@constructive-io/graphql-server 5.32.2 → 5.32.3

package/README.md

@@ -57,11 +57,11 @@ This starts the server with env defaults from `@constructive-io/graphql-env`.
 ## What it does
 
 Platform deployments connect through one pgpm-provisioned `NOSUPERUSER INHERIT
-BYPASSRLS` login with direct metadata privileges, configured only with
-`PGUSER`/`PGPASSWORD`. Startup and routing queries use that pool login directly.
-Requests continue to switch to `authenticated` or `anonymous`, so PostgreSQL
-enforces their RLS policies; the login's BYPASSRLS attribute is not inherited
-after `SET ROLE`.
+NOBYPASSRLS` login, configured only with `PGUSER`/`PGPASSWORD`. Startup and
+routing queries run as that login, so rows behind member RLS stay hidden from
+it: standing and routing settings are read through static, login-only
+`SECURITY DEFINER` readers in `function_resolution`. Requests switch to
+`authenticated` or `anonymous`, so PostgreSQL enforces their RLS policies.
 
 Runs an Express server that wires CORS, uploads, domain parsing, auth, and PostGraphile into a single GraphQL endpoint. It serves `/graphql` and `/graphiql`, injects per-request `pgSettings`, and flushes cached schemas on demand or via database notifications. When meta API is enabled, it resolves API config (schemas, roles, modules) from the meta schema using the request host and enforces `api.isPublic`, with optional header overrides in private mode; when meta API is disabled, it serves the fixed schemas and roles from `api.exposedSchemas`, `api.anonRole`, and `api.roleName`.
 
@@ -122,7 +122,7 @@ Send `X-Constructive-Session-Cookie: omit` on every request. Sign-in mutations t
 
 This is a production-only server: every request is resolved through the scoped-routing plane. There is no static single-tenant mode and no flag to disable routing. For single-database local development without route resolution or a database id, use [`@constructive-io/graphql-dev-server`](../dev-server/README.md).
 
-- The server resolves the request host with a single `resolve_route()` call against the compiled route bindings in the scoped routing schema (`API_ROUTING_SCHEMA`, default `routing_public`), mapping host → tenant/api/database/role.
+- The server resolves the request host with a single `resolve_route()` call against the compiled route bindings in `routing_public`, mapping host → tenant/api/database/role.
 - Only APIs where `api.is_public` matches `API_IS_PUBLIC` are served.
 - In private mode (`API_IS_PUBLIC=false`), you can override with headers:
   - `X-Api-Name` + `X-Database-Id`
@@ -145,7 +145,6 @@ Configuration is merged from defaults, config files, and env vars via `@construc
 | `FEATURES_SIMPLE_INFLECTION`   | Enable simple inflection              | `true`                                                        |
 | `FEATURES_OPPOSITE_BASE_NAMES` | Enable opposite base names            | `true`                                                        |
 | `FEATURES_POSTGIS`             | Enable PostGIS support                | `true`                                                        |
-| `API_ROUTING_SCHEMA`    | Schema containing `resolve_route()`   | `routing_public`                                 |
 | `API_IS_PUBLIC`                | Serve public APIs only                | `true`                                                        |
 | `API_EXPOSED_SCHEMAS`          | Additional schemas to expose          | empty                                                         |
 | `API_META_SCHEMAS`             | Meta schemas to query                 | `routing_public,metaschema_public,metaschema_modules_public` |

package/esm/middleware/api.js

@@ -6,7 +6,7 @@ import { svcCache } from '@pgpmjs/server-utils';
 import { getPgPool } from 'pg-cache';
 import errorPage50x from '../errors/50x';
 import errorPage404Message from '../errors/404-message';
-import { getRoutingSchema, isValidSchemaName, requireApiRole, resolveRoute, routeToApiStructure } from './routing';
+import { requireApiRole, resolveRouteAcrossPlanes, routeToApiStructure } from './routing';
 const log = new Logger('api');
 // =============================================================================
 // Module Loader Registry (replaces inline SQL queries for per-db config)
@@ -15,26 +15,16 @@ const defaultRegistry = createDefaultRegistry();
 // =============================================================================
 // SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
-// Private-header X-Api-Name lookup against the scoped routing plane.
-// X-Api-Name is a trusted internal selector (only honored when the server
-// runs with isPublic=false): it addresses a database's API surface by name.
+// Private-header X-Api-Name lookup. X-Api-Name is a trusted internal selector
+// (only honored when the server runs with isPublic=false): it addresses a
+// database's API surface by name. The routing tables sit behind member RLS and
+// no request identity exists yet, so the login reads through the login-only
+// SECURITY DEFINER reader, which resolves the database's apis plane itself.
 // `is_published` governs cross-scope route visibility, not internal
 // addressability, so it does not filter this lookup.
-const scopedApiNameLookupSql = (routingSchema) => `
-  SELECT 
-    a.id as api_id,
-    a.database_id,
-    a.dbname,
-    a.role_name,
-    a.anon_role,
-    a.is_published as is_public,
-    COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM "${routingSchema}".apis a
-  LEFT JOIN "${routingSchema}".api_schemas aps ON a.id = aps.api_id
-  LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
-  WHERE a.database_id = $1 
-    AND a.name = $2
-  GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_published
+const API_BY_NAME_SQL = `
+  SELECT api_id, api_database_id AS database_id, dbname, role_name, anon_role, is_public, schemas
+  FROM function_resolution.api_by_name($1, $2)
   LIMIT 1
 `;
 /**
@@ -47,7 +37,6 @@ const buildLoaderContext = (routingPool, opts, row) => {
     const dbname = row.dbname || opts.pg?.database || '';
     return {
         routingPool,
-        routingSchema: getRoutingSchema(opts),
         tenantPool: getPgPool({ ...opts.pg, database: dbname }),
         databaseId: row.database_id,
         apiId: row.api_id,
@@ -156,8 +145,8 @@ const toApiStructure = (row, opts, settings = {}) => ({
 });
 const createAdminStructure = (opts, schemas, databaseId) => ({
     dbname: opts.pg?.database ?? '',
-    anonRole: 'administrator',
-    roleName: 'administrator',
+    anonRole: 'anonymous',
+    roleName: 'authenticated',
     schema: schemas,
     domains: [],
     databaseId,
@@ -170,13 +159,8 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, opts, databaseId, name) => {
-    const routingSchema = getRoutingSchema(opts);
-    if (!isValidSchemaName(routingSchema)) {
-        log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
-        return null;
-    }
-    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name]);
+const queryByApiName = async (pool, databaseId, name) => {
+    const result = await pool.query(API_BY_NAME_SQL, [databaseId, name]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -203,7 +187,7 @@ const resolveApiNameHeader = async (ctx) => {
     const { opts, pool, headers } = ctx;
     if (!headers.databaseId)
         return null;
-    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName);
+    const row = await queryByApiName(pool, headers.databaseId, headers.apiName);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;
@@ -226,13 +210,17 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    const schema = getRoutingSchema(opts);
-    const route = await resolveRoute(pool, schema, host);
-    if (!route)
+    const match = await resolveRouteAcrossPlanes(pool, host);
+    if (!match)
         return null;
-    const structure = routeToApiStructure(route, opts);
+    const structure = routeToApiStructure(match.route, opts);
     if (!structure)
         return null;
+    if (match.planeDatabaseId && structure.databaseId !== match.planeDatabaseId) {
+        const error = new Error(`host ${host} is owned by database ${match.planeDatabaseId}'s routing plane but routes to database ${structure.databaseId ?? '<none>'}`);
+        error.code = 'CROSS_DATABASE_ROUTE';
+        throw error;
+    }
     log.debug(`[scoped-routing] resolved host=${host} → api=${structure.apiId} db=${structure.dbname}`);
     if (!structure.databaseId || !structure.apiId)
         return structure;

package/esm/middleware/flush.js

@@ -5,7 +5,6 @@ import { createHash, timingSafeEqual } from 'crypto';
 import { graphileCache } from 'graphile-cache';
 import { clearStorageModuleCache } from 'graphile-presigned-url-plugin';
 import { getPgPool } from 'pg-cache';
-import { getRoutingSchema, isValidSchemaName } from './routing';
 const log = new Logger('flush');
 const bearerToken = (req) => {
     const header = req.get('authorization');
@@ -67,14 +66,9 @@ export const flushService = async (opts, databaseId) => {
             }
         });
     }
-    const routingSchema = getRoutingSchema(opts);
-    if (!isValidSchemaName(routingSchema)) {
-        log.warn(`[flush] invalid routing schema name: ${routingSchema}`);
-        return;
-    }
-    const svc = await pgPool.query(`SELECT hostname
-     FROM "${routingSchema}".domains
-     WHERE database_id = $1`, [databaseId]);
+    // The domains plane sits behind member RLS; the login reads it through the
+    // login-only SECURITY DEFINER reader, which resolves the plane itself.
+    const svc = await pgPool.query(`SELECT hostname FROM function_resolution.api_hostnames($1) AS hostname`, [databaseId]);
     if (svc.rowCount === 0)
         return;
     for (const row of svc.rows) {

package/esm/middleware/routing.js

@@ -1,4 +1,5 @@
 import { Logger } from '@pgpmjs/logger';
+import { QuoteUtils } from '@pgsql/quotes';
 const log = new Logger('routing');
 // =============================================================================
 // Scoped routing plane (resolve_route contract)
@@ -26,13 +27,19 @@ export const requireApiRole = (column, value, apiId) => {
         error.apiId = apiId;
         throw error;
     }
+    // administrator bypasses RLS; an API never serves as it.
+    if (value === 'administrator') {
+        const error = new Error(`API ${apiId ?? '<unknown>'} ${column} is administrator; APIs serve as request roles under RLS.`);
+        error.code = 'API_ROLE_FORBIDDEN';
+        error.column = column;
+        error.apiId = apiId;
+        throw error;
+    }
     return value;
 };
 const RESOLVER_FUNCTION = 'resolve_route';
-/** Published logical name of the database-scope routing plane. */
-export const DEFAULT_ROUTING_SCHEMA = 'routing_public';
-/** The routing-plane schema in effect: configured override or the published default. */
-export const getRoutingSchema = (opts) => opts.api?.routingSchema || DEFAULT_ROUTING_SCHEMA;
+/** The scoped routing plane the server resolves hosts on first. */
+export const ROUTING_SCHEMA = 'routing_public';
 export const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
 /**
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
@@ -66,6 +73,58 @@ export const resolveRoute = async (pool, schema, host) => {
         throw error;
     }
 };
+/**
+ * The database-scope routing planes after the server's own `routing_public` plane, in
+ * the static gateway's order (by database id). The list spans every tenant,
+ * so it comes from a SECURITY DEFINER reader granted to the platform login
+ * alone, on the login's own connection: no role switch, no RLS bypass. A plane
+ * whose registration names no schema or resolver is an incomplete install and
+ * fails loud.
+ */
+export const loadDatabaseRoutingPlanes = async (pool) => {
+    const { rows } = await pool.query(`SELECT database_id, schema_name, resolver_function_name
+       FROM function_resolution.routing_planes()`);
+    return rows
+        .filter((row) => row.schema_name !== ROUTING_SCHEMA)
+        .map((row) => {
+        if (!row.schema_name || !row.resolver_function_name) {
+            const error = new Error(`route_module for database ${row.database_id} names no ${row.schema_name ? 'resolver function' : 'public schema'}`);
+            error.code = 'ROUTING_PLANE_INCOMPLETE';
+            error.databaseId = row.database_id;
+            throw error;
+        }
+        return {
+            databaseId: row.database_id,
+            schema: row.schema_name,
+            resolver: row.resolver_function_name
+        };
+    });
+};
+const resolveOnPlane = async (pool, plane, host) => {
+    const resolver = QuoteUtils.quoteQualifiedIdentifier(plane.schema, plane.resolver);
+    const result = await pool.query(`SELECT * FROM ${resolver}($1, '/', NULL)`, [host]);
+    const row = result.rows[0];
+    return row && row.route_binding_id !== null ? row : null;
+};
+/**
+ * Resolve a host across routing planes: `routing_public` first, then
+ * each tenant database-scope plane. The first plane that matches owns the
+ * host; later planes are not consulted.
+ */
+export const resolveRouteAcrossPlanes = async (pool, host) => {
+    const route = await resolveRoute(pool, ROUTING_SCHEMA, host);
+    if (route)
+        return { route, planeDatabaseId: null };
+    for (const plane of await loadDatabaseRoutingPlanes(pool)) {
+        const planeRoute = await resolveOnPlane(pool, plane, host);
+        if (planeRoute) {
+            log.debug(`[resolve-route] host=${host} owned by database plane ${plane.schema} (db=${plane.databaseId})`);
+            return { route: planeRoute, planeDatabaseId: plane.databaseId };
+        }
+    }
+    log.debug(`[resolve-route] no plane owns host=${host}`);
+    return null;
+};
 /**
  * Map a resolved api-target route onto the ApiStructure shape consumed by the
  * rest of the middleware chain. Returns null when the route target is not an

package/esm/plugins/webauthn-plugin.js

@@ -3,7 +3,6 @@ import { QuoteUtils } from '@pgsql/quotes';
 import { generateAuthenticationOptions, generateRegistrationOptions, verifyAuthenticationResponse, verifyRegistrationResponse } from '@simplewebauthn/server';
 import { isoBase64URL } from '@simplewebauthn/server/helpers';
 import { context as grafastContext, lambda, object } from 'grafast';
-import { SYSTEM_LANE_ROLE } from 'graphile-plugin-utils';
 import { extendSchema, gql } from 'graphile-utils';
 const CONTEXT_KEY = 'constructiveWebauthn';
 const REGISTER_CHALLENGE = 'webauthn_register_challenge';
@@ -16,11 +15,8 @@ const fail = (code, message) => {
     err.extensions = { code };
     throw err;
 };
-/** Apply the request's settings transaction-locally, optionally overriding its role. */
-const applySettings = async (tx, pgSettings, role) => {
-    const entries = Object.entries(pgSettings ?? {}).filter(([key]) => !role || key !== 'role');
-    if (role)
-        entries.push(['role', role]);
+/** Apply settings transaction-locally. */
+const applySettings = async (tx, entries) => {
     if (entries.length === 0)
         return;
     await tx.query({
@@ -29,11 +25,18 @@ const applySettings = async (tx, pgSettings, role) => {
     });
 };
 const withRequestLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
-    await applySettings(tx, pgSettings);
+    await applySettings(tx, Object.entries(pgSettings ?? {}));
     return cb(tx);
 }));
+/**
+ * The verifier lane calls the server-only procedures as the connection's own
+ * login, which alone holds EXECUTE on them. It carries the request's
+ * `jwt.claims.*` but never its `role`: as a request role those procedures are
+ * revoked, so any SQL caller could otherwise mint a session.
+ */
+const verifierSettings = (pgSettings) => Object.entries(pgSettings ?? {}).filter(([key]) => key !== 'role');
 const withVerifierLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
-    await applySettings(tx, pgSettings, SYSTEM_LANE_ROLE);
+    await applySettings(tx, verifierSettings(pgSettings));
     return cb(tx);
 }));
 const procedure = (settings, name) => QuoteUtils.quoteQualifiedIdentifier(settings.schema, name);

package/esm/refusals/recorder.js

@@ -87,11 +87,11 @@ export const recordRefusal = (req, reason, opts = {}) => {
  * that was missing named — rather than returning a partial identity.
  */
 export const resolvePlatformFlushIdentity = async (pool, principalName = PLATFORM_BOOTSTRAP_PRINCIPAL) => {
-    const database = await pool.query(`SELECT id FROM metaschema_public.database WHERE platform IS TRUE`);
-    if (database.rowCount !== 1) {
-        throw new Error(`refusals: expected exactly one platform database (metaschema_public.database.platform), found ${database.rowCount}`);
-    }
-    const principal = await pool.query(`SELECT user_id, bypass_step_up FROM constructive_auth_public.principals WHERE name = $1`, [principalName]);
+    // Both reads cross RLS before any request exists, so they go through
+    // SECURITY DEFINER resolvers granted to the login; the first raises when no
+    // platform database is registered.
+    const database = await pool.query(`SELECT app_scope.platform_database_id() AS id`);
+    const principal = await pool.query(`SELECT user_id, bypass_step_up FROM function_resolution.service_principal($1)`, [principalName]);
     if (principal.rowCount !== 1) {
         throw new Error(`refusals: no service principal named '${principalName}'`);
     }

package/esm/server.js

@@ -32,7 +32,6 @@ import { debugMemory } from './middleware/observability/debug-memory';
 import { localObservabilityOnly } from './middleware/observability/guard';
 import { createRequestLogger } from './middleware/observability/request-logger';
 import { createRequestProtectionMiddleware } from './middleware/request-protection';
-import { getRoutingSchema } from './middleware/routing';
 import { createStandingMiddleware } from './middleware/standing';
 import { createPlatformRefusalRecorder, installRefusalRecorder } from './refusals/recorder';
 const log = new Logger('server');
@@ -91,7 +90,6 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            routingSchema: apiOpts.routingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             observabilityEnabled
         });
@@ -144,8 +142,7 @@ class Server {
         app.use(authenticate);
         app.use(createContextMiddleware({
             pg: effectiveOpts.pg,
-            loaders: createDefaultRegistry(),
-            routingSchema: getRoutingSchema(effectiveOpts)
+            loaders: createDefaultRegistry()
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.

package/middleware/api.js

@@ -21,26 +21,16 @@ const defaultRegistry = (0, express_context_1.createDefaultRegistry)();
 // =============================================================================
 // SQL Queries (API resolution only — module queries now live in loaders)
 // =============================================================================
-// Private-header X-Api-Name lookup against the scoped routing plane.
-// X-Api-Name is a trusted internal selector (only honored when the server
-// runs with isPublic=false): it addresses a database's API surface by name.
+// Private-header X-Api-Name lookup. X-Api-Name is a trusted internal selector
+// (only honored when the server runs with isPublic=false): it addresses a
+// database's API surface by name. The routing tables sit behind member RLS and
+// no request identity exists yet, so the login reads through the login-only
+// SECURITY DEFINER reader, which resolves the database's apis plane itself.
 // `is_published` governs cross-scope route visibility, not internal
 // addressability, so it does not filter this lookup.
-const scopedApiNameLookupSql = (routingSchema) => `
-  SELECT 
-    a.id as api_id,
-    a.database_id,
-    a.dbname,
-    a.role_name,
-    a.anon_role,
-    a.is_published as is_public,
-    COALESCE(array_agg(s.schema_name) FILTER (WHERE s.schema_name IS NOT NULL), '{}') as schemas
-  FROM "${routingSchema}".apis a
-  LEFT JOIN "${routingSchema}".api_schemas aps ON a.id = aps.api_id
-  LEFT JOIN metaschema_public.schema s ON aps.schema_id = s.id
-  WHERE a.database_id = $1 
-    AND a.name = $2
-  GROUP BY a.id, a.database_id, a.dbname, a.role_name, a.anon_role, a.is_published
+const API_BY_NAME_SQL = `
+  SELECT api_id, api_database_id AS database_id, dbname, role_name, anon_role, is_public, schemas
+  FROM function_resolution.api_by_name($1, $2)
   LIMIT 1
 `;
 /**
@@ -53,7 +43,6 @@ const buildLoaderContext = (routingPool, opts, row) => {
     const dbname = row.dbname || opts.pg?.database || '';
     return {
         routingPool,
-        routingSchema: (0, routing_1.getRoutingSchema)(opts),
         tenantPool: (0, pg_cache_1.getPgPool)({ ...opts.pg, database: dbname }),
         databaseId: row.database_id,
         apiId: row.api_id,
@@ -164,8 +153,8 @@ const toApiStructure = (row, opts, settings = {}) => ({
 });
 const createAdminStructure = (opts, schemas, databaseId) => ({
     dbname: opts.pg?.database ?? '',
-    anonRole: 'administrator',
-    roleName: 'administrator',
+    anonRole: 'anonymous',
+    roleName: 'authenticated',
     schema: schemas,
     domains: [],
     databaseId,
@@ -178,13 +167,8 @@ const validateSchemata = async (pool, schemas) => {
     const result = await pool.query(`SELECT schema_name FROM information_schema.schemata WHERE schema_name = ANY($1::text[])`, [schemas]);
     return result.rows.map((row) => row.schema_name);
 };
-const queryByApiName = async (pool, opts, databaseId, name) => {
-    const routingSchema = (0, routing_1.getRoutingSchema)(opts);
-    if (!(0, routing_1.isValidSchemaName)(routingSchema)) {
-        log.warn(`[api-name-lookup] invalid routing schema name: ${routingSchema}`);
-        return null;
-    }
-    const result = await pool.query(scopedApiNameLookupSql(routingSchema), [databaseId, name]);
+const queryByApiName = async (pool, databaseId, name) => {
+    const result = await pool.query(API_BY_NAME_SQL, [databaseId, name]);
     return result.rows[0] ?? null;
 };
 // =============================================================================
@@ -211,7 +195,7 @@ const resolveApiNameHeader = async (ctx) => {
     const { opts, pool, headers } = ctx;
     if (!headers.databaseId)
         return null;
-    const row = await queryByApiName(pool, opts, headers.databaseId, headers.apiName);
+    const row = await queryByApiName(pool, headers.databaseId, headers.apiName);
     if (!row) {
         log.debug(`[api-name-lookup] No API found for databaseId=${headers.databaseId} name=${headers.apiName}`);
         return null;
@@ -234,13 +218,17 @@ const resolveMetaSchemaHeader = (ctx, validatedSchemas) => {
  */
 const resolveScopedRoute = async (ctx) => {
     const { opts, pool, host } = ctx;
-    const schema = (0, routing_1.getRoutingSchema)(opts);
-    const route = await (0, routing_1.resolveRoute)(pool, schema, host);
-    if (!route)
+    const match = await (0, routing_1.resolveRouteAcrossPlanes)(pool, host);
+    if (!match)
         return null;
-    const structure = (0, routing_1.routeToApiStructure)(route, opts);
+    const structure = (0, routing_1.routeToApiStructure)(match.route, opts);
     if (!structure)
         return null;
+    if (match.planeDatabaseId && structure.databaseId !== match.planeDatabaseId) {
+        const error = new Error(`host ${host} is owned by database ${match.planeDatabaseId}'s routing plane but routes to database ${structure.databaseId ?? '<none>'}`);
+        error.code = 'CROSS_DATABASE_ROUTE';
+        throw error;
+    }
     log.debug(`[scoped-routing] resolved host=${host} → api=${structure.apiId} db=${structure.dbname}`);
     if (!structure.databaseId || !structure.apiId)
         return structure;

package/middleware/flush.js

@@ -8,7 +8,6 @@ const crypto_1 = require("crypto");
 const graphile_cache_1 = require("graphile-cache");
 const graphile_presigned_url_plugin_1 = require("graphile-presigned-url-plugin");
 const pg_cache_1 = require("pg-cache");
-const routing_1 = require("./routing");
 const log = new logger_1.Logger('flush');
 const bearerToken = (req) => {
     const header = req.get('authorization');
@@ -71,14 +70,9 @@ const flushService = async (opts, databaseId) => {
             }
         });
     }
-    const routingSchema = (0, routing_1.getRoutingSchema)(opts);
-    if (!(0, routing_1.isValidSchemaName)(routingSchema)) {
-        log.warn(`[flush] invalid routing schema name: ${routingSchema}`);
-        return;
-    }
-    const svc = await pgPool.query(`SELECT hostname
-     FROM "${routingSchema}".domains
-     WHERE database_id = $1`, [databaseId]);
+    // The domains plane sits behind member RLS; the login reads it through the
+    // login-only SECURITY DEFINER reader, which resolves the plane itself.
+    const svc = await pgPool.query(`SELECT hostname FROM function_resolution.api_hostnames($1) AS hostname`, [databaseId]);
     if (svc.rowCount === 0)
         return;
     for (const row of svc.rows) {

package/middleware/routing.d.ts

@@ -25,14 +25,8 @@ export interface ResolvedRoute {
     tls_status: string | null;
     tls_secret_name: string | null;
 }
-/** Published logical name of the database-scope routing plane. */
-export declare const DEFAULT_ROUTING_SCHEMA = "routing_public";
-/** The routing-plane schema in effect: configured override or the published default. */
-export declare const getRoutingSchema: (opts: {
-    api?: {
-        routingSchema?: string;
-    };
-}) => string;
+/** The scoped routing plane the server resolves hosts on first. */
+export declare const ROUTING_SCHEMA = "routing_public";
 export declare const isValidSchemaName: (name: string) => boolean;
 /**
  * Resolve a hostname through the compiled scoped-routing plane (host-only:
@@ -42,6 +36,39 @@ export declare const isValidSchemaName: (name: string) => boolean;
  * treats it as a hard no-match (→ 404); there is no legacy fallback.
  */
 export declare const resolveRoute: (pool: Pool, schema: string, host: string) => Promise<ResolvedRoute | null>;
+/**
+ * Config keys the scoped api surface folds into `config` (and route
+ * `resolved_config`) that the server maps onto ApiStructure.
+ */
+/**
+ * A tenant database's own database-scope routing plane: one `route_module`
+ * row whose resolver keeps the resolve_route contract.
+ */
+export interface DatabaseRoutingPlane {
+    databaseId: string;
+    schema: string;
+    resolver: string;
+}
+/**
+ * The database-scope routing planes after the server's own `routing_public` plane, in
+ * the static gateway's order (by database id). The list spans every tenant,
+ * so it comes from a SECURITY DEFINER reader granted to the platform login
+ * alone, on the login's own connection: no role switch, no RLS bypass. A plane
+ * whose registration names no schema or resolver is an incomplete install and
+ * fails loud.
+ */
+export declare const loadDatabaseRoutingPlanes: (pool: Pool) => Promise<DatabaseRoutingPlane[]>;
+export interface PlaneRouteMatch {
+    route: ResolvedRoute;
+    /** Database whose own plane owns the host; null for `routing_public`. */
+    planeDatabaseId: string | null;
+}
+/**
+ * Resolve a host across routing planes: `routing_public` first, then
+ * each tenant database-scope plane. The first plane that matches owns the
+ * host; later planes are not consulted.
+ */
+export declare const resolveRouteAcrossPlanes: (pool: Pool, host: string) => Promise<PlaneRouteMatch | null>;
 /**
  * Map a resolved api-target route onto the ApiStructure shape consumed by the
  * rest of the middleware chain. Returns null when the route target is not an

package/middleware/routing.js

@@ -1,7 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.routeToApiStructure = exports.resolveRoute = exports.isValidSchemaName = exports.getRoutingSchema = exports.DEFAULT_ROUTING_SCHEMA = exports.requireApiRole = void 0;
+exports.routeToApiStructure = exports.resolveRouteAcrossPlanes = exports.loadDatabaseRoutingPlanes = exports.resolveRoute = exports.isValidSchemaName = exports.ROUTING_SCHEMA = exports.requireApiRole = void 0;
 const logger_1 = require("@pgpmjs/logger");
+const quotes_1 = require("@pgsql/quotes");
 const log = new logger_1.Logger('routing');
 // =============================================================================
 // Scoped routing plane (resolve_route contract)
@@ -29,15 +30,20 @@ const requireApiRole = (column, value, apiId) => {
         error.apiId = apiId;
         throw error;
     }
+    // administrator bypasses RLS; an API never serves as it.
+    if (value === 'administrator') {
+        const error = new Error(`API ${apiId ?? '<unknown>'} ${column} is administrator; APIs serve as request roles under RLS.`);
+        error.code = 'API_ROLE_FORBIDDEN';
+        error.column = column;
+        error.apiId = apiId;
+        throw error;
+    }
     return value;
 };
 exports.requireApiRole = requireApiRole;
 const RESOLVER_FUNCTION = 'resolve_route';
-/** Published logical name of the database-scope routing plane. */
-exports.DEFAULT_ROUTING_SCHEMA = 'routing_public';
-/** The routing-plane schema in effect: configured override or the published default. */
-const getRoutingSchema = (opts) => opts.api?.routingSchema || exports.DEFAULT_ROUTING_SCHEMA;
-exports.getRoutingSchema = getRoutingSchema;
+/** The scoped routing plane the server resolves hosts on first. */
+exports.ROUTING_SCHEMA = 'routing_public';
 const isValidSchemaName = (name) => /^[a-z_][a-z0-9_]*$/.test(name);
 exports.isValidSchemaName = isValidSchemaName;
 /**
@@ -73,6 +79,60 @@ const resolveRoute = async (pool, schema, host) => {
     }
 };
 exports.resolveRoute = resolveRoute;
+/**
+ * The database-scope routing planes after the server's own `routing_public` plane, in
+ * the static gateway's order (by database id). The list spans every tenant,
+ * so it comes from a SECURITY DEFINER reader granted to the platform login
+ * alone, on the login's own connection: no role switch, no RLS bypass. A plane
+ * whose registration names no schema or resolver is an incomplete install and
+ * fails loud.
+ */
+const loadDatabaseRoutingPlanes = async (pool) => {
+    const { rows } = await pool.query(`SELECT database_id, schema_name, resolver_function_name
+       FROM function_resolution.routing_planes()`);
+    return rows
+        .filter((row) => row.schema_name !== exports.ROUTING_SCHEMA)
+        .map((row) => {
+        if (!row.schema_name || !row.resolver_function_name) {
+            const error = new Error(`route_module for database ${row.database_id} names no ${row.schema_name ? 'resolver function' : 'public schema'}`);
+            error.code = 'ROUTING_PLANE_INCOMPLETE';
+            error.databaseId = row.database_id;
+            throw error;
+        }
+        return {
+            databaseId: row.database_id,
+            schema: row.schema_name,
+            resolver: row.resolver_function_name
+        };
+    });
+};
+exports.loadDatabaseRoutingPlanes = loadDatabaseRoutingPlanes;
+const resolveOnPlane = async (pool, plane, host) => {
+    const resolver = quotes_1.QuoteUtils.quoteQualifiedIdentifier(plane.schema, plane.resolver);
+    const result = await pool.query(`SELECT * FROM ${resolver}($1, '/', NULL)`, [host]);
+    const row = result.rows[0];
+    return row && row.route_binding_id !== null ? row : null;
+};
+/**
+ * Resolve a host across routing planes: `routing_public` first, then
+ * each tenant database-scope plane. The first plane that matches owns the
+ * host; later planes are not consulted.
+ */
+const resolveRouteAcrossPlanes = async (pool, host) => {
+    const route = await (0, exports.resolveRoute)(pool, exports.ROUTING_SCHEMA, host);
+    if (route)
+        return { route, planeDatabaseId: null };
+    for (const plane of await (0, exports.loadDatabaseRoutingPlanes)(pool)) {
+        const planeRoute = await resolveOnPlane(pool, plane, host);
+        if (planeRoute) {
+            log.debug(`[resolve-route] host=${host} owned by database plane ${plane.schema} (db=${plane.databaseId})`);
+            return { route: planeRoute, planeDatabaseId: plane.databaseId };
+        }
+    }
+    log.debug(`[resolve-route] no plane owns host=${host}`);
+    return null;
+};
+exports.resolveRouteAcrossPlanes = resolveRouteAcrossPlanes;
 /**
  * Map a resolved api-target route onto the ApiStructure shape consumed by the
  * rest of the middleware chain. Returns null when the route target is not an

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@constructive-io/graphql-server",
-  "version": "5.32.2",
+  "version": "5.32.3",
   "author": "Constructive <developers@constructive.io>",
   "description": "Constructive GraphQL Server",
   "main": "index.js",
@@ -43,11 +43,11 @@
     "@agentic-kit/ollama": "2.16.0",
     "@constructive-io/csrf": "^0.31.0",
     "@constructive-io/errors": "^0.25.0",
-    "@constructive-io/express-context": "^0.35.0",
-    "@constructive-io/graphql-env": "^3.37.1",
-    "@constructive-io/graphql-types": "^3.36.0",
+    "@constructive-io/express-context": "^0.35.1",
+    "@constructive-io/graphql-env": "^3.37.2",
+    "@constructive-io/graphql-types": "^3.36.1",
     "@constructive-io/llm-env": "^0.16.0",
-    "@constructive-io/query-builder": "^3.17.0",
+    "@constructive-io/query-builder": "^3.17.1",
     "@constructive-io/s3-utils": "^2.35.0",
     "@constructive-io/url-domains": "^2.32.0",
     "@graphile-contrib/pg-many-to-many": "2.0.0-rc.2",
@@ -67,11 +67,11 @@
     "graphile-build-pg": "5.1.3",
     "graphile-cache": "^4.16.1",
     "graphile-config": "1.1.0",
-    "graphile-function-bindings": "^1.18.1",
-    "graphile-plugin-utils": "^1.14.0",
-    "graphile-presigned-url-plugin": "^1.23.1",
-    "graphile-scoped-introspection": "^0.5.0",
-    "graphile-settings": "^6.26.2",
+    "graphile-function-bindings": "^1.18.2",
+    "graphile-plugin-utils": "^1.14.1",
+    "graphile-presigned-url-plugin": "^1.23.2",
+    "graphile-scoped-introspection": "^0.5.1",
+    "graphile-settings": "^6.26.3",
     "graphile-utils": "5.0.3",
     "graphql": "16.13.0",
     "graphql-upload": "^13.0.0",
@@ -94,11 +94,11 @@
     "@types/request-ip": "^0.0.41",
     "@types/supertest": "^7.2.1",
     "cookie-parser": "^1.4.7",
-    "graphile-test": "5.18.1",
+    "graphile-test": "5.18.2",
     "makage": "^0.8.0",
     "nodemon": "^3.1.14",
     "supertest": "^7.2.2",
     "ts-node": "^10.9.2"
   },
-  "gitHead": "91e18cc80da92331fb3aadd5baa43251c8934bc8"
+  "gitHead": "0b4ffa11a6d7958ba1068ce8e19616d4b018c0d6"
 }

package/plugins/webauthn-plugin.js

@@ -6,7 +6,6 @@ const quotes_1 = require("@pgsql/quotes");
 const server_1 = require("@simplewebauthn/server");
 const helpers_1 = require("@simplewebauthn/server/helpers");
 const grafast_1 = require("grafast");
-const graphile_plugin_utils_1 = require("graphile-plugin-utils");
 const graphile_utils_1 = require("graphile-utils");
 const CONTEXT_KEY = 'constructiveWebauthn';
 const REGISTER_CHALLENGE = 'webauthn_register_challenge';
@@ -19,11 +18,8 @@ const fail = (code, message) => {
     err.extensions = { code };
     throw err;
 };
-/** Apply the request's settings transaction-locally, optionally overriding its role. */
-const applySettings = async (tx, pgSettings, role) => {
-    const entries = Object.entries(pgSettings ?? {}).filter(([key]) => !role || key !== 'role');
-    if (role)
-        entries.push(['role', role]);
+/** Apply settings transaction-locally. */
+const applySettings = async (tx, entries) => {
     if (entries.length === 0)
         return;
     await tx.query({
@@ -32,11 +28,18 @@ const applySettings = async (tx, pgSettings, role) => {
     });
 };
 const withRequestLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
-    await applySettings(tx, pgSettings);
+    await applySettings(tx, Object.entries(pgSettings ?? {}));
     return cb(tx);
 }));
+/**
+ * The verifier lane calls the server-only procedures as the connection's own
+ * login, which alone holds EXECUTE on them. It carries the request's
+ * `jwt.claims.*` but never its `role`: as a request role those procedures are
+ * revoked, so any SQL caller could otherwise mint a session.
+ */
+const verifierSettings = (pgSettings) => Object.entries(pgSettings ?? {}).filter(([key]) => key !== 'role');
 const withVerifierLane = (withPgClient, pgSettings, cb) => withPgClient(null, (client) => client.withTransaction(async (tx) => {
-    await applySettings(tx, pgSettings, graphile_plugin_utils_1.SYSTEM_LANE_ROLE);
+    await applySettings(tx, verifierSettings(pgSettings));
     return cb(tx);
 }));
 const procedure = (settings, name) => quotes_1.QuoteUtils.quoteQualifiedIdentifier(settings.schema, name);

package/refusals/recorder.js

@@ -95,11 +95,11 @@ exports.recordRefusal = recordRefusal;
  * that was missing named — rather than returning a partial identity.
  */
 const resolvePlatformFlushIdentity = async (pool, principalName = exports.PLATFORM_BOOTSTRAP_PRINCIPAL) => {
-    const database = await pool.query(`SELECT id FROM metaschema_public.database WHERE platform IS TRUE`);
-    if (database.rowCount !== 1) {
-        throw new Error(`refusals: expected exactly one platform database (metaschema_public.database.platform), found ${database.rowCount}`);
-    }
-    const principal = await pool.query(`SELECT user_id, bypass_step_up FROM constructive_auth_public.principals WHERE name = $1`, [principalName]);
+    // Both reads cross RLS before any request exists, so they go through
+    // SECURITY DEFINER resolvers granted to the login; the first raises when no
+    // platform database is registered.
+    const database = await pool.query(`SELECT app_scope.platform_database_id() AS id`);
+    const principal = await pool.query(`SELECT user_id, bypass_step_up FROM function_resolution.service_principal($1)`, [principalName]);
     if (principal.rowCount !== 1) {
         throw new Error(`refusals: no service principal named '${principalName}'`);
     }

package/server.js

@@ -38,7 +38,6 @@ const debug_memory_1 = require("./middleware/observability/debug-memory");
 const guard_1 = require("./middleware/observability/guard");
 const request_logger_1 = require("./middleware/observability/request-logger");
 const request_protection_1 = require("./middleware/request-protection");
-const routing_1 = require("./middleware/routing");
 const standing_1 = require("./middleware/standing");
 const recorder_1 = require("./refusals/recorder");
 const log = new logger_1.Logger('server');
@@ -98,7 +97,6 @@ class Server {
             serverHost: effectiveOpts.server?.host,
             serverPort: effectiveOpts.server?.port,
             apiIsPublic: apiOpts.isPublic,
-            routingSchema: apiOpts.routingSchema,
             metaSchemas: apiOpts.metaSchemas?.join(',') || 'default',
             observabilityEnabled
         });
@@ -151,8 +149,7 @@ class Server {
         app.use(authenticate);
         app.use((0, express_context_1.createContextMiddleware)({
             pg: effectiveOpts.pg,
-            loaders: (0, express_context_1.createDefaultRegistry)(),
-            routingSchema: (0, routing_1.getRoutingSchema)(effectiveOpts)
+            loaders: (0, express_context_1.createDefaultRegistry)()
         }));
         // A suspended (or unknown) database is refused before anything is spent on
         // the request; billing and platform admins set that state, the loader reads it.