@kubun/db-adapter 0.16.0 → 0.18.0

package/lib/chunk.d.ts

@@ -0,0 +1,2 @@
+export declare const IN_LIST_CHUNK = 500;
+export declare function chunked<T>(values: Iterable<T>, size?: number): Array<Array<T>>;

package/lib/chunk.js

@@ -0,0 +1,15 @@
+// The most values one `IN (...)` list binds; longer lists are read in chunks,
+// well inside every adapter's bind-parameter limit.
+export const IN_LIST_CHUNK = 500;
+export function chunked(values, size = IN_LIST_CHUNK) {
+    // Deduplicated first, as a single `IN` would be: a value repeated across
+    // two chunks would otherwise return its rows twice.
+    const unique = [
+        ...new Set(values)
+    ];
+    const chunks = [];
+    for(let start = 0; start < unique.length; start += size){
+        chunks.push(unique.slice(start, start + size));
+    }
+    return chunks;
+}

package/lib/index.d.ts

@@ -1,3 +1,4 @@
+export { chunked, IN_LIST_CHUNK } from './chunk.js';
 export { AbstractPostgresAdapter, type PostgresTypes } from './postgres.js';
 export { AbstractSQLiteAdapter, type SQLiteTypes } from './sqlite.js';
 export type { AbstractAdapter, Adapter, AdapterTypes, ColumnTypes, CreatedAtColumn, Functions, SearchHit, SearchIndexConfig, SearchQuery, UpdatedAtColumn, } from './types.js';

package/lib/index.js

@@ -1,2 +1,3 @@
+export { chunked, IN_LIST_CHUNK } from './chunk.js';
 export { AbstractPostgresAdapter } from './postgres.js';
 export { AbstractSQLiteAdapter } from './sqlite.js';

package/lib/postgres.d.ts

@@ -19,6 +19,10 @@ export declare class AbstractPostgresAdapter<T extends AdapterTypes = PostgresTy
     arrayIncludesAllPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayIncludesAnyPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayPresencePredicate(expression: Expression<unknown>, mode: ArrayPresenceMode): RawBuilder<boolean>;
+    groupReadPredicate(fieldValues: Expression<unknown>, params: {
+        groupID: string;
+        circleIDs: Array<string>;
+    }): RawBuilder<boolean>;
     readAccessPredicate(params: {
         viewerDID: string;
         groupIDs: Array<string>;

package/lib/postgres.js

@@ -55,7 +55,7 @@ export class AbstractPostgresAdapter {
     }
     arrayIncludesAnyPredicate(expression, values) {
         // Elements, not `?|`, so numeric arrays are covered too (`?|` only matches string keys).
-        return sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(${expression}, '[]'::jsonb)) AS _t WHERE _t IN (${sql.join(values.map((v)=>sql`${v}`))}))`;
+        return sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(${expression}) = 'array' then ${expression} else '[]'::jsonb end) AS _t WHERE _t IN (${sql.join(values.map((v)=>sql`${v}`))}))`;
     }
     arrayPresencePredicate(expression, mode) {
         // null/nonNull/empty/nonEmpty must see the true NULL, so the node is never coalesced
@@ -75,26 +75,43 @@ export class AbstractPostgresAdapter {
                 throw new Error(`Invalid array presence mode: ${mode}`);
         }
     }
+    groupReadPredicate(fieldValues, params) {
+        const read = sql`${fieldValues} -> '$readRule'`;
+        const level = sql`${read} ->> 'level'`;
+        const grants = (field, ids)=>{
+            const node = sql`${read} -> ${sql.lit(field)}`;
+            const array = sql`case when jsonb_typeof(${node}) = 'array' then ${node} else '[]'::jsonb end`;
+            return sql`(not exists (select 1 from jsonb_array_elements(${array}) as entry(value) where jsonb_typeof(value) != 'string')
+        and exists (select 1 from jsonb_array_elements_text(${array}) as entry(value) where value in (select jsonb_array_elements_text(case when jsonb_typeof(${JSON.stringify(ids)}::text::jsonb) = 'array' then ${JSON.stringify(ids)}::text::jsonb else '[]'::jsonb end))))`;
+        };
+        const restricted = [
+            grants('allowedGroups', [
+                params.groupID
+            ])
+        ];
+        if (params.circleIDs.length > 0) restricted.push(grants('allowedCircles', params.circleIDs));
+        return sql`(${level} = 'anyone' or (${level} = 'restricted' and (${sql.join(restricted, sql` or `)})))`;
+    }
     readAccessPredicate(params, modelID) {
         const { viewerDID, groupIDs, circleIDs, serverDefault } = params;
         const docRestrictedParts = [
-            sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(data -> 'accessPermissions' -> 'read' -> 'allowedDIDs', '[]'::jsonb)) AS _t WHERE _t = ${viewerDID})`
+            sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(data -> 'accessPermissions' -> 'read' -> 'allowedDIDs') = 'array' then data -> 'accessPermissions' -> 'read' -> 'allowedDIDs' else '[]'::jsonb end) AS _t WHERE _t = ${viewerDID})`
         ];
         if (groupIDs.length > 0) {
-            docRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(data -> 'accessPermissions' -> 'read' -> 'allowedGroups', '[]'::jsonb)) AS _t WHERE _t IN (${sql.join(groupIDs.map((id)=>sql`${id}`))}))`);
+            docRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(data -> 'accessPermissions' -> 'read' -> 'allowedGroups') = 'array' then data -> 'accessPermissions' -> 'read' -> 'allowedGroups' else '[]'::jsonb end) AS _t WHERE _t IN (${sql.join(groupIDs.map((id)=>sql`${id}`))}))`);
         }
         if (circleIDs.length > 0) {
-            docRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(data -> 'accessPermissions' -> 'read' -> 'allowedCircles', '[]'::jsonb)) AS _t WHERE _t IN (${sql.join(circleIDs.map((id)=>sql`${id}`))}))`);
+            docRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(data -> 'accessPermissions' -> 'read' -> 'allowedCircles') = 'array' then data -> 'accessPermissions' -> 'read' -> 'allowedCircles' else '[]'::jsonb end) AS _t WHERE _t IN (${sql.join(circleIDs.map((id)=>sql`${id}`))}))`);
         }
         const docRestricted = docRestrictedParts.reduce((a, b)=>sql`${a} OR ${b}`);
         const madRestrictedParts = [
-            sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(_mad.allowed_dids, '[]'::jsonb)) AS _t WHERE _t = ${viewerDID})`
+            sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(_mad.allowed_dids) = 'array' then _mad.allowed_dids else '[]'::jsonb end) AS _t WHERE _t = ${viewerDID})`
         ];
         if (groupIDs.length > 0) {
-            madRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(_mad.allowed_groups, '[]'::jsonb)) AS _t WHERE _t IN (${sql.join(groupIDs.map((id)=>sql`${id}`))}))`);
+            madRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(_mad.allowed_groups) = 'array' then _mad.allowed_groups else '[]'::jsonb end) AS _t WHERE _t IN (${sql.join(groupIDs.map((id)=>sql`${id}`))}))`);
         }
         if (circleIDs.length > 0) {
-            madRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(COALESCE(_mad.allowed_circles, '[]'::jsonb)) AS _t WHERE _t IN (${sql.join(circleIDs.map((id)=>sql`${id}`))}))`);
+            madRestrictedParts.push(sql`EXISTS (SELECT 1 FROM jsonb_array_elements_text(case when jsonb_typeof(_mad.allowed_circles) = 'array' then _mad.allowed_circles else '[]'::jsonb end) AS _t WHERE _t IN (${sql.join(circleIDs.map((id)=>sql`${id}`))}))`);
         }
         const madRestricted = madRestrictedParts.reduce((a, b)=>sql`${a} OR ${b}`);
         const serverDefaultCond = serverDefault === 'anyone' ? sql`true` : serverDefault === 'only_owner' ? sql`owner = ${viewerDID}` : sql`false`;
@@ -117,6 +134,9 @@ export class AbstractPostgresAdapter {
         SELECT 1 FROM kubun_graph_user_model_access_defaults AS _mad2
         WHERE _mad2.owner_did = owner AND _mad2.model_id = ${modelID} AND _mad2.permission_type = 'read'
         AND (_mad2.removed IS NULL OR _mad2.removed = 0)
+      ) AND NOT EXISTS (
+        SELECT 1 FROM kubun_graph_access_default_records AS _adr
+        WHERE _adr.type = 'access.default' AND _adr.owner = ${sql.ref(`k_${modelID}.owner`)}
       ) AND (${serverDefaultCond}))
     )`;
     }

package/lib/sqlite.d.ts

@@ -19,6 +19,10 @@ export declare class AbstractSQLiteAdapter<T extends AdapterTypes = SQLiteTypes>
     arrayIncludesAllPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayIncludesAnyPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayPresencePredicate(expression: Expression<unknown>, mode: ArrayPresenceMode): RawBuilder<boolean>;
+    groupReadPredicate(fieldValues: Expression<unknown>, params: {
+        groupID: string;
+        circleIDs: Array<string>;
+    }): RawBuilder<boolean>;
     readAccessPredicate(params: {
         viewerDID: string;
         groupIDs: Array<string>;

package/lib/sqlite.js

@@ -83,6 +83,22 @@ export class AbstractSQLiteAdapter {
                 throw new Error(`Invalid array presence mode: ${mode}`);
         }
     }
+    groupReadPredicate(fieldValues, params) {
+        const level = sql`json_extract(${fieldValues}, '$."$readRule".level')`;
+        const grants = (field, ids)=>{
+            const path = `$."$readRule".${field}`;
+            return sql`(json_type(${fieldValues}, ${path}) = 'array'
+        and not exists (select 1 from json_each(json_extract(${fieldValues}, ${path})) where type != 'text')
+        and exists (select 1 from json_each(json_extract(${fieldValues}, ${path})) where value in (select value from json_each(${JSON.stringify(ids)}))))`;
+        };
+        const restricted = [
+            grants('allowedGroups', [
+                params.groupID
+            ])
+        ];
+        if (params.circleIDs.length > 0) restricted.push(grants('allowedCircles', params.circleIDs));
+        return sql`(${level} = 'anyone' or (${level} = 'restricted' and (${sql.join(restricted, sql` or `)})))`;
+    }
     readAccessPredicate(params, modelID) {
         const { viewerDID, groupIDs, circleIDs, serverDefault } = params;
         const docRestrictedParts = [
@@ -125,6 +141,9 @@ export class AbstractSQLiteAdapter {
         SELECT 1 FROM kubun_graph_user_model_access_defaults AS _mad2
         WHERE _mad2.owner_did = owner AND _mad2.model_id = ${modelID} AND _mad2.permission_type = 'read'
         AND (_mad2.removed IS NULL OR _mad2.removed = 0)
+      ) AND NOT EXISTS (
+        SELECT 1 FROM kubun_graph_access_default_records AS _adr
+        WHERE _adr.type = 'access.default' AND _adr.owner = ${sql.ref(`k_${modelID}.owner`)}
       ) AND (${serverDefaultCond}))
     )`;
     }

package/lib/types.d.ts

@@ -58,6 +58,10 @@ export type AbstractAdapter<T extends AdapterTypes = AdapterTypes> = {
     arrayIncludesAllPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayIncludesAnyPredicate(expression: Expression<unknown>, values: Array<unknown>): RawBuilder<boolean>;
     arrayPresencePredicate(expression: Expression<unknown>, mode: ArrayPresenceMode): RawBuilder<boolean>;
+    groupReadPredicate(fieldValues: Expression<unknown>, params: {
+        groupID: string;
+        circleIDs: Array<string>;
+    }): RawBuilder<boolean>;
     readAccessPredicate(params: {
         viewerDID: string;
         groupIDs: Array<string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kubun/db-adapter",
-  "version": "0.16.0",
+  "version": "0.18.0",
   "keywords": [],
   "license": "see LICENSE.md",
   "sideEffects": false,
@@ -15,7 +15,7 @@
     "LICENSE.md"
   ],
   "dependencies": {
-    "kysely": "^0.29.5"
+    "kysely": "^0.29.7"
   },
   "publishConfig": {
     "access": "public"
@@ -23,8 +23,8 @@
   "scripts": {
     "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
-    "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
-    "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
+    "build:js": "del 'lib/**/*.js' && swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
+    "build:types": "del 'lib/**/*.d.ts' 'lib/**/*.d.ts.map' && tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
     "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit",