@lunora/server 1.0.0-alpha.12 → 1.0.0-alpha.13

package/dist/index.mjs

@@ -20,7 +20,7 @@ export { ValidationError, v } from '@lunora/values';
 export { buildRlsReadRegistry, composeShapeReadWhere } from './packem_shared/buildRlsReadRegistry-Do1CSBTr.mjs';
 export { createPolicyDsl, definePermission, definePolicies, definePolicy, defineRole } from './packem_shared/createPolicyDsl-De67zPDS.mjs';
 export { defineStorageRule, defineStorageRules } from './packem_shared/defineStorageRule-qu0mpilX.mjs';
-export { mask } from './packem_shared/mask-CWfMjb5Y.mjs';
+export { mask } from './packem_shared/mask-E8MgAS3N.mjs';
 export { rls } from './packem_shared/rls-DhNgKFeW.mjs';
 export { storageRules } from './packem_shared/storageRules-Cje6Woea.mjs';
 

package/dist/packem_shared/{mask-CWfMjb5Y.mjs → mask-E8MgAS3N.mjs}

@@ -46,6 +46,29 @@ const maskRow = (row, columns, base) => {
 const maskPage = (page, columns, base) => {
   return { ...page, page: page.page.map((row) => maskRow(row, columns, base)) };
 };
+const assertIndexFieldsAllowed = (builderCallback, columns, tableName, method) => {
+  if (typeof builderCallback !== "function") {
+    return;
+  }
+  const referenced = /* @__PURE__ */ new Set();
+  const makeRecorder = () => /* @__PURE__ */ new Proxy(
+    {},
+    {
+      get: () => (field) => {
+        if (typeof field === "string") {
+          referenced.add(field);
+        }
+        return makeRecorder();
+      }
+    }
+  );
+  builderCallback(makeRecorder());
+  for (const field of referenced) {
+    if (field in columns) {
+      throw new LunoraError("MASK_UNSUPPORTED", `${method}() filtering "${tableName}" by masked column "${field}" is not supported`);
+    }
+  }
+};
 const isFacadeEntry = (value) => {
   if (typeof value !== "object" || value === null || Array.isArray(value)) {
     return false;
@@ -54,7 +77,7 @@ const isFacadeEntry = (value) => {
   return typeof candidate["findMany"] === "function" && typeof candidate["withSearchIndex"] === "function";
 };
 const wrapDatabase = (base, perTable, context) => {
-  const wrapReader = (reader, columns) => {
+  const wrapReader = (reader, columns, tableName) => {
     return {
       collect: async () => {
         const rows = await reader.collect();
@@ -67,13 +90,14 @@ const wrapDatabase = (base, perTable, context) => {
       // redacting masked cells the predicate can observe.
       filter: (predicate) => wrapReader(
         reader.filter((document) => predicate(maskRow(document, columns, context))),
-        columns
+        columns,
+        tableName
       ),
       first: async () => {
         const row = await reader.first();
         return row ? maskRow(row, columns, context) : null;
       },
-      order: (direction) => wrapReader(reader.order(direction), columns),
+      order: (direction) => wrapReader(reader.order(direction), columns, tableName),
       paginate: async (options) => maskPage(await reader.paginate(options), columns, context),
       take: async (limit) => {
         const rows = await reader.take(limit);
@@ -83,8 +107,19 @@ const wrapDatabase = (base, perTable, context) => {
         const row = await reader.unique();
         return row ? maskRow(row, columns, context) : null;
       },
-      withIndex: (indexName, range) => wrapReader(reader.withIndex(indexName, range), columns),
-      withSearchIndex: (indexName, search) => wrapReader(reader.withSearchIndex(indexName, search), columns)
+      // SECURITY (value oracle): reject before delegating when the range /
+      // search references a masked column — an index range or search term
+      // over a masked column is the same value oracle as a masked-column
+      // `where`, so it must fail closed (see `assertIndexFieldsAllowed`).
+      // Reads over NON-masked columns pass through and still mask output.
+      withIndex: (indexName, range) => {
+        assertIndexFieldsAllowed(range, columns, tableName, "withIndex");
+        return wrapReader(reader.withIndex(indexName, range), columns, tableName);
+      },
+      withSearchIndex: (indexName, search) => {
+        assertIndexFieldsAllowed(search, columns, tableName, "withSearchIndex");
+        return wrapReader(reader.withSearchIndex(indexName, search), columns, tableName);
+      }
     };
   };
   const locate = async (id, expectedTable) => {
@@ -201,7 +236,7 @@ const wrapDatabase = (base, perTable, context) => {
     query(tableName) {
       const reader = base.query(tableName);
       const columns = perTable.get(tableName);
-      return columns ? wrapReader(reader, columns) : reader;
+      return columns ? wrapReader(reader, columns, tableName) : reader;
     },
     async rankPage(tableName, indexName, options) {
       const page = await base.rankPage(tableName, indexName, options);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lunora/server",
-  "version": "1.0.0-alpha.12",
+  "version": "1.0.0-alpha.13",
   "description": "Server primitives for Lunora: defineSchema, defineTable, query, mutation, and action",
   "keywords": [
     "backend",