@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.5

package/dist/exports/sources/user-data.source.js

@@ -0,0 +1,93 @@
+"use strict";
+// =============================================================================
+// The `user-data` export source: "give me my data" (issue #744)
+// =============================================================================
+//
+// Driven by the user-owned data registry (#688/#699), which every model with a
+// foreign key to `User` must be in (the tripwire fails otherwise):
+//
+//   - `account`: the caller's own `User` row (redaction applies);
+//   - then one dataset per registered model with `export: 'include'`, in
+//     registry order, named after the model in snake_case: an OWNER model's
+//     rows where the owner field is the user, an ACTOR-ONLY model's rows where
+//     any actor field is (the audit events naming the user).
+//
+// Columns are the model's scalar fields minus the entry's `exportOmit` and
+// minus the default redaction rule (`datamodel.ts`). Credential models are
+// either `exclude` or list metadata only; the `exports.secret-egress`
+// conformance case proves no secret, hash or hint reaches a file.
+//
+// FILE BYTES ARE NOT INCLUDED: `storage_object` is a manifest (key, name,
+// size, MIME type, created). Read-only through the bypass client with an
+// explicit owner filter, because the user's rows sit in every organization
+// they belong to.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.USER_DATA_EXPORT_SOURCE = exports.USER_DATA_EXPORT_PERMISSION = exports.USER_DATA_EXPORT_SOURCE_ID = void 0;
+exports.userDataTables = userDataTables;
+const zod_1 = require("zod");
+const index_1 = require("../../core/index");
+const model_table_1 = require("./model-table");
+/**
+ * The source id. PERMANENT once jobs carry it.
+ *
+ * @stability experimental
+ */
+exports.USER_DATA_EXPORT_SOURCE_ID = 'user-data';
+/**
+ * The permission the `user-data` source requires: `user_settings:read`, which
+ * every role holds, so every signed-in user may export their own data.
+ *
+ * @stability experimental
+ */
+exports.USER_DATA_EXPORT_PERMISSION = 'user_settings:read';
+/** The datamodel's model of that name, or `undefined` (a fork removed it). */
+function modelOf(ctx, name) {
+    return ctx.datamodel.models.find((model) => model.name === name);
+}
+/**
+ * The datasets of one user's export, in order. Exposed for the conformance
+ * suite and for an app source that wraps it.
+ *
+ * @param ctx - the export context (`subjectId` is the user).
+ * @returns the datasets.
+ *
+ * @stability experimental
+ */
+async function* userDataTables(ctx) {
+    const user = modelOf(ctx, 'User');
+    if (user)
+        yield (0, model_table_1.modelTable)(ctx, { model: user, where: { id: ctx.subjectId }, dataset: 'account', title: 'Account' });
+    for (const def of index_1.userOwnedModelRegistry.list()) {
+        if (def.export !== 'include')
+            continue;
+        const model = modelOf(ctx, def.model);
+        if (!model)
+            continue;
+        const where = def.ownerField !== undefined
+            ? { [def.ownerField]: ctx.subjectId }
+            : { OR: (def.actorFields ?? []).map((field) => ({ [field]: ctx.subjectId })) };
+        yield (0, model_table_1.modelTable)(ctx, { model, where, omit: def.exportOmit ?? [] });
+    }
+}
+/**
+ * The platform's `user-data` source: the caller's own rows of every
+ * user-owned model the registry marks `export: 'include'`. No request
+ * options.
+ *
+ * @stability experimental
+ */
+exports.USER_DATA_EXPORT_SOURCE = {
+    id: exports.USER_DATA_EXPORT_SOURCE_ID,
+    scope: 'user',
+    label: 'Your data',
+    description: 'Everything this application stores about you: your account, settings, tokens (without their secrets), memberships, notifications, files list and activity.',
+    permission: exports.USER_DATA_EXPORT_PERMISSION,
+    requestSchema: zod_1.z.object({}).strict(),
+    // Computed, not listed: the writers that attach to `user-data` (json, csv and
+    // xlsx by default; an app's own with `attachTo`) are its formats.
+    formats: [],
+    columnTypes: model_table_1.MODEL_TABLE_COLUMN_TYPES,
+    collect: (ctx) => userDataTables(ctx),
+};
+//# sourceMappingURL=user-data.source.js.map

package/dist/exports/sources/user-data.source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-data.source.js","sourceRoot":"","sources":["../../../src/exports/sources/user-data.source.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,gEAAgE;AAChE,gFAAgF;AAChF,EAAE;AACF,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,4EAA4E;AAC5E,+EAA+E;AAC/E,6DAA6D;AAC7D,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,kEAAkE;AAClE,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,kBAAkB;AAClB,gFAAgF;;;AAsChF,wCAcC;AAlDD,6BAAwB;AAExB,4CAA0D;AAG1D,+CAAqE;AAErE;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,WAAW,CAAC;AAEtD;;;;;GAKG;AACU,QAAA,2BAA2B,GAAG,oBAAoB,CAAC;AAEhE,8EAA8E;AAC9E,SAAS,OAAO,CAAC,GAAkB,EAAE,IAAY;IAC/C,OAAO,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,SAAS,CAAC,CAAC,cAAc,CAAC,GAAkB;IACtD,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,IAAI;QAAE,MAAM,IAAA,wBAAU,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAErH,KAAK,MAAM,GAAG,IAAI,8BAAsB,CAAC,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;YAAE,SAAS;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GACT,GAAG,CAAC,UAAU,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE;YACrC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,EAAE,CAAC;QACnF,MAAM,IAAA,wBAAU,EAAC,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACU,QAAA,uBAAuB,GAAwC;IAC1E,EAAE,EAAE,kCAA0B;IAC9B,KAAK,EAAE,MAAM;IACb,KAAK,EAAE,WAAW;IAClB,WAAW,EAAE,4JAA4J;IACzK,UAAU,EAAE,mCAA2B;IACvC,aAAa,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAsC;IACxE,8EAA8E;IAC9E,kEAAkE;IAClE,OAAO,EAAE,EAAE;IACX,WAAW,EAAE,sCAAwB;IACrC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC;CACtC,CAAC"}

package/dist/exports/tasks/export-purge.task.d.ts

@@ -0,0 +1,17 @@
+import { JobsService, type JobsPrisma } from '../../jobs/index';
+/**
+ * The daily `@Cron` that enqueues `export.purge` (enqueue only).
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+export declare class ExportPurgeTask {
+    private readonly jobs;
+    private readonly prisma;
+    private readonly logger;
+    constructor(jobs: JobsService, prisma: JobsPrisma);
+    /** Enqueues today's purge, unless one is already pending. */
+    handleCron(): Promise<void>;
+}
+//# sourceMappingURL=export-purge.task.d.ts.map

package/dist/exports/tasks/export-purge.task.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-purge.task.d.ts","sourceRoot":"","sources":["../../../src/exports/tasks/export-purge.task.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,WAAW,EAA0B,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGxF;;;;;;GAMG;AACH,qBACa,eAAe;IAIxB,OAAO,CAAC,QAAQ,CAAC,IAAI;IACI,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJlD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoC;gBAGxC,IAAI,EAAE,WAAW,EACQ,MAAM,EAAE,UAAU;IAG9D,6DAA6D;IAEvD,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC;CASlC"}

package/dist/exports/tasks/export-purge.task.js

@@ -0,0 +1,69 @@
+"use strict";
+// =============================================================================
+// ExportPurgeTask: queues the daily expiry of export files (issue #744)
+// =============================================================================
+//
+// ⚠ THIS TASK DELETES NOTHING. A `@Cron` decides and enqueues, nothing more
+// (CLAUDE.md queue rule 1; `apps/api/test/conformance.spec.ts`).
+// The deleting is `export.purge`'s work, on a worker slot, retried by the
+// queue. 3am, EvoPath's schedule.
+// =============================================================================
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var ExportPurgeTask_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExportPurgeTask = void 0;
+const common_1 = require("@nestjs/common");
+const schedule_1 = require("@nestjs/schedule");
+const index_1 = require("../../core/index");
+const index_2 = require("../../jobs/index");
+const exports_constants_1 = require("../exports.constants");
+/**
+ * The daily `@Cron` that enqueues `export.purge` (enqueue only).
+ *
+ * @internal
+ *
+ * @stability experimental
+ */
+let ExportPurgeTask = ExportPurgeTask_1 = class ExportPurgeTask {
+    jobs;
+    prisma;
+    logger = new common_1.Logger(ExportPurgeTask_1.name);
+    constructor(jobs, prisma) {
+        this.jobs = jobs;
+        this.prisma = prisma;
+    }
+    /** Enqueues today's purge, unless one is already pending. */
+    async handleCron() {
+        await (0, index_2.enqueueHousekeepingJob)({
+            jobs: this.jobs,
+            prisma: this.prisma,
+            logger: this.logger,
+            type: exports_constants_1.EXPORT_PURGE_JOB_TYPE,
+            what: 'export expiry',
+        });
+    }
+};
+exports.ExportPurgeTask = ExportPurgeTask;
+__decorate([
+    (0, schedule_1.Cron)(schedule_1.CronExpression.EVERY_DAY_AT_3AM),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], ExportPurgeTask.prototype, "handleCron", null);
+exports.ExportPurgeTask = ExportPurgeTask = ExportPurgeTask_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(1, (0, common_1.Inject)(index_1.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [index_2.JobsService, Object])
+], ExportPurgeTask);
+//# sourceMappingURL=export-purge.task.js.map

package/dist/exports/tasks/export-purge.task.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"export-purge.task.js","sourceRoot":"","sources":["../../../src/exports/tasks/export-purge.task.ts"],"names":[],"mappings":";AAAA,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,iEAAiE;AACjE,0EAA0E;AAC1E,kCAAkC;AAClC,gFAAgF;;;;;;;;;;;;;;;;AAEhF,2CAA4D;AAC5D,+CAAwD;AAExD,4CAAmD;AACnD,4CAAwF;AACxF,4DAA6D;AAE7D;;;;;;GAMG;AAEI,IAAM,eAAe,uBAArB,MAAM,eAAe;IAIP;IACyB;IAJ3B,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAe,CAAC,IAAI,CAAC,CAAC;IAE3D,YACmB,IAAiB,EACQ,MAAkB;QAD3C,SAAI,GAAJ,IAAI,CAAa;QACQ,WAAM,GAAN,MAAM,CAAY;IAC3D,CAAC;IAEJ,6DAA6D;IAEvD,AAAN,KAAK,CAAC,UAAU;QACd,MAAM,IAAA,8BAAsB,EAAC;YAC3B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,yCAAqB;YAC3B,IAAI,EAAE,eAAe;SACtB,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnBY,0CAAe;AAUpB;IADL,IAAA,eAAI,EAAC,yBAAc,CAAC,gBAAgB,CAAC;;;;iDASrC;0BAlBU,eAAe;IAD3B,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;qCADD,mBAAW;GAJzB,eAAe,CAmB3B"}

package/dist/exports/testing/conformance.d.ts

@@ -0,0 +1,138 @@
+import type { ConformanceFinding, ConformanceSuite } from '../../testing/index';
+import { type ExportDatamodel } from '../datamodel';
+import type { ExportDb, ExportRow, ExportTable, ExportWriter, ExportWriteResult } from '../export.types';
+declare module '../../testing/index' {
+    interface PlatformConformanceSuiteOptions {
+        /** The exports slice's suite: its options, or `false` to opt out. Registered by importing `@marinoscar/platform-api/exports/testing`. */
+        exports?: ExportsConformanceOptions | false;
+    }
+}
+/**
+ * What the `exports` suite takes: the app's data, never its code.
+ *
+ * @stability experimental
+ */
+export interface ExportsConformanceOptions {
+    /** The app's `Prisma.dmmf.datamodel`. */
+    readonly datamodel: ExportDatamodel;
+    /** The app's permission registry (`id` of every permission). */
+    readonly permissions: ReadonlyArray<{
+        /** The permission id. */
+        readonly id: string;
+    }>;
+}
+/**
+ * The sentinel a fake row carries in `model.field`. Letters, digits and `-`
+ * only, so it survives every writer's escaping verbatim.
+ *
+ * @param model - the model name.
+ * @param field - the field name.
+ * @returns the sentinel.
+ *
+ * @stability experimental
+ */
+export declare function exportSentinel(model: string, field: string): string;
+/**
+ * What {@link collectExportOutput} returns.
+ *
+ * @stability experimental
+ */
+export interface CollectedExportOutput {
+    /** Every byte the writer wrote. */
+    bytes: Buffer;
+    /** What the writer reported. */
+    result: ExportWriteResult;
+}
+/**
+ * One output of {@link runSentinelExports}.
+ *
+ * @stability experimental
+ */
+export interface SentinelExportOutput {
+    /** The source id. */
+    source: string;
+    /** The writer id. */
+    format: string;
+    /** The output's searchable text (zips decompressed). */
+    text: string;
+}
+/**
+ * Writes `tables` with `writer` into memory.
+ *
+ * @param writer - the writer.
+ * @param tables - the datasets.
+ * @param source - the source id written into the file.
+ * @returns the bytes and the writer's row counts.
+ *
+ * @example
+ * ```ts
+ * const { bytes } = await collectExportOutput(JSON_EXPORT_WRITER, tablesOf([{ dataset: 'a', title: 'A', columns, rows: [] }]));
+ * ```
+ *
+ * @stability experimental
+ */
+export declare function collectExportOutput(writer: ExportWriter, tables: AsyncIterable<ExportTable>, source?: string): Promise<CollectedExportOutput>;
+/**
+ * Datasets with in-memory rows, as an async iterable (tests and examples).
+ *
+ * @param tables - the datasets, rows as arrays.
+ * @returns the iterable.
+ *
+ * @stability experimental
+ */
+export declare function tablesOf(tables: ReadonlyArray<Omit<ExportTable, 'rows'> & {
+    rows: readonly ExportRow[] | AsyncIterable<ExportRow>;
+}>): AsyncGenerator<ExportTable>;
+/**
+ * A fake bypass client: every model's delegate returns ONE row whose every
+ * scalar field holds its sentinel, ignoring `select` (the worst case), then
+ * nothing. `membership` rows carry a sentinel `user.email` and `role.name`.
+ *
+ * @param datamodel - the app's datamodel.
+ * @returns the client.
+ *
+ * @stability experimental
+ */
+export declare function sentinelExportDb(datamodel: ExportDatamodel): ExportDb;
+/**
+ * The sentinels that must NEVER appear in one source's export: every field
+ * the default redaction rule names, every `Bytes` field, every registry
+ * entry's `exportOmit`, and every field of a model the user-owned registry
+ * excludes (except the rows `org-data` reads by design: the organization
+ * itself and its memberships).
+ *
+ * @param datamodel - the app's datamodel.
+ * @param source - the source whose output is checked.
+ * @returns the forbidden sentinels.
+ *
+ * @stability experimental
+ */
+export declare function forbiddenExportSentinels(datamodel: ExportDatamodel, source?: string): string[];
+/**
+ * Runs the `user-data` and `org-data` sources (those registered) through
+ * every writer they offer over {@link sentinelExportDb}.
+ *
+ * @param options - the suite's options.
+ * @returns one entry per source and writer: the output's searchable text.
+ *
+ * @stability experimental
+ */
+export declare function runSentinelExports(options: ExportsConformanceOptions): Promise<SentinelExportOutput[]>;
+/**
+ * The registry and policy checks.
+ *
+ * @param options - the suite's options.
+ * @returns one finding per problem.
+ *
+ * @stability experimental
+ */
+export declare function checkExportRegistries(options: ExportsConformanceOptions): ConformanceFinding[];
+/**
+ * The `exports` conformance suite. Registered when
+ * `@marinoscar/platform-api/exports/testing` is imported.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+export declare const exportsConformanceSuite: ConformanceSuite<ExportsConformanceOptions>;
+//# sourceMappingURL=conformance.d.ts.map

package/dist/exports/testing/conformance.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conformance.d.ts","sourceRoot":"","sources":["../../../src/exports/testing/conformance.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAmB,kBAAkB,EAAqB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEpH,OAAO,EAAyC,KAAK,eAAe,EAA6B,MAAM,cAAc,CAAC;AAGtH,OAAO,KAAK,EAAiB,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAKxH,OAAO,QAAQ,qBAAqB,CAAC;IACnC,UAAU,+BAA+B;QACvC,yIAAyI;QACzI,OAAO,CAAC,EAAE,yBAAyB,GAAG,KAAK,CAAC;KAC7C;CACF;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAAyB;IACxC,yCAAyC;IACzC,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,gEAAgE;IAChE,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC;QAClC,yBAAyB;QACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;CACJ;AAID;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEnE;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAqB;IACpC,mCAAmC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,MAAM,EAAE,iBAAiB,CAAC;CAC3B;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,YAAY,EACpB,MAAM,EAAE,aAAa,CAAC,WAAW,CAAC,EAClC,MAAM,SAAS,GACd,OAAO,CAAC,qBAAqB,CAAC,CAUhC;AAED;;;;;;;GAOG;AACH,wBAAuB,QAAQ,CAC7B,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG;IAAE,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;CAAE,CAAC,GAC3G,cAAc,CAAC,WAAW,CAAC,CAW7B;AAyBD;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,eAAe,GAAG,QAAQ,CAuBrE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,GAAE,MAAmC,GAAG,MAAM,EAAE,CAc1H;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAqBjC;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,yBAAyB,GAAG,kBAAkB,EAAE,CAwC9F;AAED;;;;;;GAMG;AACH,eAAO,MAAM,uBAAuB,EAAE,gBAAgB,CAAC,yBAAyB,CA4C/E,CAAC"}

package/dist/exports/testing/conformance.js

@@ -0,0 +1,333 @@
+"use strict";
+// =============================================================================
+// The exports slice's conformance suite (issue #744)
+// =============================================================================
+//
+// Importing `@marinoscar/platform-api/exports/testing` registers the `exports`
+// suite with `runPlatformConformance()`. Checked against what the APP
+// registered:
+//
+//   1. registry: every source's permission (and cross-organization
+//      permission) is a registered permission; every source offers at least
+//      one registered writer; a writer limited to sources names registered
+//      ones.
+//   2. policy: every model of the user-owned registry is in the datamodel and
+//      every credential-shaped model (one with a field the default redaction
+//      rule names) is either `exclude`d or lists only metadata (the #688
+//      tripwire, extended to the export side).
+//   3. secret-egress: every registered model filled with SENTINEL values, the
+//      `user-data` and `org-data` sources run through EVERY writer they offer,
+//      and no sentinel of a redacted field (a secret-like name, the entry's
+//      `exportOmit`, a `Bytes` column, an excluded model) appears in any byte of
+//      any output, zips decompressed. The fake client ignores `select`, so the
+//      proof holds even for a client that returned every column.
+//
+// The spirit of the AI slice's `ai-secret-egress` spec, for exports.
+// =============================================================================
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportsConformanceSuite = void 0;
+exports.exportSentinel = exportSentinel;
+exports.collectExportOutput = collectExportOutput;
+exports.tablesOf = tablesOf;
+exports.sentinelExportDb = sentinelExportDb;
+exports.forbiddenExportSentinels = forbiddenExportSentinels;
+exports.runSentinelExports = runSentinelExports;
+exports.checkExportRegistries = checkExportRegistries;
+const node_stream_1 = require("node:stream");
+const index_1 = require("../../testing/index");
+const index_2 = require("../../core/index");
+const datamodel_1 = require("../datamodel");
+const export_registries_1 = require("../export.registries");
+const platform_sources_1 = require("../writers/platform-sources");
+const org_data_source_1 = require("../sources/org-data.source");
+const user_data_source_1 = require("../sources/user-data.source");
+const zip_1 = require("./zip");
+const SUBJECT = '00000000-0000-4000-8000-0000000000aa';
+/**
+ * The sentinel a fake row carries in `model.field`. Letters, digits and `-`
+ * only, so it survives every writer's escaping verbatim.
+ *
+ * @param model - the model name.
+ * @param field - the field name.
+ * @returns the sentinel.
+ *
+ * @stability experimental
+ */
+function exportSentinel(model, field) {
+    return `S3NT1N3L-${model}-${field}-Z`;
+}
+/**
+ * Writes `tables` with `writer` into memory.
+ *
+ * @param writer - the writer.
+ * @param tables - the datasets.
+ * @param source - the source id written into the file.
+ * @returns the bytes and the writer's row counts.
+ *
+ * @example
+ * ```ts
+ * const { bytes } = await collectExportOutput(JSON_EXPORT_WRITER, tablesOf([{ dataset: 'a', title: 'A', columns, rows: [] }]));
+ * ```
+ *
+ * @stability experimental
+ */
+async function collectExportOutput(writer, tables, source = 'test') {
+    const chunks = [];
+    const out = new node_stream_1.Writable({
+        write(chunk, _encoding, callback) {
+            chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+            callback();
+        },
+    });
+    const result = await writer.write(tables, out, { source, exportedAt: new Date('2026-01-01T00:00:00.000Z'), appSlug: 'app' });
+    return { bytes: Buffer.concat(chunks), result };
+}
+/**
+ * Datasets with in-memory rows, as an async iterable (tests and examples).
+ *
+ * @param tables - the datasets, rows as arrays.
+ * @returns the iterable.
+ *
+ * @stability experimental
+ */
+async function* tablesOf(tables) {
+    for (const table of tables) {
+        const rows = table.rows;
+        yield {
+            ...table,
+            rows: (async function* () {
+                if (Symbol.asyncIterator in rows)
+                    yield* rows;
+                else
+                    yield* rows;
+            })(),
+        };
+    }
+}
+function sentinelValue(model, field) {
+    const text = exportSentinel(model.name, field.name);
+    if (field.kind === 'enum')
+        return text;
+    switch (field.type) {
+        case 'Int':
+        case 'Float':
+        case 'Decimal':
+            return 1;
+        case 'BigInt':
+            return BigInt(1);
+        case 'Boolean':
+            return true;
+        case 'DateTime':
+            return new Date(0);
+        case 'Bytes':
+            return Buffer.from(text, 'utf8');
+        case 'Json':
+            return { value: text };
+        default:
+            return field.isList ? [text] : text;
+    }
+}
+/**
+ * A fake bypass client: every model's delegate returns ONE row whose every
+ * scalar field holds its sentinel, ignoring `select` (the worst case), then
+ * nothing. `membership` rows carry a sentinel `user.email` and `role.name`.
+ *
+ * @param datamodel - the app's datamodel.
+ * @returns the client.
+ *
+ * @stability experimental
+ */
+function sentinelExportDb(datamodel) {
+    const db = {};
+    for (const model of datamodel.models) {
+        let served = false;
+        db[(0, datamodel_1.delegateNameOf)(model.name)] = {
+            findMany: async () => {
+                if (served)
+                    return [];
+                served = true;
+                const row = {};
+                for (const field of model.fields) {
+                    if (field.kind === 'scalar' || field.kind === 'enum')
+                        row[field.name] = sentinelValue(model, field);
+                }
+                if (model.name === 'Membership') {
+                    row.user = { email: exportSentinel('User', 'email') };
+                    row.role = { name: exportSentinel('Role', 'name') };
+                }
+                return [row];
+            },
+            findUnique: async () => null,
+            findFirst: async () => null,
+        };
+    }
+    return db;
+}
+/**
+ * The sentinels that must NEVER appear in one source's export: every field
+ * the default redaction rule names, every `Bytes` field, every registry
+ * entry's `exportOmit`, and every field of a model the user-owned registry
+ * excludes (except the rows `org-data` reads by design: the organization
+ * itself and its memberships).
+ *
+ * @param datamodel - the app's datamodel.
+ * @param source - the source whose output is checked.
+ * @returns the forbidden sentinels.
+ *
+ * @stability experimental
+ */
+function forbiddenExportSentinels(datamodel, source = user_data_source_1.USER_DATA_EXPORT_SOURCE_ID) {
+    const readByDesign = source === org_data_source_1.ORG_DATA_EXPORT_SOURCE_ID ? new Set(['Organization', 'Membership']) : new Set(['User']);
+    const forbidden = [];
+    for (const model of datamodel.models) {
+        const def = index_2.userOwnedModelRegistry.get(model.name);
+        const excluded = def?.export === 'exclude' && !readByDesign.has(model.name);
+        for (const field of model.fields) {
+            if (field.kind !== 'scalar' && field.kind !== 'enum')
+                continue;
+            if ((0, datamodel_1.isRedactedExportField)(field.name) || field.type === 'Bytes' || excluded || (def?.exportOmit ?? []).includes(field.name)) {
+                forbidden.push(exportSentinel(model.name, field.name));
+            }
+        }
+    }
+    return forbidden;
+}
+/**
+ * Runs the `user-data` and `org-data` sources (those registered) through
+ * every writer they offer over {@link sentinelExportDb}.
+ *
+ * @param options - the suite's options.
+ * @returns one entry per source and writer: the output's searchable text.
+ *
+ * @stability experimental
+ */
+async function runSentinelExports(options) {
+    const outputs = [];
+    for (const id of [user_data_source_1.USER_DATA_EXPORT_SOURCE_ID, org_data_source_1.ORG_DATA_EXPORT_SOURCE_ID]) {
+        const source = export_registries_1.exportSourceRegistry.get(id);
+        if (!source)
+            continue;
+        for (const writer of (0, export_registries_1.writersFor)(source)) {
+            const ctx = {
+                exportId: '00000000-0000-4000-8000-0000000000ee',
+                scope: source.scope,
+                subjectId: SUBJECT,
+                requestedById: SUBJECT,
+                db: sentinelExportDb(options.datamodel),
+                datamodel: options.datamodel,
+                pageSize: 10,
+                now: new Date('2026-01-01T00:00:00.000Z'),
+            };
+            const { bytes } = await collectExportOutput(writer, source.collect(ctx, source.requestSchema.parse({})), source.id);
+            outputs.push({ source: source.id, format: writer.id, text: (0, zip_1.exportFileText)(bytes) });
+        }
+    }
+    return outputs;
+}
+/**
+ * The registry and policy checks.
+ *
+ * @param options - the suite's options.
+ * @returns one finding per problem.
+ *
+ * @stability experimental
+ */
+function checkExportRegistries(options) {
+    const findings = [];
+    const permissions = new Set(options.permissions.map((p) => p.id));
+    for (const source of export_registries_1.exportSourceRegistry.list()) {
+        if (!permissions.has(source.permission)) {
+            findings.push({ file: `source:${source.id}`, message: `permission ${source.permission} is not a registered permission` });
+        }
+        if (source.crossOrgPermission !== undefined && !permissions.has(source.crossOrgPermission)) {
+            findings.push({ file: `source:${source.id}`, message: `crossOrgPermission ${source.crossOrgPermission} is not a registered permission` });
+        }
+        if ((0, export_registries_1.writersFor)(source).length === 0)
+            findings.push({ file: `source:${source.id}`, message: 'offers no registered writer' });
+    }
+    for (const writer of export_registries_1.exportWriterRegistry.list()) {
+        for (const id of writer.sources ?? []) {
+            if (!export_registries_1.exportSourceRegistry.has(id))
+                findings.push({ file: `writer:${writer.id}`, message: `is limited to unknown source "${id}"` });
+        }
+        if (Array.isArray(writer.attachTo)) {
+            for (const id of writer.attachTo) {
+                // A platform source may be switched off (`platformSources`), so the built-in writers' ids are always fine.
+                if (!export_registries_1.exportSourceRegistry.has(id) && !platform_sources_1.PLATFORM_SOURCE_IDS.includes(id)) {
+                    findings.push({ file: `writer:${writer.id}`, message: `attaches to unknown source "${id}"` });
+                }
+            }
+        }
+    }
+    const models = new Map(options.datamodel.models.map((model) => [model.name, model]));
+    for (const def of index_2.userOwnedModelRegistry.list()) {
+        const model = models.get(def.model);
+        if (!model) {
+            findings.push({ file: `model:${def.model}`, message: 'is registered as user-owned but is not in the datamodel' });
+            continue;
+        }
+        if (def.export !== 'include')
+            continue;
+        for (const field of def.exportOmit ?? []) {
+            if (!model.fields.some((f) => f.name === field)) {
+                findings.push({ file: `model:${def.model}`, message: `exportOmit names unknown field "${field}"` });
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * The `exports` conformance suite. Registered when
+ * `@marinoscar/platform-api/exports/testing` is imported.
+ *
+ * @extensionPoint registry
+ * @stability experimental
+ */
+exports.exportsConformanceSuite = {
+    id: 'exports',
+    title: 'the exports slice keeps its invariants',
+    description: 'Every source names a registered permission and offers a registered writer, the user-owned registry agrees with the datamodel, and no secret, hash or hint reaches any export file.',
+    check(_context, options) {
+        return {
+            scanned: { sources: export_registries_1.exportSourceRegistry.size, writers: export_registries_1.exportWriterRegistry.size, models: options.datamodel.models.length },
+            scannedFiles: { sources: export_registries_1.exportSourceRegistry.ids(), writers: export_registries_1.exportWriterRegistry.ids() },
+            findings: checkExportRegistries(options),
+        };
+    },
+    cases(options) {
+        return [
+            {
+                name: 'registry: every source names a registered permission and offers a registered writer',
+                run: (report, expect) => {
+                    expect(report.scanned.sources).toBeGreaterThanOrEqual(1);
+                    expect(report.findings.filter((f) => f.file.startsWith('source:') || f.file.startsWith('writer:'))).toEqual([]);
+                },
+            },
+            {
+                name: 'policy: every user-owned model exists and its exportOmit names real fields',
+                run: (report, expect) => {
+                    expect(report.findings.filter((f) => f.file.startsWith('model:'))).toEqual([]);
+                },
+            },
+            {
+                name: 'secret-egress: no secret, hash or hint sentinel appears in any export, with every writer',
+                run: async (_report, expect) => {
+                    const outputs = await runSentinelExports(options);
+                    expect(outputs.length).toBeGreaterThanOrEqual(1);
+                    const leaks = outputs.flatMap((output) => {
+                        const forbidden = forbiddenExportSentinels(options.datamodel, output.source);
+                        expect(forbidden.length).toBeGreaterThanOrEqual(1);
+                        return forbidden.filter((sentinel) => output.text.includes(sentinel)).map((sentinel) => `${output.source}/${output.format}: ${sentinel}`);
+                    });
+                    expect(leaks).toEqual([]);
+                    // Not vacuous: the exports did carry the user's ordinary data.
+                    for (const output of outputs)
+                        expect(output.text).toContain('S3NT1N3L-');
+                },
+            },
+        ];
+    },
+};
+if (!index_1.conformanceSuites.has(exports.exportsConformanceSuite.id))
+    index_1.conformanceSuites.register(exports.exportsConformanceSuite);
+//# sourceMappingURL=conformance.js.map