@gencow/core 0.1.19 → 0.1.21

package/src/__tests__/fixtures/basic/migrations/meta/0000_snapshot.json

@@ -0,0 +1,438 @@
+{
+  "id": "5dae5382-aa29-4251-9a52-0df4786c5100",
+  "prevId": "00000000-0000-0000-0000-000000000000",
+  "version": "7",
+  "dialect": "postgresql",
+  "tables": {
+    "public.tasks": {
+      "name": "tasks",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "title": {
+          "name": "title",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "description": {
+          "name": "description",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "done": {
+          "name": "done",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "tasks_user_id_user_id_fk": {
+          "name": "tasks_user_id_user_id_fk",
+          "tableFrom": "tasks",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {
+        "rls-select": {
+          "name": "rls-select",
+          "as": "PERMISSIVE",
+          "for": "SELECT",
+          "to": [
+            "public"
+          ],
+          "using": "\"tasks\".\"user_id\" = current_setting('app.current_user_id', true)"
+        },
+        "rls-insert": {
+          "name": "rls-insert",
+          "as": "PERMISSIVE",
+          "for": "INSERT",
+          "to": [
+            "public"
+          ],
+          "withCheck": "\"tasks\".\"user_id\" = current_setting('app.current_user_id', true)"
+        },
+        "rls-update": {
+          "name": "rls-update",
+          "as": "PERMISSIVE",
+          "for": "UPDATE",
+          "to": [
+            "public"
+          ],
+          "using": "\"tasks\".\"user_id\" = current_setting('app.current_user_id', true)",
+          "withCheck": "\"tasks\".\"user_id\" = current_setting('app.current_user_id', true)"
+        },
+        "rls-delete": {
+          "name": "rls-delete",
+          "as": "PERMISSIVE",
+          "for": "DELETE",
+          "to": [
+            "public"
+          ],
+          "using": "\"tasks\".\"user_id\" = current_setting('app.current_user_id', true)"
+        }
+      },
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.user": {
+      "name": "user",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "name": {
+          "name": "name",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email": {
+          "name": "email",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "email_verified": {
+          "name": "email_verified",
+          "type": "boolean",
+          "primaryKey": false,
+          "notNull": true,
+          "default": false
+        },
+        "image": {
+          "name": "image",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "user_email_unique": {
+          "name": "user_email_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "email"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.account": {
+      "name": "account",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "account_id": {
+          "name": "account_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "provider_id": {
+          "name": "provider_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "access_token": {
+          "name": "access_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token": {
+          "name": "refresh_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "id_token": {
+          "name": "id_token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "access_token_expires_at": {
+          "name": "access_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "refresh_token_expires_at": {
+          "name": "refresh_token_expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "scope": {
+          "name": "scope",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "password": {
+          "name": "password",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "account_user_id_user_id_fk": {
+          "name": "account_user_id_user_id_fk",
+          "tableFrom": "account",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.session": {
+      "name": "session",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "token": {
+          "name": "token",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true,
+          "default": "now()"
+        },
+        "ip_address": {
+          "name": "ip_address",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_agent": {
+          "name": "user_agent",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": false
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {
+        "session_user_id_user_id_fk": {
+          "name": "session_user_id_user_id_fk",
+          "tableFrom": "session",
+          "tableTo": "user",
+          "columnsFrom": [
+            "user_id"
+          ],
+          "columnsTo": [
+            "id"
+          ],
+          "onDelete": "cascade",
+          "onUpdate": "no action"
+        }
+      },
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {
+        "session_token_unique": {
+          "name": "session_token_unique",
+          "nullsNotDistinct": false,
+          "columns": [
+            "token"
+          ]
+        }
+      },
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    },
+    "public.verification": {
+      "name": "verification",
+      "schema": "",
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "text",
+          "primaryKey": true,
+          "notNull": true
+        },
+        "identifier": {
+          "name": "identifier",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "value": {
+          "name": "value",
+          "type": "text",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "expires_at": {
+          "name": "expires_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": true
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "now()"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamp",
+          "primaryKey": false,
+          "notNull": false,
+          "default": "now()"
+        }
+      },
+      "indexes": {},
+      "foreignKeys": {},
+      "compositePrimaryKeys": {},
+      "uniqueConstraints": {},
+      "policies": {},
+      "checkConstraints": {},
+      "isRLSEnabled": false
+    }
+  },
+  "enums": {},
+  "schemas": {},
+  "sequences": {},
+  "roles": {},
+  "policies": {},
+  "views": {},
+  "_meta": {
+    "columns": {},
+    "schemas": {},
+    "tables": {}
+  }
+}

package/src/__tests__/fixtures/basic/migrations/meta/_journal.json

@@ -0,0 +1,13 @@
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1776143474320,
+      "tag": "0000_faithful_silver_sable",
+      "breakpoints": true
+    }
+  ]
+}

package/src/__tests__/fixtures/basic/schema.ts

@@ -0,0 +1,35 @@
+/**
+ * gencow/schema.ts — Task App 스키마
+ *
+ * 🔒 Secure by Default:
+ *   - pgTable + ownerRls + crud로 사용자별 데이터 자동 격리
+ *   - onDelete: "cascade"로 유저 삭제 시 관련 데이터 자동 정리
+ *
+ * 변경 후: gencow dev가 자동 반영
+ */
+import { ownerRls } from "../../../rls";
+import { pgTable } from "drizzle-orm/pg-core";
+import { text, boolean, timestamp } from "drizzle-orm/pg-core";
+import { user } from "../common/auth-schema";
+import { v4 as uuidv4 } from "uuid";
+
+export { user } from "../common/auth-schema";
+
+export const tasks = pgTable(
+  "tasks",
+  {
+    id: text("id")
+      .primaryKey()
+      .$defaultFn(() => uuidv4()),
+    title: text("title").notNull(),
+    description: text("description"),
+    done: boolean("done").default(false).notNull(),
+    // 🔒 RLS (Role-Level Security)
+    userId: text("user_id")
+      .notNull()
+      .references(() => user.id, { onDelete: "cascade" }),
+    createdAt: timestamp("created_at").defaultNow().notNull(),
+    updatedAt: timestamp("updated_at").defaultNow().notNull(),
+  },
+  (t) => ownerRls(t.userId)
+);

package/src/__tests__/fixtures/basic/tasks.ts

@@ -0,0 +1,15 @@
+/**
+ * gencow/tasks.ts — Task CRUD (Zero-Boilerplate Pattern)
+ *
+ * 🔒 Secure by Default:
+ *   - ctx.db uses RLS (Row-Level Security) — auto-filters by userId
+ *   - crud auto-registers query/mutation with auth + realtime
+ */
+import { crud } from "../../../crud";
+import { tasks } from "./schema";
+
+// 자동 생성: list, get, create, update, remove (query + mutation + auth + realtime)
+export const { list, get, create, update, remove } = crud(tasks, {
+    searchFields: ["title", "description"],
+    defaultLimit: 50,
+});

package/src/__tests__/fixtures/common/auth-schema.ts

@@ -0,0 +1,63 @@
+/**
+ * packages/server/src/auth-schema.ts
+ *
+ * better-auth가 사용하는 Drizzle 스키마 테이블 정의.
+ * better-auth는 user, session, account, verification 4개 테이블을 필요로 합니다.
+ *
+ * @see https://www.better-auth.com/docs/adapters/drizzle
+ */
+import { pgTable, text, boolean, timestamp } from "drizzle-orm/pg-core";
+
+// ─── user 테이블 ────────────────────────────────────────
+
+export const user = pgTable("user", {
+    id: text("id").primaryKey(),
+    name: text("name").notNull(),
+    email: text("email").notNull().unique(),
+    emailVerified: boolean("email_verified").notNull().default(false),
+    image: text("image"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+// ─── session 테이블 ─────────────────────────────────────
+
+export const session = pgTable("session", {
+    id: text("id").primaryKey(),
+    expiresAt: timestamp("expires_at").notNull(),
+    token: text("token").notNull().unique(),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+    ipAddress: text("ip_address"),
+    userAgent: text("user_agent"),
+    userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+});
+
+// ─── account 테이블 ─────────────────────────────────────
+
+export const account = pgTable("account", {
+    id: text("id").primaryKey(),
+    accountId: text("account_id").notNull(),
+    providerId: text("provider_id").notNull(),
+    userId: text("user_id").notNull().references(() => user.id, { onDelete: "cascade" }),
+    accessToken: text("access_token"),
+    refreshToken: text("refresh_token"),
+    idToken: text("id_token"),
+    accessTokenExpiresAt: timestamp("access_token_expires_at"),
+    refreshTokenExpiresAt: timestamp("refresh_token_expires_at"),
+    scope: text("scope"),
+    password: text("password"),
+    createdAt: timestamp("created_at").notNull().defaultNow(),
+    updatedAt: timestamp("updated_at").notNull().defaultNow(),
+});
+
+// ─── verification 테이블 ────────────────────────────────
+
+export const verification = pgTable("verification", {
+    id: text("id").primaryKey(),
+    identifier: text("identifier").notNull(),
+    value: text("value").notNull(),
+    expiresAt: timestamp("expires_at").notNull(),
+    createdAt: timestamp("created_at").defaultNow(),
+    updatedAt: timestamp("updated_at").defaultNow(),
+});

package/src/__tests__/helpers/pglite-migrations.ts

@@ -0,0 +1,35 @@
+import { readFileSync, readdirSync } from "fs";
+import { join } from "path";
+import type { PGlite } from "@electric-sql/pglite";
+
+function listMigrationSqlFiles(migrationsDir: string): string[] {
+  return readdirSync(migrationsDir)
+    .filter((f) => f.endsWith(".sql"))
+    .sort()
+    .map((f) => join(migrationsDir, f));
+}
+
+/**
+ * Apply Drizzle-generated SQL from a folder of `.sql` files (split on `--> statement-breakpoint`).
+ */
+export async function loadAndApplyMigrations(
+  client: PGlite,
+  migrationsDir: string
+): Promise<void> {
+  const files = listMigrationSqlFiles(migrationsDir);
+  if (files.length === 0) {
+    throw new Error(
+      `No .sql migration files in ${migrationsDir} (generate migrations with your Drizzle workflow)`
+    );
+  }
+  for (const filePath of files) {
+    const raw = readFileSync(filePath, "utf8");
+    const chunks = raw
+      .split(/--> statement-breakpoint/g)
+      .map((s) => s.trim())
+      .filter(Boolean);
+    for (const sqlChunk of chunks) {
+      await client.exec(sqlChunk);
+    }
+  }
+}

package/src/__tests__/helpers/pglite-rls-session.ts

@@ -0,0 +1,54 @@
+import type { PGlite } from "@electric-sql/pglite";
+
+/** Default role used in PGlite tests when you need RLS to apply (session user must not own the tables). */
+export const DEFAULT_PGLITE_RLS_APP_ROLE = "gencow_rls_app";
+
+function quoteIdent(name: string): string {
+    if (!/^[a-z_][a-z0-9_]*$/i.test(name)) {
+        throw new Error(`Invalid SQL identifier: ${name}`);
+    }
+    return `"${name.replace(/"/g, '""')}"`;
+}
+
+/**
+ * After migrations (and optional seed as the bootstrap user), create a non-superuser role and grant
+ * DML on `public` so queries run as **non-owner** → PostgreSQL applies RLS policies without
+ * `FORCE ROW LEVEL SECURITY`.
+ *
+ * Omits `GRANT CONNECT ON DATABASE` — PGlite’s default DB can be `template1` and that grant has
+ * caused engine errors; schema/table privileges are enough for the embedded single-connection case.
+ *
+ * Call {@link setPgliteSessionRole} on the same `PGlite` instance before running app queries.
+ */
+export async function createPgliteRlsAppRole(
+    client: PGlite,
+    options?: { roleName?: string }
+): Promise<string> {
+    const roleName = options?.roleName ?? DEFAULT_PGLITE_RLS_APP_ROLE;
+    const role = quoteIdent(roleName);
+
+    await client.exec(`
+CREATE ROLE ${role} LOGIN;
+GRANT USAGE ON SCHEMA public TO ${role};
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO ${role};
+GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO ${role};
+`);
+
+    return roleName;
+}
+
+/**
+ * Run follow-up queries in this session as the given role (must not be table owner so RLS applies).
+ * The bootstrap user must be allowed to `SET ROLE` (e.g. superuser, or `GRANT rls_role TO bootstrap`).
+ */
+export async function setPgliteSessionRole(
+    client: PGlite,
+    roleName: string
+): Promise<void> {
+    await client.exec(`SET ROLE ${quoteIdent(roleName)}`);
+}
+
+/** Restore session user to the original login role (typically the PGlite bootstrap user). */
+export async function resetPgliteSessionRole(client: PGlite): Promise<void> {
+    await client.exec("RESET ROLE");
+}