@getstrata/core 1.0.9 → 1.1.1

package/dist/entries/tenant/enableTenantRls.js

@@ -0,0 +1,385 @@
+// @bun
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+function normalizeEnvValue(value) {
+  return (value ?? "").trim().toLowerCase();
+}
+function isProductionEnv(env = process.env) {
+  const appEnv = normalizeEnvValue(env.APP_ENV);
+  const nodeEnv = normalizeEnvValue(env.NODE_ENV);
+  if (appEnv === "production" || nodeEnv === "production") {
+    return true;
+  }
+  if (appEnv === "") {
+    return false;
+  }
+  return !NON_PRODUCTION_APP_ENVS.has(appEnv);
+}
+function envFlagEnabled(value) {
+  return value === "true";
+}
+
+// ../../src/core/tenant/postgresAppRole.ts
+var POSTGRES_APP_ROLE = "strata_app";
+var POSTGRES_APP_ROLE_PASSWORD = "dev-strata-app-change-me";
+var POSTGRES_SUPERUSER_PASSWORD = "dev-postgres-change-me";
+var LEGACY_POSTGRES_SUPERUSER_PASSWORD = "postgres";
+function assertSafeSqlIdentifier(identifier, label) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Refusing unsafe Postgres ${label}: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteSqlLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function isPostgresUrl(raw) {
+  const trimmed = raw?.trim() ?? "";
+  if (!trimmed) {
+    return false;
+  }
+  try {
+    const url = new URL(trimmed);
+    return url.protocol === "postgres:" || url.protocol === "postgresql:";
+  } catch {
+    return false;
+  }
+}
+function postgresUrlUsername(raw) {
+  if (!isPostgresUrl(raw)) {
+    return null;
+  }
+  return decodeURIComponent(new URL(raw).username);
+}
+function postgresDatabaseNameFromUrl(raw) {
+  let name = "";
+  try {
+    name = decodeURIComponent(new URL(raw).pathname.replace(/^\//, ""));
+  } catch {
+    throw new Error(`DATABASE_URL is not a valid URL: ${raw}`);
+  }
+  if (!name) {
+    throw new Error("DATABASE_URL is missing a database name.");
+  }
+  return assertSafeSqlIdentifier(name, "database name");
+}
+function withPostgresUrlCredentials(raw, username, password) {
+  const url = new URL(raw);
+  url.username = username;
+  url.password = password;
+  return url.toString();
+}
+function withPostgresDatabaseName(raw, database) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+      return null;
+    }
+    url.pathname = `/${database}`;
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+function uniqueUrls(urls) {
+  const seen = new Set;
+  const out = [];
+  for (const url of urls) {
+    const trimmed = url?.trim() ?? "";
+    if (!trimmed || seen.has(trimmed)) {
+      continue;
+    }
+    seen.add(trimmed);
+    out.push(trimmed);
+  }
+  return out;
+}
+function postgresAdminUrls(options) {
+  const urls = [];
+  const seen = new Set;
+  const push = (url) => {
+    const trimmed = url?.trim() ?? "";
+    if (!trimmed || seen.has(trimmed)) {
+      return;
+    }
+    seen.add(trimmed);
+    urls.push(trimmed);
+  };
+  push(options.migrationUrl);
+  if (!isPostgresUrl(options.runtimeUrl)) {
+    return urls;
+  }
+  const superuserPassword = options.superuserPassword ?? POSTGRES_SUPERUSER_PASSWORD;
+  push(withPostgresUrlCredentials(options.runtimeUrl, "postgres", superuserPassword));
+  if (!isProductionEnv()) {
+    push(withPostgresUrlCredentials(options.runtimeUrl, "postgres", LEGACY_POSTGRES_SUPERUSER_PASSWORD));
+  }
+  return urls;
+}
+function resolveTargetDatabaseName(options) {
+  if (isPostgresUrl(options.runtimeUrl)) {
+    return postgresDatabaseNameFromUrl(options.runtimeUrl);
+  }
+  const migrationUrl = options.migrationUrl?.trim() ?? "";
+  if (isPostgresUrl(migrationUrl)) {
+    return postgresDatabaseNameFromUrl(migrationUrl);
+  }
+  return null;
+}
+function defaultConnect(url) {
+  return new Bun.SQL(url);
+}
+async function closePostgres(sql) {
+  if (!sql.close) {
+    return;
+  }
+  try {
+    await sql.close();
+  } catch {}
+}
+async function pingPostgres(sql) {
+  await sql.unsafe("SELECT 1");
+}
+async function connectFirstSuccessful(urls, connect) {
+  let lastError;
+  for (const candidate of urls) {
+    const sql = connect(candidate);
+    try {
+      await pingPostgres(sql);
+      return sql;
+    } catch (error) {
+      lastError = error;
+      await closePostgres(sql);
+    }
+  }
+  throw lastError instanceof Error ? lastError : new Error("Could not open a Postgres superuser connection for CREATE ROLE / CREATE DATABASE / GRANT. Set MIGRATION_DATABASE_URL.");
+}
+async function openPostgresAdminConnection(options) {
+  const connect = options.connect ?? defaultConnect;
+  const target = resolveTargetDatabaseName(options);
+  const candidates = uniqueUrls(postgresAdminUrls(options).map((url) => target ? withPostgresDatabaseName(url, target) ?? url : url));
+  return await connectFirstSuccessful(candidates, connect);
+}
+async function openPostgresMaintenanceConnection(options) {
+  const connect = options.connect ?? defaultConnect;
+  const candidates = [];
+  for (const url of postgresAdminUrls(options)) {
+    candidates.push(withPostgresDatabaseName(url, "postgres"));
+    candidates.push(withPostgresDatabaseName(url, "template1"));
+    candidates.push(url);
+  }
+  return await connectFirstSuccessful(uniqueUrls(candidates), connect);
+}
+function postgresAppRoleCreateSql(options = {}) {
+  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
+  const password = quoteSqlLiteral(options.password ?? POSTGRES_APP_ROLE_PASSWORD);
+  return `DO $$
+BEGIN
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+    CREATE ROLE ${role} LOGIN PASSWORD ${password}
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  ELSE
+    ALTER ROLE ${role} WITH LOGIN PASSWORD ${password}
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  END IF;
+END
+$$`;
+}
+function postgresAppRoleSql(options) {
+  const database = assertSafeSqlIdentifier(options.database, "database name");
+  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
+  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
+-- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
+-- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
+${postgresAppRoleCreateSql(options)};
+
+GRANT CONNECT ON DATABASE ${database} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
+`;
+}
+async function grantPostgresAppRolePrivileges(sql, options) {
+  const database = assertSafeSqlIdentifier(options.database, "database name");
+  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
+  await sql.unsafe(`GRANT CONNECT ON DATABASE ${database} TO ${role}`);
+  await sql.unsafe(`GRANT USAGE, CREATE ON SCHEMA public TO ${role}`);
+  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role}`);
+  await sql.unsafe(`GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role}`);
+  await sql.unsafe(`GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role}`);
+  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role}`);
+  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role}`);
+  await sql.unsafe(`ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role}`);
+}
+async function ensurePostgresAppRole(sql, options) {
+  await sql.unsafe(postgresAppRoleCreateSql(options));
+  await grantPostgresAppRolePrivileges(sql, options);
+}
+async function ensurePostgresDatabaseAndAppRole(options) {
+  const name = postgresDatabaseNameFromUrl(options.runtimeUrl);
+  const maintenance = await openPostgresMaintenanceConnection(options);
+  try {
+    const rows = await maintenance.unsafe("SELECT 1 AS ok FROM pg_database WHERE datname = $1", [name]);
+    if (rows.length === 0) {
+      await maintenance.unsafe(`CREATE DATABASE ${name}`);
+    }
+  } finally {
+    await closePostgres(maintenance);
+  }
+  const admin = await openPostgresAdminConnection(options);
+  try {
+    await ensurePostgresAppRole(admin, {
+      database: name,
+      role: options.role,
+      password: options.password ?? process.env.STRATA_APP_PASSWORD ?? POSTGRES_APP_ROLE_PASSWORD
+    });
+  } finally {
+    await closePostgres(admin);
+  }
+  return options.runtimeUrl;
+}
+async function dropPostgresTablesAsAdmin(tables, options) {
+  const safeTables = tables.map((table) => assertSafeSqlIdentifier(table, "table name"));
+  const sql = await openPostgresAdminConnection(options);
+  try {
+    for (const table of safeTables) {
+      await sql.unsafe(`DROP TABLE IF EXISTS ${table} CASCADE`);
+    }
+  } finally {
+    await closePostgres(sql);
+  }
+}
+async function inspectCurrentPostgresRole(sql) {
+  const rows = await sql.unsafe(`SELECT current_user AS rolname, r.rolsuper, r.rolbypassrls
+     FROM pg_roles r WHERE r.rolname = current_user`);
+  return rows[0] ?? null;
+}
+function assertPostgresRoleCannotBypassRls(role, source = "DATABASE_URL") {
+  if (!role) {
+    throw new Error(`Production startup blocked: could not inspect the live Postgres role for ${source}.`);
+  }
+  if (role.rolsuper || role.rolbypassrls) {
+    throw new Error(`Production startup blocked: ${source} role ${role.rolname} is rolsuper or rolbypassrls. FORCE RLS does not apply. Use a NOBYPASSRLS login role.`);
+  }
+}
+
+// ../../src/core/tenant/enableTenantRls.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+var RLS_HELPER_SQL = `
+CREATE OR REPLACE FUNCTION app_bypass_rls()
+RETURNS BOOLEAN AS $$
+BEGIN
+  RETURN COALESCE(current_setting('app.bypass_rls', true), 'false') = 'true';
+EXCEPTION
+  WHEN others THEN
+    RETURN FALSE;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_bypass_identifier()
+RETURNS TEXT AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.bypass_identifier', true), '');
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_current_tenant_id()
+RETURNS INTEGER AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.tenant_id', true), '')::INTEGER;
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+`;
+function tenantIsolationPolicy(table, predicate) {
+  return `
+ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON ${table};
+CREATE POLICY tenant_isolation ON ${table}
+USING (
+  app_bypass_rls()
+  OR ${predicate}
+)
+WITH CHECK (
+  app_bypass_rls()
+  OR ${predicate}
+);
+`;
+}
+function enableTenantRlsSql(tableName) {
+  const table = assertSafeIdentifier(tableName);
+  return tenantIsolationPolicy(table, `tenant_id = app_current_tenant_id()`);
+}
+function enableUsersRlsSql() {
+  return tenantIsolationPolicy("users", `tenant_id = app_current_tenant_id()
+  OR (
+    app_bypass_identifier() IS NOT NULL
+    AND (
+      id::text = app_bypass_identifier()
+      OR email = app_bypass_identifier()
+    )
+  )`);
+}
+function userOwnedIdentifierPredicate(table, userIdColumn) {
+  const userIdMatch = `${table}.${userIdColumn}::text = app_bypass_identifier()`;
+  if (table === "sessions") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.id::text = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  if (table === "api_tokens" || table === "auth_one_time_tokens") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.token_hash = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  return `(app_bypass_identifier() IS NOT NULL AND ${userIdMatch})`;
+}
+function enableUserOwnedRlsSql(tableName, userIdColumn = "user_id") {
+  const table = assertSafeIdentifier(tableName);
+  const column = assertSafeIdentifier(userIdColumn);
+  return tenantIsolationPolicy(table, `EXISTS (
+    SELECT 1 FROM users u
+    WHERE u.id = ${table}.${column}
+      AND u.tenant_id = app_current_tenant_id()
+  )
+  OR ${userOwnedIdentifierPredicate(table, column)}`);
+}
+function generatedRlsBootstrapSql(tables, userOwnedTables = []) {
+  return [
+    RLS_HELPER_SQL,
+    ...tables.map((table) => table === "users" ? enableUsersRlsSql() : enableTenantRlsSql(table)),
+    ...userOwnedTables.map((table) => enableUserOwnedRlsSql(table))
+  ].join(`
+`);
+}
+export {
+  POSTGRES_APP_ROLE,
+  POSTGRES_APP_ROLE_PASSWORD,
+  POSTGRES_SUPERUSER_PASSWORD,
+  RLS_HELPER_SQL,
+  assertPostgresRoleCannotBypassRls,
+  dropPostgresTablesAsAdmin,
+  enableTenantRlsSql,
+  enableUserOwnedRlsSql,
+  ensurePostgresAppRole,
+  ensurePostgresDatabaseAndAppRole,
+  generatedRlsBootstrapSql,
+  grantPostgresAppRolePrivileges,
+  inspectCurrentPostgresRole,
+  isPostgresUrl,
+  openPostgresAdminConnection,
+  postgresAppRoleSql,
+  postgresDatabaseNameFromUrl,
+  postgresUrlUsername
+};