@everystack/cli 0.2.39 → 0.3.3

package/src/cli/schema-source.ts

@@ -0,0 +1,416 @@
+/**
+ * `compileDrizzleSource` — the typed-runtime-table slice of the one generator.
+ *
+ * The sibling of `compileTableSchema` (SQL DDL) and `compileTableContract` (RLS):
+ * those compile a {@link ModelDescriptor} to a migration target; this compiles it
+ * to drizzle-orm TypeScript SOURCE TEXT. The emitted `schema.generated.ts`, when
+ * imported, yields the SAME runtime table `toDrizzleTable(model)` builds — but as
+ * literal, fully-typed declarations, so the SSR loaders keep their precise column
+ * types (`toDrizzleTable`'s loop-built table infers `<any>`; literal source does
+ * not). One hand-authored source (`models/*.ts`), the drizzle schema a generated,
+ * drift-guarded artifact.
+ *
+ * The column mapping mirrors `toDrizzleTable` exactly, expressed as text. The two
+ * documented divergences from a hand-written schema (see docs/plans/model-drizzle-codegen.md):
+ *
+ *  - Cross-schema FKs (e.g. `profiles.id → auth.users.id`) are OMITTED — the model
+ *    can't express a reference to a non-Model table, so neither can the emitter.
+ *  - `relationName` strings are synthesized deterministically (the `Relation` type
+ *    carries no name); only the pairing of a belongsTo with its inverse hasMany
+ *    matters, which the synthesis guarantees.
+ *
+ * Pure and deterministic: imports sorted, declarations in model order, relation
+ * keys in declared order — re-running on the same models is byte-identical.
+ *
+ * Input is a `@everystack/model` ModelDescriptor (type-only — no runtime dep).
+ */
+
+import type { ModelDescriptor, FieldSpec } from '@everystack/model';
+
+/** `author_id` is the SQL identifier; `authorId` the field key. The single snake-case rule. */
+function toSnakeCase(name: string): string {
+  return name.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+}
+
+/** `image_variants` → `imageVariants` (a snake table name to its camelCase drizzle export var). */
+function toCamelCase(name: string): string {
+  return name.replace(/_([a-z0-9])/g, (_, c: string) => c.toUpperCase());
+}
+
+/** A JS/TS string literal — single-quoted, the example's style. */
+function strLiteral(value: string): string {
+  return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "\\'")}'`;
+}
+
+/** A `.default(<v>)` argument literal for a value default (the JSON forms drizzle accepts). */
+function defaultValueLiteral(value: unknown): string {
+  if (typeof value === 'string') return strLiteral(value);
+  if (typeof value === 'boolean') return value ? 'true' : 'false';
+  if (value === null) return 'null';
+  if (typeof value === 'number') return String(value);
+  // Arrays / objects: a JSON literal is valid TS for jsonb defaults.
+  return JSON.stringify(value);
+}
+
+/**
+ * The drizzle pg-core column builder *call* for a field — `text('bio')`,
+ * `timestamp('created_at', { withTimezone: true })`, `uuid('id')` — exactly the
+ * type + args `toDrizzleTable`'s `baseColumn` produces, as source text. Returns
+ * the call and the builder name it used (so the import set can be collected).
+ */
+function baseColumnSource(columnName: string, spec: FieldSpec): { call: string; builder: string } {
+  const n = strLiteral(columnName);
+  switch (spec.type) {
+    case 'text':
+      return { call: `text(${n})`, builder: 'text' };
+    case 'uuid':
+      return { call: `uuid(${n})`, builder: 'uuid' };
+    case 'integer':
+      return { call: `integer(${n})`, builder: 'integer' };
+    case 'bigint':
+      return { call: `bigint(${n}, { mode: 'number' })`, builder: 'bigint' };
+    case 'bigserial':
+      return { call: `bigserial(${n}, { mode: 'number' })`, builder: 'bigserial' };
+    case 'boolean':
+      return { call: `boolean(${n})`, builder: 'boolean' };
+    case 'timestamptz':
+      return { call: `timestamp(${n}, { withTimezone: true })`, builder: 'timestamp' };
+    case 'timestamp':
+      return { call: `timestamp(${n})`, builder: 'timestamp' };
+    case 'date':
+      return { call: `date(${n})`, builder: 'date' };
+    case 'numeric':
+      return spec.precision !== undefined
+        ? { call: `numeric(${n}, { precision: ${spec.precision}, scale: ${spec.scale} })`, builder: 'numeric' }
+        : { call: `numeric(${n})`, builder: 'numeric' };
+    case 'varchar':
+      return spec.length !== undefined
+        ? { call: `varchar(${n}, { length: ${spec.length} })`, builder: 'varchar' }
+        : { call: `varchar(${n})`, builder: 'varchar' };
+    case 'jsonb':
+      return { call: `jsonb(${n})`, builder: 'jsonb' };
+    case 'enum': {
+      if (!spec.enumName) throw new Error('enum field is missing enumName');
+      return { call: `${enumConstName(spec.enumName)}(${n})`, builder: enumConstName(spec.enumName) };
+    }
+    default: {
+      const exhaustive: never = spec.type;
+      throw new Error(`Unsupported field type: ${String(exhaustive)}`);
+    }
+  }
+}
+
+/** The hoisted const name for an enum type. `status` → `statusEnum`. */
+function enumConstName(enumName: string): string {
+  return `${toCamelCase(enumName)}Enum`;
+}
+
+/** The single primary-key field key for a model (FK targets reference its column). */
+function primaryKeyKey(model: ModelDescriptor): string {
+  const pk = model.primaryKey[0];
+  if (!pk) throw new Error(`Referenced model "${model.table}" has no primary key`);
+  return pk;
+}
+
+/** A model's `field key → snake column name` map (for relation `fields:`/`references:` text). */
+function columnKeys(model: ModelDescriptor): Map<string, string> {
+  const m = new Map<string, string>();
+  for (const key of Object.keys(model.fields)) m.set(key, toSnakeCase(key));
+  return m;
+}
+
+/**
+ * The modifier chain for a column, in `toDrizzleTable` order: notNull, unique,
+ * default, primaryKey (single-PK only), references. Cross-schema references are
+ * impossible to model, so only in-set targets are emitted. `usedBuilders` collects
+ * the table-extra/import builders the references clause needs (none today).
+ */
+function columnModifiers(
+  spec: FieldSpec,
+  isComposite: boolean,
+  modelsByDescriptor: Map<ModelDescriptor, { camel: string }>,
+): string {
+  let s = '';
+  if (spec.isArray) s += '.array()';
+  if (spec.isNotNull) s += '.notNull()';
+  if (spec.isUnique) s += '.unique()';
+
+  if (spec.defaultKind === 'now') s += '.defaultNow()';
+  else if (spec.defaultKind === 'random') s += '.defaultRandom()';
+  else if (spec.defaultKind === 'value') s += `.default(${defaultValueLiteral(spec.default)})`;
+
+  if (spec.isPrimaryKey && !isComposite) s += '.primaryKey()';
+
+  if (spec.references) {
+    const target = (spec.references as () => ModelDescriptor)();
+    const entry = modelsByDescriptor.get(target);
+    if (entry) {
+      const parentPk = primaryKeyKey(target);
+      const opts: string[] = [];
+      if (spec.onDelete) opts.push(`onDelete: ${strLiteral(spec.onDelete)}`);
+      if (spec.onUpdate) opts.push(`onUpdate: ${strLiteral(spec.onUpdate)}`);
+      const optsText = opts.length ? `, { ${opts.join(', ')} }` : '';
+      s += `.references(() => ${entry.camel}.${parentPk}${optsText})`;
+    }
+    // A reference to a model OUTSIDE the emitted set (a cross-schema FK) is omitted —
+    // the runtime + relations never needed it; the DB constraint stays unmanaged.
+  }
+
+  return s;
+}
+
+/** An unordered table-pair key, so `(follows, profiles)` and `(profiles, follows)` collide. */
+function pairKey(a: string, b: string): string {
+  return a < b ? `${a}\x00${b}` : `${b}\x00${a}`;
+}
+
+/**
+ * A relation that needs a `relationName` carries one keyed by `(childTable,
+ * fkColumnKey)` — the same string on the belongsTo (child) and the inverse hasMany
+ * (parent), so drizzle pairs them. Derived from the model's OWN relation graph:
+ * a belongsTo names `(thisTable, column)`; a hasMany names `(targetTable, column)`
+ * — both resolve to the child table holding the FK and the FK column key, so the
+ * two sides agree without coordination.
+ */
+interface RelationNaming {
+  /** All synthesized names, keyed by `(childTable, fkColumnKey)`. */
+  needsName: Set<string>;
+}
+
+function relationPairId(childTable: string, fkColumnKey: string): string {
+  return `${childTable}\x00${fkColumnKey}`;
+}
+
+function synthesizedName(childTable: string, fkColumnKey: string): string {
+  return `${childTable}_${toSnakeCase(fkColumnKey)}`;
+}
+
+/**
+ * Decide which relations need a `relationName`: only pairs of tables connected by
+ * MORE than one relation. Counts every relation (both sides) per unordered table
+ * pair; a pair counted more than once flags every relation between those two tables.
+ */
+function planRelationNames(models: ModelDescriptor[]): RelationNaming {
+  // Ambiguity is per DISTINCT FK column connecting a table pair — NOT per relation
+  // declaration. profiles<->posts is one FK (author_id) declared from both sides
+  // (belongsTo + its inverse hasMany): drizzle pairs them by table, no name needed.
+  // profiles<->follows is TWO FKs (follower_id, following_id): drizzle cannot tell
+  // which hasMany pairs which belongsTo, so every relation on that pair needs a name.
+  //
+  // Each relation resolves to a (childTable, fkColumnKey) — the child table holds the
+  // FK column. Count distinct such pairs per unordered table pair.
+  const fkColumnsByPair = new Map<string, Set<string>>();
+  for (const model of models) {
+    for (const rel of Object.values(model.relations)) {
+      const other = rel.target().table;
+      const childTable = rel.kind === 'belongsTo' ? model.table : other;
+      const k = pairKey(model.table, other);
+      let set = fkColumnsByPair.get(k);
+      if (!set) {
+        set = new Set<string>();
+        fkColumnsByPair.set(k, set);
+      }
+      set.add(relationPairId(childTable, rel.column));
+    }
+  }
+
+  const needsName = new Set<string>();
+  for (const model of models) {
+    for (const rel of Object.values(model.relations)) {
+      const other = rel.target().table;
+      const k = pairKey(model.table, other);
+      // Ambiguous when more than one distinct FK column connects the two tables.
+      if ((fkColumnsByPair.get(k)?.size ?? 0) <= 1) continue;
+      const childTable = rel.kind === 'belongsTo' ? model.table : other;
+      needsName.add(relationPairId(childTable, rel.column));
+    }
+  }
+  return { needsName };
+}
+
+/** The `relationName: '…'` fragment for a relation, or '' when the pair is unambiguous. */
+function relationNameFragment(
+  model: ModelDescriptor,
+  rel: { kind: 'belongsTo' | 'hasMany'; column: string; target: () => ModelDescriptor },
+  naming: RelationNaming,
+): string {
+  const other = rel.target().table;
+  const childTable = rel.kind === 'belongsTo' ? model.table : other;
+  const id = relationPairId(childTable, rel.column);
+  if (!naming.needsName.has(id)) return '';
+  return `, relationName: ${strLiteral(synthesizedName(childTable, rel.column))}`;
+}
+
+export interface CompileDrizzleSourceOptions {
+  /** Reserved for parity with the DDL compiler's `schema` option. Unused in the emit. */
+  schema?: string;
+}
+
+/**
+ * Emit the full text of a `schema.generated.ts` from a set of Models: hoisted
+ * `pgEnum`s, one `pgTable` per model (columns + table-extras), then a
+ * `relations()` block per model that declares any. The output is what an app's
+ * hand-written `db/schema.ts` is replaced by — fully-typed, derived, drift-guarded.
+ */
+export function compileDrizzleSource(allModels: ModelDescriptor[], _opts: CompileDrizzleSourceOptions = {}): string {
+  // A private model is package-owned — its drizzle runtime table ships with the
+  // package (e.g. @everystack/storage/schema), so it never appears in the app's
+  // generated schema. (The migration generator still emits its SQL + authz.) The
+  // command and the drift guard both call this, so filtering here keeps them in sync.
+  const models = allModels.filter((m) => !m.private);
+
+  const modelsByDescriptor = new Map<ModelDescriptor, { camel: string }>();
+  for (const model of models) modelsByDescriptor.set(model, { camel: toCamelCase(model.table) });
+
+  // --- Collect enums (deduped by name, sorted) -----------------------------
+  const enumsByName = new Map<string, readonly string[]>();
+  for (const model of models) {
+    for (const f of Object.values(model.fields)) {
+      const { type, enumName, enumValues } = f.spec;
+      if (type !== 'enum' || !enumName) continue;
+      const values = enumValues ?? [];
+      const existing = enumsByName.get(enumName);
+      if (existing && existing.join(',') !== values.join(',')) {
+        throw new Error(`enum '${enumName}' is declared with conflicting values: [${existing}] vs [${values}]`);
+      }
+      if (!existing) enumsByName.set(enumName, values);
+    }
+  }
+  const enumNames = [...enumsByName.keys()].sort((a, b) => a.localeCompare(b));
+
+  // --- Track which pg-core builders + drizzle-orm symbols are used ----------
+  const pgCoreBuilders = new Set<string>();
+  pgCoreBuilders.add('pgTable');
+  if (enumNames.length) pgCoreBuilders.add('pgEnum');
+
+  const relationNaming = planRelationNames(models);
+  const anyRelations = models.some((m) => Object.keys(m.relations).length > 0);
+
+  // --- Emit each table -------------------------------------------------------
+  const tableBlocks: string[] = [];
+  for (const model of models) {
+    const camel = toCamelCase(model.table);
+    const isComposite = model.primaryKey.length > 1;
+
+    const colLines: string[] = [];
+    for (const [key, builder] of Object.entries(model.fields)) {
+      const spec = builder.spec;
+      const { call, builder: pgBuilder } = baseColumnSource(toSnakeCase(key), spec);
+      pgCoreBuilders.add(pgBuilder);
+      const mods = columnModifiers(spec, isComposite, modelsByDescriptor);
+      colLines.push(`  ${key}: ${call}${mods},`);
+    }
+
+    // Table-extras: composite PK, then table-level unique/check constraints.
+    const extras: string[] = [];
+    if (isComposite) {
+      pgCoreBuilders.add('primaryKey');
+      const cols = model.primaryKey.map((k) => `t.${k}`).join(', ');
+      extras.push(`  primaryKey({ columns: [${cols}] }),`);
+    }
+    for (const con of model.constraints) {
+      if (con.kind === 'unique') {
+        pgCoreBuilders.add('unique');
+        const cols = con.columns.map((k) => `t.${k}`).join(', ');
+        extras.push(`  unique().on(${cols}),`);
+      } else if (con.kind === 'check') {
+        pgCoreBuilders.add('check');
+        pgCoreBuilders.add('sql'); // imported from 'drizzle-orm', handled below
+        extras.push(`  check(${strLiteral(`${model.table}_check`)}, sql.raw(${strLiteral(con.predicate)})),`);
+      }
+      // 'index' / 'foreignKey' table constraints are not materialized on the runtime
+      // drizzle table object (mirrors toDrizzleTable), so they are omitted here.
+    }
+
+    const cols = `{\n${colLines.join('\n')}\n}`;
+    let block: string;
+    if (extras.length) {
+      block = `export const ${camel} = pgTable(${strLiteral(model.table)}, ${cols}, (t) => [\n${extras.join('\n')}\n]);`;
+    } else {
+      block = `export const ${camel} = pgTable(${strLiteral(model.table)}, ${cols});`;
+    }
+    tableBlocks.push(block);
+  }
+
+  // --- Emit relations() blocks ----------------------------------------------
+  const relationBlocks: string[] = [];
+  for (const model of models) {
+    const relEntries = Object.entries(model.relations);
+    if (relEntries.length === 0) continue;
+    const camel = toCamelCase(model.table);
+
+    const usesOne = relEntries.some(([, r]) => r.kind === 'belongsTo');
+    const usesMany = relEntries.some(([, r]) => r.kind === 'hasMany');
+    const helpers = [usesOne ? 'one' : null, usesMany ? 'many' : null].filter(Boolean).join(', ');
+
+    const lines: string[] = [];
+    for (const [key, rel] of relEntries) {
+      const target = rel.target();
+      const targetCamel = toCamelCase(target.table);
+      const nameFrag = relationNameFragment(model, rel, relationNaming);
+      if (rel.kind === 'belongsTo') {
+        // belongsTo(() => Target, column, references?) -> one(...)
+        const thisCol = rel.column; // FK FIELD KEY on this model
+        const targetPk = rel.references ?? primaryKeyKey(target);
+        lines.push(
+          `  ${key}: one(${targetCamel}, { fields: [${camel}.${thisCol}], references: [${targetCamel}.${targetPk}]${nameFrag} }),`,
+        );
+      } else {
+        // hasMany(() => Target, column, references?) -> many(...)
+        if (nameFrag) {
+          lines.push(`  ${key}: many(${targetCamel}, {${nameFrag.replace(/^, /, ' ')} }),`);
+        } else {
+          lines.push(`  ${key}: many(${targetCamel}),`);
+        }
+      }
+    }
+
+    relationBlocks.push(
+      `export const ${camel}Relations = relations(${camel}, ({ ${helpers} }) => ({\n${lines.join('\n')}\n}));`,
+    );
+  }
+
+  // --- Header ----------------------------------------------------------------
+  const header = [
+    '// GENERATED by `everystack db:generate` from models/. Do not edit.',
+    '//',
+    '// Cross-schema foreign keys (e.g. profiles.id -> auth.users.id) are intentionally',
+    '// omitted: a Model cannot reference a table outside the model set, so the runtime',
+    '// table and its relations() never carry that FK. The DB constraint stays untouched.',
+  ].join('\n');
+
+  // --- Imports ---------------------------------------------------------------
+  // pg-core: sorted, enum consts are not imports (they're declared below), `sql`
+  // comes from 'drizzle-orm', not pg-core — strip both from the pg-core set.
+  const enumConsts = new Set(enumNames.map(enumConstName));
+  const usesSqlRaw = pgCoreBuilders.has('sql');
+  const pgCoreNames = [...pgCoreBuilders].filter((b) => !enumConsts.has(b) && b !== 'sql').sort((a, b) => a.localeCompare(b));
+
+  const importLines: string[] = [];
+  importLines.push(`import { ${pgCoreNames.join(', ')} } from 'drizzle-orm/pg-core';`);
+
+  const drizzleOrmNames: string[] = [];
+  if (anyRelations) drizzleOrmNames.push('relations');
+  if (usesSqlRaw) drizzleOrmNames.push('sql');
+  drizzleOrmNames.sort((a, b) => a.localeCompare(b));
+  if (drizzleOrmNames.length) {
+    importLines.push(`import { ${drizzleOrmNames.join(', ')} } from 'drizzle-orm';`);
+  }
+
+  // --- Enum declarations -----------------------------------------------------
+  const enumDecls = enumNames.map((name) => {
+    const values = enumsByName.get(name) ?? [];
+    const valsText = values.map((v) => strLiteral(v)).join(', ');
+    return `export const ${enumConstName(name)} = pgEnum(${strLiteral(name)}, [${valsText}]);`;
+  });
+
+  // --- Assemble --------------------------------------------------------------
+  const sections: string[] = [];
+  sections.push(header);
+  sections.push(importLines.join('\n'));
+  if (enumDecls.length) sections.push(enumDecls.join('\n'));
+  for (const block of tableBlocks) sections.push(block);
+  for (const block of relationBlocks) sections.push(block);
+
+  return sections.join('\n\n') + '\n';
+}

package/src/cli/security-audit.ts

@@ -36,6 +36,13 @@ export interface FunctionDescriptor {
   securityDefiner: boolean;
   /** True when the function pins `SET search_path`. */
   hasSearchPath: boolean;
+  /** Owning role (catalog path only — static SQL parsing can't know it). */
+  owner?: string;
+  /**
+   * True when the owner runs above RLS (superuser, BYPASSRLS, or rds_superuser member).
+   * A SECURITY DEFINER function owned by such a role is the maximum blast radius.
+   */
+  ownerBypassesRls?: boolean;
 }
 
 export interface FunctionFinding {

package/src/cli/security-catalog.ts

@@ -32,7 +32,18 @@ SELECT
   EXISTS (
     SELECT 1 FROM unnest(coalesce(p.proconfig, '{}'::text[])) cfg
     WHERE lower(cfg) LIKE 'search_path=%'
-  ) AS has_search_path
+  ) AS has_search_path,
+  pg_get_userbyid(p.proowner) AS owner,
+  -- Does the owner run above RLS? A SECURITY DEFINER function owned by such a role is
+  -- the maximum blast radius — search_path pinning is necessary but not sufficient.
+  -- RDS has no true superuser (rolsuper=false), so also check rds_superuser membership.
+  (
+    SELECT r.rolsuper OR r.rolbypassrls OR EXISTS (
+      SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+      WHERE m.member = p.proowner AND g.rolname = 'rds_superuser'
+    )
+    FROM pg_roles r WHERE r.oid = p.proowner
+  ) AS owner_bypasses_rls
 FROM pg_proc p
 JOIN pg_namespace n ON n.oid = p.pronamespace
 JOIN pg_type t ON t.oid = p.prorettype
@@ -111,6 +122,8 @@ interface FunctionRow {
   returns_set: unknown;
   return_typtype: unknown;
   has_search_path: unknown;
+  owner?: unknown;
+  owner_bypasses_rls?: unknown;
 }
 
 /** Map a pg_proc row to a descriptor, computing a precise return class. */
@@ -132,6 +145,8 @@ export function catalogFunctionToDescriptor(row: FunctionRow): FunctionDescripto
     returnClassHint,
     securityDefiner: truthy(row.security_definer),
     hasSearchPath: truthy(row.has_search_path),
+    owner: row.owner != null ? String(row.owner) : undefined,
+    ownerBypassesRls: row.owner_bypasses_rls != null ? truthy(row.owner_bypasses_rls) : undefined,
   };
 }