@decohere/data-typeorm 0.0.1-dev.126 → 0.0.1-dev.5

package/commonjs/src/unit-of-work.js

@@ -1,49 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", {
-    value: true
-});
-Object.defineProperty(exports, "TypeOrmUnitOfWork", {
-    enumerable: true,
-    get: function() {
-        return TypeOrmUnitOfWork;
-    }
-});
-class TypeOrmUnitOfWork {
-    dataSource;
-    queryRunner;
-    constructor(dataSource){
-        this.dataSource = dataSource;
-        this.queryRunner = this.dataSource.createQueryRunner();
-    }
-    get entityManager() {
-        return this.queryRunner.manager;
-    }
-    getRepository(entity) {
-        return this.entityManager.getRepository(entity);
-    }
-    async beginTransaction() {
-        return this.queryRunner.startTransaction();
-    }
-    async commit() {
-        return this.queryRunner.commitTransaction();
-    }
-    /**
-	 * Hand the connection back to the pool, rolling back first if a transaction is still open
-	 * (e.g. the request failed before commit). Otherwise the next user of that pooled
-	 * connection would inherit the half-finished transaction.
-	 */ async [Symbol.asyncDispose]() {
-        if (this.queryRunner.isReleased) {
-            return;
-        }
-        try {
-            if (this.queryRunner.isTransactionActive) {
-                await this.queryRunner.rollbackTransaction();
-            }
-        } finally{
-            await this.queryRunner.release();
-        }
-    }
-    /** Prefer `await using` / async disposal; this starts the same cleanup without waiting. */ [Symbol.dispose]() {
-        void this[Symbol.asyncDispose]();
-    }
-}

package/es6/src/bootstrap-policy.js

@@ -1,55 +0,0 @@
-import { DataConfigurationError } from "@decohere/data";
-/** True when NODE_ENV says development. Only then may a data source declare `auth: trust`. */ export function isDevelopmentEnv(nodeEnv = process.env.NODE_ENV) {
-    const env = nodeEnv?.toLowerCase() ?? "";
-    return env === "development" || env === "dev";
-}
-function isTrusted(info) {
-    return info.auth === "trust";
-}
-function has(value) {
-    return typeof value === "string" && value.length > 0;
-}
-/**
- * Check how a data source signs in, in every environment. A server that needs no password is
- * declared with `auth: trust`, never inferred from a missing password: a password left out by
- * mistake would otherwise look like a trusted server and fail later, less clearly.
- */ export function assertDataSourceAuth(info, nodeEnv = process.env.NODE_ENV) {
-    const auth = info.auth ?? "password";
-    if (auth !== "password" && auth !== "trust") {
-        throw new DataConfigurationError(`Data source "${info.name}": auth must be "password" or "trust" (got ${JSON.stringify(auth)})`);
-    }
-    if (auth === "trust") {
-        if (!isDevelopmentEnv(nodeEnv)) {
-            throw new DataConfigurationError(`Data source "${info.name}" sets auth: trust, which is allowed only in development (NODE_ENV is ${JSON.stringify(nodeEnv ?? "")}). A server that trusts every connection belongs on a developer's machine.`);
-        }
-        return;
-    }
-    if (!has(info.password)) {
-        throw new DataConfigurationError(`Data source "${info.name}" has no password. Set password, or auth: trust for a local server that trusts every connection.`);
-    }
-}
-/**
- * Decide whether to bootstrap a data source (create its database, roles and schema).
- *
- * - `bootstrap: false` → never
- * - `bootstrap: true` → yes (requires adminUser, and adminPassword unless `auth: trust`)
- * - omitted → only in development, when those admin credentials are present
- */ export function shouldBootstrapDatabase(info, nodeEnv = process.env.NODE_ENV) {
-    if (info.bootstrap === false) {
-        return false;
-    }
-    const hasAdmin = has(info.adminUser) && (isTrusted(info) || has(info.adminPassword));
-    if (info.bootstrap === true) {
-        if (!hasAdmin) {
-            throw new DataConfigurationError(`Data source "${info.name}": bootstrap requires adminUser and adminPassword (adminPassword may be left out only with auth: trust)`);
-        }
-        return true;
-    }
-    return isDevelopmentEnv(nodeEnv) && hasAdmin;
-}
-/** A data source that will be bootstrapped must have every password the bootstrap needs. */ export function assertBootstrapCredentials(info) {
-    if (isTrusted(info)) return;
-    if (has(info.migrateUsername) && !has(info.migratePassword)) {
-        throw new DataConfigurationError(`Data source "${info.name}" has migrateUsername but no migratePassword. Set migratePassword, or auth: trust for a local server that trusts every connection.`);
-    }
-}

package/es6/src/bootstrap.js

@@ -1,139 +0,0 @@
-function _ts_add_disposable_resource(env, value, async) {
-    if (value !== null && value !== void 0) {
-        if (typeof value !== "object" && typeof value !== "function") throw new TypeError("Object expected.");
-        var dispose, inner;
-        if (async) {
-            if (!Symbol.asyncDispose) throw new TypeError("Symbol.asyncDispose is not defined.");
-            dispose = value[Symbol.asyncDispose];
-        }
-        if (dispose === void 0) {
-            if (!Symbol.dispose) throw new TypeError("Symbol.dispose is not defined.");
-            dispose = value[Symbol.dispose];
-            if (async) inner = dispose;
-        }
-        if (typeof dispose !== "function") throw new TypeError("Object not disposable.");
-        if (inner) dispose = function() {
-            try {
-                inner.call(this);
-            } catch (e) {
-                return Promise.reject(e);
-            }
-        };
-        env.stack.push({
-            value: value,
-            dispose: dispose,
-            async: async
-        });
-    } else if (async) {
-        env.stack.push({
-            async: true
-        });
-    }
-    return value;
-}
-function _ts_dispose_resources(env) {
-    var _SuppressedError = typeof SuppressedError === "function" ? SuppressedError : function(error, suppressed, message) {
-        var e = new Error(message);
-        return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
-    };
-    return (_ts_dispose_resources = function _ts_dispose_resources(env) {
-        function fail(e) {
-            env.error = env.hasError ? new _SuppressedError(e, env.error, "An error was suppressed during disposal.") : e;
-            env.hasError = true;
-        }
-        var r, s = 0;
-        function next() {
-            while(r = env.stack.pop()){
-                try {
-                    if (!r.async && s === 1) return s = 0, env.stack.push(r), Promise.resolve().then(next);
-                    if (r.dispose) {
-                        var result = r.dispose.call(r.value);
-                        if (r.async) return s |= 2, Promise.resolve(result).then(next, function(e) {
-                            fail(e);
-                            return next();
-                        });
-                    } else s |= 1;
-                } catch (e) {
-                    fail(e);
-                }
-            }
-            if (s === 1) return env.hasError ? Promise.reject(env.error) : Promise.resolve();
-            if (env.hasError) throw env.error;
-        }
-        return next();
-    })(env);
-}
-import { DataConfigurationError } from "@decohere/data";
-import { assertBootstrapCredentials, assertDataSourceAuth, shouldBootstrapDatabase } from "./bootstrap-policy.js";
-import { PostgresServerManager } from "./server-manager.js";
-/** What every data source on one server and database must agree on. */ const SHARED_FIELDS = [
-    "auth",
-    "adminUser",
-    "migrateUsername"
-];
-/**
- * Check every data source's auth, then create the databases, roles and schemas of those that
- * bootstrap. Data sources on the same server and database are bootstrapped once, one after the
- * other: in parallel they would race to create the same database and roles. Running it again
- * changes nothing.
- *
- * For runners and scripts that open their own `DataSource`; `withTypeOrm` calls it for you.
- */ export async function bootstrapDataSources(dataSources, options) {
-    const nodeEnv = options.nodeEnv ?? process.env.NODE_ENV;
-    for (const info of dataSources)assertDataSourceAuth(info, nodeEnv);
-    const toBootstrap = dataSources.filter((info)=>shouldBootstrapDatabase(info, nodeEnv));
-    for (const info of toBootstrap)assertBootstrapCredentials(info);
-    for (const group of byServerAndDatabase(toBootstrap)){
-        const env = {
-            stack: [],
-            error: void 0,
-            hasError: false
-        };
-        try {
-            const [first] = group;
-            const server = _ts_add_disposable_resource(env, new PostgresServerManager(options.applicationName, first), true);
-            await server.connect();
-            await server.initializeDatabase(first.database);
-            for (const info of group){
-                await server.provisionRoles({
-                    database: info.database,
-                    appUsername: info.username,
-                    appPassword: info.password,
-                    migrateUsername: info.migrateUsername,
-                    migratePassword: info.migratePassword,
-                    allowAppDdl: info.synchronize === true,
-                    schema: info.schema
-                });
-            }
-        } catch (e) {
-            env.error = e;
-            env.hasError = true;
-        } finally{
-            const result = _ts_dispose_resources(env);
-            if (result) await result;
-        }
-    }
-}
-function byServerAndDatabase(dataSources) {
-    const groups = new Map();
-    for (const info of dataSources){
-        const key = `${info.host}:${info.port}/${info.database}`;
-        const group = groups.get(key);
-        if (group == null) {
-            groups.set(key, [
-                info
-            ]);
-            continue;
-        }
-        const [first] = group;
-        for (const field of SHARED_FIELDS){
-            if (info[field] !== first[field]) {
-                throw new DataConfigurationError(`Data sources "${first.name}" and "${info.name}" share database ${key} but set different ${field} (${JSON.stringify(first[field])} and ${JSON.stringify(info[field])})`);
-            }
-        }
-        group.push(info);
-    }
-    return [
-        ...groups.values()
-    ];
-}

package/es6/src/data-source.factory.js

@@ -1,27 +0,0 @@
-import { DataSource } from "typeorm";
-import { ProviderMap } from "./dialect-map.js";
-/** Fields used only for bootstrap / privilege provisioning — not TypeORM connection options. */ function omitProvisionFields(options) {
-    const { adminUser: _adminUser, adminPassword: _adminPassword, migrateUsername: _migrateUsername, migratePassword: _migratePassword, bootstrap: _bootstrap, auth: _auth, seed: _seed, dialect: _dialect, name: _name, ...rest } = options;
-    return rest;
-}
-/**
- * A DataSource the container can close: TypeORM's has `destroy()` but no `Symbol.asyncDispose`,
- * so disposing the app's container used to leave its connections open.
- */ export class ManagedDataSource extends DataSource {
-    async [Symbol.asyncDispose]() {
-        if (this.isInitialized) await this.destroy();
-    }
-}
-export class DataSourceFactory {
-    static create(options, logger) {
-        const { applicationName } = options;
-        const { provider } = options;
-        const type = ProviderMap[provider];
-        return new ManagedDataSource({
-            type,
-            logger,
-            applicationName,
-            ...omitProvisionFields(options)
-        });
-    }
-}

package/es6/src/database-options.js

@@ -1 +0,0 @@
-export { };

package/es6/src/dialect-map.js

@@ -1,8 +0,0 @@
-export const ProviderMap = {
-    postgres: "postgres",
-    mssql: "mssql"
-};
-export const DialectMap = {
-    postgresql: "postgres",
-    tsql: "mssql"
-};

package/es6/src/scripts/user.js

@@ -1,209 +0,0 @@
-/** Postgres identifier: letters, digits, underscore; must start with letter or underscore. */ const SAFE_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/;
-export function assertSafeSqlIdent(value, label) {
-    if (typeof value !== "string" || value.length === 0 || !SAFE_IDENT.test(value)) {
-        throw new Error(`Invalid ${label}: must match ${SAFE_IDENT} (got ${JSON.stringify(value)})`);
-    }
-    return value;
-}
-/** Double-quote a validated identifier for use in DDL. */ export function quoteIdent(value, label = "identifier") {
-    const safe = assertSafeSqlIdent(value, label);
-    return `"${safe.replaceAll('"', '""')}"`;
-}
-/**
- * Single-quote a string literal for DDL that cannot take bind parameters
- * (e.g. CREATE USER … PASSWORD — Postgres rejects PASSWORD $1).
- */ export function quoteLiteral(value) {
-    return `'${value.replaceAll("'", "''")}'`;
-}
-/** Existence check — username bound as $1 (never concatenated). */ export function roleExistsQuery(username) {
-    assertSafeSqlIdent(username, "username");
-    return {
-        text: `SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = $1`,
-        values: [
-            username
-        ]
-    };
-}
-/**
- * CREATE USER with password as an escaped SQL literal.
- * Username is validated + quoted as an identifier (cannot be parameterized in DDL).
- * Password cannot use bind params in CREATE USER … PASSWORD (Postgres syntax error).
- *
- * `password` omitted (undefined) creates a role with no password, for a local dev server that
- * trusts every connection. An empty string is still an error: that is a typo, not a choice.
- * Callers decide when no password is allowed (see PostgresServerManager).
- */ export function createUserQuery(username, password) {
-    const userIdent = quoteIdent(username, "username");
-    const attributes = "NOSUPERUSER NOBYPASSRLS NOCREATEDB NOCREATEROLE";
-    if (password === undefined) {
-        return {
-            text: `CREATE USER ${userIdent} WITH LOGIN ${attributes}`,
-            values: []
-        };
-    }
-    if (typeof password !== "string" || password.length === 0) {
-        throw new Error("Invalid password: must be a non-empty string");
-    }
-    const passwordLiteral = quoteLiteral(password);
-    return {
-        text: `CREATE USER ${userIdent} WITH LOGIN PASSWORD ${passwordLiteral} ${attributes}`,
-        values: []
-    };
-}
-/** CONNECT only — production runtime app role. */ export function grantConnectQuery(username, database) {
-    const userIdent = quoteIdent(username, "username");
-    const dbIdent = quoteIdent(database, "database");
-    return {
-        text: `GRANT CONNECT ON DATABASE ${dbIdent} TO ${userIdent}`,
-        values: []
-    };
-}
-export function grantSchemaUsageQuery(username, schema = "public") {
-    const userIdent = quoteIdent(username, "username");
-    const schemaIdent = quoteIdent(schema, "schema");
-    return {
-        text: `GRANT USAGE ON SCHEMA ${schemaIdent} TO ${userIdent}`,
-        values: []
-    };
-}
-/** Needed for TypeORM synchronize (dev only). */ export function grantSchemaCreateQuery(username, schema = "public") {
-    const userIdent = quoteIdent(username, "username");
-    const schemaIdent = quoteIdent(schema, "schema");
-    return {
-        text: `GRANT CREATE ON SCHEMA ${schemaIdent} TO ${userIdent}`,
-        values: []
-    };
-}
-/** The schema, owned by `owner`. Unchanged when it already exists. */ export function createSchemaQuery(schema, owner) {
-    const schemaIdent = quoteIdent(schema, "schema");
-    const ownerIdent = quoteIdent(owner, "owner");
-    return {
-        text: `CREATE SCHEMA IF NOT EXISTS ${schemaIdent} AUTHORIZATION ${ownerIdent}`,
-        values: []
-    };
-}
-/**
- * Whether a role already holds a privilege. Postgres checks that the grantor may grant even when
- * the grant would change nothing, so bootstrap asks first and grants only what is missing.
- */ export function hasDatabasePrivilegeQuery(username, database, privilege) {
-    assertSafeSqlIdent(username, "username");
-    assertSafeSqlIdent(database, "database");
-    return {
-        text: `SELECT has_database_privilege($1, $2, $3) AS granted`,
-        values: [
-            username,
-            database,
-            privilege
-        ]
-    };
-}
-export function hasSchemaPrivilegeQuery(username, schema, privilege) {
-    assertSafeSqlIdent(username, "username");
-    assertSafeSqlIdent(schema, "schema");
-    return {
-        text: `SELECT has_schema_privilege($1, $2, $3) AS granted`,
-        values: [
-            username,
-            schema,
-            privilege
-        ]
-    };
-}
-/** Whether `member` already has the privileges of `role` (inherited, or as a superuser). */ export function hasRolePrivilegesQuery(member, role) {
-    assertSafeSqlIdent(member, "member");
-    assertSafeSqlIdent(role, "role");
-    return {
-        text: `SELECT pg_has_role($1, $2, 'USAGE') AS granted`,
-        values: [
-            member,
-            role
-        ]
-    };
-}
-export function databaseOwnerQuery(database) {
-    assertSafeSqlIdent(database, "database");
-    return {
-        text: `SELECT pg_get_userbyid(datdba) AS owner FROM pg_catalog.pg_database WHERE datname = $1`,
-        values: [
-            database
-        ]
-    };
-}
-export function grantSchemaPrivilegesQuery(username, schema = "public") {
-    const userIdent = quoteIdent(username, "username");
-    const schemaIdent = quoteIdent(schema, "schema");
-    return {
-        text: `GRANT ALL ON SCHEMA ${schemaIdent} TO ${userIdent}`,
-        values: []
-    };
-}
-export function alterDatabaseOwnerQuery(database, username) {
-    const dbIdent = quoteIdent(database, "database");
-    const userIdent = quoteIdent(username, "username");
-    return {
-        text: `ALTER DATABASE ${dbIdent} OWNER TO ${userIdent}`,
-        values: []
-    };
-}
-/**
- * Postgres requires the session user to be a member of the target role to
- * `ALTER DATABASE … OWNER TO` / `ALTER DEFAULT PRIVILEGES FOR ROLE`.
- */ export function grantRoleMembershipQuery(member, role) {
-    const memberIdent = quoteIdent(member, "member");
-    const roleIdent = quoteIdent(role, "role");
-    return {
-        text: `GRANT ${roleIdent} TO ${memberIdent}`,
-        values: []
-    };
-}
-export function revokeRoleMembershipQuery(member, role) {
-    const memberIdent = quoteIdent(member, "member");
-    const roleIdent = quoteIdent(role, "role");
-    return {
-        text: `REVOKE ${roleIdent} FROM ${memberIdent}`,
-        values: []
-    };
-}
-/**
- * Future tables/sequences created by the migration role are usable by the app role (DML only).
- */ export function defaultPrivilegesForAppQueries(migrateUsername, appUsername, schema = "public") {
-    const migrateIdent = quoteIdent(migrateUsername, "migrateUsername");
-    const appIdent = quoteIdent(appUsername, "username");
-    const schemaIdent = quoteIdent(schema, "schema");
-    return [
-        {
-            text: `ALTER DEFAULT PRIVILEGES FOR ROLE ${migrateIdent} IN SCHEMA ${schemaIdent} GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO ${appIdent}`,
-            values: []
-        },
-        {
-            text: `ALTER DEFAULT PRIVILEGES FOR ROLE ${migrateIdent} IN SCHEMA ${schemaIdent} GRANT USAGE, SELECT ON SEQUENCES TO ${appIdent}`,
-            values: []
-        }
-    ];
-}
-/**
- * @deprecated Prefer discrete query helpers + PostgresServerManager.provisionRoles.
- * Kept for call-site / pen-test migration: emits create + CONNECT + USAGE (not ALL PRIVILEGES).
- */ const createOwnerUser = (username, password, database)=>{
-    quoteIdent(username, "username");
-    quoteIdent(database, "database");
-    if (typeof password !== "string" || password.length === 0) {
-        throw new Error("Invalid password: must be a non-empty string");
-    }
-    const create = createUserQuery(username, password);
-    const connect = grantConnectQuery(username, database);
-    const usage = grantSchemaUsageQuery(username);
-    return {
-        text: [
-            create.text,
-            connect.text,
-            usage.text
-        ].join(";\n"),
-        values: []
-    };
-};
-const userExists = (username)=>roleExistsQuery(username);
-export const userScripts = {
-    createOwnerUser,
-    userExists
-};