@cfast/db 0.2.0 → 0.4.0

package/dist/index.js

@@ -12,14 +12,17 @@ import {
 } from "@cfast/permissions";
 import { CRUD_ACTIONS } from "@cfast/permissions";
 function resolvePermissionFilters(grants, action, table) {
+  const targetName = getTableName(table);
   const matching = grants.filter((g) => {
     const actionMatch = g.action === action || g.action === "manage";
-    const tableMatch = g.subject === "all" || g.subject === table || typeof g.subject === "object" && getTableName(g.subject) === getTableName(table);
+    const tableMatch = g.subject === "all" || g.subject === table || getTableName(g.subject) === targetName;
     return actionMatch && tableMatch;
   });
   if (matching.length === 0) return [];
   if (matching.some((g) => !g.where)) return [];
-  return matching.filter((g) => !!g.where).map((g) => g.where);
+  return matching.filter(
+    (g) => !!g.where
+  );
 }
 function grantMatchesAction(grantAction, requiredAction) {
   if (grantAction === requiredAction) return true;
@@ -60,6 +63,7 @@ function checkOperationPermissions(grants, descriptors) {
 }
 
 // src/utils.ts
+import { AsyncLocalStorage } from "async_hooks";
 import { and, or } from "drizzle-orm";
 import { getTableName as getTableName2 } from "@cfast/permissions";
 function deduplicateDescriptors(descriptors) {
@@ -74,13 +78,46 @@ function deduplicateDescriptors(descriptors) {
   }
   return result;
 }
-function buildPermissionFilter(grants, action, table, user, unsafe) {
+var lookupCacheStorage = new AsyncLocalStorage();
+function createLookupCache() {
+  return /* @__PURE__ */ new Map();
+}
+function runWithLookupCache(fn, cache = createLookupCache()) {
+  return lookupCacheStorage.run(cache, fn);
+}
+function getActiveLookupCache(fallback) {
+  return lookupCacheStorage.getStore() ?? fallback;
+}
+async function resolveGrantLookups(grant, user, lookupDb, cache) {
+  if (!grant.with) return {};
+  const activeCache = getActiveLookupCache(cache);
+  const cached = activeCache.get(grant);
+  if (cached) return cached;
+  const entries = Object.entries(grant.with);
+  const promise = (async () => {
+    const resolved = {};
+    await Promise.all(
+      entries.map(async ([key, fn]) => {
+        resolved[key] = await fn(user, lookupDb);
+      })
+    );
+    return resolved;
+  })();
+  activeCache.set(grant, promise);
+  return promise;
+}
+async function buildPermissionFilter(grants, action, table, user, unsafe, getLookupDb, cache) {
   if (unsafe || !user) return void 0;
-  const filters = resolvePermissionFilters(grants, action, table);
-  if (filters.length === 0) return void 0;
+  const matching = resolvePermissionFilters(grants, action, table);
+  if (matching.length === 0) return void 0;
   const columns = table;
-  const clauses = filters.map(
-    (fn) => fn(columns, user)
+  const needsLookupDb = matching.some((g) => g.with !== void 0);
+  const lookupDb = needsLookupDb ? getLookupDb() : void 0;
+  const lookupSets = await Promise.all(
+    matching.map((g) => resolveGrantLookups(g, user, lookupDb, cache))
+  );
+  const clauses = matching.map(
+    (g, i) => g.where(columns, user, lookupSets[i])
   );
   return or(...clauses);
 }
@@ -191,12 +228,14 @@ function buildQueryOperation(config, db, tableKey, method, options) {
       if (!config.unsafe) {
         checkOperationPermissions(config.grants, permissions);
       }
-      const permFilter = buildPermissionFilter(
+      const permFilter = await buildPermissionFilter(
         config.grants,
         "read",
         config.table,
         config.user,
-        config.unsafe
+        config.unsafe,
+        config.getLookupDb,
+        config.lookupCache
       );
       const userWhere = options?.where;
       const combinedWhere = combineWhere(userWhere, permFilter);
@@ -243,16 +282,18 @@ function createQueryBuilder(config) {
         if (!tableKey) throw new Error("Table not found in schema");
         return tableKey;
       }
-      function checkAndBuildWhere(extraWhere) {
+      async function checkAndBuildWhere(extraWhere) {
         if (!config.unsafe) {
           checkOperationPermissions(config.grants, permissions);
         }
-        const permFilter = buildPermissionFilter(
+        const permFilter = await buildPermissionFilter(
           config.grants,
           "read",
           config.table,
           config.user,
-          config.unsafe
+          config.unsafe,
+          config.getLookupDb,
+          config.lookupCache
         );
         return combineWhere(
           combineWhere(options?.where, permFilter),
@@ -282,7 +323,7 @@ function createQueryBuilder(config) {
             const cursorValues = decodeCursor(params.cursor);
             const direction = options?.orderDirection ?? "desc";
             const cursorWhere = cursorValues ? buildCursorWhere(cursorColumns, cursorValues, direction) : void 0;
-            const combinedWhere = checkAndBuildWhere(cursorWhere);
+            const combinedWhere = await checkAndBuildWhere(cursorWhere);
             const queryOptions = buildBaseQueryOptions(combinedWhere);
             queryOptions.limit = params.limit + 1;
             const queryTable = getQueryTable(db, key);
@@ -303,7 +344,7 @@ function createQueryBuilder(config) {
         permissions,
         async run(_params) {
           const key = ensureTableKey();
-          const combinedWhere = checkAndBuildWhere();
+          const combinedWhere = await checkAndBuildWhere();
           const queryOptions = buildBaseQueryOptions(combinedWhere);
           queryOptions.limit = params.limit;
           queryOptions.offset = (params.page - 1) * params.limit;
@@ -344,10 +385,11 @@ function checkIfNeeded(config, grants, permissions) {
     checkOperationPermissions(grants, permissions);
   }
 }
-function buildMutationWithReturning(config, permissions, tableName, buildQuery) {
+function buildMutationWithReturning(config, permissions, tableName, buildQuery, prepareFn) {
   const drizzleDb = drizzle2(config.d1, { schema: config.schema });
   const runOnce = async (returning) => {
     checkIfNeeded(config, config.grants, permissions);
+    if (prepareFn) await prepareFn();
     const built = buildQuery(drizzleDb, returning);
     const result = await built.execute(returning);
     config.onMutate?.(tableName);
@@ -366,6 +408,7 @@ function buildMutationWithReturning(config, permissions, tableName, buildQuery)
         }
       };
       returningOp[BATCHABLE] = {
+        prepare: prepareFn,
         build: (sharedDb) => buildQuery(sharedDb, true).query,
         tableName,
         withResult: true
@@ -374,6 +417,7 @@ function buildMutationWithReturning(config, permissions, tableName, buildQuery)
     }
   };
   baseOp[BATCHABLE] = {
+    prepare: prepareFn,
     build: (sharedDb) => buildQuery(sharedDb, false).query,
     tableName,
     withResult: false
@@ -409,17 +453,31 @@ function createUpdateBuilder(config) {
     set(values) {
       return {
         where(condition) {
-          const permFilter = buildPermissionFilter(
-            config.grants,
-            "update",
-            config.table,
-            config.user,
-            config.unsafe
-          );
-          const combinedWhere = combineWhere(condition, permFilter);
+          let resolvedCombinedWhere;
+          let preparePromise;
+          const prepareFn = () => {
+            if (!preparePromise) {
+              preparePromise = (async () => {
+                const permFilter = await buildPermissionFilter(
+                  config.grants,
+                  "update",
+                  config.table,
+                  config.user,
+                  config.unsafe,
+                  config.getLookupDb,
+                  config.lookupCache
+                );
+                resolvedCombinedWhere = combineWhere(
+                  condition,
+                  permFilter
+                );
+              })();
+            }
+            return preparePromise;
+          };
           const buildQuery = (sharedDb, returning) => {
             const base = sharedDb.update(config.table).set(values);
-            if (combinedWhere) base.where(combinedWhere);
+            if (resolvedCombinedWhere) base.where(resolvedCombinedWhere);
             const query = returning ? base.returning() : base;
             return {
               query,
@@ -431,7 +489,13 @@ function createUpdateBuilder(config) {
               }
             };
           };
-          return buildMutationWithReturning(config, permissions, tableName, buildQuery);
+          return buildMutationWithReturning(
+            config,
+            permissions,
+            tableName,
+            buildQuery,
+            prepareFn
+          );
         }
       };
     }
@@ -442,17 +506,31 @@ function createDeleteBuilder(config) {
   const tableName = getTableName2(config.table);
   return {
     where(condition) {
-      const permFilter = buildPermissionFilter(
-        config.grants,
-        "delete",
-        config.table,
-        config.user,
-        config.unsafe
-      );
-      const combinedWhere = combineWhere(condition, permFilter);
+      let resolvedCombinedWhere;
+      let preparePromise;
+      const prepareFn = () => {
+        if (!preparePromise) {
+          preparePromise = (async () => {
+            const permFilter = await buildPermissionFilter(
+              config.grants,
+              "delete",
+              config.table,
+              config.user,
+              config.unsafe,
+              config.getLookupDb,
+              config.lookupCache
+            );
+            resolvedCombinedWhere = combineWhere(
+              condition,
+              permFilter
+            );
+          })();
+        }
+        return preparePromise;
+      };
       const buildQuery = (sharedDb, returning) => {
         const base = sharedDb.delete(config.table);
-        if (combinedWhere) base.where(combinedWhere);
+        if (resolvedCombinedWhere) base.where(resolvedCombinedWhere);
         const query = returning ? base.returning() : base;
         return {
           query,
@@ -464,7 +542,13 @@ function createDeleteBuilder(config) {
           }
         };
       };
-      return buildMutationWithReturning(config, permissions, tableName, buildQuery);
+      return buildMutationWithReturning(
+        config,
+        permissions,
+        tableName,
+        buildQuery,
+        prepareFn
+      );
     }
   };
 }
@@ -590,16 +674,156 @@ function createCacheManager(config) {
   };
 }
 
+// src/transaction.ts
+var TransactionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TransactionError";
+  }
+};
+function wrapWriteOperation(ctx, op) {
+  const record = (toQueue) => {
+    if (ctx.closed) {
+      throw new TransactionError(
+        "Cannot run an operation after the transaction has committed or aborted."
+      );
+    }
+    if (ctx.aborted) {
+      throw new TransactionError(
+        "Transaction has been aborted; no further operations may run."
+      );
+    }
+    ctx.pending.push({ op: toQueue });
+  };
+  const proxied = {
+    permissions: op.permissions,
+    async run() {
+      record(op);
+      return void 0;
+    }
+  };
+  if (typeof op.returning === "function") {
+    proxied.returning = () => {
+      const returningOp = op.returning();
+      return {
+        permissions: returningOp.permissions,
+        async run() {
+          record(returningOp);
+          return void 0;
+        }
+      };
+    };
+  }
+  return proxied;
+}
+function createTxHandle(db, ctx) {
+  return {
+    query: (table) => {
+      return db.query(table);
+    },
+    insert: (table) => {
+      const realBuilder = db.insert(table);
+      return {
+        values: (values) => {
+          const realOp = realBuilder.values(values);
+          return wrapWriteOperation(ctx, realOp);
+        }
+      };
+    },
+    update: (table) => {
+      const realBuilder = db.update(table);
+      return {
+        set: (values) => {
+          const realSet = realBuilder.set(values);
+          return {
+            where: (condition) => {
+              const realOp = realSet.where(condition);
+              return wrapWriteOperation(ctx, realOp);
+            }
+          };
+        }
+      };
+    },
+    delete: (table) => {
+      const realBuilder = db.delete(table);
+      return {
+        where: (condition) => {
+          const realOp = realBuilder.where(condition);
+          return wrapWriteOperation(ctx, realOp);
+        }
+      };
+    },
+    transaction: (callback) => {
+      return runTransaction(db, callback, ctx);
+    }
+  };
+}
+async function flushWrites(db, pending) {
+  if (pending.length === 0) return;
+  const ops = pending.map((p) => p.op);
+  for (const op of ops) {
+    if (getBatchable(op) === void 0) {
+      throw new TransactionError(
+        "Internal error: a pending transaction operation was not batchable. Transactions only accept operations produced by tx.insert/update/delete."
+      );
+    }
+  }
+  await db.batch(ops).run({});
+}
+async function runTransaction(db, callback, parentCtx) {
+  if (parentCtx) {
+    if (parentCtx.closed || parentCtx.aborted) {
+      throw new TransactionError(
+        "Cannot start a nested transaction: parent has already committed or aborted."
+      );
+    }
+    const nestedTx = createTxHandle(db, parentCtx);
+    return callback(nestedTx);
+  }
+  const ctx = {
+    pending: [],
+    closed: false,
+    aborted: false,
+    nested: false
+  };
+  const tx = createTxHandle(db, ctx);
+  let result;
+  try {
+    result = await callback(tx);
+  } catch (err) {
+    ctx.aborted = true;
+    ctx.closed = true;
+    ctx.pending.length = 0;
+    throw err;
+  }
+  try {
+    await flushWrites(db, ctx.pending);
+    ctx.closed = true;
+  } catch (err) {
+    ctx.aborted = true;
+    ctx.closed = true;
+    throw err;
+  }
+  return result;
+}
+
 // src/create-db.ts
 function createDb(config) {
-  return buildDb(config, false);
+  const lookupCache = createLookupCache();
+  return buildDb(config, false, lookupCache);
 }
-function buildDb(config, isUnsafe) {
+function buildDb(config, isUnsafe, lookupCache) {
   const cacheManager = config.cache === false ? null : createCacheManager(config.cache ?? { backend: "cache-api" });
   const onMutate = (tableName) => {
     cacheManager?.invalidateTable(tableName);
   };
-  return {
+  let lookupDbCache = null;
+  const getLookupDb = () => {
+    if (lookupDbCache) return lookupDbCache;
+    lookupDbCache = isUnsafe ? db : buildDb(config, true, lookupCache);
+    return lookupDbCache;
+  };
+  const db = {
     query(table) {
       return createQueryBuilder({
         d1: config.d1,
@@ -607,7 +831,9 @@ function buildDb(config, isUnsafe) {
         grants: config.grants,
         user: config.user,
         table,
-        unsafe: isUnsafe
+        unsafe: isUnsafe,
+        lookupCache,
+        getLookupDb
       });
     },
     insert(table) {
@@ -618,7 +844,9 @@ function buildDb(config, isUnsafe) {
         user: config.user,
         table,
         unsafe: isUnsafe,
-        onMutate
+        onMutate,
+        lookupCache,
+        getLookupDb
       });
     },
     update(table) {
@@ -629,7 +857,9 @@ function buildDb(config, isUnsafe) {
         user: config.user,
         table,
         unsafe: isUnsafe,
-        onMutate
+        onMutate,
+        lookupCache,
+        getLookupDb
       });
     },
     delete(table) {
@@ -640,11 +870,13 @@ function buildDb(config, isUnsafe) {
         user: config.user,
         table,
         unsafe: isUnsafe,
-        onMutate
+        onMutate,
+        lookupCache,
+        getLookupDb
       });
     },
     unsafe() {
-      return buildDb(config, true);
+      return buildDb(config, true, lookupCache);
     },
     batch(operations) {
       const allPermissions = deduplicateDescriptors(
@@ -654,13 +886,19 @@ function buildDb(config, isUnsafe) {
         permissions: allPermissions,
         async run(params) {
           const p = params ?? {};
+          if (operations.length === 0) {
+            return [];
+          }
           if (!isUnsafe) {
             checkOperationPermissions(config.grants, allPermissions);
           }
           const batchables = operations.map((op) => getBatchable(op));
-          const everyOpBatchable = operations.length > 0 && batchables.every((b) => b !== void 0);
+          const everyOpBatchable = batchables.every((b) => b !== void 0);
           if (everyOpBatchable) {
             const sharedDb = drizzle3(config.d1, { schema: config.schema });
+            await Promise.all(
+              batchables.map((b) => b.prepare?.() ?? Promise.resolve())
+            );
             const items = batchables.map((b) => b.build(sharedDb));
             const batchResults = await sharedDb.batch(
               items
@@ -682,6 +920,9 @@ function buildDb(config, isUnsafe) {
         }
       };
     },
+    transaction(callback) {
+      return runTransaction(db, callback);
+    },
     cache: {
       async invalidate(options) {
         if (!cacheManager) return;
@@ -696,10 +937,27 @@ function buildDb(config, isUnsafe) {
       }
     }
   };
+  return db;
+}
+function createAppDb(config) {
+  const { d1, schema, cache } = config;
+  const getD1 = typeof d1 === "function" ? d1 : () => d1;
+  return (grants, user) => createDb({
+    d1: getD1(),
+    schema,
+    grants,
+    user,
+    cache
+  });
 }
 
 // src/compose.ts
 function compose(operations, executor) {
+  if (executor.length > 0 && executor.length !== operations.length) {
+    throw new Error(
+      `compose(): executor declares ${executor.length} parameter(s) but ${operations.length} operation(s) were passed. Each operation must have a corresponding run-function parameter (in array order), otherwise sub-operations will silently go uninvoked. Prefer composeSequentialCallback() for by-name binding.`
+    );
+  }
   const allPermissions = deduplicateDescriptors(
     operations.flatMap((op) => op.permissions)
   );
@@ -770,7 +1028,7 @@ function wrapForTracking(target, perms) {
   });
 }
 function createTrackingDb(real, perms) {
-  return {
+  const trackingDb = {
     query: (table) => wrapForTracking(real.query(table), perms),
     insert: (table) => wrapForTracking(real.insert(table), perms),
     update: (table) => wrapForTracking(real.update(table), perms),
@@ -787,8 +1045,23 @@ function createTrackingDb(real, perms) {
         }
       };
     },
+    transaction: async (callback) => {
+      const trackingTx = {
+        query: trackingDb.query,
+        insert: trackingDb.insert,
+        update: trackingDb.update,
+        delete: trackingDb.delete,
+        transaction: (cb) => trackingDb.transaction(cb)
+      };
+      try {
+        await callback(trackingTx);
+      } catch {
+      }
+      return createSentinel();
+    },
     cache: real.cache
   };
+  return trackingDb;
 }
 function composeSequentialCallback(db, callback) {
   const collected = [];
@@ -817,11 +1090,43 @@ function composeSequentialCallback(db, callback) {
     }
   };
 }
+
+// src/seed.ts
+function defineSeed(config) {
+  const entries = Object.freeze(
+    config.entries.map((entry) => ({
+      table: entry.table,
+      rows: Object.freeze([...entry.rows])
+    }))
+  );
+  return {
+    entries,
+    async run(db) {
+      const unsafeDb = db.unsafe();
+      for (const entry of entries) {
+        if (entry.rows.length === 0) continue;
+        const ops = entry.rows.map(
+          (row) => unsafeDb.insert(entry.table).values(row)
+        );
+        if (ops.length === 1) {
+          await ops[0].run({});
+        } else {
+          await unsafeDb.batch(ops).run({});
+        }
+      }
+    }
+  };
+}
 export {
+  TransactionError,
   compose,
   composeSequential,
   composeSequentialCallback,
+  createAppDb,
   createDb,
+  createLookupCache,
+  defineSeed,
   parseCursorParams,
-  parseOffsetParams
+  parseOffsetParams,
+  runWithLookupCache
 };