@mathrunet/masamune_cloudflare_turso 3.2.1 → 3.2.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +1 -1
- package/README.md +176 -67
- package/dist/functions/turso.js +9 -0
- package/dist/functions/turso.js.map +1 -1
- package/dist/functions/turso_token.js +18 -9
- package/dist/functions/turso_token.js.map +1 -1
- package/dist/lib/request.d.ts +1 -1
- package/dist/lib/request.js +17 -9
- package/dist/lib/request.js.map +1 -1
- package/dist/lib/rules.d.ts +34 -1
- package/dist/lib/rules.js +294 -8
- package/dist/lib/rules.js.map +1 -1
- package/dist/lib/token.d.ts +4 -4
- package/dist/lib/token.js +11 -90
- package/dist/lib/token.js.map +1 -1
- package/dist/lib/turso_client.js +5 -15
- package/dist/lib/turso_client.js.map +1 -1
- package/dist/lib/types.d.ts +12 -10
- package/package.json +1 -1
package/CHANGELOG.md
CHANGED
package/README.md
CHANGED
|
@@ -49,101 +49,116 @@ Pass the return value of the `deploy` function to `export default`. It is define
|
|
|
49
49
|
```typescript
|
|
50
50
|
import * as m from "@mathrunet/masamune_cloudflare_turso";
|
|
51
51
|
|
|
52
|
-
export default m.deploy(
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
61
|
-
|
|
62
|
-
|
|
63
|
-
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
68
|
-
|
|
69
|
-
|
|
70
|
-
}
|
|
71
|
-
|
|
72
|
-
|
|
73
|
-
|
|
74
|
-
|
|
75
|
-
|
|
76
|
-
|
|
77
|
-
|
|
78
|
-
|
|
79
|
-
|
|
80
|
-
|
|
81
|
-
|
|
82
|
-
|
|
83
|
-
|
|
84
|
-
|
|
85
|
-
|
|
86
|
-
|
|
87
|
-
)
|
|
52
|
+
export default m.deploy([
|
|
53
|
+
m.Functions.turso({
|
|
54
|
+
organizationName: TURSO_ORGANIZATION_NAME,
|
|
55
|
+
groupName: TURSO_GROUP_NAME,
|
|
56
|
+
platformApiToken: TURSO_PLATFORM_API_TOKEN,
|
|
57
|
+
autoCreateDatabase: true,
|
|
58
|
+
autoCreateTable: true,
|
|
59
|
+
autoMigrateAddColumns: true,
|
|
60
|
+
rules: {
|
|
61
|
+
version: "1",
|
|
62
|
+
rules: {
|
|
63
|
+
"database/*/table/*/*": {
|
|
64
|
+
read: "deny",
|
|
65
|
+
write: "deny",
|
|
66
|
+
},
|
|
67
|
+
"database/main/table/users/*": {
|
|
68
|
+
read: "authenticated",
|
|
69
|
+
write: "authenticated",
|
|
70
|
+
},
|
|
71
|
+
},
|
|
72
|
+
},
|
|
73
|
+
}),
|
|
74
|
+
m.Functions.tursoToken({
|
|
75
|
+
organizationName: TURSO_ORGANIZATION_NAME,
|
|
76
|
+
groupName: TURSO_GROUP_NAME,
|
|
77
|
+
platformApiToken: TURSO_PLATFORM_API_TOKEN,
|
|
78
|
+
rules: {
|
|
79
|
+
version: "1",
|
|
80
|
+
rules: {
|
|
81
|
+
"database/main": {
|
|
82
|
+
read: "authenticated",
|
|
83
|
+
write: "deny",
|
|
84
|
+
},
|
|
85
|
+
},
|
|
86
|
+
},
|
|
87
|
+
}),
|
|
88
|
+
]);
|
|
88
89
|
```
|
|
89
90
|
|
|
90
91
|
# Endpoints
|
|
91
92
|
|
|
92
93
|
The package exposes Turso through a single provider path.
|
|
93
94
|
|
|
94
|
-
| Method
|
|
95
|
-
|
|
96
|
-
| `GET`
|
|
97
|
-
| `
|
|
98
|
-
| `
|
|
99
|
-
| `
|
|
100
|
-
| `
|
|
95
|
+
| Method | Path | Description |
|
|
96
|
+
| -------- | -------------- | --------------------------------- |
|
|
97
|
+
| `GET` | `/turso/database/{database}/{table}` | Read rows or count rows. |
|
|
98
|
+
| `GET` | `/turso/database/{database}/{table}/{indexKey}` | Read a row. |
|
|
99
|
+
| `POST` | `/turso/database/{database}/{table}` | Create a row. |
|
|
100
|
+
| `POST` | `/turso/database/{database}/{table}/{indexKey}` | Create a row with an explicit ID. |
|
|
101
|
+
| `PUT` | `/turso/database/{database}/{table}` | Update rows. |
|
|
102
|
+
| `PUT` | `/turso/database/{database}/{table}/{indexKey}` | Update a row. |
|
|
103
|
+
| `DELETE` | `/turso/database/{database}/{table}` | Delete rows. |
|
|
104
|
+
| `DELETE` | `/turso/database/{database}/{table}/{indexKey}` | Delete a row. |
|
|
105
|
+
| `POST` | `/turso/token/database/{database}` | Issue a database-scoped short-lived token. |
|
|
101
106
|
|
|
102
|
-
`GET
|
|
107
|
+
`GET` uses the path for `database`, `table`, and optional `indexKey`.
|
|
103
108
|
|
|
104
109
|
```text
|
|
105
|
-
/turso
|
|
110
|
+
/turso/database/main/users/user_1
|
|
106
111
|
```
|
|
107
112
|
|
|
108
113
|
Collection queries can pass `where`, `orderBy`, and `limit`.
|
|
109
114
|
|
|
110
115
|
```text
|
|
111
|
-
/turso
|
|
116
|
+
/turso/database/main/users?where=[{"type":"equalTo","key":"name","value":"Alice"}]&orderBy=[{"key":"created_at","descending":true}]&limit=20
|
|
112
117
|
```
|
|
113
118
|
|
|
114
119
|
Supported `where` types are `equalTo`, `notEqualTo`, `lessThan`,
|
|
115
120
|
`lessThanOrEqualTo`, `greaterThan`, `greaterThanOrEqualTo`, `whereIn`,
|
|
116
121
|
`whereNotIn`, `isNull`, `isNotNull`, and `like`.
|
|
117
122
|
|
|
118
|
-
`POST` / `PUT` / `DELETE` use JSON bodies
|
|
123
|
+
`POST` / `PUT` / `DELETE` use the same path format and JSON bodies for
|
|
124
|
+
`value` or query filters.
|
|
119
125
|
|
|
120
126
|
```json
|
|
121
127
|
{
|
|
122
|
-
"database": "main",
|
|
123
|
-
"table": "users",
|
|
124
|
-
"indexKey": "user_1",
|
|
125
128
|
"value": {
|
|
126
129
|
"name": "Alice"
|
|
127
130
|
}
|
|
128
131
|
}
|
|
129
132
|
```
|
|
130
133
|
|
|
134
|
+
The previous query/body style is still accepted for compatibility:
|
|
135
|
+
|
|
136
|
+
```text
|
|
137
|
+
/turso?database=main&table=users&indexKey=user_1
|
|
138
|
+
```
|
|
139
|
+
|
|
131
140
|
# Database and schema management
|
|
132
141
|
|
|
133
142
|
The worker can create Turso databases and tables automatically.
|
|
134
143
|
|
|
135
144
|
```typescript
|
|
136
145
|
m.Functions.turso({
|
|
137
|
-
|
|
138
|
-
|
|
139
|
-
|
|
140
|
-
|
|
141
|
-
|
|
142
|
-
|
|
143
|
-
autoMigrateAddColumns: true,
|
|
146
|
+
organizationName: TURSO_ORGANIZATION_NAME,
|
|
147
|
+
groupName: TURSO_GROUP_NAME,
|
|
148
|
+
platformApiToken: TURSO_PLATFORM_API_TOKEN,
|
|
149
|
+
autoCreateDatabase: true,
|
|
150
|
+
autoCreateTable: true,
|
|
151
|
+
autoMigrateAddColumns: true,
|
|
144
152
|
});
|
|
145
153
|
```
|
|
146
154
|
|
|
155
|
+
`groupName` must point to an existing Turso group. The region/location is set
|
|
156
|
+
when the group is created, not when each database is created.
|
|
157
|
+
|
|
158
|
+
```bash
|
|
159
|
+
turso group create my-group --location aws-ap-northeast-1
|
|
160
|
+
```
|
|
161
|
+
|
|
147
162
|
`groupName` can also be omitted when the runtime environment provides
|
|
148
163
|
`TURSO_GROUP_NAME`, such as through a local `.env` file or Cloudflare Worker
|
|
149
164
|
environment variables. When neither `groupName` nor `TURSO_GROUP_NAME` is
|
|
@@ -170,20 +185,82 @@ CREATE TABLE IF NOT EXISTS table_name (
|
|
|
170
185
|
|
|
171
186
|
Objects and arrays are stored as JSON strings.
|
|
172
187
|
|
|
173
|
-
#
|
|
188
|
+
# Database-scoped short-lived token
|
|
189
|
+
|
|
190
|
+
Use `/turso/token/database/{database}` to issue a Turso database token after
|
|
191
|
+
resolving `read-only` or `full-access` authorization through `rules`.
|
|
174
192
|
|
|
175
|
-
|
|
193
|
+
Token authorization is evaluated against the database path:
|
|
176
194
|
|
|
177
195
|
```json
|
|
178
196
|
{
|
|
179
|
-
"
|
|
197
|
+
"version": "1",
|
|
198
|
+
"rules": {
|
|
199
|
+
"database/main": {
|
|
200
|
+
"read": "authenticated",
|
|
201
|
+
"write": "deny"
|
|
202
|
+
}
|
|
203
|
+
}
|
|
204
|
+
}
|
|
205
|
+
```
|
|
206
|
+
|
|
207
|
+
If `read` is allowed and `write` is denied, the worker issues a `read-only`
|
|
208
|
+
token. If both `read` and all write operations are allowed, the worker issues a
|
|
209
|
+
`full-access` token. If `read` is denied, the token request returns `403`.
|
|
210
|
+
|
|
211
|
+
Named path parameters can be compared with the authenticated user ID:
|
|
212
|
+
|
|
213
|
+
```json
|
|
214
|
+
{
|
|
215
|
+
"version": "1",
|
|
216
|
+
"rules": {
|
|
217
|
+
"database/{uid}": {
|
|
218
|
+
"read": { "type": "pathParamMatch", "param": "uid" },
|
|
219
|
+
"write": { "type": "pathParamMatch", "param": "uid" }
|
|
220
|
+
}
|
|
221
|
+
}
|
|
222
|
+
}
|
|
223
|
+
```
|
|
224
|
+
|
|
225
|
+
With this rule, only the authenticated user whose `uid` is equal to the
|
|
226
|
+
database name can access that database.
|
|
227
|
+
|
|
228
|
+
Read and write operations can be restricted to the Workers endpoint while
|
|
229
|
+
issuing only the direct Turso token that is safe for the requested scope:
|
|
230
|
+
|
|
231
|
+
```json
|
|
232
|
+
{
|
|
233
|
+
"version": "1",
|
|
234
|
+
"rules": {
|
|
235
|
+
"database/{uid}": {
|
|
236
|
+
"read": { "type": "pathParamMatch", "param": "uid" },
|
|
237
|
+
"write": {
|
|
238
|
+
"type": "pathParamMatch",
|
|
239
|
+
"param": "uid",
|
|
240
|
+
"serverOnly": true
|
|
241
|
+
}
|
|
242
|
+
}
|
|
243
|
+
}
|
|
244
|
+
}
|
|
245
|
+
```
|
|
246
|
+
|
|
247
|
+
`serverOnly` can also be used with `read` and `fieldMatch` rules. A
|
|
248
|
+
server-only rule does not grant direct token access for that operation.
|
|
249
|
+
|
|
250
|
+
Table/document rules below the database path are also treated as server-side
|
|
251
|
+
rules for token issuance when they restrict `read` or `write`. This is
|
|
252
|
+
intentional because Turso Platform tokens are database-scoped and cannot enforce
|
|
253
|
+
document-level `fieldMatch` or `pathParamMatch` checks on the client.
|
|
254
|
+
|
|
255
|
+
```json
|
|
256
|
+
{
|
|
257
|
+
"ttlSeconds": 600,
|
|
180
258
|
"scope": [
|
|
181
259
|
{
|
|
182
260
|
"table": "users",
|
|
183
|
-
"operations": ["read"]
|
|
261
|
+
"operations": ["read", "write"]
|
|
184
262
|
}
|
|
185
|
-
]
|
|
186
|
-
"ttlSeconds": 600
|
|
263
|
+
]
|
|
187
264
|
}
|
|
188
265
|
```
|
|
189
266
|
|
|
@@ -192,20 +269,52 @@ The response is:
|
|
|
192
269
|
```json
|
|
193
270
|
{
|
|
194
271
|
"token": "<jwt>",
|
|
195
|
-
"expiresAt": 1760000000
|
|
272
|
+
"expiresAt": 1760000000,
|
|
273
|
+
"url": "libsql://your-db.turso.io",
|
|
274
|
+
"readMode": "direct",
|
|
275
|
+
"writeMode": "functions",
|
|
276
|
+
"scopes": [
|
|
277
|
+
{
|
|
278
|
+
"table": "users",
|
|
279
|
+
"operations": ["read", "write"],
|
|
280
|
+
"readMode": "direct",
|
|
281
|
+
"writeMode": "functions"
|
|
282
|
+
}
|
|
283
|
+
]
|
|
284
|
+
}
|
|
285
|
+
```
|
|
286
|
+
|
|
287
|
+
If both read and write are functions-only, `/turso/token/database/{database}`
|
|
288
|
+
does not return `token`, `expiresAt`, or `url`; it returns only the resolved
|
|
289
|
+
modes and scopes:
|
|
290
|
+
|
|
291
|
+
```json
|
|
292
|
+
{
|
|
293
|
+
"readMode": "functions",
|
|
294
|
+
"writeMode": "functions",
|
|
295
|
+
"scopes": [
|
|
296
|
+
{
|
|
297
|
+
"table": "users",
|
|
298
|
+
"operations": ["read", "write"],
|
|
299
|
+
"readMode": "functions",
|
|
300
|
+
"writeMode": "functions"
|
|
301
|
+
}
|
|
302
|
+
]
|
|
196
303
|
}
|
|
197
304
|
```
|
|
198
305
|
|
|
306
|
+
`url` is resolved by the Workers backend. This lets clients use direct libSQL
|
|
307
|
+
access for dynamically created databases without building the Turso hostname on
|
|
308
|
+
the client.
|
|
309
|
+
|
|
199
310
|
`ttlSeconds` defaults to 600 seconds and is capped by `maxTtlSeconds` (default: 3600 seconds).
|
|
200
311
|
|
|
201
|
-
|
|
312
|
+
Tokens are generated with the Turso Platform API:
|
|
202
313
|
|
|
203
314
|
```text
|
|
204
315
|
POST /v1/organizations/{organizationSlug}/databases/{databaseName}/auth/tokens
|
|
205
316
|
```
|
|
206
317
|
|
|
207
|
-
If Platform API settings are not available, the worker falls back to a local HS256 JWT signed with `tokenIssuer.secret` or `authToken`.
|
|
208
|
-
|
|
209
318
|
# GitHub Sponsors
|
|
210
319
|
|
|
211
320
|
Sponsors are always welcome. Thank you for your support!
|
package/dist/functions/turso.js
CHANGED
|
@@ -6,9 +6,17 @@ const rules_1 = require("../lib/rules");
|
|
|
6
6
|
const turso_client_1 = require("../lib/turso_client");
|
|
7
7
|
module.exports = (hono, options, data) => {
|
|
8
8
|
hono.get("/", async (context) => handleCrud(context, options, "GET"));
|
|
9
|
+
hono.get("/database/:database/:table", async (context) => handleCrud(context, options, "GET"));
|
|
10
|
+
hono.get("/database/:database/:table/:indexKey", async (context) => handleCrud(context, options, "GET"));
|
|
9
11
|
hono.post("/", async (context) => handleCrud(context, options, "POST"));
|
|
12
|
+
hono.post("/database/:database/:table", async (context) => handleCrud(context, options, "POST"));
|
|
13
|
+
hono.post("/database/:database/:table/:indexKey", async (context) => handleCrud(context, options, "POST"));
|
|
10
14
|
hono.put("/", async (context) => handleCrud(context, options, "PUT"));
|
|
15
|
+
hono.put("/database/:database/:table", async (context) => handleCrud(context, options, "PUT"));
|
|
16
|
+
hono.put("/database/:database/:table/:indexKey", async (context) => handleCrud(context, options, "PUT"));
|
|
11
17
|
hono.delete("/", async (context) => handleCrud(context, options, "DELETE"));
|
|
18
|
+
hono.delete("/database/:database/:table", async (context) => handleCrud(context, options, "DELETE"));
|
|
19
|
+
hono.delete("/database/:database/:table/:indexKey", async (context) => handleCrud(context, options, "DELETE"));
|
|
12
20
|
return hono;
|
|
13
21
|
};
|
|
14
22
|
async function handleCrud(context, options, method) {
|
|
@@ -27,6 +35,7 @@ async function handleCrud(context, options, method) {
|
|
|
27
35
|
operation: (0, rules_1.normalizeHttpMethodToRulesOperation)(method),
|
|
28
36
|
authentication,
|
|
29
37
|
fetchDocument: async () => (0, crud_1.fetchDocumentForRules)(client, request),
|
|
38
|
+
server: true,
|
|
30
39
|
});
|
|
31
40
|
if (!result.allowed) {
|
|
32
41
|
return context.json({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"turso.js","sourceRoot":"","sources":["../../src/functions/turso.ts"],"names":[],"mappings":";;AAMA,sCAAiE;AACjE,4CAA6D;AAC7D,wCAIsB;AACtB,sDAG6B;AAE7B,MAAM,CAAC,OAAO,GAAG,CACf,IAAU,EACV,OAA4B,EAC5B,IAAgC,EAChC,EAAE;IACF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,OAA4B,EAC5B,MAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAgB,EAAC,OAAO,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,IAAA,wCAAyB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAA,gCAAiB,EAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAA,8BAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAsC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,IAAA,sBAAc,EAAC;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;aAClC,CAAC;YACF,SAAS,EAAE,IAAA,2CAAmC,EAAC,MAAM,CAAC;YACtD,cAAc;YACd,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,4BAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"turso.js","sourceRoot":"","sources":["../../src/functions/turso.ts"],"names":[],"mappings":";;AAMA,sCAAiE;AACjE,4CAA6D;AAC7D,wCAIsB;AACtB,sDAG6B;AAE7B,MAAM,CAAC,OAAO,GAAG,CACf,IAAU,EACV,OAA4B,EAC5B,IAAgC,EAChC,EAAE;IACF,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IACjG,IAAI,CAAC,IAAI,CAAC,sCAAsC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3G,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACtE,IAAI,CAAC,GAAG,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC/F,IAAI,CAAC,GAAG,CAAC,sCAAsC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,4BAA4B,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IACrG,IAAI,CAAC,MAAM,CAAC,sCAAsC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,KAAK,UAAU,UAAU,CACvB,OAAgB,EAChB,OAA4B,EAC5B,MAAuB;IAEvB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,0BAAgB,EAAC,OAAO,CAAC,CAAC;QAChD,MAAM,UAAU,GAAG,MAAM,IAAA,wCAAyB,EAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAG,IAAA,gCAAiB,EAAC,UAAU,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAA,8BAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAsC,CAAC;QAC1F,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC;YACnC,IAAI,EAAE,IAAA,sBAAc,EAAC;gBACnB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;aAClC,CAAC;YACF,SAAS,EAAE,IAAA,2CAAmC,EAAC,MAAM,CAAC;YACtD,cAAc;YACd,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,IAAA,4BAAqB,EAAC,MAAM,EAAE,OAAO,CAAC;YACjE,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,OAAO,CAAC,IAAI,CAAC;gBAClB,KAAK,EAAE,QAAQ;gBACf,IAAI,EAAE,MAAM,CAAC,QAAQ;aACtB,EAAE,GAAG,CAAC,CAAC;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAA,kBAAW,EAAC;YACjC,MAAM;YACN,MAAM;YACN,OAAO;YACP,eAAe,EAAE,OAAO,CAAC,eAAe,KAAK,KAAK;YAClD,qBAAqB,EAAE,OAAO,CAAC,qBAAqB,KAAK,KAAK;SAC/D,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAA,mBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}
|
|
@@ -6,32 +6,41 @@ const turso_client_1 = require("../lib/turso_client");
|
|
|
6
6
|
const token_1 = require("../lib/token");
|
|
7
7
|
module.exports = (hono, options, data) => {
|
|
8
8
|
hono.post("/", async (context) => handleToken(context, options));
|
|
9
|
+
hono.post("/database/:database", async (context) => handleToken(context, options));
|
|
10
|
+
hono.post("/:database", async (context) => handleToken(context, options));
|
|
9
11
|
return hono;
|
|
10
12
|
};
|
|
11
13
|
async function handleToken(context, options) {
|
|
12
14
|
try {
|
|
13
15
|
const request = await (0, request_1.parseTokenRequest)(context);
|
|
14
|
-
await (0, turso_client_1.resolveDatabaseConnection)(request.database, options);
|
|
16
|
+
const connection = await (0, turso_client_1.resolveDatabaseConnection)(request.database, options);
|
|
15
17
|
const authentication = context.get("authentication");
|
|
16
18
|
const engine = (0, rules_1.createTursoRulesEngine)(options.rules);
|
|
17
|
-
const
|
|
19
|
+
const access = await (0, rules_1.resolveDatabaseTokenAccess)({
|
|
18
20
|
engine,
|
|
19
21
|
database: request.database,
|
|
20
22
|
scope: request.scope,
|
|
21
23
|
authentication,
|
|
22
24
|
});
|
|
23
|
-
if (
|
|
25
|
+
if (!access) {
|
|
24
26
|
return context.json({
|
|
25
27
|
error: "denied",
|
|
26
28
|
}, 403);
|
|
27
29
|
}
|
|
28
|
-
const token =
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
30
|
+
const token = access.authorization
|
|
31
|
+
? await (0, token_1.issueDatabaseToken)({
|
|
32
|
+
database: request.database,
|
|
33
|
+
authorization: access.authorization,
|
|
34
|
+
ttlSeconds: request.ttlSeconds,
|
|
35
|
+
options,
|
|
36
|
+
})
|
|
37
|
+
: undefined;
|
|
38
|
+
return context.json({
|
|
39
|
+
...(token ? { ...token, url: connection.url } : {}),
|
|
40
|
+
readMode: access.readMode,
|
|
41
|
+
writeMode: access.writeMode,
|
|
42
|
+
scopes: access.scopes,
|
|
33
43
|
});
|
|
34
|
-
return context.json(token);
|
|
35
44
|
}
|
|
36
45
|
catch (error) {
|
|
37
46
|
return (0, request_1.jsonError)(context, error);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"turso_token.js","sourceRoot":"","sources":["../../src/functions/turso_token.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"turso_token.js","sourceRoot":"","sources":["../../src/functions/turso_token.ts"],"names":[],"mappings":";;AAEA,4CAA8D;AAC9D,wCAGsB;AACtB,sDAAgE;AAChE,wCAAkD;AAElD,MAAM,CAAC,OAAO,GAAG,CACf,IAAU,EACV,OAA4B,EAC5B,IAAgC,EAChC,EAAE;IACF,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IACnF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC,CAAC;AAEF,KAAK,UAAU,WAAW,CACxB,OAAgB,EAChB,OAA4B;IAE5B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,IAAA,2BAAiB,EAAC,OAAO,CAAC,CAAC;QACjD,MAAM,UAAU,GAAG,MAAM,IAAA,wCAAyB,EAChD,OAAO,CAAC,QAAQ,EAChB,OAAO,CACR,CAAC;QACF,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAsC,CAAC;QAC1F,MAAM,MAAM,GAAG,IAAA,8BAAsB,EAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,IAAA,kCAA0B,EAAC;YAC9C,MAAM;YACN,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,cAAc;SACf,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,OAAO,CAAC,IAAI,CACjB;gBACE,KAAK,EAAE,QAAQ;aAChB,EACD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa;YAChC,CAAC,CAAC,MAAM,IAAA,0BAAkB,EAAC;gBACvB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,OAAO;aACR,CAAC;YACJ,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,OAAO,CAAC,IAAI,CAAC;YAClB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnD,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAA,mBAAS,EAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;AACH,CAAC"}
|
package/dist/lib/request.d.ts
CHANGED
|
@@ -5,7 +5,7 @@ export declare class HttpError extends Error {
|
|
|
5
5
|
constructor(status: number, message: string);
|
|
6
6
|
}
|
|
7
7
|
export declare function parseCrudRequest(context: Context): Promise<Required<Pick<TursoRequestBody, "database" | "table">> & TursoRequestBody>;
|
|
8
|
-
export declare function parseTokenRequest(context: Context): Promise<Required<Pick<TursoTokenRequestBody, "database"
|
|
8
|
+
export declare function parseTokenRequest(context: Context): Promise<Required<Pick<TursoTokenRequestBody, "database">> & TursoTokenRequestBody>;
|
|
9
9
|
export declare function validateIdentifier(value: string, label: string): string;
|
|
10
10
|
export declare function validateLogicalName(value: string, label: string): string;
|
|
11
11
|
export declare function validateIndexKey(value: string): string;
|
package/dist/lib/request.js
CHANGED
|
@@ -18,12 +18,18 @@ class HttpError extends Error {
|
|
|
18
18
|
exports.HttpError = HttpError;
|
|
19
19
|
async function parseCrudRequest(context) {
|
|
20
20
|
const method = context.req.method.toUpperCase();
|
|
21
|
+
const pathDatabase = optionalParam(context, "database");
|
|
22
|
+
const pathTable = optionalParam(context, "table");
|
|
23
|
+
const pathIndexKey = optionalParam(context, "indexKey");
|
|
21
24
|
const body = method === "GET"
|
|
22
25
|
? parseGetRequest(context)
|
|
23
26
|
: await parseJsonBody(context);
|
|
24
|
-
const database = validateLogicalName(body.database ?? "main", "database");
|
|
25
|
-
const table = validateIdentifier(requiredString(body.table, "table"), "table");
|
|
26
|
-
const
|
|
27
|
+
const database = validateLogicalName(pathDatabase ?? body.database ?? "main", "database");
|
|
28
|
+
const table = validateIdentifier(requiredString(pathTable ?? body.table, "table"), "table");
|
|
29
|
+
const requestedIndexKey = pathIndexKey ?? body.indexKey;
|
|
30
|
+
const indexKey = requestedIndexKey
|
|
31
|
+
? validateIndexKey(requiredString(requestedIndexKey, "indexKey"))
|
|
32
|
+
: undefined;
|
|
27
33
|
const where = validateWhere(body.where ?? []);
|
|
28
34
|
const orderBy = validateOrderBy(body.orderBy ?? []);
|
|
29
35
|
const limit = validateLimit(body.limit);
|
|
@@ -41,12 +47,10 @@ async function parseCrudRequest(context) {
|
|
|
41
47
|
};
|
|
42
48
|
}
|
|
43
49
|
async function parseTokenRequest(context) {
|
|
50
|
+
const pathDatabase = optionalParam(context, "database");
|
|
44
51
|
const body = await parseJsonBody(context);
|
|
45
|
-
const database = validateLogicalName(body.database ?? "main", "database");
|
|
46
|
-
|
|
47
|
-
throw new HttpError(400, "scope is required.");
|
|
48
|
-
}
|
|
49
|
-
const scope = body.scope.map((item) => {
|
|
52
|
+
const database = validateLogicalName(pathDatabase ?? body.database ?? "main", "database");
|
|
53
|
+
const scope = body.scope?.map((item) => {
|
|
50
54
|
if (!item || typeof item !== "object") {
|
|
51
55
|
throw new HttpError(400, "scope item must be an object.");
|
|
52
56
|
}
|
|
@@ -75,7 +79,7 @@ async function parseTokenRequest(context) {
|
|
|
75
79
|
return {
|
|
76
80
|
...body,
|
|
77
81
|
database,
|
|
78
|
-
scope,
|
|
82
|
+
...(scope ? { scope } : {}),
|
|
79
83
|
};
|
|
80
84
|
}
|
|
81
85
|
function validateIdentifier(value, label) {
|
|
@@ -120,6 +124,10 @@ function parseGetRequest(context) {
|
|
|
120
124
|
count: query.count === "true",
|
|
121
125
|
};
|
|
122
126
|
}
|
|
127
|
+
function optionalParam(context, name) {
|
|
128
|
+
const value = context.req.param(name);
|
|
129
|
+
return value && value.length > 0 ? value : undefined;
|
|
130
|
+
}
|
|
123
131
|
async function parseJsonBody(context) {
|
|
124
132
|
try {
|
|
125
133
|
return await context.req.json();
|
package/dist/lib/request.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/lib/request.ts"],"names":[],"mappings":";;;AAmBA,
|
|
1
|
+
{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/lib/request.ts"],"names":[],"mappings":";;;AAmBA,4CA6BC;AAED,8CAmCC;AAED,gDAKC;AAED,kDAKC;AAED,4CAKC;AAED,8BAQC;AA5GD,MAAM,iBAAiB,GAAG,0BAA0B,CAAC;AAErD,MAAa,SAAU,SAAQ,KAAK;IAEvB;IADX,YACW,MAAc,EACvB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,WAAM,GAAN,MAAM,CAAQ;IAIzB,CAAC;CACF;AAPD,8BAOC;AAEM,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;IAChD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,KAAK,KAAK;QAC3B,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC;QAC1B,CAAC,CAAC,MAAM,aAAa,CAAmB,OAAO,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5F,MAAM,iBAAiB,GAAG,YAAY,IAAI,IAAI,CAAC,QAAQ,CAAC;IACxD,MAAM,QAAQ,GAAG,iBAAiB;QAChC,CAAC,CAAC,gBAAgB,CAAC,cAAc,CAAC,iBAAiB,EAAE,UAAU,CAAC,CAAC;QACjE,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO;QACL,GAAG,IAAI;QACP,QAAQ;QACR,KAAK;QACL,QAAQ;QACR,KAAK;QACL,OAAO;QACP,KAAK;QACL,KAAK;QACL,KAAK,EAAE,IAAI,CAAC,KAAK,KAAK,IAAI;KAC3B,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IACtD,MAAM,YAAY,GAAG,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,MAAM,aAAa,CAAwB,OAAO,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,mBAAmB,CAAC,YAAY,IAAI,IAAI,CAAC,QAAQ,IAAI,MAAM,EAAE,UAAU,CAAC,CAAC;IAC1F,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACrC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,KAAK,GAAG,kBAAkB,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC,CAAC;QAC3F,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,+BAA+B,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;YACnD,QAAQ,SAAS,EAAE,CAAC;gBAClB,KAAK,MAAM,CAAC;gBACZ,KAAK,OAAO,CAAC;gBACb,KAAK,KAAK,CAAC;gBACX,KAAK,QAAQ,CAAC;gBACd,KAAK,QAAQ,CAAC;gBACd,KAAK,QAAQ;oBACX,OAAO,SAAS,CAAC;gBACnB;oBACE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,SAAS,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC,CAAC,CAAC;QACH,OAAO;YACL,KAAK;YACL,UAAU;SACX,CAAC;IACJ,CAAC,CAAC,CAAC;IACH,OAAO;QACL,GAAG,IAAI;QACP,QAAQ;QACR,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,SAAgB,kBAAkB,CAAC,KAAa,EAAE,KAAa;IAC7D,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAa,EAAE,KAAa;IAC9D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,qBAAqB,KAAK,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAgB,SAAS,CAAC,OAAgB,EAAE,KAAc;IACxD,IAAI,KAAK,YAAY,SAAS,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,MAAa,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,eAAe,CAAC,OAAgB;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAwB,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAwB,KAAK,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7G,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1E,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK;QACL,OAAO;QACP,KAAK;QACL,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,MAAM;KAC9B,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAgB,EAAE,IAAY;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,aAAa,CAAI,OAAgB;IAC9C,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAK,CAAC;IACrC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAI,KAAa,EAAE,KAAa;IACtD,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAM,CAAC;IAChC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,gBAAgB,CAAC,CAAC;IACrD,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,KAAa;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,eAAe,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAA4B;IACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC7B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,oCAAoC,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,SAAS,CAAC;QACzC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,SAAS,CAAC;YACf,KAAK,YAAY,CAAC;YAClB,KAAK,UAAU,CAAC;YAChB,KAAK,mBAAmB,CAAC;YACzB,KAAK,aAAa,CAAC;YACnB,KAAK,sBAAsB,CAAC;YAC5B,KAAK,SAAS,CAAC;YACf,KAAK,YAAY,CAAC;YAClB,KAAK,QAAQ,CAAC;YACd,KAAK,WAAW,CAAC;YACjB,KAAK,MAAM,CAAC;YACZ,KAAK,eAAe,CAAC;YACrB,KAAK,kBAAkB;gBACrB,MAAM;YACR;gBACE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,gCAAgC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,GAAG,GAAG,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO;YACL,IAAI;YACJ,GAAG;YACH,KAAK,EAAE,SAAS,CAAC,KAAK;SACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,OAA8B;IACrD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE;QAC/B,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;YAChD,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;QACnE,CAAC;QACD,OAAO;YACL,GAAG,EAAE,kBAAkB,CAAC,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,aAAa,CAAC;YACpF,UAAU,EAAE,SAAS,CAAC,UAAU,KAAK,IAAI;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,KAAyB;IAC9C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAA8B;IACnD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;IACvD,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,CAAC,kBAAkB,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,GAAG,IAAI,CAAC;IACtD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
|
package/dist/lib/rules.d.ts
CHANGED
|
@@ -1,19 +1,38 @@
|
|
|
1
|
-
import { AuthenticationContext, RulesAccessRule, RulesConfig, RulesOperation, RulesOperationKey, TursoTokenScopeInput } from "./types";
|
|
1
|
+
import { AuthenticationContext, RulesAccessRule, RulesConfig, RulesOperation, RulesOperationKey, TursoTokenAccessMode, TursoTokenScopeInput, TursoTokenScopeOutput } from "./types";
|
|
2
2
|
export interface RulesEvaluationInput {
|
|
3
3
|
path: string;
|
|
4
4
|
operation: RulesOperation | RulesOperationKey;
|
|
5
5
|
authentication?: AuthenticationContext | undefined;
|
|
6
6
|
fetchDocument?: (() => Promise<Record<string, unknown> | null | undefined>) | undefined;
|
|
7
|
+
server?: boolean | undefined;
|
|
7
8
|
}
|
|
8
9
|
export interface RulesEvaluationResult {
|
|
9
10
|
allowed: boolean;
|
|
10
11
|
rulePath?: string | undefined;
|
|
11
12
|
access?: RulesAccessRule | undefined;
|
|
13
|
+
params?: Record<string, string> | undefined;
|
|
14
|
+
}
|
|
15
|
+
export type TursoDatabaseTokenAuthorization = "read-only" | "full-access";
|
|
16
|
+
export interface TursoDatabaseTokenAccess {
|
|
17
|
+
authorization?: TursoDatabaseTokenAuthorization | undefined;
|
|
18
|
+
readMode: TursoTokenAccessMode;
|
|
19
|
+
writeMode: TursoTokenAccessMode;
|
|
20
|
+
scopes: TursoTokenScopeOutput[];
|
|
12
21
|
}
|
|
13
22
|
export declare class RulesEngine {
|
|
14
23
|
constructor(config?: RulesConfig | undefined);
|
|
15
24
|
private readonly config;
|
|
16
25
|
evaluate(input: RulesEvaluationInput): Promise<RulesEvaluationResult>;
|
|
26
|
+
hasScopedRestriction({ database, table, operation, }: {
|
|
27
|
+
database: string;
|
|
28
|
+
table: string;
|
|
29
|
+
operation: RulesOperation | RulesOperationKey;
|
|
30
|
+
}): boolean;
|
|
31
|
+
hasScopedDeny({ database, table, operation, }: {
|
|
32
|
+
database: string;
|
|
33
|
+
table: string;
|
|
34
|
+
operation: RulesOperation | RulesOperationKey;
|
|
35
|
+
}): boolean;
|
|
17
36
|
}
|
|
18
37
|
export declare function createTursoRulesEngine(config?: RulesConfig | undefined): RulesEngine;
|
|
19
38
|
export declare function buildRulesPath({ database, table, indexKey, }: {
|
|
@@ -21,6 +40,9 @@ export declare function buildRulesPath({ database, table, indexKey, }: {
|
|
|
21
40
|
table: string;
|
|
22
41
|
indexKey: string;
|
|
23
42
|
}): string;
|
|
43
|
+
export declare function buildDatabaseRulesPath({ database, }: {
|
|
44
|
+
database: string;
|
|
45
|
+
}): string;
|
|
24
46
|
export declare function normalizeHttpMethodToRulesOperation(method: string): RulesOperation;
|
|
25
47
|
export declare function normalizeRulesOperation(operation: RulesOperation | RulesOperationKey): RulesOperation;
|
|
26
48
|
export declare function expandRulesOperation(operation: RulesOperationKey): RulesOperation[];
|
|
@@ -30,3 +52,14 @@ export declare function filterAllowedScope({ engine, database, scope, authentica
|
|
|
30
52
|
scope: TursoTokenScopeInput[];
|
|
31
53
|
authentication?: AuthenticationContext | undefined;
|
|
32
54
|
}): Promise<TursoTokenScopeInput[]>;
|
|
55
|
+
export declare function resolveDatabaseTokenAccess({ engine, database, scope, authentication, }: {
|
|
56
|
+
engine: RulesEngine;
|
|
57
|
+
database: string;
|
|
58
|
+
scope?: TursoTokenScopeInput[] | undefined;
|
|
59
|
+
authentication?: AuthenticationContext | undefined;
|
|
60
|
+
}): Promise<TursoDatabaseTokenAccess | undefined>;
|
|
61
|
+
export declare function resolveDatabaseTokenAuthorization({ engine, database, authentication, }: {
|
|
62
|
+
engine: RulesEngine;
|
|
63
|
+
database: string;
|
|
64
|
+
authentication?: AuthenticationContext | undefined;
|
|
65
|
+
}): Promise<TursoDatabaseTokenAuthorization | undefined>;
|