@everystack/cli 0.4.80 → 0.4.82

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.82] - 2026-09-08
+
+### Fixed
+
+- four compiler-hardening throws close the A22/F-A10/F-A12 tail
+- column-path check disclosure parity closes the F1 gap
+
+## [0.4.81] - 2026-09-08
+
+### Added
+
+- every declared write compiles a policy; check narrows, never replaces
+
+### Fixed
+
+- db:pull recovers owner: from the normalized predicate and round-trips
+
 ## [0.4.80] - 2026-09-07
 
 ### BREAKING CHANGES

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.80",
+  "version": "0.4.82",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-derive.ts

@@ -92,14 +92,20 @@ function deriveExtraPrivileges(contract: TableContract): Record<string, string[]
 }
 
 /**
- * The deparsed owner predicate the compiler produces, in both its casts:
- *   (col = (((current_setting('request.jwt.claims'::text, true))::jsonb ->> 'sub'::text)))
+ * The deparsed owner predicate, in BOTH wire spellings — the `::text` casts are optional:
+ *   normalized (what both producers emit since a616a1f3, 2026-08-24, and what a live stage
+ *     returns through `predicate()`'s cross-version normalizer):
+ *       (col = (((current_setting('request.jwt.claims', true))::jsonb ->> 'sub'))::uuid)
+ *   raw old-major deparse (a dump captured before the normalizer, or an older stage):
+ *       (col = (((current_setting('request.jwt.claims'::text, true))::jsonb ->> 'sub'::text)))
  * Recognising it turns a predicate back into `{ owner: 'col' }` — the structured shape —
- * instead of an opaque `sql:` fragment. Anything unrecognised stays verbatim rather than
- * being guessed at.
+ * instead of an opaque `sql:` fragment. Before the casts were made optional the matcher
+ * expected only the raw spelling, so a normalized live predicate — every one, today — fell
+ * through to `sql:` and lost the `owner:` on round-trip. Anything unrecognised still stays
+ * verbatim rather than being guessed at.
  */
 const OWNER_RE =
-  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(*\(current_setting\('request\.jwt\.claims'::text,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'::text\)*(?:::[a-z]+)?\)?$/i;
+  /^\(?([a-z_][a-z0-9_]*)\s*=\s*\(*\(current_setting\('request\.jwt\.claims'(?:::text)?,\s*true\)\)::jsonb\s*->>\s*'([a-z_]+)'(?:::text)?\)*(?:::[a-z]+)?\)?$/i;
 
 /**
  * The OTHER owner shape: the database's own accessor, `(<col> = auth.user_id())`.
@@ -132,6 +138,33 @@ export function parseOwnerPredicate(
   return f ? { column: f[1], claim: 'sub', expr: f[2] } : null;
 }
 
+/**
+ * Decompose a WRITE predicate into its owner conjunct and the remaining guard.
+ *
+ * The compiler builds an owner write as `rowScope AND where` (USING) and `rowScope AND (check ??
+ * where)` (WITH CHECK). To round-trip, the deriver reverses that: the owner term may be the whole
+ * predicate (`owner = claim`) or one top-level AND conjunct (`owner = claim AND state = 'draft'`),
+ * and everything else is the guard the compiler will AND back in beside the owner. Returns the
+ * owner parse (null when there is none) and the guard text (null when the owner is the whole
+ * predicate). Nothing is guessed: a predicate with no recognisable owner conjunct returns
+ * `{ owner: null, guard: <the whole predicate> }`, which the caller carries verbatim as `sql:`.
+ */
+function splitOwnerPredicate(
+  pred: string | null,
+): { owner: ReturnType<typeof parseOwnerPredicate>; guard: string | null } {
+  if (!pred) return { owner: null, guard: null };
+  const direct = parseOwnerPredicate(pred);
+  if (direct) return { owner: direct, guard: null };
+  const conjuncts = splitTopLevel(pred, 'AND');
+  if (conjuncts.length < 2) return { owner: null, guard: pred };
+  const idx = conjuncts.findIndex((c) => parseOwnerPredicate(c));
+  if (idx === -1) return { owner: null, guard: pred };
+  const owner = parseOwnerPredicate(conjuncts[idx]);
+  const rest = conjuncts.filter((_, i) => i !== idx);
+  const guard = rest.length === 0 ? null : rest.length === 1 ? rest[0] : `(${rest.join(' AND ')})`;
+  return { owner, guard };
+}
+
 /**
  * Split a predicate on a top-level operator, respecting parens and string literals.
  *
@@ -331,15 +364,24 @@ function renderColumnAbility(
   grantee: string,
   columns: readonly string[],
   policy: PolicyContract,
+  notes: string[],
 ): string | null {
   const using = policy.using ?? null;
   const owner = parseOwnerPredicate(using);
   const parts: string[] = [];
   const role = policyRoleForGrantee(grantee);
 
-  // Owner-only uses the model's authenticated default. Every other grantee must be named so
-  // the compiler emits the policy TO the live role, rather than a role-less public ability.
-  if (!owner || role !== 'authenticated') parts.push(`role: '${role}'`);
+  // A distinct WITH CHECK on a column UPDATE must ride as `check:`, and the compiler REFUSES a
+  // role-less column ability that carries any row predicate (F-A12: a column ability has nowhere
+  // row-level to put one). So a differing check forces the NAMED-role spelling — `role:
+  // 'authenticated'` — which routes to the compiler's named-role column path: that path ANDs the
+  // owner back into BOTH halves and honors the check, where the role-less shape would throw.
+  const distinctCheck = action === 'update' && policy.check != null && policy.check !== using;
+
+  // Owner-only uses the model's authenticated default. Every other grantee must be named so the
+  // compiler emits the policy TO the live role, not a role-less public ability — and a differing
+  // check names it too, to escape the F-A12 refusal above.
+  if (!owner || role !== 'authenticated' || distinctCheck) parts.push(`role: '${role}'`);
   if (owner) {
     parts.push(`owner: '${modelFieldKey(owner.column)}'`);
     if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
@@ -349,10 +391,26 @@ function renderColumnAbility(
     if (fragment) parts.push(`sql: ${fragment}`);
   }
 
-  if (action === 'update' && policy.check && policy.check !== using) {
-    const fragment = sqlFragment(policy.check);
+  if (distinctCheck) {
+    // Emit only the guard BEYOND the owner gate. The live WITH CHECK restates the owner term
+    // (the compiler's named-role column path ANDs it back in), so carrying the whole predicate
+    // would double the owner on recompile and churn the plan. Strip it exactly as the row-level
+    // write path does; a check with no owner conjunct rides whole (guard === the check).
+    const split = owner ? splitOwnerPredicate(policy.check) : null;
+    const guard = split ? split.guard : policy.check;
+    const fragment = sqlFragment(guard);
     if (!fragment) return null;
     parts.push(`check: ${fragment}`);
+    // Disclosure parity with the row-level write path. When USING is a PURE owner predicate but
+    // the live WITH CHECK does NOT restate the owner, the compiler ANDs the owner back into the
+    // rendered check — TIGHTENING it (the F-A11 "wider write half" the model cannot express). Say
+    // so, rather than let an unexplained conjunct surface in the next db:plan, which an operator
+    // might "fix" back toward the wider live shape by hand — the exact spelling the compiler refuses.
+    if (split && split.owner == null) {
+      notes.push(`policy "${policy.name}" (UPDATE) has a WITH CHECK that does not restate the owner gate in its USING —`);
+      notes.push(`  it is wider than a column owner ability can express, so the rendered model TIGHTENS it to the owner. Live WITH CHECK:`);
+      notes.push(`    ${policy.check}`);
+    }
   }
   parts.push(`columns: [${columns.map((column) => `'${modelFieldKey(column)}'`).join(', ')}]`);
   return `can('${action}', { ${parts.join(', ')} })`;
@@ -562,7 +620,7 @@ export function deriveAbilities(
     }
 
     if (diverges && own) {
-      const parts = [`owner: '${own.owner.column}'`];
+      const parts = [`owner: '${modelFieldKey(own.owner.column)}'`];
       if (own.owner.claim !== 'sub') parts.push(`userField: '${own.owner.claim}'`);
       if (own.owner.expr) parts.push(`ownerExpr: sql\`${own.owner.expr}\``);
       const guard = sqlFragment(own.ownerSql);
@@ -597,7 +655,7 @@ export function deriveAbilities(
     const pol = policiesFor(contract, 'authenticated', 'SELECT')[0];
     const owner = parseOwnerPredicate(pol?.using ?? null);
     if (owner) {
-      const parts = [`owner: '${owner.column}'`];
+      const parts = [`owner: '${modelFieldKey(owner.column)}'`];
       if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
       if (owner.expr) parts.push(`ownerExpr: sql\`${owner.expr}\``);
       abilities.push(`can('read', { ${parts.join(', ')} })`);
@@ -616,22 +674,58 @@ export function deriveAbilities(
       ?? policiesFor(contract, 'authenticated', command)[0];
     const using = pol?.using ?? null;
     const check = pol?.check ?? null;
-    const owner = parseOwnerPredicate(using) ?? parseOwnerPredicate(check);
+    // Decompose both halves into (owner, guard). INSERT carries the owner in WITH CHECK (its
+    // USING is null); UPDATE/DELETE carry it in USING. The owner is recovered from whichever
+    // half has it.
+    const u = splitOwnerPredicate(using);
+    const c = splitOwnerPredicate(check);
+    const owner = u.owner ?? c.owner;
 
     const parts: string[] = [];
     if (owner) {
-      parts.push(`owner: '${owner.column}'`);
+      parts.push(`owner: '${modelFieldKey(owner.column)}'`);
       if (owner.claim !== 'sub') parts.push(`userField: '${owner.claim}'`);
       if (owner.expr) parts.push(`ownerExpr: sql\`${owner.expr}\``);
-    }
-    // A predicate beyond the owner gate (a state guard, a tenant filter) rides as `sql`.
-    const usingFrag = owner && parseOwnerPredicate(using) ? null : sqlFragment(using);
-    if (usingFrag) parts.push(`sql: ${usingFrag}`);
-    // The WRITE half, only when it genuinely differs. Postgres defaults it to USING, and
-    // emitting it unconditionally would be noise that also defeats the round-trip diff.
-    if (check && check !== using) {
-      const checkFrag = sqlFragment(check);
-      if (checkFrag) parts.push(`check: ${checkFrag}`);
+      // The USING guard beyond the owner gate (a state guard, a tenant filter) rides as `sql`.
+      const usingGuard = sqlFragment(u.guard);
+      if (usingGuard) parts.push(`sql: ${usingGuard}`);
+      // The WRITE half rides as `check` ONLY when its guard differs from the USING guard. The
+      // compiler defaults WITH CHECK to (rowScope AND where), so emitting an equal guard would
+      // double the owner term on recompile — the round-trip regression this closes.
+      // WITH CHECK handling. `check == null` means the live policy has NO explicit WITH CHECK
+      // (Postgres defaults it to USING at runtime) — emit no `check:` and let the compiler
+      // default it the same way. Only an EXPLICIT check that differs from the USING guard needs a
+      // `check:`, and only in the shapes below.
+      if (command !== 'DELETE' && check != null && c.owner == null) {
+        // The live WITH CHECK does not even restate the owner gate that USING carries — it is
+        // WIDER on the owner axis (the extreme is `WITH CHECK (true)`: write a row you do not
+        // own). The model has no spelling for that, and every `check:` the compiler emits ANDs
+        // the owner back in, so the derived ability necessarily TIGHTENS live. Disclose it rather
+        // than round-trip the loss silently; the residual db:plan statement is the real diff.
+        notes.push(`policy "${pol?.name}" (${command}) has a WITH CHECK that does not restate the owner gate in its USING —`);
+        notes.push(`  it is wider than any owner ability can express, so the rendered model TIGHTENS it to the owner. Live WITH CHECK:`);
+        notes.push(`    ${check}`);
+      } else if (command !== 'DELETE' && check != null && c.owner != null && c.guard == null && u.guard != null) {
+        // Explicit owner-only WITH CHECK while USING carries a guard — the write half is
+        // deliberately WIDER than the read half (the moderation shape this file's header names:
+        // "your own draft rows" to target, "your own row" to write into). Left implicit, the
+        // compiler would default WITH CHECK to (owner AND where) and TIGHTEN it, so the pull would
+        // misreport live. `check: sql`true`` forces WITH CHECK back to the owner gate alone.
+        parts.push('check: sql`true`');
+      } else if (c.guard != null && (c.guard ?? '') !== (u.guard ?? '')) {
+        // An explicit WITH CHECK carrying a DIFFERENT guard than USING (owner ∧ a distinct write
+        // guard). Rides as `check:`; the compiler ANDs the owner back in.
+        const checkFrag = sqlFragment(c.guard);
+        if (checkFrag) parts.push(`check: ${checkFrag}`);
+      }
+    } else {
+      // No owner recovered — carry the predicates verbatim, USING and (differing) WITH CHECK.
+      const usingFrag = sqlFragment(using);
+      if (usingFrag) parts.push(`sql: ${usingFrag}`);
+      if (check && check !== using) {
+        const checkFrag = sqlFragment(check);
+        if (checkFrag) parts.push(`check: ${checkFrag}`);
+      }
     }
 
     if (!parts.length && !pol) {
@@ -670,7 +764,7 @@ export function deriveAbilities(
       if (!cols.length) continue;
       const action = priv === 'SELECT' ? 'read' : priv === 'UPDATE' ? 'update' : null;
       const policy = action ? columnPolicyFor(contract, grantee, priv) : null;
-      const ability = action && policy ? renderColumnAbility(action, grantee, cols, policy) : null;
+      const ability = action && policy ? renderColumnAbility(action, grantee, cols, policy, notes) : null;
       if (ability) {
         abilities.push(ability);
         renderedColumnRoles.add(grantee);