@nest-boot/row-level-security 7.0.0 → 7.2.0

package/dist/enums/row-level-security-role.enum.d.ts

@@ -0,0 +1,7 @@
+/** Built-in database roles used by row-level security helpers. */
+export declare enum RowLevelSecurityRole {
+    /** Role used for unauthenticated or public RLS access. */
+    ANONYMOUS = "anonymous",
+    /** Role used for authenticated RLS access. */
+    AUTHENTICATED = "authenticated"
+}

package/dist/enums/row-level-security-role.enum.js

@@ -0,0 +1,12 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RowLevelSecurityRole = void 0;
+/** Built-in database roles used by row-level security helpers. */
+var RowLevelSecurityRole;
+(function (RowLevelSecurityRole) {
+    /** Role used for unauthenticated or public RLS access. */
+    RowLevelSecurityRole["ANONYMOUS"] = "anonymous";
+    /** Role used for authenticated RLS access. */
+    RowLevelSecurityRole["AUTHENTICATED"] = "authenticated";
+})(RowLevelSecurityRole || (exports.RowLevelSecurityRole = RowLevelSecurityRole = {}));
+//# sourceMappingURL=row-level-security-role.enum.js.map

package/dist/enums/row-level-security-role.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security-role.enum.js","sourceRoot":"","sources":["../../src/enums/row-level-security-role.enum.ts"],"names":[],"mappings":";;;AAAA,kEAAkE;AAClE,IAAY,oBAKX;AALD,WAAY,oBAAoB;IAC9B,0DAA0D;IAC1D,+CAAuB,CAAA;IACvB,8CAA8C;IAC9C,uDAA+B,CAAA;AACjC,CAAC,EALW,oBAAoB,oCAApB,oBAAoB,QAK/B"}

package/dist/index.d.ts

@@ -1,9 +1,10 @@
 export * from "./decorators/policy.decorator";
 export * from "./enums/policy-command.enum";
 export * from "./enums/policy-mode.enum";
+export * from "./enums/row-level-security-role.enum";
 export * from "./interfaces";
-export * from "./row-level-security-context";
-export * from "./row-level-security-entity-manager";
+export * from "./row-level-security";
+export * from "./row-level-security-driver";
 export * from "./row-level-security-migration";
 export * from "./row-level-security-migration-generator";
 export * from "./utils";

package/dist/index.js

@@ -17,9 +17,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./decorators/policy.decorator"), exports);
 __exportStar(require("./enums/policy-command.enum"), exports);
 __exportStar(require("./enums/policy-mode.enum"), exports);
+__exportStar(require("./enums/row-level-security-role.enum"), exports);
 __exportStar(require("./interfaces"), exports);
-__exportStar(require("./row-level-security-context"), exports);
-__exportStar(require("./row-level-security-entity-manager"), exports);
+__exportStar(require("./row-level-security"), exports);
+__exportStar(require("./row-level-security-driver"), exports);
 __exportStar(require("./row-level-security-migration"), exports);
 __exportStar(require("./row-level-security-migration-generator"), exports);
 __exportStar(require("./utils"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gEAA8C;AAC9C,8DAA4C;AAC5C,2DAAyC;AACzC,+CAA6B;AAC7B,+DAA6C;AAC7C,sEAAoD;AACpD,iEAA+C;AAC/C,2EAAyD;AACzD,0CAAwB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gEAA8C;AAC9C,8DAA4C;AAC5C,2DAAyC;AACzC,uEAAqD;AACrD,+CAA6B;AAC7B,uDAAqC;AACrC,8DAA4C;AAC5C,iEAA+C;AAC/C,2EAAyD;AACzD,0CAAwB"}

package/dist/index.spec.js

@@ -36,35 +36,27 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const rowLevelSecurity = __importStar(require("."));
 const rowLevelSecurityUtils = __importStar(require("./utils"));
 describe("row level security package exports", () => {
-    afterEach(() => {
-        rowLevelSecurityUtils.setRowLevelSecurityOptions();
-    });
     it("exports the public package API", () => {
         expect(rowLevelSecurity.Policy).toBeDefined();
         expect(rowLevelSecurity.PolicyCommand.SELECT).toBe("select");
         expect(rowLevelSecurity.PolicyMode.PERMISSIVE).toBe("permissive");
-        expect(rowLevelSecurity.RowLevelSecurityContext).toBeDefined();
-        expect(rowLevelSecurity.RowLevelSecurityEntityManager).toBeDefined();
+        expect(rowLevelSecurity.RowLevelSecurity).toBeDefined();
+        expect(rowLevelSecurity.RowLevelSecurityMode.AUTO).toBe("auto");
+        expect(rowLevelSecurity.RowLevelSecurityRole.ANONYMOUS).toBe("anonymous");
+        expect(rowLevelSecurity.RowLevelSecurityConnection).toBeDefined();
+        expect(rowLevelSecurity.RowLevelSecurityDriver).toBeDefined();
         expect(rowLevelSecurity.RowLevelSecurityMigration).toBeDefined();
         expect(rowLevelSecurity.RowLevelSecurityMigrationGenerator).toBeDefined();
         expect(rowLevelSecurity.createPolicyUpSqlStatements).toBeDefined();
     });
     it("exports utility helpers", () => {
         expect(rowLevelSecurityUtils.assertIdentifier("valid_identifier")).toBe("valid_identifier");
-        expect(rowLevelSecurityUtils.DEFAULT_ROW_LEVEL_SECURITY_OPTIONS).toEqual({
-            anonymousRole: "anonymous",
-            authenticatedRole: "authenticated",
-        });
         expect(rowLevelSecurityUtils.createPolicyBootstrapSqlStatements()).toEqual(expect.arrayContaining(["create schema if not exists app;"]));
+        expect(rowLevelSecurityUtils.createPolicyRoleUpSqlStatements()).toEqual(expect.arrayContaining(["grant anonymous to current_user;"]));
     });
     it("exports migration generator types", () => {
         const diff = { down: [], up: [] };
         expect(diff).toEqual({ down: [], up: [] });
     });
-    it("returns a copy of process-level options", () => {
-        const options = rowLevelSecurityUtils.getRowLevelSecurityOptions();
-        options.authenticatedRole = "mutated";
-        expect(rowLevelSecurityUtils.getRowLevelSecurityOptions().authenticatedRole).toBe("authenticated");
-    });
 });
 //# sourceMappingURL=index.spec.js.map

package/dist/index.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.spec.js","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oDAAsC;AACtC,+DAAiD;AAEjD,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,SAAS,CAAC,GAAG,EAAE;QACb,qBAAqB,CAAC,0BAA0B,EAAE,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,CAAC,gBAAgB,CAAC,uBAAuB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/D,MAAM,CAAC,gBAAgB,CAAC,6BAA6B,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACrE,kBAAkB,CACnB,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,kCAAkC,CAAC,CAAC,OAAO,CAAC;YACvE,aAAa,EAAE,WAAW;YAC1B,iBAAiB,EAAE,eAAe;SACnC,CAAC,CAAC;QACH,MAAM,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,OAAO,CACxE,MAAM,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAEjD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,OAAO,GAAG,qBAAqB,CAAC,0BAA0B,EAAE,CAAC;QAEnE,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC;QAEtC,MAAM,CACJ,qBAAqB,CAAC,0BAA0B,EAAE,CAAC,iBAAiB,CACrE,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.spec.js","sourceRoot":"","sources":["../src/index.spec.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,oDAAsC;AACtC,+DAAiD;AAEjD,QAAQ,CAAC,oCAAoC,EAAE,GAAG,EAAE;IAClD,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9C,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7D,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAClE,MAAM,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,CAAC,gBAAgB,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1E,MAAM,CAAC,gBAAgB,CAAC,0BAA0B,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,MAAM,CAAC,gBAAgB,CAAC,sBAAsB,CAAC,CAAC,WAAW,EAAE,CAAC;QAC9D,MAAM,CAAC,gBAAgB,CAAC,yBAAyB,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,CAAC,gBAAgB,CAAC,kCAAkC,CAAC,CAAC,WAAW,EAAE,CAAC;QAC1E,MAAM,CAAC,gBAAgB,CAAC,2BAA2B,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,CAAC,qBAAqB,CAAC,gBAAgB,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CACrE,kBAAkB,CACnB,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,kCAAkC,EAAE,CAAC,CAAC,OAAO,CACxE,MAAM,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAC7D,CAAC;QACF,MAAM,CAAC,qBAAqB,CAAC,+BAA+B,EAAE,CAAC,CAAC,OAAO,CACrE,MAAM,CAAC,eAAe,CAAC,CAAC,kCAAkC,CAAC,CAAC,CAC7D,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,IAAI,GAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC;QAEjD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/interfaces/index.d.ts

@@ -2,4 +2,3 @@ export * from "./policy-metadata.interface";
 export * from "./policy-options.interface";
 export * from "./policy-sql-options.interface";
 export type { MigrationDiff } from "./row-level-security-migration-generator.interface";
-export * from "./row-level-security-options.interface";

package/dist/interfaces/index.js

@@ -17,5 +17,4 @@ Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./policy-metadata.interface"), exports);
 __exportStar(require("./policy-options.interface"), exports);
 __exportStar(require("./policy-sql-options.interface"), exports);
-__exportStar(require("./row-level-security-options.interface"), exports);
 //# sourceMappingURL=index.js.map

package/dist/interfaces/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/interfaces/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,6DAA2C;AAC3C,iEAA+C;AAE/C,yEAAuD"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/interfaces/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8DAA4C;AAC5C,6DAA2C;AAC3C,iEAA+C"}

package/dist/interfaces/policy-options.interface.d.ts

@@ -12,9 +12,9 @@ export interface PolicyOptions {
     property?: string;
     /** Row-level security context key read through `app.get_context`. */
     context?: string;
-    /** Explicit `USING` expression. Overrides the generated predicate when provided. */
+    /** Explicit `USING` expression. Overrides the generated predicate when provided. Raw expressions are parenthesized in generated SQL. */
     using?: string;
-    /** Explicit `WITH CHECK` expression. Overrides the generated predicate when provided. */
+    /** Explicit `WITH CHECK` expression. Overrides the generated predicate when provided. Raw expressions are parenthesized in generated SQL. */
     withCheck?: string;
     /** Database roles to which the policy applies. Empty or omitted means no role restriction. */
     roles?: string[];

package/dist/interfaces/policy-sql-options.interface.d.ts

@@ -12,9 +12,9 @@ export interface PolicySqlOptions {
     mode?: PolicyMode;
     /** PostgreSQL command covered by the policy. Defaults to {@link PolicyCommand.ALL}. */
     command?: PolicyCommand;
-    /** SQL expression emitted as the policy `USING` predicate. */
+    /** SQL expression emitted as the policy `USING` predicate. Raw expressions are parenthesized in generated SQL. */
     using?: string;
-    /** SQL expression emitted as the policy `WITH CHECK` predicate. */
+    /** SQL expression emitted as the policy `WITH CHECK` predicate. Raw expressions are parenthesized in generated SQL. */
     withCheck?: string;
     /** Database roles to which the generated policy applies. */
     roles?: string[];

package/dist/row-level-security-driver.d.ts

@@ -0,0 +1,15 @@
+import type { AnyEntity, Configuration, EntityData, LoggingOptions, QueryResult, Transaction } from "@mikro-orm/core";
+import { AbstractSqlDriver, Knex, PostgreSqlConnection } from "@mikro-orm/postgresql";
+/** PostgreSQL connection that applies RLS role and context at SQL execution time. */
+export declare class RowLevelSecurityConnection extends PostgreSqlConnection {
+    /** Applies row level security setup before delegating SQL execution to MikroORM. */
+    execute<T extends QueryResult | EntityData<AnyEntity> | EntityData<AnyEntity>[] = EntityData<AnyEntity>[]>(queryOrKnex: string | Knex.QueryBuilder | Knex.Raw, params?: unknown[], method?: "all" | "get" | "run", ctx?: Transaction, loggerContext?: LoggingOptions): Promise<T>;
+    private runInTransactionQueue;
+    private configureRowLevelSecurity;
+    private clearRowLevelSecurity;
+}
+/** MikroORM PostgreSQL driver that applies row level security per SQL query. */
+export declare class RowLevelSecurityDriver extends AbstractSqlDriver<RowLevelSecurityConnection> {
+    /** Creates a PostgreSQL driver using the row level security connection. */
+    constructor(config: Configuration);
+}

package/dist/row-level-security-driver.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RowLevelSecurityDriver = exports.RowLevelSecurityConnection = void 0;
+const postgresql_1 = require("@mikro-orm/postgresql");
+const create_row_level_security_transaction_setup_1 = require("./utils/create-row-level-security-transaction-setup");
+const ROW_LEVEL_SECURITY_TRANSACTION_SIGNATURE = Symbol("rowLevelSecurityTransactionSignature");
+const ROW_LEVEL_SECURITY_TRANSACTION_CONTEXT_KEYS = Symbol("rowLevelSecurityTransactionContextKeys");
+const ROW_LEVEL_SECURITY_TRANSACTION_QUEUE = Symbol("rowLevelSecurityTransactionQueue");
+/** PostgreSQL connection that applies RLS role and context at SQL execution time. */
+class RowLevelSecurityConnection extends postgresql_1.PostgreSqlConnection {
+    /** Applies row level security setup before delegating SQL execution to MikroORM. */
+    async execute(queryOrKnex, params = [], method = "all", ctx, loggerContext) {
+        const setup = (0, create_row_level_security_transaction_setup_1.createRowLevelSecurityTransactionSetup)();
+        const transactionContext = getTransactionContext(queryOrKnex, ctx);
+        if (transactionContext) {
+            return await this.runInTransactionQueue(transactionContext.state, async () => {
+                await this.configureRowLevelSecurity(transactionContext.state, transactionContext.execution, setup, loggerContext);
+                return await super.execute(queryOrKnex, params, method, transactionContext.execution, loggerContext);
+            });
+        }
+        if (!setup || setup.action === "clear") {
+            return await super.execute(queryOrKnex, params, method, ctx, loggerContext);
+        }
+        return await this.transactional(async (trx) => {
+            const transactionState = trx;
+            return await this.runInTransactionQueue(transactionState, async () => {
+                await this.configureRowLevelSecurity(transactionState, trx, setup, loggerContext);
+                return await super.execute(queryOrKnex, params, method, trx, loggerContext);
+            });
+        }, {
+            loggerContext,
+        });
+    }
+    async runInTransactionQueue(transactionState, callback) {
+        const previous = transactionState[ROW_LEVEL_SECURITY_TRANSACTION_QUEUE];
+        let release = () => {
+            return;
+        };
+        const current = new Promise((resolve) => {
+            release = resolve;
+        });
+        const queued = (previous ?? Promise.resolve()).then(() => current, () => current);
+        transactionState[ROW_LEVEL_SECURITY_TRANSACTION_QUEUE] = queued;
+        await previous?.catch(() => undefined);
+        try {
+            return await callback();
+        }
+        finally {
+            release();
+            if (transactionState[ROW_LEVEL_SECURITY_TRANSACTION_QUEUE] === queued) {
+                transactionState[ROW_LEVEL_SECURITY_TRANSACTION_QUEUE] = undefined;
+            }
+        }
+    }
+    async configureRowLevelSecurity(transactionState, ctx, setup, loggerContext) {
+        if (!setup) {
+            await this.clearRowLevelSecurity(transactionState, ctx, loggerContext);
+            return;
+        }
+        if (setup.action === "clear") {
+            await this.clearRowLevelSecurity(transactionState, ctx, loggerContext);
+            return;
+        }
+        const staleContextKeys = getStaleContextKeys(transactionState[ROW_LEVEL_SECURITY_TRANSACTION_CONTEXT_KEYS] ?? [], setup.contextKeys);
+        const setupSql = [setup.sql, createClearContextSql(staleContextKeys)]
+            .filter(Boolean)
+            .join("\n");
+        if (transactionState[ROW_LEVEL_SECURITY_TRANSACTION_SIGNATURE] ===
+            setup.signature &&
+            staleContextKeys.length === 0) {
+            return;
+        }
+        await super.execute(setupSql, [], "run", ctx, loggerContext);
+        transactionState[ROW_LEVEL_SECURITY_TRANSACTION_SIGNATURE] =
+            setup.signature;
+        transactionState[ROW_LEVEL_SECURITY_TRANSACTION_CONTEXT_KEYS] = [
+            ...setup.contextKeys,
+        ];
+    }
+    async clearRowLevelSecurity(transactionState, ctx, loggerContext) {
+        const contextKeys = transactionState[ROW_LEVEL_SECURITY_TRANSACTION_CONTEXT_KEYS] ?? [];
+        if (!transactionState[ROW_LEVEL_SECURITY_TRANSACTION_SIGNATURE] &&
+            contextKeys.length === 0) {
+            return;
+        }
+        await super.execute([/* SQL */ "SET LOCAL ROLE NONE;", createClearContextSql(contextKeys)]
+            .filter(Boolean)
+            .join("\n"), [], "run", ctx, loggerContext);
+        transactionState[ROW_LEVEL_SECURITY_TRANSACTION_SIGNATURE] = undefined;
+        transactionState[ROW_LEVEL_SECURITY_TRANSACTION_CONTEXT_KEYS] = [];
+    }
+}
+exports.RowLevelSecurityConnection = RowLevelSecurityConnection;
+/** MikroORM PostgreSQL driver that applies row level security per SQL query. */
+class RowLevelSecurityDriver extends postgresql_1.AbstractSqlDriver {
+    /** Creates a PostgreSQL driver using the row level security connection. */
+    constructor(config) {
+        super(config, new postgresql_1.PostgreSqlPlatform(), RowLevelSecurityConnection, [
+            "knex",
+            "pg",
+        ]);
+    }
+}
+exports.RowLevelSecurityDriver = RowLevelSecurityDriver;
+function getTransactionContext(queryOrKnex, ctx) {
+    if (ctx) {
+        return {
+            state: ctx,
+            execution: ctx,
+        };
+    }
+    if (typeof queryOrKnex === "string") {
+        return undefined;
+    }
+    const knexQuery = queryOrKnex;
+    if (!knexQuery.client?.transacting) {
+        return undefined;
+    }
+    return {
+        state: knexQuery.client,
+        execution: queryOrKnex,
+    };
+}
+function getStaleContextKeys(previousKeys, nextKeys) {
+    const nextKeySet = new Set(nextKeys);
+    return previousKeys.filter((key) => !nextKeySet.has(key));
+}
+function createClearContextSql(contextKeys) {
+    if (contextKeys.length === 0) {
+        return "";
+    }
+    return `SELECT ${contextKeys
+        .map((key) => `set_config('app.${key}', '', true)`)
+        .join(",")};`;
+}
+//# sourceMappingURL=row-level-security-driver.js.map

package/dist/row-level-security-driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security-driver.js","sourceRoot":"","sources":["../src/row-level-security-driver.ts"],"names":[],"mappings":";;;AAQA,sDAK+B;AAE/B,qHAG6D;AAE7D,MAAM,wCAAwC,GAAG,MAAM,CACrD,sCAAsC,CACvC,CAAC;AACF,MAAM,2CAA2C,GAAG,MAAM,CACxD,wCAAwC,CACzC,CAAC;AACF,MAAM,oCAAoC,GAAG,MAAM,CACjD,kCAAkC,CACnC,CAAC;AAaF,qFAAqF;AACrF,MAAa,0BAA2B,SAAQ,iCAAoB;IAClE,oFAAoF;IAC3E,KAAK,CAAC,OAAO,CAIpB,WAAkD,EAClD,SAAoB,EAAE,EACtB,SAAgC,KAAK,EACrC,GAAiB,EACjB,aAA8B;QAE9B,MAAM,KAAK,GAAG,IAAA,oFAAsC,GAAE,CAAC;QACvD,MAAM,kBAAkB,GAAG,qBAAqB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAEnE,IAAI,kBAAkB,EAAE,CAAC;YACvB,OAAO,MAAM,IAAI,CAAC,qBAAqB,CACrC,kBAAkB,CAAC,KAAK,EACxB,KAAK,IAAI,EAAE;gBACT,MAAM,IAAI,CAAC,yBAAyB,CAClC,kBAAkB,CAAC,KAAK,EACxB,kBAAkB,CAAC,SAAS,EAC5B,KAAK,EACL,aAAa,CACd,CAAC;gBAEF,OAAO,MAAM,KAAK,CAAC,OAAO,CACxB,WAAW,EACX,MAAM,EACN,MAAM,EACN,kBAAkB,CAAC,SAAS,EAC5B,aAAa,CACd,CAAC;YACJ,CAAC,CACF,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACvC,OAAO,MAAM,KAAK,CAAC,OAAO,CACxB,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,EACH,aAAa,CACd,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,aAAa,CAC7B,KAAK,EAAE,GAAG,EAAE,EAAE;YACZ,MAAM,gBAAgB,GAAG,GAAuC,CAAC;YAEjE,OAAO,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,KAAK,IAAI,EAAE;gBACnE,MAAM,IAAI,CAAC,yBAAyB,CAClC,gBAAgB,EAChB,GAAG,EACH,KAAK,EACL,aAAa,CACd,CAAC;gBAEF,OAAO,MAAM,KAAK,CAAC,OAAO,CACxB,WAAW,EACX,MAAM,EACN,MAAM,EACN,GAAG,EACH,aAAa,CACd,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC,EACD;YACE,aAAa;SACd,CACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,gBAAkD,EAClD,QAA0B;QAE1B,MAAM,QAAQ,GAAG,gBAAgB,CAAC,oCAAoC,CAAC,CAAC;QACxE,IAAI,OAAO,GAAe,GAAG,EAAE;YAC7B,OAAO;QACT,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5C,OAAO,GAAG,OAAO,CAAC;QACpB,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CACjD,GAAG,EAAE,CAAC,OAAO,EACb,GAAG,EAAE,CAAC,OAAO,CACd,CAAC;QAEF,gBAAgB,CAAC,oCAAoC,CAAC,GAAG,MAAM,CAAC;QAChE,MAAM,QAAQ,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,CAAC;YACH,OAAO,MAAM,QAAQ,EAAE,CAAC;QAC1B,CAAC;gBAAS,CAAC;YACT,OAAO,EAAE,CAAC;YAEV,IAAI,gBAAgB,CAAC,oCAAoC,CAAC,KAAK,MAAM,EAAE,CAAC;gBACtE,gBAAgB,CAAC,oCAAoC,CAAC,GAAG,SAAS,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB,CACrC,gBAAkD,EAClD,GAAgB,EAChB,KAAmD,EACnD,aAA8B;QAE9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,CAAC,qBAAqB,CAAC,gBAAgB,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;YACvE,OAAO;QACT,CAAC;QAED,MAAM,gBAAgB,GAAG,mBAAmB,CAC1C,gBAAgB,CAAC,2CAA2C,CAAC,IAAI,EAAE,EACnE,KAAK,CAAC,WAAW,CAClB,CAAC;QACF,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;aAClE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,IACE,gBAAgB,CAAC,wCAAwC,CAAC;YACxD,KAAK,CAAC,SAAS;YACjB,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAC7B,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,aAAa,CAAC,CAAC;QAC7D,gBAAgB,CAAC,wCAAwC,CAAC;YACxD,KAAK,CAAC,SAAS,CAAC;QAClB,gBAAgB,CAAC,2CAA2C,CAAC,GAAG;YAC9D,GAAG,KAAK,CAAC,WAAW;SACrB,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,qBAAqB,CACjC,gBAAkD,EAClD,GAAgB,EAChB,aAA8B;QAE9B,MAAM,WAAW,GACf,gBAAgB,CAAC,2CAA2C,CAAC,IAAI,EAAE,CAAC;QAEtE,IACE,CAAC,gBAAgB,CAAC,wCAAwC,CAAC;YAC3D,WAAW,CAAC,MAAM,KAAK,CAAC,EACxB,CAAC;YACD,OAAO;QACT,CAAC;QAED,MAAM,KAAK,CAAC,OAAO,CACjB,CAAC,SAAS,CAAC,sBAAsB,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC;aACnE,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,EACb,EAAE,EACF,KAAK,EACL,GAAG,EACH,aAAa,CACd,CAAC;QACF,gBAAgB,CAAC,wCAAwC,CAAC,GAAG,SAAS,CAAC;QACvE,gBAAgB,CAAC,2CAA2C,CAAC,GAAG,EAAE,CAAC;IACrE,CAAC;CACF;AA3KD,gEA2KC;AAED,gFAAgF;AAChF,MAAa,sBAAuB,SAAQ,8BAA6C;IACvF,2EAA2E;IAC3E,YAAY,MAAqB;QAC/B,KAAK,CAAC,MAAM,EAAE,IAAI,+BAAkB,EAAE,EAAE,0BAA0B,EAAE;YAClE,MAAM;YACN,IAAI;SACL,CAAC,CAAC;IACL,CAAC;CACF;AARD,wDAQC;AAED,SAAS,qBAAqB,CAC5B,WAAoB,EACpB,GAAY;IAEZ,IAAI,GAAG,EAAE,CAAC;QACR,OAAO;YACL,KAAK,EAAE,GAAuC;YAC9C,SAAS,EAAE,GAAkB;SAC9B,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,SAAS,GAAG,WAIjB,CAAC;IAEF,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,WAAW,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,MAA0C;QAC3D,SAAS,EAAE,WAA0B;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,YAAsB,EAAE,QAAkB;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAErC,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAqB;IAClD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO,UAAU,WAAW;SACzB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,mBAAmB,GAAG,cAAc,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAClB,CAAC"}

package/dist/row-level-security-driver.spec.js

@@ -0,0 +1,267 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const postgresql_1 = require("@mikro-orm/postgresql");
+const request_context_1 = require("@nest-boot/request-context");
+const row_level_security_1 = require("./row-level-security");
+const row_level_security_driver_1 = require("./row-level-security-driver");
+describe("RowLevelSecurityDriver", () => {
+    afterEach(() => {
+        jest.restoreAllMocks();
+    });
+    it("delegates unchanged outside RequestContext by default", async () => {
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn();
+        const connection = createConnection({ transactional });
+        const result = await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, "select original", [], "all");
+        expect(result).toBe("query-result");
+        expect(transactional).not.toHaveBeenCalled();
+        expect(executeSpy).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenCalledWith("select original", [], "all", undefined, undefined);
+    });
+    it("delegates unchanged inside RequestContext when no row level security context is set", async () => {
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn();
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "job" }), async () => {
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, "select original", [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).not.toHaveBeenCalled();
+        expect(executeSpy).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenCalledWith("select original", [], "all", undefined, undefined);
+    });
+    it("delegates unchanged when row level security mode is disabled", async () => {
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn();
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "job" }), async () => {
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.DISABLED);
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 7);
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, "select original", [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).not.toHaveBeenCalled();
+        expect(executeSpy).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenCalledWith("select original", [], "all", undefined, undefined);
+    });
+    it("clears transaction-local row level security before a disabled query", async () => {
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 7);
+            row_level_security_1.RowLevelSecurity.setContext("request_id", "abc");
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select scoped", [], "all", transaction);
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.DISABLED);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select disabled", [], "all", transaction);
+        });
+        expect(executeSpy).toHaveBeenNthCalledWith(3, "SET LOCAL ROLE NONE;\nSELECT set_config('app.tenant_id', '', true),set_config('app.request_id', '', true);", [], "run", transaction, undefined);
+        expect(executeSpy).toHaveBeenNthCalledWith(4, "select disabled", [], "all", transaction, undefined);
+    });
+    it("clears transaction-local row level security before a query without RequestContext", async () => {
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 7);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select scoped", [], "all", transaction);
+        });
+        await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select unscoped", [], "all", transaction);
+        expect(executeSpy).toHaveBeenNthCalledWith(3, "SET LOCAL ROLE NONE;\nSELECT set_config('app.tenant_id', '', true);", [], "run", transaction, undefined);
+        expect(executeSpy).toHaveBeenNthCalledWith(4, "select unscoped", [], "all", transaction, undefined);
+    });
+    it("applies anonymous row level security when mode is enabled without context values", async () => {
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transaction = {};
+        const transactional = jest.fn(async (cb) => {
+            return await cb(transaction);
+        });
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "http" }), async () => {
+            row_level_security_1.RowLevelSecurity.setMode(row_level_security_1.RowLevelSecurityMode.ENABLED);
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, "select original", [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenNthCalledWith(1, "SET LOCAL ROLE anonymous;", [], "run", transaction, undefined);
+    });
+    it("applies row level security on an existing transaction before executing the query", async () => {
+        const transaction = {};
+        const loggerContext = { label: "test" };
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("app_authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 42);
+            row_level_security_1.RowLevelSecurity.setContext("request_id", "abc");
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select original", ["value"], "all", transaction, loggerContext);
+        });
+        expect(result).toBe("query-result");
+        expect(executeSpy).toHaveBeenNthCalledWith(1, "SET LOCAL ROLE app_authenticated;\nSELECT set_config('app.tenant_id', '42', true),set_config('app.request_id', 'abc', true);", [], "run", transaction, loggerContext);
+        expect(executeSpy).toHaveBeenNthCalledWith(2, "select original", ["value"], "all", transaction, loggerContext);
+    });
+    it("opens a short transaction when executing a query outside an existing transaction", async () => {
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn(async (cb) => {
+            return await cb(transaction);
+        });
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 7);
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, "select original", [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenNthCalledWith(1, "SET LOCAL ROLE authenticated;\nSELECT set_config('app.tenant_id', '7', true);", [], "run", transaction, undefined);
+        expect(executeSpy).toHaveBeenNthCalledWith(2, "select original", [], "all", transaction, undefined);
+    });
+    it("reuses the transaction from a transacting Knex query builder", async () => {
+        const queryBuilder = {
+            client: {
+                transacting: true,
+            },
+        };
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn();
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, queryBuilder, [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).not.toHaveBeenCalled();
+        expect(executeSpy).toHaveBeenNthCalledWith(1, "SET LOCAL ROLE authenticated;", [], "run", queryBuilder, undefined);
+        expect(executeSpy).toHaveBeenNthCalledWith(2, queryBuilder, [], "all", queryBuilder, undefined);
+    });
+    it("tracks row level security state on the shared transaction client for Knex query builders", async () => {
+        const transactionClient = {
+            transacting: true,
+        };
+        const scopedQueryBuilder = {
+            client: transactionClient,
+        };
+        const unscopedQueryBuilder = {
+            client: transactionClient,
+        };
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 7);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), scopedQueryBuilder, [], "all");
+        });
+        await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), unscopedQueryBuilder, [], "all");
+        expect(executeSpy).toHaveBeenNthCalledWith(3, "SET LOCAL ROLE NONE;\nSELECT set_config('app.tenant_id', '', true);", [], "run", unscopedQueryBuilder, undefined);
+    });
+    it("opens a short transaction for a Knex query builder without a transaction", async () => {
+        const queryBuilder = {
+            client: {
+                transacting: false,
+            },
+        };
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        const transactional = jest.fn(async (cb) => {
+            return await cb(transaction);
+        });
+        const connection = createConnection({ transactional });
+        const result = await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(connection, queryBuilder, [], "all");
+        });
+        expect(result).toBe("query-result");
+        expect(transactional).toHaveBeenCalledTimes(1);
+        expect(executeSpy).toHaveBeenNthCalledWith(1, "SET LOCAL ROLE authenticated;", [], "run", transaction, undefined);
+        expect(executeSpy).toHaveBeenNthCalledWith(2, queryBuilder, [], "all", transaction, undefined);
+    });
+    it("reuses row level security setup on the same transaction until the context changes", async () => {
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 1);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select one", [], "all", transaction);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select two", [], "all", transaction);
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 2);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select three", [], "all", transaction);
+        });
+        const rlsQueries = executeSpy.mock.calls.filter(([query]) => typeof query === "string" && query.startsWith("SET LOCAL ROLE"));
+        expect(rlsQueries).toHaveLength(2);
+        expect(rlsQueries[0]?.[0]).toBe("SET LOCAL ROLE authenticated;\nSELECT set_config('app.tenant_id', '1', true);");
+        expect(rlsQueries[1]?.[0]).toBe("SET LOCAL ROLE authenticated;\nSELECT set_config('app.tenant_id', '2', true);");
+    });
+    it("clears removed context keys before reusing a transaction", async () => {
+        const transaction = {};
+        const executeSpy = mockPostgreSqlExecute("query-result");
+        await request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 1);
+            row_level_security_1.RowLevelSecurity.setContext("request_id", "abc");
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select one", [], "all", transaction);
+            row_level_security_1.RowLevelSecurity.clear();
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 2);
+            await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select two", [], "all", transaction);
+        });
+        const setupQueries = executeSpy.mock.calls
+            .map(([query]) => query)
+            .filter((query) => typeof query === "string" && query.startsWith("SET LOCAL"));
+        expect(setupQueries).toEqual([
+            "SET LOCAL ROLE authenticated;\nSELECT set_config('app.tenant_id', '1', true),set_config('app.request_id', 'abc', true);",
+            "SET LOCAL ROLE authenticated;\nSELECT set_config('app.tenant_id', '2', true);\nSELECT set_config('app.request_id', '', true);",
+        ]);
+    });
+    it("serializes setup and query execution on the same transaction", async () => {
+        const transaction = {};
+        const executionOrder = [];
+        let activeTenantId;
+        jest
+            .spyOn(postgresql_1.PostgreSqlConnection.prototype, "execute")
+            .mockImplementation(async (queryOrKnex) => {
+            if (typeof queryOrKnex === "string") {
+                if (queryOrKnex.startsWith("SET LOCAL ROLE")) {
+                    activeTenantId = queryOrKnex.includes("'1'") ? 1 : 2;
+                    executionOrder.push(`setup:${String(activeTenantId)}`);
+                    return undefined;
+                }
+                executionOrder.push(`${queryOrKnex}:${String(activeTenantId)}`);
+                return activeTenantId;
+            }
+            return undefined;
+        });
+        const firstQuery = request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 1);
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select one", [], "get", transaction);
+        });
+        const secondQuery = request_context_1.RequestContext.run(new request_context_1.RequestContext({ type: "test" }), async () => {
+            row_level_security_1.RowLevelSecurity.setRole("authenticated");
+            row_level_security_1.RowLevelSecurity.setContext("tenant_id", 2);
+            return await row_level_security_driver_1.RowLevelSecurityConnection.prototype.execute.call(createConnection(), "select two", [], "get", transaction);
+        });
+        await expect(Promise.all([firstQuery, secondQuery])).resolves.toEqual([
+            1, 2,
+        ]);
+        expect(executionOrder).toEqual([
+            "setup:1",
+            "select one:1",
+            "setup:2",
+            "select two:2",
+        ]);
+    });
+});
+function mockPostgreSqlExecute(result) {
+    return jest
+        .spyOn(postgresql_1.PostgreSqlConnection.prototype, "execute")
+        .mockImplementation(async (queryOrKnex) => {
+        return typeof queryOrKnex === "string" &&
+            queryOrKnex.startsWith("SET LOCAL ROLE")
+            ? undefined
+            : result;
+    });
+}
+function createConnection(overrides = {}) {
+    return Object.assign(Object.create(row_level_security_driver_1.RowLevelSecurityConnection.prototype), overrides);
+}
+//# sourceMappingURL=row-level-security-driver.spec.js.map

package/dist/row-level-security-driver.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"row-level-security-driver.spec.js","sourceRoot":"","sources":["../src/row-level-security-driver.spec.ts"],"names":[],"mappings":";;AAAA,sDAA6D;AAC7D,gEAA4D;AAE5D,6DAA8E;AAC9E,2EAAyE;AAEzE,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACpE,UAAU,EACV,iBAAiB,EACjB,EAAE,EACF,KAAK,CACN,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CACrC,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qFAAqF,EAAE,KAAK,IAAI,EAAE;QACnG,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACnC,KAAK,IAAI,EAAE;YACT,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,iBAAiB,EACjB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CACrC,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EACnC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,QAAQ,CAAC,CAAC;YACxD,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,iBAAiB,EACjB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,UAAU,CAAC,CAAC,oBAAoB,CACrC,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,SAAS,EACT,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;QACnF,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;YACxE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5C,qCAAgB,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEjD,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,eAAe,EACf,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;YAEF,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,QAAQ,CAAC,CAAC;YAExD,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,4GAA4G,EAC5G,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;YACxE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,eAAe,EACf,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,qEAAqE,EACrE,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAA6B,EAAE,EAAE;YACpE,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,yCAAoB,CAAC,OAAO,CAAC,CAAC;YAEvD,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,iBAAiB,EACjB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,2BAA2B,EAC3B,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YAC7C,qCAAgB,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEjD,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,gBAAgB,EAAE,EAClB,iBAAiB,EACjB,CAAC,OAAO,CAAC,EACT,KAAK,EACL,WAAW,EACX,aAAa,CACd,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,8HAA8H,EAC9H,EAAE,EACF,KAAK,EACL,WAAW,EACX,aAAa,CACd,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,iBAAiB,EACjB,CAAC,OAAO,CAAC,EACT,KAAK,EACL,WAAW,EACX,aAAa,CACd,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAA6B,EAAE,EAAE;YACpE,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,iBAAiB,EACjB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,+EAA+E,EAC/E,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,iBAAiB,EACjB,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,YAAY,GAAG;YACnB,MAAM,EAAE;gBACN,WAAW,EAAE,IAAI;aAClB;SACF,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAE1C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,YAAmB,EACnB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAC7C,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,+BAA+B,EAC/B,EAAE,EACF,KAAK,EACL,YAAY,EACZ,SAAS,CACV,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,YAAY,EACZ,EAAE,EACF,KAAK,EACL,YAAY,EACZ,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,iBAAiB,GAAG;YACxB,WAAW,EAAE,IAAI;SAClB,CAAC;QACF,MAAM,kBAAkB,GAAG;YACzB,MAAM,EAAE,iBAAiB;SAC1B,CAAC;QACF,MAAM,oBAAoB,GAAG;YAC3B,MAAM,EAAE,iBAAiB;SAC1B,CAAC;QACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;YACxE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,kBAAyB,EACzB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,oBAA2B,EAC3B,EAAE,EACF,KAAK,CACN,CAAC;QAEF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,qEAAqE,EACrE,EAAE,EACF,KAAK,EACL,oBAAoB,EACpB,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,YAAY,GAAG;YACnB,MAAM,EAAE;gBACN,WAAW,EAAE,KAAK;aACnB;SACF,CAAC;QACF,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QACzD,MAAM,aAAa,GAAG,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,EAA6B,EAAE,EAAE;YACpE,OAAO,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,MAAM,gCAAc,CAAC,GAAG,CACrC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAE1C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,UAAU,EACV,YAAmB,EACnB,EAAE,EACF,KAAK,CACN,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,aAAa,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAAC;QAC/C,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,+BAA+B,EAC/B,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,uBAAuB,CACxC,CAAC,EACD,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,EACX,SAAS,CACV,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;YACxE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;YACF,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;YAEF,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,cAAc,EACd,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAC7C,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CACV,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAClE,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7B,+EAA+E,CAChF,CAAC;QACF,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAC7B,+EAA+E,CAChF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,KAAK,IAAI,EAAE;QACxE,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;QAEzD,MAAM,gCAAc,CAAC,GAAG,CAAC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,IAAI,EAAE;YACxE,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAC5C,qCAAgB,CAAC,UAAU,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YAEjD,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;YAEF,qCAAgB,CAAC,KAAK,EAAE,CAAC;YACzB,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CACrD,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,KAAK;aACvC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC;aACvB,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,CACtE,CAAC;QAEJ,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC;YAC3B,yHAAyH;YACzH,+HAA+H;SAChI,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,KAAK,IAAI,EAAE;QAC5E,MAAM,WAAW,GAAG,EAAE,CAAC;QACvB,MAAM,cAAc,GAAa,EAAE,CAAC;QACpC,IAAI,cAAkC,CAAC;QAEvC,IAAI;aACD,KAAK,CAAC,iCAAoB,CAAC,SAAS,EAAE,SAAS,CAAC;aAChD,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YACxC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBACpC,IAAI,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;oBAC7C,cAAc,GAAG,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACrD,cAAc,CAAC,IAAI,CAAC,SAAS,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;oBAEvD,OAAO,SAAgB,CAAC;gBAC1B,CAAC;gBAED,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,IAAI,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAEhE,OAAO,cAAqB,CAAC;YAC/B,CAAC;YAED,OAAO,SAAgB,CAAC;QAC1B,CAAC,CAAC,CAAC;QAEL,MAAM,UAAU,GAAG,gCAAc,CAAC,GAAG,CACnC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CACF,CAAC;QACF,MAAM,WAAW,GAAG,gCAAc,CAAC,GAAG,CACpC,IAAI,gCAAc,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EACpC,KAAK,IAAI,EAAE;YACT,qCAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC1C,qCAAgB,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAE5C,OAAO,MAAM,sDAA0B,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAC5D,gBAAgB,EAAE,EAClB,YAAY,EACZ,EAAE,EACF,KAAK,EACL,WAAW,CACZ,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;YACpE,CAAC,EAAE,CAAC;SACL,CAAC,CAAC;QACH,MAAM,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC;YAC7B,SAAS;YACT,cAAc;YACd,SAAS;YACT,cAAc;SACf,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,SAAS,qBAAqB,CAAC,MAAe;IAC5C,OAAO,IAAI;SACR,KAAK,CAAC,iCAAoB,CAAC,SAAS,EAAE,SAAS,CAAC;SAChD,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;QACxC,OAAO,OAAO,WAAW,KAAK,QAAQ;YACpC,WAAW,CAAC,UAAU,CAAC,gBAAgB,CAAC;YACxC,CAAC,CAAE,SAAiB;YACpB,CAAC,CAAE,MAAc,CAAC;IACtB,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAqC,EAAE;IAC/D,OAAO,MAAM,CAAC,MAAM,CAClB,MAAM,CAAC,MAAM,CAAC,sDAA0B,CAAC,SAAS,CAAC,EACnD,SAAS,CACoB,CAAC;AAClC,CAAC"}