@kubun/graphql 0.11.0 → 0.12.0

package/lib/context.d.ts

@@ -1,6 +1,6 @@
 import { DocumentID } from '@kubun/id';
 import type { AggregateHaving, AggregateSpec, AggregateValues, DocumentData, DocumentFilter, DocumentNode, DocumentOrderBy, GroupedAggregateOrderTerm, GroupedAggregateValue } from '@kubun/protocol';
-import type { ViewerReadAccess } from '@kubun/store-graph';
+import type { StoredAccessDefaultRow, ViewerReadAccess } from '@kubun/store-graph';
 import type { Tracer } from '@sozai/otel';
 import type { GraphQLResolveInfo } from 'graphql';
 import type { Connection, Edge } from 'graphql-relay';
@@ -83,6 +83,7 @@ export type ReadContextDB = {
         modelID: string;
         rank: number;
     }>>;
+    listUserModelAccessDefaults(ownerDID: string): Promise<Array<StoredAccessDefaultRow>>;
 };
 /**
  * Query scope carried alongside a connection value so child resolvers (e.g.
@@ -148,6 +149,12 @@ export type QueryContext = {
         modelID: string;
         rank: number;
     }>>;
+    /**
+     * The viewer's own stored model-access-default rows, across every model and
+     * permission type. Scoped to the current viewer DID - not for cross-member
+     * visibility.
+     */
+    listModelAccessDefaults(): Promise<Array<StoredAccessDefaultRow>>;
 };
 /**
  * Subscription functions requiring server implementation

package/lib/context.js

@@ -8,6 +8,7 @@ import { withSpan } from '@sozai/otel';
  * generator. When a consumer falls behind, the oldest events are evicted so a
  * single slow subscriber cannot grow memory without bound.
  */ const DEFAULT_SUBSCRIPTION_QUEUE_SIZE = 1000;
+/** Access checks in flight at once — see `filterByAccess`. */ const ACCESS_CHECK_CONCURRENCY = 25;
 /**
  * Minimum spacing between repeated overflow warnings for a single generator, so
  * a sustained overflow logs at most once per interval instead of per drop.
@@ -25,6 +26,34 @@ import { withSpan } from '@sozai/otel';
 const logger = getKubunLogger('graphql');
 export function createReadContext(params) {
     const { store, viewerDID, accessChecker, viewerReadAccess } = params;
+    /**
+   * Keep the documents a viewer may read, in their original order.
+   *
+   * The checks are independent reads over one viewer, so they run concurrently;
+   * checking in sequence only ever bought the order the denial warnings were
+   * pushed in, and filtering after every verdict is in preserves that too.
+   */ async function filterByAccess(documents, check) {
+        // Concurrent but bounded. Each check issues its own reads, and the page
+        // reaching here can be as large as `unboundedScanCap` (5000) — one
+        // `Promise.all` over that queues five thousand reads onto a single SQLite
+        // connection at once, which is slower than the sequential version it
+        // replaced and starves everything else on that connection.
+        const verdicts = [];
+        for(let index = 0; index < documents.length; index += ACCESS_CHECK_CONCURRENCY){
+            const batch = documents.slice(index, index + ACCESS_CHECK_CONCURRENCY);
+            verdicts.push(...await Promise.all(batch.map((doc)=>check(doc, 'read'))));
+        }
+        return documents.filter((doc, index)=>{
+            if (verdicts[index]) {
+                return true;
+            }
+            params.warnings?.push({
+                message: `Access denied for document ${doc.id}`,
+                code: 'KB07'
+            });
+            return false;
+        });
+    }
     function traced(name, attributes, fn) {
         if (params.tracer != null) {
             return withSpan(params.tracer, name, {
@@ -206,6 +235,9 @@ export function createReadContext(params) {
                 first
             });
         },
+        async listModelAccessDefaults () {
+            return await store.listUserModelAccessDefaults(viewerDID);
+        },
         async resolveConnection (modelIDs, args) {
             const resolverKey = `connection:${modelIDs.join(',')}`;
             const start = params.complexity?.resolverTimings != null ? performance.now() : 0;
@@ -252,17 +284,7 @@ export function createReadContext(params) {
                     // Apply access control
                     let accessible = documents;
                     if (accessChecker) {
-                        accessible = [];
-                        for (const doc of documents){
-                            if (await accessChecker(doc, 'read')) {
-                                accessible.push(doc);
-                            } else if (params.warnings != null) {
-                                params.warnings.push({
-                                    message: `Access denied for document ${doc.id}`,
-                                    code: 'KB07'
-                                });
-                            }
-                        }
+                        accessible = await filterByAccess(documents, accessChecker);
                     }
                     // Order by search rank
                     const rankMap = new Map(searchResults.map((r)=>[
@@ -491,17 +513,7 @@ export function createReadContext(params) {
                     return documents;
                 }
                 // Filter based on access control
-                const accessible = [];
-                for (const doc of documents){
-                    if (await accessChecker(doc, 'read')) {
-                        accessible.push(doc);
-                    } else if (params.warnings != null) {
-                        params.warnings.push({
-                            message: `Access denied for document ${doc.id}`,
-                            code: 'KB07'
-                        });
-                    }
-                }
+                const accessible = await filterByAccess(documents, accessChecker);
                 if (params.complexity != null) {
                     params.complexity.resolverCount++;
                     for (const id of modelIDs){

package/lib/scalars.js

@@ -6,6 +6,7 @@ function validateURL(input) {
     try {
         return new URL(input).toString();
     } catch  {
+        // biome-ignore lint/style/useErrorCause: GraphQLError
         throw new GraphQLError(`Invalid URL: ${input}`);
     }
 }

package/lib/schema.js

@@ -581,6 +581,42 @@ export class SchemaBuilder {
                 }
             };
         }
+        // Introspection: the viewer's own model-access-default rows. The stored
+        // rows are one-per-(model, permissionType); group them by modelID so each
+        // result groups read+write into `permissions`, matching `ModelAccessDefaults`.
+        queryFields.modelAccessDefaults = {
+            type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(ModelAccessDefaults))),
+            resolve: async (_root, _args, ctx)=>{
+                const viewerDID = ctx.getViewer();
+                // The rows are the viewer's OWN defaults and `ownerDID` names the viewer.
+                // With no viewer there is no owner to name, and no own rows to return.
+                if (viewerDID == null) {
+                    return [];
+                }
+                const rows = await ctx.listModelAccessDefaults();
+                const byModelID = new Map();
+                for (const row of rows){
+                    let entry = byModelID.get(row.modelID);
+                    if (entry == null) {
+                        entry = {
+                            ownerDID: viewerDID,
+                            modelID: row.modelID,
+                            permissions: {}
+                        };
+                        byModelID.set(row.modelID, entry);
+                    }
+                    entry.permissions[row.permissionType] = {
+                        level: row.level,
+                        allowedDIDs: row.allowedDIDs,
+                        allowedCircles: row.allowedCircles,
+                        allowedGroups: row.allowedGroups
+                    };
+                }
+                return [
+                    ...byModelID.values()
+                ];
+            }
+        };
         // Add access control mutations if mutations are enabled
         if (this._includeMutations) {
             this._mutations.setModelAccessDefaults = {

package/package.json

@@ -1,50 +1,50 @@
 {
   "name": "@kubun/graphql",
-  "version": "0.11.0",
-  "license": "see LICENSE.md",
+  "version": "0.12.0",
   "keywords": [],
+  "license": "see LICENSE.md",
+  "sideEffects": false,
   "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
   "exports": {
     ".": "./lib/index.js"
   },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
   "files": [
     "lib/*",
     "LICENSE.md"
   ],
-  "sideEffects": false,
   "dependencies": {
-    "@sozai/async": "^0.1.0",
-    "@sozai/codec": "^0.1.0",
-    "@sozai/event": "^0.1.0",
-    "@sozai/otel": "^0.2.0",
+    "@sozai/async": "^0.2.1",
+    "@sozai/codec": "^0.4.0",
+    "@sozai/event": "^0.1.3",
+    "@sozai/otel": "^0.3.2",
     "change-case": "^5.4.4",
     "graphql": "^16.14.2",
     "graphql-relay": "^0.10.2",
     "graphql-scalars": "^1.25.0",
-    "multiformats": "^14.0.4",
-    "@kubun/hlc": "^0.11.0",
-    "@kubun/id": "^0.11.0",
-    "@kubun/logger": "^0.11.0",
-    "@kubun/protocol": "^0.11.0"
+    "multiformats": "^14.0.5",
+    "@kubun/id": "^0.12.0",
+    "@kubun/logger": "^0.12.0",
+    "@kubun/protocol": "^0.12.0",
+    "@kubun/hlc": "^0.12.0"
   },
   "devDependencies": {
-    "@kokuin/capability": "^0.1.0",
-    "@kokuin/token": "^0.1.1",
-    "@kubun/db-better-sqlite": "^0.11.0",
-    "@kubun/db": "^0.11.0",
-    "@kubun/store-graph": "^0.11.0",
-    "@kubun/test-utils": "^0.11.0"
+    "@kokuin/capability": "^0.2.1",
+    "@kokuin/token": "^0.3.0",
+    "@kubun/db": "^0.12.0",
+    "@kubun/store-graph": "^0.12.0",
+    "@kubun/test-utils": "^0.12.0",
+    "@kubun/db-better-sqlite": "^0.12.0"
   },
   "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
     "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
-    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",
-    "test:unit": "vitest run",
-    "test": "pnpm run test:types && pnpm run test:unit"
+    "test:unit": "vitest run"
   }
 }