@kubun/graphql 0.11.0 → 0.13.0

package/lib/context.d.ts

@@ -1,6 +1,6 @@
 import { DocumentID } from '@kubun/id';
 import type { AggregateHaving, AggregateSpec, AggregateValues, DocumentData, DocumentFilter, DocumentNode, DocumentOrderBy, GroupedAggregateOrderTerm, GroupedAggregateValue } from '@kubun/protocol';
-import type { ViewerReadAccess } from '@kubun/store-graph';
+import type { StoredAccessDefaultRow, ViewerReadAccess } from '@kubun/store-graph';
 import type { Tracer } from '@sozai/otel';
 import type { GraphQLResolveInfo } from 'graphql';
 import type { Connection, Edge } from 'graphql-relay';
@@ -83,6 +83,7 @@ export type ReadContextDB = {
         modelID: string;
         rank: number;
     }>>;
+    listUserModelAccessDefaults(ownerDID: string): Promise<Array<StoredAccessDefaultRow>>;
 };
 /**
  * Query scope carried alongside a connection value so child resolvers (e.g.
@@ -148,6 +149,12 @@ export type QueryContext = {
         modelID: string;
         rank: number;
     }>>;
+    /**
+     * The viewer's own stored model-access-default rows, across every model and
+     * permission type. Scoped to the current viewer DID - not for cross-member
+     * visibility.
+     */
+    listModelAccessDefaults(): Promise<Array<StoredAccessDefaultRow>>;
 };
 /**
  * Subscription functions requiring server implementation

package/lib/context.js

@@ -8,6 +8,7 @@ import { withSpan } from '@sozai/otel';
  * generator. When a consumer falls behind, the oldest events are evicted so a
  * single slow subscriber cannot grow memory without bound.
  */ const DEFAULT_SUBSCRIPTION_QUEUE_SIZE = 1000;
+/** Access checks in flight at once — see `filterByAccess`. */ const ACCESS_CHECK_CONCURRENCY = 25;
 /**
  * Minimum spacing between repeated overflow warnings for a single generator, so
  * a sustained overflow logs at most once per interval instead of per drop.
@@ -25,6 +26,34 @@ import { withSpan } from '@sozai/otel';
 const logger = getKubunLogger('graphql');
 export function createReadContext(params) {
     const { store, viewerDID, accessChecker, viewerReadAccess } = params;
+    /**
+   * Keep the documents a viewer may read, in their original order.
+   *
+   * The checks are independent reads over one viewer, so they run concurrently;
+   * checking in sequence only ever bought the order the denial warnings were
+   * pushed in, and filtering after every verdict is in preserves that too.
+   */ async function filterByAccess(documents, check) {
+        // Concurrent but bounded. Each check issues its own reads, and the page
+        // reaching here can be as large as `unboundedScanCap` (5000) — one
+        // `Promise.all` over that queues five thousand reads onto a single SQLite
+        // connection at once, which is slower than the sequential version it
+        // replaced and starves everything else on that connection.
+        const verdicts = [];
+        for(let index = 0; index < documents.length; index += ACCESS_CHECK_CONCURRENCY){
+            const batch = documents.slice(index, index + ACCESS_CHECK_CONCURRENCY);
+            verdicts.push(...await Promise.all(batch.map((doc)=>check(doc, 'read'))));
+        }
+        return documents.filter((doc, index)=>{
+            if (verdicts[index]) {
+                return true;
+            }
+            params.warnings?.push({
+                message: `Access denied for document ${doc.id}`,
+                code: 'KB07'
+            });
+            return false;
+        });
+    }
     function traced(name, attributes, fn) {
         if (params.tracer != null) {
             return withSpan(params.tracer, name, {
@@ -206,6 +235,9 @@ export function createReadContext(params) {
                 first
             });
         },
+        async listModelAccessDefaults () {
+            return await store.listUserModelAccessDefaults(viewerDID);
+        },
         async resolveConnection (modelIDs, args) {
             const resolverKey = `connection:${modelIDs.join(',')}`;
             const start = params.complexity?.resolverTimings != null ? performance.now() : 0;
@@ -252,17 +284,7 @@ export function createReadContext(params) {
                     // Apply access control
                     let accessible = documents;
                     if (accessChecker) {
-                        accessible = [];
-                        for (const doc of documents){
-                            if (await accessChecker(doc, 'read')) {
-                                accessible.push(doc);
-                            } else if (params.warnings != null) {
-                                params.warnings.push({
-                                    message: `Access denied for document ${doc.id}`,
-                                    code: 'KB07'
-                                });
-                            }
-                        }
+                        accessible = await filterByAccess(documents, accessChecker);
                     }
                     // Order by search rank
                     const rankMap = new Map(searchResults.map((r)=>[
@@ -491,17 +513,7 @@ export function createReadContext(params) {
                     return documents;
                 }
                 // Filter based on access control
-                const accessible = [];
-                for (const doc of documents){
-                    if (await accessChecker(doc, 'read')) {
-                        accessible.push(doc);
-                    } else if (params.warnings != null) {
-                        params.warnings.push({
-                            message: `Access denied for document ${doc.id}`,
-                            code: 'KB07'
-                        });
-                    }
-                }
+                const accessible = await filterByAccess(documents, accessChecker);
                 if (params.complexity != null) {
                     params.complexity.resolverCount++;
                     for (const id of modelIDs){

package/lib/scalars.js

@@ -6,6 +6,7 @@ function validateURL(input) {
     try {
         return new URL(input).toString();
     } catch  {
+        // biome-ignore lint/style/useErrorCause: GraphQLError
         throw new GraphQLError(`Invalid URL: ${input}`);
     }
 }

package/lib/schema.js

@@ -105,7 +105,7 @@ function createEnumValueFilterInput(type) {
         }
     });
 }
-function createScalarValueFilterInput(type) {
+function createScalarValueFilterInput(type, options = {}) {
     return new GraphQLInputObjectType({
         name: `${type.name}ValueFilter`,
         isOneOf: true,
@@ -136,6 +136,37 @@ function createScalarValueFilterInput(type) {
             },
             greaterThanOrEqualTo: {
                 type
+            },
+            // Substring match only makes sense against string-backed scalars.
+            ...options.stringBacked ? {
+                contains: {
+                    type: GraphQLString
+                }
+            } : {}
+        }
+    });
+}
+// Opaque identifiers (DID, DocumentID, AttachmentID): equality only, no ordering
+// or substring match — the underlying strings are content-addressed, not text.
+function createExactValueFilterInput(type) {
+    return new GraphQLInputObjectType({
+        name: `${type.name}ValueFilter`,
+        isOneOf: true,
+        fields: {
+            isNull: {
+                type: GraphQLBoolean
+            },
+            equalTo: {
+                type
+            },
+            notEqualTo: {
+                type
+            },
+            in: {
+                type: toList(type)
+            },
+            notIn: {
+                type: toList(type)
             }
         }
     });
@@ -159,6 +190,7 @@ const VALUE_FILTER_INPUTS = {
             }
         }
     }),
+    AttachmentIDValueFilter: createExactValueFilterInput(GraphQLAttachmentID),
     BooleanValueFilter: new GraphQLInputObjectType({
         name: 'BooleanValueFilter',
         isOneOf: true,
@@ -171,16 +203,26 @@ const VALUE_FILTER_INPUTS = {
             }
         }
     }),
+    DIDValueFilter: createExactValueFilterInput(GraphQLDID),
+    DocumentIDValueFilter: createExactValueFilterInput(GraphQLDocID),
     FloatValueFilter: createScalarValueFilterInput(GraphQLFloat),
     IntValueFilter: createScalarValueFilterInput(GraphQLInt),
-    StringValueFilter: createScalarValueFilterInput(GraphQLString)
+    StringValueFilter: createScalarValueFilterInput(GraphQLString, {
+        stringBacked: true
+    })
 };
+// Keyed by `scalar.name` (the GraphQL type name, e.g. "DID"), not the import
+// binding — keying by binding name silently never matched here before, since
+// scalars are looked up by `scalar.name`. `_owner` bypasses this map entirely
+// (hardcoded to AccountValueFilter), so it is not listed here.
 const VALUE_FILTER_INPUT_TYPES = {
-    GraphQLBoolean: 'BooleanValueFilter',
-    GraphQLDID: 'AccountValueFilter',
-    GraphQLFloat: 'FloatValueFilter',
-    GraphQLInt: 'IntValueFilter',
-    GraphQLString: 'StringValueFilter'
+    AttachmentID: 'AttachmentIDValueFilter',
+    Boolean: 'BooleanValueFilter',
+    DID: 'DIDValueFilter',
+    DocumentID: 'DocumentIDValueFilter',
+    Float: 'FloatValueFilter',
+    Int: 'IntValueFilter',
+    String: 'StringValueFilter'
 };
 const PatchSetOperation = new GraphQLInputObjectType({
     name: 'PatchSetOperation',
@@ -247,6 +289,26 @@ const OrderByDirection = new GraphQLEnumType({
         }
     }
 });
+const ArrayPresence = new GraphQLEnumType({
+    name: 'ArrayPresence',
+    values: {
+        NULL: {
+            value: 'null'
+        },
+        NON_NULL: {
+            value: 'nonNull'
+        },
+        EMPTY: {
+            value: 'empty'
+        },
+        NON_EMPTY: {
+            value: 'nonEmpty'
+        },
+        NULL_OR_EMPTY: {
+            value: 'nullOrEmpty'
+        }
+    }
+});
 const AccessRule = new GraphQLObjectType({
     name: 'AccessRule',
     fields: {
@@ -581,6 +643,42 @@ export class SchemaBuilder {
                 }
             };
         }
+        // Introspection: the viewer's own model-access-default rows. The stored
+        // rows are one-per-(model, permissionType); group them by modelID so each
+        // result groups read+write into `permissions`, matching `ModelAccessDefaults`.
+        queryFields.modelAccessDefaults = {
+            type: new GraphQLNonNull(new GraphQLList(new GraphQLNonNull(ModelAccessDefaults))),
+            resolve: async (_root, _args, ctx)=>{
+                const viewerDID = ctx.getViewer();
+                // The rows are the viewer's OWN defaults and `ownerDID` names the viewer.
+                // With no viewer there is no owner to name, and no own rows to return.
+                if (viewerDID == null) {
+                    return [];
+                }
+                const rows = await ctx.listModelAccessDefaults();
+                const byModelID = new Map();
+                for (const row of rows){
+                    let entry = byModelID.get(row.modelID);
+                    if (entry == null) {
+                        entry = {
+                            ownerDID: viewerDID,
+                            modelID: row.modelID,
+                            permissions: {}
+                        };
+                        byModelID.set(row.modelID, entry);
+                    }
+                    entry.permissions[row.permissionType] = {
+                        level: row.level,
+                        allowedDIDs: row.allowedDIDs,
+                        allowedCircles: row.allowedCircles,
+                        allowedGroups: row.allowedGroups
+                    };
+                }
+                return [
+                    ...byModelID.values()
+                ];
+            }
+        };
         // Add access control mutations if mutations are enabled
         if (this._includeMutations) {
             this._mutations.setModelAccessDefaults = {
@@ -2125,16 +2223,34 @@ export class SchemaBuilder {
         if (schema.type === 'array') {
             const name = this._aliases[id] ?? pascalCase(parentName + schema.title);
             refParentName = name;
-            // const itemType = this._buildReferenceFilterInput(schema.items.$ref, schema.title)
+            const itemID = getReferenceID(schema.items.$ref);
+            const itemSchema = this._getReferenceSchema(itemID);
+            // Membership ops need a scalar item type; array-of-object/array-of-array items
+            // fall back to `isNull`-only filtering (no `_buildScalar` support for them).
+            if (itemSchema.type === 'object' || itemSchema.type === 'array') {
+                return new GraphQLInputObjectType({
+                    name: `${name}Filter`,
+                    isOneOf: true,
+                    fields: {
+                        isNull: {
+                            type: GraphQLBoolean
+                        }
+                    }
+                });
+            }
+            const itemScalar = this._buildScalar(itemID, itemSchema, name);
             return new GraphQLInputObjectType({
                 name: `${name}Filter`,
                 isOneOf: true,
                 fields: {
-                    // DB does not support filtering on array values
-                    // contains: { type: toList(itemType) },
-                    // isEmpty: { type: GraphQLBoolean },
-                    isNull: {
-                        type: GraphQLBoolean
+                    includesAll: {
+                        type: toList(itemScalar)
+                    },
+                    includesAny: {
+                        type: toList(itemScalar)
+                    },
+                    presence: {
+                        type: ArrayPresence
                     }
                 }
             });
@@ -2144,7 +2260,9 @@ export class SchemaBuilder {
         if (knownFilter != null) {
             return this._inputObjects[knownFilter];
         }
-        const filter = isEnumType(scalar) ? createEnumValueFilterInput(scalar) : createScalarValueFilterInput(scalar);
+        const filter = isEnumType(scalar) ? createEnumValueFilterInput(scalar) : createScalarValueFilterInput(scalar, {
+            stringBacked: true
+        });
         if (this._inputObjects[filter.name] == null) {
             this._inputObjects[filter.name] = filter;
         }

package/package.json

@@ -1,50 +1,53 @@
 {
   "name": "@kubun/graphql",
-  "version": "0.11.0",
-  "license": "see LICENSE.md",
+  "version": "0.13.0",
   "keywords": [],
+  "license": "see LICENSE.md",
+  "sideEffects": false,
   "type": "module",
-  "main": "lib/index.js",
-  "types": "lib/index.d.ts",
   "exports": {
     ".": "./lib/index.js"
   },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
   "files": [
     "lib/*",
     "LICENSE.md"
   ],
-  "sideEffects": false,
   "dependencies": {
-    "@sozai/async": "^0.1.0",
-    "@sozai/codec": "^0.1.0",
-    "@sozai/event": "^0.1.0",
-    "@sozai/otel": "^0.2.0",
+    "@sozai/async": "^0.2.1",
+    "@sozai/codec": "^0.4.0",
+    "@sozai/event": "^0.1.3",
+    "@sozai/otel": "^0.3.2",
     "change-case": "^5.4.4",
     "graphql": "^16.14.2",
     "graphql-relay": "^0.10.2",
-    "graphql-scalars": "^1.25.0",
-    "multiformats": "^14.0.4",
-    "@kubun/hlc": "^0.11.0",
-    "@kubun/id": "^0.11.0",
-    "@kubun/logger": "^0.11.0",
-    "@kubun/protocol": "^0.11.0"
+    "graphql-scalars": "^1.26.0",
+    "multiformats": "^14.0.5",
+    "@kubun/logger": "^0.12.0",
+    "@kubun/hlc": "^0.12.0",
+    "@kubun/id": "^0.12.0",
+    "@kubun/protocol": "^0.13.0"
   },
   "devDependencies": {
-    "@kokuin/capability": "^0.1.0",
-    "@kokuin/token": "^0.1.1",
-    "@kubun/db-better-sqlite": "^0.11.0",
-    "@kubun/db": "^0.11.0",
-    "@kubun/store-graph": "^0.11.0",
-    "@kubun/test-utils": "^0.11.0"
+    "@kokuin/capability": "^0.2.2",
+    "@kokuin/token": "^0.4.0",
+    "@kubun/store-graph": "^0.13.0",
+    "@kubun/db-better-sqlite": "^0.12.1",
+    "@kubun/db": "^0.12.1",
+    "@kubun/test-utils": "^0.12.0"
+  },
+  "publishConfig": {
+    "access": "public"
   },
   "scripts": {
+    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
     "build:clean": "del lib",
     "build:js": "swc src -d ./lib --config-file ../../node_modules/@kigu/dev/swc.json --strip-leading-paths",
     "build:types": "tsc --emitDeclarationOnly --skipLibCheck",
     "build:types:ci": "tsc --emitDeclarationOnly --declarationMap false",
-    "build": "pnpm run build:clean && pnpm run build:js && pnpm run build:types",
+    "test": "pnpm run test:types && pnpm run test:unit",
     "test:types": "tsc --noEmit -p tsconfig.test.json",
-    "test:unit": "vitest run",
-    "test": "pnpm run test:types && pnpm run test:unit"
+    "test:unit": "vitest run"
   }
 }