@blamejs/core 0.14.26 → 0.15.0

package/lib/db-declare-row-policy.js

@@ -54,6 +54,7 @@
  *   }
  */
 var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
 
@@ -64,6 +65,8 @@ var ALLOWED_OPTS = [
   "using", "withCheck", "command", "permissive", "backend",
 ];
 
+// allow:hand-rolled-sql — RLS FOR-<command> keyword allowlist, not SQL text;
+// the policy itself is composed through b.sql.createPolicy.
 var ALLOWED_COMMANDS = ["ALL", "SELECT", "INSERT", "UPDATE", "DELETE"];
 
 function _err(code, message) {
@@ -192,9 +195,9 @@ function _ensureBackendIsPostgres(externalDb, backendName) {
 
 function declareRowPolicy(opts) {
   var spec = _validateOpts(opts);
-  var qTable  = safeSql.quoteQualified([spec.schema, spec.table], "postgres");
-  var qPolicy = safeSql.quoteIdentifier(spec.name, "postgres");
-  var qRole   = spec.role ? safeSql.quoteIdentifier(spec.role, "postgres") : null;
+  // The dotted "schema.table" form b.sql's RLS builders accept (each
+  // segment validated + quoted by construction inside b.sql).
+  var tableRef = spec.schema + "." + spec.table;
 
   var description = "declareRowPolicy " + spec.schema + "." + spec.table + "." + spec.name;
 
@@ -206,13 +209,18 @@ function declareRowPolicy(opts) {
     // Idempotent ENABLE — Postgres has no IF NOT EXISTS for this. Read
     // the current setting from pg_class and skip the ALTER when already
     // on, so re-running a migration set in a partially-applied state
-    // doesn't fail with a no-op error from the lock acquisition.
-    var rlsCheck = await xdb.query(
-      "SELECT relrowsecurity FROM pg_class c " +
-      "JOIN pg_namespace n ON n.oid = c.relnamespace " +
-      "WHERE n.nspname = $1 AND c.relname = $2",
-      [spec.schema, spec.table]
-    );
+    // doesn't fail with a no-op error from the lock acquisition. The
+    // pg_class / pg_namespace catalog join is composed through b.sql with
+    // a guarded raw join (system-catalog columns are outside any operator
+    // schema, so a column gate has no set to check); the schema + table
+    // names bind as parameters, never interpolate.
+    var rlsQuery = sql.select("pg_class", { dialect: "postgres", alias: "c" })
+      .columns(["c.relrowsecurity"])
+      .joinRaw("JOIN pg_namespace n ON n.oid = c.relnamespace")
+      .whereRaw("n.nspname = ?", [spec.schema])
+      .whereRaw("c.relname = ?", [spec.table])
+      .toExternalSql("postgres");
+    var rlsCheck = await xdb.query(rlsQuery.sql, rlsQuery.params);
     var rows = (rlsCheck && rlsCheck.rows) || [];
     if (rows.length === 0) {
       throw _err("declare-row-policy/table-not-found",
@@ -220,19 +228,23 @@ function declareRowPolicy(opts) {
         "' not found (does it exist? does the migration role have visibility?)");
     }
     if (!rows[0].relrowsecurity) {
-      await xdb.query("ALTER TABLE " + qTable + " ENABLE ROW LEVEL SECURITY", []);
+      var enableStmt = sql.enableRowLevelSecurity(tableRef, { dialect: "postgres" });
+      await xdb.query(enableStmt.sql, enableStmt.params);
     }
 
-    // CREATE POLICY assembled in canonical order: name → table → AS
-    // PERMISSIVE/RESTRICTIVE → FOR command → TO role → USING → WITH CHECK.
-    var sql = "CREATE POLICY " + qPolicy + " ON " + qTable;
-    sql += " AS " + (spec.permissive ? "PERMISSIVE" : "RESTRICTIVE");
-    sql += " FOR " + spec.command;
-    if (qRole) sql += " TO " + qRole;
-    sql += " USING (" + spec.using + ")";
-    if (spec.withCheck) sql += " WITH CHECK (" + spec.withCheck + ")";
-
-    await xdb.query(sql, []);
+    // CREATE POLICY assembled in canonical order by b.sql.createPolicy:
+    // name → table → AS PERMISSIVE/RESTRICTIVE → FOR command → TO role →
+    // USING → WITH CHECK. The using / withCheck boolean predicates ride
+    // b.sql's guarded raw-fragment path (the same b.guardSql gate the
+    // operator-facing whereRaw uses).
+    var policyStmt = sql.createPolicy(spec.name, tableRef, {
+      command:    spec.command,
+      permissive: spec.permissive,
+      role:       spec.role || undefined,
+      using:      spec.using,
+      withCheck:  spec.withCheck || undefined,
+    }, { dialect: "postgres" });
+    await xdb.query(policyStmt.sql, policyStmt.params);
 
     return {
       policy:       spec.schema + "." + spec.table + "." + spec.name,
@@ -248,7 +260,8 @@ function declareRowPolicy(opts) {
     if (ctx && ctx.externalDb && ctx.backendName) {
       _ensureBackendIsPostgres(ctx.externalDb, ctx.backendName);
     }
-    await xdb.query("DROP POLICY IF EXISTS " + qPolicy + " ON " + qTable, []);
+    var dropStmt = sql.dropPolicy(spec.name, tableRef, { dialect: "postgres", ifExists: true });
+    await xdb.query(dropStmt.sql, dropStmt.params);
   }
 
   return {

package/lib/db-file-lifecycle.js

@@ -63,6 +63,7 @@ var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var { generateBytes, generateToken, encryptPacked, decryptPacked } = require("./crypto");
+var frameworkFiles = require("./framework-files");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var { defineClass } = require("./framework-error");
@@ -162,13 +163,13 @@ function fileLifecycle(opts) {
     DbFileLifecycleError, "db-file-lifecycle/bad-flush-interval");
 
   var label = opts.label || "default";
-  var encName = opts.encryptedDbName || "db.enc";
+  var encName = opts.encryptedDbName || frameworkFiles.fileName("dbEnc");
   var encPath = opts.encryptedDbPath
     ? nodePath.resolve(opts.encryptedDbPath)
     : nodePath.join(opts.dataDir, encName);
   var keyPath = opts.dbKeyPath
     ? nodePath.resolve(opts.dbKeyPath)
-    : nodePath.join(opts.dataDir, "db.key.enc");
+    : nodePath.join(opts.dataDir, frameworkFiles.fileName("dbKeyEnc"));
   var flushIntervalMs = opts.flushIntervalMs || DEFAULT_FLUSH_INTERVAL_MS;
   var tmpDir = _resolveTmpDir(opts.tmpDir, opts.allowDiskFallback === true);
   if (!nodeFs.existsSync(tmpDir)) nodeFs.mkdirSync(tmpDir, { recursive: true });