@everystack/server 0.4.37 → 0.4.38

package/src/role-chain.ts

@@ -168,6 +168,32 @@ export function generateReaderRoleSQL(options: ReaderRoleOptions = {}): string {
   ].join('\n') + '\n';
 }
 
+/**
+ * The reserved role `lifecycle: true` models compile grants and policies to, and that owns their
+ * SECURITY DEFINER functions. Equal to LIFECYCLE_OWNER_ROLE in @everystack/model (this package
+ * keeps no dependency on it).
+ */
+export const LIFECYCLE_ROLE = 'everystack_lifecycle';
+
+/**
+ * Generate idempotent DDL for the reserved lifecycle role: create it if absent, then re-assert
+ * its attributes so a hand-made role is brought into line.
+ *
+ *   - NOLOGIN     — no one connects as it. It is a function owner and a grantee, not an identity.
+ *   - NOINHERIT   — it never ambiently gains another role's privileges.
+ *   - NOBYPASSRLS — its reads and writes go through the policies the compiler writes for it.
+ *
+ * It grants the role NOTHING and grants it TO no one. Membership is SET ROLE, and SET ROLE to it
+ * passes the lifecycle guard, so no tool hands membership out here (db:provision reports members).
+ */
+export function generateLifecycleRoleSQL(role: string = LIFECYCLE_ROLE): string {
+  assertIdent(role, 'lifecycle role');
+  return [
+    `DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = '${role}') THEN CREATE ROLE ${role} NOLOGIN NOINHERIT NOBYPASSRLS; END IF; END $$;`,
+    `ALTER ROLE ${role} WITH NOLOGIN NOINHERIT NOBYPASSRLS;`,
+  ].join('\n') + '\n';
+}
+
 export interface ReaderGrantOptions {
   /** The SELECT-only login the grants are made TO. Default 'reader'. */
   readerRole?: string;