@decaf-ts/integrations 0.10.8 → 0.12.0

package/lib/cjs/namespaces/rls/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces/rls/index.cjs","sourceRoot":"","sources":["namespaces/rls/index.js"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,qDAAmC;AACnC,iDAA+B;AAC/B,oDAAkC;AAClC,6DAA2C;AAC3C,0DAAwC;AACxC,uDAAqC;AACrC,iCAAiC"}

package/lib/cjs/namespaces/rls/principal-resolver.cjs

@@ -0,0 +1,66 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PRINCIPAL_UUID_PATTERN = void 0;
+exports.resolvePrincipalForSubject = resolvePrincipalForSubject;
+/**
+ * @module integrations/namespaces/rls/principal-resolver
+ * @summary Resolves a decaf `principals.id` UUID from an authenticated subject through the RLS `SECURITY DEFINER` helper.
+ * @description Exposes {@link resolvePrincipalForSubject}, a fail-closed,
+ * fully parameterized lookup that maps an authenticated subject id (and
+ * optional tenant) to the single matching principal UUID via the
+ * `app_rls_principal_for_subject(text, uuid)` SQL helper installed by the
+ * namespace RLS template. Intended for privileged infrastructure code (auth
+ * prime / service role) that must translate a login identity into the
+ * principal UUID the TypeORM adapter binds transaction-locally to
+ * `app.principal_id`; it is not meant to run on an RLS-restricted application
+ * session.
+ */
+const db_decorators_1 = require("@decaf-ts/db-decorators");
+/**
+ * @description Pattern enforcing UUID shape on resolved principals and tenant ids
+ * @summary Used to validate the optional `tenantId` argument and to fail
+ * closed on driver results that are not UUID-shaped strings.
+ * @const PRINCIPAL_UUID_PATTERN
+ */
+exports.PRINCIPAL_UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * @description Resolves the principal UUID for an authenticated subject
+ * @summary Calls the `SECURITY DEFINER` helper
+ * `app_rls_principal_for_subject(text, uuid)` through the given privileged
+ * client with fully parameterized SQL. Fails closed: an empty subject, an
+ * ambiguous subject (the helper returns `NULL` unless exactly one principal
+ * matches), and driver results that are not UUID-shaped strings all resolve to
+ * `undefined` rather than throwing, so callers handle "no principal" uniformly
+ * by denying. Requires a privileged auth-prime/service-role client; this
+ * resolver must never be invoked with an application session client.
+ * @function resolvePrincipalForSubject
+ * @param {PrincipalSubjectQueryClient} client - Privileged client used to run the helper query.
+ * @param {string} subject - The authenticated subject id (`principals.subject_id`).
+ * @param {string} [tenantId] - Optional tenant UUID scoping the lookup.
+ * @returns {Promise<string | undefined>} The principal UUID, or `undefined` when none can be resolved.
+ * @throws {ValidationError} When the client is not query-capable, or `tenantId` is provided but not a UUID.
+ * @example
+ * const principalId = await resolvePrincipalForSubject(pgClient, authSubject, tenantId);
+ * if (!principalId)
+ *   throw new Error("No principal for subject"); // fail closed
+ */
+async function resolvePrincipalForSubject(client, subject, tenantId) {
+    if (!client || typeof client.query !== "function")
+        throw new db_decorators_1.ValidationError("resolvePrincipalForSubject requires a privileged auth-prime/service-role client, not the application session");
+    const normalizedSubject = typeof subject === "string" ? subject.trim() : "";
+    if (!normalizedSubject)
+        return undefined;
+    if (tenantId !== undefined && tenantId !== null) {
+        if (typeof tenantId !== "string" || !exports.PRINCIPAL_UUID_PATTERN.test(tenantId))
+            throw new db_decorators_1.ValidationError("resolvePrincipalForSubject tenantId must be a UUID when provided");
+    }
+    const result = (await client.query("SELECT app_rls_principal_for_subject($1, $2) AS principal_id", [normalizedSubject, tenantId ?? null]));
+    const rows = Array.isArray(result) ? result : result?.rows;
+    const principalId = Array.isArray(rows) ? rows[0]?.principal_id : undefined;
+    if (typeof principalId !== "string")
+        return undefined;
+    const normalized = principalId.trim();
+    return exports.PRINCIPAL_UUID_PATTERN.test(normalized) ? normalized : undefined;
+}
+//# sourceMappingURL=principal-resolver.js.map
+//# sourceMappingURL=principal-resolver.cjs.map

package/lib/cjs/namespaces/rls/principal-resolver.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces/rls/principal-resolver.cjs","sourceRoot":"","sources":["namespaces/rls/principal-resolver.js"],"names":[],"mappings":";;;AA0CA,gEAiBC;AA3DD;;;;;;;;;;;;GAYG;AACH,2DAA0D;AAC1D;;;;;GAKG;AACU,QAAA,sBAAsB,GAAG,iEAAiE,CAAC;AACxG;;;;;;;;;;;;;;;;;;;;GAoBG;AACI,KAAK,UAAU,0BAA0B,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ;IACtE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU;QAC7C,MAAM,IAAI,+BAAe,CAAC,8GAA8G,CAAC,CAAC;IAC9I,MAAM,iBAAiB,GAAG,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,CAAC,iBAAiB;QAClB,OAAO,SAAS,CAAC;IACrB,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9C,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,8BAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC;YACtE,MAAM,IAAI,+BAAe,CAAC,kEAAkE,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,8DAA8D,EAAE,CAAC,iBAAiB,EAAE,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3I,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC;IAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,OAAO,WAAW,KAAK,QAAQ;QAC/B,OAAO,SAAS,CAAC;IACrB,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACtC,OAAO,8BAAsB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5E,CAAC;AACD,8CAA8C"}

package/lib/cjs/namespaces/rls/rls-bootstrap.service.cjs

@@ -0,0 +1,269 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RlsBootstrapService = exports.RlsFunctionOwnerError = void 0;
+exports.assertPrincipalId = assertPrincipalId;
+exports.runAsPrincipal = runAsPrincipal;
+/**
+ * @module integrations/namespaces/rls/bootstrap
+ * @summary Bootstrap service that applies the namespace row-level-security template.
+ * @description Wires the SQL template into a query executor (for example a
+ * `pg.Client`) so deployments apply the policies through application bootstrap
+ * or a migration runner instead of hand-running SQL. Also exposes helpers
+ * that bind `app.principal_id` transaction-locally for request-scoped access.
+ */
+const core_1 = require("@decaf-ts/core");
+const db_decorators_1 = require("@decaf-ts/db-decorators");
+const rls_template_js_1 = require("./rls.template.cjs");
+const rls_constants_js_1 = require("./rls.constants.cjs");
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * @description Thrown when the executor role cannot safely own the RLS helper functions.
+ * @summary Raised by
+ * `RlsBootstrapService.assertFunctionOwnerPrivileges()` when the current
+ * database role is neither `SUPERUSER` nor `BYPASSRLS` (or when its
+ * privileges cannot be determined). Extends
+ * `{@link InternalError}` so callers can catch it generically, while
+ * carrying the distinctive `RlsFunctionOwnerError` name for
+ * fail-closed matching.
+ * @class RlsFunctionOwnerError
+ * @category Namespaces
+ */
+class RlsFunctionOwnerError extends db_decorators_1.InternalError {
+    constructor(message) {
+        super(message);
+        this.name = "RlsFunctionOwnerError";
+    }
+}
+exports.RlsFunctionOwnerError = RlsFunctionOwnerError;
+function assertTransactionLocalBinding(method, options) {
+    if (options && options.local !== undefined && options.local !== true) {
+        throw new db_decorators_1.ValidationError(`${method} only supports transaction-local binding: session-wide binding is not allowed`);
+    }
+}
+/**
+ * @description Validates a principal identifier before binding it to the
+ * `app.principal_id` RLS setting.
+ * @summary Fail-closed shape guard shared by the binding helpers: the value
+ * must be a non-empty UUID string. On failure it throws a `ValidationError`
+ * with a fixed message that never echoes the rejected value, so invalid input
+ * cannot leak into error surfaces or logs.
+ * @function assertPrincipalId
+ * @param {string} principalId - Candidate principal (or tenant) UUID to validate.
+ * @returns {void}
+ * @throws {ValidationError} When the value is empty or not UUID-shaped; the message does not include the rejected value.
+ */
+function assertPrincipalId(principalId) {
+    if (!principalId || !UUID_PATTERN.test(principalId)) {
+        throw new db_decorators_1.ValidationError("Invalid RLS principal id");
+    }
+}
+/**
+ * @description Applies the namespace RLS template through a SQL executor.
+ * @summary The service boots with a SQL executor (`pg.Client`, `pg.Pool`, or a
+ * compatible wrapper) and applies the namespace row-level-security template:
+ * function plus policy DDL executed sequentially. It is the deployment-side
+ * entry point for the RLS template, meant to run during application bootstrap
+ * or a migration runner instead of hand-running SQL. The template is
+ * idempotent and may run on every deployment.
+ * @class RlsBootstrapService
+ * @category Namespaces
+ */
+class RlsBootstrapService extends core_1.ClientBasedService {
+    constructor() {
+        super();
+    }
+    async initialize(...args) {
+        const client = args[0];
+        if (!client || typeof client.query !== "function") {
+            throw new db_decorators_1.ValidationError("RlsBootstrapService requires a query executor as its first argument");
+        }
+        const config = args[1] ?? {};
+        return { config, client };
+    }
+    /**
+     * @description Applies the configured (or bundled) RLS statement list.
+     * @summary The service is booted with an executor (`pg.Client`, `pg.Pool`, or a
+     * compatible wrapper) and applies function plus policy DDL sequentially. The
+     * template is idempotent and may run on every deployment. Before any DDL is
+     * sent, `assertFunctionOwnerPrivileges()` verifies that the current
+     * executor role is `SUPERUSER` or `BYPASSRLS` and fails closed otherwise,
+     * so `SECURITY DEFINER` helper functions are never created with an owner
+     * that would recurse under `FORCE ROW LEVEL SECURITY`.
+     * @return {Promise<{applied: number}>} The number of statements executed.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or its privileges cannot be determined.
+     * @throws {InternalError} When the resolved statement list is empty.
+     */
+    async apply(...args) {
+        const { log } = (await this.logCtx(args, "apply", true)).for(this.apply);
+        const statements = this.statements();
+        if (!statements.length) {
+            throw new db_decorators_1.InternalError("No RLS statements to apply");
+        }
+        await this.assertFunctionOwnerPrivileges(...args);
+        log.verbose(`Applying ${statements.length} RLS statements`);
+        for (const statement of statements) {
+            await this.client.query(statement);
+        }
+        log.info(`Applied namespace RLS template (${statements.length} statements)`);
+        return { applied: statements.length };
+    }
+    /**
+     * @description Verifies that the current executor role can own the RLS helper functions.
+     * @summary Runs `RLS_FUNCTION_OWNER_QUERY` through the configured executor
+     * and reads the current role's `rolsuper`/`rolbypassrls` flags from
+     * `pg_roles`. Fails closed: when the row is missing or the flags are not
+     * booleans, it throws `RlsFunctionOwnerError` with the same
+     * fail-closed semantics as an explicit privilege failure. Called
+     * automatically by `apply()` before any DDL is executed.
+     * @param args - Optional trailing decaf `Context` arguments forwarded to the log context.
+     * @return Resolves when the current role is `SUPERUSER` or `BYPASSRLS`.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or when its privileges cannot be determined from `pg_roles`.
+     */
+    async assertFunctionOwnerPrivileges(...args) {
+        const { log } = (await this.logCtx(args, "assertFunctionOwnerPrivileges", true)).for(this.assertFunctionOwnerPrivileges);
+        const result = await this.client.query(rls_constants_js_1.RLS_FUNCTION_OWNER_QUERY);
+        const row = (result.rows?.[0] ?? undefined);
+        const roleName = row?.rolname
+            ? JSON.stringify(row.rolname)
+            : "current_user";
+        if (typeof row?.rolsuper !== "boolean" ||
+            typeof row?.rolbypassrls !== "boolean") {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template: could not determine the privileges of ${roleName}. ` +
+                "The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to " +
+                "apply policies that would recurse under FORCE ROW LEVEL SECURITY.");
+        }
+        if (!row.rolsuper && !row.rolbypassrls) {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template as ${roleName}: the executor role is neither SUPERUSER ` +
+                "nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, " +
+                "otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as " +
+                "the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated " +
+                "BYPASSRLS owner.");
+        }
+        log.verbose(`Verified RLS function owner privileges for ${roleName}`);
+    }
+    /**
+     * @description Resolves the statement list for the active configuration.
+     */
+    statements() {
+        const config = this._config ?? {};
+        if (config.statements)
+            return [...config.statements];
+        if (config.policies) {
+            return [
+                ...rls_template_js_1.RLS_FUNCTION_STATEMENTS,
+                ...(0, rls_template_js_1.rlsPolicyStatements)(config.policies),
+            ];
+        }
+        return (0, rls_template_js_1.rlsBootstrapStatements)();
+    }
+    /**
+     * @description Binds the acting principal for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the principal
+     * id.
+     * @param principalId Principal UUID stored in `app.principal_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the principal id is invalid or a session-wide binding is requested.
+     */
+    async setPrincipal(principalId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setPrincipal", true)).for(this.setPrincipal);
+        assertPrincipalId(principalId);
+        assertTransactionLocalBinding("setPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            rls_constants_js_1.RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        log.verbose("Bound RLS principal (transaction-local)");
+    }
+    /**
+     * @description Binds the acting tenant for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the tenant
+     * id.
+     * @param tenantId Tenant UUID stored in `app.tenant_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the tenant id is invalid or a session-wide binding is requested.
+     */
+    async setTenant(tenantId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setTenant", true)).for(this.setTenant);
+        assertPrincipalId(tenantId);
+        assertTransactionLocalBinding("setTenant", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            rls_constants_js_1.RLS_SETTINGS.Tenant,
+            tenantId,
+        ]);
+        log.verbose("Bound RLS tenant (transaction-local)");
+    }
+    /**
+     * @description Clears the acting principal for the current transaction.
+     * @summary Resets `app.principal_id` to the empty string with
+     * `SELECT set_config($1, $2, true)`, so the clear is also transaction-local
+     * and never reaches the pooled session. A session-wide clear request fails
+     * with `ValidationError` before any SQL is sent.
+     * @param options Only `local: true` (the default) is accepted; the clear is
+     * always transaction-local and does not reach the pooled session.
+     * @returns {Promise<void>} Resolves once the setting is cleared transaction-locally.
+     * @throws {ValidationError} When a session-wide clear is requested.
+     */
+    async clearPrincipal(options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "clearPrincipal", true)).for(this.clearPrincipal);
+        assertTransactionLocalBinding("clearPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            rls_constants_js_1.RLS_SETTINGS.Principal,
+            "",
+        ]);
+        log.verbose("Cleared RLS principal (transaction-local)");
+    }
+    /**
+     * @description Returns the principal currently bound to the connection.
+     */
+    async currentPrincipal(...args) {
+        const { log } = (await this.logCtx(args, "currentPrincipal", true)).for(this.currentPrincipal);
+        log.verbose("Reading current RLS principal");
+        const result = await this.client.query("SELECT app_rls_principal_id() AS principal_id");
+        const row = (result.rows?.[0] ?? {});
+        return row.principal_id ?? null;
+    }
+}
+exports.RlsBootstrapService = RlsBootstrapService;
+/**
+ * @description Runs a callback inside a transaction with the RLS principal bound.
+ * @summary The executor must be a single connection (`pg.Client`), not a pool,
+ * because the transaction and the `app.principal_id` setting are
+ * connection-scoped. By default the transaction is rolled back, keeping
+ * integration-test mutations isolated; pass `{ commit: true }` for real writes.
+ */
+async function runAsPrincipal(executor, principalId, run, options = {}) {
+    assertPrincipalId(principalId);
+    await executor.query("BEGIN");
+    try {
+        await executor.query("SELECT set_config($1, $2, true)", [
+            rls_constants_js_1.RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        const result = await run(executor);
+        await executor.query(options.commit ? "COMMIT" : "ROLLBACK");
+        return result;
+    }
+    catch (error) {
+        try {
+            await executor.query("ROLLBACK");
+        }
+        catch {
+            // preserve the original failure
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=rls-bootstrap.service.js.map
+//# sourceMappingURL=rls-bootstrap.service.cjs.map

package/lib/cjs/namespaces/rls/rls-bootstrap.service.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces/rls/rls-bootstrap.service.cjs","sourceRoot":"","sources":["namespaces/rls/rls-bootstrap.service.js"],"names":[],"mappings":";;;AAgDA,8CAIC;AA0LD,wCAqBC;AAnQD;;;;;;;GAOG;AACH,yCAAoD;AACpD,2DAAyE;AACzE,uDAA0G;AAC1G,yDAA4E;AAC5E,MAAM,YAAY,GAAG,iEAAiE,CAAC;AACvF;;;;;;;;;;;GAWG;AACH,MAAa,qBAAsB,SAAQ,6BAAa;IACpD,YAAY,OAAO;QACf,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACxC,CAAC;CACJ;AALD,sDAKC;AACD,SAAS,6BAA6B,CAAC,MAAM,EAAE,OAAO;IAClD,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACnE,MAAM,IAAI,+BAAe,CAAC,GAAG,MAAM,+EAA+E,CAAC,CAAC;IACxH,CAAC;AACL,CAAC;AACD;;;;;;;;;;;GAWG;AACH,SAAgB,iBAAiB,CAAC,WAAW;IACzC,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,+BAAe,CAAC,0BAA0B,CAAC,CAAC;IAC1D,CAAC;AACL,CAAC;AACD;;;;;;;;;;GAUG;AACH,MAAa,mBAAoB,SAAQ,yBAAkB;IACvD;QACI,KAAK,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI;QACpB,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,+BAAe,CAAC,qEAAqE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC9B,CAAC;IACD;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI;QACf,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACrB,MAAM,IAAI,6BAAa,CAAC,4BAA4B,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,YAAY,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACvC,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,mCAAmC,UAAU,CAAC,MAAM,cAAc,CAAC,CAAC;QAC7E,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IAC1C,CAAC;IACD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,6BAA6B,CAAC,GAAG,IAAI;QACvC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACzH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAAwB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO;YACzB,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,cAAc,CAAC;QACrB,IAAI,OAAO,GAAG,EAAE,QAAQ,KAAK,SAAS;YAClC,OAAO,GAAG,EAAE,YAAY,KAAK,SAAS,EAAE,CAAC;YACzC,MAAM,IAAI,qBAAqB,CAAC,kFAAkF,QAAQ,IAAI;gBAC1H,4FAA4F;gBAC5F,mEAAmE,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACrC,MAAM,IAAI,qBAAqB,CAAC,8CAA8C,QAAQ,2CAA2C;gBAC7H,kGAAkG;gBAClG,kGAAkG;gBAClG,+FAA+F;gBAC/F,kBAAkB,CAAC,CAAC;QAC5B,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD;;OAEG;IACH,UAAU;QACN,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU;YACjB,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO;gBACH,GAAG,yCAAuB;gBAC1B,GAAG,IAAA,qCAAmB,EAAC,MAAM,CAAC,QAAQ,CAAC;aAC1C,CAAC;QACN,CAAC;QACD,OAAO,IAAA,wCAAsB,GAAE,CAAC;IACpC,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI;QACjD,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvF,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/B,6BAA6B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACvD,+BAAY,CAAC,SAAS;YACtB,WAAW;SACd,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI;QAC3C,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACvD,+BAAY,CAAC,MAAM;YACnB,QAAQ;SACX,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACxD,CAAC;IACD;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAAC,OAAO,GAAG,EAAE,EAAE,GAAG,IAAI;QACtC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QAC3F,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACvD,+BAAY,CAAC,SAAS;YACtB,EAAE;SACL,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC7D,CAAC;IACD;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAI;QAC1B,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAC/F,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IACpC,CAAC;CACJ;AAtKD,kDAsKC;AACD;;;;;;GAMG;AACI,KAAK,UAAU,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,OAAO,GAAG,EAAE;IACzE,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACpD,+BAAY,CAAC,SAAS;YACtB,WAAW;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAClB,CAAC;IACD,OAAO,KAAK,EAAE,CAAC;QACX,IAAI,CAAC;YACD,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,CAAC;YACH,gCAAgC;QACpC,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AACD,iDAAiD"}

package/lib/cjs/namespaces/rls/rls.constants.cjs

@@ -0,0 +1,79 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RLS_PROTECTED_TABLES = exports.RLS_FUNCTION_OWNER_QUERY = exports.RLS_ROLE_KEYS = exports.RLS_SETTINGS = exports.RLS_PERMISSION_KEYS = void 0;
+/**
+ * @module integrations/namespaces/rls/constants
+ * @summary Row-level-security constants for the namespace authorization schema.
+ * @description Canonical permission keys, session settings, default role keys, and
+ * the tables covered by the namespace RLS template.
+ */
+/**
+ * @description Permission keys consumed by the SQL RLS policies.
+ * @summary A namespace reader can only read, a writer can also create/update/delete
+ * non-administrative rows, and an admin can do everything in the namespace.
+ */
+exports.RLS_PERMISSION_KEYS = {
+    Read: "namespace.read",
+    Write: "namespace.write",
+    Admin: "namespace.admin",
+};
+/**
+ * @description Session settings read by the RLS policies.
+ * @summary The application must set `app.principal_id` for every request-scoped
+ * database session or transaction before querying namespace tables.
+ */
+exports.RLS_SETTINGS = {
+    Principal: "app.principal_id",
+    Tenant: "app.tenant_id",
+};
+/**
+ * @description Default role keys for the reader/writer/admin matrix.
+ * @summary Bootstrapping a tenant with these keys gives consumers a stable
+ * three-tier namespace role model without coupling them to custom role names.
+ */
+exports.RLS_ROLE_KEYS = {
+    Reader: "namespace-reader",
+    Writer: "namespace-writer",
+    Admin: "namespace-admin",
+};
+/**
+ * @description Boot-time privilege probe for the RLS `SECURITY DEFINER` helper functions.
+ * @summary Reads the current role's `rolsuper` and `rolbypassrls` flags from
+ * `pg_roles`. `RlsBootstrapService.assertFunctionOwnerPrivileges()` executes
+ * this query before applying any RLS DDL and refuses to proceed unless the
+ * executor role is `SUPERUSER` or `BYPASSRLS`, because a `SECURITY DEFINER`
+ * owner that does not bypass RLS makes every policy evaluation recurse under
+ * `FORCE ROW LEVEL SECURITY`.
+ */
+exports.RLS_FUNCTION_OWNER_QUERY = "SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user";
+/**
+ * @description Tables protected by the namespace RLS template.
+ * @summary Includes the authorization machinery, org profiles, protected
+ * resources, and the slice-1 credential/secret records.
+ */
+exports.RLS_PROTECTED_TABLES = [
+    "tenants",
+    "org_units",
+    "org_unit_closure",
+    "users",
+    "groups",
+    "principals",
+    "tenant_memberships",
+    "org_unit_memberships",
+    "group_memberships",
+    "permissions",
+    "roles",
+    "role_permissions",
+    "role_assignments",
+    "inheritance_blocks",
+    "protected_resources",
+    "resource_grants",
+    "effective_permissions",
+    "storage_bindings",
+    "tenant_profiles",
+    "org_unit_profiles",
+    "credentials",
+    "secrets",
+];
+//# sourceMappingURL=rls.constants.js.map
+//# sourceMappingURL=rls.constants.cjs.map

package/lib/cjs/namespaces/rls/rls.constants.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespaces/rls/rls.constants.cjs","sourceRoot":"","sources":["namespaces/rls/rls.constants.js"],"names":[],"mappings":";;;AAAA;;;;;GAKG;AACH;;;;GAIG;AACU,QAAA,mBAAmB,GAAG;IAC/B,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,iBAAiB;IACxB,KAAK,EAAE,iBAAiB;CAC3B,CAAC;AACF;;;;GAIG;AACU,QAAA,YAAY,GAAG;IACxB,SAAS,EAAE,kBAAkB;IAC7B,MAAM,EAAE,eAAe;CAC1B,CAAC;AACF;;;;GAIG;AACU,QAAA,aAAa,GAAG;IACzB,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;CAC3B,CAAC;AACF;;;;;;;;GAQG;AACU,QAAA,wBAAwB,GAAG,mGAAmG,CAAC;AAC5I;;;;GAIG;AACU,QAAA,oBAAoB,GAAG;IAChC,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,oBAAoB;IACpB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,uBAAuB;IACvB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;IACb,SAAS;CACZ,CAAC;AACF,yCAAyC"}