@decaf-ts/integrations 0.11.0 → 0.14.0

package/lib/esm/namespaces/rls/rls-bootstrap.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-bootstrap.service.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls-bootstrap.service.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,GACpB,0BAAuB;AAMxB,OAAO,EAAE,wBAAwB,EAAE,YAAY,EAAE,2BAAwB;AAEzE,MAAM,YAAY,GAChB,iEAAiE,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,qBAAsB,SAAQ,aAAa;IACtD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAgBD,SAAS,6BAA6B,CACpC,MAAc,EACd,OAAsC;IAEtC,IAAI,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CACvB,GAAG,MAAM,+EAA+E,CACzF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,IAAI,CAAC,WAAW,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,eAAe,CAAC,0BAA0B,CAAC,CAAC;IACxD,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,mBAAoB,SAAQ,kBAGxC;IACC;QACE,KAAK,EAAE,CAAC;IACV,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAG,IAAW;QAI7B,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAiC,CAAC;QACvD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YAClD,MAAM,IAAI,eAAe,CACvB,qEAAqE,CACtE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAI,IAAI,CAAC,CAAC,CAAoC,IAAI,EAAE,CAAC;QACjE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,KAAK,CAAC,GAAG,IAAW;QACxB,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QACrC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,aAAa,CAAC,4BAA4B,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,CAAC,6BAA6B,CAAC,GAAG,IAAI,CAAC,CAAC;QAClD,GAAG,CAAC,OAAO,CAAC,YAAY,UAAU,CAAC,MAAM,iBAAiB,CAAC,CAAC;QAC5D,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;YACnC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC;QACD,GAAG,CAAC,IAAI,CACN,mCAAmC,UAAU,CAAC,MAAM,cAAc,CACnE,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;IACxC,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,6BAA6B,CAAC,GAAG,IAAW;QAChD,MAAM,EAAE,GAAG,EAAE,GAAG,CACd,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,+BAA+B,EAAE,IAAI,CAAC,CAC/D,CAAC,GAAG,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAE7B,CAAC;QACd,MAAM,QAAQ,GAAG,GAAG,EAAE,OAAO;YAC3B,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC;YAC7B,CAAC,CAAC,cAAc,CAAC;QACnB,IACE,OAAO,GAAG,EAAE,QAAQ,KAAK,SAAS;YAClC,OAAO,GAAG,EAAE,YAAY,KAAK,SAAS,EACtC,CAAC;YACD,MAAM,IAAI,qBAAqB,CAC7B,kFAAkF,QAAQ,IAAI;gBAC5F,4FAA4F;gBAC5F,mEAAmE,CACtE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC;YACvC,MAAM,IAAI,qBAAqB,CAC7B,8CAA8C,QAAQ,2CAA2C;gBAC/F,kGAAkG;gBAClG,kGAAkG;gBAClG,+FAA+F;gBAC/F,kBAAkB,CACrB,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,OAAO,CAAC,8CAA8C,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,UAAU;QACR,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QAClC,IAAI,MAAM,CAAC,UAAU;YAAE,OAAO,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QACrD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO;gBACL,GAAG,uBAAuB;gBAC1B,GAAG,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC;aACxC,CAAC;QACJ,CAAC;QACD,OAAO,sBAAsB,EAAE,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,YAAY,CAChB,WAAmB,EACnB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACjE,IAAI,CAAC,YAAY,CAClB,CAAC;QACF,iBAAiB,CAAC,WAAW,CAAC,CAAC;QAC/B,6BAA6B,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,SAAS;YACtB,WAAW;SACZ,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC;IACzD,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,KAAK,CAAC,SAAS,CACb,QAAgB,EAChB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAC9D,IAAI,CAAC,SAAS,CACf,CAAC;QACF,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC5B,6BAA6B,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACpD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,MAAM;YACnB,QAAQ;SACT,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,cAAc,CAClB,UAA6B,EAAE,EAC/B,GAAG,IAAW;QAEd,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACnE,IAAI,CAAC,cAAc,CACpB,CAAC;QACF,6BAA6B,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACzD,YAAY,CAAC,SAAS;YACtB,EAAE;SACH,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC;IAC3D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB,CAAC,GAAG,IAAW;QACnC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CACrE,IAAI,CAAC,gBAAgB,CACtB,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CACpC,+CAA+C,CAChD,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAqC,CAAC;QACzE,OAAO,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC;IAClC,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAA0B,EAC1B,WAAmB,EACnB,GAA+C,EAC/C,UAAiC,EAAE;IAEnC,iBAAiB,CAAC,WAAW,CAAC,CAAC;IAC/B,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,KAAK,CAAC,iCAAiC,EAAE;YACtD,YAAY,CAAC,SAAS;YACtB,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7D,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/lib/esm/namespaces/rls/rls.constants.js

@@ -0,0 +1,75 @@
+/**
+ * @module integrations/namespaces/rls/constants
+ * @summary Row-level-security constants for the namespace authorization schema.
+ * @description Canonical permission keys, session settings, default role keys, and
+ * the tables covered by the namespace RLS template.
+ */
+/**
+ * @description Permission keys consumed by the SQL RLS policies.
+ * @summary A namespace reader can only read, a writer can also create/update/delete
+ * non-administrative rows, and an admin can do everything in the namespace.
+ */
+export const RLS_PERMISSION_KEYS = {
+    Read: "namespace.read",
+    Write: "namespace.write",
+    Admin: "namespace.admin",
+};
+/**
+ * @description Session settings read by the RLS policies.
+ * @summary The application must set `app.principal_id` for every request-scoped
+ * database session or transaction before querying namespace tables.
+ */
+export const RLS_SETTINGS = {
+    Principal: "app.principal_id",
+    Tenant: "app.tenant_id",
+};
+/**
+ * @description Default role keys for the reader/writer/admin matrix.
+ * @summary Bootstrapping a tenant with these keys gives consumers a stable
+ * three-tier namespace role model without coupling them to custom role names.
+ */
+export const RLS_ROLE_KEYS = {
+    Reader: "namespace-reader",
+    Writer: "namespace-writer",
+    Admin: "namespace-admin",
+};
+/**
+ * @description Boot-time privilege probe for the RLS `SECURITY DEFINER` helper functions.
+ * @summary Reads the current role's `rolsuper` and `rolbypassrls` flags from
+ * `pg_roles`. `RlsBootstrapService.assertFunctionOwnerPrivileges()` executes
+ * this query before applying any RLS DDL and refuses to proceed unless the
+ * executor role is `SUPERUSER` or `BYPASSRLS`, because a `SECURITY DEFINER`
+ * owner that does not bypass RLS makes every policy evaluation recurse under
+ * `FORCE ROW LEVEL SECURITY`.
+ */
+export const RLS_FUNCTION_OWNER_QUERY = "SELECT current_user AS rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname = current_user";
+/**
+ * @description Tables protected by the namespace RLS template.
+ * @summary Includes the authorization machinery, org profiles, protected
+ * resources, and the slice-1 credential/secret records.
+ */
+export const RLS_PROTECTED_TABLES = [
+    "tenants",
+    "org_units",
+    "org_unit_closure",
+    "users",
+    "groups",
+    "principals",
+    "tenant_memberships",
+    "org_unit_memberships",
+    "group_memberships",
+    "permissions",
+    "roles",
+    "role_permissions",
+    "role_assignments",
+    "inheritance_blocks",
+    "protected_resources",
+    "resource_grants",
+    "effective_permissions",
+    "storage_bindings",
+    "tenant_profiles",
+    "org_unit_profiles",
+    "credentials",
+    "secrets",
+];
+//# sourceMappingURL=rls.constants.js.map

package/lib/esm/namespaces/rls/rls.constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls.constants.js","sourceRoot":"","sources":["../../../../src/namespaces/rls/rls.constants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,IAAI,EAAE,gBAAgB;IACtB,KAAK,EAAE,iBAAiB;IACxB,KAAK,EAAE,iBAAiB;CAChB,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,SAAS,EAAE,kBAAkB;IAC7B,MAAM,EAAE,eAAe;CACf,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,kBAAkB;IAC1B,KAAK,EAAE,iBAAiB;CAChB,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GACnC,mGAAmG,CAAC;AAEtG;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS;IACT,WAAW;IACX,kBAAkB;IAClB,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,oBAAoB;IACpB,sBAAsB;IACtB,mBAAmB;IACnB,aAAa;IACb,OAAO;IACP,kBAAkB;IAClB,kBAAkB;IAClB,oBAAoB;IACpB,qBAAqB;IACrB,iBAAiB;IACjB,uBAAuB;IACvB,kBAAkB;IAClB,iBAAiB;IACjB,mBAAmB;IACnB,aAAa;IACb,SAAS;CACD,CAAC"}