@m1212e/rumble 0.27.3 → 0.27.4

package/out/index.mjs

@@ -1,18 +1,18 @@
 import { t as generateFromSchema } from "./generate-Dzf2klR2.mjs";
-import { One, aliasedTable, asc, count, desc, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
+import { One, asc, count, desc, getTableColumns, getTableName, is, isTable, or, relationsFilterToSQL, sql } from "drizzle-orm";
 import { GraphQLError, GraphQLScalarType, GraphQLSchema, Kind, execute as defaultExecute, getOperationAST, print, subscribe as defaultSubscribe } from "graphql";
 import { capitalize, cloneDeep, debounce, merge, once, toMerged } from "es-toolkit";
 import { SpanStatusCode, isSpanContextValid, trace } from "@opentelemetry/api";
 import { ATTR_GRAPHQL_DOCUMENT, ATTR_GRAPHQL_OPERATION_NAME, ATTR_GRAPHQL_OPERATION_TYPE } from "@opentelemetry/semantic-conventions/incubating";
 import { AttributeNames, SpanNames, createOpenTelemetryWrapper } from "@pothos/tracing-opentelemetry";
+import { MySqlEnumColumn, MySqlEnumObjectColumn, MySqlTable, getTableConfig, unionAll } from "drizzle-orm/mysql-core";
+import { PgColumn, PgEnumColumn, PgEnumObjectColumn, PgTable, getTableConfig as getTableConfig$1, isPgEnum, unionAll as unionAll$1 } from "drizzle-orm/pg-core";
+import { SQLiteTable, getTableConfig as getTableConfig$2, unionAll as unionAll$2 } from "drizzle-orm/sqlite-core";
 import { EnvelopArmorPlugin } from "@escape.tech/graphql-armor";
 import { useDisableIntrospection } from "@graphql-yoga/plugin-disable-introspection";
 import { createPubSub, createYoga } from "graphql-yoga";
 import { toCamelCase } from "drizzle-orm/casing";
-import { PgColumn, PgEnumColumn, PgEnumObjectColumn, PgTable, getTableConfig, isPgEnum } from "drizzle-orm/pg-core";
-import { MySqlEnumColumn, MySqlEnumObjectColumn, MySqlTable, getTableConfig as getTableConfig$1 } from "drizzle-orm/mysql-core";
 import pluralize from "pluralize";
-import { SQLiteTable, getTableConfig as getTableConfig$2 } from "drizzle-orm/sqlite-core";
 import SchemaBuilder, { BasePlugin, isThenable } from "@pothos/core";
 import DrizzlePlugin from "@pothos/plugin-drizzle";
 import SmartSubscriptionsPlugin, { subscribeOptionsFromIterator } from "@pothos/plugin-smart-subscriptions";
@@ -172,6 +172,7 @@ const columnMaskKey = Symbol.for("rumble:columnMask");
 const columnVisibilityKey = Symbol.for("rumble:columnVisibility");
 const guardInputKey = Symbol.for("rumble:guardInput");
 const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
+const refreshAbilitiesKey = Symbol.for("rumble:refreshAbilities");
 const requestStateKey = Symbol.for("rumble:requestState");
 // lib/abilityBuilder/requestState.ts
 function createRequestState() {
@@ -189,14 +190,6 @@ function requestStateOf(abilities) {
 	return abilities?.[requestStateKey];
 }
 // lib/abilityBuilder/columnMask.ts
-function referencesRelation(filter, relations) {
-	if (!filter || typeof filter !== "object") return false;
-	return Object.entries(filter).some(([key, value]) => {
-		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
-		if (key === "NOT") return referencesRelation(value, relations);
-		return key in relations;
-	});
-}
 function selectedColumns(columns, allColumns) {
 	if (!columns) return new Set(allColumns);
 	const entries = Object.entries(columns).filter(([, v]) => v !== void 0);
@@ -255,12 +248,7 @@ function conditionalGroups(rules, guaranteed) {
 function createColumnAccessResolver({ db, actions }, tableSchema) {
 	const allColumnNames = Object.keys(tableSchema.columns);
 	const primaryKeyNames = Object.keys(tableSchema.primaryKey);
-	const primaryKeyName = primaryKeyNames[0];
 	const toSQL = (table, wheres) => or(...wheres.map((where) => relationsFilterToSQL(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
-	const uncorrelated = (table, wheres, group) => {
-		const inner = aliasedTable(tableSchema.table, `rumble_columns_${group}`);
-		return sql`exists ${db.select({ pk: inner[primaryKeyName] }).from(inner).where(sql`${inner[primaryKeyName]} = ${table[primaryKeyName]} and (${toSQL(inner, wheres)})`)}`;
-	};
 	return function resolveColumnAccess(action, filters) {
 		const rules = filters.map((f) => ({
 			where: realWhere(f?.where),
@@ -291,11 +279,7 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		const actionIndex = sql.raw(String(actions.indexOf(action)));
 		const extras = { [ACTION_FLAG_KEY]: () => sql`${actionIndex}` };
 		groups.forEach(({ wheres }, group) => {
-			const relational = wheres.some((w) => referencesRelation(w, tableSchema.relations));
-			extras[mask.flags[group]] = (table) => {
-				const condition = relational ? uncorrelated(table, wheres, group) : toSQL(table, wheres);
-				return sql`case when ${condition} then 1 else 0 end`;
-			};
+			extras[mask.flags[group]] = (table) => sql`case when ${toSQL(table, wheres)} then 1 else 0 end`;
 		});
 		return {
 			columns,
@@ -545,6 +529,7 @@ const ATTR_ABILITIES_STATUS = "rumble.abilities.status";
 const ATTR_ABILITIES_STATIC = "rumble.abilities.static";
 const ATTR_ABILITIES_DYNAMIC = "rumble.abilities.dynamic";
 const ATTR_ABILITIES_TOTAL = "rumble.abilities.total";
+const ATTR_ABILITIES_RESOLVED = "rumble.abilities.resolved";
 const ATTR_FILTERS_TOTAL = "rumble.filters.total";
 const ATTR_FILTERS_ALLOWED = "rumble.filters.allowed";
 const ATTR_SUBSCRIPTION_EVENT_INDEX = "rumble.subscription.event_index";
@@ -767,6 +752,117 @@ function isDynamicQueryFilter(filter) {
 function isStaticQueryFilter(filter) {
 	return typeof filter !== "function";
 }
+// lib/helpers/determineDialectFromSchema.ts
+const dialectCache = /* @__PURE__ */ new WeakMap();
+function determineDBDialectFromSchema(schema) {
+	const cached = dialectCache.get(schema);
+	if (cached) return cached;
+	const found = /* @__PURE__ */ new Set();
+	for (const table of Object.values(schema).map((t) => t.table)) {
+		if (!table || typeof table !== "object") continue;
+		if (is(table, PgTable)) found.add("postgres");
+		else if (is(table, MySqlTable)) found.add("mysql");
+		else if (is(table, SQLiteTable)) found.add("sqlite");
+	}
+	const dialects = Array.from(found);
+	if (dialects.length === 1) {
+		const only = dialects[0];
+		dialectCache.set(schema, only);
+		return only;
+	}
+	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
+	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
+}
+function isPostgresDB(db) {
+	return determineDBDialectFromSchema(db._.relations) === "postgres";
+}
+// lib/abilityBuilder/resolveRules.ts
+const DEFAULT_MAX_RESOLVED_IDS = 500;
+/**
+* Whether the where names a relation of the table, so it renders as (nested)
+* `exists` subqueries.
+*/
+function referencesRelation(filter, relations) {
+	if (!filter || typeof filter !== "object") return false;
+	return Object.entries(filter).some(([key, value]) => {
+		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
+		if (key === "NOT") return referencesRelation(value, relations);
+		return key in relations;
+	});
+}
+/**
+* Creates the function replacing the relational rules of a table by the
+* primary keys they match, resolved with one query per call.
+*
+* A relational rule ("the users whose delegation the caller supervises")
+* renders as a chain of correlated `exists` subqueries, once in the row filter
+* and once more in every column flag, at every place the table is nested in a
+* query. Planning such a statement costs the database tens of megabytes. For a
+* given caller the rule matches a fixed set of rows though, so this looks them
+* up once (`select pk from table where <rule>`) and the rule becomes
+* `pk in (...)`, which costs the planner nothing. Rules matching more than
+* `maxIds` rows stay relational, so broad rules do not turn into huge lists.
+*
+* Returns undefined when disabled or the table has no single primary key.
+*/
+function createRuleResolver(settings, tableSchema) {
+	const config = settings.resolveRelationalRules;
+	const primaryKeys = Object.keys(tableSchema.primaryKey);
+	if (!config?.enabled || primaryKeys.length !== 1) return void 0;
+	const maxIds = config.maxIds ?? DEFAULT_MAX_RESOLVED_IDS;
+	const primaryKeyName = primaryKeys[0];
+	const db = settings.db;
+	const table = tableSchema.table;
+	const dialect = determineDBDialectFromSchema(db._.relations);
+	const unionAll$3 = {
+		postgres: unionAll$1,
+		sqlite: unionAll$2,
+		mysql: unionAll
+	}[dialect];
+	const listFilter = (ids) => dialect === "postgres" ? { RAW: (aliased) => sql`${aliased[primaryKeyName]} = any(${sql.param(ids)})` } : { [primaryKeyName]: { in: ids } };
+	/** The primary keys matching the rule, tagged with the rule's index. */
+	const matches = (where, rule) => {
+		const limited = db.select({
+			pk: table[primaryKeyName],
+			rule: sql.raw(String(rule)).as("rule")
+		}).from(table).where(relationsFilterToSQL(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)).limit(maxIds + 1).as(`rumble_rule_${rule}`);
+		return db.select({
+			pk: limited.pk,
+			rule: limited.rule
+		}).from(limited);
+	};
+	const whereOf = (filter) => realWhere(filter?.where);
+	return async function resolveRules(filters) {
+		const relational = filters.flatMap((filter, index) => referencesRelation(whereOf(filter), tableSchema.relations) ? [index] : []);
+		if (relational.length === 0) return {
+			filters,
+			resolved: 0
+		};
+		const queries = relational.map((index) => matches(whereOf(filters[index]), index));
+		const rows = await (queries.length === 1 ? queries[0] : unionAll$3(...queries));
+		const idsPerRule = new Map(relational.map((index) => [index, []]));
+		for (const row of rows) idsPerRule.get(Number(row.rule)).push(row.pk);
+		let resolved = 0;
+		const result = [];
+		filters.forEach((filter, index) => {
+			const ids = idsPerRule.get(index);
+			if (!ids || ids.length > maxIds) {
+				result.push(filter);
+				return;
+			}
+			resolved++;
+			if (ids.length === 0) return;
+			result.push({
+				...filter,
+				where: listFilter(ids)
+			});
+		});
+		return {
+			filters: result,
+			resolved
+		};
+	};
+}
 // lib/helpers/errorLogging.ts
 function hasMessage(error) {
 	return typeof error === "object" && error !== null && "message" in error;
@@ -904,7 +1000,23 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 	const blockEverythingFilter = createBlockEverythingFilter(String(tableName), tableSchema);
 	const resolveColumnAccess = createColumnAccessResolver(settings, tableSchema);
 	const transformToResponse = createFilterResponder(settings, tableSchema);
-	const assembleAbilities = async (userContext, action, attributes) => {
+	const resolveRules = createRuleResolver(settings, tableSchema);
+	const evaluateDynamicFilters = (userContext, action) => Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+	/** The response for the rules applying to the caller: their OR, columns and flags. */
+	const respondWithFilters = (action, allQueryFilters) => {
+		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
+			return mergeFilters(a, b, "OR");
+		});
+		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
+		if (columns) mergedFilters.columns = columns;
+		else delete mergedFilters.columns;
+		if (extras) mergedFilters.extras = {
+			...mergedFilters.extras,
+			...extras
+		};
+		return transformToResponse(mergedFilters, mask, visibility);
+	};
+	const assembleAbilities = async (action, attributes, evaluate) => {
 		const filters = queryFilters.get(action);
 		if (filters === "unrestricted") {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
@@ -915,7 +1027,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			settings.warnNothingRegistered(String(tableName), action);
 			return transformToResponse(blockEverythingFilter);
 		}
-		const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+		const rawResults = await evaluate();
 		if (rawResults.includes("allow")) {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
 			return transformToResponse();
@@ -923,28 +1035,32 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 		const dynamicResults = rawResults.filter((r) => r !== void 0).map(withRestrictingWhere);
 		attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
 		attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
-		const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
+		let allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
 		attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
+		if (resolveRules && allQueryFilters.length > 0) {
+			const resolution = await resolveRules(allQueryFilters);
+			allQueryFilters = resolution.filters;
+			attributes[ATTR_ABILITIES_RESOLVED] = resolution.resolved;
+		}
 		if (allQueryFilters.length === 0) {
 			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
 			return transformToResponse(blockEverythingFilter);
 		}
-		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
-			return mergeFilters(a, b, "OR");
-		});
-		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
-		if (columns) mergedFilters.columns = columns;
-		else delete mergedFilters.columns;
-		if (extras) mergedFilters.extras = {
-			...mergedFilters.extras,
-			...extras
-		};
 		attributes[ATTR_ABILITIES_STATUS] = "applied";
-		return transformToResponse(mergedFilters, mask, visibility);
+		return respondWithFilters(action, allQueryFilters);
 	};
 	return { withContext: (userContext) => {
-		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
-		const cache = /* @__PURE__ */ new Map();
+		const evaluated = /* @__PURE__ */ new Map();
+		const evaluate = (action) => {
+			let results = evaluated.get(action);
+			if (!results) {
+				results = evaluateDynamicFilters(userContext, action);
+				evaluated.set(action, results);
+			}
+			return results;
+		};
+		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(action, attributes, () => evaluate(action)));
+		let cache = /* @__PURE__ */ new Map();
 		const resolved = /* @__PURE__ */ new Map();
 		const abilities = { filter: (action) => {
 			let prepared = cache.get(action);
@@ -956,6 +1072,9 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			return prepared;
 		} };
 		abilities[resolvedFilterKey] = (action) => resolved.get(action);
+		abilities[refreshAbilitiesKey] = () => {
+			if (resolveRules) cache = /* @__PURE__ */ new Map();
+		};
 		return abilities;
 	} };
 };
@@ -1176,8 +1295,20 @@ when: (queryFilter) => {
 		}
 	};
 };
+// lib/abilityBuilder/refresh.ts
+/**
+* Starts a new snapshot of the resolved relational rules of every table, see
+* `resolveRelationalRules`. Rumble calls this whenever a root field starts to
+* resolve. Call it yourself in a resolver that writes rows and then reads them
+* through a table whose rules it already resolved before the write. A no-op
+* unless rules are resolved.
+*/
+function refreshAbilities(abilities) {
+	if (!abilities) return;
+	for (const table of Object.values(abilities)) table?.[refreshAbilitiesKey]?.();
+}
 // lib/abilityBuilder/index.ts
-const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerConfig }) => {
+const createAbilityBuilder = ({ db, actions, defaultLimit, resolveRelationalRules, otel, logger: loggerConfig }) => {
 	const log = loggerConfig?.enabled ? loggerConfig.logger : void 0;
 	const telemetryConfig = {
 		otel,
@@ -1187,6 +1318,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		db,
 		actions,
 		defaultLimit,
+		resolveRelationalRules,
 		otel,
 		telemetryConfig,
 		log,
@@ -1395,7 +1527,7 @@ function mapNullFieldsToUndefined(obj) {
 	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
 }
 // package.json
-var version = "0.27.3";
+var version = "0.27.4";
 // lib/args/orderArg.ts
 const makeDefaultName$1 = (dbName) => `${capitalize(toCamelCase(dbName.toString()))}OrderInputArgument`;
 const createOrderArgImplementer = ({ db, schemaBuilder }) => {
@@ -2143,30 +2275,6 @@ function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, n
 		default: throw new RumbleError(`Unsupported object type ${gqlType} for column ${fieldName}`);
 	}
 }
-// lib/helpers/determineDialectFromSchema.ts
-const dialectCache = /* @__PURE__ */ new WeakMap();
-function determineDBDialectFromSchema(schema) {
-	const cached = dialectCache.get(schema);
-	if (cached) return cached;
-	const found = /* @__PURE__ */ new Set();
-	for (const table of Object.values(schema).map((t) => t.table)) {
-		if (!table || typeof table !== "object") continue;
-		if (is(table, PgTable)) found.add("postgres");
-		else if (is(table, MySqlTable)) found.add("mysql");
-		else if (is(table, SQLiteTable)) found.add("sqlite");
-	}
-	const dialects = Array.from(found);
-	if (dialects.length === 1) {
-		const only = dialects[0];
-		dialectCache.set(schema, only);
-		return only;
-	}
-	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
-	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
-}
-function isPostgresDB(db) {
-	return determineDBDialectFromSchema(db._.relations) === "postgres";
-}
 // lib/search.ts
 async function initSearchIfApplicable(input) {
 	const log = input.logger?.enabled ? input.logger.logger : void 0;
@@ -3001,6 +3109,28 @@ function createAbilityAwareClient({ db, abilityBuilder }) {
 		} });
 	};
 }
+// lib/refreshAbilitiesPlugin/refreshAbilitiesPlugin.ts
+const refreshAbilitiesPluginName = "RefreshAbilitiesPlugin";
+/**
+* Starts a new snapshot of the resolved relational rules whenever a root
+* field (query, mutation or subscription event) starts to resolve, see
+* `resolveRelationalRules`. A mutation's second root field sees what the first
+* wrote, and a live query refetching sees the rows related to the caller by
+* now. A no-op unless rules are resolved.
+*/
+var RefreshAbilitiesPlugin = class extends BasePlugin {
+	wrapResolve(resolver, fieldConfig) {
+		const { kind } = this.buildCache.getTypeConfig(fieldConfig.parentType);
+		if (kind !== "Query" && kind !== "Mutation" && kind !== "Subscription") return resolver;
+		return (parent, args, context, info) => {
+			refreshAbilities(context?.abilities);
+			return resolver(parent, args, context, info);
+		};
+	}
+};
+function registerRefreshAbilitiesPlugin() {
+	registerPluginOnce(refreshAbilitiesPluginName, RefreshAbilitiesPlugin);
+}
 // lib/runtimeFiltersPlugin/filterTypes.ts
 const pluginName = "RuntimeFiltersPlugin";
 // lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
@@ -9170,10 +9300,12 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 	const createSpan = otel?.enabled && otel.tracer ? createOpenTelemetryWrapper(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
 	registerColumnMaskPlugin();
+	registerRefreshAbilitiesPlugin();
 	const schemaBuilder = new SchemaBuilder({
 		...pothosConfig,
 		plugins: [
 			columnMaskPluginName,
+			refreshAbilitiesPluginName,
 			pluginName,
 			DrizzlePlugin,
 			SmartSubscriptionsPlugin,
@@ -9188,8 +9320,8 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 			}),
 			relations: db._.relations,
 			getTableConfig(table) {
-				if (is(table, PgTable)) return getTableConfig(table);
-				if (is(table, MySqlTable)) return getTableConfig$1(table);
+				if (is(table, PgTable)) return getTableConfig$1(table);
+				if (is(table, MySqlTable)) return getTableConfig(table);
 				if (is(table, SQLiteTable)) return getTableConfig$2(table);
 				return {
 					columns: isTable(table) ? Object.values(getTableColumns(table)) : [],
@@ -9577,6 +9709,6 @@ export const r = rumble({
 		buildSchema: builtSchema
 	};
 };
-export { RumbleError, RumbleErrorSafe, addressChecks, addressData, addressValidationSchema, assertFindFirstExists, assertFirstEntryExists, checkPostalCode, checkRegion, checkRequiredFields, findRegionCode, guardFilterInput, mapNullFieldsToUndefined, normalizeAddress, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, rumble, validateAddress };
+export { RumbleError, RumbleErrorSafe, addressChecks, addressData, addressValidationSchema, assertFindFirstExists, assertFirstEntryExists, checkPostalCode, checkRegion, checkRequiredFields, findRegionCode, guardFilterInput, mapNullFieldsToUndefined, normalizeAddress, normalizeEmailAddress, normalizePersonName, parsePhoneNumber, refreshAbilities, rumble, validateAddress };
 
 //# sourceMappingURL=index.mjs.map