@lunora/server 1.0.0-alpha.11 → 1.0.0-alpha.12

package/dist/index.mjs

@@ -17,11 +17,11 @@ export { defineShape } from './packem_shared/defineShape-CJ27Wx7o.mjs';
 export { anyApi } from './types.mjs';
 export { cronJobs } from '@lunora/scheduler';
 export { ValidationError, v } from '@lunora/values';
-export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-1jexWrb3.mjs';
+export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-Do1CSBTr.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-BV_jNzsN.mjs';
-export { rls } from './packem_shared/rls-2Jhd0uev.mjs';
+export { mask } from './packem_shared/mask-CWfMjb5Y.mjs';
+export { rls } from './packem_shared/rls-DhNgKFeW.mjs';
 export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
 
 const VERSION = "0.0.0";

package/dist/packem_shared/{buildRlsReadRegistry-1jexWrb3.mjs → buildRlsReadRegistry-Do1CSBTr.mjs}

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-2Jhd0uev.mjs';
+import { indexRolePermissions, computeReadBaseWhere, permissionName } from './rls-DhNgKFeW.mjs';
 import { r as readRlsTag } from './policy-tag-DvpVH2tv.mjs';
 
 const FALSE_PREDICATE = { OR: [] };

package/dist/packem_shared/{mask-BV_jNzsN.mjs → mask-CWfMjb5Y.mjs}

@@ -60,8 +60,13 @@ const wrapDatabase = (base, perTable, context) => {
         const rows = await reader.collect();
         return rows.map((row) => maskRow(row, columns, context));
       },
+      // SECURITY (value oracle): the predicate must see the MASKED row, not
+      // the raw stored row — otherwise a caller can `.filter(d => d.ssn ===
+      // guess)` to read the value the mask hides. Masking before the
+      // predicate keeps filtering on non-masked columns working while
+      // redacting masked cells the predicate can observe.
       filter: (predicate) => wrapReader(
-        reader.filter((document) => predicate(document)),
+        reader.filter((document) => predicate(maskRow(document, columns, context))),
         columns
       ),
       first: async () => {
@@ -120,23 +125,63 @@ const wrapDatabase = (base, perTable, context) => {
       throw new LunoraError("MASK_UNSUPPORTED", `${method}() over masked column "${offending}" on "${tableName}" is not supported`);
     }
   };
+  const collectWhereFields = (where, into) => {
+    if (!where || typeof where !== "object" || Array.isArray(where)) {
+      return;
+    }
+    for (const [key, value] of Object.entries(where)) {
+      if (key === "AND" || key === "OR") {
+        if (Array.isArray(value)) {
+          for (const clause of value) {
+            collectWhereFields(clause, into);
+          }
+        }
+      } else if (key === "NOT") {
+        collectWhereFields(value, into);
+      } else if (!key.startsWith("__")) {
+        into.add(key);
+      }
+    }
+  };
+  const assertWhereAllowed = (tableName, where, method) => {
+    const columns = perTable.get(tableName);
+    if (!columns || where === void 0) {
+      return;
+    }
+    const referenced = /* @__PURE__ */ new Set();
+    collectWhereFields(where, referenced);
+    for (const field of referenced) {
+      if (field in columns) {
+        throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+      }
+    }
+  };
   const wrapped = {
     ...base,
     aggregate(tableName, options) {
       assertReductionAllowed(tableName, [options.field], "aggregate");
       return base.aggregate(tableName, options);
     },
+    count(tableName, whereOrArgs) {
+      const wrapper = whereOrArgs && typeof whereOrArgs === "object" && !Array.isArray(whereOrArgs) ? whereOrArgs : void 0;
+      const where = wrapper && ("where" in wrapper || "baseWhere" in wrapper || "restrictsCounts" in wrapper) ? wrapper.where : whereOrArgs;
+      assertWhereAllowed(tableName, where, "count");
+      return base.count(tableName, whereOrArgs);
+    },
     async findFirst(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirst");
       const row = await base.findFirst(tableName, args);
       const columns = perTable.get(tableName);
       return row && columns ? maskRow(row, columns, context) : row;
     },
     async findFirstOrThrow(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findFirstOrThrow");
       const row = await base.findFirstOrThrow(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskRow(row, columns, context) : row;
     },
     async findMany(tableName, args) {
+      assertWhereAllowed(tableName, args?.where, "findMany");
       const page = await base.findMany(tableName, args);
       const columns = perTable.get(tableName);
       return columns ? maskPage(page, columns, context) : page;

package/dist/packem_shared/{rls-2Jhd0uev.mjs → rls-DhNgKFeW.mjs}

@@ -245,7 +245,6 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, raw, perTable, context) => {
-  const route = (tableName) => perTable.has(tableName) ? raw : base;
   const readBaseCache = /* @__PURE__ */ new Map();
   const readBase = (tableName) => {
     const cached = readBaseCache.get(tableName);
@@ -263,6 +262,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
     readBaseCache.set(tableName, result);
     return result;
   };
+  const route = (tableName) => readBase(tableName).restricts ? raw : base;
   const relationReadFilter = (table) => readBase(table).baseWhere;
   const locateRow = async (id, expectedTable) => {
     if (raw.lookupById) {
@@ -300,7 +300,7 @@ const wrapDatabase = (base, raw, perTable, context) => {
       const nextRow = computeNextRow ? computeNextRow(located.row) : void 0;
       const writeOk = evaluateWrite(policies, op, { ...context, row: located.row }, nextRow);
       if (!writeOk) {
-        throw new LunoraError("FORBIDDEN", `${op} on "${located.tableName}" denied by policy`);
+        throw new LunoraError("FORBIDDEN", `${op} denied by policy`);
       }
     }
     return perform(raw);
@@ -366,7 +366,10 @@ const wrapDatabase = (base, raw, perTable, context) => {
         return base.get(id, expectedTable);
       }
       const { baseWhere, restricts } = readBase(located.tableName);
-      if (!restricts || !baseWhere) {
+      if (!restricts) {
+        return base.get(id, expectedTable);
+      }
+      if (!baseWhere) {
         return located.row;
       }
       const allowed = await raw.findFirst(located.tableName, { baseWhere, limit: 1, where: { _id: id } });

package/dist/rls/testing.mjs

@@ -1,4 +1,4 @@
-import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-2Jhd0uev.mjs';
+import { indexRolePermissions, computeReadBaseWhere, matchesWhere, evaluateWrite, permissionName } from '../packem_shared/rls-DhNgKFeW.mjs';
 
 const expectPolicy = (policies, options = {}) => {
   const rolePermissions = indexRolePermissions(options.roles);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.11",
+  "version": "1.0.0-alpha.12",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",