@lunora/server 0.0.0 → 1.0.0-alpha.1

package/dist/packem_shared/mask-CkZJHHMM.mjs

@@ -0,0 +1,211 @@
+import { LunoraError } from './LunoraError-DhggBJZF.mjs';
+import { bindTableFacade, bindOrm } from './bindTableFacade-DCuyr46L.mjs';
+
+const permissionName = (permission) => typeof permission === "string" ? permission : permission.name;
+const indexRolePermissions = (roles) => {
+  const map = /* @__PURE__ */ new Map();
+  for (const role of roles ?? []) {
+    map.set(role.name, new Set((role.permissions ?? []).map((permission) => permissionName(permission))));
+  }
+  return map;
+};
+const fnv1aHex = (input) => {
+  let hash = 2166136261;
+  for (let index = 0; index < input.length; index += 1) {
+    hash ^= input.codePointAt(index) ?? 0;
+    hash = Math.imul(hash, 16777619);
+  }
+  return (hash >>> 0).toString(16).padStart(8, "0");
+};
+const applyStrategy = (strategy, value, context) => {
+  try {
+    if (strategy === "redact") {
+      return null;
+    }
+    if (strategy === "hash") {
+      if (value === null || value === void 0) {
+        return value;
+      }
+      return fnv1aHex(typeof value === "string" ? value : JSON.stringify(value));
+    }
+    return strategy(value, context);
+  } catch {
+    return null;
+  }
+};
+const maskRow = (row, columns, base) => {
+  const out = { ...row };
+  for (const [column, strategy] of Object.entries(columns)) {
+    if (!(column in out)) {
+      continue;
+    }
+    out[column] = applyStrategy(strategy, row[column], { ...base, column, row });
+  }
+  return out;
+};
+const maskPage = (page, columns, base) => {
+  return { ...page, page: page.page.map((row) => maskRow(row, columns, base)) };
+};
+const isFacadeEntry = (value) => {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
+};
+const wrapDatabase = (base, perTable, context) => {
+  const wrapReader = (reader, columns) => {
+    return {
+      collect: async () => {
+        const rows = await reader.collect();
+        return rows.map((row) => maskRow(row, columns, context));
+      },
+      filter: (predicate) => wrapReader(
+        reader.filter((document) => predicate(document)),
+        columns
+      ),
+      first: async () => {
+        const row = await reader.first();
+        return row ? maskRow(row, columns, context) : null;
+      },
+      order: (direction) => wrapReader(reader.order(direction), columns),
+      paginate: async (options) => maskPage(await reader.paginate(options), columns, context),
+      take: async (limit) => {
+        const rows = await reader.take(limit);
+        return rows.map((row) => maskRow(row, columns, context));
+      },
+      unique: async () => {
+        const row = await reader.unique();
+        return row ? maskRow(row, columns, context) : null;
+      },
+      withIndex: (indexName, range) => wrapReader(reader.withIndex(indexName, range), columns),
+      withSearchIndex: (indexName, search) => wrapReader(reader.withSearchIndex(indexName, search), columns)
+    };
+  };
+  const locate = async (id, expectedTable) => {
+    if (base.lookupById) {
+      const located = await base.lookupById(id, expectedTable);
+      if (!located) {
+        return { row: null, tableName: void 0 };
+      }
+      return { row: located.row, tableName: perTable.has(located.tableName) ? located.tableName : void 0 };
+    }
+    const row = await base.get(id, expectedTable);
+    if (!row) {
+      return { row: null, tableName: void 0 };
+    }
+    let probeTables;
+    if (expectedTable === void 0) {
+      probeTables = [...perTable.keys()];
+    } else if (perTable.has(expectedTable)) {
+      probeTables = [expectedTable];
+    } else {
+      probeTables = [];
+    }
+    const probes = await Promise.all(
+      probeTables.map(async (tableName) => {
+        const probe = await base.findFirst(tableName, { limit: 1, where: { _id: id } });
+        return probe?.["_id"] === id ? tableName : void 0;
+      })
+    );
+    return { row, tableName: probes.find((entry) => entry !== void 0) };
+  };
+  const assertReductionAllowed = (tableName, fields, method) => {
+    const columns = perTable.get(tableName);
+    if (!columns) {
+      return;
+    }
+    const offending = fields.find((field) => typeof field === "string" && field in columns);
+    if (offending !== void 0) {
+      throw new LunoraError("MASK_UNSUPPORTED", `${method}() over masked column "${offending}" on "${tableName}" is not supported`);
+    }
+  };
+  const wrapped = {
+    ...base,
+    aggregate(tableName, options) {
+      assertReductionAllowed(tableName, [options.field], "aggregate");
+      return base.aggregate(tableName, options);
+    },
+    async findFirst(tableName, args) {
+      const row = await base.findFirst(tableName, args);
+      const columns = perTable.get(tableName);
+      return row && columns ? maskRow(row, columns, context) : row;
+    },
+    async findFirstOrThrow(tableName, args) {
+      const row = await base.findFirstOrThrow(tableName, args);
+      const columns = perTable.get(tableName);
+      return columns ? maskRow(row, columns, context) : row;
+    },
+    async findMany(tableName, args) {
+      const page = await base.findMany(tableName, args);
+      const columns = perTable.get(tableName);
+      return columns ? maskPage(page, columns, context) : page;
+    },
+    async get(id, expectedTable) {
+      const { row, tableName } = await locate(id, expectedTable);
+      const columns = tableName === void 0 ? void 0 : perTable.get(tableName);
+      if (!row || !columns) {
+        return row;
+      }
+      return maskRow(row, columns, context);
+    },
+    groupBy(tableName, options) {
+      assertReductionAllowed(tableName, [...options.by, options.agg?.field], "groupBy");
+      return base.groupBy(tableName, options);
+    },
+    query(tableName) {
+      const reader = base.query(tableName);
+      const columns = perTable.get(tableName);
+      return columns ? wrapReader(reader, columns) : reader;
+    },
+    async rankPage(tableName, indexName, options) {
+      const page = await base.rankPage(tableName, indexName, options);
+      const columns = perTable.get(tableName);
+      return columns ? maskPage(page, columns, context) : page;
+    }
+  };
+  const writableFacade = wrapped;
+  for (const tableName of perTable.keys()) {
+    if (isFacadeEntry(base[tableName])) {
+      writableFacade[tableName] = bindTableFacade(wrapped, tableName);
+    }
+  }
+  return wrapped;
+};
+const mask = (policies, options = {}) => {
+  const perTable = new Map(Object.entries(policies));
+  const rolePermissions = indexRolePermissions(options.roles);
+  return async ({ ctx, next }) => {
+    const auth = ctx.auth ?? {};
+    const identity = await auth.getIdentity?.() ?? null;
+    const roles = auth.roles ?? [];
+    const granted = /* @__PURE__ */ new Set();
+    for (const roleName of roles) {
+      for (const name of rolePermissions.get(roleName) ?? []) {
+        granted.add(name);
+      }
+    }
+    const maskContext = {
+      auth: {
+        can: (permission) => granted.has(permissionName(permission)),
+        identity,
+        roles,
+        // eslint-disable-next-line unicorn/no-null -- MaskContext.auth.userId is a public `null | string` type
+        userId: auth.userId ?? null
+      },
+      ctx
+    };
+    if (options.bypass?.(maskContext)) {
+      return next();
+    }
+    const wrapped = wrapDatabase(ctx.db, perTable, maskContext);
+    const extension = { db: wrapped };
+    const { orm } = ctx;
+    if (orm !== null && typeof orm === "object") {
+      extension.orm = bindOrm(wrapped);
+    }
+    return next({ ctx: extension });
+  };
+};
+
+export { mask };

package/dist/packem_shared/onConnect-CIPXKPyw.mjs

@@ -0,0 +1,13 @@
+const wrapLifecycle = (lifecycle, handler) => {
+  return {
+    args: {},
+    handler: (context, event) => handler(context, event),
+    kind: "mutation",
+    lifecycle,
+    visibility: "internal"
+  };
+};
+const onConnect = (handler) => wrapLifecycle("connect", handler);
+const onDisconnect = (handler) => wrapLifecycle("disconnect", handler);
+
+export { onConnect, onDisconnect };

package/dist/packem_shared/protectPublic-BjFkQ_Or.mjs

@@ -0,0 +1,15 @@
+import { r as runMiddlewareChain } from './run-middleware-CYQOuoV6.mjs';
+
+const protectPublic = (options) => {
+  const chain = [options.rateLimit, options.captcha, ...options.use ?? []].filter(
+    (middleware) => middleware !== void 0
+  );
+  const composed = async ({ ctx, next }) => runMiddlewareChain(
+    chain,
+    ctx,
+    (context) => next({ ctx: context })
+  );
+  return composed;
+};
+
+export { protectPublic };