@decaf-ts/integrations 0.11.0 → 0.12.0

package/lib/esm/namespaces/rls/rls-bootstrap.service.js

@@ -0,0 +1,261 @@
+/**
+ * @module integrations/namespaces/rls/bootstrap
+ * @summary Bootstrap service that applies the namespace row-level-security template.
+ * @description Wires the SQL template into a query executor (for example a
+ * `pg.Client`) so deployments apply the policies through application bootstrap
+ * or a migration runner instead of hand-running SQL. Also exposes helpers
+ * that bind `app.principal_id` transaction-locally for request-scoped access.
+ */
+import { ClientBasedService } from "@decaf-ts/core";
+import { InternalError, ValidationError } from "@decaf-ts/db-decorators";
+import { RLS_FUNCTION_STATEMENTS, rlsBootstrapStatements, rlsPolicyStatements, } from "./rls.template.js";
+import { RLS_FUNCTION_OWNER_QUERY, RLS_SETTINGS } from "./rls.constants.js";
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+ * @description Thrown when the executor role cannot safely own the RLS helper functions.
+ * @summary Raised by
+ * `RlsBootstrapService.assertFunctionOwnerPrivileges()` when the current
+ * database role is neither `SUPERUSER` nor `BYPASSRLS` (or when its
+ * privileges cannot be determined). Extends
+ * `{@link InternalError}` so callers can catch it generically, while
+ * carrying the distinctive `RlsFunctionOwnerError` name for
+ * fail-closed matching.
+ * @class RlsFunctionOwnerError
+ * @category Namespaces
+ */
+export class RlsFunctionOwnerError extends InternalError {
+    constructor(message) {
+        super(message);
+        this.name = "RlsFunctionOwnerError";
+    }
+}
+function assertTransactionLocalBinding(method, options) {
+    if (options && options.local !== undefined && options.local !== true) {
+        throw new ValidationError(`${method} only supports transaction-local binding: session-wide binding is not allowed`);
+    }
+}
+/**
+ * @description Validates a principal identifier before binding it to the
+ * `app.principal_id` RLS setting.
+ * @summary Fail-closed shape guard shared by the binding helpers: the value
+ * must be a non-empty UUID string. On failure it throws a `ValidationError`
+ * with a fixed message that never echoes the rejected value, so invalid input
+ * cannot leak into error surfaces or logs.
+ * @function assertPrincipalId
+ * @param {string} principalId - Candidate principal (or tenant) UUID to validate.
+ * @returns {void}
+ * @throws {ValidationError} When the value is empty or not UUID-shaped; the message does not include the rejected value.
+ */
+export function assertPrincipalId(principalId) {
+    if (!principalId || !UUID_PATTERN.test(principalId)) {
+        throw new ValidationError("Invalid RLS principal id");
+    }
+}
+/**
+ * @description Applies the namespace RLS template through a SQL executor.
+ * @summary The service boots with a SQL executor (`pg.Client`, `pg.Pool`, or a
+ * compatible wrapper) and applies the namespace row-level-security template:
+ * function plus policy DDL executed sequentially. It is the deployment-side
+ * entry point for the RLS template, meant to run during application bootstrap
+ * or a migration runner instead of hand-running SQL. The template is
+ * idempotent and may run on every deployment.
+ * @class RlsBootstrapService
+ * @category Namespaces
+ */
+export class RlsBootstrapService extends ClientBasedService {
+    constructor() {
+        super();
+    }
+    async initialize(...args) {
+        const client = args[0];
+        if (!client || typeof client.query !== "function") {
+            throw new ValidationError("RlsBootstrapService requires a query executor as its first argument");
+        }
+        const config = args[1] ?? {};
+        return { config, client };
+    }
+    /**
+     * @description Applies the configured (or bundled) RLS statement list.
+     * @summary The service is booted with an executor (`pg.Client`, `pg.Pool`, or a
+     * compatible wrapper) and applies function plus policy DDL sequentially. The
+     * template is idempotent and may run on every deployment. Before any DDL is
+     * sent, `assertFunctionOwnerPrivileges()` verifies that the current
+     * executor role is `SUPERUSER` or `BYPASSRLS` and fails closed otherwise,
+     * so `SECURITY DEFINER` helper functions are never created with an owner
+     * that would recurse under `FORCE ROW LEVEL SECURITY`.
+     * @return {Promise<{applied: number}>} The number of statements executed.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or its privileges cannot be determined.
+     * @throws {InternalError} When the resolved statement list is empty.
+     */
+    async apply(...args) {
+        const { log } = (await this.logCtx(args, "apply", true)).for(this.apply);
+        const statements = this.statements();
+        if (!statements.length) {
+            throw new InternalError("No RLS statements to apply");
+        }
+        await this.assertFunctionOwnerPrivileges(...args);
+        log.verbose(`Applying ${statements.length} RLS statements`);
+        for (const statement of statements) {
+            await this.client.query(statement);
+        }
+        log.info(`Applied namespace RLS template (${statements.length} statements)`);
+        return { applied: statements.length };
+    }
+    /**
+     * @description Verifies that the current executor role can own the RLS helper functions.
+     * @summary Runs `RLS_FUNCTION_OWNER_QUERY` through the configured executor
+     * and reads the current role's `rolsuper`/`rolbypassrls` flags from
+     * `pg_roles`. Fails closed: when the row is missing or the flags are not
+     * booleans, it throws `RlsFunctionOwnerError` with the same
+     * fail-closed semantics as an explicit privilege failure. Called
+     * automatically by `apply()` before any DDL is executed.
+     * @param args - Optional trailing decaf `Context` arguments forwarded to the log context.
+     * @return Resolves when the current role is `SUPERUSER` or `BYPASSRLS`.
+     * @throws {RlsFunctionOwnerError} When the executor role is neither `SUPERUSER` nor `BYPASSRLS`, or when its privileges cannot be determined from `pg_roles`.
+     */
+    async assertFunctionOwnerPrivileges(...args) {
+        const { log } = (await this.logCtx(args, "assertFunctionOwnerPrivileges", true)).for(this.assertFunctionOwnerPrivileges);
+        const result = await this.client.query(RLS_FUNCTION_OWNER_QUERY);
+        const row = (result.rows?.[0] ?? undefined);
+        const roleName = row?.rolname
+            ? JSON.stringify(row.rolname)
+            : "current_user";
+        if (typeof row?.rolsuper !== "boolean" ||
+            typeof row?.rolbypassrls !== "boolean") {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template: could not determine the privileges of ${roleName}. ` +
+                "The SECURITY DEFINER helper functions require a SUPERUSER or BYPASSRLS owner; refusing to " +
+                "apply policies that would recurse under FORCE ROW LEVEL SECURITY.");
+        }
+        if (!row.rolsuper && !row.rolbypassrls) {
+            throw new RlsFunctionOwnerError(`Cannot apply the namespace RLS template as ${roleName}: the executor role is neither SUPERUSER ` +
+                "nor BYPASSRLS. The SECURITY DEFINER helper functions must be owned by a role that bypasses RLS, " +
+                "otherwise every policy evaluation recurses under FORCE ROW LEVEL SECURITY and fails. Connect as " +
+                "the database owner/BYPASSRLS migration role, or create the helper functions with a dedicated " +
+                "BYPASSRLS owner.");
+        }
+        log.verbose(`Verified RLS function owner privileges for ${roleName}`);
+    }
+    /**
+     * @description Resolves the statement list for the active configuration.
+     */
+    statements() {
+        const config = this._config ?? {};
+        if (config.statements)
+            return [...config.statements];
+        if (config.policies) {
+            return [
+                ...RLS_FUNCTION_STATEMENTS,
+                ...rlsPolicyStatements(config.policies),
+            ];
+        }
+        return rlsBootstrapStatements();
+    }
+    /**
+     * @description Binds the acting principal for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the principal
+     * id.
+     * @param principalId Principal UUID stored in `app.principal_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the principal id is invalid or a session-wide binding is requested.
+     */
+    async setPrincipal(principalId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setPrincipal", true)).for(this.setPrincipal);
+        assertPrincipalId(principalId);
+        assertTransactionLocalBinding("setPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        log.verbose("Bound RLS principal (transaction-local)");
+    }
+    /**
+     * @description Binds the acting tenant for the current transaction.
+     * @summary Issues parameterized `SELECT set_config($1, $2, true)` after
+     * validation, so the binding lives only for the current transaction and is
+     * discarded on commit/rollback — safe on pooled connections. A session-wide
+     * binding request fails with `ValidationError` before any SQL is sent, and
+     * the verbose log records only that a binding happened, never the tenant
+     * id.
+     * @param tenantId Tenant UUID stored in `app.tenant_id`.
+     * @param options Only `local: true` (the default) is accepted; the binding is
+     * always transaction-local and is discarded on commit/rollback.
+     * @returns {Promise<void>} Resolves once the setting is bound transaction-locally.
+     * @throws {ValidationError} When the tenant id is invalid or a session-wide binding is requested.
+     */
+    async setTenant(tenantId, options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "setTenant", true)).for(this.setTenant);
+        assertPrincipalId(tenantId);
+        assertTransactionLocalBinding("setTenant", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Tenant,
+            tenantId,
+        ]);
+        log.verbose("Bound RLS tenant (transaction-local)");
+    }
+    /**
+     * @description Clears the acting principal for the current transaction.
+     * @summary Resets `app.principal_id` to the empty string with
+     * `SELECT set_config($1, $2, true)`, so the clear is also transaction-local
+     * and never reaches the pooled session. A session-wide clear request fails
+     * with `ValidationError` before any SQL is sent.
+     * @param options Only `local: true` (the default) is accepted; the clear is
+     * always transaction-local and does not reach the pooled session.
+     * @returns {Promise<void>} Resolves once the setting is cleared transaction-locally.
+     * @throws {ValidationError} When a session-wide clear is requested.
+     */
+    async clearPrincipal(options = {}, ...args) {
+        const { log } = (await this.logCtx(args, "clearPrincipal", true)).for(this.clearPrincipal);
+        assertTransactionLocalBinding("clearPrincipal", options);
+        await this.client.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            "",
+        ]);
+        log.verbose("Cleared RLS principal (transaction-local)");
+    }
+    /**
+     * @description Returns the principal currently bound to the connection.
+     */
+    async currentPrincipal(...args) {
+        const { log } = (await this.logCtx(args, "currentPrincipal", true)).for(this.currentPrincipal);
+        log.verbose("Reading current RLS principal");
+        const result = await this.client.query("SELECT app_rls_principal_id() AS principal_id");
+        const row = (result.rows?.[0] ?? {});
+        return row.principal_id ?? null;
+    }
+}
+/**
+ * @description Runs a callback inside a transaction with the RLS principal bound.
+ * @summary The executor must be a single connection (`pg.Client`), not a pool,
+ * because the transaction and the `app.principal_id` setting are
+ * connection-scoped. By default the transaction is rolled back, keeping
+ * integration-test mutations isolated; pass `{ commit: true }` for real writes.
+ */
+export async function runAsPrincipal(executor, principalId, run, options = {}) {
+    assertPrincipalId(principalId);
+    await executor.query("BEGIN");
+    try {
+        await executor.query("SELECT set_config($1, $2, true)", [
+            RLS_SETTINGS.Principal,
+            principalId,
+        ]);
+        const result = await run(executor);
+        await executor.query(options.commit ? "COMMIT" : "ROLLBACK");
+        return result;
+    }
+    catch (error) {
+        try {
+            await executor.query("ROLLBACK");
+        }
+        catch {
+            // preserve the original failure
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=rls-bootstrap.service.js.map

package/lib/esm/namespaces/rls/rls-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-bootstrap.service.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls-bootstrap.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,GACpB,0BAAuB;AAMxB,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,2BAAwB;AAEzE,MAAM,YAAY,GAChB,iEAAiE,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAgBD,SAAS,6BAA6B,CACpC,MAAc,EACd,OAAsC;IAEtC,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CACvB,GAAG,MAAM,+EAA+E,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAoB,SAAQ,kBAGxC;IACC;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG,IAAW;QAI7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAiC,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAI,IAAI,CAAC,CAAC,CAAoC,IAAI,EAAE,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,GAAG,IAAW;QACxB,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,YAAY,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAI,CACN,mCAAmC,UAAU,CAAC,MAAM,cAAc,CACnE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,6BAA6B,CAAC,GAAG,IAAW;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,CACd,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAC/D,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAE7B,CAAC;QACd,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,cAAc,CAAC;QACnB,IACE,OAAO,GAAG,EAAE,QAAQ,KAAK,SAAS;YAClC,OAAO,GAAG,EAAE,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,kFAAkF,QAAQ,IAAI;gBAC5F,4FAA4F;gBAC5F,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAC7B,8CAA8C,QAAQ,2CAA2C;gBAC/F,kGAAkG;gBAClG,kGAAkG;gBAClG,+FAA+F;gBAC/F,kBAAkB,CACrB,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;gBACL,GAAG,uBAAuB;gBAC1B,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;aACxC,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACjE,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/B,6BAA6B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,SAAS;YACtB,WAAW;SACZ,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAC9D,IAAI,CAAC,SAAS,CACf,CAAC;QACF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,MAAM;YACnB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAClB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACnE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,SAAS;YACtB,EAAE;SACH,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAW;QACnC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACrE,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACpC,+CAA+C,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,OAAO,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IAClC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAA0B,EAC1B,WAAmB,EACnB,GAA+C,EAC/C,UAAiC,EAAE;IAEnC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACtD,YAAY,CAAC,SAAS;YACtB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/lib/esm/namespaces/rls/rls.constants.js

@@ -0,0 +1,75 @@
+/**
+ * @module integrations/namespaces/rls/constants
+ * @summary Row-level-security constants for the namespace authorization schema.
+ * @description Canonical permission keys, session settings, default role keys, and
+ * the tables covered by the namespace RLS template.
+ */
+/**
+ * @description Permission keys consumed by the SQL RLS policies.
+ * @summary A namespace reader can only read, a writer can also create/update/delete
+ * non-administrative rows, and an admin can do everything in the namespace.
+ */
+export const RLS_PERMISSION_KEYS = {
+    Read: "namespace.read",
+    Write: "namespace.write",
+    Admin: "namespace.admin",
+};
+/**
+ * @description Session settings read by the RLS policies.
+ * @summary The application must set `app.principal_id` for every request-scoped
+ * database session or transaction before querying namespace tables.
+ */
+export const RLS_SETTINGS = {
+    Principal: "app.principal_id",
+    Tenant: "app.tenant_id",
+};
+/**
+ * @description Default role keys for the reader/writer/admin matrix.
+ * @summary Bootstrapping a tenant with these keys gives consumers a stable
+ * three-tier namespace role model without coupling them to custom role names.
+ */
+export const RLS_ROLE_KEYS = {
+    Reader: "namespace-reader",
+    Writer: "namespace-writer",
+    Admin: "namespace-admin",
+};
+/**
+ * @description Boot-time privilege probe for the RLS `SECURITY DEFINER` helper functions.
+ * @summary Reads the current role's `rolsuper` and `rolbypassrls` flags from
+ * `pg_roles`. `RlsBootstrapService.assertFunctionOwnerPrivileges()` executes
+ * this query before applying any RLS DDL and refuses to proceed unless the
+ * executor role is `SUPERUSER` or `BYPASSRLS`, because a `SECURITY DEFINER`
+ * owner that does not bypass RLS makes every policy evaluation recurse under
+ * `FORCE ROW LEVEL SECURITY`.
+ */
+export const RLS_FUNCTION_OWNER_QUERY = "SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user";
+/**
+ * @description Tables protected by the namespace RLS template.
+ * @summary Includes the authorization machinery, org profiles, protected
+ * resources, and the slice-1 credential/secret records.
+ */
+export const RLS_PROTECTED_TABLES = [
+    "tenants",
+    "org_units",
+    "org_unit_closure",
+    "users",
+    "groups",
+    "principals",
+    "tenant_memberships",
+    "org_unit_memberships",
+    "group_memberships",
+    "permissions",
+    "roles",
+    "role_permissions",
+    "role_assignments",
+    "inheritance_blocks",
+    "protected_resources",
+    "resource_grants",
+    "effective_permissions",
+    "storage_bindings",
+    "tenant_profiles",
+    "org_unit_profiles",
+    "credentials",
+    "secrets",
+];
+//# sourceMappingURL=rls.constants.js.map

package/lib/esm/namespaces/rls/rls.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.constants.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls.constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,iBAAiB;IACxB,KAAK,EAAE,iBAAiB;CAChB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,kBAAkB;IAC7B,MAAM,EAAE,eAAe;CACf,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;CAChB,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mGAAmG,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,oBAAoB;IACpB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,uBAAuB;IACvB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;IACb,SAAS;CACD,CAAC"}