@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.3

package/dist/core/data-access/scoped-client.d.ts

@@ -0,0 +1,104 @@
+import { Prisma } from '@prisma/client/extension';
+import type { Scope, SystemActor } from '../principal/index';
+import type { UserOwnedModelLookup } from './types';
+/**
+ * The arguments a user-scoped client passes to Prisma for one call. Pure: it
+ * never mutates `args`, and it throws {@link ScopedAccessError} instead of
+ * returning when the call is outside the scope.
+ *
+ * Not exported from the package entry point; the package's unit tests import
+ * it from this file.
+ *
+ * @param call - `model` is `undefined` for raw SQL (`$queryRaw` and friends).
+ * @param scope - only `userId` is applied (see the file header).
+ * @param registry - the user-owned model registry; tests pass a fixture.
+ * @internal
+ */
+export declare function scopeQueryArgs(call: {
+    model?: string;
+    operation: string;
+    args: unknown;
+}, scope: Scope, registry?: UserOwnedModelLookup): unknown;
+/**
+ * The Prisma client extension {@link userScopeExtension} returns: a function
+ * of a client, as `Prisma.defineExtension` builds it, that adds no models,
+ * results or client methods (all four type arguments empty), so the extended
+ * client keeps the app's generated types.
+ *
+ * @stability experimental
+ */
+export type UserScopeExtension = ReturnType<typeof Prisma.defineExtension<{}, {}, {}, {}>>;
+/**
+ * The extension behind {@link forUser}: confines queries on registered owner
+ * models to `scope.userId` and refuses every other model and raw SQL. Pass it
+ * to the app's own client with `$extends` when the call site needs the app's
+ * generated types (the reference app's `PrismaService.forUser`).
+ *
+ * @param scope - only `userId` is applied; `orgId` and `groupIds` are accepted and ignored until #725 and #729.
+ * @param registry - defaults to {@link userOwnedModelRegistry}.
+ * @throws ScopedAccessError when `scope.userId` is empty.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * // apps/api/src/prisma/prisma.service.ts
+ * forUser(scope: Scope) {
+ *   return this.$extends(userScopeExtension(scope));
+ * }
+ * ```
+ */
+export declare function userScopeExtension(scope: Scope, registry?: UserOwnedModelLookup): UserScopeExtension;
+/**
+ * The structural shape {@link forUser} needs from a client: `$extends`. The
+ * app's generated `PrismaClient` and the `PLATFORM_PRISMA` host port's
+ * `PrismaClientLike` both satisfy it.
+ *
+ * @stability experimental
+ */
+export interface ExtendableClient {
+    /** Prisma's client-extension entry point. */
+    $extends(extension: never): unknown;
+}
+/**
+ * A client whose queries on registered owner models are confined to
+ * `scope.userId`, and which refuses every other model and raw SQL.
+ *
+ * Built per call; `$extends` shares the underlying connection pool, so this is
+ * cheap. Interactive transactions on the returned client stay scoped. The
+ * return type is whatever the client's `$extends` returns; an app that wants
+ * its generated model types back uses {@link userScopeExtension} on its own
+ * client instead.
+ *
+ * @param client - the app's Prisma client (or the `PLATFORM_PRISMA` port).
+ * @param scope - derived from the principal, never from request input.
+ * @param registry - defaults to {@link userOwnedModelRegistry}.
+ * @throws ScopedAccessError when `scope.userId` is empty.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const db = forUser(prisma, { userId: principal.userId });
+ * await db.userCredential.findMany(); // only that user's rows
+ * ```
+ */
+export declare function forUser<C extends ExtendableClient>(client: C, scope: Scope, registry?: UserOwnedModelLookup): ReturnType<C['$extends']>;
+/**
+ * The explicit, greppable marker for deliberately unscoped work (backups,
+ * purges, the Doctor, cross-user admin reads, actor-only tables). Returns
+ * `client` unchanged after checking the actor, and sets
+ * `db.access.scope = 'system'` and `db.access.reason` on the active span. The
+ * reason is never a metric label (cardinality).
+ *
+ * @param client - the unscoped client to hand back.
+ * @param actor - `{ kind: 'system', reason }` with a short, non-empty reason.
+ * @throws ScopedAccessError when the actor is not a system actor with a reason.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const db = asSystem(prisma, { kind: 'system', reason: 'retention.purge' });
+ * await db.notification.deleteMany({ where: { createdAt: { lt: cutoff } } });
+ * ```
+ */
+export declare function asSystem<C>(client: C, actor: SystemActor): C;
+//# sourceMappingURL=scoped-client.d.ts.map

package/dist/core/data-access/scoped-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-client.d.ts","sourceRoot":"","sources":["../../../src/core/data-access/scoped-client.ts"],"names":[],"mappings":"AA+CA,OAAO,EAAE,MAAM,EAAE,MAAM,0BAA0B,CAAC;AAElD,OAAO,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAE7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AAyGpD;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAC5B,IAAI,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,EAC1D,KAAK,EAAE,KAAK,EACZ,QAAQ,GAAE,oBAA6C,GACtD,OAAO,CAsCT;AAQD;;;;;;;GAOG;AACH,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;AAE3F;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,GAAE,oBAA6C,GAAG,kBAAkB,CAW5H;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6CAA6C;IAC7C,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,OAAO,CAAC;CACrC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,gBAAgB,EAChD,MAAM,EAAE,CAAC,EACT,KAAK,EAAE,KAAK,EACZ,QAAQ,GAAE,oBAA6C,GACtD,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAG3B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,GAAG,CAAC,CAS5D"}

package/dist/core/data-access/scoped-client.js

@@ -0,0 +1,270 @@
+"use strict";
+// =============================================================================
+// Scoped data access: forUser() and asSystem() (issue #688 PP-1.9, moved to
+// core by #699)
+// =============================================================================
+//
+// `forUser(client, scope)` returns a Prisma client extension whose queries on
+// REGISTERED OWNER MODELS (./user-owned-data.registry.ts) are confined to the
+// scope's user. Everything else through that client throws `ScopedAccessError`:
+// actor-only models, unregistered models and raw SQL. A path that needs a
+// system table says so with `asSystem(client, { kind: 'system', reason })`,
+// which returns the client unchanged and records the reason on the active span.
+//
+// SCHEMA-INDEPENDENT: the extension is built with `Prisma.defineExtension` from
+// `@prisma/client/extension`, which does not depend on any generated client.
+// Model names are strings looked up in the registry the app fills; nothing
+// here imports a generated model type. The app's client is passed in at call
+// time (in a packaged slice: the `PLATFORM_PRISMA` host port).
+//
+// Defence in depth, never a replacement for authorization: every route still
+// declares its access, and a service still decides WHICH user it acts for.
+// What this adds is that, once it has decided, a forgotten `where: { userId }`
+// cannot read or change another user's rows.
+//
+// What the extension does per operation, for owner field O and user U:
+//
+//   findFirst(OrThrow), findMany, count, aggregate, groupBy,
+//   updateMany(AndReturn), deleteMany
+//       where := { AND: [where ?? {}, { O: U }] }
+//   findUnique(OrThrow), update, delete, upsert
+//       where := { ...where, AND: [...where.AND, { O: U }] }   (a unique where
+//       accepts extra filters; another user's row is "not found", never 403)
+//   create, createMany(AndReturn), upsert.create
+//       O absent: set to U. O present and different: throw. The owner given
+//       as the relation instead (`user: { connect: { id } }`) is accepted only
+//       when the id is U.
+//   update, updateMany(AndReturn), upsert.update
+//       data may not move the row to another owner (throw).
+//
+// NOT REWRITTEN: nested writes and `include`/`select` of relations. A nested
+// write into another user-owned model must go through that model's own
+// scoped call. See README.md next to this folder.
+//
+// `Scope.orgId` and `Scope.groupIds` are accepted and ignored: org scoping
+// arrives with row-level security (#725) and group grants with #729.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scopeQueryArgs = scopeQueryArgs;
+exports.userScopeExtension = userScopeExtension;
+exports.forUser = forUser;
+exports.asSystem = asSystem;
+const api_1 = require("@opentelemetry/api");
+const extension_1 = require("@prisma/client/extension");
+const scoped_access_error_1 = require("./scoped-access.error");
+const user_owned_data_registry_1 = require("./user-owned-data.registry");
+/** Operations whose `where` is a filter: the owner condition is ANDed in. */
+const FILTER_OPERATIONS = new Set([
+    'findFirst',
+    'findFirstOrThrow',
+    'findMany',
+    'count',
+    'aggregate',
+    'groupBy',
+    'updateMany',
+    'updateManyAndReturn',
+    'deleteMany',
+]);
+/** Operations whose `where` is a unique where: the owner condition is added to it. */
+const UNIQUE_OPERATIONS = new Set(['findUnique', 'findUniqueOrThrow', 'update', 'delete', 'upsert']);
+/** Operations whose `data` creates rows. */
+const CREATE_OPERATIONS = new Set(['create', 'createMany', 'createManyAndReturn']);
+/** Operations whose `data` updates rows. */
+const UPDATE_OPERATIONS = new Set(['update', 'updateMany', 'updateManyAndReturn']);
+function isRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function refuse(pin, message) {
+    throw new scoped_access_error_1.ScopedAccessError(message, { model: pin.model, operation: pin.operation });
+}
+function ownerCondition(pin) {
+    return { [pin.field]: pin.userId };
+}
+function scopeFilterWhere(where, pin) {
+    return { AND: [isRecord(where) ? where : {}, ownerCondition(pin)] };
+}
+function scopeUniqueWhere(where, pin) {
+    const base = isRecord(where) ? where : {};
+    const existing = base.AND === undefined ? [] : Array.isArray(base.AND) ? base.AND : [base.AND];
+    return { ...base, AND: [...existing, ownerCondition(pin)] };
+}
+/** The scalar value an update or create assigns, unwrapping `{ set: v }`. */
+function assignedValue(value) {
+    return isRecord(value) && 'set' in value ? value.set : value;
+}
+/** Whether a relation write points exactly at the scope's user: `{ connect: { id: U } }`. */
+function isConnectToScopeUser(value, pin) {
+    if (!isRecord(value))
+        return false;
+    const keys = Object.keys(value);
+    if (keys.length !== 1 || keys[0] !== 'connect' || !isRecord(value.connect))
+        return false;
+    const connect = value.connect;
+    return Object.keys(connect).length === 1 && connect.id === pin.userId;
+}
+function scopeCreateData(data, pin) {
+    if (!isRecord(data))
+        refuse(pin, `${pin.model}.${pin.operation}: create data must be an object.`);
+    if (pin.field in data) {
+        if (assignedValue(data[pin.field]) !== pin.userId) {
+            refuse(pin, `${pin.model}.${pin.operation}: ${pin.field} names another user; a scoped client only writes its own user's rows.`);
+        }
+        return data;
+    }
+    if (pin.relation !== undefined && pin.relation in data) {
+        if (!isConnectToScopeUser(data[pin.relation], pin)) {
+            refuse(pin, `${pin.model}.${pin.operation}: ${pin.relation} must be { connect: { id: <scope user> } }; a scoped client only writes its own user's rows.`);
+        }
+        return data;
+    }
+    return { ...data, [pin.field]: pin.userId };
+}
+function assertUpdateKeepsOwner(data, pin) {
+    if (!isRecord(data))
+        return;
+    if (pin.field in data && assignedValue(data[pin.field]) !== pin.userId) {
+        refuse(pin, `${pin.model}.${pin.operation}: a scoped client cannot move a row to another owner (${pin.field}).`);
+    }
+    if (pin.relation !== undefined && pin.relation in data && !isConnectToScopeUser(data[pin.relation], pin)) {
+        refuse(pin, `${pin.model}.${pin.operation}: a scoped client cannot change a row's owner (${pin.relation}).`);
+    }
+}
+/**
+ * The arguments a user-scoped client passes to Prisma for one call. Pure: it
+ * never mutates `args`, and it throws {@link ScopedAccessError} instead of
+ * returning when the call is outside the scope.
+ *
+ * Not exported from the package entry point; the package's unit tests import
+ * it from this file.
+ *
+ * @param call - `model` is `undefined` for raw SQL (`$queryRaw` and friends).
+ * @param scope - only `userId` is applied (see the file header).
+ * @param registry - the user-owned model registry; tests pass a fixture.
+ * @internal
+ */
+function scopeQueryArgs(call, scope, registry = user_owned_data_registry_1.userOwnedModelRegistry) {
+    const { model, operation } = call;
+    if (model === undefined) {
+        refuse({ model: '(raw)', operation }, `${operation} is not allowed on a user-scoped client: raw SQL is system-only; use asSystem() with a reason.`);
+    }
+    const def = registry.get(model);
+    const field = def?.ownerField;
+    if (def === undefined || field === undefined) {
+        refuse({ model, operation }, `${model} is not user-owned; use asSystem() with a reason.`);
+    }
+    const pin = { model, operation, field, relation: (0, user_owned_data_registry_1.ownerRelationOf)(def), userId: scope.userId };
+    const args = isRecord(call.args) ? { ...call.args } : {};
+    if (FILTER_OPERATIONS.has(operation)) {
+        args.where = scopeFilterWhere(args.where, pin);
+    }
+    else if (UNIQUE_OPERATIONS.has(operation)) {
+        args.where = scopeUniqueWhere(args.where, pin);
+    }
+    else if (!CREATE_OPERATIONS.has(operation)) {
+        refuse(pin, `${model}.${operation} is not supported on a user-scoped client; use asSystem() with a reason.`);
+    }
+    if (CREATE_OPERATIONS.has(operation)) {
+        args.data = Array.isArray(args.data)
+            ? args.data.map((row) => scopeCreateData(row, pin))
+            : scopeCreateData(args.data, pin);
+    }
+    if (UPDATE_OPERATIONS.has(operation)) {
+        assertUpdateKeepsOwner(args.data, pin);
+    }
+    if (operation === 'upsert') {
+        args.create = scopeCreateData(args.create, pin);
+        assertUpdateKeepsOwner(args.update, pin);
+    }
+    return args;
+}
+function assertScope(scope) {
+    if (typeof scope?.userId !== 'string' || scope.userId.trim() === '') {
+        throw new scoped_access_error_1.ScopedAccessError('A scope must name a user: scope.userId is empty.');
+    }
+}
+/**
+ * The extension behind {@link forUser}: confines queries on registered owner
+ * models to `scope.userId` and refuses every other model and raw SQL. Pass it
+ * to the app's own client with `$extends` when the call site needs the app's
+ * generated types (the reference app's `PrismaService.forUser`).
+ *
+ * @param scope - only `userId` is applied; `orgId` and `groupIds` are accepted and ignored until #725 and #729.
+ * @param registry - defaults to {@link userOwnedModelRegistry}.
+ * @throws ScopedAccessError when `scope.userId` is empty.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * // apps/api/src/prisma/prisma.service.ts
+ * forUser(scope: Scope) {
+ *   return this.$extends(userScopeExtension(scope));
+ * }
+ * ```
+ */
+function userScopeExtension(scope, registry = user_owned_data_registry_1.userOwnedModelRegistry) {
+    assertScope(scope);
+    const pinned = { userId: scope.userId };
+    return extension_1.Prisma.defineExtension({
+        name: 'user-scope',
+        query: {
+            $allOperations({ model, operation, args, query }) {
+                return query(scopeQueryArgs({ model, operation, args }, pinned, registry));
+            },
+        },
+    });
+}
+/**
+ * A client whose queries on registered owner models are confined to
+ * `scope.userId`, and which refuses every other model and raw SQL.
+ *
+ * Built per call; `$extends` shares the underlying connection pool, so this is
+ * cheap. Interactive transactions on the returned client stay scoped. The
+ * return type is whatever the client's `$extends` returns; an app that wants
+ * its generated model types back uses {@link userScopeExtension} on its own
+ * client instead.
+ *
+ * @param client - the app's Prisma client (or the `PLATFORM_PRISMA` port).
+ * @param scope - derived from the principal, never from request input.
+ * @param registry - defaults to {@link userOwnedModelRegistry}.
+ * @throws ScopedAccessError when `scope.userId` is empty.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const db = forUser(prisma, { userId: principal.userId });
+ * await db.userCredential.findMany(); // only that user's rows
+ * ```
+ */
+function forUser(client, scope, registry = user_owned_data_registry_1.userOwnedModelRegistry) {
+    const extension = userScopeExtension(scope, registry);
+    return client.$extends(extension);
+}
+/**
+ * The explicit, greppable marker for deliberately unscoped work (backups,
+ * purges, the Doctor, cross-user admin reads, actor-only tables). Returns
+ * `client` unchanged after checking the actor, and sets
+ * `db.access.scope = 'system'` and `db.access.reason` on the active span. The
+ * reason is never a metric label (cardinality).
+ *
+ * @param client - the unscoped client to hand back.
+ * @param actor - `{ kind: 'system', reason }` with a short, non-empty reason.
+ * @throws ScopedAccessError when the actor is not a system actor with a reason.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const db = asSystem(prisma, { kind: 'system', reason: 'retention.purge' });
+ * await db.notification.deleteMany({ where: { createdAt: { lt: cutoff } } });
+ * ```
+ */
+function asSystem(client, actor) {
+    if (actor?.kind !== 'system' || typeof actor.reason !== 'string' || actor.reason.trim() === '') {
+        throw new scoped_access_error_1.ScopedAccessError('asSystem() needs { kind: "system", reason } with a non-empty reason.');
+    }
+    api_1.trace.getActiveSpan()?.setAttributes({
+        'db.access.scope': 'system',
+        'db.access.reason': actor.reason,
+    });
+    return client;
+}
+//# sourceMappingURL=scoped-client.js.map

package/dist/core/data-access/scoped-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scoped-client.js","sourceRoot":"","sources":["../../../src/core/data-access/scoped-client.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,4EAA4E;AAC5E,gBAAgB;AAChB,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,gFAAgF;AAChF,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,2EAA2E;AAC3E,6EAA6E;AAC7E,+DAA+D;AAC/D,EAAE;AACF,6EAA6E;AAC7E,2EAA2E;AAC3E,+EAA+E;AAC/E,6CAA6C;AAC7C,EAAE;AACF,uEAAuE;AACvE,EAAE;AACF,6DAA6D;AAC7D,sCAAsC;AACtC,kDAAkD;AAClD,gDAAgD;AAChD,+EAA+E;AAC/E,6EAA6E;AAC7E,iDAAiD;AACjD,4EAA4E;AAC5E,+EAA+E;AAC/E,0BAA0B;AAC1B,iDAAiD;AACjD,4DAA4D;AAC5D,EAAE;AACF,6EAA6E;AAC7E,uEAAuE;AACvE,kDAAkD;AAClD,EAAE;AACF,2EAA2E;AAC3E,qEAAqE;AACrE,gFAAgF;;AA6HhF,wCA0CC;AAqCD,gDAWC;AAoCD,0BAOC;AAoBD,4BASC;AA7RD,4CAA2C;AAC3C,wDAAkD;AAGlD,+DAA0D;AAE1D,yEAAqF;AAIrF,6EAA6E;AAC7E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,WAAW;IACX,kBAAkB;IAClB,UAAU;IACV,OAAO;IACP,WAAW;IACX,SAAS;IACT,YAAY;IACZ,qBAAqB;IACrB,YAAY;CACb,CAAC,CAAC;AAEH,sFAAsF;AACtF,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,mBAAmB,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAErG,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEnF,4CAA4C;AAC5C,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,qBAAqB,CAAC,CAAC,CAAC;AAEnF,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAWD,SAAS,MAAM,CAAC,GAAqC,EAAE,OAAe;IACpE,MAAM,IAAI,uCAAiB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,cAAc,CAAC,GAAQ;IAC9B,OAAO,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACrC,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,GAAQ;IAChD,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc,EAAE,GAAQ;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC/F,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,EAAE,CAAC,GAAG,QAAQ,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;AAC/D,CAAC;AAED,6FAA6F;AAC7F,SAAS,oBAAoB,CAAC,KAAc,EAAE,GAAQ;IACpD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACzF,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG,CAAC,MAAM,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,IAAa,EAAE,GAAQ;IAC9C,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,kCAAkC,CAAC,CAAC;IAElG,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,EAAE,CAAC;QACtB,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,KAAK,uEAAuE,CAAC,CAAC;QAClI,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;YACnD,MAAM,CACJ,GAAG,EACH,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,8FAA8F,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AAC9C,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAa,EAAE,GAAQ;IACrD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC5B,IAAI,GAAG,CAAC,KAAK,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC;QACvE,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,yDAAyD,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;IACnH,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;QACzG,MAAM,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,SAAS,kDAAkD,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,cAAc,CAC5B,IAA0D,EAC1D,KAAY,EACZ,WAAiC,iDAAsB;IAEvD,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC;IAElC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,gGAAgG,CAAC,CAAC;IACtJ,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,GAAG,GAAG,EAAE,UAAU,CAAC;IAC9B,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,KAAK,mDAAmD,CAAC,CAAC;IAC5F,CAAC;IAED,MAAM,GAAG,GAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAA,0CAAe,EAAC,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IACnG,MAAM,IAAI,GAAS,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACjD,CAAC;SAAM,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7C,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,SAAS,0EAA0E,CAAC,CAAC;IAC/G,CAAC;IAED,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACnD,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IACD,IAAI,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QACrC,sBAAsB,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChD,sBAAsB,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAY;IAC/B,IAAI,OAAO,KAAK,EAAE,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,uCAAiB,CAAC,kDAAkD,CAAC,CAAC;IAClF,CAAC;AACH,CAAC;AAYD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,kBAAkB,CAAC,KAAY,EAAE,WAAiC,iDAAsB;IACtG,WAAW,CAAC,KAAK,CAAC,CAAC;IACnB,MAAM,MAAM,GAAU,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;IAC/C,OAAO,kBAAM,CAAC,eAAe,CAAC;QAC5B,IAAI,EAAE,YAAY;QAClB,KAAK,EAAE;YACL,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE;gBAC9C,OAAO,KAAK,CAAC,cAAc,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAgB,CAAC,CAAC;YAC5F,CAAC;SACF;KACF,CAAC,CAAC;AACL,CAAC;AAcD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,OAAO,CACrB,MAAS,EACT,KAAY,EACZ,WAAiC,iDAAsB;IAEvD,MAAM,SAAS,GAAG,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAQ,MAAM,CAAC,QAAyE,CAAC,SAAS,CAAC,CAAC;AACtG,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAgB,QAAQ,CAAI,MAAS,EAAE,KAAkB;IACvD,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/F,MAAM,IAAI,uCAAiB,CAAC,sEAAsE,CAAC,CAAC;IACtG,CAAC;IACD,WAAK,CAAC,aAAa,EAAE,EAAE,aAAa,CAAC;QACnC,iBAAiB,EAAE,QAAQ;QAC3B,kBAAkB,EAAE,KAAK,CAAC,MAAM;KACjC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/core/data-access/types.d.ts

@@ -0,0 +1,85 @@
+/**
+ * What happens to a registered row when its user's data is purged.
+ *
+ * Each value names the database behaviour the relation's `onDelete` already
+ * implements; the `userOwnedData` conformance suite checks the two agree.
+ *
+ * - `'delete'`: the row is deleted with the user's data (`onDelete: Cascade`).
+ * - `'detach'`: the row survives and the user reference is nulled
+ *   (`onDelete: SetNull`).
+ * - `'retain'`: the row survives untouched and the user cannot be deleted
+ *   while it exists (`onDelete: Restrict` or `NoAction`). Only for actor
+ *   fields on rows another owner controls, and the rationale must say why.
+ *
+ * @stability experimental
+ */
+export type PurgePolicy = 'delete' | 'detach' | 'retain';
+/**
+ * Whether a user's data export includes the row.
+ *
+ * @stability experimental
+ */
+export type ExportPolicy = 'include' | 'exclude';
+/**
+ * One registered model: every model holding a foreign key to `User` has one,
+ * naming the role of each such key, a purge and an export policy.
+ *
+ * @typeParam TModel - the model-name type. Apps pass their generated
+ * `Prisma.ModelName` so a misspelt model fails to compile; the registry itself
+ * stores plain strings.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * const def: UserOwnedModelDef = {
+ *   model: 'UserCredential',
+ *   ownerField: 'userId',
+ *   purge: 'delete',
+ *   export: 'include',
+ *   exportOmit: ['secret'],
+ *   rationale: "A user's own encrypted key; the ciphertext never leaves the server.",
+ * };
+ * ```
+ */
+export interface UserOwnedModelDef<TModel extends string = string> {
+    /** The Prisma model name, PascalCase, e.g. `'UserCredential'`. */
+    readonly model: TModel;
+    /**
+     * The scalar foreign key naming the row's owner, e.g. `'userId'`. Absent for
+     * actor-only models. A model with an owner field is what a scoped client
+     * may read and write.
+     */
+    readonly ownerField?: string;
+    /**
+     * The relation field backing {@link UserOwnedModelDef.ownerField}, used when
+     * a create passes the owner as `{ connect: { id } }` instead of the scalar.
+     * Defaults to the owner field without its trailing `Id` (`userId` → `user`,
+     * `createdById` → `createdBy`); the conformance suite checks it against the
+     * schema.
+     */
+    readonly ownerRelation?: string;
+    /** Scalar foreign keys to `User` that record who acted, not who owns. */
+    readonly actorFields?: readonly string[];
+    /**
+     * Applies to the owner field, or to every actor field when there is no
+     * owner. See {@link PurgePolicy}.
+     */
+    readonly purge: PurgePolicy;
+    /** See {@link ExportPolicy}. */
+    readonly export: ExportPolicy;
+    /** Columns never exported even when `export` is `'include'` (secrets, hashes). */
+    readonly exportOmit?: readonly string[];
+    /** One or two sentences: why this role and these policies. Rendered in docs. */
+    readonly rationale: string;
+}
+/**
+ * The one capability a scoped client needs from a registry: look a model up.
+ * {@link userOwnedModelRegistry} satisfies it; tests pass a fixture.
+ *
+ * @stability experimental
+ */
+export interface UserOwnedModelLookup {
+    /** The registered definition of `model`, or `undefined`. */
+    get(model: string): UserOwnedModelDef | undefined;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/core/data-access/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/core/data-access/types.ts"],"names":[],"mappings":"AAUA;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEzD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,CAAC;AAEjD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,iBAAiB,CAAC,MAAM,SAAS,MAAM,GAAG,MAAM;IAC/D,kEAAkE;IAClE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;IAChC,yEAAyE;IACzE,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,gCAAgC;IAChC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,kFAAkF;IAClF,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAAC;CACnD"}

package/dist/core/data-access/types.js

@@ -0,0 +1,12 @@
+"use strict";
+// =============================================================================
+// User-owned data: policy types (issue #688 PP-1.9, moved to core by #699)
+// =============================================================================
+//
+// Schema-independent on purpose: a model is a string. An app narrows it to its
+// own generated `Prisma.ModelName` with the type parameter, so a typo in a
+// registration still fails its typecheck while the package never sees the
+// app's generated types.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=types.js.map

package/dist/core/data-access/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/core/data-access/types.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,2EAA2E;AAC3E,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,yBAAyB;AACzB,gFAAgF"}

package/dist/core/data-access/user-owned-data.registry.d.ts

@@ -0,0 +1,60 @@
+import type { UserOwnedModelDef } from './types';
+/**
+ * The static registry of models holding a foreign key to `User`, keyed by
+ * model name. One per process: the app fills it from a manifest imported
+ * before bootstrap, and `RegistryFreezeService` freezes it with every other
+ * `defineRegistry` registry.
+ *
+ * @stability experimental
+ * @extensionPoint registry
+ * @example
+ * ```ts
+ * // apps/api/src/prisma/ownership/user-owned-model.manifest.ts
+ * registerUserOwnedModels(PLATFORM_USER_OWNED_MODELS);
+ * registerUserOwnedModels(APP_USER_OWNED_MODELS);
+ *
+ * userOwnedModelRegistry.get('UserCredential')?.ownerField; // 'userId'
+ * ```
+ */
+export declare const userOwnedModelRegistry: import("../registry/registry").Registry<UserOwnedModelDef<string>>;
+/**
+ * Registers a batch of definitions in {@link userOwnedModelRegistry}, all or
+ * nothing.
+ *
+ * @param defs - the definitions; an app may type them with its own model names.
+ * @throws RegistryError `INVALID_ENTRY`, `DUPLICATE_ID` or `FROZEN`.
+ *
+ * @stability experimental
+ * @example
+ * ```ts
+ * registerUserOwnedModels([
+ *   { model: 'Workout', ownerField: 'userId', purge: 'delete', export: 'include', rationale: "The user's own log." },
+ * ]);
+ * ```
+ */
+export declare function registerUserOwnedModels<TModel extends string>(defs: readonly UserOwnedModelDef<TModel>[]): void;
+/**
+ * The owner field of a registered model, or `undefined` (actor-only or
+ * unregistered).
+ *
+ * @param model - the Prisma model name.
+ * @stability experimental
+ * @example
+ * ```ts
+ * ownerFieldOf('StorageObject'); // 'uploadedById'
+ * ```
+ */
+export declare function ownerFieldOf(model: string): string | undefined;
+/**
+ * The relation field backing a definition's owner field: `ownerRelation`
+ * when given, otherwise the owner field without its trailing `Id`.
+ *
+ * @param def - a registered (or candidate) definition.
+ * @stability experimental
+ * @example
+ * ```ts
+ * ownerRelationOf({ model: 'WorkerNode', ownerField: 'createdById', purge: 'delete', export: 'exclude', rationale: 'x' }); // 'createdBy'
+ * ```
+ */
+export declare function ownerRelationOf(def: UserOwnedModelDef): string | undefined;
+//# sourceMappingURL=user-owned-data.registry.d.ts.map

package/dist/core/data-access/user-owned-data.registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-owned-data.registry.d.ts","sourceRoot":"","sources":["../../../src/core/data-access/user-owned-data.registry.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAuCjD;;;;;;;;;;;;;;;;GAgBG;AACH,eAAO,MAAM,sBAAsB,oEAMjC,CAAC;AAEH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,MAAM,SAAS,MAAM,EAAE,IAAI,EAAE,SAAS,iBAAiB,CAAC,MAAM,CAAC,EAAE,GAAG,IAAI,CAE/G;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE9D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,iBAAiB,GAAG,MAAM,GAAG,SAAS,CAG1E"}