@constructive-io/express-context 0.33.6 → 0.34.0

package/context.d.ts

@@ -24,6 +24,8 @@ export interface ContextMiddlewareOptions {
     loaders?: LoaderRegistry;
     /** Routing-plane schema loaders query (defaults to routing_public) */
     routingSchema?: string;
+    /** Role the module loaders run as (`SET LOCAL ROLE`); required with `loaders`. */
+    controlRole?: string;
 }
 /**
  * Build the ConstructiveContext from the current request state.

package/context.js

@@ -18,6 +18,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.buildContext = buildContext;
 exports.createContextMiddleware = createContextMiddleware;
 const pg_cache_1 = require("pg-cache");
+const pg_query_context_1 = require("pg-query-context");
 const billing_client_1 = require("./billing-client");
 const pg_client_1 = require("./pg-client");
 const pg_settings_1 = require("./pg-settings");
@@ -64,11 +65,10 @@ function buildContext(req, opts = {}) {
     // Build loader context (if registry provided and databaseId known)
     let loaderCtx = null;
     if (opts.loaders && api.databaseId) {
-        const routingPool = (0, pg_cache_1.getPgPool)(opts.pg);
         loaderCtx = {
-            routingPool,
+            routingPool: (0, pg_query_context_1.controlPlanePool)((0, pg_cache_1.getPgPool)(opts.pg), opts.controlRole),
             routingSchema: opts.routingSchema,
-            tenantPool,
+            tenantPool: (0, pg_query_context_1.controlPlanePool)(tenantPool, opts.controlRole),
             databaseId: api.databaseId,
             apiId: api.apiId,
             dbname: api.dbname
@@ -143,6 +143,9 @@ function buildContext(req, opts = {}) {
  * ```
  */
 function createContextMiddleware(opts = {}) {
+    if (opts.loaders && !opts.controlRole) {
+        throw new Error('createContextMiddleware: `loaders` need a `controlRole` to run as');
+    }
     return (req, _res, next) => {
         const ctx = buildContext(req, opts);
         if (ctx) {

package/esm/context.js

@@ -14,6 +14,7 @@
  * route handler can use for tenant-scoped database operations.
  */
 import { getPgPool } from 'pg-cache';
+import { controlPlanePool } from 'pg-query-context';
 import { createBillingClient } from './billing-client';
 import { withPgClient as withPgClientFn } from './pg-client';
 import { buildPgSettings } from './pg-settings';
@@ -60,11 +61,10 @@ export function buildContext(req, opts = {}) {
     // Build loader context (if registry provided and databaseId known)
     let loaderCtx = null;
     if (opts.loaders && api.databaseId) {
-        const routingPool = getPgPool(opts.pg);
         loaderCtx = {
-            routingPool,
+            routingPool: controlPlanePool(getPgPool(opts.pg), opts.controlRole),
             routingSchema: opts.routingSchema,
-            tenantPool,
+            tenantPool: controlPlanePool(tenantPool, opts.controlRole),
             databaseId: api.databaseId,
             apiId: api.apiId,
             dbname: api.dbname
@@ -139,6 +139,9 @@ export function buildContext(req, opts = {}) {
  * ```
  */
 export function createContextMiddleware(opts = {}) {
+    if (opts.loaders && !opts.controlRole) {
+        throw new Error('createContextMiddleware: `loaders` need a `controlRole` to run as');
+    }
     return (req, _res, next) => {
         const ctx = buildContext(req, opts);
         if (ctx) {

package/esm/refusals.js

@@ -20,7 +20,7 @@
  * @module refusals
  */
 import { Logger } from '@pgpmjs/logger';
-import { withPgClient } from 'pg-query-context';
+import { withControlRole } from 'pg-query-context';
 import { BoundedCounter, CounterFlusher } from './usage-counter';
 const log = new Logger('refusals');
 export const REFUSAL_REASONS = [
@@ -207,8 +207,8 @@ export const createRecordRefusalsSink = (opts) => {
         if (rows.length === 0)
             return;
         const claims = await opts.claims();
-        await withPgClient(opts.pool, claims, async (client) => {
+        await withControlRole(opts.pool, opts.role, async (client) => {
             await client.query(sql, [JSON.stringify(rows)]);
-        });
+        }, claims);
     };
 };

package/loaders/request-protection.d.ts

@@ -14,9 +14,9 @@
  * predates these columns must resolve to the platform defaults, not fail every
  * request against it with `column ds.… does not exist`.
  */
-import type { Pool } from 'pg';
+import type { ControlPlaneQueryable } from 'pg-query-context';
 import type { RequestProtection } from '../request-protection';
 import type { ModuleLoader } from './types';
 /** Test seam: forget what a pool's routing plane looked like. */
-export declare const forgetProtectionColumns: (pool: Pool) => void;
+export declare const forgetProtectionColumns: (pool: ControlPlaneQueryable) => void;
 export declare const requestProtectionLoader: ModuleLoader<RequestProtection>;

package/loaders/types.d.ts

@@ -9,7 +9,7 @@
  * during context building. The result is a typed modules map on
  * `req.constructive.modules`.
  */
-import type { Pool } from 'pg';
+import type { ControlPlaneQueryable } from 'pg-query-context';
 /** Published logical name of the scoped routing plane. */
 export declare const DEFAULT_ROUTING_SCHEMA = "routing_public";
 /**
@@ -31,15 +31,16 @@ export declare function requireDatabaseId(databaseId: string | undefined, loader
 /**
  * Context passed to every loader's resolve function.
  * Provides both pool references so the loader can query whichever
- * database tier it needs.
+ * database tier it needs. Both run every query as the control role
+ * (`SET LOCAL ROLE` in its own transaction): the login role can read nothing.
  */
 export interface LoaderContext {
     /** Routing/configuration database pool (for routing-plane lookups) */
-    routingPool: Pool;
+    routingPool: ControlPlaneQueryable;
     /** Routing-plane schema to query (defaults to the published routing_public) */
     routingSchema?: string;
     /** Tenant database pool (for metaschema_modules_public.* lookups) */
-    tenantPool: Pool;
+    tenantPool: ControlPlaneQueryable;
     /** UUID of the database being resolved */
     databaseId: string;
     /** UUID of the API (if resolved from domain/api-name lookup) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/express-context",
-  "version": "0.33.6",
+  "version": "0.34.0",
   "description": "Extractable Express middleware for Constructive tenant context — domain resolution, JWT auth, pgSettings, and withPgClient",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -30,14 +30,14 @@
   },
   "dependencies": {
     "@constructive-io/url-domains": "^2.31.0",
-    "@pgpmjs/env": "^2.46.3",
+    "@pgpmjs/env": "^2.47.0",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.6",
-    "@pgpmjs/types": "^2.56.3",
+    "@pgpmjs/server-utils": "^3.29.7",
+    "@pgpmjs/types": "^2.57.0",
     "lru-cache": "^11.2.7",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.6",
-    "pg-query-context": "^2.31.0"
+    "pg-cache": "^3.29.7",
+    "pg-query-context": "^2.32.0"
   },
   "devDependencies": {
     "@types/express": "^5.0.6",
@@ -59,5 +59,5 @@
     "jwt",
     "pgSettings"
   ],
-  "gitHead": "a95137c03998f4ef18aaba770bdeb598077e5b51"
+  "gitHead": "2f506a4a4062b4bd92979c02249e0fee14af4043"
 }

package/refusals.d.ts

@@ -136,6 +136,8 @@ export declare class RefusalRecorder {
 export interface RecordRefusalsSinkOptions {
     /** The platform database's pool. */
     pool: Pool;
+    /** Role the flush runs as (`SET LOCAL ROLE`); the login role holds nothing. */
+    role: string;
     /**
      * The transaction-local claims the flush runs under, resolved by the caller
      * (a service principal plus the platform database id). The function raises

package/refusals.js

@@ -215,9 +215,9 @@ const createRecordRefusalsSink = (opts) => {
         if (rows.length === 0)
             return;
         const claims = await opts.claims();
-        await (0, pg_query_context_1.withPgClient)(opts.pool, claims, async (client) => {
+        await (0, pg_query_context_1.withControlRole)(opts.pool, opts.role, async (client) => {
             await client.query(sql, [JSON.stringify(rows)]);
-        });
+        }, claims);
     };
 };
 exports.createRecordRefusalsSink = createRecordRefusalsSink;