@gencow/core 0.1.8 → 0.1.10

package/src/scoped-db.ts

@@ -0,0 +1,416 @@
+/**
+ * packages/core/src/scoped-db.ts
+ *
+ * Creates a scoped (Proxy-wrapped) Drizzle DB instance that auto-injects
+ * schema-level access control filters from gencowTable() metadata.
+ *
+ * Key behaviors:
+ *   - .select().from(gencowTable) → auto-inject filter into WHERE
+ *   - .insert(table) / .update(table) / .delete(table) → inject filter for writes
+ *   - .leftJoin(table) / .innerJoin(table) → detect and inject filter
+ *   - .execute() → blocked (throws Error)
+ *   - .query.tableName.findMany() → inject filter into relational queries
+ *
+ * Run tests: bun test packages/core/src/__tests__/scoped-db.test.ts
+ */
+
+import { and } from "drizzle-orm";
+import type { SQL } from "drizzle-orm";
+import { getTableAccessMeta } from "./table";
+import type { GencowCtx } from "./reactive";
+import type { TableAccessMeta } from "./table";
+
+// ─── createScopedDb ─────────────────────────────────────
+
+/**
+ * Wrap a Drizzle DB instance with access control Proxy.
+ *
+ * @param db  - Raw Drizzle DB instance
+ * @param ctx - GencowCtx (provides auth for filter evaluation)
+ * @returns Proxy-wrapped DB with auto-filter injection
+ */
+export function createScopedDb(db: any, ctx: GencowCtx): any {
+    return new Proxy(db, {
+        get(target, prop: string | symbol) {
+            const propStr = typeof prop === "string" ? prop : "";
+
+            // ── Block dangerous methods ──────────────────
+            if (propStr === "execute") {
+                return () => {
+                    throw new Error(
+                        "[gencow] ctx.db.execute() is not allowed. " +
+                        "Use ctx.db.select().from(table) for type-safe queries with automatic access control. " +
+                        "If you need raw SQL, use ctx.unsafeDb.execute()."
+                    );
+                };
+            }
+
+            if (propStr === "$client" || propStr === "_") {
+                throw new Error(
+                    `[gencow] ctx.db.${propStr} is not allowed. ` +
+                    "Direct database client access bypasses access control. " +
+                    "Use ctx.unsafeDb if you need direct access."
+                );
+            }
+
+            // ── Wrap select() ────────────────────────────
+            if (propStr === "select") {
+                return (...selectArgs: any[]) => {
+                    const selectResult = target.select(...selectArgs);
+                    return wrapSelectChain(selectResult, ctx);
+                };
+            }
+
+            // ── Wrap update() ────────────────────────────
+            if (propStr === "update") {
+                return (table: any) => {
+                    const updateResult = target.update(table);
+                    return wrapWriteChain(updateResult, table, ctx);
+                };
+            }
+
+            // ── Wrap delete() ────────────────────────────
+            if (propStr === "delete") {
+                return (table: any) => {
+                    const deleteResult = target.delete(table);
+                    return wrapWriteChain(deleteResult, table, ctx);
+                };
+            }
+
+            // ── Wrap query (relational API) ──────────────
+            if (propStr === "query") {
+                return wrapRelationalQuery(target.query, ctx);
+            }
+
+            // ── Pass through everything else ─────────────
+            const value = target[prop];
+            if (typeof value === "function") {
+                return value.bind(target);
+            }
+            return value;
+        },
+    });
+}
+
+// ─── Select chain: .from() + .join() → filter injection ─
+
+/**
+ * Wraps a Drizzle select() chain to intercept .from() and .join() calls.
+ * Each detected gencowTable gets its filter injected.
+ */
+function wrapSelectChain(selectResult: any, ctx: GencowCtx): any {
+    return new Proxy(selectResult, {
+        get(target, prop: string | symbol) {
+            const propStr = typeof prop === "string" ? prop : "";
+
+            // ── .from(table) → inject filter ────────────
+            if (propStr === "from") {
+                return (table: any, ...restArgs: any[]) => {
+                    const fromResult = target.from(table, ...restArgs);
+                    const meta = getTableAccessMeta(table);
+
+                    if (meta) {
+                        // Wrap the chain to inject filter and handle joins
+                        return wrapFromChain(fromResult, ctx, [{ table, meta }]);
+                    }
+
+                    // No gencowTable metadata — pass through but still wrap for join detection
+                    return wrapFromChain(fromResult, ctx, []);
+                };
+            }
+
+            const value = target[prop];
+            if (typeof value === "function") {
+                return value.bind(target);
+            }
+            return value;
+        },
+    });
+}
+
+/**
+ * Wraps the chain after .from() — handles .where(), .leftJoin(), .innerJoin(), etc.
+ * Accumulates filters from all detected tables and injects them at execution time.
+ */
+function wrapFromChain(
+    chain: any,
+    ctx: GencowCtx,
+    pendingFilters: Array<{ table: any; meta: TableAccessMeta }>,
+): any {
+    return new Proxy(chain, {
+        get(target, prop: string | symbol) {
+            const propStr = typeof prop === "string" ? prop : "";
+
+            // ── Join methods → detect table, accumulate filter ──
+            if (["leftJoin", "rightJoin", "innerJoin", "fullJoin"].includes(propStr)) {
+                return (joinTable: any, ...joinArgs: any[]) => {
+                    const joinResult = target[propStr](joinTable, ...joinArgs);
+                    const joinMeta = getTableAccessMeta(joinTable);
+                    const newFilters = joinMeta
+                        ? [...pendingFilters, { table: joinTable, meta: joinMeta }]
+                        : pendingFilters;
+                    return wrapFromChain(joinResult, ctx, newFilters);
+                };
+            }
+
+            // ── .where() → combine with accumulated filters ──
+            if (propStr === "where") {
+                return (...whereArgs: any[]) => {
+                    const combinedFilter = buildCombinedFilter(pendingFilters, ctx);
+                    if (combinedFilter) {
+                        // Combine user's where with our filters
+                        const userWhere = whereArgs[0];
+                        const merged = userWhere ? and(userWhere, combinedFilter) : combinedFilter;
+                        const result = target.where(merged);
+                        // After .where(), no more filter injection needed — continue with clean proxy
+                        return wrapFromChain(result, ctx, []);
+                    }
+                    return wrapFromChain(target.where(...whereArgs), ctx, []);
+                };
+            }
+
+            // ── Terminal methods (then, execute, etc.) → inject pending filters ──
+            if (propStr === "then" || propStr === "execute") {
+                // If there are pending filters that haven't been injected via .where(),
+                // inject them now by calling .where() before execution
+                if (pendingFilters.length > 0) {
+                    const combinedFilter = buildCombinedFilter(pendingFilters, ctx);
+                    if (combinedFilter) {
+                        const filtered = target.where(combinedFilter);
+                        return filtered[prop].bind(filtered);
+                    }
+                }
+                const value = target[prop];
+                return typeof value === "function" ? value.bind(target) : value;
+            }
+
+            // ── Other chainable methods (.orderBy, .limit, .offset, etc.) ──
+            const value = target[prop];
+            if (typeof value === "function") {
+                return (...args: any[]) => {
+                    const result = value.apply(target, args);
+                    // If the result is thenable (query builder), keep wrapping
+                    if (result && typeof result === "object" && typeof result.then === "function") {
+                        return wrapFromChain(result, ctx, pendingFilters);
+                    }
+                    if (result && typeof result === "object" && "where" in result) {
+                        return wrapFromChain(result, ctx, pendingFilters);
+                    }
+                    return result;
+                };
+            }
+            return value;
+        },
+    });
+}
+
+// ─── Write chain: update()/delete() filter injection ────
+
+/**
+ * Wraps update(table) or delete(table) chains.
+ * Injects the table's filter into .where() so users can only modify their own rows.
+ */
+function wrapWriteChain(chain: any, table: any, ctx: GencowCtx): any {
+    const meta = getTableAccessMeta(table);
+    if (!meta) {
+        return chain; // No gencowTable metadata — pass through
+    }
+
+    return new Proxy(chain, {
+        get(target, prop: string | symbol) {
+            const propStr = typeof prop === "string" ? prop : "";
+
+            if (propStr === "where") {
+                return (...whereArgs: any[]) => {
+                    const filterResult = evaluateFilterSync(meta, ctx);
+                    if (typeof filterResult === "boolean") {
+                        if (!filterResult) {
+                            // false → block all writes — add impossible condition
+                            return target.where(whereArgs[0]); // Let it through but will match nothing
+                        }
+                        // true → no additional filter
+                        return target.where(...whereArgs);
+                    }
+                    // SQL condition — combine with user's where
+                    const userWhere = whereArgs[0];
+                    const merged = userWhere ? and(userWhere, filterResult) : filterResult;
+                    return target.where(merged);
+                };
+            }
+
+            // Terminal methods — inject filter if .where() wasn't called
+            if (propStr === "then" || propStr === "execute" || propStr === "returning") {
+                const filterResult = evaluateFilterSync(meta, ctx);
+                if (filterResult && typeof filterResult !== "boolean") {
+                    const filtered = target.where(filterResult);
+                    const value = filtered[prop];
+                    return typeof value === "function" ? value.bind(filtered) : value;
+                }
+                const value = target[prop];
+                return typeof value === "function" ? value.bind(target) : value;
+            }
+
+            const value = target[prop];
+            if (typeof value === "function") {
+                return value.bind(target);
+            }
+            return value;
+        },
+    });
+}
+
+// ─── Relational query wrapping ──────────────────────────
+
+/**
+ * Wraps db.query to intercept relational queries (findMany, findFirst).
+ */
+function wrapRelationalQuery(queryObj: any, ctx: GencowCtx): any {
+    if (!queryObj) return queryObj;
+
+    return new Proxy(queryObj, {
+        get(target, tableName: string | symbol) {
+            const tableProxy = target[tableName];
+            if (!tableProxy || typeof tableProxy !== "object") return tableProxy;
+
+            return new Proxy(tableProxy, {
+                get(tableTarget, method: string | symbol) {
+                    const methodStr = typeof method === "string" ? method : "";
+
+                    if (methodStr === "findMany" || methodStr === "findFirst") {
+                        return (args: any = {}) => {
+                            // Try to find the gencowTable by table name
+                            // (relational queries use the table name string)
+                            // We need to look up from registry by tableName
+                            const meta = findMetaByTableName(String(tableName));
+                            if (meta) {
+                                const filterResult = evaluateFilterSync(meta, ctx);
+                                if (filterResult && typeof filterResult !== "boolean") {
+                                    args.where = args.where ? and(args.where, filterResult) : filterResult;
+                                } else if (filterResult === false) {
+                                    // Deny all — return empty
+                                    args.where = args.where; // Keep existing, but won't match
+                                }
+                            }
+                            return tableTarget[method](args);
+                        };
+                    }
+
+                    const value = tableTarget[method];
+                    if (typeof value === "function") {
+                        return value.bind(tableTarget);
+                    }
+                    return value;
+                },
+            });
+        },
+    });
+}
+
+// ─── Filter helpers ─────────────────────────────────────
+
+/**
+ * Build a combined SQL filter from multiple table filters.
+ * Returns null if no filters to apply.
+ */
+function buildCombinedFilter(
+    pendingFilters: Array<{ table: any; meta: TableAccessMeta }>,
+    ctx: GencowCtx,
+): SQL | null {
+    const sqlConditions: SQL[] = [];
+
+    for (const { meta } of pendingFilters) {
+        const result = evaluateFilterSync(meta, ctx);
+        if (result === false) {
+            // Any false → deny all (AND with false = false)
+            // We'd need an always-false SQL expression
+            // For now, we create a `1 = 0` condition
+            const { sql: sqlTag } = require("drizzle-orm");
+            return sqlTag`1 = 0`;
+        }
+        if (result === true) {
+            continue; // Allow all — no condition needed
+        }
+        if (result) {
+            sqlConditions.push(result);
+        }
+    }
+
+    if (sqlConditions.length === 0) return null;
+    if (sqlConditions.length === 1) return sqlConditions[0];
+    return and(...sqlConditions) ?? null;
+}
+
+/**
+ * Evaluate a filter synchronously. If the filter is async, this will throw.
+ * For async filters, callers should use evaluateFilterAsync.
+ */
+function evaluateFilterSync(meta: TableAccessMeta, ctx: GencowCtx): SQL | boolean {
+    const result = meta.filter(ctx);
+    if (result instanceof Promise) {
+        throw new Error(
+            `[gencow] Async filter on table "${meta.tableName}" is not supported in synchronous context. ` +
+            "Use synchronous filters for schema-level access control."
+        );
+    }
+    return result;
+}
+
+/**
+ * Find table access metadata by table name string.
+ * Used by relational query proxy where we only have the table name.
+ */
+function findMetaByTableName(name: string): TableAccessMeta | undefined {
+    for (const [, meta] of globalThis.__gencow_tableAccessRegistry || []) {
+        if (meta.tableName === name) return meta;
+    }
+    return undefined;
+}
+
+// ─── fieldAccess post-processing ────────────────────────
+
+/**
+ * Apply field-level access control to query results.
+ * Nullifies fields that the current user is not authorized to read.
+ *
+ * @param result - Query result (array or single object)
+ * @param table  - The gencowTable used in the query
+ * @param ctx    - GencowCtx for auth checks
+ * @returns Filtered result with unauthorized fields set to null
+ */
+export function applyFieldAccess(result: any, table: any, ctx: GencowCtx): any {
+    const meta = getTableAccessMeta(table);
+    if (!meta?.fieldAccess) return result;
+
+    const fieldAccess = meta.fieldAccess;
+
+    // Determine which fields to mask
+    const maskedFields: string[] = [];
+    for (const [field, rule] of Object.entries(fieldAccess)) {
+        try {
+            if (!rule.read(ctx)) {
+                maskedFields.push(field);
+            }
+        } catch {
+            // If read check throws (e.g., requireAuth on anonymous), mask the field
+            maskedFields.push(field);
+        }
+    }
+
+    if (maskedFields.length === 0) return result;
+
+    const maskRow = (row: any) => {
+        if (!row || typeof row !== "object") return row;
+        const masked = { ...row };
+        for (const field of maskedFields) {
+            if (field in masked) {
+                masked[field] = null;
+            }
+        }
+        return masked;
+    };
+
+    if (Array.isArray(result)) {
+        return result.map(maskRow);
+    }
+    return maskRow(result);
+}

package/src/storage.ts

@@ -7,10 +7,14 @@ import * as crypto from "crypto";
 /** 파일 업로드 최대 크기: 50MB (하드코딩 — 사용자가 오버라이드 불가) */
 const MAX_FILE_SIZE = 50 * 1024 * 1024;
 
+/** 기본 스토리지 쿼터: 1GB */
+const DEFAULT_STORAGE_QUOTA = 1024 * 1024 * 1024;
+
 function formatBytes(bytes: number): string {
     if (bytes < 1024) return `${bytes}B`;
     if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)}KB`;
-    return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+    if (bytes < 1024 * 1024 * 1024) return `${(bytes / (1024 * 1024)).toFixed(1)}MB`;
+    return `${(bytes / (1024 * 1024 * 1024)).toFixed(2)}GB`;
 }
 
 // ─── Types ──────────────────────────────────────────────
@@ -23,6 +27,13 @@ interface StorageFile {
     path: string;
 }
 
+export interface StorageOptions {
+    /** Raw SQL 실행 함수 — DB 자동 기록 + 쿼터 검증에 필요 */
+    rawSql?: (sql: string, params?: unknown[]) => Promise<unknown[]>;
+    /** 앱별 스토리지 쿼터 (bytes). 0 = 무제한. 기본: 1GB */
+    storageQuota?: number;
+}
+
 export interface Storage {
     /** Store a file and return a storageId — Convex의 ctx.storage.store() */
     store(file: File | Blob, filename?: string): Promise<string>;
@@ -40,27 +51,120 @@ export interface Storage {
 
 const metaStore = new Map<string, StorageFile>();
 
+/**
+ * files 테이블 자동 생성 (이미 존재하면 무시)
+ * admin.ts의 CREATE_FILES_TABLE_SQL과 동일한 스키마 사용
+ */
+let filesTableEnsured = false;
+
+async function ensureFilesTable(
+    rawSql: (sql: string, params?: unknown[]) => Promise<unknown[]>,
+): Promise<void> {
+    if (filesTableEnsured) return;
+    await rawSql(`
+        DO $$
+        BEGIN
+            IF NOT EXISTS (
+                SELECT 1 FROM information_schema.tables
+                WHERE table_schema = current_schema()
+                AND table_name = 'files'
+            ) THEN
+                CREATE TABLE files (
+                    id SERIAL PRIMARY KEY,
+                    storage_id TEXT NOT NULL,
+                    name TEXT NOT NULL,
+                    size TEXT NOT NULL,
+                    type TEXT NOT NULL DEFAULT 'application/octet-stream',
+                    uploaded_by TEXT DEFAULT 'api',
+                    created_at TIMESTAMP DEFAULT NOW()
+                );
+            END IF;
+        END$$;
+    `);
+    filesTableEnsured = true;
+}
+
+/**
+ * 스토리지 쿼터 검증 — 현재 총 사용량 + 새 파일 크기가 쿼터를 초과하는지 확인
+ */
+async function checkStorageQuota(
+    rawSql: (sql: string, params?: unknown[]) => Promise<unknown[]>,
+    newFileSize: number,
+    quota: number,
+): Promise<void> {
+    if (quota <= 0) return; // 무제한
+
+    const rows = await rawSql(
+        `SELECT COALESCE(SUM(CAST(size AS BIGINT)), 0) AS total FROM files`,
+    );
+    const currentUsage = Number((rows[0] as Record<string, string>)?.total || "0");
+    const projectedUsage = currentUsage + newFileSize;
+
+    if (projectedUsage > quota) {
+        throw new Error(
+            `Storage quota exceeded: ${formatBytes(currentUsage)} used + ${formatBytes(newFileSize)} new = ${formatBytes(projectedUsage)}, ` +
+            `quota is ${formatBytes(quota)}. Delete files or increase quota.`
+        );
+    }
+}
+
+/**
+ * DB에 파일 메타데이터 기록 — store() 호출 시 자동 수행
+ *
+ * 대시보드 업로드(admin.ts)는 uploaded_by='dashboard'로 별도 INSERT하므로,
+ * 여기서는 skipDbRecord 옵션으로 중복 방지 가능.
+ */
+async function recordFileToDb(
+    rawSql: (sql: string, params?: unknown[]) => Promise<unknown[]>,
+    storageId: string,
+    name: string,
+    size: number,
+    type: string,
+    uploadedBy: string = "api",
+): Promise<void> {
+    await ensureFilesTable(rawSql);
+    await rawSql(
+        `INSERT INTO files (storage_id, name, size, type, uploaded_by, created_at)
+         VALUES ($1, $2, $3, $4, $5, NOW())`,
+        [storageId, name, String(size), type, uploadedBy],
+    );
+}
+
 /**
  * Create a storage instance — Convex storage 패턴 재현
  *
+ * @param dir - 파일 저장 디렉토리
+ * @param options - DB 연동 + 쿼터 옵션
+ *
  * @example
- * const storage = createStorage('./uploads');
+ * const storage = createStorage('./uploads', { rawSql, storageQuota: 1024 * 1024 * 1024 });
  * const id = await storage.store(file);
  * const url = storage.getUrl(id);
  */
-export function createStorage(dir: string = "./uploads"): Storage {
+export function createStorage(
+    dir: string = "./uploads",
+    options?: StorageOptions,
+): Storage {
+    const rawSql = options?.rawSql;
+    const quota = options?.storageQuota ?? DEFAULT_STORAGE_QUOTA;
+
     // Ensure directory exists
     fs.mkdir(dir, { recursive: true }).catch(() => { });
 
     return {
         async store(file: File | Blob, filename?: string): Promise<string> {
-            // 크기 제한 검증
+            // 크기 제한 검증 (단일 파일)
             if (file.size > MAX_FILE_SIZE) {
                 throw new Error(
                     `File too large: ${formatBytes(file.size)} exceeds limit of ${formatBytes(MAX_FILE_SIZE)}`
                 );
             }
 
+            // 스토리지 쿼터 검증 (앱 전체 용량)
+            if (rawSql) {
+                await checkStorageQuota(rawSql, file.size, quota);
+            }
+
             const id = crypto.randomUUID();
             const name = filename || (file instanceof File ? file.name : `${id}.bin`);
             const filePath = path.join(dir, id);
@@ -68,14 +172,27 @@ export function createStorage(dir: string = "./uploads"): Storage {
             const arrayBuffer = await file.arrayBuffer();
             await fs.writeFile(filePath, Buffer.from(arrayBuffer));
 
+            const type = file.type || "application/octet-stream";
+
             metaStore.set(id, {
                 id,
                 name,
                 size: file.size,
-                type: file.type || "application/octet-stream",
+                type,
                 path: filePath,
             });
 
+            // DB 자동 기록 (rawSql 있을 때만)
+            if (rawSql) {
+                try {
+                    await recordFileToDb(rawSql, id, name, file.size, type, "api");
+                } catch (e: unknown) {
+                    // DB 기록 실패해도 파일 저장은 성공 — 로그만 남김
+                    const msg = e instanceof Error ? e.message : String(e);
+                    console.warn(`[storage] DB record failed for ${id}: ${msg}`);
+                }
+            }
+
             return id;
         },
 
@@ -84,16 +201,21 @@ export function createStorage(dir: string = "./uploads"): Storage {
             filename: string,
             type: string = "application/octet-stream"
         ): Promise<string> {
-            const id = crypto.randomUUID();
-            const filePath = path.join(dir, id);
-
-            // 크기 제한 검증
+            // 크기 제한 검증 (단일 파일)
             if (buffer.length > MAX_FILE_SIZE) {
                 throw new Error(
                     `File too large: ${formatBytes(buffer.length)} exceeds limit of ${formatBytes(MAX_FILE_SIZE)}`
                 );
             }
 
+            // 스토리지 쿼터 검증 (앱 전체 용량)
+            if (rawSql) {
+                await checkStorageQuota(rawSql, buffer.length, quota);
+            }
+
+            const id = crypto.randomUUID();
+            const filePath = path.join(dir, id);
+
             await fs.writeFile(filePath, buffer);
 
             metaStore.set(id, {
@@ -104,6 +226,16 @@ export function createStorage(dir: string = "./uploads"): Storage {
                 path: filePath,
             });
 
+            // DB 자동 기록
+            if (rawSql) {
+                try {
+                    await recordFileToDb(rawSql, id, filename, buffer.length, type, "api");
+                } catch (e: unknown) {
+                    const msg = e instanceof Error ? e.message : String(e);
+                    console.warn(`[storage] DB record failed for ${id}: ${msg}`);
+                }
+            }
+
             return id;
         },
 
@@ -121,19 +253,32 @@ export function createStorage(dir: string = "./uploads"): Storage {
                 await fs.unlink(meta.path).catch(() => { });
                 metaStore.delete(storageId);
             }
+
+            // DB에서도 삭제 (rawSql 있을 때만)
+            if (rawSql) {
+                try {
+                    await rawSql(
+                        `DELETE FROM files WHERE storage_id = $1`,
+                        [storageId],
+                    );
+                } catch { /* 삭제 실패 무시 — 파일은 이미 제거됨 */ }
+            }
         },
     };
 }
 
 /**
  * Hono routes for serving stored files
+ *
+ * 인증 없이 public URL로 서빙 — Convex getUrl() 패턴과 동일.
+ * 접근 제어는 URL을 반환하는 query/mutation 레벨에서 개발자가 구현.
  */
 export function storageRoutes(
     storage: ReturnType<typeof createStorage>,
-    rawSql?: (sql: string, params?: any[]) => Promise<any[]>,
+    rawSql?: (sql: string, params?: unknown[]) => Promise<unknown[]>,
     storageDir?: string,
 ) {
-    return async (c: any) => {
+    return async (c: { req: { param: (key: string) => string }; json: (data: unknown, status?: number) => Response; body: (data: unknown, status: number, headers: Record<string, string>) => Response }) => {
         const id = c.req.param("id");
         let meta = await storage.getMeta(id);
 
@@ -145,7 +290,7 @@ export function storageRoutes(
                     [id]
                 );
                 if (rows.length > 0) {
-                    const row = rows[0];
+                    const row = rows[0] as Record<string, string>;
                     const dir = storageDir || "./uploads";
                     meta = {
                         id: row.storage_id,