@ingram-tech/nk-auth 0.19.3 → 0.19.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/chain.d.ts +5 -2
  2. package/dist/chain.d.ts.map +1 -1
  3. package/dist/chain.js +15 -4
  4. package/dist/chain.js.map +1 -1
  5. package/package.json +1 -1
  6. package/src/chain.ts +17 -6
package/dist/chain.d.ts CHANGED
@@ -32,8 +32,11 @@ export interface AuthChainCheckOptions {
32
32
  * Returns the runner's status when it is, or `null` when the database has no
33
33
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
34
34
  * own chain (a squashed baseline) never records this one, and that is not a
35
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
36
- * exists but lags the installed package.
35
+ * deployment mistake. Also `null` when this role cannot read the journal (a
36
+ * least-privilege auth role with no access to the `drizzle` schema): it could
37
+ * not have applied the chain either, so there is nothing to verify through it.
38
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
39
+ * installed package.
37
40
  *
38
41
  * `createAuthHelpers` runs this once per process on the first session read
39
42
  * when the instance's `database` is a `pg` Pool; call it yourself from
package/dist/chain.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGrF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAOtC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAS3D;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,YAAY,OAAO,EAAE,SAAS,MAAM,EAAE,EAMrC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,SAC5B,IAAI,YACD,qBAAqB,KAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CAkBhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aAChB,OAAO,YACR,qBAAqB,KAC5B,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAOtB,CAAC"}
1
+ {"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAGrF,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;AAE/B;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,QAAO,MAOtC,CAAC;AAEH,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,wBAAwB,CAAC;AAS3D;;;;;;GAMG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;IAClD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,YAAY,OAAO,EAAE,SAAS,MAAM,EAAE,EAMrC;CACD;AAED,MAAM,WAAW,qBAAqB;IACrC,sFAAsF;IACtF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,sBAAsB,SAC5B,IAAI,YACD,qBAAqB,KAC5B,OAAO,CAAC,eAAe,GAAG,IAAI,CA0BhC,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,aAChB,OAAO,YACR,qBAAqB,KAC5B,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAOtB,CAAC"}
package/dist/chain.js CHANGED
@@ -36,8 +36,11 @@ export class AuthChainNotAppliedError extends Error {
36
36
  * Returns the runner's status when it is, or `null` when the database has no
37
37
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
38
38
  * own chain (a squashed baseline) never records this one, and that is not a
39
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
40
- * exists but lags the installed package.
39
+ * deployment mistake. Also `null` when this role cannot read the journal (a
40
+ * least-privilege auth role with no access to the `drizzle` schema): it could
41
+ * not have applied the chain either, so there is nothing to verify through it.
42
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
43
+ * installed package.
41
44
  *
42
45
  * `createAuthHelpers` runs this once per process on the first session read
43
46
  * when the instance's `database` is a `pg` Pool; call it yourself from
@@ -46,8 +49,16 @@ export class AuthChainNotAppliedError extends Error {
46
49
  export const assertAuthChainApplied = async (pool, options = {}) => {
47
50
  const schema = options.migrationsSchema ?? "drizzle";
48
51
  const table = options.migrationsTable ?? AUTH_MIGRATIONS_TABLE;
49
- const { rows } = await pool.query("select to_regclass($1) as present", [`"${schema}"."${table}"`]);
50
- if (rows[0]?.present === null || rows[0]?.present === undefined)
52
+ // Look the journal up in pg_catalog, which every role can read:
53
+ // `to_regclass` raises "permission denied" instead of returning null when the
54
+ // role lacks USAGE on the schema, and that broke every session read on a
55
+ // site whose auth role has no business in `drizzle`.
56
+ const { rows } = await pool.query(`select has_schema_privilege(n.oid, 'USAGE')
57
+ and has_table_privilege(c.oid, 'SELECT') as readable
58
+ from pg_catalog.pg_class c
59
+ join pg_catalog.pg_namespace n on n.oid = c.relnamespace
60
+ where n.nspname = $1 and c.relname = $2`, [schema, table]);
61
+ if (rows[0]?.readable !== true)
51
62
  return null;
52
63
  const status = await inspectMigrations({
53
64
  pool,
package/dist/chain.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAChD,OAAO,CACN,OAAO,CACN,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CACrC,oDAAoD,CACpD,CACD,CACD,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAA6B,CAAC,KAAK,KAAK,UAAU;IAC1D,OAAQ,KAA+B,CAAC,OAAO,KAAK,UAAU,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,OAAO,CAAoB;IACpC,YAAY,OAA0B;QACrC,KAAK,CACJ,yBAAyB,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G,qBAAqB,kCAAkC,CACvS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AASD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAC1C,IAAU,EACV,OAAO,GAA0B,EAAE,EACD,EAAE;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,CAAC;IAC/D,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC,mCAAmC,EACnC,CAAC,IAAI,MAAM,MAAM,KAAK,GAAG,CAAC,CAC1B,CAAC;IACF,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,oBAAoB,EAAE;QACxC,gBAAgB,EAAE,MAAM;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,QAAiB,EACjB,OAAO,GAA0B,EAAE,EACX,EAAE;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC7C,IAAI,OAAkC,CAAC;IACvC,OAAO,GAAG,EAAE;QACX,OAAO,KAAK,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC,CAAC"}
1
+ {"version":3,"file":"chain.js","sourceRoot":"","sources":["../src/chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAwB,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAW,EAAE,CAChD,OAAO,CACN,OAAO,CACN,aAAa,CAAC,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CACrC,oDAAoD,CACpD,CACD,CACD,CAAC;AAEH,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,qBAAqB,CAAC;AAE3D,mEAAmE;AACnE,MAAM,MAAM,GAAG,CAAC,KAAc,EAAiB,EAAE,CAChD,OAAO,KAAK,KAAK,QAAQ;IACzB,KAAK,KAAK,IAAI;IACd,OAAQ,KAA6B,CAAC,KAAK,KAAK,UAAU;IAC1D,OAAQ,KAA+B,CAAC,OAAO,KAAK,UAAU,CAAC;AAEhE;;;;;;GAMG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACzC,OAAO,CAAoB;IACpC,YAAY,OAA0B;QACrC,KAAK,CACJ,yBAAyB,OAAO,CAAC,MAAM,6EAA6E,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,0GAA0G,qBAAqB,kCAAkC,CACvS,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACxB,CAAC;CACD;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EAC1C,IAAU,EACV,OAAO,GAA0B,EAAE,EACD,EAAE;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,IAAI,qBAAqB,CAAC;IAC/D,gEAAgE;IAChE,8EAA8E;IAC9E,yEAAyE;IACzE,qDAAqD;IACrD,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAChC;;;;0CAIwC,EACxC,CAAC,MAAM,EAAE,KAAK,CAAC,CACf,CAAC;IACF,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACtC,IAAI;QACJ,gBAAgB,EAAE,oBAAoB,EAAE;QACxC,gBAAgB,EAAE,MAAM;QACxB,eAAe,EAAE,KAAK;KACtB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,wBAAwB,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC7B,QAAiB,EACjB,OAAO,GAA0B,EAAE,EACX,EAAE;IAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,IAAI,EAAE,GAAE,CAAC,CAAC;IAC7C,IAAI,OAAkC,CAAC;IACvC,OAAO,GAAG,EAAE;QACX,OAAO,KAAK,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5E,OAAO,OAAO,CAAC;IAChB,CAAC,CAAC;AACH,CAAC,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@ingram-tech/nk-auth",
3
- "version": "0.19.3",
3
+ "version": "0.19.4",
4
4
  "description": "The Ingram Better Auth foundation: composable presets (org, dual-shape JWT, active-org hooks, pg pool) for Next.js sites.",
5
5
  "license": "MIT",
6
6
  "type": "module",
package/src/chain.ts CHANGED
@@ -59,8 +59,11 @@ export interface AuthChainCheckOptions {
59
59
  * Returns the runner's status when it is, or `null` when the database has no
60
60
  * nk-auth journal table at all: a site that owns Better Auth's tables in its
61
61
  * own chain (a squashed baseline) never records this one, and that is not a
62
- * deployment mistake. Throws {@link AuthChainNotAppliedError} when the journal
63
- * exists but lags the installed package.
62
+ * deployment mistake. Also `null` when this role cannot read the journal (a
63
+ * least-privilege auth role with no access to the `drizzle` schema): it could
64
+ * not have applied the chain either, so there is nothing to verify through it.
65
+ * Throws {@link AuthChainNotAppliedError} when the journal exists but lags the
66
+ * installed package.
64
67
  *
65
68
  * `createAuthHelpers` runs this once per process on the first session read
66
69
  * when the instance's `database` is a `pg` Pool; call it yourself from
@@ -72,11 +75,19 @@ export const assertAuthChainApplied = async (
72
75
  ): Promise<MigrationStatus | null> => {
73
76
  const schema = options.migrationsSchema ?? "drizzle";
74
77
  const table = options.migrationsTable ?? AUTH_MIGRATIONS_TABLE;
75
- const { rows } = await pool.query<{ present: string | null }>(
76
- "select to_regclass($1) as present",
77
- [`"${schema}"."${table}"`],
78
+ // Look the journal up in pg_catalog, which every role can read:
79
+ // `to_regclass` raises "permission denied" instead of returning null when the
80
+ // role lacks USAGE on the schema, and that broke every session read on a
81
+ // site whose auth role has no business in `drizzle`.
82
+ const { rows } = await pool.query<{ readable: boolean }>(
83
+ `select has_schema_privilege(n.oid, 'USAGE')
84
+ and has_table_privilege(c.oid, 'SELECT') as readable
85
+ from pg_catalog.pg_class c
86
+ join pg_catalog.pg_namespace n on n.oid = c.relnamespace
87
+ where n.nspname = $1 and c.relname = $2`,
88
+ [schema, table],
78
89
  );
79
- if (rows[0]?.present === null || rows[0]?.present === undefined) return null;
90
+ if (rows[0]?.readable !== true) return null;
80
91
  const status = await inspectMigrations({
81
92
  pool,
82
93
  migrationsFolder: authMigrationsFolder(),