@cipherstash/stack 0.16.0 → 0.19.0

package/dist/supabase/index.js

@@ -1,13 +1,18 @@
+import {
+  EncryptedV3Column
+} from "../chunk-U66S7VIF.js";
 import {
   bulkModelsToEncryptedPgComposites,
   modelToEncryptedPgComposites
-} from "../chunk-4RNBI3UH.js";
+} from "../chunk-BNO32ZMV.js";
 import {
   EncryptedColumn
-} from "../chunk-JDZ2QUUF.js";
+} from "../chunk-MP3SSDNN.js";
+import "../chunk-IADZCZEA.js";
 import {
   logger
-} from "../chunk-6FD7OBGM.js";
+} from "../chunk-HQANMV7R.js";
+import "../chunk-PZ5AY32C.js";
 
 // src/supabase/helpers.ts
 function getEncryptedColumnNames(schema) {
@@ -35,6 +40,40 @@ function addJsonbCasts(columns, encryptedColumnNames) {
     return col;
   }).join(",");
 }
+function addJsonbCastsV3(columns, propToDb) {
+  const dbNames = new Set(Object.values(propToDb));
+  const keyToDb = {};
+  const select = columns.split(",").map((col) => {
+    const trimmed = col.trim();
+    if (!trimmed) return col;
+    if (trimmed.includes("::")) return col;
+    if (trimmed.includes("(") || trimmed.includes(".")) return col;
+    const leadingWhitespace = col.match(/^(\s*)/)?.[1] ?? "";
+    const aliasMatch = trimmed.match(
+      /^([A-Za-z_][A-Za-z0-9_]*):([A-Za-z_][A-Za-z0-9_]*)$/
+    );
+    if (aliasMatch) {
+      const [, alias, name] = aliasMatch;
+      const db2 = propToDb[name] ?? (dbNames.has(name) ? name : void 0);
+      if (db2 !== void 0) {
+        keyToDb[alias] = db2;
+        return `${leadingWhitespace}${alias}:${db2}::jsonb`;
+      }
+      return col;
+    }
+    const db = propToDb[trimmed];
+    if (db !== void 0) {
+      keyToDb[trimmed] = db;
+      return db === trimmed ? `${leadingWhitespace}${trimmed}::jsonb` : `${leadingWhitespace}${trimmed}:${db}::jsonb`;
+    }
+    if (dbNames.has(trimmed)) {
+      keyToDb[trimmed] = trimmed;
+      return `${leadingWhitespace}${trimmed}::jsonb`;
+    }
+    return col;
+  }).join(",");
+  return { select, keyToDb };
+}
 function mapFilterOpToQueryType(op) {
   switch (op) {
     case "eq":
@@ -388,7 +427,7 @@ var EncryptedQueryBuilderImpl = class {
           result2.failure
         );
       }
-      return bulkModelsToEncryptedPgComposites(result2.data);
+      return this.transformEncryptedMutationModels(result2.data);
     }
     const baseOp = this.encryptionClient.encryptModel(data, this.schema);
     const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
@@ -403,7 +442,20 @@ var EncryptedQueryBuilderImpl = class {
         result.failure
       );
     }
-    return modelToEncryptedPgComposites(result.data);
+    return this.transformEncryptedMutationModel(result.data);
+  }
+  /**
+   * Encode an encrypted model for the Supabase request body. v2 wraps each
+   * encrypted value in the `{ data: ... }` object expected by the
+   * `eql_v2_encrypted` composite type. The v3 dialect overrides this — native
+   * `eql_v3.*` domains are plain jsonb, so the raw payload is sent instead
+   * (keyed by DB column name).
+   */
+  transformEncryptedMutationModel(model) {
+    return modelToEncryptedPgComposites(model);
+  }
+  transformEncryptedMutationModels(models) {
+    return bulkModelsToEncryptedPgComposites(models);
   }
   // ---------------------------------------------------------------------------
   // Step 2: Build select string with casts
@@ -436,7 +488,6 @@ var EncryptedQueryBuilderImpl = class {
           termMap.push({ source: "filter", filterIndex: i, inIndex: j });
         }
       } else if (f.op === "is") {
-        continue;
       } else {
         terms.push({
           value: f.value,
@@ -536,6 +587,17 @@ var EncryptedQueryBuilderImpl = class {
     if (terms.length === 0) {
       return { encryptedValues: [], termMap: [] };
     }
+    const encryptedValues = await this.encryptCollectedTerms(terms);
+    return { encryptedValues, termMap };
+  }
+  /**
+   * Encrypt the collected filter terms, returning one encoded value per term
+   * (in order). v2 batch-encrypts via `encryptQuery` with the
+   * `composite-literal` return type — the `("json")` string the
+   * `eql_v2_encrypted` composite operators compare. The v3 dialect overrides
+   * this to produce full-envelope jsonb operands instead.
+   */
+  async encryptCollectedTerms(terms) {
     const baseOp = this.encryptionClient.encryptQuery(terms);
     const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
     if (this.auditConfig) op.audit(this.auditConfig);
@@ -549,7 +611,7 @@ var EncryptedQueryBuilderImpl = class {
         result.failure
       );
     }
-    return { encryptedValues: result.data, termMap };
+    return result.data;
   }
   // ---------------------------------------------------------------------------
   // Step 4: Build and execute real Supabase query
@@ -669,36 +731,36 @@ var EncryptedQueryBuilderImpl = class {
           return filterInMap.has(key) ? filterInMap.get(key) : v;
         });
       }
+      const column = this.filterColumnName(f.column);
+      const wasEncrypted = filterValueMap.has(i);
       switch (f.op) {
         case "eq":
-          q = q.eq(f.column, value);
+          q = q.eq(column, value);
           break;
         case "neq":
-          q = q.neq(f.column, value);
+          q = q.neq(column, value);
           break;
         case "gt":
-          q = q.gt(f.column, value);
+          q = q.gt(column, value);
           break;
         case "gte":
-          q = q.gte(f.column, value);
+          q = q.gte(column, value);
           break;
         case "lt":
-          q = q.lt(f.column, value);
+          q = q.lt(column, value);
           break;
         case "lte":
-          q = q.lte(f.column, value);
+          q = q.lte(column, value);
           break;
         case "like":
-          q = q.like(f.column, value);
-          break;
         case "ilike":
-          q = q.ilike(f.column, value);
+          q = this.applyPatternFilter(q, column, f.op, value, wasEncrypted);
           break;
         case "is":
-          q = q.is(f.column, value);
+          q = q.is(column, value);
           break;
         case "in":
-          q = q.in(f.column, value);
+          q = q.in(column, value);
           break;
       }
     }
@@ -707,53 +769,113 @@ var EncryptedQueryBuilderImpl = class {
       const resolvedQuery = {};
       for (const [colName, originalValue] of Object.entries(mf.query)) {
         const key = `${i}:${colName}`;
-        resolvedQuery[colName] = matchValueMap.has(key) ? matchValueMap.get(key) : originalValue;
+        resolvedQuery[this.filterColumnName(colName)] = matchValueMap.has(key) ? matchValueMap.get(key) : originalValue;
       }
       q = q.match(resolvedQuery);
     }
     for (let i = 0; i < this.notFilters.length; i++) {
       const nf = this.notFilters[i];
-      const value = notValueMap.has(i) ? notValueMap.get(i) : nf.value;
-      q = q.not(nf.column, nf.op, value);
+      const wasEncrypted = notValueMap.has(i);
+      const value = wasEncrypted ? notValueMap.get(i) : nf.value;
+      q = q.not(
+        this.filterColumnName(nf.column),
+        this.notFilterOperator(nf.op, wasEncrypted),
+        value
+      );
     }
     for (let i = 0; i < this.orFilters.length; i++) {
       const of_ = this.orFilters[i];
       if (of_.kind === "string") {
         const parsed = parseOrString(of_.value);
-        let hasEncrypted = false;
+        const encryptedIndexes = /* @__PURE__ */ new Set();
         for (let j = 0; j < parsed.length; j++) {
           const key = `${i}:${j}`;
           if (orStringConditionMap.has(key)) {
             parsed[j] = { ...parsed[j], value: orStringConditionMap.get(key) };
-            hasEncrypted = true;
+            encryptedIndexes.add(j);
           }
         }
-        if (hasEncrypted) {
-          q = q.or(rebuildOrString(parsed), {
-            referencedTable: of_.referencedTable
-          });
+        if (encryptedIndexes.size > 0) {
+          q = q.or(
+            rebuildOrString(
+              this.transformOrConditions(parsed, encryptedIndexes)
+            ),
+            {
+              referencedTable: of_.referencedTable
+            }
+          );
         } else {
           q = q.or(of_.value, { referencedTable: of_.referencedTable });
         }
       } else {
+        const encryptedIndexes = /* @__PURE__ */ new Set();
         const conditions = of_.conditions.map((cond, j) => {
           const key = `${i}:${j}`;
           if (orStructuredConditionMap.has(key)) {
+            encryptedIndexes.add(j);
             return { ...cond, value: orStructuredConditionMap.get(key) };
           }
           return cond;
         });
-        q = q.or(rebuildOrString(conditions));
+        q = q.or(
+          rebuildOrString(
+            this.transformOrConditions(conditions, encryptedIndexes)
+          )
+        );
       }
     }
     for (let i = 0; i < this.rawFilters.length; i++) {
       const rf = this.rawFilters[i];
       const value = rawValueMap.has(i) ? rawValueMap.get(i) : rf.value;
-      q = q.filter(rf.column, rf.operator, value);
+      q = q.filter(this.filterColumnName(rf.column), rf.operator, value);
     }
     return q;
   }
   // ---------------------------------------------------------------------------
+  // Dialect seams — every default preserves the v2 behaviour byte-for-byte.
+  // The v3 builder (see ./query-builder-v3) overrides these for native
+  // `eql_v3.*` domain columns.
+  // ---------------------------------------------------------------------------
+  /**
+   * Map a filter's column name to the DB column name PostgREST must see.
+   * v2 schemas key columns by their DB name already, so this is the identity;
+   * the v3 dialect resolves a JS property name to its DB name.
+   */
+  filterColumnName(column) {
+    return column;
+  }
+  /**
+   * Apply a `like`/`ilike` filter. v2 relies on the `~~` operator defined on
+   * `eql_v2_encrypted`; the v3 dialect overrides this for encrypted columns
+   * because the `eql_v3.*` domains expose free-text match via `@>`
+   * (PostgREST `cs`) rather than a LIKE operator.
+   */
+  applyPatternFilter(q, column, op, value, _wasEncrypted) {
+    return op === "like" ? q.like(column, value) : q.ilike(column, value);
+  }
+  /**
+   * The PostgREST operator to use for a `.not()` filter. The v3 dialect maps
+   * `like`/`ilike` on encrypted columns to `cs` (see applyPatternFilter).
+   */
+  notFilterOperator(op, _wasEncrypted) {
+    return op;
+  }
+  /**
+   * Transform `.or()` conditions before the or-string is rebuilt. The v3
+   * dialect maps property names to DB names and `like`/`ilike` on encrypted
+   * conditions to `cs`.
+   */
+  transformOrConditions(conditions, _encryptedIndexes) {
+    return conditions;
+  }
+  /**
+   * Post-process a decrypted result row. The v3 dialect reconstructs `Date`
+   * values from the encrypt-config `cast_as`; v2 returns rows unchanged.
+   */
+  postprocessDecryptedRow(row) {
+    return row;
+  }
+  // ---------------------------------------------------------------------------
   // Step 5: Decrypt results
   // ---------------------------------------------------------------------------
   async decryptResults(result) {
@@ -817,7 +939,9 @@ var EncryptedQueryBuilderImpl = class {
         );
       }
       return {
-        data: decrypted2.data,
+        data: this.postprocessDecryptedRow(
+          decrypted2.data
+        ),
         error: null,
         count: result.count ?? null,
         status: result.status,
@@ -848,7 +972,9 @@ var EncryptedQueryBuilderImpl = class {
       );
     }
     return {
-      data: decrypted.data,
+      data: decrypted.data.map(
+        (row) => this.postprocessDecryptedRow(row)
+      ),
       error: null,
       count: result.count ?? null,
       status: result.status,
@@ -879,6 +1005,184 @@ var EncryptionFailedError = class extends Error {
   }
 };
 
+// src/supabase/query-builder-v3.ts
+var EncryptedQueryBuilderV3Impl = class extends EncryptedQueryBuilderImpl {
+  v3Table;
+  /** JS property name → DB column name, for every encrypted column. */
+  propToDb;
+  /** Built column schemas keyed by DB column name (for `cast_as`). */
+  columnSchemas;
+  /** Column builders keyed by BOTH property name and DB name. */
+  v3Columns;
+  /**
+   * Result-row key → DB column name for the columns the current select
+   * produces, including user-chosen PostgREST aliases (`ts:created_at` keys
+   * rows by `ts`). Populated by {@link buildSelectString}; consumed by
+   * {@link postprocessDecryptedRow} so aliased date columns still get `Date`
+   * reconstruction.
+   */
+  selectKeyToDb = {};
+  constructor(tableName, table, encryptionClient, supabaseClient) {
+    super(
+      tableName,
+      // The base class only ever calls BuildableTable members on the schema
+      // (build / encryptModel plumbing); every v2-specific behaviour is
+      // overridden below.
+      table,
+      encryptionClient,
+      supabaseClient
+    );
+    this.v3Table = table;
+    this.propToDb = table.buildColumnKeyMap();
+    this.columnSchemas = table.build().columns;
+    this.v3Columns = {};
+    for (const [property, builder] of Object.entries(table.columnBuilders)) {
+      if (builder instanceof EncryptedV3Column) {
+        const col = builder;
+        this.v3Columns[property] = col;
+        this.v3Columns[col.getName()] = col;
+      }
+    }
+    this.encryptedColumnNames = Object.keys(this.v3Columns);
+  }
+  // ---------------------------------------------------------------------------
+  // Dialect overrides
+  // ---------------------------------------------------------------------------
+  getColumnMap() {
+    return this.v3Columns;
+  }
+  filterColumnName(column) {
+    return this.propToDb[column] ?? column;
+  }
+  buildSelectString() {
+    if (this.selectColumns === null) return null;
+    const { select, keyToDb } = addJsonbCastsV3(
+      this.selectColumns,
+      this.propToDb
+    );
+    this.selectKeyToDb = keyToDb;
+    return select;
+  }
+  /** v3 domains are plain jsonb — send the raw payload, keyed by DB name. */
+  transformEncryptedMutationModel(model) {
+    const out = {};
+    for (const [key, value] of Object.entries(model)) {
+      out[this.propToDb[key] ?? key] = value;
+    }
+    return out;
+  }
+  transformEncryptedMutationModels(models) {
+    return models.map((model) => this.transformEncryptedMutationModel(model));
+  }
+  /**
+   * Encrypt every filter operand as a full storage envelope (see the class
+   * doc for why `encryptQuery` terms cannot be used), serialized to jsonb
+   * text for the PostgREST filter value.
+   *
+   * INTERIM + single swap point. The full-envelope operand is a tracked
+   * workaround (Linear CIP-3402), not the design: it carries a real
+   * decryptable ciphertext `c` plus ALL of the column's index terms, and
+   * PostgREST filters travel in GET query strings — so operands can land in
+   * URL logs, proxies, and Supabase request logs (query terms are meant to
+   * be index-terms-only). When the EQL term-only scalar query envelope (the
+   * scalar analog of `eql_v3.jsonb_query`) ships, swapping the encryption
+   * call inside THIS method — and its `JSON.stringify` wire encoding — must
+   * be the ONLY change needed: every consuming seam (filter application,
+   * `or`/`not` transforms, the wire-operator remap) treats the returned
+   * operand as an opaque, already-encoded string and is encoding-agnostic.
+   * Do not let operand-encoding knowledge leak out of this method.
+   */
+  async encryptCollectedTerms(terms) {
+    return Promise.all(
+      terms.map(async (term) => {
+        const column = term.column;
+        const queryType = term.queryType ?? "equality";
+        const capabilities = column.getQueryCapabilities();
+        if (term.value == null) {
+          throw new Error(
+            `[supabase v3]: cannot encrypt a null filter value for column "${column.getName()}" \u2014 use .is('${column.getName()}', null) for NULL checks`
+          );
+        }
+        if (queryType !== "equality" && queryType !== "orderAndRange" && queryType !== "freeTextSearch") {
+          throw new Error(
+            `[supabase v3]: query type "${queryType}" is not supported on scalar eql_v3 columns`
+          );
+        }
+        if (!capabilities[queryType]) {
+          throw new Error(
+            `[supabase v3]: column "${column.getName()}" (${column.getEqlType()}) does not support ${queryType} queries \u2014 declare the column with a domain that carries that capability`
+          );
+        }
+        const baseOp = this.encryptionClient.encrypt(term.value, {
+          column,
+          table: this.v3Table
+        });
+        const op = this.lockContext ? baseOp.withLockContext(this.lockContext) : baseOp;
+        if (this.auditConfig) op.audit(this.auditConfig);
+        const result = await op;
+        if (result.failure) {
+          logger.error(
+            `Supabase: failed to encrypt query terms for table "${this.tableName}"`
+          );
+          throw new EncryptionFailedError(
+            `Failed to encrypt query terms: ${result.failure.message}`,
+            result.failure
+          );
+        }
+        return JSON.stringify(result.data);
+      })
+    );
+  }
+  /**
+   * The single source of the encrypted wire-operator remap: `like`/`ilike`
+   * on an encrypted column become PostgREST `cs` (bloom-filter `@>`) — the
+   * `eql_v3.*` domains define no LIKE operator. Every pattern-bearing seam
+   * (`applyPatternFilter`, `notFilterOperator`, `transformOrConditions`)
+   * derives its operator here so they cannot drift apart.
+   */
+  encryptedFilterOp(op, wasEncrypted) {
+    return wasEncrypted && (op === "like" || op === "ilike") ? "cs" : op;
+  }
+  /** Encrypted pattern filters go through the bloom-filter `@>` (`cs`). */
+  applyPatternFilter(q, column, op, value, wasEncrypted) {
+    const wireOp = this.encryptedFilterOp(op, wasEncrypted);
+    if (wireOp !== op) {
+      return q.filter(column, wireOp, value);
+    }
+    return super.applyPatternFilter(q, column, op, value, wasEncrypted);
+  }
+  notFilterOperator(op, wasEncrypted) {
+    return this.encryptedFilterOp(op, wasEncrypted);
+  }
+  transformOrConditions(conditions, encryptedIndexes) {
+    return conditions.map((cond, j) => ({
+      ...cond,
+      column: this.filterColumnName(cond.column),
+      op: this.encryptedFilterOp(cond.op, encryptedIndexes.has(j))
+    }));
+  }
+  /** Rebuild `Date` values from the encrypt-config `cast_as`, mirroring the
+   * typed v3 client's decrypt-model path. */
+  postprocessDecryptedRow(row) {
+    const keyToDb = { ...this.selectKeyToDb };
+    for (const [property, dbName] of Object.entries(this.propToDb)) {
+      keyToDb[property] ??= dbName;
+      keyToDb[dbName] ??= dbName;
+    }
+    const out = { ...row };
+    for (const [key, dbName] of Object.entries(keyToDb)) {
+      const castAs = this.columnSchemas[dbName]?.cast_as;
+      if (castAs !== "date" && castAs !== "timestamp") continue;
+      const value = out[key];
+      if (value == null || value instanceof Date) continue;
+      if (typeof value === "string" || typeof value === "number") {
+        out[key] = new Date(value);
+      }
+    }
+    return out;
+  }
+};
+
 // src/supabase/index.ts
 function encryptedSupabase(config) {
   const { encryptionClient, supabaseClient } = config;
@@ -893,7 +1197,21 @@ function encryptedSupabase(config) {
     }
   };
 }
+function encryptedSupabaseV3(config) {
+  const { encryptionClient, supabaseClient } = config;
+  return {
+    from(tableName, table) {
+      return new EncryptedQueryBuilderV3Impl(
+        tableName,
+        table,
+        encryptionClient,
+        supabaseClient
+      );
+    }
+  };
+}
 export {
-  encryptedSupabase
+  encryptedSupabase,
+  encryptedSupabaseV3
 };
 //# sourceMappingURL=index.js.map