@forgebase/database 0.0.1

package/dist/cjs/permissionService.d.ts

@@ -0,0 +1,20 @@
+import { Kysely, Transaction } from 'kysely';
+import { type TablePermissions } from './types';
+export declare class PermissionService {
+    private cache;
+    private db;
+    private initPromise;
+    constructor(db: Kysely<any>);
+    ready(): Promise<void>;
+    private initializeDatabase;
+    /**
+     * Sync-only lookup: returns cached permissions or undefined if not cached.
+     * Avoids async overhead when the permission is already in the LRU cache.
+     */
+    getPermissionsForTableSync(tableName: string): TablePermissions | undefined;
+    getPermissionsForTable(tableName: string, trx?: Transaction<any> | Kysely<any>): Promise<TablePermissions | any>;
+    setPermissionsForTable(tableName: string, permissions: TablePermissions, trx?: Transaction<any> | Kysely<any>): Promise<TablePermissions>;
+    deletePermissionsForTable(tableName: string, trx?: Transaction<any> | Kysely<any>): Promise<void>;
+    clearCache(): void;
+}
+//# sourceMappingURL=permissionService.d.ts.map

package/dist/cjs/permissionService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionService.d.ts","sourceRoot":"","sources":["../../src/permissionService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAO,WAAW,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAGrE,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAAqC;IAElD,OAAO,CAAC,EAAE,CAAc;IACxB,OAAO,CAAC,WAAW,CAAgB;gBAEvB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;IAWrB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;YAId,kBAAkB;IAsBhC;;;OAGG;IACH,0BAA0B,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB,GAAG,SAAS;IAIrE,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,gBAAgB,GAAG,GAAG,CAAC;IA6B5B,sBAAsB,CAC1B,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,gBAAgB,EAC7B,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,gBAAgB,CAAC;IA4BtB,yBAAyB,CAC7B,SAAS,EAAE,MAAM,EACjB,GAAG,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC;IAYhB,UAAU,IAAI,IAAI;CAGnB"}

package/dist/cjs/permissionService.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PermissionService = void 0;
+const kysely_1 = require("kysely");
+const types_1 = require("./types");
+const lru_cache_1 = require("lru-cache");
+class PermissionService {
+    constructor(db) {
+        this.db = db;
+        this.cache = new lru_cache_1.LRUCache({
+            max: 500,
+            ttl: 5 * 60 * 1000, // 5 minutes TTL
+            allowStale: false,
+            updateAgeOnGet: true,
+        });
+        this.initPromise = this.initializeDatabase();
+    }
+    async ready() {
+        return this.initPromise;
+    }
+    async initializeDatabase() {
+        try {
+            const adapterName = this.db.getExecutor().adapter.constructor.name;
+            const isSqlite = adapterName.includes('Sqlite') || adapterName.includes('Libsql');
+            const now = isSqlite ? (0, kysely_1.sql) `CURRENT_TIMESTAMP` : (0, kysely_1.sql) `now()`;
+            await this.db.schema
+                .createTable(types_1.FG_PERMISSION_TABLE)
+                .ifNotExists()
+                .addColumn('table_name', 'varchar(255)', (col) => col.primaryKey().notNull())
+                .addColumn('permissions', 'json', (col) => col.notNull())
+                .addColumn('created_at', 'timestamp', (col) => col.defaultTo(now))
+                .addColumn('updated_at', 'timestamp', (col) => col.defaultTo(now))
+                .execute();
+        }
+        catch (e) {
+            console.warn('Permission table initialization warning:', e);
+        }
+    }
+    /**
+     * Sync-only lookup: returns cached permissions or undefined if not cached.
+     * Avoids async overhead when the permission is already in the LRU cache.
+     */
+    getPermissionsForTableSync(tableName) {
+        return this.cache.get(tableName);
+    }
+    async getPermissionsForTable(tableName, trx) {
+        const cachedPermissions = this.cache.get(tableName);
+        if (cachedPermissions) {
+            return cachedPermissions;
+        }
+        const executor = trx || this.db;
+        const result = await executor
+            .selectFrom(types_1.FG_PERMISSION_TABLE)
+            .where('table_name', '=', tableName)
+            .selectAll()
+            .executeTakeFirst();
+        if (!result)
+            return {};
+        let permissions = result.permissions;
+        if (typeof permissions === 'string') {
+            try {
+                permissions = JSON.parse(permissions);
+            }
+            catch (e) {
+                // ignore
+            }
+        }
+        this.cache.set(tableName, permissions);
+        return permissions;
+    }
+    async setPermissionsForTable(tableName, permissions, trx) {
+        const executor = trx || this.db;
+        const permissionsJson = JSON.stringify(permissions);
+        const adapterName = this.db.getExecutor().adapter.constructor.name;
+        const isSqlite = adapterName.includes('Sqlite') || adapterName.includes('Libsql');
+        const now = isSqlite ? (0, kysely_1.sql) `CURRENT_TIMESTAMP` : (0, kysely_1.sql) `now()`;
+        await executor
+            .insertInto(types_1.FG_PERMISSION_TABLE)
+            .values({
+            table_name: tableName,
+            permissions: permissionsJson,
+            updated_at: now,
+        })
+            .onConflict((oc) => oc.column('table_name').doUpdateSet({
+            permissions: permissionsJson,
+            updated_at: now,
+        }))
+            .execute();
+        this.cache.set(tableName, permissions);
+        return permissions;
+    }
+    async deletePermissionsForTable(tableName, trx) {
+        const executor = trx || this.db;
+        await executor
+            .deleteFrom(types_1.FG_PERMISSION_TABLE)
+            .where('table_name', '=', tableName)
+            .execute();
+        // Remove from cache
+        this.cache.delete(tableName);
+    }
+    // Method to clear the entire cache
+    clearCache() {
+        this.cache.clear();
+    }
+}
+exports.PermissionService = PermissionService;
+//# sourceMappingURL=permissionService.js.map

package/dist/cjs/permissionService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissionService.js","sourceRoot":"","sources":["../../src/permissionService.ts"],"names":[],"mappings":";;;AAAA,mCAAkD;AAClD,mCAAqE;AACrE,yCAAqC;AAErC,MAAa,iBAAiB;IAM5B,YAAY,EAAe;QACzB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,KAAK,GAAG,IAAI,oBAAQ,CAAC;YACxB,GAAG,EAAE,GAAG;YACR,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,gBAAgB;YACpC,UAAU,EAAE,KAAK;YACjB,cAAc,EAAE,IAAI;SACd,CAAC,CAAC;QACV,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC/C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEO,KAAK,CAAC,kBAAkB;QAC9B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;YACnE,MAAM,QAAQ,GACZ,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAA,YAAG,EAAA,mBAAmB,CAAC,CAAC,CAAC,IAAA,YAAG,EAAA,OAAO,CAAC;YAE3D,MAAM,IAAI,CAAC,EAAE,CAAC,MAAM;iBACjB,WAAW,CAAC,2BAAmB,CAAC;iBAChC,WAAW,EAAE;iBACb,SAAS,CAAC,YAAY,EAAE,cAAc,EAAE,CAAC,GAAG,EAAE,EAAE,CAC/C,GAAG,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,CAC3B;iBACA,SAAS,CAAC,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;iBACxD,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;iBACjE,SAAS,CAAC,YAAY,EAAE,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;iBACjE,OAAO,EAAE,CAAC;QACf,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,0CAA0C,EAAE,CAAC,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,0BAA0B,CAAC,SAAiB;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,GAAoC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpD,IAAI,iBAAiB,EAAE,CAAC;YACtB,OAAO,iBAAiB,CAAC;QAC3B,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,MAAM,GAAG,MAAM,QAAQ;aAC1B,UAAU,CAAC,2BAAmB,CAAC;aAC/B,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;aACnC,SAAS,EAAE;aACX,gBAAgB,EAAE,CAAC;QAEtB,IAAI,CAAC,MAAM;YAAE,OAAO,EAAE,CAAC;QAEvB,IAAI,WAAW,GAAG,MAAM,CAAC,WAAW,CAAC;QAErC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,IAAI,CAAC;gBACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,SAAS;YACX,CAAC;QACH,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACvC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAC1B,SAAiB,EACjB,WAA6B,EAC7B,GAAoC;QAEpC,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,eAAe,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAEpD,MAAM,WAAW,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC;QACnE,MAAM,QAAQ,GACZ,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAA,YAAG,EAAA,mBAAmB,CAAC,CAAC,CAAC,IAAA,YAAG,EAAA,OAAO,CAAC;QAE3D,MAAM,QAAQ;aACX,UAAU,CAAC,2BAAmB,CAAC;aAC/B,MAAM,CAAC;YACN,UAAU,EAAE,SAAS;YACrB,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC;aACD,UAAU,CAAC,CAAC,EAAO,EAAE,EAAE,CACtB,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC;YAClC,WAAW,EAAE,eAAe;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CACH;aACA,OAAO,EAAE,CAAC;QAEb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACvC,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,yBAAyB,CAC7B,SAAiB,EACjB,GAAoC;QAEpC,MAAM,QAAQ,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,QAAQ;aACX,UAAU,CAAC,2BAAmB,CAAC;aAC/B,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,SAAS,CAAC;aACnC,OAAO,EAAE,CAAC;QAEb,oBAAoB;QACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAED,mCAAmC;IACnC,UAAU;QACR,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;CACF;AArID,8CAqIC"}

package/dist/cjs/rlsFunctionRegistry.d.ts

@@ -0,0 +1,43 @@
+import type { CustomRlsFunction } from './types';
+/**
+ * Registry for custom RLS functions that can be used in permission rules
+ */
+declare class RlsFunctionRegistry {
+    private functions;
+    /**
+     * Register a custom RLS function
+     * @param name Unique name for the function
+     * @param fn The function implementation
+     */
+    register(name: string, fn: CustomRlsFunction): void;
+    /**
+     * Get a registered RLS function by name
+     * @param name Name of the function to retrieve
+     * @returns The function or undefined if not found
+     */
+    get(name: string): CustomRlsFunction | undefined;
+    /**
+     * Check if a function with the given name exists
+     * @param name Name to check
+     * @returns True if the function exists
+     */
+    has(name: string): boolean;
+    /**
+     * Remove a function from the registry
+     * @param name Name of the function to remove
+     * @returns True if the function was removed
+     */
+    unregister(name: string): boolean;
+    /**
+     * Clear all registered functions
+     */
+    clear(): void;
+    /**
+     * Get all registered function names
+     * @returns Array of function names
+     */
+    getRegisteredFunctionNames(): string[];
+}
+declare const rlsFunctionRegistry: RlsFunctionRegistry;
+export { rlsFunctionRegistry };
+//# sourceMappingURL=rlsFunctionRegistry.d.ts.map

package/dist/cjs/rlsFunctionRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rlsFunctionRegistry.d.ts","sourceRoot":"","sources":["../../src/rlsFunctionRegistry.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD;;GAEG;AACH,cAAM,mBAAmB;IACvB,OAAO,CAAC,SAAS,CAA6C;IAE9D;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,GAAG,IAAI;IAOnD;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIhD;;;;OAIG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;;OAIG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAIjC;;OAEG;IACH,KAAK,IAAI,IAAI;IAIb;;;OAGG;IACH,0BAA0B,IAAI,MAAM,EAAE;CAGvC;AAGD,QAAA,MAAM,mBAAmB,qBAA4B,CAAC;AAEtD,OAAO,EAAE,mBAAmB,EAAE,CAAC"}

package/dist/cjs/rlsFunctionRegistry.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rlsFunctionRegistry = void 0;
+/**
+ * Registry for custom RLS functions that can be used in permission rules
+ */
+class RlsFunctionRegistry {
+    constructor() {
+        this.functions = new Map();
+    }
+    /**
+     * Register a custom RLS function
+     * @param name Unique name for the function
+     * @param fn The function implementation
+     */
+    register(name, fn) {
+        if (this.functions.has(name)) {
+            console.warn(`RLS function "${name}" is being overwritten`);
+        }
+        this.functions.set(name, fn);
+    }
+    /**
+     * Get a registered RLS function by name
+     * @param name Name of the function to retrieve
+     * @returns The function or undefined if not found
+     */
+    get(name) {
+        return this.functions.get(name);
+    }
+    /**
+     * Check if a function with the given name exists
+     * @param name Name to check
+     * @returns True if the function exists
+     */
+    has(name) {
+        return this.functions.has(name);
+    }
+    /**
+     * Remove a function from the registry
+     * @param name Name of the function to remove
+     * @returns True if the function was removed
+     */
+    unregister(name) {
+        return this.functions.delete(name);
+    }
+    /**
+     * Clear all registered functions
+     */
+    clear() {
+        this.functions.clear();
+    }
+    /**
+     * Get all registered function names
+     * @returns Array of function names
+     */
+    getRegisteredFunctionNames() {
+        return Array.from(this.functions.keys());
+    }
+}
+// Create a singleton instance
+const rlsFunctionRegistry = new RlsFunctionRegistry();
+exports.rlsFunctionRegistry = rlsFunctionRegistry;
+//# sourceMappingURL=rlsFunctionRegistry.js.map

package/dist/cjs/rlsFunctionRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rlsFunctionRegistry.js","sourceRoot":"","sources":["../../src/rlsFunctionRegistry.ts"],"names":[],"mappings":";;;AAEA;;GAEG;AACH,MAAM,mBAAmB;IAAzB;QACU,cAAS,GAAmC,IAAI,GAAG,EAAE,CAAC;IAuDhE,CAAC;IArDC;;;;OAIG;IACH,QAAQ,CAAC,IAAY,EAAE,EAAqB;QAC1C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,iBAAiB,IAAI,wBAAwB,CAAC,CAAC;QAC9D,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,UAAU,CAAC,IAAY;QACrB,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;IAED;;OAEG;IACH,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;IAED;;;OAGG;IACH,0BAA0B;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3C,CAAC;CACF;AAED,8BAA8B;AAC9B,MAAM,mBAAmB,GAAG,IAAI,mBAAmB,EAAE,CAAC;AAE7C,kDAAmB"}

package/dist/cjs/rlsManager.d.ts

@@ -0,0 +1,23 @@
+import type { PermissionRule, UserContext } from './types';
+import { PermissionService } from './permissionService';
+import type { Kysely } from 'kysely';
+export declare function evaluatePermission(rules: PermissionRule[], userContext: UserContext, row?: Record<string, unknown>, db?: Kysely<any>): Promise<boolean>;
+/**
+ * Fast path: evaluate pre-extracted fieldCheck rules against a single row.
+ * Avoids the full enforcePermissions overhead (permission lookup, rule
+ * classification, array handling) when we already know we need a fieldCheck
+ * evaluation for one specific record.
+ */
+export declare function evaluateFieldCheckForRow(fieldCheckRules: PermissionRule[], userContext: UserContext, row: Record<string, unknown>, db?: Kysely<any>): Promise<boolean>;
+type Row = Record<string, unknown>;
+export declare function enforcePermissions(tableName: string, operation: 'SELECT' | 'INSERT' | 'UPDATE' | 'DELETE', userContext: UserContext, permissionService: PermissionService, rows?: Row | Row[], db?: Kysely<any>): Promise<{
+    row?: Row | Row[];
+    status: boolean;
+    message?: string;
+    hasFieldCheck: boolean;
+    hasCustomFunction: boolean;
+    fieldCheckRules?: PermissionRule[];
+    customFunctionRules?: PermissionRule[];
+}>;
+export {};
+//# sourceMappingURL=rlsManager.d.ts.map

package/dist/cjs/rlsManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rlsManager.d.ts","sourceRoot":"","sources":["../../src/rlsManager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,cAAc,EAEd,WAAW,EAEZ,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIrC,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,cAAc,EAAE,EACvB,WAAW,EAAE,WAAW,EACxB,GAAG,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,EACjC,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GACf,OAAO,CAAC,OAAO,CAAC,CAiMlB;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,eAAe,EAAE,cAAc,EAAE,EACjC,WAAW,EAAE,WAAW,EACxB,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC5B,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GACf,OAAO,CAAC,OAAO,CAAC,CAOlB;AAID,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEnC,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,EACpD,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,IAAI,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,EAClB,EAAE,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC,GACf,OAAO,CAAC;IACT,GAAG,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,CAAC,EAAE,cAAc,EAAE,CAAC;IACnC,mBAAmB,CAAC,EAAE,cAAc,EAAE,CAAC;CACxC,CAAC,CAwND"}

package/dist/cjs/rlsManager.js

@@ -0,0 +1,371 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluatePermission = evaluatePermission;
+exports.evaluateFieldCheckForRow = evaluateFieldCheckForRow;
+exports.enforcePermissions = enforcePermissions;
+const kysely_1 = require("kysely");
+const rlsFunctionRegistry_1 = require("./rlsFunctionRegistry");
+async function evaluatePermission(rules, userContext, row = {}, db) {
+    for (const rule of rules) {
+        switch (rule.allow) {
+            case 'public':
+                return true;
+            case 'private':
+                return false;
+            case 'role':
+                if (!rule.roles || rule.roles.length === 0) {
+                    // If no roles specified, continue to next rule
+                    continue;
+                }
+                if (rule.roles &&
+                    userContext.role &&
+                    rule.roles?.includes(userContext.role)) {
+                    return true;
+                }
+                // If we reach here, the role rule didn't match
+                // Continue to the next rule instead of returning false
+                continue;
+            case 'auth':
+                if (userContext.userId) {
+                    return true;
+                }
+                // If we reach here, the auth rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'guest':
+                if (!userContext.userId)
+                    return true;
+                // If we reach here, the guest rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'labels':
+                if (rule.labels !== undefined &&
+                    userContext.labels.some((label) => rule.labels && rule.labels.includes(label))) {
+                    return true;
+                }
+                // If we reach here, the labels rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'teams':
+                if (rule.teams !== undefined &&
+                    userContext.teams.some((team) => rule.teams && rule.teams.includes(team))) {
+                    return true;
+                }
+                // If we reach here, the teams rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'static':
+                if (typeof rule.static === 'boolean') {
+                    return rule.static;
+                }
+                // If we reach here, the static rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'fieldCheck':
+                if (rule.fieldCheck) {
+                    const { field, operator, valueType, value } = rule.fieldCheck;
+                    const dataValue = row[field];
+                    // console.log('Data value:', dataValue);
+                    const comparisonValue = valueType === 'userContext'
+                        ? userContext[value]
+                        : value;
+                    switch (operator) {
+                        case '===':
+                            if (dataValue === comparisonValue)
+                                return true;
+                            break;
+                        case '!==':
+                            if (dataValue !== comparisonValue)
+                                return true;
+                            break;
+                        case 'in':
+                            if (Array.isArray(comparisonValue) &&
+                                comparisonValue.includes(dataValue)) {
+                                return true;
+                            }
+                            break;
+                        case 'notIn':
+                            if (Array.isArray(comparisonValue) &&
+                                !comparisonValue.includes(dataValue)) {
+                                return true;
+                            }
+                            break;
+                    }
+                }
+                // If we reach here, the fieldCheck rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'customSql':
+                if (rule.customSql && db) {
+                    try {
+                        // Replace placeholders with userContext values
+                        const parsedSql = rule.customSql.replace(/:([a-zA-Z_]+)/g, (_match, key) => {
+                            if (userContext[key] === undefined) {
+                                throw new Error(`Missing context value for key: ${key}`);
+                            }
+                            // For SQL parameters, we need to handle different types appropriately
+                            const value = userContext[key];
+                            if (typeof value === 'string') {
+                                return `'${value.replace(/'/g, "''")}'`; // Escape single quotes for SQL
+                            }
+                            else if (value === null) {
+                                return 'NULL';
+                            }
+                            else if (Array.isArray(value)) {
+                                // Convert array to SQL array format
+                                return `(${value
+                                    .map((item) => {
+                                    if (typeof item === 'string')
+                                        return `'${item.replace(/'/g, "''")}'`;
+                                    return item;
+                                })
+                                    .join(', ')})`;
+                            }
+                            return String(value);
+                        });
+                        // console.log(`Executing custom SQL: ${parsedSql}`);
+                        // Execute the SQL query
+                        // Kysely sql.raw returns a builder, we need to execute it.
+                        const result = await kysely_1.sql.raw(parsedSql).execute(db);
+                        const rows = result.rows;
+                        // Check if the query returned any rows or a truthy value
+                        // Kysely result.rows is array of rows
+                        return rows.length > 0;
+                    }
+                    catch (error) {
+                        console.error(`Error executing custom SQL:`, error);
+                        return false;
+                    }
+                }
+                // If we reach here, the customSql rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+            case 'customFunction':
+                if (rule.customFunction) {
+                    try {
+                        // Get the function from the registry
+                        const customFn = rlsFunctionRegistry_1.rlsFunctionRegistry.get(rule.customFunction);
+                        if (!customFn) {
+                            console.error(`Custom RLS function "${rule.customFunction}" not found in registry`);
+                            return false;
+                        }
+                        // Execute the custom function with userContext and row data
+                        const result = await Promise.resolve(customFn(userContext, row, db));
+                        return !!result;
+                    }
+                    catch (error) {
+                        console.error(`Error executing custom RLS function "${rule.customFunction}":`, error);
+                        return false;
+                    }
+                }
+                // If we reach here, the customFunction rule didn't match
+                // Continue to the next rule instead of breaking
+                continue;
+        }
+    }
+    return false;
+}
+/**
+ * Fast path: evaluate pre-extracted fieldCheck rules against a single row.
+ * Avoids the full enforcePermissions overhead (permission lookup, rule
+ * classification, array handling) when we already know we need a fieldCheck
+ * evaluation for one specific record.
+ */
+async function evaluateFieldCheckForRow(fieldCheckRules, userContext, row, db) {
+    for (const rule of fieldCheckRules) {
+        if (await evaluatePermission([rule], userContext, row, db)) {
+            return true;
+        }
+    }
+    return false;
+}
+const CHUNK_SIZE = 1000;
+async function enforcePermissions(tableName, operation, userContext, permissionService, rows, db) {
+    // Try sync cache lookup first to avoid async overhead on cache hits
+    const tablePermissions = (permissionService.getPermissionsForTableSync(tableName) ??
+        (await permissionService.getPermissionsForTable(tableName)));
+    if (!tablePermissions) {
+        return {
+            row: rows,
+            status: false,
+            message: `No permissions defined for table "${tableName}"`,
+            hasFieldCheck: false,
+            hasCustomFunction: false,
+        };
+    }
+    if (!tablePermissions?.operations?.[operation]) {
+        return {
+            row: rows,
+            status: false,
+            message: `No permissions defined for operation "${operation}" on table "${tableName}"`,
+            hasFieldCheck: false,
+            hasCustomFunction: false,
+        };
+    }
+    const rules = tablePermissions.operations[operation];
+    // Early return if no rules
+    if (!rules || rules.length === 0) {
+        return {
+            row: rows,
+            status: true,
+            hasFieldCheck: false,
+            hasCustomFunction: false,
+        };
+    }
+    // Single-pass rule classification (avoids 3× Array.filter)
+    const fieldCheckRules = [];
+    const customFunctionRules = [];
+    const simpleRules = [];
+    for (const rule of rules) {
+        if (rule.allow === 'fieldCheck')
+            fieldCheckRules.push(rule);
+        else if (rule.allow === 'customFunction')
+            customFunctionRules.push(rule);
+        else
+            simpleRules.push(rule);
+    }
+    // First check simple rules that don't need row data
+    if (simpleRules.length > 0) {
+        // Check each rule and find the first one that grants access
+        for (const rule of simpleRules) {
+            const hasAccess = await evaluatePermission([rule], userContext, {}, db);
+            if (hasAccess) {
+                return {
+                    row: rows,
+                    status: true,
+                    hasFieldCheck: false,
+                    hasCustomFunction: false,
+                };
+            }
+        }
+    }
+    // Check customFunction rules if no simple rules matched
+    // These need row data like fieldCheck rules
+    if (customFunctionRules.length > 0) {
+        // If no rows provided but we need to check with custom functions, return early
+        if (!rows) {
+            return {
+                row: undefined,
+                status: false,
+                hasFieldCheck: false,
+                hasCustomFunction: true,
+                fieldCheckRules,
+                customFunctionRules,
+                message: 'Custom function check required, please provide row data',
+            };
+        }
+        // Handle array of rows
+        if (Array.isArray(rows)) {
+            const result = [];
+            for (let i = 0; i < rows.length; i += CHUNK_SIZE) {
+                const chunk = rows.slice(i, i + CHUNK_SIZE);
+                // Filter rows based on custom function rules
+                const filteredChunk = [];
+                for (const row of chunk) {
+                    // Check each row against all custom function rules
+                    for (const rule of customFunctionRules) {
+                        const hasAccess = await evaluatePermission([rule], userContext, row, db);
+                        if (hasAccess) {
+                            filteredChunk.push(row);
+                            break; // Move to the next row once we find a rule that grants access
+                        }
+                    }
+                }
+                result.push(...filteredChunk);
+            }
+            // If any rows passed the custom function checks, return success
+            if (result.length > 0) {
+                return {
+                    row: result,
+                    status: true,
+                    hasFieldCheck: false,
+                    hasCustomFunction: false,
+                };
+            }
+        }
+        else {
+            // Handle single row
+            for (const rule of customFunctionRules) {
+                const hasAccess = await evaluatePermission([rule], userContext, rows, db);
+                if (hasAccess) {
+                    return {
+                        row: rows,
+                        status: true,
+                        hasFieldCheck: false,
+                        hasCustomFunction: false,
+                    };
+                }
+            }
+        }
+    }
+    // If we reach here, no non-fieldCheck rules passed
+    // Check if we have fieldCheck rules
+    if (fieldCheckRules.length > 0) {
+        // If no rows provided but we need to check fields, return early
+        if (!rows) {
+            return {
+                row: undefined,
+                status: false,
+                hasFieldCheck: true,
+                hasCustomFunction: false,
+                fieldCheckRules,
+                customFunctionRules,
+                message: 'Field-level check required, please provide row data',
+            };
+        }
+        // Handle array of rows
+        if (Array.isArray(rows)) {
+            const result = [];
+            for (let i = 0; i < rows.length; i += CHUNK_SIZE) {
+                const chunk = rows.slice(i, i + CHUNK_SIZE);
+                // Filter rows based on field check rules
+                const filteredChunk = [];
+                for (const row of chunk) {
+                    // Check each row against all field check rules
+                    for (const rule of fieldCheckRules) {
+                        const hasAccess = await evaluatePermission([rule], userContext, row, db);
+                        if (hasAccess) {
+                            filteredChunk.push(row);
+                            break; // Move to the next row once we find a rule that grants access
+                        }
+                    }
+                }
+                result.push(...filteredChunk);
+            }
+            return {
+                row: result,
+                status: result.length > 0,
+                hasFieldCheck: false,
+                hasCustomFunction: false,
+                message: result.length === 0
+                    ? 'No rows matched the field-level permission rules'
+                    : undefined,
+            };
+        }
+        // Handle single row
+        let hasFieldAccess = false;
+        for (const rule of fieldCheckRules) {
+            hasFieldAccess = await evaluatePermission([rule], userContext, rows, db);
+            if (hasFieldAccess)
+                break;
+        }
+        return {
+            row: rows,
+            status: hasFieldAccess,
+            hasFieldCheck: false,
+            hasCustomFunction: false,
+            message: !hasFieldAccess
+                ? `User does not have field-level permission to perform operation "${operation}" on table "${tableName}"`
+                : undefined,
+        };
+    }
+    // If we reach here, no rules passed
+    return {
+        row: rows,
+        status: false,
+        hasFieldCheck: false,
+        hasCustomFunction: false,
+        message: `User does not have permission to perform operation "${operation}" on table "${tableName}"`,
+    };
+}
+//# sourceMappingURL=rlsManager.js.map