@fitzzero/quickdraw-core 5.0.0 → 5.0.1

package/dist/{chunk-XFDOGTMC.js → chunk-HQ6WIRE2.js}

@@ -13,12 +13,12 @@ import {
   searchTargetOf,
   streamMaxOf,
   viewPredicate
-} from "./chunk-XUSN5WKU.js";
+} from "./chunk-O2PWC2YW.js";
 import {
   MAX_SUBSCRIBE_IDS,
   PROTOCOL_VERSION,
   QUICKDRAW_VERSION
-} from "./chunk-7QIY2DDX.js";
+} from "./chunk-WVIRXYI4.js";
 import {
   isScopedStream
 } from "./chunk-5YRQ26LF.js";
@@ -849,4 +849,4 @@ function createMockClient(contracts, options = {}) {
 export {
   createMockClient
 };
-//# sourceMappingURL=chunk-XFDOGTMC.js.map
+//# sourceMappingURL=chunk-HQ6WIRE2.js.map

package/dist/{chunk-LLLYILEP.js → chunk-NS5PUHIZ.js}

@@ -10,7 +10,7 @@ import {
   quietly,
   strictWarningsOf,
   versionTime
-} from "./chunk-DNCAI3KY.js";
+} from "./chunk-4DIQHASK.js";
 import {
   isCallEnvelope,
   isCancel
@@ -77,7 +77,7 @@ import {
   streamRoom,
   topicRoom,
   userRoom
-} from "./chunk-7QIY2DDX.js";
+} from "./chunk-WVIRXYI4.js";
 import {
   hasJsonSchema
 } from "./chunk-47AEXVDM.js";
@@ -424,9 +424,9 @@ function addBranchKeys(node, root, keys, seen) {
     }
   }
   for (const keyword of BRANCHES) {
-    const members = target2[keyword];
-    if (Array.isArray(members)) {
-      for (const member of members) {
+    const members2 = target2[keyword];
+    if (Array.isArray(members2)) {
+      for (const member of members2) {
         addBranchKeys(member, root, keys, seen);
       }
     }
@@ -673,12 +673,12 @@ async function membersAmong(storage, collection, scope, ids) {
 }
 async function readItemsById(storage, collection, scope, ids, rev) {
   const wanted = [...new Set(ids)];
-  const members = wanted.length === 0 ? void 0 : await membersAmong(storage, collection, scope, wanted);
-  if (members === void 0) {
+  const members2 = wanted.length === 0 ? void 0 : await membersAmong(storage, collection, scope, wanted);
+  if (members2 === void 0) {
     return { rev, items: [] };
   }
   const rows = await storage.findMany(collection.model, {
-    where: members,
+    where: members2,
     select: collection.item.select
   });
   const found = new Map(rows.flatMap((row) => typeof row.id === "string" ? [[row.id, row]] : []));
@@ -792,10 +792,10 @@ function indexRowFrom(collection, item, row, rev) {
   const id = typeof row.id === "string" ? row.id : "";
   return [id, version ?? rev, ...(collection.index ?? []).map((field) => values[field] ?? null)];
 }
-async function readIndex(storage, collection, members, nullable, rev, max = INDEX_MAX_ROWS) {
+async function readIndex(storage, collection, members2, nullable, rev, max = INDEX_MAX_ROWS) {
   const fields = collection.index ?? [];
   const rows = await storage.findMany(collection.model, {
-    where: members,
+    where: members2,
     select: indexSelect(collection, fields),
     orderBy: orderByOf(collection.order, nullable),
     take: max + 1
@@ -1056,8 +1056,17 @@ function bindingOf(state, contract) {
   }
   return binding;
 }
+function sameRead(a, b) {
+  const columns = ["model", "entry", "user", "level"].every((key) => a[key] === b[key]);
+  if (!columns || a.levels === void 0 || b.levels === void 0) {
+    return columns && a.levels === b.levels;
+  }
+  const mapped = b.levels;
+  const roles = Object.entries(a.levels);
+  return roles.length === Object.keys(mapped).length && roles.every(([role, level]) => Object.hasOwn(mapped, role) && mapped[role] === level);
+}
 function membershipScope(scope, binding, read) {
-  const declared = binding.memberships.get(read);
+  const declared = binding.memberships.get(read) ?? [...binding.memberships].find(([known]) => sameRead(known, read))?.[1];
   if (declared !== void 0) {
     return [scope.cached, declared];
   }
@@ -2336,6 +2345,220 @@ function createBasicAccessEngine(options = {}) {
   });
 }
 
+// src/server/access/policies/anyOf.ts
+function unionReads(policies) {
+  const memberships = /* @__PURE__ */ new Set();
+  for (const policy of policies) {
+    for (const read of policy.reads.memberships) {
+      memberships.add(read);
+    }
+  }
+  return {
+    columns: [...new Set(policies.flatMap((policy) => policy.reads.columns))],
+    memberships: [...memberships],
+    inherits: [...new Set(policies.flatMap((policy) => policy.reads.inherits))],
+    parents: policies.flatMap((policy) => policy.reads.parents ?? []),
+    storage: policies.some((policy) => policy.reads.storage)
+  };
+}
+var MEMBERS = /* @__PURE__ */ new WeakMap();
+function anyOfPolicies(policy) {
+  return MEMBERS.get(policy);
+}
+function anyOf(...policies) {
+  if (policies.length === 0 || !policies.every(isAccessPolicy)) {
+    throw new TypeError("anyOf(...policies): pass one or more access policies");
+  }
+  const all = Object.freeze([...policies]);
+  const combined = definePolicy({
+    kind: "anyOf",
+    policies: all,
+    reads: unionReads(all),
+    async levelsFor(principal, ids, tools) {
+      const each = await Promise.all(all.map((policy) => policy.levelsFor(principal, ids, tools)));
+      const levels = /* @__PURE__ */ new Map();
+      for (const id of ids) {
+        levels.set(
+          id,
+          each.reduce((level, granted) => maxLevel(level, granted.get(id)), null)
+        );
+      }
+      return levels;
+    },
+    async accessWhere(principal, level, tools) {
+      const filters = await Promise.all(
+        all.map((policy) => policy.accessWhere(principal, level, tools))
+      );
+      const matching = filters.filter((filter) => filter !== "none");
+      if (matching.some((filter) => Object.keys(filter).length === 0)) {
+        return {};
+      }
+      if (matching.length <= 1) {
+        return matching[0] ?? "none";
+      }
+      return { OR: matching };
+    }
+  });
+  MEMBERS.set(combined, all);
+  return combined;
+}
+
+// src/server/access/policies/members.ts
+function membershipOf(policy) {
+  return policy.kind === "members" ? policy.reads.memberships[0] : void 0;
+}
+function checkLevels(owner, levels) {
+  if (levels === void 0) {
+    return void 0;
+  }
+  const valid = typeof levels === "object" && levels !== null && !Array.isArray(levels) && Object.values(levels).every(isAccessLevel);
+  if (!valid) {
+    throw new TypeError(
+      `${owner}: levels must map stored roles to access levels, as in { editor: "Moderate" }`
+    );
+  }
+  return Object.freeze({ ...levels });
+}
+function membershipRead(options, owner) {
+  const { model, entry, user, level, levels } = options;
+  return Object.freeze({
+    model: checkName(owner("model"), "model", model),
+    entry: checkName(owner("entry"), "entry", entry),
+    user: checkName(owner("user"), "user", user),
+    level: checkName(owner("level"), "level", level),
+    levels: checkLevels(owner("levels"), levels)
+  });
+}
+function rolesAtLeast(read, level) {
+  const enough = new Set(levelsAtLeast(level));
+  if (read.levels === void 0) {
+    return [...enough];
+  }
+  return Object.entries(read.levels).filter(([, mapped]) => enough.has(mapped)).map(([role]) => role);
+}
+function members(options) {
+  if (typeof options !== "object" || options === null) {
+    throw new TypeError("members(options): options must be { model, entry, user, level }");
+  }
+  const read = membershipRead(options, (option) => `members({ ${option} })`);
+  return definePolicy({
+    kind: "members",
+    membership: read,
+    reads: { columns: [], memberships: [read], inherits: [], storage: true },
+    levelsFor: (principal, ids, tools) => tools.memberships(read, principal.userId, ids),
+    async accessWhere(principal, level, tools) {
+      const roles = rolesAtLeast(read, level);
+      if (roles.length === 0) {
+        return "none";
+      }
+      const rows = await tools.storage.findMany(read.model, {
+        where: { [read.user]: principal.userId, [read.level]: { in: roles } },
+        select: { [read.entry]: true }
+      });
+      const entries = rows.map((row) => row[read.entry]);
+      return idFilter(entries.filter((entry) => typeof entry === "string"));
+    }
+  });
+}
+
+// src/server/access/policies/resolver.ts
+var UNDECLARED = /* @__PURE__ */ new WeakSet();
+function declaresNoReads(policy) {
+  return UNDECLARED.has(policy);
+}
+function noReads() {
+  return { columns: [], memberships: [], inherits: [], storage: false };
+}
+var READ_KEYS = ["columns", "memberships"];
+function readsProblem(message) {
+  throw new TypeError(`resolver({ reads }): ${message}`);
+}
+function checkColumns(columns) {
+  if (columns === void 0) {
+    return [];
+  }
+  const valid = Array.isArray(columns) && columns.every((column) => typeof column === "string" && column.length > 0);
+  return valid ? Object.freeze([...new Set(columns)]) : readsProblem("columns must be a list of column names");
+}
+function checkMemberships(memberships) {
+  if (memberships === void 0) {
+    return [];
+  }
+  const valid = Array.isArray(memberships) && memberships.every((each) => typeof each === "object" && each !== null && !Array.isArray(each));
+  if (!valid) {
+    readsProblem("memberships must be a list of { model, entry, user, level, levels? }");
+  }
+  return Object.freeze(
+    memberships.map(
+      (each) => membershipRead(each, () => "resolver({ reads: { memberships } })")
+    )
+  );
+}
+function checkReads(reads) {
+  if (reads === void 0) {
+    return void 0;
+  }
+  if (reads === "none") {
+    return noReads();
+  }
+  if (typeof reads !== "object" || reads === null || Array.isArray(reads)) {
+    readsProblem('reads must be { columns?, memberships? } or "none"');
+  }
+  const given = reads;
+  const unknownKey = Object.keys(given).find((key) => !READ_KEYS.includes(key));
+  if (unknownKey !== void 0) {
+    readsProblem(`reads has an unknown key "${unknownKey}"; the keys are columns and memberships`);
+  }
+  const columns = checkColumns(given.columns);
+  const memberships = checkMemberships(given.memberships);
+  if (columns.length === 0 && memberships.length === 0) {
+    readsProblem('name a column or a membership table, or pass "none"');
+  }
+  return { columns, memberships, inherits: [], storage: true };
+}
+function levelIn(levels, id) {
+  let level;
+  if (levels instanceof Map) {
+    level = levels.get(id);
+  } else if (Object.hasOwn(levels, id)) {
+    level = levels[id];
+  }
+  return isAccessLevel(level) ? level : null;
+}
+function resolver(options) {
+  const valid = typeof options === "object" && options !== null && typeof options.levelsFor === "function" && (options.where === void 0 || typeof options.where === "function");
+  if (!valid) {
+    throw new TypeError(
+      "resolver({ levelsFor, where?, reads? }): levelsFor and where must be functions"
+    );
+  }
+  const { levelsFor, where: where2 } = options;
+  const reads = checkReads(options.reads);
+  const policy = definePolicy({
+    kind: "resolver",
+    reads: reads ?? noReads(),
+    async levelsFor(principal, ids, tools) {
+      const levels = await levelsFor(principal, ids, tools);
+      if (typeof levels !== "object" || levels === null) {
+        return levelsById(ids, () => null);
+      }
+      return levelsById(ids, (id) => levelIn(levels, id));
+    },
+    async accessWhere(principal, level, tools) {
+      if (where2 === void 0) {
+        return "none";
+      }
+      const filter = await where2(principal, level, tools);
+      const isFilter = typeof filter === "object" && filter !== null && !Array.isArray(filter);
+      return isFilter ? filter : "none";
+    }
+  });
+  if (reads === void 0) {
+    UNDECLARED.add(policy);
+  }
+  return policy;
+}
+
 // src/server/collections/scopes.ts
 function serviceOf2(anchor) {
   return anchor.slice(0, anchor.indexOf("\0"));
@@ -4211,9 +4434,9 @@ async function nullableColumns(storage, collection, values) {
   return nullable;
 }
 async function readRows4(storage, collection, read) {
-  const { members, values, nullable, limit } = read;
+  const { members: members2, values, nullable, limit } = read;
   const { order } = collection;
-  const where2 = values === void 0 ? members : { AND: [members, afterCursor(order, values, nullable)] };
+  const where2 = values === void 0 ? members2 : { AND: [members2, afterCursor(order, values, nullable)] };
   const [rows, total] = await Promise.allSettled([
     storage.findMany(collection.model, {
       where: where2,
@@ -4224,7 +4447,7 @@ async function readRows4(storage, collection, read) {
       orderBy: orderByOf(order, nullable),
       take: limit + 1
     }),
-    storage.count(collection.model, { where: members })
+    storage.count(collection.model, { where: members2 })
   ]);
   if (total.status === "rejected") {
     throw total.reason;
@@ -4244,15 +4467,15 @@ async function readPage(storage, collection, request, rev) {
   const { order } = collection;
   const values = request.cursor === void 0 ? void 0 : decodeCursor(order, request.cursor);
   const nullable = await nullableColumns(storage, collection, values);
-  const members = await membersWhere(storage, collection, request.scope);
+  const members2 = await membersWhere(storage, collection, request.scope);
   const page = { ok: true, rev, limit, ...clamped ? { clamped: true } : {} };
   const indexed = values === void 0 && collection.index !== void 0;
-  if (members === void 0) {
+  if (members2 === void 0) {
     return { ...page, items: [], total: 0, cursor: null, ...indexed ? { index: [] } : {} };
   }
   const [{ rows, total }, index] = await Promise.all([
-    readRows4(storage, collection, { members, values, nullable, limit }),
-    indexed ? readIndex(storage, collection, members, nullable, rev) : void 0
+    readRows4(storage, collection, { members: members2, values, nullable, limit }),
+    indexed ? readIndex(storage, collection, members2, nullable, rev) : void 0
   ]);
   const shown = rows.slice(0, limit);
   const last = shown.at(-1);
@@ -6477,11 +6700,41 @@ function createPolicyEngine(options) {
   });
 }
 
+// src/server/access/resolverReads.ts
+function hasUndeclaredResolver(policy) {
+  return declaresNoReads(policy) || (anyOfPolicies(policy)?.some(hasUndeclaredResolver) ?? false);
+}
+function resolverReadsWarnings(service) {
+  const { access, model } = service;
+  if (access === void 0 || model === void 0 || !hasUndeclaredResolver(access)) {
+    return [];
+  }
+  return [
+    {
+      kind: "resolver-without-reads",
+      service: service.name,
+      message: `${service.name}: its access policy uses a resolver that declares no reads, so no tracked write re-checks the levels it gives: a live row, collection scope or change topic it authorized stays open after the user loses access. Declare what the levels depend on, resolver({ levelsFor, reads: { columns, memberships } }) (columns of the ${model} model, membership tables as members() takes them), or reads: "none" when nothing a tracked write changes can change them`,
+      meta: { model }
+    }
+  ];
+}
+function warnResolverReads(registry, warnings) {
+  if (!warnings.enabled) {
+    return;
+  }
+  for (const service of registry.services.values()) {
+    for (const warning of resolverReadsWarnings(service)) {
+      warnings.warn(warning);
+    }
+  }
+}
+
 // src/server/pipeline/accessSettings.ts
 function isAccessEngine(value) {
   return typeof value === "object" && value !== null && typeof value.authorize === "function";
 }
-function resolveAccess2(access, registry, storage, logger) {
+function resolveAccess2(access, registry, storage, report) {
+  const { logger, warnings } = report;
   if (access !== void 0 && (typeof access !== "object" || access === null)) {
     throw new TypeError("createDispatcher: access must be an access engine or { cacheMs }");
   }
@@ -6493,6 +6746,7 @@ function resolveAccess2(access, registry, storage, logger) {
     logger,
     cacheMs: accessOptions.cacheMs
   });
+  warnResolverReads(registry, warnings);
   return { access: engine ?? createBasicAccessEngine({ rows: policies.rows }), policies };
 }
 
@@ -6626,7 +6880,10 @@ function resolveSettings(options, registry, db, accessSinks = []) {
   const warnings = createDevWarnings({ logger, development, strict: strictWarningsOf(options) });
   warnTieredOutputs(registry, warnings);
   const storage = storageFor(options, db);
-  const { access, policies } = resolveAccess2(options.access, registry, storage, logger);
+  const { access, policies } = resolveAccess2(options.access, registry, storage, {
+    logger,
+    warnings
+  });
   const outputValidation = options.outputValidation ?? development;
   const live = createLive({
     registry,
@@ -8806,7 +9063,6 @@ export {
   isAccessPolicy,
   checkName,
   levelsById,
-  idFilter,
   encodeCursor,
   decodeCursor,
   orderByOf,
@@ -8823,6 +9079,11 @@ export {
   STREAM_MAX_SCOPES,
   MAX_STREAMS_PER_SOCKET,
   createBasicAccessEngine,
+  anyOfPolicies,
+  anyOf,
+  membershipOf,
+  members,
+  resolver,
   DEFAULT_LIMITS,
   MAX_TIMEOUT_MS,
   createDispatcher,
@@ -8838,4 +9099,4 @@ export {
   watchAdapterClients,
   createServer
 };
-//# sourceMappingURL=chunk-LLLYILEP.js.map
+//# sourceMappingURL=chunk-NS5PUHIZ.js.map