@getstrata/starter 2.0.6 → 2.0.7

package/dist/cli.js

@@ -2697,6 +2697,155 @@ export default authProvider;
 `;
 }
 
+// ../../src/core/runtime/appEnv.ts
+var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
+
+// ../../src/core/tenant/postgresAppRole.ts
+var POSTGRES_APP_ROLE = "strata_app";
+var POSTGRES_APP_ROLE_PASSWORD = "dev-strata-app-change-me";
+function assertSafeSqlIdentifier(identifier, label) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Refusing unsafe Postgres ${label}: ${identifier}`);
+  }
+  return identifier;
+}
+function quoteSqlLiteral(value) {
+  return `'${value.replaceAll("'", "''")}'`;
+}
+function postgresAppRoleCreateSql(options = {}) {
+  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
+  const password = quoteSqlLiteral(options.password ?? POSTGRES_APP_ROLE_PASSWORD);
+  return `DO $$
+BEGIN
+  -- pg_authid is shared across databases. Database-local advisory locks cannot
+  -- serialize a cluster-global role. This lock permits readers and lasts until commit.
+  LOCK TABLE pg_catalog.pg_authid IN SHARE ROW EXCLUSIVE MODE;
+  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
+    CREATE ROLE ${role} LOGIN PASSWORD ${password}
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  ELSE
+    ALTER ROLE ${role} WITH LOGIN PASSWORD ${password}
+      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
+  END IF;
+END
+$$`;
+}
+function postgresAppRoleSql(options) {
+  const database = assertSafeSqlIdentifier(options.database, "database name");
+  const role = assertSafeSqlIdentifier(options.role ?? POSTGRES_APP_ROLE, "role name");
+  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
+-- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate / migrate:fresh DROP.
+-- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
+${postgresAppRoleCreateSql(options)};
+
+GRANT CONNECT ON DATABASE ${database} TO ${role};
+GRANT USAGE, CREATE ON SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
+GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
+ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
+`;
+}
+
+// ../../src/core/tenant/enableTenantRls.ts
+function assertSafeIdentifier(identifier) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
+    throw new Error(`Invalid SQL identifier: ${identifier}`);
+  }
+  return identifier;
+}
+var RLS_HELPER_SQL = `
+CREATE OR REPLACE FUNCTION app_bypass_rls()
+RETURNS BOOLEAN AS $$
+BEGIN
+  RETURN COALESCE(current_setting('app.bypass_rls', true), 'false') = 'true';
+EXCEPTION
+  WHEN others THEN
+    RETURN FALSE;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_bypass_identifier()
+RETURNS TEXT AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.bypass_identifier', true), '');
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+
+CREATE OR REPLACE FUNCTION app_current_tenant_id()
+RETURNS INTEGER AS $$
+BEGIN
+  RETURN NULLIF(current_setting('app.tenant_id', true), '')::INTEGER;
+EXCEPTION
+  WHEN others THEN
+    RETURN NULL;
+END;
+$$ LANGUAGE plpgsql STABLE;
+`;
+function tenantIsolationPolicy(table, predicate) {
+  return `
+ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;
+ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;
+DROP POLICY IF EXISTS tenant_isolation ON ${table};
+CREATE POLICY tenant_isolation ON ${table}
+USING (
+  app_bypass_rls()
+  OR ${predicate}
+)
+WITH CHECK (
+  app_bypass_rls()
+  OR ${predicate}
+);
+`;
+}
+function enableTenantRlsSql(tableName) {
+  const table = assertSafeIdentifier(tableName);
+  return tenantIsolationPolicy(table, `tenant_id = app_current_tenant_id()`);
+}
+function enableUsersRlsSql() {
+  return tenantIsolationPolicy("users", `tenant_id = app_current_tenant_id()
+  OR (
+    app_bypass_identifier() IS NOT NULL
+    AND (
+      id::text = app_bypass_identifier()
+      OR email = app_bypass_identifier()
+    )
+  )`);
+}
+function userOwnedIdentifierPredicate(table, userIdColumn) {
+  const userIdMatch = `${table}.${userIdColumn}::text = app_bypass_identifier()`;
+  if (table === "sessions") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.id::text = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  if (table === "api_tokens" || table === "auth_one_time_tokens") {
+    return `(app_bypass_identifier() IS NOT NULL AND (${table}.token_hash = app_bypass_identifier() OR ${userIdMatch}))`;
+  }
+  return `(app_bypass_identifier() IS NOT NULL AND ${userIdMatch})`;
+}
+function enableUserOwnedRlsSql(tableName, userIdColumn = "user_id") {
+  const table = assertSafeIdentifier(tableName);
+  const column = assertSafeIdentifier(userIdColumn);
+  return tenantIsolationPolicy(table, `EXISTS (
+    SELECT 1 FROM users u
+    WHERE u.id = ${table}.${column}
+      AND u.tenant_id = app_current_tenant_id()
+  )
+  OR ${userOwnedIdentifierPredicate(table, column)}`);
+}
+function generatedRlsBootstrapSql(tables, userOwnedTables = []) {
+  return [
+    RLS_HELPER_SQL,
+    ...tables.map((table) => table === "users" ? enableUsersRlsSql() : enableTenantRlsSql(table)),
+    ...userOwnedTables.map((table) => enableUserOwnedRlsSql(table))
+  ].join(`
+`);
+}
+
 // src/renderEnv.ts
 function envFlag(value) {
   return value ? "true" : "false";
@@ -2743,32 +2892,12 @@ function renderPostgresAppRoleInitSql(projectName, layers) {
   if (layers.database !== "postgres") {
     return null;
   }
-  const database = appDatabaseName(projectName);
-  const role = GENERATED_POSTGRES_APP_ROLE;
-  const password = GENERATED_POSTGRES_APP_PASSWORD;
-  return `-- Application login role. FORCE RLS applies because this role is NOSUPERUSER and NOBYPASSRLS.
--- Superuser remains for CREATE ROLE / CREATE DATABASE / GRANT / migrate.
--- This script is repeatable on an already-existing volume (not only docker-entrypoint-initdb.d).
-DO $$
-BEGIN
-  IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${role}') THEN
-    CREATE ROLE ${role} LOGIN PASSWORD '${password}'
-      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
-  ELSE
-    ALTER ROLE ${role} WITH LOGIN PASSWORD '${password}'
-      NOSUPERUSER NOCREATEDB NOCREATEROLE NOINHERIT NOBYPASSRLS;
-  END IF;
-END
-$$;
-
-GRANT CONNECT ON DATABASE ${database} TO ${role};
-GRANT USAGE, CREATE ON SCHEMA public TO ${role};
-GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${role};
-GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${role};
-GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA public TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${role};
-ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT EXECUTE ON FUNCTIONS TO ${role};
+  return `BEGIN;
+${postgresAppRoleSql({
+    database: appDatabaseName(projectName),
+    role: GENERATED_POSTGRES_APP_ROLE,
+    password: GENERATED_POSTGRES_APP_PASSWORD
+  })}COMMIT;
 `;
 }
 function renderEnvExample(projectName, layers) {
@@ -3063,9 +3192,9 @@ function renderPackageJson(projectName, options = {}) {
     "@getstrata/cli": "workspace:*",
     "@getstrata/core": "workspace:*"
   } : {
-    "@getstrata/bootstrap": "^2.0.6",
-    "@getstrata/cli": "^2.0.6",
-    "@getstrata/core": "^2.0.6"
+    "@getstrata/bootstrap": "^2.0.7",
+    "@getstrata/cli": "^2.0.7",
+    "@getstrata/core": "^2.0.7"
   };
   coreDeps.eta = "^4.6.0";
   if (options.layers?.database === "mysql") {
@@ -3413,106 +3542,6 @@ ${authUsesCookie(layers.auth) ? "- Set `SESSION_SECRET` to 32+ characters.\n" :
 `;
 }
 
-// ../../src/core/runtime/appEnv.ts
-var NON_PRODUCTION_APP_ENVS = new Set(["local", "development", "dev", "test", "testing", "ci"]);
-
-// ../../src/core/tenant/enableTenantRls.ts
-function assertSafeIdentifier(identifier) {
-  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(identifier)) {
-    throw new Error(`Invalid SQL identifier: ${identifier}`);
-  }
-  return identifier;
-}
-var RLS_HELPER_SQL = `
-CREATE OR REPLACE FUNCTION app_bypass_rls()
-RETURNS BOOLEAN AS $$
-BEGIN
-  RETURN COALESCE(current_setting('app.bypass_rls', true), 'false') = 'true';
-EXCEPTION
-  WHEN others THEN
-    RETURN FALSE;
-END;
-$$ LANGUAGE plpgsql STABLE;
-
-CREATE OR REPLACE FUNCTION app_bypass_identifier()
-RETURNS TEXT AS $$
-BEGIN
-  RETURN NULLIF(current_setting('app.bypass_identifier', true), '');
-EXCEPTION
-  WHEN others THEN
-    RETURN NULL;
-END;
-$$ LANGUAGE plpgsql STABLE;
-
-CREATE OR REPLACE FUNCTION app_current_tenant_id()
-RETURNS INTEGER AS $$
-BEGIN
-  RETURN NULLIF(current_setting('app.tenant_id', true), '')::INTEGER;
-EXCEPTION
-  WHEN others THEN
-    RETURN NULL;
-END;
-$$ LANGUAGE plpgsql STABLE;
-`;
-function tenantIsolationPolicy(table, predicate) {
-  return `
-ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;
-ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;
-DROP POLICY IF EXISTS tenant_isolation ON ${table};
-CREATE POLICY tenant_isolation ON ${table}
-USING (
-  app_bypass_rls()
-  OR ${predicate}
-)
-WITH CHECK (
-  app_bypass_rls()
-  OR ${predicate}
-);
-`;
-}
-function enableTenantRlsSql(tableName) {
-  const table = assertSafeIdentifier(tableName);
-  return tenantIsolationPolicy(table, `tenant_id = app_current_tenant_id()`);
-}
-function enableUsersRlsSql() {
-  return tenantIsolationPolicy("users", `tenant_id = app_current_tenant_id()
-  OR (
-    app_bypass_identifier() IS NOT NULL
-    AND (
-      id::text = app_bypass_identifier()
-      OR email = app_bypass_identifier()
-    )
-  )`);
-}
-function userOwnedIdentifierPredicate(table, userIdColumn) {
-  const userIdMatch = `${table}.${userIdColumn}::text = app_bypass_identifier()`;
-  if (table === "sessions") {
-    return `(app_bypass_identifier() IS NOT NULL AND (${table}.id::text = app_bypass_identifier() OR ${userIdMatch}))`;
-  }
-  if (table === "api_tokens" || table === "auth_one_time_tokens") {
-    return `(app_bypass_identifier() IS NOT NULL AND (${table}.token_hash = app_bypass_identifier() OR ${userIdMatch}))`;
-  }
-  return `(app_bypass_identifier() IS NOT NULL AND ${userIdMatch})`;
-}
-function enableUserOwnedRlsSql(tableName, userIdColumn = "user_id") {
-  const table = assertSafeIdentifier(tableName);
-  const column = assertSafeIdentifier(userIdColumn);
-  return tenantIsolationPolicy(table, `EXISTS (
-    SELECT 1 FROM users u
-    WHERE u.id = ${table}.${column}
-      AND u.tenant_id = app_current_tenant_id()
-  )
-  OR ${userOwnedIdentifierPredicate(table, column)}`);
-}
-function generatedRlsBootstrapSql(tables, userOwnedTables = []) {
-  return [
-    RLS_HELPER_SQL,
-    ...tables.map((table) => table === "users" ? enableUsersRlsSql() : enableTenantRlsSql(table)),
-    ...userOwnedTables.map((table) => enableUserOwnedRlsSql(table))
-  ].join(`
-`);
-}
-
 // src/renderRuntime.ts
 function needsEnsure(layers) {
   return layers.database !== "sqlite";

package/dist/templates/package.json

@@ -12,9 +12,9 @@
     "check": "tsc --noEmit"
   },
   "dependencies": {
-    "@getstrata/bootstrap": "^2.0.6",
-    "@getstrata/cli": "^2.0.6",
-    "@getstrata/core": "^2.0.6",
+    "@getstrata/bootstrap": "^2.0.7",
+    "@getstrata/cli": "^2.0.7",
+    "@getstrata/core": "^2.0.7",
     "eta": "^4.6.0"
   },
   "devDependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstrata/starter",
-  "version": "2.0.6",
+  "version": "2.0.7",
   "description": "Interactive create-strata wizard. Choose each layer; one database engine.",
   "type": "module",
   "license": "MIT",