@malloy-publisher/server 0.0.229 → 0.0.230

package/src/server.ts

@@ -35,6 +35,7 @@ import {
 import { logger, loggerMiddleware } from "./logger";
 
 import {
+   getExtensionFetchPolicy,
    getMaterializationSchedulerConfig,
    getMemoryGovernorConfig,
 } from "./config";
@@ -199,6 +200,12 @@ const modelController = new ModelController(environmentStore);
 // that Environment.getPackage / addPackage consult before allocating
 // any new package — the server responds with HTTP 503 instead of
 // OOM-killing the pod.
+// Validate the DuckDB extension-fetch policy at boot so an unrecognised value
+// (e.g. a k8s-manifest typo) fails the boot loudly here, rather than surfacing
+// on the first query that resolves a DuckDB connection — which matters most for
+// an operator relying on `local-only` for a no-network guarantee. Logging the
+// resolved policy also records the posture the server booted with.
+logger.info(`DuckDB extension-fetch policy: ${getExtensionFetchPolicy()}`);
 const memoryGovernorConfig = getMemoryGovernorConfig();
 const memoryGovernor = memoryGovernorConfig
    ? new PackageMemoryGovernor(memoryGovernorConfig)

package/src/service/authorize.spec.ts

@@ -3,8 +3,30 @@ import {
    collectAuthorizeExprs,
    isProbeTrue,
    parseAuthorizeAnnotation,
+   referencedGivenNames,
 } from "./authorize";
 
+describe("referencedGivenNames", () => {
+   it("returns the $NAME tokens deduped in first-seen order", () => {
+      expect(
+         referencedGivenNames("$ROLE = 'admin' and $ROLE != $PRIOR"),
+      ).toEqual(["ROLE", "PRIOR"]);
+   });
+
+   it("ignores a $NAME inside a string literal (not a real reference)", () => {
+      // Otherwise a joined gate's referenced-given count is inflated and the
+      // full-coverage check wrongly denies a correctly-authorized request.
+      expect(referencedGivenNames("$ROLE = 'the $BOSS role'")).toEqual([
+         "ROLE",
+      ]);
+      expect(referencedGivenNames("'$A $B $C'")).toEqual([]);
+      expect(referencedGivenNames("$X = 'it\\'s $Y' or $Z = 1")).toEqual([
+         "X",
+         "Z",
+      ]);
+   });
+});
+
 describe("isProbeTrue", () => {
    it("grants only on a genuine true / 1 / 'true'", () => {
       expect(isProbeTrue(true)).toBe(true);

package/src/service/authorize.ts

@@ -27,6 +27,12 @@ const FILE_PREFIX = "##(authorize)";
 /** source name → effective authorize expressions (file-level then source-level). */
 export type AuthorizeMap = Map<string, string[]>;
 
+/** A `given:` declaration to prepend to a probe so it compiles standalone. */
+export interface ProbeGivenDecl {
+   name: string;
+   type: string;
+}
+
 /**
  * Build the synthetic probe query that evaluates a source's authorize
  * expressions. Each expression becomes a boolean `select` column over a
@@ -37,18 +43,119 @@ export type AuthorizeMap = Map<string, string[]>;
  * compile errors); running it evaluates the gate. The reserved dummy column
  * name is deliberately obscure so a real authorize expression is unlikely to
  * collide with it — a bare field reference in an expression is meant to fail.
+ *
+ * `givenDecls`, when supplied, are prepended as the probe's OWN `given:`
+ * block, making the probe self-contained: it compiles against whatever
+ * givens it declares itself rather than depending on the ambient model's
+ * given namespace. This is what lets {@link evaluateAuthorize} gate a joined
+ * source whose givens live in a model that isn't the one the probe is
+ * compiled against (see the two-hop transitive-import case in
+ * `docs/authorize.md`). Compile-time validation (`validateAuthorizeProbes`)
+ * calls this with no decls, so it still validates against the ambient
+ * namespace of the model it's compiling in.
  */
-export function buildAuthorizeProbe(exprs: string[]): string {
+export function buildAuthorizeProbe(
+   exprs: string[],
+   givenDecls: ProbeGivenDecl[] = [],
+): string {
    const selects = exprs
       .map((expr, i) => `__auth_${i} is (${expr})`)
       .join("\n      ");
-   return `run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
+   const givenBlock =
+      givenDecls.length > 0
+         ? `given:\n${givenDecls.map((g) => `  ${g.name} :: ${g.type}`).join("\n")}\n\n`
+         : "";
+   return `${givenBlock}run: duckdb.sql("SELECT 1 AS __authorize_probe_row") -> {
     select:
       ${selects}
     limit: 1
   }`;
 }
 
+const GIVEN_REF_PATTERN = /\$([A-Za-z_][A-Za-z0-9_]*)/g;
+// Malloy string literals are single-quoted; a `$NAME` inside one is literal
+// text, not a given reference. Strip literals (honoring `\'` escapes) before
+// scanning, so e.g. `$ROLE = 'the $BOSS role'` references only ROLE — otherwise
+// a joined gate's referenced-count is inflated and the full-coverage check
+// wrongly denies a correctly-authorized request.
+const STRING_LITERAL_PATTERN = /'(?:\\.|[^'\\])*'/g;
+
+/**
+ * Given names an authorize expression references (`$NAME` tokens), deduped,
+ * in first-seen order. Used to figure out which givens a self-contained
+ * probe needs to declare for a given expression.
+ */
+export function referencedGivenNames(expr: string): string[] {
+   const scanned = expr.replace(STRING_LITERAL_PATTERN, "''");
+   const names: string[] = [];
+   const seen = new Set<string>();
+   for (const match of scanned.matchAll(GIVEN_REF_PATTERN)) {
+      const name = match[1];
+      if (!seen.has(name)) {
+         seen.add(name);
+         names.push(name);
+      }
+   }
+   return names;
+}
+
+/**
+ * Infer a Malloy given type from a caller-supplied JS value, so a
+ * self-contained probe can declare exactly the givens an expression
+ * references without depending on the ambient model's own given namespace —
+ * which a joined source pulled in from a different (possibly multi-hop
+ * transitively imported) file may not share. Returns `null` for a value with
+ * no sensible Malloy type (null, a plain object, an empty untyped array);
+ * callers skip declaring that given, which fails the probe closed —
+ * consistent with the existing "referenced given has no value" behavior.
+ */
+function inferGivenType(value: GivenValue): string | null {
+   if (typeof value === "string") return "string";
+   if (typeof value === "number" || typeof value === "bigint") return "number";
+   if (typeof value === "boolean") return "boolean";
+   if (value instanceof Date) return "timestamp";
+   if (Array.isArray(value)) {
+      if (value.length === 0) return null;
+      const elementType = inferGivenType(value[0]);
+      return elementType ? `${elementType}[]` : null;
+   }
+   return null;
+}
+
+/**
+ * Build the self-contained `given:` declarations + bound values a probe
+ * needs for one expression, from whatever the caller supplied. A referenced
+ * name that's absent from `givens` (or whose value has no inferrable type) is
+ * simply left undeclared — the probe then fails to compile for that
+ * expression (an undeclared `$NAME`), which {@link evaluateAuthorize} already
+ * treats as "this disjunct can't be evaluated" and denies that branch.
+ *
+ * `declaredTypes`, when supplied, is preferred over inferring the type from
+ * the caller's JS value — the gate author's own `given:` declaration is the
+ * source of truth (e.g. `$LEVEL > 3` should compare numerically even if the
+ * caller sends `"5"` as a string). Only covers a name declared within one
+ * import hop of the entry model (the same reach as `this.givens` — see
+ * `docs/authorize.md`); a gate on a source reached through a deeper
+ * transitive import falls back to inferring from the value, same as before.
+ */
+function bindProbeGivens(
+   expr: string,
+   givens: Record<string, GivenValue>,
+   declaredTypes?: Map<string, string>,
+): { decls: ProbeGivenDecl[]; bound: Record<string, GivenValue> } {
+   const decls: ProbeGivenDecl[] = [];
+   const bound: Record<string, GivenValue> = {};
+   for (const name of referencedGivenNames(expr)) {
+      if (!(name in givens)) continue;
+      const value = givens[name];
+      const type = declaredTypes?.get(name) ?? inferGivenType(value);
+      if (!type) continue;
+      decls.push({ name, type });
+      bound[name] = value;
+   }
+   return { decls, bound };
+}
+
 /**
  * Strict, fail-closed truthiness for a probe result cell. DuckDB (the probe's
  * connection) returns a native boolean, but normalize defensively: only a real
@@ -74,6 +181,25 @@ interface AuthorizeProbeExecutor {
    };
 }
 
+/**
+ * Run one probe (already-built query text) and report whether it evaluated
+ * true. Any throw (compile error, runtime "no value" for a referenced given,
+ * a missing/malformed result) propagates to the caller, which decides how to
+ * react — {@link evaluateAuthorize} treats it as "can't evaluate this way,
+ * try something else" rather than granting.
+ */
+async function runProbe(
+   executor: AuthorizeProbeExecutor,
+   probeText: string,
+   givens: Record<string, GivenValue>,
+): Promise<boolean> {
+   const result = await executor
+      .loadQuery(probeText)
+      .run({ rowLimit: 1, givens });
+   const row = result?.data?.value?.[0];
+   return !!(row && isProbeTrue(row.__auth_0));
+}
+
 /**
  * Evaluate a source's authorize disjunction against the supplied givens.
  * Returns true if ANY expression evaluates true (OR semantics).
@@ -88,31 +214,162 @@ interface AuthorizeProbeExecutor {
  * Per-branch failures are swallowed to false (fail closed at the branch level);
  * access is granted only if some branch genuinely returns true. Short-circuits
  * on the first true. Returns false (→ caller denies) if none grant.
+ *
+ * Each expression is tried TWICE if needed, in one of two orders depending on
+ * `selfContainedFirst`:
+ *
+ *  - AMBIENT FIRST (`selfContainedFirst` false — the default, used only for
+ *    the run target's OWN source gate): compile against `executor`'s own
+ *    given namespace, passing the full supplied `givens` — the original
+ *    approach, unchanged for the common case where `executor` (always the
+ *    ENTRY model's materializer) already has the referenced givens in scope
+ *    (same file, or a directly imported one — Malloy merges one level of
+ *    import into a model's given namespace). Falls back to the
+ *    self-contained probe below only if the ambient probe THROWS.
+ *
+ *  - SELF-CONTAINED FIRST (`selfContainedFirst` true — used for every gate
+ *    reached via a join/derivation/composite-member walk): declare just the
+ *    givens this expression references ({@link bindProbeGivens}), preferring
+ *    `declaredTypes` (the gate author's own declaration) over inferring from
+ *    the caller-supplied value, so the probe compiles independently of
+ *    `executor`'s namespace. This is what isolates a JOINED source's gate
+ *    from the entry model's own ambient given namespace: if the entry model
+ *    happens to declare its OWN given of the SAME NAME the joined gate
+ *    references, an ambient-first probe would compile successfully against
+ *    the ENTRY model's default/value instead of failing closed — silently
+ *    granting access based on an unrelated given. An expression referencing
+ *    NO givens at all (a constant/public gate, e.g. `#(authorize) "true"`)
+ *    has nothing ambient to isolate from, so it's evaluated with a no-decls
+ *    self-contained probe and returned directly — no fallback needed.
+ *    Otherwise, the probe is attempted ONLY when EVERY referenced given got
+ *    a decl — a probe that declares just SOME of them is not actually
+ *    isolated: `executor.loadQuery` still compiles it against the ENTRY
+ *    model's own materializer, so an undeclared referenced name resolves via
+ *    the entry model's own ambient value/default for that name INSTEAD OF
+ *    THROWING — reopening the collision hole for a partially supplied
+ *    multi-given gate without ever reaching a catch block. So "not every
+ *    referenced name could be bound" denies immediately, with NO probe
+ *    attempted and NO ambient fallback. Once every referenced name IS
+ *    declared, ambient is tried as a last resort only if that fully-declared
+ *    probe itself throws for some OTHER reason — safe at that point since no
+ *    referenced name is left for an entry default to decide.
+ *
+ * Either order still lets a gate on a source reached through a multi-hop
+ * transitive import evaluate correctly — Malloy does not flatten a `given:`
+ * declaration through more than one level of import, so the entry model's own
+ * namespace can be missing a given that's declared two-or-more imports away
+ * from a JOINED source's home file (see `docs/authorize.md`).
  */
 export async function evaluateAuthorize(
    executor: AuthorizeProbeExecutor,
    exprs: string[],
    givens: Record<string, GivenValue>,
+   declaredTypes?: Map<string, string>,
+   options?: { selfContainedFirst?: boolean },
 ): Promise<boolean> {
+   const selfContainedFirst = options?.selfContainedFirst ?? false;
    for (const expr of exprs) {
+      if (selfContainedFirst) {
+         if (
+            await evaluateSelfContainedFirst(
+               executor,
+               expr,
+               givens,
+               declaredTypes,
+            )
+         ) {
+            return true;
+         }
+         continue;
+      }
       try {
-         const result = await executor
-            .loadQuery(buildAuthorizeProbe([expr]))
-            .run({ rowLimit: 1, givens });
-         const row = result?.data?.value?.[0];
-         if (row && isProbeTrue(row.__auth_0)) {
+         if (await runProbe(executor, buildAuthorizeProbe([expr]), givens)) {
             return true;
          }
+         continue;
       } catch {
-         // This disjunct can't be evaluated (e.g. a referenced given has no
-         // value) — treat as not-granting and try the next. It does not fail
-         // the whole request, which is what keeps OR semantics intact.
+         // Ambient compile/eval failed — fall through to the self-contained
+         // retry below rather than immediately treating this disjunct as
+         // not-granting.
+      }
+      try {
+         const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
+         if (decls.length === 0) continue; // nothing left to try — deny
+         if (
+            await runProbe(executor, buildAuthorizeProbe([expr], decls), bound)
+         ) {
+            return true;
+         }
+      } catch {
+         // Still can't be evaluated — deny this branch and try the next.
+         // Does not fail the whole request, which is what keeps OR
+         // semantics intact.
          continue;
       }
    }
    return false;
 }
 
+/**
+ * One expression's self-contained-first evaluation (see
+ * {@link evaluateAuthorize}'s `selfContainedFirst` mode). A probe is only
+ * ever attempted once every given the expression references has been
+ * declared — a partially-declared probe still compiles against the ENTRY
+ * model's own materializer, so an undeclared name silently resolves via the
+ * entry's own ambient value/default instead of throwing, which is not
+ * isolation at all. Ambient is tried as a last resort only when the
+ * fully-declared self-contained probe itself throws for some other reason.
+ */
+async function evaluateSelfContainedFirst(
+   executor: AuthorizeProbeExecutor,
+   expr: string,
+   givens: Record<string, GivenValue>,
+   declaredTypes?: Map<string, string>,
+): Promise<boolean> {
+   const referenced = referencedGivenNames(expr);
+   if (referenced.length === 0) {
+      // The expression references NO givens at all — a constant/public gate
+      // (e.g. `#(authorize) "true"`). There's nothing ambient to isolate
+      // from, so run the no-decls probe (still fully self-contained: it
+      // declares no givens and is handed none) and use its result directly.
+      // This is NOT the "unsatisfiable" case below — that's specifically
+      // about a referenced given the caller can't supply.
+      try {
+         return await runProbe(executor, buildAuthorizeProbe([expr]), {});
+      } catch {
+         return false;
+      }
+   }
+   const { decls, bound } = bindProbeGivens(expr, givens, declaredTypes);
+   if (decls.length !== referenced.length) {
+      // Not every referenced given could be bound — deny. A probe that
+      // declares only SOME of the referenced names is not actually isolated:
+      // `executor.loadQuery` compiles it against the ENTRY model's own
+      // materializer, so an undeclared referenced given resolves via the
+      // ENTRY model's own ambient value/default for that name instead of
+      // throwing — reopening the name-collision hole for a partially
+      // supplied multi-given gate. Only attempt a probe once every
+      // referenced name can be declared (and thus shadowed) ourselves.
+      return false;
+   }
+   try {
+      return await runProbe(
+         executor,
+         buildAuthorizeProbe([expr], decls),
+         bound,
+      );
+   } catch {
+      // Every referenced given was supplied and declared, so a throw here
+      // isn't the collision case — there's no unsupplied name left for an
+      // entry default to decide. Ambient is a safe last resort.
+      try {
+         return await runProbe(executor, buildAuthorizeProbe([expr]), givens);
+      } catch {
+         return false;
+      }
+   }
+}
+
 /** A source plus its effective authorize expressions. */
 interface SourceWithAuthorize {
    name?: string;