comments",
|
|
68
163
|
"leading_select_or_with",
|
|
69
164
|
"no_blocked_write_or_ddl_keywords",
|
|
165
|
+
"no_blocked_side_effect_functions",
|
|
70
166
|
],
|
|
71
|
-
remediationNote: "Heuristic
|
|
167
|
+
remediationNote: "Heuristic, lexer-based defense-in-depth checks only—not a SQL parser and not a security boundary. Execute generated SQL under a read-only database role, and review it before trusted execution.",
|
|
72
168
|
};
|
|
73
169
|
}
|
|
74
|
-
function firstMeaningfulToken(withoutStrings) {
|
|
75
|
-
const token = /([a-zA-Z_][\w$]*|"[^"]*")/.exec(withoutStrings.trim());
|
|
76
|
-
if (!token)
|
|
77
|
-
return "";
|
|
78
|
-
let t = token[1];
|
|
79
|
-
if (t.startsWith('"') && t.endsWith('"')) {
|
|
80
|
-
t = t.slice(1, -1);
|
|
81
|
-
}
|
|
82
|
-
return t.toLowerCase();
|
|
83
|
-
}
|
|
84
170
|
//# sourceMappingURL=validate.js.map
|
package/dist/sql/validate.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA8B,MAAM,cAAc,CAAC;
|
|
1
|
+
{"version":3,"file":"validate.js","sourceRoot":"","sources":["../../src/sql/validate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAA8B,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAoB,MAAM,mBAAmB,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,aAAa,EACb,MAAM,EACN,eAAe,GAGhB,MAAM,YAAY,CAAC;AAEpB;;;;;;;GAOG;AACH,MAAM,cAAc,GAAsB;IACxC,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,UAAU;IACV,OAAO;IACP,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;CACP,CAAC;AAEF,SAAS,eAAe,CAAC,IAA2B,EAAE,OAAe,EAAE,IAAY;IACjF,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAoB,EAAE,GAAW;IACjE,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,eAAe,CACnB,WAAW,EACX,0CAA0C,EAC1C,uJAAuJ,CACxJ,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IACzC,IAAI,MAAkB,CAAC;IACvB,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,oBAAoB,CAAC,OAAO,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3G,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,CAAC,OAAO,CAAC,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC,CAAC;QACtF,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,mBAAmB,CAAC,OAAO,CAAC,EAAE,GAAG,mBAAmB,EAAE,CAAC,CAAC,CAAC;QACvF,MAAM,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,IAAI,qBAAqB;YAAE,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACvF,OAAO,CAAC,aAAa,EAAE,CAAC,UAAU,CAAC,CAAC;IACpC,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CACvB,GAAW,EACX,OAAwB,EACxB,QAA6B,EAC7B,SAA8B;IAE9B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEpC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IAChD,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,eAAe,CACnB,kBAAkB,EAClB,qCAAqC,aAAa,CAAC,IAAI,CAAC,GAAG,EAC3D,wKAAwK,CACzK,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACxB,IAAI,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,GAAG,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjD,MAAM,eAAe,CACnB,qBAAqB,EACrB,wFAAwF,EACxF,8IAA8I,CAC/I,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC7B,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,CACT,CAAC,CAAC,IAAI,KAAK,SAAS;QACpB,sFAAsF;QACtF,uDAAuD;QACvD,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO;YACjB,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAC3D,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,eAAe,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,eAAe,CACnB,aAAa,EACb,wFAAwF,EACxF,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,MAAM,CAAC,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjD,MAAM,eAAe,CACnB,wBAAwB,EACxB,4CAA4C,GAAG,IAAI,MAAM,KAAK,EAC9D,mIAAmI,CACpI,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/C,MAAM,eAAe,CACnB,uBAAuB,EACvB,uCAAuC,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAC/D,yCAAyC,CAAC,CAAC,KAAK,2GAA2G,CAC5J,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,QAAQ,GACZ,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAC;QAClG,IAAI,CAAC,QAAQ;YAAE,OAAO;QACtB,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAC/E,IAAI,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,eAAe,CACnB,wBAAwB,EACxB,wCAAwC,IAAI,KAAK,EACjD,IAAI,IAAI,kIAAkI,CAC3I,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAoB;IAChD,OAAO,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAoB;IAC/C,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,SAAS,mBAAmB;IAC1B,OAAO,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,OAAO,CAAC,CAAuB,EAAE,IAAY;IACpD,OAAO,CAAC,EAAE,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,eAAe,CAAC,CAAW,EAAE,IAA0B,EAAE,IAAY;IAC5E,OAAO,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAK,CAAC,KAAK,KAAK,CAAC,CAAC,GAAG,CAAC;AACtD,CAAC;AAED,6FAA6F;AAC7F,SAAS,SAAS,CAAC,MAA2B;IAC5C,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,aAAa,CAAC,CAAW;IAChC,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,eAAe,CAAC;IACjD,IAAI,CAAC,CAAC,IAAI,KAAK,mBAAmB;QAAE,OAAO,mBAAmB,CAAC;IAC/D,IAAI,CAAC,CAAC,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,sBAAsB,CAAC;IAC5D,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AASD,6FAA6F;AAC7F,MAAM,UAAU,+BAA+B,CAAC,YAAoB;IAClE,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;IACnE,MAAM,aAAa,GAAsB,IAAI,EAAE,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpF,OAAO;QACL,aAAa;QACb,cAAc,EAAE;YACd,eAAe;YACf,sCAAsC;YACtC,kBAAkB;YAClB,2BAA2B;YAC3B,wBAAwB;YACxB,kCAAkC;YAClC,kCAAkC;SACnC;QACD,eAAe,EACb,kMAAkM;KACrM,CAAC;AACJ,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@askdb/core",
|
|
3
|
-
"version": "1.0.0-beta.
|
|
3
|
+
"version": "1.0.0-beta.43",
|
|
4
4
|
"description": "AskDB core: dialect-agnostic NL→SQL pipeline. Provides ask() orchestration, schema/IR types, modes, logging, and retrieval input. Bring your own dialect (e.g. @askdb/postgres).",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"askdb",
|
|
@@ -11,7 +11,7 @@
|
|
|
11
11
|
"ai-sdk",
|
|
12
12
|
"schema-v2"
|
|
13
13
|
],
|
|
14
|
-
"homepage": "https://
|
|
14
|
+
"homepage": "https://askdb.tools/reference/core-api/",
|
|
15
15
|
"bugs": {
|
|
16
16
|
"url": "https://github.com/Ygilany/AskDB/issues"
|
|
17
17
|
},
|
|
@@ -23,6 +23,7 @@
|
|
|
23
23
|
"license": "Apache-2.0",
|
|
24
24
|
"author": "Yahya Gilany",
|
|
25
25
|
"type": "module",
|
|
26
|
+
"sideEffects": false,
|
|
26
27
|
"main": "./dist/index.js",
|
|
27
28
|
"types": "./dist/index.d.ts",
|
|
28
29
|
"exports": {
|
|
@@ -42,14 +43,14 @@
|
|
|
42
43
|
"node": ">=22.12"
|
|
43
44
|
},
|
|
44
45
|
"dependencies": {
|
|
45
|
-
"ai": "^7.0.
|
|
46
|
+
"ai": "^7.0.113",
|
|
46
47
|
"gray-matter": "^4.0.3",
|
|
47
48
|
"pino": "^10.3.1",
|
|
48
|
-
"zod": "^4.
|
|
49
|
+
"zod": "^4.6.5"
|
|
49
50
|
},
|
|
50
51
|
"devDependencies": {
|
|
51
52
|
"typescript": "^6.0.3",
|
|
52
|
-
"vitest": "^
|
|
53
|
+
"vitest": "^5.0.1"
|
|
53
54
|
},
|
|
54
55
|
"scripts": {
|
|
55
56
|
"build": "tsc -p tsconfig.build.json",
|
package/dist/exec/postgres.d.ts
DELETED
|
@@ -1 +0,0 @@
|
|
|
1
|
-
{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../../src/exec/postgres.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC;CACnB,CAAC;AAEF,wBAAsB,qBAAqB,CAAC,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAuBzG"}
|
package/dist/exec/postgres.js
DELETED
|
@@ -1,30 +0,0 @@
|
|
|
1
|
-
import pg from "pg";
|
|
2
|
-
import { SqlExecutionError } from "../errors.js";
|
|
3
|
-
export async function executeReadOnlySelect(connectionString, sql) {
|
|
4
|
-
const pool = new pg.Pool({ connectionString });
|
|
5
|
-
const client = await pool.connect();
|
|
6
|
-
try {
|
|
7
|
-
await client.query("BEGIN READ ONLY");
|
|
8
|
-
const res = await client.query(sql);
|
|
9
|
-
await client.query("COMMIT");
|
|
10
|
-
const fields = res.fields ?? [];
|
|
11
|
-
const columns = fields.map((f) => f.name);
|
|
12
|
-
const rows = res.rows.map((row) => fields.map((f) => row[f.name]));
|
|
13
|
-
return { columns, rows };
|
|
14
|
-
}
|
|
15
|
-
catch (e) {
|
|
16
|
-
try {
|
|
17
|
-
await client.query("ROLLBACK");
|
|
18
|
-
}
|
|
19
|
-
catch {
|
|
20
|
-
/* ignore */
|
|
21
|
-
}
|
|
22
|
-
const message = e instanceof Error ? e.message : String(e);
|
|
23
|
-
throw new SqlExecutionError(`PostgreSQL execution failed: ${message}`, e);
|
|
24
|
-
}
|
|
25
|
-
finally {
|
|
26
|
-
client.release();
|
|
27
|
-
await pool.end();
|
|
28
|
-
}
|
|
29
|
-
}
|
|
30
|
-
//# sourceMappingURL=postgres.js.map
|