@lunora/server 1.0.0-alpha.10 → 1.0.0-alpha.100

package/dist/rls/testing.d.ts

@@ -1,48 +1,56 @@
-import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BDY0FYHK.js";
+import { P as PolicyOperation, R as Role, a as Policy } from "../packem_shared/types.d-BCtjbIzl.js";
 import "../data-model.js";
 /**
-* The slice of a request identity a policy reads. Mirrors the
-* `PolicyContext.auth` shape the middleware builds at request time — every
-* field is optional and defaults the same way the middleware defaults it
-* (`userId`/`identity` → `null`, `roles` → `[]`).
-*/
+ * The slice of a request identity a policy reads. Mirrors the
+ * `PolicyContext.auth` shape the middleware builds at request time — every
+ * field is optional and defaults the same way the middleware defaults it
+ * (`userId`/`identity` → `null`, `roles` → the `roles` claim on `identity`).
+ *
+ * There is deliberately NO separate `roles` field: `auth.roles` is derived from
+ * the identity claims by the same `readIdentityRoles` the middleware uses, so
+ * the harness cannot set up a world the runtime is unable to produce. Give a
+ * role-branched policy its roles the way production does —
+ * `.as({ identity: { roles: ["admin"] }, userId: "u1" })`.
+ */
 interface TestIdentity {
-  /** Raw identity claims a policy may branch on (`auth.identity.email`, …). */
+  /**
+   * Raw identity claims a policy may branch on (`auth.identity.email`, …).
+   * The `roles` claim (a `string[]` or a comma-separated string) is what
+   * populates `auth.roles` and backs `auth.can(...)`.
+   */
   identity?: Record<string, unknown> | null;
-  /** Role labels the request carries; resolved to permissions via the harness `roles` registry. */
-  roles?: ReadonlyArray<string>;
   /** The caller id (`auth.userId`); `null`/omitted is the anonymous caller. */
   userId?: null | string;
 }
 /** Options for {@link expectPolicy}. */
 interface ExpectPolicyOptions<Context = unknown> {
   /**
-  * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
-  * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
-  * different context. Defaults to an empty object.
-  */
+   * The procedure context a policy reads via `ctx` (e.g. `ctx.orgId`). Held
+   * for the whole harness; pass a fresh `expectPolicy(..., { ctx })` for a
+   * different context. Defaults to an empty object.
+   */
   ctx?: Context;
   /**
-  * Role→permission grants backing `auth.can(...)` — the same registry passed
-  * to `rls(policies, { roles })`. A role not listed here grants nothing, so
-  * `can(...)` fails closed exactly as it does in production.
-  */
+   * Role→permission grants backing `auth.can(...)` — the same registry passed
+   * to `rls(policies, { roles })`. A role not listed here grants nothing, so
+   * `can(...)` fails closed exactly as it does in production.
+   */
   roles?: ReadonlyArray<Role>;
 }
 /** A harness bound to one identity; answers can/cannot for an `(op, table, row)`. */
 interface BoundPolicyAssertion {
   /**
-  * Would this identity be **allowed** the operation on `row`?
-  *
-  * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
-  * - `insert` — is the candidate `row` allowed by the insert policies?
-  * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
-  *
-  * A table with **no** policy in the list is unguarded → always `true`
-  * (mirrors the middleware passing such tables through unwrapped). A table
-  * that participates but declares no policy for the write `op` denies
-  * (default-DENY), exactly as the middleware does.
-  */
+   * Would this identity be **allowed** the operation on `row`?
+   *
+   * - `read` — is `row` visible? `true` when the table has no read policy (unrestricted), or when the effective read `baseWhere` matches `row`.
+   * - `insert` — is the candidate `row` allowed by the insert policies?
+   * - `update` / `delete` — is the pre-write `row` allowed? For `update` pass `nextRow` to also assert the post-image (WITH CHECK) — a policy can't be satisfied by the old row while the patch reassigns it to another tenant.
+   *
+   * A table with **no** policy in the list is unguarded → always `true`
+   * (mirrors the middleware passing such tables through unwrapped). A table
+   * that participates but declares no policy for the write `op` denies
+   * (default-DENY), exactly as the middleware does.
+   */
   can: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
   /** Negation of {@link BoundPolicyAssertion.can} — reads more naturally in a denial test. */
   cannot: (op: PolicyOperation, table: string, row?: Record<string, unknown>, nextRow?: Record<string, unknown>) => boolean;
@@ -53,11 +61,11 @@ interface PolicyAssertion {
   as: (identity?: TestIdentity | null) => BoundPolicyAssertion;
 }
 /**
-* Build an in-process assertion harness over a policy set. Reuses the `rls()`
-* middleware's own evaluation primitives, so an assertion is faithful to
-* request-time behaviour by construction.
-* @param policies the policy list, typically from `definePolicies([...])`.
-* @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
-*/
+ * Build an in-process assertion harness over a policy set. Reuses the `rls()`
+ * middleware's own evaluation primitives, so an assertion is faithful to
+ * request-time behaviour by construction.
+ * @param policies the policy list, typically from `definePolicies([...])`.
+ * @param options role registry + procedure `ctx` (see {@link ExpectPolicyOptions}).
+ */
 declare const expectPolicy: <Context = unknown>(policies: ReadonlyArray<Policy<Context>>, options?: ExpectPolicyOptions<Context>) => PolicyAssertion;
 export { BoundPolicyAssertion, ExpectPolicyOptions, PolicyAssertion, TestIdentity, expectPolicy };

package/dist/rls/testing.mjs

@@ -1,49 +1 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-2Jhd0uev.mjs';
-
-const expectPolicy = (policies, options = {}) => {
-  const rolePermissions = indexRolePermissions(options.roles);
-  const context = options.ctx ?? {};
-  return {
-    as: (identity) => {
-      const auth = identity ?? {};
-      const roles = auth.roles ?? [];
-      const granted = /* @__PURE__ */ new Set();
-      for (const roleName of roles) {
-        for (const name of rolePermissions.get(roleName) ?? []) {
-          granted.add(name);
-        }
-      }
-      const baseContext = {
-        auth: {
-          can: (permission) => granted.has(permissionName(permission)),
-          // eslint-disable-next-line unicorn/no-null -- PolicyContext.auth.identity is a public `… | null` type, mirroring the middleware
-          identity: auth.identity ?? null,
-          roles,
-          // eslint-disable-next-line unicorn/no-null -- PolicyContext.auth.userId is a public `null | string` type, mirroring the middleware
-          userId: auth.userId ?? null
-        },
-        ctx: context
-      };
-      const can = (op, table, row, nextRow) => {
-        const tablePolicies = policies.filter((policy) => policy.table === table);
-        if (tablePolicies.length === 0) {
-          return true;
-        }
-        if (op === "read") {
-          if (!tablePolicies.some((policy) => policy.on === "read")) {
-            return true;
-          }
-          const baseWhere = computeReadBaseWhere(tablePolicies, baseContext);
-          return baseWhere === void 0 || matchesWhere(row ?? {}, baseWhere);
-        }
-        return evaluateWrite(tablePolicies, op, { ...baseContext, row }, nextRow);
-      };
-      return {
-        can,
-        cannot: (op, table, row, nextRow) => !can(op, table, row, nextRow)
-      };
-    }
-  };
-};
-
-export { expectPolicy };
+import{i as y,d as P,f as W,e as v,m as I,g as R}from"../packem_shared/middleware-BXIVIudl.mjs";const p=(m,o={})=>{const h=y(o.roles),x=o.ctx??{};return{as:f=>{const c=f??{},i=c.identity??null,l=P(i),u={auth:{can:W(l,h),identity:i,roles:l,userId:c.userId??null},ctx:x},d=(e,r,t,a)=>{const s=m.filter(n=>n.table===r);if(s.length===0)return!0;if(e==="read"){if(!s.some(b=>b.on==="read"))return!0;const n=v(s,u);return n===void 0||I(t??{},n)}return R(s,e,{...u,row:t},a)};return{can:d,cannot:(e,r,t,a)=>!d(e,r,t,a)}}}};export{p as expectPolicy};