npm - @malloy-publisher/server - Versions diffs - 0.0.203 → 0.0.204 - Mend

@malloy-publisher/server 0.0.203 → 0.0.204

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (50) hide show

package/dist/app/api-doc.yaml +17 -0
package/dist/app/assets/{EnvironmentPage-BVQ7glKP.js → EnvironmentPage-CX06cjOF.js} +1 -1
package/dist/app/assets/HomePage-CNFt_eUU.js +1 -0
package/dist/app/assets/{MainPage-bYOWcgDP.js → MainPage-nUJ9YatG.js} +1 -1
package/dist/app/assets/{PackagePage-N1ZBNJul.js → MaterializationsPage-B5goxVXW.js} +1 -1
package/dist/app/assets/{ModelPage-DT0gjNy1.js → ModelPage-Ba7Xh4lL.js} +1 -1
package/dist/app/assets/PackagePage-BaEVdEAG.js +1 -0
package/dist/app/assets/{RouteError-_J-EBz7W.js → RouteError-BShQjZio.js} +1 -1
package/dist/app/assets/{WorkbookPage-Bjs9Nm-_.js → WorkbookPage-CBn6ZjJW.js} +1 -1
package/dist/app/assets/{core-BPLlx5VM.es-C2ARtwWI.js → core-DECXYL4E.es-OaRfXwuQ.js} +1 -1
package/dist/app/assets/{index-CqUWJELr.js → index-BLfPC1gy.js} +2 -2
package/dist/app/assets/index-DqiJ0bWp.js +455 -0
package/dist/app/assets/index-Dy3YhAZQ.js +1812 -0
package/dist/app/assets/index.umd-DAN9K8yC.js +2469 -0
package/dist/app/index.html +1 -1
package/dist/package_load_worker.mjs +392 -67
package/dist/server.mjs +415 -152
package/package.json +11 -11
package/src/ducklake_version.spec.ts +43 -0
package/src/ducklake_version.ts +26 -0
package/src/errors.ts +18 -1
package/src/package_load/package_load_pool.ts +0 -5
package/src/package_load/package_load_worker.ts +41 -99
package/src/package_load/protocol.ts +1 -7
package/src/service/annotations.spec.ts +118 -0
package/src/service/annotations.ts +91 -0
package/src/service/authorize.spec.ts +132 -0
package/src/service/authorize.ts +241 -0
package/src/service/authorize_integration.spec.ts +838 -0
package/src/service/connection.ts +1 -1
package/src/service/environment.ts +4 -4
package/src/service/filter.spec.ts +14 -3
package/src/service/filter.ts +5 -1
package/src/service/filter_bypass.spec.ts +418 -0
package/src/service/given.ts +37 -12
package/src/service/givens_integration.spec.ts +34 -7
package/src/service/materialization_service.ts +25 -20
package/src/service/materialized_table_gc.spec.ts +6 -5
package/src/service/materialized_table_gc.ts +2 -50
package/src/service/model.spec.ts +203 -8
package/src/service/model.ts +305 -155
package/src/service/package_worker_path.spec.ts +113 -0
package/src/service/quoting.ts +0 -20
package/src/service/restricted_mode.spec.ts +299 -0
package/src/service/source_extraction.ts +226 -0
package/src/storage/StorageManager.ts +73 -0
package/dist/app/assets/HomePage-D9drXoZX.js +0 -1
package/dist/app/assets/index-BeNwIeYQ.js +0 -454
package/dist/app/assets/index-Dx7qi2LO.js +0 -1803
package/dist/app/assets/index.umd-BXm2lnUO.js +0 -1145

package/dist/app/index.html CHANGED Viewed

@@ -11,7 +11,7 @@
          href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap"
       />
       <title>Malloy Publisher</title>
-     <script type="module" crossorigin src="/assets/index-BeNwIeYQ.js"></script>
+     <script type="module" crossorigin src="/assets/index-DqiJ0bWp.js"></script>
      <link rel="stylesheet" crossorigin href="/assets/index-5eLCcNmP.css">
    </head>
    <body>

package/dist/package_load_worker.mjs CHANGED Viewed

@@ -11386,16 +11386,156 @@ var init_logger = __esm(() => {
   DISABLE_RESPONSE_LOGGING = process.env.DISABLE_RESPONSE_LOGGING === "true" || process.env.DISABLE_RESPONSE_LOGGING === "1";
 });
+// src/errors.ts
+import { MalloyError } from "@malloydata/malloy";
+function internalErrorToHttpError(error) {
+  if (error instanceof BadRequestError) {
+    return httpError(400, error.message);
+  } else if (error instanceof FrozenConfigError) {
+    return httpError(403, error.message);
+  } else if (error instanceof AccessDeniedError) {
+    return httpError(403, error.message);
+  } else if (error instanceof EnvironmentNotFoundError) {
+    return httpError(404, error.message);
+  } else if (error instanceof PackageNotFoundError) {
+    return httpError(404, error.message);
+  } else if (error instanceof ModelNotFoundError) {
+    return httpError(404, error.message);
+  } else if (error instanceof MalloyError) {
+    return httpError(400, error.message);
+  } else if (error instanceof ConnectionNotFoundError) {
+    return httpError(404, error.message);
+  } else if (error instanceof ConnectionAuthError) {
+    return httpError(422, error.message);
+  } else if (error instanceof ModelCompilationError) {
+    return httpError(424, error.message);
+  } else if (error instanceof ConnectionError) {
+    return httpError(502, error.message);
+  } else if (error instanceof MaterializationNotFoundError) {
+    return httpError(404, error.message);
+  } else if (error instanceof MaterializationConflictError) {
+    return httpError(409, error.message);
+  } else if (error instanceof InvalidStateTransitionError) {
+    return httpError(409, error.message);
+  } else if (error instanceof ServiceUnavailableError) {
+    return httpError(503, error.message);
+  } else if (error instanceof PayloadTooLargeError) {
+    return httpError(413, error.message);
+  } else if (error instanceof QueryTimeoutError) {
+    return httpError(504, error.message);
+  } else {
+    return httpError(500, error.message);
+  }
+}
+function httpError(code, message) {
+  return {
+    status: code,
+    json: {
+      code,
+      message
+    }
+  };
+}
+var NotImplementedError, BadRequestError, EnvironmentNotFoundError, PackageNotFoundError, ModelNotFoundError, ConnectionNotFoundError, ConnectionError, ConnectionAuthError, ModelCompilationError, FrozenConfigError, AccessDeniedError, MaterializationNotFoundError, MaterializationConflictError, InvalidStateTransitionError, ServiceUnavailableError, PayloadTooLargeError, QueryTimeoutError;
+var init_errors = __esm(() => {
+  init_constants();
+  NotImplementedError = class NotImplementedError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  BadRequestError = class BadRequestError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  EnvironmentNotFoundError = class EnvironmentNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  PackageNotFoundError = class PackageNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ModelNotFoundError = class ModelNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ConnectionNotFoundError = class ConnectionNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ConnectionError = class ConnectionError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ConnectionAuthError = class ConnectionAuthError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ModelCompilationError = class ModelCompilationError extends Error {
+    constructor(error) {
+      super(error.message);
+    }
+  };
+  FrozenConfigError = class FrozenConfigError extends Error {
+    constructor(message = `Publisher config can't be updated when ${PUBLISHER_CONFIG_NAME} has { "frozenConfig": true }`) {
+      super(message);
+    }
+  };
+  AccessDeniedError = class AccessDeniedError extends Error {
+    constructor(message) {
+      super(message);
+      this.name = "AccessDeniedError";
+    }
+  };
+  MaterializationNotFoundError = class MaterializationNotFoundError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  MaterializationConflictError = class MaterializationConflictError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  InvalidStateTransitionError = class InvalidStateTransitionError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  ServiceUnavailableError = class ServiceUnavailableError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  PayloadTooLargeError = class PayloadTooLargeError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+  QueryTimeoutError = class QueryTimeoutError extends Error {
+    constructor(message) {
+      super(message);
+    }
+  };
+});
 // src/package_load/package_load_worker.ts
 init_constants();
 var import_recursive_readdir = __toESM(require_recursive_readdir(), 1);
 import {
   contextOverlay,
   MalloyConfig,
-  MalloyError,
+  MalloyError as MalloyError2,
   modelDefToModelInfo,
-  Runtime,
-  isSourceDef
+  Runtime
 } from "@malloydata/malloy";
 import {
   MalloySQLParser,
@@ -11454,6 +11594,157 @@ class HackyDataStylesAccumulator {
   }
 }
+// src/package_load/package_load_worker.ts
+init_errors();
+// src/service/authorize.ts
+init_errors();
+var SOURCE_PREFIX = "#(authorize)";
+var FILE_PREFIX = "##(authorize)";
+function buildAuthorizeProbe(exprs) {
+  const selects = exprs.map((expr, i) => `__auth_${i} is (${expr})`).join(`
+      `);
+  return `run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
+    select:
+      ${selects}
+    limit: 1
+  }`;
+}
+function isProbeTrue(cell) {
+  return cell === true || cell === 1 || cell === "true";
+}
+async function evaluateAuthorize(executor, exprs, givens) {
+  for (const expr of exprs) {
+    try {
+      const result = await executor.loadQuery(buildAuthorizeProbe([expr])).run({ rowLimit: 1, givens });
+      const row = result?.data?.value?.[0];
+      if (row && isProbeTrue(row.__auth_0)) {
+        return true;
+      }
+    } catch {
+      continue;
+    }
+  }
+  return false;
+}
+async function validateAuthorizeProbes(compiler, sources) {
+  for (const source of sources) {
+    const exprs = source.authorize;
+    if (!exprs || exprs.length === 0)
+      continue;
+    try {
+      await compiler.loadQuery(buildAuthorizeProbe(exprs)).getPreparedQuery();
+    } catch (err) {
+      const detail = err instanceof Error ? err.message : String(err);
+      throw new ModelCompilationError({
+        message: `Invalid #(authorize) annotation on source "${source.name ?? "(unnamed)"}" [${exprs.join(" | ")}]: ${detail}`
+      });
+    }
+  }
+}
+function parseAuthorizeAnnotation(annotation) {
+  const trimmed = annotation.trim();
+  let body;
+  if (trimmed.startsWith(FILE_PREFIX)) {
+    body = trimmed.slice(FILE_PREFIX.length).trim();
+  } else if (trimmed.startsWith(SOURCE_PREFIX)) {
+    body = trimmed.slice(SOURCE_PREFIX.length).trim();
+  } else {
+    return null;
+  }
+  return unwrapQuotedExpression(body);
+}
+function collectAuthorizeExprs(annotations) {
+  const exprs = [];
+  for (const annotation of annotations) {
+    const expr = parseAuthorizeAnnotation(annotation);
+    if (expr !== null) {
+      exprs.push(expr);
+    }
+  }
+  return exprs;
+}
+function unwrapQuotedExpression(body) {
+  if (body.length < 2 || body[0] !== '"') {
+    throw new Error(`authorize annotation expression must be a double-quoted string, got: ${body || "(empty)"}`);
+  }
+  let expr = "";
+  let i = 1;
+  let closed = false;
+  for (;i < body.length; i++) {
+    const ch = body[i];
+    if (ch === "\\" && i + 1 < body.length) {
+      const next = body[i + 1];
+      if (next === '"' || next === "\\") {
+        expr += next;
+        i++;
+        continue;
+      }
+    }
+    if (ch === '"') {
+      closed = true;
+      i++;
+      break;
+    }
+    expr += ch;
+  }
+  if (!closed) {
+    throw new Error(`authorize annotation has mismatched quotes: ${body}`);
+  }
+  const rest = body.slice(i).trim();
+  if (rest.length > 0) {
+    throw new Error(`authorize annotation has unexpected content after the expression: ${rest}`);
+  }
+  if (expr.trim().length === 0) {
+    throw new Error("authorize annotation has an empty expression body");
+  }
+  return expr;
+}
+// src/service/source_extraction.ts
+import {
+  isSourceDef
+} from "@malloydata/malloy";
+// src/service/annotations.ts
+import { Annotations } from "@malloydata/malloy";
+function isReservedRoute(route) {
+  return route === "" || !/[\p{L}\p{N}]/u.test(route);
+}
+function modelAnnotations(modelDef) {
+  const registry = modelDef.modelAnnotations ?? {};
+  const visited = new Set;
+  const order = [];
+  const visit = (id) => {
+    if (visited.has(id))
+      return;
+    visited.add(id);
+    const entry = registry[id];
+    if (!entry)
+      return;
+    for (const dep of entry.inheritsFrom)
+      visit(dep);
+    order.push(id);
+  };
+  visit(modelDef.modelID);
+  let folded;
+  for (const id of order) {
+    const own = registry[id].ownNotes;
+    if (!own.notes?.length && !own.blockNotes?.length)
+      continue;
+    folded = {
+      notes: own.notes,
+      blockNotes: own.blockNotes,
+      inherits: folded
+    };
+  }
+  return folded ?? {};
+}
+function annotationTexts(annote) {
+  const texts = new Annotations(annote).texts();
+  return texts.length > 0 ? texts : undefined;
+}
 // src/service/filter.ts
 var VALID_FILTER_TYPES = new Set([
   "equal",
@@ -11605,7 +11896,8 @@ function injectFilterRefinement(query, filterClause) {
   if (!filterClause) {
     return query;
   }
-  return `${query.trimEnd()} + {where: ${filterClause}}`;
+  return `${query.trimEnd()}
++ {where: ${filterClause}}`;
 }
 class FilterValidationError extends Error {
@@ -11644,6 +11936,81 @@ function tokenize(input) {
   return tokens;
 }
+// src/service/source_extraction.ts
+function extractSourcesFromModelDef(modelDef, givens, onParseError) {
+  const filterMap = new Map;
+  const authorizeMap = new Map;
+  const fileLevelAuthorize = collectAuthorizeExprs((modelAnnotations(modelDef).notes ?? []).map((note) => note.text));
+  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef(obj)).map((sourceObj) => {
+    const struct = sourceObj;
+    const sourceName = struct.as || struct.name;
+    const annotations = annotationTexts(struct.annotations);
+    const collected = [];
+    let cur = struct.annotations;
+    while (cur) {
+      if (cur.blockNotes) {
+        collected.push(cur.blockNotes.map((note) => note.text));
+      }
+      cur = cur.inherits;
+    }
+    const allAnnotations = collected.reverse().flat();
+    let filters;
+    if (allAnnotations.length > 0) {
+      try {
+        const parsed = parseFilters(allAnnotations);
+        if (parsed.length > 0) {
+          filterMap.set(sourceName, parsed);
+          const fields = struct.fields;
+          filters = parsed.map((f) => {
+            const field = fields.find((fd) => (fd.as || fd.name) === f.dimension);
+            return {
+              name: f.name,
+              dimension: f.dimension,
+              type: f.type,
+              implicit: f.implicit,
+              required: f.required,
+              dimensionType: field?.type
+            };
+          });
+        }
+      } catch (err) {
+        onParseError?.(sourceName, err);
+      }
+    }
+    const ownNotes = (struct.annotations?.blockNotes ?? []).map((note) => note.text);
+    const effective = [
+      ...fileLevelAuthorize,
+      ...collectAuthorizeExprs(ownNotes)
+    ];
+    let authorize;
+    if (effective.length > 0) {
+      authorizeMap.set(sourceName, effective);
+      authorize = effective;
+    }
+    const views = struct.fields.filter((field) => field.type === "turtle").filter((turtle) => turtle.pipeline.map((stage) => stage.type).every((type) => type === "reduce")).map((turtle) => ({
+      name: turtle.as || turtle.name,
+      annotations: annotationTexts(turtle.annotations)
+    }));
+    return {
+      name: sourceName,
+      annotations,
+      views,
+      filters,
+      givens,
+      authorize
+    };
+  });
+  return { sources, filterMap, authorizeMap };
+}
+function extractQueriesFromModelDef(modelDef) {
+  const isNamedQuery = (obj) => obj.type === "query";
+  return Object.values(modelDef.contents).filter(isNamedQuery).map((queryObj) => ({
+    name: queryObj.as || queryObj.name,
+    sourceName: typeof queryObj.structRef === "string" ? queryObj.structRef : undefined,
+    annotations: annotationTexts(queryObj.annotations)
+  }));
+}
 // src/service/given.ts
 function malloyGivenToApi(given) {
   const type = given.type;
@@ -11651,7 +12018,8 @@ function malloyGivenToApi(given) {
   return {
     name: given.name,
     type: renderedType,
-    annotations: given.getTaglines(/^#\(/)
+    annotations: given.annotations.forRoute(undefined).filter((note) => !isReservedRoute(note.route)).map((note) => note.text),
+    default: given._internal?.defaultText
   };
 }
@@ -11788,9 +12156,6 @@ function serializeFetchOptions(options) {
   if (options.refreshTimestamp !== undefined) {
     out.refreshTimestamp = options.refreshTimestamp;
   }
-  if (options.modelAnnotation !== undefined) {
-    out.modelAnnotation = options.modelAnnotation;
-  }
   return out;
 }
 function makeWorkerUrlReader(jobId) {
@@ -11888,62 +12253,12 @@ function appendLocalSourceInfos(modelDef, target, importedNames) {
       target.push(source);
   }
 }
-function extractSources(modelPath, modelDef, givens) {
-  const filterMap = new Map;
-  const sources = Object.values(modelDef.contents).filter((obj) => isSourceDef(obj)).map((sourceObj) => {
-    const sourceName = sourceObj.as || sourceObj.name;
-    const annotations = sourceObj.annotation?.blockNotes?.filter((note) => note.at.url.includes(modelPath)).map((note) => note.text);
-    const collected = [];
-    let cur = sourceObj.annotation;
-    while (cur) {
-      if (cur.blockNotes) {
-        collected.push(cur.blockNotes.map((note) => note.text));
-      }
-      cur = cur.inherits;
-    }
-    const allAnnotations = collected.reverse().flat();
-    let filters;
-    if (allAnnotations.length > 0) {
-      try {
-        const parsed = parseFilters(allAnnotations);
-        if (parsed.length > 0) {
-          filterMap.set(sourceName, parsed);
-          const fields = sourceObj.fields;
-          filters = parsed.map((f) => {
-            const field = fields.find((fd) => (fd.as || fd.name) === f.dimension);
-            return {
-              name: f.name,
-              dimension: f.dimension,
-              type: f.type,
-              implicit: f.implicit,
-              required: f.required,
-              dimensionType: field?.type
-            };
-          });
-        }
-      } catch {}
-    }
-    const views = sourceObj.fields.filter((f) => f.type === "turtle").filter((turtle) => turtle.pipeline.map((stage) => stage.type).every((type) => type === "reduce")).map((turtle) => ({
-      name: turtle.as || turtle.name,
-      annotations: turtle?.annotation?.blockNotes?.filter((note) => note.at.url.includes(modelPath)).map((note) => note.text)
-    }));
-    return {
-      name: sourceName,
-      annotations,
-      views,
-      filters,
-      givens
-    };
-  });
+function extractSources(modelDef, givens) {
+  const { sources, filterMap } = extractSourcesFromModelDef(modelDef, givens);
   return { sources, filterMap };
 }
-function extractQueries(modelPath, modelDef) {
-  const isNamedQuery = (obj) => obj.type === "query";
-  return Object.values(modelDef.contents).filter(isNamedQuery).map((q) => ({
-    name: q.as || q.name,
-    sourceName: typeof q.structRef === "string" ? q.structRef : undefined,
-    annotations: q?.annotation?.blockNotes?.filter((note) => note.at.url.includes(modelPath)).map((note) => note.text)
-  }));
+function extractQueries(modelDef) {
+  return extractQueriesFromModelDef(modelDef);
 }
 function buildRuntimeForModel(job, malloyConfig, jobId) {
   const urlReader = new HackyDataStylesAccumulator(makeWorkerUrlReader(jobId));
@@ -11970,8 +12285,9 @@ async function compileMalloyModel(job, malloyConfig, modelPath) {
   const givens = malloyGivens.length > 0 ? malloyGivens.map((g) => malloyGivenToApi(g)) : undefined;
   const { sourceInfos, importedNames } = await collectImportedSourceInfos(modelDef, runtime, importBaseURL);
   appendLocalSourceInfos(modelDef, sourceInfos, importedNames);
-  const { sources, filterMap } = extractSources(modelPath, modelDef, givens);
-  const queries = extractQueries(modelPath, modelDef);
+  const { sources, filterMap } = extractSources(modelDef, givens);
+  const queries = extractQueries(modelDef);
+  await validateAuthorizeProbes(mm, sources);
   return {
     modelPath,
     modelType: "model",
@@ -12076,10 +12392,11 @@ async function compileNotebookModel(job, malloyConfig, modelPath) {
     const collected = await collectImportedSourceInfos(finalModelDef, runtime, importBaseURL);
     appendLocalSourceInfos(finalModelDef, collected.sourceInfos, collected.importedNames);
     finalSourceInfos = collected.sourceInfos;
-    const extracted = extractSources(modelPath, finalModelDef, finalGivens);
+    const extracted = extractSources(finalModelDef, finalGivens);
     finalSources = extracted.sources;
     finalFilterMap = extracted.filterMap;
-    finalQueries = extractQueries(modelPath, finalModelDef);
+    finalQueries = extractQueries(finalModelDef);
+    await validateAuthorizeProbes(mm, finalSources);
   }
   return {
     modelPath,
@@ -12137,7 +12454,7 @@ async function loadPackage(job) {
   };
 }
 function serializeError(error) {
-  if (error instanceof MalloyError) {
+  if (error instanceof MalloyError2) {
     return {
       name: error.name,
       message: error.message,
@@ -12146,6 +12463,14 @@ function serializeError(error) {
       isCompilationError: true
     };
   }
+  if (error instanceof ModelCompilationError) {
+    return {
+      name: error.name,
+      message: error.message,
+      stack: error.stack,
+      isCompilationError: true
+    };
+  }
   if (error instanceof Error) {
     return {
       name: error.name,