@holeauth/rbac-drizzle 0.0.1-alpha.0

package/dist/mysql/index.d.ts

@@ -0,0 +1,275 @@
+import * as drizzle_orm from 'drizzle-orm';
+import * as drizzle_orm_mysql_core from 'drizzle-orm/mysql-core';
+import { MySqlTableWithColumns } from 'drizzle-orm/mysql-core';
+import { RbacAdapter } from '@holeauth/plugin-rbac';
+
+type MysqlUsersTable = MySqlTableWithColumns<any> & {
+    id: any;
+};
+interface CreateRbacTablesOptions<U extends MysqlUsersTable> {
+    usersTable: U;
+    prefix?: string;
+    persistGroups?: boolean;
+}
+declare function createRbacTables<U extends MysqlUsersTable>(opts: CreateRbacTablesOptions<U>): {
+    tables: {
+        userGroups: MySqlTableWithColumns<{
+            name: string;
+            schema: undefined;
+            columns: {
+                userId: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "user_id";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                groupId: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "group_id";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                assignedAt: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "assigned_at";
+                    tableName: string;
+                    dataType: "date";
+                    columnType: "MySqlTimestamp";
+                    data: Date;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+            };
+            dialect: "mysql";
+        }>;
+        userPermissions: MySqlTableWithColumns<{
+            name: string;
+            schema: undefined;
+            columns: {
+                userId: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "user_id";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                node: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "node";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                assignedAt: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "assigned_at";
+                    tableName: string;
+                    dataType: "date";
+                    columnType: "MySqlTimestamp";
+                    data: Date;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+            };
+            dialect: "mysql";
+        }>;
+        groups?: NonNullable<MySqlTableWithColumns<{
+            name: string;
+            schema: undefined;
+            columns: {
+                id: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "id";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: true;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                displayName: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "display_name";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                description: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "description";
+                    tableName: string;
+                    dataType: "string";
+                    columnType: "MySqlVarChar";
+                    data: string;
+                    driverParam: string | number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: [string, ...string[]];
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                priority: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "priority";
+                    tableName: string;
+                    dataType: "number";
+                    columnType: "MySqlInt";
+                    data: number;
+                    driverParam: string | number;
+                    notNull: false;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                isDefault: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "is_default";
+                    tableName: string;
+                    dataType: "boolean";
+                    columnType: "MySqlBoolean";
+                    data: boolean;
+                    driverParam: number | boolean;
+                    notNull: true;
+                    hasDefault: true;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                effective: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "effective";
+                    tableName: string;
+                    dataType: "json";
+                    columnType: "MySqlJson";
+                    data: string[];
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+                permissions: drizzle_orm_mysql_core.MySqlColumn<{
+                    name: "permissions";
+                    tableName: string;
+                    dataType: "json";
+                    columnType: "MySqlJson";
+                    data: string[];
+                    driverParam: string;
+                    notNull: true;
+                    hasDefault: false;
+                    isPrimaryKey: false;
+                    isAutoincrement: false;
+                    hasRuntimeDefault: false;
+                    enumValues: undefined;
+                    baseColumn: never;
+                    identity: undefined;
+                    generated: undefined;
+                }, object>;
+            };
+            dialect: "mysql";
+        }> | undefined>;
+    };
+    relations: {
+        userGroupsRelations: drizzle_orm.Relations<string, {
+            user: drizzle_orm.One<U["_"]["name"], true>;
+        }>;
+        userPermissionsRelations: drizzle_orm.Relations<string, {
+            user: drizzle_orm.One<U["_"]["name"], true>;
+        }>;
+    };
+};
+type RbacTables = ReturnType<typeof createRbacTables>['tables'];
+interface CreateRbacAdapterOptions {
+    db: any;
+    tables: RbacTables;
+}
+declare function createRbacAdapter(opts: CreateRbacAdapterOptions): RbacAdapter;
+
+export { type CreateRbacAdapterOptions, type CreateRbacTablesOptions, type MysqlUsersTable, createRbacAdapter, createRbacTables };

package/dist/mysql/index.js

@@ -0,0 +1,96 @@
+import { mysqlTable, timestamp, varchar, index, primaryKey, json, boolean, int } from 'drizzle-orm/mysql-core';
+import { relations, eq, and } from 'drizzle-orm';
+
+// src/mysql/index.ts
+function createRbacTables(opts) {
+  const { usersTable, prefix = "holeauth_rbac_", persistGroups = false } = opts;
+  const p = (s) => `${prefix}${s}`;
+  const userGroups = mysqlTable(
+    p("user_group"),
+    {
+      userId: varchar("user_id", { length: 191 }).notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+      groupId: varchar("group_id", { length: 191 }).notNull(),
+      assignedAt: timestamp("assigned_at", { fsp: 3 }).notNull().defaultNow()
+    },
+    (t) => ({
+      pk: primaryKey({ columns: [t.userId, t.groupId] }),
+      groupIdx: index(`${p("user_group")}_group_idx`).on(t.groupId)
+    })
+  );
+  const userPermissions = mysqlTable(
+    p("user_permission"),
+    {
+      userId: varchar("user_id", { length: 191 }).notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+      node: varchar("node", { length: 191 }).notNull(),
+      assignedAt: timestamp("assigned_at", { fsp: 3 }).notNull().defaultNow()
+    },
+    (t) => ({ pk: primaryKey({ columns: [t.userId, t.node] }) })
+  );
+  const userGroupsRelations = relations(userGroups, ({ one }) => ({
+    user: one(usersTable, { fields: [userGroups.userId], references: [usersTable.id] })
+  }));
+  const userPermissionsRelations = relations(userPermissions, ({ one }) => ({
+    user: one(usersTable, { fields: [userPermissions.userId], references: [usersTable.id] })
+  }));
+  const groups = persistGroups ? mysqlTable(p("group"), {
+    id: varchar("id", { length: 191 }).primaryKey(),
+    displayName: varchar("display_name", { length: 191 }),
+    description: varchar("description", { length: 512 }),
+    priority: int("priority"),
+    isDefault: boolean("is_default").notNull().default(false),
+    effective: json("effective").$type().notNull(),
+    permissions: json("permissions").$type().notNull()
+  }) : void 0;
+  return {
+    tables: {
+      userGroups,
+      userPermissions,
+      ...groups ? { groups } : {}
+    },
+    relations: { userGroupsRelations, userPermissionsRelations }
+  };
+}
+function createRbacAdapter(opts) {
+  const { db, tables } = opts;
+  const { userGroups, userPermissions } = tables;
+  return {
+    async listUserGroups(userId) {
+      const rows = await db.select({ groupId: userGroups.groupId }).from(userGroups).where(eq(userGroups.userId, userId));
+      return rows.map((r) => r.groupId);
+    },
+    async assignGroup(userId, groupId) {
+      await db.insert(userGroups).values({ userId, groupId }).onDuplicateKeyUpdate({ set: { groupId } });
+    },
+    async removeGroup(userId, groupId) {
+      await db.delete(userGroups).where(and(eq(userGroups.userId, userId), eq(userGroups.groupId, groupId)));
+    },
+    async listUserPermissions(userId) {
+      const rows = await db.select({ node: userPermissions.node }).from(userPermissions).where(eq(userPermissions.userId, userId));
+      return rows.map((r) => r.node);
+    },
+    async grantPermission(userId, node) {
+      await db.insert(userPermissions).values({ userId, node }).onDuplicateKeyUpdate({ set: { node } });
+    },
+    async revokePermission(userId, node) {
+      await db.delete(userPermissions).where(and(eq(userPermissions.userId, userId), eq(userPermissions.node, node)));
+    },
+    async listAllGroupAssignments() {
+      const rows = await db.select().from(userGroups);
+      return rows.map(
+        (r) => ({
+          userId: r.userId,
+          groupId: r.groupId,
+          assignedAt: r.assignedAt
+        })
+      );
+    },
+    async purgeUser(userId) {
+      await db.delete(userPermissions).where(eq(userPermissions.userId, userId));
+      await db.delete(userGroups).where(eq(userGroups.userId, userId));
+    }
+  };
+}
+
+export { createRbacAdapter, createRbacTables };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map

package/dist/mysql/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/mysql/index.ts"],"names":[],"mappings":";;;;AAuBO,SAAS,iBAA4C,IAAA,EAAkC;AAC5F,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,GAAS,gBAAA,EAAkB,aAAA,GAAgB,OAAM,GAAI,IAAA;AACzE,EAAA,MAAM,IAAI,CAAC,CAAA,KAAc,CAAA,EAAG,MAAM,GAAG,CAAC,CAAA,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAa,UAAA;AAAA,IACjB,EAAE,YAAY,CAAA;AAAA,IACd;AAAA,MACE,QAAQ,OAAA,CAAQ,SAAA,EAAW,EAAE,MAAA,EAAQ,KAAK,CAAA,CACvC,OAAA,EAAQ,CACR,WAAW,MAAM,UAAA,CAAW,IAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,MAC1D,OAAA,EAAS,QAAQ,UAAA,EAAY,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,MACtD,UAAA,EAAY,SAAA,CAAU,aAAA,EAAe,EAAE,GAAA,EAAK,GAAG,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA;AAAW,KACxE;AAAA,IACA,CAAC,CAAA,MAAO;AAAA,MACN,EAAA,EAAI,UAAA,CAAW,EAAE,OAAA,EAAS,CAAC,EAAE,MAAA,EAAQ,CAAA,CAAE,OAAO,CAAA,EAAG,CAAA;AAAA,MACjD,QAAA,EAAU,KAAA,CAAM,CAAA,EAAG,CAAA,CAAE,YAAY,CAAC,CAAA,UAAA,CAAY,CAAA,CAAE,EAAA,CAAG,CAAA,CAAE,OAAO;AAAA,KAC9D;AAAA,GACF;AAEA,EAAA,MAAM,eAAA,GAAkB,UAAA;AAAA,IACtB,EAAE,iBAAiB,CAAA;AAAA,IACnB;AAAA,MACE,QAAQ,OAAA,CAAQ,SAAA,EAAW,EAAE,MAAA,EAAQ,KAAK,CAAA,CACvC,OAAA,EAAQ,CACR,WAAW,MAAM,UAAA,CAAW,IAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,MAC1D,IAAA,EAAM,QAAQ,MAAA,EAAQ,EAAE,QAAQ,GAAA,EAAK,EAAE,OAAA,EAAQ;AAAA,MAC/C,UAAA,EAAY,SAAA,CAAU,aAAA,EAAe,EAAE,GAAA,EAAK,GAAG,CAAA,CAAE,OAAA,EAAQ,CAAE,UAAA;AAAW,KACxE;AAAA,IACA,CAAC,CAAA,MAAO,EAAE,EAAA,EAAI,WAAW,EAAE,OAAA,EAAS,CAAC,CAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,EAAG,CAAA,EAAE;AAAA,GAC5D;AAEA,EAAA,MAAM,sBAAsB,SAAA,CAAU,UAAA,EAAY,CAAC,EAAE,KAAI,MAAO;AAAA,IAC9D,IAAA,EAAM,GAAA,CAAI,UAAA,EAAY,EAAE,QAAQ,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG,UAAA,EAAY,CAAC,UAAA,CAAW,EAAE,GAAG;AAAA,GACpF,CAAE,CAAA;AACF,EAAA,MAAM,2BAA2B,SAAA,CAAU,eAAA,EAAiB,CAAC,EAAE,KAAI,MAAO;AAAA,IACxE,IAAA,EAAM,GAAA,CAAI,UAAA,EAAY,EAAE,QAAQ,CAAC,eAAA,CAAgB,MAAM,CAAA,EAAG,UAAA,EAAY,CAAC,UAAA,CAAW,EAAE,GAAG;AAAA,GACzF,CAAE,CAAA;AAEF,EAAA,MAAM,MAAA,GAAS,aAAA,GACX,UAAA,CAAW,CAAA,CAAE,OAAO,CAAA,EAAG;AAAA,IACrB,EAAA,EAAI,QAAQ,IAAA,EAAM,EAAE,QAAQ,GAAA,EAAK,EAAE,UAAA,EAAW;AAAA,IAC9C,aAAa,OAAA,CAAQ,cAAA,EAAgB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACpD,aAAa,OAAA,CAAQ,aAAA,EAAe,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,IACnD,QAAA,EAAU,IAAI,UAAU,CAAA;AAAA,IACxB,WAAW,OAAA,CAAQ,YAAY,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,IACxD,WAAW,IAAA,CAAK,WAAW,CAAA,CAAE,KAAA,GAAkB,OAAA,EAAQ;AAAA,IACvD,aAAa,IAAA,CAAK,aAAa,CAAA,CAAE,KAAA,GAAkB,OAAA;AAAQ,GAC5D,CAAA,GACD,MAAA;AAEJ,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,UAAA;AAAA,MACA,eAAA;AAAA,MACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,KAC7B;AAAA,IAKA,SAAA,EAAW,EAAE,mBAAA,EAAqB,wBAAA;AAAyB,GAC7D;AACF;AAUO,SAAS,kBAAkB,IAAA,EAA6C;AAC7E,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAO,GAAI,IAAA;AACvB,EAAA,MAAM,EAAE,UAAA,EAAY,eAAA,EAAgB,GAAI,MAAA;AAExC,EAAA,OAAO;AAAA,IACL,MAAM,eAAe,MAAA,EAAQ;AAC3B,MAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,OAAA,EAAS,WAAW,OAAA,EAAS,CAAA,CACtC,IAAA,CAAK,UAAU,CAAA,CACf,KAAA,CAAM,GAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAC,CAAA;AACtC,MAAA,OAAQ,IAAA,CAA+B,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO,CAAA;AAAA,IAC7D,CAAA;AAAA,IACA,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAA,EAAS;AACjC,MAAA,MAAM,GACH,MAAA,CAAO,UAAU,CAAA,CACjB,MAAA,CAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAC1B,qBAAqB,EAAE,GAAA,EAAK,EAAE,OAAA,IAAW,CAAA;AAAA,IAC9C,CAAA;AAAA,IACA,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAA,EAAS;AACjC,MAAA,MAAM,GACH,MAAA,CAAO,UAAU,CAAA,CACjB,KAAA,CAAM,IAAI,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,GAAG,EAAA,CAAG,UAAA,CAAW,OAAA,EAAS,OAAO,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAA;AAAA,IACA,MAAM,oBAAoB,MAAA,EAAQ;AAChC,MAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,IAAA,EAAM,gBAAgB,IAAA,EAAM,CAAA,CACrC,IAAA,CAAK,eAAe,CAAA,CACpB,KAAA,CAAM,GAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAC3C,MAAA,OAAQ,IAAA,CAA4B,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,IACvD,CAAA;AAAA,IACA,MAAM,eAAA,CAAgB,MAAA,EAAQ,IAAA,EAAM;AAClC,MAAA,MAAM,GACH,MAAA,CAAO,eAAe,CAAA,CACtB,MAAA,CAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,CACvB,qBAAqB,EAAE,GAAA,EAAK,EAAE,IAAA,IAAQ,CAAA;AAAA,IAC3C,CAAA;AAAA,IACA,MAAM,gBAAA,CAAiB,MAAA,EAAQ,IAAA,EAAM;AACnC,MAAA,MAAM,GACH,MAAA,CAAO,eAAe,CAAA,CACtB,KAAA,CAAM,IAAI,EAAA,CAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,GAAG,EAAA,CAAG,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,MAAM,uBAAA,GAA0B;AAC9B,MAAA,MAAM,OAAO,MAAM,EAAA,CAAG,MAAA,EAAO,CAAE,KAAK,UAAU,CAAA;AAC9C,MAAA,OAAQ,IAAA,CAAiE,GAAA;AAAA,QACvE,CAAC,CAAA,MAA4B;AAAA,UAC3B,QAAQ,CAAA,CAAE,MAAA;AAAA,UACV,SAAS,CAAA,CAAE,OAAA;AAAA,UACX,YAAY,CAAA,CAAE;AAAA,SAChB;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IACA,MAAM,UAAU,MAAA,EAAQ;AACtB,MAAA,MAAM,EAAA,CAAG,OAAO,eAAe,CAAA,CAAE,MAAM,EAAA,CAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAC,CAAA;AACzE,MAAA,MAAM,EAAA,CAAG,OAAO,UAAU,CAAA,CAAE,MAAM,EAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,IACjE;AAAA,GACF;AACF","file":"index.js","sourcesContent":["import {\n  mysqlTable,\n  varchar,\n  timestamp,\n  int,\n  boolean,\n  json,\n  primaryKey,\n  index,\n  type MySqlTableWithColumns,\n} from 'drizzle-orm/mysql-core';\nimport { relations, eq, and } from 'drizzle-orm';\nimport type { RbacAdapter, UserGroupAssignment } from '@holeauth/plugin-rbac';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type MysqlUsersTable = MySqlTableWithColumns<any> & { id: any };\n\nexport interface CreateRbacTablesOptions<U extends MysqlUsersTable> {\n  usersTable: U;\n  prefix?: string;\n  persistGroups?: boolean;\n}\n\nexport function createRbacTables<U extends MysqlUsersTable>(opts: CreateRbacTablesOptions<U>) {\n  const { usersTable, prefix = 'holeauth_rbac_', persistGroups = false } = opts;\n  const p = (s: string) => `${prefix}${s}`;\n\n  const userGroups = mysqlTable(\n    p('user_group'),\n    {\n      userId: varchar('user_id', { length: 191 })\n        .notNull()\n        .references(() => usersTable.id, { onDelete: 'cascade' }),\n      groupId: varchar('group_id', { length: 191 }).notNull(),\n      assignedAt: timestamp('assigned_at', { fsp: 3 }).notNull().defaultNow(),\n    },\n    (t) => ({\n      pk: primaryKey({ columns: [t.userId, t.groupId] }),\n      groupIdx: index(`${p('user_group')}_group_idx`).on(t.groupId),\n    }),\n  );\n\n  const userPermissions = mysqlTable(\n    p('user_permission'),\n    {\n      userId: varchar('user_id', { length: 191 })\n        .notNull()\n        .references(() => usersTable.id, { onDelete: 'cascade' }),\n      node: varchar('node', { length: 191 }).notNull(),\n      assignedAt: timestamp('assigned_at', { fsp: 3 }).notNull().defaultNow(),\n    },\n    (t) => ({ pk: primaryKey({ columns: [t.userId, t.node] }) }),\n  );\n\n  const userGroupsRelations = relations(userGroups, ({ one }) => ({\n    user: one(usersTable, { fields: [userGroups.userId], references: [usersTable.id] }),\n  }));\n  const userPermissionsRelations = relations(userPermissions, ({ one }) => ({\n    user: one(usersTable, { fields: [userPermissions.userId], references: [usersTable.id] }),\n  }));\n\n  const groups = persistGroups\n    ? mysqlTable(p('group'), {\n        id: varchar('id', { length: 191 }).primaryKey(),\n        displayName: varchar('display_name', { length: 191 }),\n        description: varchar('description', { length: 512 }),\n        priority: int('priority'),\n        isDefault: boolean('is_default').notNull().default(false),\n        effective: json('effective').$type<string[]>().notNull(),\n        permissions: json('permissions').$type<string[]>().notNull(),\n      })\n    : undefined;\n\n  return {\n    tables: {\n      userGroups,\n      userPermissions,\n      ...(groups ? { groups } : {}),\n    } as {\n      userGroups: typeof userGroups;\n      userPermissions: typeof userPermissions;\n      groups?: NonNullable<typeof groups>;\n    },\n    relations: { userGroupsRelations, userPermissionsRelations },\n  };\n}\n\ntype RbacTables = ReturnType<typeof createRbacTables>['tables'];\n\nexport interface CreateRbacAdapterOptions {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  db: any;\n  tables: RbacTables;\n}\n\nexport function createRbacAdapter(opts: CreateRbacAdapterOptions): RbacAdapter {\n  const { db, tables } = opts;\n  const { userGroups, userPermissions } = tables;\n  // MySQL uses onDuplicateKeyUpdate for idempotent inserts.\n  return {\n    async listUserGroups(userId) {\n      const rows = await db\n        .select({ groupId: userGroups.groupId })\n        .from(userGroups)\n        .where(eq(userGroups.userId, userId));\n      return (rows as { groupId: string }[]).map((r) => r.groupId);\n    },\n    async assignGroup(userId, groupId) {\n      await db\n        .insert(userGroups)\n        .values({ userId, groupId })\n        .onDuplicateKeyUpdate({ set: { groupId } });\n    },\n    async removeGroup(userId, groupId) {\n      await db\n        .delete(userGroups)\n        .where(and(eq(userGroups.userId, userId), eq(userGroups.groupId, groupId)));\n    },\n    async listUserPermissions(userId) {\n      const rows = await db\n        .select({ node: userPermissions.node })\n        .from(userPermissions)\n        .where(eq(userPermissions.userId, userId));\n      return (rows as { node: string }[]).map((r) => r.node);\n    },\n    async grantPermission(userId, node) {\n      await db\n        .insert(userPermissions)\n        .values({ userId, node })\n        .onDuplicateKeyUpdate({ set: { node } });\n    },\n    async revokePermission(userId, node) {\n      await db\n        .delete(userPermissions)\n        .where(and(eq(userPermissions.userId, userId), eq(userPermissions.node, node)));\n    },\n    async listAllGroupAssignments() {\n      const rows = await db.select().from(userGroups);\n      return (rows as { userId: string; groupId: string; assignedAt: Date }[]).map(\n        (r): UserGroupAssignment => ({\n          userId: r.userId,\n          groupId: r.groupId,\n          assignedAt: r.assignedAt,\n        }),\n      );\n    },\n    async purgeUser(userId) {\n      await db.delete(userPermissions).where(eq(userPermissions.userId, userId));\n      await db.delete(userGroups).where(eq(userGroups.userId, userId));\n    },\n  };\n}\n"]}

package/dist/pg/index.cjs

@@ -0,0 +1,101 @@
+'use strict';
+
+var pgCore = require('drizzle-orm/pg-core');
+var drizzleOrm = require('drizzle-orm');
+
+// src/pg/index.ts
+function createRbacTables(opts) {
+  const { usersTable, prefix = "holeauth_rbac_", persistGroups = false } = opts;
+  const p = (s) => `${prefix}${s}`;
+  const userGroups = pgCore.pgTable(
+    p("user_group"),
+    {
+      userId: pgCore.text("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+      groupId: pgCore.text("group_id").notNull(),
+      assignedAt: pgCore.timestamp("assigned_at", { withTimezone: true, mode: "date" }).notNull().defaultNow()
+    },
+    (t) => ({
+      pk: pgCore.primaryKey({ columns: [t.userId, t.groupId] }),
+      groupIdx: pgCore.index().on(t.groupId)
+    })
+  );
+  const userPermissions = pgCore.pgTable(
+    p("user_permission"),
+    {
+      userId: pgCore.text("user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+      node: pgCore.text("node").notNull(),
+      assignedAt: pgCore.timestamp("assigned_at", { withTimezone: true, mode: "date" }).notNull().defaultNow()
+    },
+    (t) => ({
+      pk: pgCore.primaryKey({ columns: [t.userId, t.node] })
+    })
+  );
+  const userGroupsRelations = drizzleOrm.relations(userGroups, ({ one }) => ({
+    user: one(usersTable, { fields: [userGroups.userId], references: [usersTable.id] })
+  }));
+  const userPermissionsRelations = drizzleOrm.relations(userPermissions, ({ one }) => ({
+    user: one(usersTable, { fields: [userPermissions.userId], references: [usersTable.id] })
+  }));
+  const groups = persistGroups ? pgCore.pgTable(p("group"), {
+    id: pgCore.text("id").primaryKey(),
+    displayName: pgCore.text("display_name"),
+    description: pgCore.text("description"),
+    priority: pgCore.integer("priority"),
+    isDefault: pgCore.boolean("is_default").notNull().default(false),
+    effective: pgCore.text("effective").array().notNull().default([]),
+    permissions: pgCore.text("permissions").array().notNull().default([])
+  }) : void 0;
+  return {
+    tables: {
+      userGroups,
+      userPermissions,
+      ...groups ? { groups } : {}
+    },
+    relations: { userGroupsRelations, userPermissionsRelations }
+  };
+}
+function createRbacAdapter(opts) {
+  const { db, tables } = opts;
+  const { userGroups, userPermissions } = tables;
+  return {
+    async listUserGroups(userId) {
+      const rows = await db.select({ groupId: userGroups.groupId }).from(userGroups).where(drizzleOrm.eq(userGroups.userId, userId));
+      return rows.map((r) => r.groupId);
+    },
+    async assignGroup(userId, groupId) {
+      await db.insert(userGroups).values({ userId, groupId }).onConflictDoNothing();
+    },
+    async removeGroup(userId, groupId) {
+      await db.delete(userGroups).where(drizzleOrm.and(drizzleOrm.eq(userGroups.userId, userId), drizzleOrm.eq(userGroups.groupId, groupId)));
+    },
+    async listUserPermissions(userId) {
+      const rows = await db.select({ node: userPermissions.node }).from(userPermissions).where(drizzleOrm.eq(userPermissions.userId, userId));
+      return rows.map((r) => r.node);
+    },
+    async grantPermission(userId, node) {
+      await db.insert(userPermissions).values({ userId, node }).onConflictDoNothing();
+    },
+    async revokePermission(userId, node) {
+      await db.delete(userPermissions).where(drizzleOrm.and(drizzleOrm.eq(userPermissions.userId, userId), drizzleOrm.eq(userPermissions.node, node)));
+    },
+    async listAllGroupAssignments() {
+      const rows = await db.select().from(userGroups);
+      return rows.map(
+        (r) => ({
+          userId: r.userId,
+          groupId: r.groupId,
+          assignedAt: r.assignedAt
+        })
+      );
+    },
+    async purgeUser(userId) {
+      await db.delete(userPermissions).where(drizzleOrm.eq(userPermissions.userId, userId));
+      await db.delete(userGroups).where(drizzleOrm.eq(userGroups.userId, userId));
+    }
+  };
+}
+
+exports.createRbacAdapter = createRbacAdapter;
+exports.createRbacTables = createRbacTables;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map

package/dist/pg/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/pg/index.ts"],"names":["pgTable","text","timestamp","primaryKey","index","relations","integer","boolean","eq","and"],"mappings":";;;;;;AAwBO,SAAS,iBAAyC,IAAA,EAAkC;AACzF,EAAA,MAAM,EAAE,UAAA,EAAY,MAAA,GAAS,gBAAA,EAAkB,aAAA,GAAgB,OAAM,GAAI,IAAA;AACzE,EAAA,MAAM,IAAI,CAAC,CAAA,KAAc,CAAA,EAAG,MAAM,GAAG,CAAC,CAAA,CAAA;AAEtC,EAAA,MAAM,UAAA,GAAaA,cAAA;AAAA,IACjB,EAAE,YAAY,CAAA;AAAA,IACd;AAAA,MACE,MAAA,EAAQC,WAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,UAAA,CAAW,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,MAC1D,OAAA,EAASA,WAAA,CAAK,UAAU,CAAA,CAAE,OAAA,EAAQ;AAAA,MAClC,UAAA,EAAYC,gBAAA,CAAU,aAAA,EAAe,EAAE,YAAA,EAAc,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,CAAA,CACtE,OAAA,EAAQ,CACR,UAAA;AAAW,KAChB;AAAA,IACA,CAAC,CAAA,MAAO;AAAA,MACN,EAAA,EAAIC,iBAAA,CAAW,EAAE,OAAA,EAAS,CAAC,EAAE,MAAA,EAAQ,CAAA,CAAE,OAAO,CAAA,EAAG,CAAA;AAAA,MACjD,QAAA,EAAUC,YAAA,EAAM,CAAE,EAAA,CAAG,EAAE,OAAO;AAAA,KAChC;AAAA,GACF;AAEA,EAAA,MAAM,eAAA,GAAkBJ,cAAA;AAAA,IACtB,EAAE,iBAAiB,CAAA;AAAA,IACnB;AAAA,MACE,MAAA,EAAQC,WAAA,CAAK,SAAS,CAAA,CACnB,OAAA,EAAQ,CACR,UAAA,CAAW,MAAM,UAAA,CAAW,EAAA,EAAI,EAAE,QAAA,EAAU,WAAW,CAAA;AAAA,MAC1D,IAAA,EAAMA,WAAA,CAAK,MAAM,CAAA,CAAE,OAAA,EAAQ;AAAA,MAC3B,UAAA,EAAYC,gBAAA,CAAU,aAAA,EAAe,EAAE,YAAA,EAAc,IAAA,EAAM,IAAA,EAAM,MAAA,EAAQ,CAAA,CACtE,OAAA,EAAQ,CACR,UAAA;AAAW,KAChB;AAAA,IACA,CAAC,CAAA,MAAO;AAAA,MACN,EAAA,EAAIC,iBAAA,CAAW,EAAE,OAAA,EAAS,CAAC,EAAE,MAAA,EAAQ,CAAA,CAAE,IAAI,CAAA,EAAG;AAAA,KAChD;AAAA,GACF;AAEA,EAAA,MAAM,sBAAsBE,oBAAA,CAAU,UAAA,EAAY,CAAC,EAAE,KAAI,MAAO;AAAA,IAC9D,IAAA,EAAM,GAAA,CAAI,UAAA,EAAY,EAAE,QAAQ,CAAC,UAAA,CAAW,MAAM,CAAA,EAAG,UAAA,EAAY,CAAC,UAAA,CAAW,EAAE,GAAG;AAAA,GACpF,CAAE,CAAA;AACF,EAAA,MAAM,2BAA2BA,oBAAA,CAAU,eAAA,EAAiB,CAAC,EAAE,KAAI,MAAO;AAAA,IACxE,IAAA,EAAM,GAAA,CAAI,UAAA,EAAY,EAAE,QAAQ,CAAC,eAAA,CAAgB,MAAM,CAAA,EAAG,UAAA,EAAY,CAAC,UAAA,CAAW,EAAE,GAAG;AAAA,GACzF,CAAE,CAAA;AAEF,EAAA,MAAM,MAAA,GAAS,aAAA,GACXL,cAAA,CAAQ,CAAA,CAAE,OAAO,CAAA,EAAG;AAAA,IAClB,EAAA,EAAIC,WAAA,CAAK,IAAI,CAAA,CAAE,UAAA,EAAW;AAAA,IAC1B,WAAA,EAAaA,YAAK,cAAc,CAAA;AAAA,IAChC,WAAA,EAAaA,YAAK,aAAa,CAAA;AAAA,IAC/B,QAAA,EAAUK,eAAQ,UAAU,CAAA;AAAA,IAC5B,WAAWC,cAAA,CAAQ,YAAY,EAAE,OAAA,EAAQ,CAAE,QAAQ,KAAK,CAAA;AAAA,IACxD,SAAA,EAAWN,WAAA,CAAK,WAAW,CAAA,CAAE,KAAA,GAAQ,OAAA,EAAQ,CAAE,OAAA,CAAQ,EAAE,CAAA;AAAA,IACzD,WAAA,EAAaA,WAAA,CAAK,aAAa,CAAA,CAAE,KAAA,GAAQ,OAAA,EAAQ,CAAE,OAAA,CAAQ,EAAE;AAAA,GAC9D,CAAA,GACD,MAAA;AAEJ,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ;AAAA,MACN,UAAA;AAAA,MACA,eAAA;AAAA,MACA,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,KAC7B;AAAA,IAKA,SAAA,EAAW,EAAE,mBAAA,EAAqB,wBAAA;AAAyB,GAC7D;AACF;AAUO,SAAS,kBAAkB,IAAA,EAA6C;AAC7E,EAAA,MAAM,EAAE,EAAA,EAAI,MAAA,EAAO,GAAI,IAAA;AACvB,EAAA,MAAM,EAAE,UAAA,EAAY,eAAA,EAAgB,GAAI,MAAA;AAExC,EAAA,OAAO;AAAA,IACL,MAAM,eAAe,MAAA,EAAQ;AAC3B,MAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,OAAA,EAAS,WAAW,OAAA,EAAS,CAAA,CACtC,IAAA,CAAK,UAAU,CAAA,CACf,KAAA,CAAMO,cAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAC,CAAA;AACtC,MAAA,OAAQ,IAAA,CAA+B,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,OAAO,CAAA;AAAA,IAC7D,CAAA;AAAA,IACA,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAA,EAAS;AACjC,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,UAAU,CAAA,CAAE,MAAA,CAAO,EAAE,MAAA,EAAQ,OAAA,EAAS,CAAA,CAAE,mBAAA,EAAoB;AAAA,IAC9E,CAAA;AAAA,IACA,MAAM,WAAA,CAAY,MAAA,EAAQ,OAAA,EAAS;AACjC,MAAA,MAAM,GACH,MAAA,CAAO,UAAU,CAAA,CACjB,KAAA,CAAMC,eAAID,aAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,GAAGA,aAAA,CAAG,UAAA,CAAW,OAAA,EAAS,OAAO,CAAC,CAAC,CAAA;AAAA,IAC9E,CAAA;AAAA,IACA,MAAM,oBAAoB,MAAA,EAAQ;AAChC,MAAA,MAAM,OAAO,MAAM,EAAA,CAChB,OAAO,EAAE,IAAA,EAAM,gBAAgB,IAAA,EAAM,CAAA,CACrC,IAAA,CAAK,eAAe,CAAA,CACpB,KAAA,CAAMA,cAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAC,CAAA;AAC3C,MAAA,OAAQ,IAAA,CAA4B,GAAA,CAAI,CAAC,CAAA,KAAM,EAAE,IAAI,CAAA;AAAA,IACvD,CAAA;AAAA,IACA,MAAM,eAAA,CAAgB,MAAA,EAAQ,IAAA,EAAM;AAClC,MAAA,MAAM,EAAA,CAAG,MAAA,CAAO,eAAe,CAAA,CAAE,MAAA,CAAO,EAAE,MAAA,EAAQ,IAAA,EAAM,CAAA,CAAE,mBAAA,EAAoB;AAAA,IAChF,CAAA;AAAA,IACA,MAAM,gBAAA,CAAiB,MAAA,EAAQ,IAAA,EAAM;AACnC,MAAA,MAAM,GACH,MAAA,CAAO,eAAe,CAAA,CACtB,KAAA,CAAMC,eAAID,aAAA,CAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,GAAGA,aAAA,CAAG,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,CAAC,CAAA;AAAA,IAClF,CAAA;AAAA,IACA,MAAM,uBAAA,GAA0B;AAC9B,MAAA,MAAM,OAAO,MAAM,EAAA,CAAG,MAAA,EAAO,CAAE,KAAK,UAAU,CAAA;AAC9C,MAAA,OAAQ,IAAA,CAAiE,GAAA;AAAA,QACvE,CAAC,CAAA,MAA4B;AAAA,UAC3B,QAAQ,CAAA,CAAE,MAAA;AAAA,UACV,SAAS,CAAA,CAAE,OAAA;AAAA,UACX,YAAY,CAAA,CAAE;AAAA,SAChB;AAAA,OACF;AAAA,IACF,CAAA;AAAA,IACA,MAAM,UAAU,MAAA,EAAQ;AACtB,MAAA,MAAM,EAAA,CAAG,OAAO,eAAe,CAAA,CAAE,MAAMA,aAAA,CAAG,eAAA,CAAgB,MAAA,EAAQ,MAAM,CAAC,CAAA;AACzE,MAAA,MAAM,EAAA,CAAG,OAAO,UAAU,CAAA,CAAE,MAAMA,aAAA,CAAG,UAAA,CAAW,MAAA,EAAQ,MAAM,CAAC,CAAA;AAAA,IACjE;AAAA,GACF;AACF","file":"index.cjs","sourcesContent":["import {\n  pgTable,\n  text,\n  timestamp,\n  integer,\n  boolean,\n  primaryKey,\n  index,\n  type PgTableWithColumns,\n} from 'drizzle-orm/pg-core';\nimport { relations, eq, and } from 'drizzle-orm';\nimport type { RbacAdapter, UserGroupAssignment } from '@holeauth/plugin-rbac';\n\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\nexport type PgUsersTable = PgTableWithColumns<any> & { id: any };\n\nexport interface CreateRbacTablesOptions<U extends PgUsersTable> {\n  usersTable: U;\n  /** Prefix for rbac tables. Default `holeauth_rbac_`. */\n  prefix?: string;\n  /** Also persist group definitions (opt-in). Default `false` — groups come from YAML. */\n  persistGroups?: boolean;\n}\n\nexport function createRbacTables<U extends PgUsersTable>(opts: CreateRbacTablesOptions<U>) {\n  const { usersTable, prefix = 'holeauth_rbac_', persistGroups = false } = opts;\n  const p = (s: string) => `${prefix}${s}`;\n\n  const userGroups = pgTable(\n    p('user_group'),\n    {\n      userId: text('user_id')\n        .notNull()\n        .references(() => usersTable.id, { onDelete: 'cascade' }),\n      groupId: text('group_id').notNull(),\n      assignedAt: timestamp('assigned_at', { withTimezone: true, mode: 'date' })\n        .notNull()\n        .defaultNow(),\n    },\n    (t) => ({\n      pk: primaryKey({ columns: [t.userId, t.groupId] }),\n      groupIdx: index().on(t.groupId),\n    }),\n  );\n\n  const userPermissions = pgTable(\n    p('user_permission'),\n    {\n      userId: text('user_id')\n        .notNull()\n        .references(() => usersTable.id, { onDelete: 'cascade' }),\n      node: text('node').notNull(),\n      assignedAt: timestamp('assigned_at', { withTimezone: true, mode: 'date' })\n        .notNull()\n        .defaultNow(),\n    },\n    (t) => ({\n      pk: primaryKey({ columns: [t.userId, t.node] }),\n    }),\n  );\n\n  const userGroupsRelations = relations(userGroups, ({ one }) => ({\n    user: one(usersTable, { fields: [userGroups.userId], references: [usersTable.id] }),\n  }));\n  const userPermissionsRelations = relations(userPermissions, ({ one }) => ({\n    user: one(usersTable, { fields: [userPermissions.userId], references: [usersTable.id] }),\n  }));\n\n  const groups = persistGroups\n    ? pgTable(p('group'), {\n        id: text('id').primaryKey(),\n        displayName: text('display_name'),\n        description: text('description'),\n        priority: integer('priority'),\n        isDefault: boolean('is_default').notNull().default(false),\n        effective: text('effective').array().notNull().default([]),\n        permissions: text('permissions').array().notNull().default([]),\n      })\n    : undefined;\n\n  return {\n    tables: {\n      userGroups,\n      userPermissions,\n      ...(groups ? { groups } : {}),\n    } as {\n      userGroups: typeof userGroups;\n      userPermissions: typeof userPermissions;\n      groups?: NonNullable<typeof groups>;\n    },\n    relations: { userGroupsRelations, userPermissionsRelations },\n  };\n}\n\ntype RbacTables = ReturnType<typeof createRbacTables>['tables'];\n\nexport interface CreateRbacAdapterOptions {\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  db: any;\n  tables: RbacTables;\n}\n\nexport function createRbacAdapter(opts: CreateRbacAdapterOptions): RbacAdapter {\n  const { db, tables } = opts;\n  const { userGroups, userPermissions } = tables;\n\n  return {\n    async listUserGroups(userId) {\n      const rows = await db\n        .select({ groupId: userGroups.groupId })\n        .from(userGroups)\n        .where(eq(userGroups.userId, userId));\n      return (rows as { groupId: string }[]).map((r) => r.groupId);\n    },\n    async assignGroup(userId, groupId) {\n      await db.insert(userGroups).values({ userId, groupId }).onConflictDoNothing();\n    },\n    async removeGroup(userId, groupId) {\n      await db\n        .delete(userGroups)\n        .where(and(eq(userGroups.userId, userId), eq(userGroups.groupId, groupId)));\n    },\n    async listUserPermissions(userId) {\n      const rows = await db\n        .select({ node: userPermissions.node })\n        .from(userPermissions)\n        .where(eq(userPermissions.userId, userId));\n      return (rows as { node: string }[]).map((r) => r.node);\n    },\n    async grantPermission(userId, node) {\n      await db.insert(userPermissions).values({ userId, node }).onConflictDoNothing();\n    },\n    async revokePermission(userId, node) {\n      await db\n        .delete(userPermissions)\n        .where(and(eq(userPermissions.userId, userId), eq(userPermissions.node, node)));\n    },\n    async listAllGroupAssignments() {\n      const rows = await db.select().from(userGroups);\n      return (rows as { userId: string; groupId: string; assignedAt: Date }[]).map(\n        (r): UserGroupAssignment => ({\n          userId: r.userId,\n          groupId: r.groupId,\n          assignedAt: r.assignedAt,\n        }),\n      );\n    },\n    async purgeUser(userId) {\n      await db.delete(userPermissions).where(eq(userPermissions.userId, userId));\n      await db.delete(userGroups).where(eq(userGroups.userId, userId));\n    },\n  };\n}\n"]}