@m1212e/rumble 0.27.3 → 0.27.5

package/out/index.cjs

@@ -27,15 +27,15 @@ let es_toolkit = require("es-toolkit");
 let _opentelemetry_api = require("@opentelemetry/api");
 let _opentelemetry_semantic_conventions_incubating = require("@opentelemetry/semantic-conventions/incubating");
 let _pothos_tracing_opentelemetry = require("@pothos/tracing-opentelemetry");
+let drizzle_orm_mysql_core = require("drizzle-orm/mysql-core");
+let drizzle_orm_pg_core = require("drizzle-orm/pg-core");
+let drizzle_orm_sqlite_core = require("drizzle-orm/sqlite-core");
 let _escape_tech_graphql_armor = require("@escape.tech/graphql-armor");
 let _graphql_yoga_plugin_disable_introspection = require("@graphql-yoga/plugin-disable-introspection");
 let graphql_yoga = require("graphql-yoga");
 let drizzle_orm_casing = require("drizzle-orm/casing");
-let drizzle_orm_pg_core = require("drizzle-orm/pg-core");
-let drizzle_orm_mysql_core = require("drizzle-orm/mysql-core");
 let pluralize = require("pluralize");
 pluralize = __toESM(pluralize, 1);
-let drizzle_orm_sqlite_core = require("drizzle-orm/sqlite-core");
 let _pothos_core = require("@pothos/core");
 _pothos_core = __toESM(_pothos_core, 1);
 let _pothos_plugin_drizzle = require("@pothos/plugin-drizzle");
@@ -201,6 +201,7 @@ const columnMaskKey = Symbol.for("rumble:columnMask");
 const columnVisibilityKey = Symbol.for("rumble:columnVisibility");
 const guardInputKey = Symbol.for("rumble:guardInput");
 const resolvedFilterKey = Symbol.for("rumble:resolvedFilter");
+const refreshAbilitiesKey = Symbol.for("rumble:refreshAbilities");
 const requestStateKey = Symbol.for("rumble:requestState");
 // lib/abilityBuilder/requestState.ts
 function createRequestState() {
@@ -218,14 +219,6 @@ function requestStateOf(abilities) {
 	return abilities?.[requestStateKey];
 }
 // lib/abilityBuilder/columnMask.ts
-function referencesRelation(filter, relations) {
-	if (!filter || typeof filter !== "object") return false;
-	return Object.entries(filter).some(([key, value]) => {
-		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
-		if (key === "NOT") return referencesRelation(value, relations);
-		return key in relations;
-	});
-}
 function selectedColumns(columns, allColumns) {
 	if (!columns) return new Set(allColumns);
 	const entries = Object.entries(columns).filter(([, v]) => v !== void 0);
@@ -284,12 +277,7 @@ function conditionalGroups(rules, guaranteed) {
 function createColumnAccessResolver({ db, actions }, tableSchema) {
 	const allColumnNames = Object.keys(tableSchema.columns);
 	const primaryKeyNames = Object.keys(tableSchema.primaryKey);
-	const primaryKeyName = primaryKeyNames[0];
 	const toSQL = (table, wheres) => (0, drizzle_orm.or)(...wheres.map((where) => (0, drizzle_orm.relationsFilterToSQL)(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)));
-	const uncorrelated = (table, wheres, group) => {
-		const inner = (0, drizzle_orm.aliasedTable)(tableSchema.table, `rumble_columns_${group}`);
-		return drizzle_orm.sql`exists ${db.select({ pk: inner[primaryKeyName] }).from(inner).where(drizzle_orm.sql`${inner[primaryKeyName]} = ${table[primaryKeyName]} and (${toSQL(inner, wheres)})`)}`;
-	};
 	return function resolveColumnAccess(action, filters) {
 		const rules = filters.map((f) => ({
 			where: realWhere(f?.where),
@@ -320,11 +308,7 @@ function createColumnAccessResolver({ db, actions }, tableSchema) {
 		const actionIndex = drizzle_orm.sql.raw(String(actions.indexOf(action)));
 		const extras = { [ACTION_FLAG_KEY]: () => drizzle_orm.sql`${actionIndex}` };
 		groups.forEach(({ wheres }, group) => {
-			const relational = wheres.some((w) => referencesRelation(w, tableSchema.relations));
-			extras[mask.flags[group]] = (table) => {
-				const condition = relational ? uncorrelated(table, wheres, group) : toSQL(table, wheres);
-				return drizzle_orm.sql`case when ${condition} then 1 else 0 end`;
-			};
+			extras[mask.flags[group]] = (table) => drizzle_orm.sql`case when ${toSQL(table, wheres)} then 1 else 0 end`;
 		});
 		return {
 			columns,
@@ -574,6 +558,7 @@ const ATTR_ABILITIES_STATUS = "rumble.abilities.status";
 const ATTR_ABILITIES_STATIC = "rumble.abilities.static";
 const ATTR_ABILITIES_DYNAMIC = "rumble.abilities.dynamic";
 const ATTR_ABILITIES_TOTAL = "rumble.abilities.total";
+const ATTR_ABILITIES_RESOLVED = "rumble.abilities.resolved";
 const ATTR_FILTERS_TOTAL = "rumble.filters.total";
 const ATTR_FILTERS_ALLOWED = "rumble.filters.allowed";
 const ATTR_SUBSCRIPTION_EVENT_INDEX = "rumble.subscription.event_index";
@@ -796,6 +781,117 @@ function isDynamicQueryFilter(filter) {
 function isStaticQueryFilter(filter) {
 	return typeof filter !== "function";
 }
+// lib/helpers/determineDialectFromSchema.ts
+const dialectCache = /* @__PURE__ */ new WeakMap();
+function determineDBDialectFromSchema(schema) {
+	const cached = dialectCache.get(schema);
+	if (cached) return cached;
+	const found = /* @__PURE__ */ new Set();
+	for (const table of Object.values(schema).map((t) => t.table)) {
+		if (!table || typeof table !== "object") continue;
+		if ((0, drizzle_orm.is)(table, drizzle_orm_pg_core.PgTable)) found.add("postgres");
+		else if ((0, drizzle_orm.is)(table, drizzle_orm_mysql_core.MySqlTable)) found.add("mysql");
+		else if ((0, drizzle_orm.is)(table, drizzle_orm_sqlite_core.SQLiteTable)) found.add("sqlite");
+	}
+	const dialects = Array.from(found);
+	if (dialects.length === 1) {
+		const only = dialects[0];
+		dialectCache.set(schema, only);
+		return only;
+	}
+	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
+	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
+}
+function isPostgresDB(db) {
+	return determineDBDialectFromSchema(db._.relations) === "postgres";
+}
+// lib/abilityBuilder/resolveRules.ts
+const DEFAULT_MAX_RESOLVED_IDS = 500;
+/**
+* Whether the where names a relation of the table, so it renders as (nested)
+* `exists` subqueries.
+*/
+function referencesRelation(filter, relations) {
+	if (!filter || typeof filter !== "object") return false;
+	return Object.entries(filter).some(([key, value]) => {
+		if (key === "AND" || key === "OR") return value.some((v) => referencesRelation(v, relations));
+		if (key === "NOT") return referencesRelation(value, relations);
+		return key in relations;
+	});
+}
+/**
+* Creates the function replacing the relational rules of a table by the
+* primary keys they match, resolved with one query per call.
+*
+* A relational rule ("the users whose delegation the caller supervises")
+* renders as a chain of correlated `exists` subqueries, once in the row filter
+* and once more in every column flag, at every place the table is nested in a
+* query. Planning such a statement costs the database tens of megabytes. For a
+* given caller the rule matches a fixed set of rows though, so this looks them
+* up once (`select pk from table where <rule>`) and the rule becomes
+* `pk in (...)`, which costs the planner nothing. Rules matching more than
+* `maxIds` rows stay relational, so broad rules do not turn into huge lists.
+*
+* Returns undefined when disabled or the table has no single primary key.
+*/
+function createRuleResolver(settings, tableSchema) {
+	const config = settings.resolveRelationalRules;
+	const primaryKeys = Object.keys(tableSchema.primaryKey);
+	if (!config?.enabled || primaryKeys.length !== 1) return void 0;
+	const maxIds = config.maxIds ?? DEFAULT_MAX_RESOLVED_IDS;
+	const primaryKeyName = primaryKeys[0];
+	const db = settings.db;
+	const table = tableSchema.table;
+	const dialect = determineDBDialectFromSchema(db._.relations);
+	const unionAll = {
+		postgres: drizzle_orm_pg_core.unionAll,
+		sqlite: drizzle_orm_sqlite_core.unionAll,
+		mysql: drizzle_orm_mysql_core.unionAll
+	}[dialect];
+	const listFilter = (ids) => dialect === "postgres" ? { RAW: (aliased) => drizzle_orm.sql`${aliased[primaryKeyName]} = any(${drizzle_orm.sql.param(ids)})` } : { [primaryKeyName]: { in: ids } };
+	/** The primary keys matching the rule, tagged with the rule's index. */
+	const matches = (where, rule) => {
+		const limited = db.select({
+			pk: table[primaryKeyName],
+			rule: drizzle_orm.sql.raw(String(rule)).as("rule")
+		}).from(table).where((0, drizzle_orm.relationsFilterToSQL)(table, sanitizeFilterValue(where), tableSchema.relations, db._.relations)).limit(maxIds + 1).as(`rumble_rule_${rule}`);
+		return db.select({
+			pk: limited.pk,
+			rule: limited.rule
+		}).from(limited);
+	};
+	const whereOf = (filter) => realWhere(filter?.where);
+	return async function resolveRules(filters) {
+		const relational = filters.flatMap((filter, index) => referencesRelation(whereOf(filter), tableSchema.relations) ? [index] : []);
+		if (relational.length === 0) return {
+			filters,
+			resolved: 0
+		};
+		const queries = relational.map((index) => matches(whereOf(filters[index]), index));
+		const rows = await (queries.length === 1 ? queries[0] : unionAll(...queries));
+		const idsPerRule = new Map(relational.map((index) => [index, []]));
+		for (const row of rows) idsPerRule.get(Number(row.rule)).push(row.pk);
+		let resolved = 0;
+		const result = [];
+		filters.forEach((filter, index) => {
+			const ids = idsPerRule.get(index);
+			if (!ids || ids.length > maxIds) {
+				result.push(filter);
+				return;
+			}
+			resolved++;
+			if (ids.length === 0) return;
+			result.push({
+				...filter,
+				where: listFilter(ids)
+			});
+		});
+		return {
+			filters: result,
+			resolved
+		};
+	};
+}
 // lib/helpers/errorLogging.ts
 function hasMessage(error) {
 	return typeof error === "object" && error !== null && "message" in error;
@@ -933,7 +1029,23 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 	const blockEverythingFilter = createBlockEverythingFilter(String(tableName), tableSchema);
 	const resolveColumnAccess = createColumnAccessResolver(settings, tableSchema);
 	const transformToResponse = createFilterResponder(settings, tableSchema);
-	const assembleAbilities = async (userContext, action, attributes) => {
+	const resolveRules = createRuleResolver(settings, tableSchema);
+	const evaluateDynamicFilters = (userContext, action) => Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+	/** The response for the rules applying to the caller: their OR, columns and flags. */
+	const respondWithFilters = (action, allQueryFilters) => {
+		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
+			return mergeFilters(a, b, "OR");
+		});
+		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
+		if (columns) mergedFilters.columns = columns;
+		else delete mergedFilters.columns;
+		if (extras) mergedFilters.extras = {
+			...mergedFilters.extras,
+			...extras
+		};
+		return transformToResponse(mergedFilters, mask, visibility);
+	};
+	const assembleAbilities = async (action, attributes, evaluate) => {
 		const filters = queryFilters.get(action);
 		if (filters === "unrestricted") {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
@@ -944,7 +1056,7 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			settings.warnNothingRegistered(String(tableName), action);
 			return transformToResponse(blockEverythingFilter);
 		}
-		const rawResults = await Promise.all(dynamicQueryFilters[action].map((func) => func(userContext)));
+		const rawResults = await evaluate();
 		if (rawResults.includes("allow")) {
 			attributes[ATTR_ABILITIES_STATUS] = "unrestricted";
 			return transformToResponse();
@@ -952,28 +1064,32 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 		const dynamicResults = rawResults.filter((r) => r !== void 0).map(withRestrictingWhere);
 		attributes[ATTR_ABILITIES_DYNAMIC] = dynamicResults.length;
 		attributes[ATTR_ABILITIES_STATIC] = simpleQueryFilters[action].length;
-		const allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
+		let allQueryFilters = [...simpleQueryFilters[action], ...dynamicResults];
 		attributes[ATTR_ABILITIES_TOTAL] = allQueryFilters.length;
+		if (resolveRules && allQueryFilters.length > 0) {
+			const resolution = await resolveRules(allQueryFilters);
+			allQueryFilters = resolution.filters;
+			attributes[ATTR_ABILITIES_RESOLVED] = resolution.resolved;
+		}
 		if (allQueryFilters.length === 0) {
 			attributes[ATTR_ABILITIES_STATUS] = "blocked_everything";
 			return transformToResponse(blockEverythingFilter);
 		}
-		const mergedFilters = allQueryFilters.length === 1 ? { ...allQueryFilters[0] } : allQueryFilters.reduce((a, b) => {
-			return mergeFilters(a, b, "OR");
-		});
-		const { columns, extras, mask, visibility } = resolveColumnAccess(action, allQueryFilters);
-		if (columns) mergedFilters.columns = columns;
-		else delete mergedFilters.columns;
-		if (extras) mergedFilters.extras = {
-			...mergedFilters.extras,
-			...extras
-		};
 		attributes[ATTR_ABILITIES_STATUS] = "applied";
-		return transformToResponse(mergedFilters, mask, visibility);
+		return respondWithFilters(action, allQueryFilters);
 	};
 	return { withContext: (userContext) => {
-		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(userContext, action, attributes));
-		const cache = /* @__PURE__ */ new Map();
+		const evaluated = /* @__PURE__ */ new Map();
+		const evaluate = (action) => {
+			let results = evaluated.get(action);
+			if (!results) {
+				results = evaluateDynamicFilters(userContext, action);
+				evaluated.set(action, results);
+			}
+			return results;
+		};
+		const prepare = (action) => traceAbilityPreparation(settings, String(tableName), action, (attributes) => assembleAbilities(action, attributes, () => evaluate(action)));
+		let cache = /* @__PURE__ */ new Map();
 		const resolved = /* @__PURE__ */ new Map();
 		const abilities = { filter: (action) => {
 			let prepared = cache.get(action);
@@ -985,6 +1101,9 @@ const createTableAbilities = (settings, tableName, queryFilters) => {
 			return prepared;
 		} };
 		abilities[resolvedFilterKey] = (action) => resolved.get(action);
+		abilities[refreshAbilitiesKey] = () => {
+			if (resolveRules) cache = /* @__PURE__ */ new Map();
+		};
 		return abilities;
 	} };
 };
@@ -1089,11 +1208,11 @@ function createInputGuard({ db, abilities, readActionOf }) {
 			db,
 			table
 		});
-		return (aliased, { asc, desc }) => entries.map(([key, direction]) => {
+		return (aliased, { asc, desc }) => entries.filter(([key]) => visibility(key) !== false).map(([key, direction]) => {
 			const condition = visibility(key);
 			const column = aliased[key];
-			const value = condition === true ? column : condition === false ? null : drizzle_orm.sql`case when ${(0, drizzle_orm.relationsFilterToSQL)(aliased, sanitizeFilterValue(condition), schema.relations, db._.relations)} then ${column} end`;
-			return (direction === "asc" ? asc : desc)(value ?? drizzle_orm.sql`null`);
+			const value = condition === true ? column : drizzle_orm.sql`case when ${(0, drizzle_orm.relationsFilterToSQL)(aliased, sanitizeFilterValue(condition), schema.relations, db._.relations)} then ${column} end`;
+			return (direction === "asc" ? asc : desc)(value);
 		});
 	};
 	return {
@@ -1205,8 +1324,20 @@ when: (queryFilter) => {
 		}
 	};
 };
+// lib/abilityBuilder/refresh.ts
+/**
+* Starts a new snapshot of the resolved relational rules of every table, see
+* `resolveRelationalRules`. Rumble calls this whenever a root field starts to
+* resolve. Call it yourself in a resolver that writes rows and then reads them
+* through a table whose rules it already resolved before the write. A no-op
+* unless rules are resolved.
+*/
+function refreshAbilities(abilities) {
+	if (!abilities) return;
+	for (const table of Object.values(abilities)) table?.[refreshAbilitiesKey]?.();
+}
 // lib/abilityBuilder/index.ts
-const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerConfig }) => {
+const createAbilityBuilder = ({ db, actions, defaultLimit, resolveRelationalRules, otel, logger: loggerConfig }) => {
 	const log = loggerConfig?.enabled ? loggerConfig.logger : void 0;
 	const telemetryConfig = {
 		otel,
@@ -1216,6 +1347,7 @@ const createAbilityBuilder = ({ db, actions, defaultLimit, otel, logger: loggerC
 		db,
 		actions,
 		defaultLimit,
+		resolveRelationalRules,
 		otel,
 		telemetryConfig,
 		log,
@@ -1424,7 +1556,7 @@ function mapNullFieldsToUndefined(obj) {
 	return Object.fromEntries(Object.entries(obj).map(([key, value]) => [key, value === null ? void 0 : value]));
 }
 // package.json
-var version = "0.27.3";
+var version = "0.27.5";
 // lib/args/orderArg.ts
 const makeDefaultName$1 = (dbName) => `${(0, es_toolkit.capitalize)((0, drizzle_orm_casing.toCamelCase)(dbName.toString()))}OrderInputArgument`;
 const createOrderArgImplementer = ({ db, schemaBuilder }) => {
@@ -2172,30 +2304,6 @@ function buildPothosResponseTypeFromGraphQLType({ builder, sqlType, fieldName, n
 		default: throw new RumbleError(`Unsupported object type ${gqlType} for column ${fieldName}`);
 	}
 }
-// lib/helpers/determineDialectFromSchema.ts
-const dialectCache = /* @__PURE__ */ new WeakMap();
-function determineDBDialectFromSchema(schema) {
-	const cached = dialectCache.get(schema);
-	if (cached) return cached;
-	const found = /* @__PURE__ */ new Set();
-	for (const table of Object.values(schema).map((t) => t.table)) {
-		if (!table || typeof table !== "object") continue;
-		if ((0, drizzle_orm.is)(table, drizzle_orm_pg_core.PgTable)) found.add("postgres");
-		else if ((0, drizzle_orm.is)(table, drizzle_orm_mysql_core.MySqlTable)) found.add("mysql");
-		else if ((0, drizzle_orm.is)(table, drizzle_orm_sqlite_core.SQLiteTable)) found.add("sqlite");
-	}
-	const dialects = Array.from(found);
-	if (dialects.length === 1) {
-		const only = dialects[0];
-		dialectCache.set(schema, only);
-		return only;
-	}
-	if (dialects.length === 0) throw new Error("No tables found in schema, could not determine dialect");
-	throw new Error(`Multiple dialects found in schema: ${dialects.join(", ")}`);
-}
-function isPostgresDB(db) {
-	return determineDBDialectFromSchema(db._.relations) === "postgres";
-}
 // lib/search.ts
 async function initSearchIfApplicable(input) {
 	const log = input.logger?.enabled ? input.logger.logger : void 0;
@@ -3030,6 +3138,28 @@ function createAbilityAwareClient({ db, abilityBuilder }) {
 		} });
 	};
 }
+// lib/refreshAbilitiesPlugin/refreshAbilitiesPlugin.ts
+const refreshAbilitiesPluginName = "RefreshAbilitiesPlugin";
+/**
+* Starts a new snapshot of the resolved relational rules whenever a root
+* field (query, mutation or subscription event) starts to resolve, see
+* `resolveRelationalRules`. A mutation's second root field sees what the first
+* wrote, and a live query refetching sees the rows related to the caller by
+* now. A no-op unless rules are resolved.
+*/
+var RefreshAbilitiesPlugin = class extends _pothos_core.BasePlugin {
+	wrapResolve(resolver, fieldConfig) {
+		const { kind } = this.buildCache.getTypeConfig(fieldConfig.parentType);
+		if (kind !== "Query" && kind !== "Mutation" && kind !== "Subscription") return resolver;
+		return (parent, args, context, info) => {
+			refreshAbilities(context?.abilities);
+			return resolver(parent, args, context, info);
+		};
+	}
+};
+function registerRefreshAbilitiesPlugin() {
+	registerPluginOnce(refreshAbilitiesPluginName, RefreshAbilitiesPlugin);
+}
 // lib/runtimeFiltersPlugin/filterTypes.ts
 const pluginName = "RuntimeFiltersPlugin";
 // lib/runtimeFiltersPlugin/runtimeFiltersPlugin.ts
@@ -9199,10 +9329,12 @@ const createSchemaBuilder = ({ db, pubsub, pothosConfig, otel, logger, validatio
 	const createSpan = otel?.enabled && otel.tracer ? (0, _pothos_tracing_opentelemetry.createOpenTelemetryWrapper)(otel.tracer, otel.options) : void 0;
 	registerRuntimeFiltersPlugin();
 	registerColumnMaskPlugin();
+	registerRefreshAbilitiesPlugin();
 	const schemaBuilder = new _pothos_core.default({
 		...pothosConfig,
 		plugins: [
 			columnMaskPluginName,
+			refreshAbilitiesPluginName,
 			pluginName,
 			_pothos_plugin_drizzle.default,
 			_pothos_plugin_smart_subscriptions.default,
@@ -9623,6 +9755,7 @@ exports.normalizeAddress = normalizeAddress;
 exports.normalizeEmailAddress = normalizeEmailAddress;
 exports.normalizePersonName = normalizePersonName;
 exports.parsePhoneNumber = parsePhoneNumber;
+exports.refreshAbilities = refreshAbilities;
 exports.rumble = rumble;
 exports.validateAddress = validateAddress;