@nest-boot/row-level-security 8.0.0-beta.0 → 8.0.0-beta.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/decorators/policy.decorator.d.ts +0 -10
- package/dist/decorators/policy.decorator.js +0 -10
- package/dist/decorators/policy.decorator.js.map +1 -1
- package/dist/enums/policy-command.enum.d.ts +0 -6
- package/dist/enums/policy-command.enum.js +0 -6
- package/dist/enums/policy-command.enum.js.map +1 -1
- package/dist/enums/policy-mode.enum.d.ts +0 -3
- package/dist/enums/policy-mode.enum.js +0 -3
- package/dist/enums/policy-mode.enum.js.map +1 -1
- package/dist/enums/row-level-security-role.enum.d.ts +0 -3
- package/dist/enums/row-level-security-role.enum.js +0 -3
- package/dist/enums/row-level-security-role.enum.js.map +1 -1
- package/dist/interfaces/policy-metadata.interface.d.ts +0 -28
- package/dist/interfaces/policy-options.interface.d.ts +0 -9
- package/dist/interfaces/policy-sql-options.interface.d.ts +0 -9
- package/dist/interfaces/row-level-security-migration-generator.interface.d.ts +1 -5
- package/dist/row-level-security-driver.d.ts +2 -5
- package/dist/row-level-security-driver.js +5 -6
- package/dist/row-level-security-driver.js.map +1 -1
- package/dist/row-level-security-migration-generator.d.ts +0 -2
- package/dist/row-level-security-migration-generator.js +4 -4
- package/dist/row-level-security-migration-generator.js.map +1 -1
- package/dist/row-level-security-migration.d.ts +0 -3
- package/dist/row-level-security-migration.js +0 -3
- package/dist/row-level-security-migration.js.map +1 -1
- package/dist/row-level-security-migrator.d.ts +3 -5
- package/dist/row-level-security-migrator.js +4 -8
- package/dist/row-level-security-migrator.js.map +1 -1
- package/dist/row-level-security.d.ts +0 -13
- package/dist/row-level-security.js +0 -13
- package/dist/row-level-security.js.map +1 -1
- package/dist/utils/assert-identifier.d.ts +0 -1
- package/dist/utils/assert-identifier.js +0 -1
- package/dist/utils/assert-identifier.js.map +1 -1
- package/dist/utils/assert-snake-case.d.ts +0 -1
- package/dist/utils/assert-snake-case.js +0 -1
- package/dist/utils/assert-snake-case.js.map +1 -1
- package/dist/utils/create-policy-bootstrap-sql-statements.d.ts +0 -1
- package/dist/utils/create-policy-bootstrap-sql-statements.js +0 -1
- package/dist/utils/create-policy-bootstrap-sql-statements.js.map +1 -1
- package/dist/utils/create-policy-down-sql.d.ts +0 -1
- package/dist/utils/create-policy-down-sql.js +1 -2
- package/dist/utils/create-policy-down-sql.js.map +1 -1
- package/dist/utils/create-policy-privilege-down-sql-statements.d.ts +0 -6
- package/dist/utils/create-policy-privilege-down-sql-statements.js +1 -7
- package/dist/utils/create-policy-privilege-down-sql-statements.js.map +1 -1
- package/dist/utils/create-policy-role-sql-statements.d.ts +0 -3
- package/dist/utils/create-policy-role-sql-statements.js +0 -4
- package/dist/utils/create-policy-role-sql-statements.js.map +1 -1
- package/dist/utils/create-policy-up-sql-statements.d.ts +0 -1
- package/dist/utils/create-policy-up-sql-statements.js +1 -2
- package/dist/utils/create-policy-up-sql-statements.js.map +1 -1
- package/dist/utils/create-row-level-security-transaction-setup.d.ts +0 -9
- package/dist/utils/create-row-level-security-transaction-setup.js +1 -2
- package/dist/utils/create-row-level-security-transaction-setup.js.map +1 -1
- package/dist/utils/escape-sql-literal.d.ts +0 -1
- package/dist/utils/escape-sql-literal.js +0 -1
- package/dist/utils/escape-sql-literal.js.map +1 -1
- package/dist/utils/is-postgres-keyword-requiring-quote.js +0 -2
- package/dist/utils/is-postgres-keyword-requiring-quote.js.map +1 -1
- package/dist/utils/quote-identifier.d.ts +0 -1
- package/dist/utils/quote-identifier.js +0 -1
- package/dist/utils/quote-identifier.js.map +1 -1
- package/dist/utils/quote-qualified-identifier.d.ts +0 -1
- package/dist/utils/quote-qualified-identifier.js +0 -1
- package/dist/utils/quote-qualified-identifier.js.map +1 -1
- package/dist/utils/row-level-security-context-builder.d.ts +0 -4
- package/dist/utils/row-level-security-context-builder.js +2 -6
- package/dist/utils/row-level-security-context-builder.js.map +1 -1
- package/dist/utils/row-level-security-context-builder.types.d.ts +0 -5
- package/package.json +32 -20
|
@@ -1,13 +1,11 @@
|
|
|
1
1
|
import type { MigrationResult, MikroORM } from "@mikro-orm/core";
|
|
2
|
-
import { Migrator } from "@mikro-orm/migrations";
|
|
3
|
-
|
|
4
|
-
export declare class RowLevelSecurityMigrator extends Migrator {
|
|
5
|
-
/** Registers the RLS-aware migrator extension with a MikroORM instance. */
|
|
2
|
+
import { Migrator as BaseMigrator } from "@mikro-orm/migrations";
|
|
3
|
+
declare class Migrator extends BaseMigrator {
|
|
6
4
|
static register(orm: MikroORM): void;
|
|
7
5
|
create(path?: string, blank?: boolean, initial?: boolean, name?: string): Promise<MigrationResult>;
|
|
8
|
-
/** Checks whether schema or RLS policy changes require a new migration. */
|
|
9
6
|
checkSchema(): Promise<boolean>;
|
|
10
7
|
private hasPendingPolicyChanges;
|
|
11
8
|
private getRowLevelSecurityGenerator;
|
|
12
9
|
private getInternals;
|
|
13
10
|
}
|
|
11
|
+
export { Migrator as RowLevelSecurityMigrator };
|
|
@@ -1,10 +1,8 @@
|
|
|
1
|
-
import { Migrator } from "@mikro-orm/migrations";
|
|
1
|
+
import { Migrator as BaseMigrator } from "@mikro-orm/migrations";
|
|
2
2
|
import { RowLevelSecurityMigrationGenerator } from "./row-level-security-migration-generator.js";
|
|
3
|
-
|
|
4
|
-
export class RowLevelSecurityMigrator extends Migrator {
|
|
5
|
-
/** Registers the RLS-aware migrator extension with a MikroORM instance. */
|
|
3
|
+
class Migrator extends BaseMigrator {
|
|
6
4
|
static register(orm) {
|
|
7
|
-
orm.config.registerExtension("@mikro-orm/migrator", () => new
|
|
5
|
+
orm.config.registerExtension("@mikro-orm/migrator", () => new Migrator(orm.em));
|
|
8
6
|
}
|
|
9
7
|
async create(path, blank = false, initial = false, name) {
|
|
10
8
|
if (initial) {
|
|
@@ -28,7 +26,6 @@ export class RowLevelSecurityMigrator extends Migrator {
|
|
|
28
26
|
diff,
|
|
29
27
|
};
|
|
30
28
|
}
|
|
31
|
-
/** Checks whether schema or RLS policy changes require a new migration. */
|
|
32
29
|
async checkSchema() {
|
|
33
30
|
const internals = this.getInternals();
|
|
34
31
|
const diff = await internals.getSchemaDiff(false, false);
|
|
@@ -39,8 +36,6 @@ export class RowLevelSecurityMigrator extends Migrator {
|
|
|
39
36
|
}
|
|
40
37
|
async hasPendingPolicyChanges(diff) {
|
|
41
38
|
const generator = this.getRowLevelSecurityGenerator();
|
|
42
|
-
// TODO: Support MikroORM snapshot mode by comparing generated policy state
|
|
43
|
-
// instead of only live database policies.
|
|
44
39
|
return generator ? await generator.hasPendingPolicyChanges(diff) : false;
|
|
45
40
|
}
|
|
46
41
|
getRowLevelSecurityGenerator() {
|
|
@@ -53,4 +48,5 @@ export class RowLevelSecurityMigrator extends Migrator {
|
|
|
53
48
|
return this;
|
|
54
49
|
}
|
|
55
50
|
}
|
|
51
|
+
export { Migrator as RowLevelSecurityMigrator };
|
|
56
52
|
//# sourceMappingURL=row-level-security-migrator.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"row-level-security-migrator.js","sourceRoot":"","sources":["../src/row-level-security-migrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"row-level-security-migrator.js","sourceRoot":"","sources":["../src/row-level-security-migrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAEjE,OAAO,EAAE,kCAAkC,EAAE,MAAM,6CAA6C,CAAC;AAoBjG,MAAM,QAAS,SAAQ,YAAY;IAEjC,MAAM,CAAU,QAAQ,CAAC,GAAa;QACpC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAC1B,qBAAqB,EACrB,GAAG,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,CAAC,EAAW,CAAC,CACpC,CAAC;IACJ,CAAC;IAEQ,KAAK,CAAC,MAAM,CACnB,IAAa,EACb,KAAK,GAAG,KAAK,EACb,OAAO,GAAG,KAAK,EACf,IAAa;QAEb,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,CAAC;QAE9C,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;QAE3D,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAE3D,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,gBAAgB,GAAG,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;YAElE,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QAEvE,MAAM,SAAS,CAAC,kBAAkB,EAAE,CAAC;QAErC,OAAO;YACL,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACtB,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;YAClB,IAAI;SACL,CAAC;IACJ,CAAC;IAGQ,KAAK,CAAC,WAAW;QACxB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAEzD,IAAI,IAAI,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC;IAClD,CAAC;IAEO,KAAK,CAAC,uBAAuB,CAAC,IAAmB;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAItD,OAAO,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,CAAC,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC3E,CAAC;IAEO,4BAA4B;QAClC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,SAAS,CAAC;QAEhD,OAAO,SAAS,YAAY,kCAAkC;YAC5D,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAEO,YAAY;QAClB,OAAO,IAAoC,CAAC;IAC9C,CAAC;CACF;AAID,OAAO,EAAE,QAAQ,IAAI,wBAAwB,EAAE,CAAC"}
|
|
@@ -1,29 +1,16 @@
|
|
|
1
1
|
import { RowLevelSecurityContextValue, SnakeCase } from "./utils/row-level-security-context-builder.types.js";
|
|
2
|
-
/** Request-scoped row-level security execution mode. */
|
|
3
2
|
export declare enum RowLevelSecurityMode {
|
|
4
|
-
/** Apply RLS only when a role or context value is present. */
|
|
5
3
|
AUTO = "auto",
|
|
6
|
-
/** Always apply RLS while request context is active. */
|
|
7
4
|
ENABLED = "enabled",
|
|
8
|
-
/** Never apply RLS, even when role or context values are present. */
|
|
9
5
|
DISABLED = "disabled"
|
|
10
6
|
}
|
|
11
|
-
/** Request-scoped row-level security mode, role, and context helpers. */
|
|
12
7
|
export declare class RowLevelSecurity {
|
|
13
|
-
/** Stores the row-level security mode for the current request context. */
|
|
14
8
|
static setMode(mode: RowLevelSecurityMode): void;
|
|
15
|
-
/** Reads the request-scoped row-level security mode. */
|
|
16
9
|
static getMode(): RowLevelSecurityMode;
|
|
17
|
-
/** Stores the database role that should be applied to the next RLS query. */
|
|
18
10
|
static setRole(role: string): void;
|
|
19
|
-
/** Reads the request-scoped database role, if one is active. */
|
|
20
11
|
static getRole(): string | undefined;
|
|
21
|
-
/** Stores a context value that will be converted to a PostgreSQL setting. */
|
|
22
12
|
static setContext<S extends string>(key: SnakeCase<S>, value: RowLevelSecurityContextValue): void;
|
|
23
|
-
/** Reads a request-scoped context value by key. */
|
|
24
13
|
static getContext<S extends string>(key: SnakeCase<S>): RowLevelSecurityContextValue;
|
|
25
|
-
/** Returns all request-scoped context entries for RLS transaction setup. */
|
|
26
14
|
static entries(): [string, RowLevelSecurityContextValue][];
|
|
27
|
-
/** Clears request-scoped RLS mode, role, and context values. */
|
|
28
15
|
static clear(): void;
|
|
29
16
|
}
|
|
@@ -2,57 +2,44 @@ import { RequestContext } from "@nest-boot/request-context";
|
|
|
2
2
|
const ROW_LEVEL_SECURITY_CONTEXT = Symbol("ROW_LEVEL_SECURITY_CONTEXT");
|
|
3
3
|
const ROW_LEVEL_SECURITY_MODE = Symbol("ROW_LEVEL_SECURITY_MODE");
|
|
4
4
|
const ROW_LEVEL_SECURITY_ROLE = Symbol("ROW_LEVEL_SECURITY_ROLE");
|
|
5
|
-
/** Request-scoped row-level security execution mode. */
|
|
6
5
|
export var RowLevelSecurityMode;
|
|
7
6
|
(function (RowLevelSecurityMode) {
|
|
8
|
-
/** Apply RLS only when a role or context value is present. */
|
|
9
7
|
RowLevelSecurityMode["AUTO"] = "auto";
|
|
10
|
-
/** Always apply RLS while request context is active. */
|
|
11
8
|
RowLevelSecurityMode["ENABLED"] = "enabled";
|
|
12
|
-
/** Never apply RLS, even when role or context values are present. */
|
|
13
9
|
RowLevelSecurityMode["DISABLED"] = "disabled";
|
|
14
10
|
})(RowLevelSecurityMode || (RowLevelSecurityMode = {}));
|
|
15
|
-
/** Request-scoped row-level security mode, role, and context helpers. */
|
|
16
11
|
export class RowLevelSecurity {
|
|
17
|
-
/** Stores the row-level security mode for the current request context. */
|
|
18
12
|
static setMode(mode) {
|
|
19
13
|
RequestContext.set(ROW_LEVEL_SECURITY_MODE, mode);
|
|
20
14
|
}
|
|
21
|
-
/** Reads the request-scoped row-level security mode. */
|
|
22
15
|
static getMode() {
|
|
23
16
|
return RequestContext.isActive()
|
|
24
17
|
? (RequestContext.get(ROW_LEVEL_SECURITY_MODE) ??
|
|
25
18
|
RowLevelSecurityMode.AUTO)
|
|
26
19
|
: RowLevelSecurityMode.AUTO;
|
|
27
20
|
}
|
|
28
|
-
/** Stores the database role that should be applied to the next RLS query. */
|
|
29
21
|
static setRole(role) {
|
|
30
22
|
RequestContext.set(ROW_LEVEL_SECURITY_ROLE, role);
|
|
31
23
|
}
|
|
32
|
-
/** Reads the request-scoped database role, if one is active. */
|
|
33
24
|
static getRole() {
|
|
34
25
|
return RequestContext.isActive()
|
|
35
26
|
? RequestContext.get(ROW_LEVEL_SECURITY_ROLE)
|
|
36
27
|
: undefined;
|
|
37
28
|
}
|
|
38
|
-
/** Stores a context value that will be converted to a PostgreSQL setting. */
|
|
39
29
|
static setContext(key, value) {
|
|
40
30
|
const context = RequestContext.getOrSet(ROW_LEVEL_SECURITY_CONTEXT, new Map());
|
|
41
31
|
context.set(key, value);
|
|
42
32
|
}
|
|
43
|
-
/** Reads a request-scoped context value by key. */
|
|
44
33
|
static getContext(key) {
|
|
45
34
|
return RequestContext.isActive()
|
|
46
35
|
? RequestContext.get(ROW_LEVEL_SECURITY_CONTEXT)?.get(key)
|
|
47
36
|
: undefined;
|
|
48
37
|
}
|
|
49
|
-
/** Returns all request-scoped context entries for RLS transaction setup. */
|
|
50
38
|
static entries() {
|
|
51
39
|
return RequestContext.isActive()
|
|
52
40
|
? Array.from(RequestContext.get(ROW_LEVEL_SECURITY_CONTEXT) ?? [])
|
|
53
41
|
: [];
|
|
54
42
|
}
|
|
55
|
-
/** Clears request-scoped RLS mode, role, and context values. */
|
|
56
43
|
static clear() {
|
|
57
44
|
if (!RequestContext.isActive()) {
|
|
58
45
|
return;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"row-level-security.js","sourceRoot":"","sources":["../src/row-level-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAS5D,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAClE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;
|
|
1
|
+
{"version":3,"file":"row-level-security.js","sourceRoot":"","sources":["../src/row-level-security.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAS5D,MAAM,0BAA0B,GAAG,MAAM,CAAC,4BAA4B,CAAC,CAAC;AACxE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAClE,MAAM,uBAAuB,GAAG,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAGlE,MAAM,CAAN,IAAY,oBAOX;AAPD,WAAY,oBAAoB;IAE9B,qCAAa,CAAA;IAEb,2CAAmB,CAAA;IAEnB,6CAAqB,CAAA;AACvB,CAAC,EAPW,oBAAoB,KAApB,oBAAoB,QAO/B;AAGD,MAAM,OAAO,gBAAgB;IAE3B,MAAM,CAAC,OAAO,CAAC,IAA0B;QACvC,cAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAGD,MAAM,CAAC,OAAO;QACZ,OAAO,cAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAuB,uBAAuB,CAAC;gBAChE,oBAAoB,CAAC,IAAI,CAAC;YAC9B,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC;IAChC,CAAC;IAGD,MAAM,CAAC,OAAO,CAAC,IAAY;QACzB,cAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;IACpD,CAAC;IAGD,MAAM,CAAC,OAAO;QACZ,OAAO,cAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,GAAG,CAAS,uBAAuB,CAAC;YACrD,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAGD,MAAM,CAAC,UAAU,CACf,GAAiB,EACjB,KAAmC;QAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,QAAQ,CACrC,0BAA0B,EAC1B,IAAI,GAAG,EAAE,CACV,CAAC;QAEF,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;IAGD,MAAM,CAAC,UAAU,CACf,GAAiB;QAEjB,OAAO,cAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,cAAc,CAAC,GAAG,CAChB,0BAA0B,CAC3B,EAAE,GAAG,CAAC,GAAG,CAAC;YACb,CAAC,CAAC,SAAS,CAAC;IAChB,CAAC;IAGD,MAAM,CAAC,OAAO;QACZ,OAAO,cAAc,CAAC,QAAQ,EAAE;YAC9B,CAAC,CAAC,KAAK,CAAC,IAAI,CACR,cAAc,CAAC,GAAG,CAChB,0BAA0B,CAC3B,IAAI,EAAE,CACR;YACH,CAAC,CAAC,EAAE,CAAC;IACT,CAAC;IAGD,MAAM,CAAC,KAAK;QACV,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QAED,cAAc,CAAC,GAAG,CAAC,uBAAuB,EAAE,oBAAoB,CAAC,IAAI,CAAC,CAAC;QACvE,cAAc,CAAC,GAAG,CAAqB,uBAAuB,EAAE,SAAS,CAAC,CAAC;QAC3E,cAAc,CAAC,GAAG,CAChB,0BAA0B,EAC1B,IAAI,GAAG,EAAE,CACV,CAAC;IACJ,CAAC;CACF"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"assert-identifier.js","sourceRoot":"","sources":["../../src/utils/assert-identifier.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"assert-identifier.js","sourceRoot":"","sources":["../../src/utils/assert-identifier.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,gBAAgB,CAAC,UAAkB;IACjD,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"assert-snake-case.js","sourceRoot":"","sources":["../../src/utils/assert-snake-case.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"assert-snake-case.js","sourceRoot":"","sources":["../../src/utils/assert-snake-case.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,KAAa;IAC1D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wBAAwB,KAAK,EAAE,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-policy-bootstrap-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-bootstrap-sql-statements.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"create-policy-bootstrap-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-bootstrap-sql-statements.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,kCAAkC;IAChD,OAAO,EAAE,CAAC;AACZ,CAAC"}
|
|
@@ -1,10 +1,9 @@
|
|
|
1
1
|
import { assertIdentifier } from "./assert-identifier.js";
|
|
2
2
|
import { quoteQualifiedIdentifier } from "./quote-qualified-identifier.js";
|
|
3
|
-
/** Creates guarded SQL for dropping a policy and disabling RLS when no policies remain. */
|
|
4
3
|
export function createPolicyDownSql(options) {
|
|
5
4
|
const tableIdentifier = quoteQualifiedIdentifier(options.schemaName, options.tableName);
|
|
6
5
|
const policyName = assertIdentifier(options.policyName);
|
|
7
|
-
return
|
|
6
|
+
return `
|
|
8
7
|
do $$
|
|
9
8
|
declare
|
|
10
9
|
policy_count integer;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-policy-down-sql.js","sourceRoot":"","sources":["../../src/utils/create-policy-down-sql.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"create-policy-down-sql.js","sourceRoot":"","sources":["../../src/utils/create-policy-down-sql.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAG3E,MAAM,UAAU,mBAAmB,CAAC,OAAyB;IAC3D,MAAM,eAAe,GAAG,wBAAwB,CAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAExD,OAAiB;;;;;oBAKC,eAAe;qCACE,UAAU,OAAO,eAAe;;;;0BAI3C,OAAO,CAAC,UAAU,sBAAsB,OAAO,CAAC,SAAS;;;6BAGtD,eAAe;;;;;CAK3C,CAAC,IAAI,EAAE,CAAC;AACT,CAAC"}
|
|
@@ -1,8 +1,2 @@
|
|
|
1
1
|
import type { PolicySqlOptions } from "../interfaces/policy-sql-options.interface.js";
|
|
2
|
-
/**
|
|
3
|
-
* Creates SQL that revokes table and sequence privileges emitted for a policy.
|
|
4
|
-
*
|
|
5
|
-
* Preserved policies keep overlapping privileges for the same schema, table,
|
|
6
|
-
* and role from being revoked during rollback.
|
|
7
|
-
*/
|
|
8
2
|
export declare function createPolicyPrivilegeDownSqlStatements(options: PolicySqlOptions, preservedPolicies?: PolicySqlOptions[]): string[];
|
|
@@ -2,12 +2,6 @@ import { PolicyCommand } from "../enums/policy-command.enum.js";
|
|
|
2
2
|
import { assertIdentifier } from "./assert-identifier.js";
|
|
3
3
|
import { escapeSqlLiteral } from "./escape-sql-literal.js";
|
|
4
4
|
import { quoteQualifiedIdentifier } from "./quote-qualified-identifier.js";
|
|
5
|
-
/**
|
|
6
|
-
* Creates SQL that revokes table and sequence privileges emitted for a policy.
|
|
7
|
-
*
|
|
8
|
-
* Preserved policies keep overlapping privileges for the same schema, table,
|
|
9
|
-
* and role from being revoked during rollback.
|
|
10
|
-
*/
|
|
11
5
|
export function createPolicyPrivilegeDownSqlStatements(options, preservedPolicies = []) {
|
|
12
6
|
const roles = getPolicySqlRoleNames(options.roles);
|
|
13
7
|
if (roles.length === 0) {
|
|
@@ -85,6 +79,6 @@ function createSequenceRevokeSql(options, tableIdentifier, roleSql) {
|
|
|
85
79
|
const tableLiteral = escapeSqlLiteral(tableIdentifier);
|
|
86
80
|
const schemaName = escapeSqlLiteral(options.schemaName);
|
|
87
81
|
const tableName = escapeSqlLiteral(options.tableName);
|
|
88
|
-
return
|
|
82
|
+
return `do $$ declare sequence_identifier text; begin for sequence_identifier in select pg_get_serial_sequence('${tableLiteral}', columns.column_name) from information_schema.columns where columns.table_schema = '${schemaName}' and columns.table_name = '${tableName}' and pg_get_serial_sequence('${tableLiteral}', columns.column_name) is not null loop execute format('revoke usage, select on sequence %s from ${roleSql}', sequence_identifier); end loop; end $$;`;
|
|
89
83
|
}
|
|
90
84
|
//# sourceMappingURL=create-policy-privilege-down-sql-statements.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-policy-privilege-down-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-privilege-down-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"create-policy-privilege-down-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-privilege-down-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAQ3E,MAAM,UAAU,sCAAsC,CACpD,OAAyB,EACzB,oBAAwC,EAAE;IAE1C,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAEnD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,eAAe,GAAG,wBAAwB,CAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,uCAAuC,CACxD,OAAO,EACP,eAAe,EACf,KAAK,EACL,iBAAiB,CAClB,CAAC;IAEF,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,mBAAmB,GAAG,KAAK,CAAC,MAAM,CACtC,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,8BAA8B,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CACpE,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnC,UAAU,CAAC,IAAI,CACb,uBAAuB,CACrB,OAAO,EACP,eAAe,EACf,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAC/B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,uCAAuC,CAC9C,OAAyB,EACzB,eAAuB,EACvB,KAAe,EACf,iBAAqC;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoB,CAAC;IAEtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,mBAAmB,GAAG,2BAA2B,CACrD,OAAO,EACP,IAAI,EACJ,iBAAiB,CAClB,CAAC;QACF,MAAM,mBAAmB,GAAG,UAAU,CAAC,MAAM,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,GAAG,CAAC,SAAS,CAAC,CACnD,CAAC;QAEF,IAAI,mBAAmB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,YAAY,GAAG,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,YAAY,GAAG,iBAAiB,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QAE/D,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,iBAAiB,CAAC,GAAG,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACpD,CAAC;IAED,OAAO,CAAC,GAAG,iBAAiB,CAAC,CAAC,GAAG,CAC/B,CAAC,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,EAAE,CAC/B,UAAU,YAAY,aAAa,eAAe,SAAS,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACxF,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAsB;IACxD,OAAO,OAAO,KAAK,aAAa,CAAC,MAAM,IAAI,OAAO,KAAK,aAAa,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IAErC,KAAK,MAAM,eAAe,IAAI,2BAA2B,CACvD,OAAO,EACP,IAAI,EACJ,iBAAiB,CAClB,EAAE,CAAC;QACF,KAAK,MAAM,SAAS,IAAI,kBAAkB,CACxC,eAAe,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAC7C,EAAE,CAAC;YACF,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,8BAA8B,CACrC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,OAAO,2BAA2B,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC,IAAI,CACvE,CAAC,eAAe,EAAE,EAAE,CAClB,0BAA0B,CAAC,eAAe,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,OAAyB,EACzB,IAAY,EACZ,iBAAqC;IAErC,OAAO,iBAAiB,CAAC,MAAM,CAC7B,CAAC,eAAe,EAAE,EAAE,CAClB,kBAAkB,CAAC,OAAO,EAAE,eAAe,CAAC;QAC5C,qBAAqB,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC9D,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAA2B;IACxD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAsB,EAAE,KAAuB;IACzE,OAAO,CACL,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAC3E,CAAC;AACJ,CAAC;AAED,SAAS,uBAAuB,CAC9B,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAiB,2GAA2G,YAAY,yFAAyF,UAAU,+BAA+B,SAAS,iCAAiC,YAAY,qGAAqG,OAAO,4CAA4C,CAAC;AAC3d,CAAC"}
|
|
@@ -1,6 +1,3 @@
|
|
|
1
|
-
/** Creates SQL for pre-created RLS roles. Roles are managed outside migrations. */
|
|
2
1
|
export declare function createPolicyRoleUpSqlStatements(roles?: Iterable<string>): never[];
|
|
3
|
-
/** Creates SQL for rolling back role bootstrap. Roles are managed outside migrations. */
|
|
4
2
|
export declare function createPolicyRoleDownSqlStatements(roles?: Iterable<string>): never[];
|
|
5
|
-
/** Returns unique policy roles, always including the anonymous fallback role. */
|
|
6
3
|
export declare function getPolicyRoleNames(roles?: Iterable<string>): string[];
|
|
@@ -1,22 +1,18 @@
|
|
|
1
1
|
import { RowLevelSecurityRole } from "../enums/row-level-security-role.enum.js";
|
|
2
2
|
import { assertIdentifier } from "./assert-identifier.js";
|
|
3
|
-
/** Creates SQL for pre-created RLS roles. Roles are managed outside migrations. */
|
|
4
3
|
export function createPolicyRoleUpSqlStatements(roles = []) {
|
|
5
4
|
getPolicyRoleNames(roles);
|
|
6
5
|
return [];
|
|
7
6
|
}
|
|
8
|
-
/** Creates SQL for rolling back role bootstrap. Roles are managed outside migrations. */
|
|
9
7
|
export function createPolicyRoleDownSqlStatements(roles = []) {
|
|
10
8
|
[...getExplicitPolicyRoleNames(roles)].sort();
|
|
11
9
|
return [];
|
|
12
10
|
}
|
|
13
|
-
/** Returns unique policy roles, always including the anonymous fallback role. */
|
|
14
11
|
export function getPolicyRoleNames(roles = []) {
|
|
15
12
|
const roleNames = getExplicitPolicyRoleNames(roles);
|
|
16
13
|
roleNames.delete(RowLevelSecurityRole.ANONYMOUS);
|
|
17
14
|
return [RowLevelSecurityRole.ANONYMOUS, ...[...roleNames].sort()];
|
|
18
15
|
}
|
|
19
|
-
/** Returns unique explicit policy roles without adding fallback roles. */
|
|
20
16
|
function getExplicitPolicyRoleNames(roles) {
|
|
21
17
|
const roleNames = new Set();
|
|
22
18
|
for (const role of roles) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-policy-role-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-role-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"create-policy-role-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-role-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,UAAU,+BAA+B,CAAC,QAA0B,EAAE;IAC1E,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAE1B,OAAO,EAAE,CAAC;AACZ,CAAC;AAGD,MAAM,UAAU,iCAAiC,CAC/C,QAA0B,EAAE;IAE5B,CAAC,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE9C,OAAO,EAAE,CAAC;AACZ,CAAC;AAGD,MAAM,UAAU,kBAAkB,CAAC,QAA0B,EAAE;IAC7D,MAAM,SAAS,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAEpD,SAAS,CAAC,MAAM,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAEjD,OAAO,CAAC,oBAAoB,CAAC,SAAS,EAAE,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAGD,SAAS,0BAA0B,CAAC,KAAuB;IACzD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;YACpC,SAAS;QACX,CAAC;QAED,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
|
@@ -3,7 +3,6 @@ import { PolicyMode } from "../enums/policy-mode.enum.js";
|
|
|
3
3
|
import { assertIdentifier } from "./assert-identifier.js";
|
|
4
4
|
import { escapeSqlLiteral } from "./escape-sql-literal.js";
|
|
5
5
|
import { quoteQualifiedIdentifier } from "./quote-qualified-identifier.js";
|
|
6
|
-
/** Creates SQL statements that enable RLS and recreate a PostgreSQL policy. */
|
|
7
6
|
export function createPolicyUpSqlStatements(options) {
|
|
8
7
|
const tableIdentifier = quoteQualifiedIdentifier(options.schemaName, options.tableName);
|
|
9
8
|
const policyName = assertIdentifier(options.policyName);
|
|
@@ -55,7 +54,7 @@ function createSequenceGrantSql(options, tableIdentifier, roleSql) {
|
|
|
55
54
|
const tableLiteral = escapeSqlLiteral(tableIdentifier);
|
|
56
55
|
const schemaName = escapeSqlLiteral(options.schemaName);
|
|
57
56
|
const tableName = escapeSqlLiteral(options.tableName);
|
|
58
|
-
return
|
|
57
|
+
return `do $$ declare sequence_identifier text; begin for sequence_identifier in select pg_get_serial_sequence('${tableLiteral}', columns.column_name) from information_schema.columns where columns.table_schema = '${schemaName}' and columns.table_name = '${tableName}' and pg_get_serial_sequence('${tableLiteral}', columns.column_name) is not null loop execute format('grant usage, select on sequence %s to ${roleSql}', sequence_identifier); end loop; end $$;`;
|
|
59
58
|
}
|
|
60
59
|
function getPolicyPredicates(options) {
|
|
61
60
|
const command = options.command ?? PolicyCommand.ALL;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-policy-up-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-up-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;
|
|
1
|
+
{"version":3,"file":"create-policy-up-sql-statements.js","sourceRoot":"","sources":["../../src/utils/create-policy-up-sql-statements.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,8BAA8B,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAC;AAG3E,MAAM,UAAU,2BAA2B,CAAC,OAAyB;IACnE,MAAM,eAAe,GAAG,wBAAwB,CAC9C,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,SAAS,CAClB,CAAC;IACF,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEhD,OAAO;QACL,eAAe,eAAe,6BAA6B;QAC3D,GAAG,iCAAiC,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC;QACvE,yBAAyB,UAAU,OAAO,eAAe,GAAG;QAC5D,iBAAiB,UAAU,OAAO,eAAe,OAAO,IAAI,QAAQ,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,GAAG;KAC/J,CAAC;AACJ,CAAC;AAED,SAAS,iCAAiC,CACxC,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG;QACjB,SAAS,UAAU,aAAa,eAAe,OAAO,OAAO,GAAG;KACjE,CAAC;IAEF,IAAI,0BAA0B,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,UAAU,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAsB;IAChD,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpB,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9B,CAAC;IAED,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,0BAA0B,CAAC,OAAsB;IACxD,OAAO,OAAO,KAAK,aAAa,CAAC,MAAM,IAAI,OAAO,KAAK,aAAa,CAAC,GAAG,CAAC;AAC3E,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAyB,EACzB,eAAuB,EACvB,OAAe;IAEf,MAAM,YAAY,GAAG,gBAAgB,CAAC,eAAe,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAEtD,OAAiB,2GAA2G,YAAY,yFAAyF,UAAU,+BAA+B,SAAS,iCAAiC,YAAY,kGAAkG,OAAO,4CAA4C,CAAC;AACxd,CAAC;AAED,SAAS,mBAAmB,CAAC,OAAyB;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC;IACrD,MAAM,UAAU,GAAG;QACjB,KAAK,EAAE,mBAAmB,CAAC,OAAO,CAAC,KAAK,CAAC;QACzC,SAAS,EAAE,mBAAmB,CAAC,OAAO,CAAC,SAAS,CAAC;KAClD,CAAC;IAEF,sBAAsB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAE5C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,mBAAmB,CAAC,UAA8B;IACzD,MAAM,UAAU,GAAG,UAAU,EAAE,IAAI,EAAE,CAAC;IAEtC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,sBAAsB,CAC7B,OAAsB,EACtB,UAAkD;IAElD,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzE,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,UAAU,CAAC,SAAS,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACrC,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;IACT,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAsB,EACtB,UAAkD;IAElD,MAAM,SAAS,GAAa,EAAE,CAAC;IAE/B,IAAI,OAAO,KAAK,aAAa,CAAC,MAAM,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACzD,SAAS,CAAC,IAAI,CAAC,SAAS,4BAA4B,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,IACE,OAAO,KAAK,aAAa,CAAC,MAAM;QAChC,OAAO,KAAK,aAAa,CAAC,MAAM;QAChC,UAAU,CAAC,SAAS,EACpB,CAAC;QACD,SAAS,CAAC,IAAI,CACZ,cAAc,4BAA4B,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CACnE,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,4BAA4B,CAAC,UAAkB;IACtD,OAAO,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,UAAU,GAAG,CAAC;AAChF,CAAC;AAED,SAAS,yBAAyB,CAAC,UAAkB;IACnD,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChE,CAAC"}
|
|
@@ -1,20 +1,11 @@
|
|
|
1
|
-
/** Instruction for row level security transaction setup. */
|
|
2
1
|
export type RowLevelSecurityTransactionSetup = RowLevelSecurityApplyTransactionSetup | RowLevelSecurityClearTransactionSetup;
|
|
3
|
-
/** SQL and cache key for applying row level security on a transaction. */
|
|
4
2
|
export interface RowLevelSecurityApplyTransactionSetup {
|
|
5
|
-
/** Applies row level security state to the transaction. */
|
|
6
3
|
action: "apply";
|
|
7
|
-
/** Transaction-local SQL that applies the PostgreSQL role and context settings. */
|
|
8
4
|
sql: string;
|
|
9
|
-
/** Stable cache key used to skip repeated setup on the same transaction. */
|
|
10
5
|
signature: string;
|
|
11
|
-
/** Context setting keys emitted by this setup. */
|
|
12
6
|
contextKeys: string[];
|
|
13
7
|
}
|
|
14
|
-
/** Instruction to clear previously applied row level security state. */
|
|
15
8
|
export interface RowLevelSecurityClearTransactionSetup {
|
|
16
|
-
/** Clears row level security state previously applied to the transaction. */
|
|
17
9
|
action: "clear";
|
|
18
10
|
}
|
|
19
|
-
/** Creates transaction-local SQL for the current row level security context. */
|
|
20
11
|
export declare function createRowLevelSecurityTransactionSetup(): RowLevelSecurityTransactionSetup | undefined;
|
|
@@ -3,7 +3,6 @@ import { RowLevelSecurityRole } from "../enums/row-level-security-role.enum.js";
|
|
|
3
3
|
import { RowLevelSecurity, RowLevelSecurityMode, } from "../row-level-security.js";
|
|
4
4
|
import { assertSnakeCase } from "./assert-snake-case.js";
|
|
5
5
|
import { RowLevelSecurityContextBuilder } from "./row-level-security-context-builder.js";
|
|
6
|
-
/** Creates transaction-local SQL for the current row level security context. */
|
|
7
6
|
export function createRowLevelSecurityTransactionSetup() {
|
|
8
7
|
if (!RequestContext.isActive()) {
|
|
9
8
|
return;
|
|
@@ -28,7 +27,7 @@ export function createRowLevelSecurityTransactionSetup() {
|
|
|
28
27
|
const databaseRole = role ?? RowLevelSecurityRole.ANONYMOUS;
|
|
29
28
|
assertSnakeCase(databaseRole, "Row level security database role");
|
|
30
29
|
const contextSql = builder.entries().length > 0 ? builder.toSQL() : "";
|
|
31
|
-
const sql = [
|
|
30
|
+
const sql = [`SET LOCAL ROLE ${databaseRole};`, contextSql]
|
|
32
31
|
.filter(Boolean)
|
|
33
32
|
.join("\n");
|
|
34
33
|
const signature = JSON.stringify({
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"create-row-level-security-transaction-setup.js","sourceRoot":"","sources":["../../src/utils/create-row-level-security-transaction-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;
|
|
1
|
+
{"version":3,"file":"create-row-level-security-transaction-setup.js","sourceRoot":"","sources":["../../src/utils/create-row-level-security-transaction-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0CAA0C,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,yCAAyC,CAAC;AA2BzF,MAAM,UAAU,sCAAsC;IAGpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC;QAC/B,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,8BAA8B,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;IACxC,MAAM,cAAc,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAClD,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,CAAC;IAExC,IAAI,IAAI,KAAK,oBAAoB,CAAC,QAAQ,EAAE,CAAC;QAC3C,OAAO;YACL,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,IACE,IAAI,KAAK,oBAAoB,CAAC,IAAI;QAClC,CAAC,IAAI;QACL,cAAc,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO;YACL,MAAM,EAAE,OAAO;SAChB,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACvC,MAAM,YAAY,GAAG,IAAI,IAAI,oBAAoB,CAAC,SAAS,CAAC;IAC5D,eAAe,CAAC,YAAY,EAAE,kCAAkC,CAAC,CAAC;IAElE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvE,MAAM,GAAG,GAAG,CAAW,kBAAkB,YAAY,GAAG,EAAE,UAAU,CAAC;SAClE,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE;QAC1B,IAAI,EAAE,YAAY;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,OAAO;QACf,WAAW,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;QAClD,SAAS;QACT,GAAG;KACJ,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAuC,EACvC,OAEa;IAEb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,IAAI,EAAE,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"escape-sql-literal.js","sourceRoot":"","sources":["../../src/utils/escape-sql-literal.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"escape-sql-literal.js","sourceRoot":"","sources":["../../src/utils/escape-sql-literal.ts"],"names":[],"mappings":"AACA,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"is-postgres-keyword-requiring-quote.js","sourceRoot":"","sources":["../../src/utils/is-postgres-keyword-requiring-quote.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"is-postgres-keyword-requiring-quote.js","sourceRoot":"","sources":["../../src/utils/is-postgres-keyword-requiring-quote.ts"],"names":[],"mappings":"AAEA,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC7C,KAAK;IACL,SAAS;IACT,SAAS;IACT,KAAK;IACL,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,YAAY;IACZ,eAAe;IACf,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,KAAK;IACL,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,WAAW;IACX,OAAO;IACP,UAAU;IACV,SAAS;IACT,WAAW;IACX,QAAQ;IACR,cAAc;IACd,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,gBAAgB;IAChB,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,KAAK;IACL,SAAS;IACT,SAAS;IACT,YAAY;IACZ,MAAM;IACN,UAAU;IACV,IAAI;IACJ,MAAM;IACN,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,OAAO;IACP,OAAO;IACP,OAAO;IACP,KAAK;IACL,SAAS;IACT,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,UAAU;IACV,OAAO;IACP,UAAU;IACV,QAAQ;IACR,OAAO;IACP,IAAI;IACJ,WAAW;IACX,OAAO;IACP,OAAO;IACP,KAAK;IACL,SAAS;IACT,WAAW;IACX,UAAU;IACV,MAAM;IACN,IAAI;IACJ,QAAQ;IACR,MAAM;IACN,MAAM;IACN,YAAY;IACZ,eAAe;IACf,aAAa;IACb,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,aAAa;IACb,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,WAAW;IACX,gBAAgB;IAChB,cAAc;IACd,UAAU;IACV,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;IACX,KAAK;IACL,SAAS;IACT,MAAM;IACN,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,IAAI;IACJ,MAAM;IACN,IAAI;IACJ,OAAO;IACP,KAAK;IACL,OAAO;IACP,UAAU;IACV,SAAS;IACT,SAAS;IACT,UAAU;IACV,WAAW;IACX,SAAS;IACT,MAAM;IACN,YAAY;IACZ,WAAW;IACX,OAAO;IACP,KAAK;IACL,QAAQ;IACR,cAAc;IACd,OAAO;IACP,SAAS;IACT,UAAU;IACV,MAAM;IACN,WAAW;IACX,WAAW;IACX,aAAa;IACb,OAAO;IACP,aAAa;IACb,MAAM;IACN,MAAM;IACN,WAAW;IACX,IAAI;IACJ,UAAU;IACV,OAAO;IACP,MAAM;IACN,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,OAAO;IACP,QAAQ;IACR,SAAS;IACT,UAAU;IACV,SAAS;IACT,MAAM;IACN,OAAO;IACP,QAAQ;IACR,MAAM;IACN,eAAe;IACf,WAAW;IACX,YAAY;IACZ,WAAW;IACX,WAAW;IACX,eAAe;IACf,UAAU;IACV,OAAO;IACP,SAAS;IACT,cAAc;IACd,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,UAAU,+BAA+B,CAAC,UAAkB;IAChE,OAAO,8BAA8B,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;AACtE,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quote-identifier.js","sourceRoot":"","sources":["../../src/utils/quote-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"quote-identifier.js","sourceRoot":"","sources":["../../src/utils/quote-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAC;AAG1D,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,gBAAgB,CAAC,UAAU,CAAC,CAAC;IAE7B,OAAO,IAAI,UAAU,GAAG,CAAC;AAC3B,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"quote-qualified-identifier.js","sourceRoot":"","sources":["../../src/utils/quote-qualified-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"quote-qualified-identifier.js","sourceRoot":"","sources":["../../src/utils/quote-qualified-identifier.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGxD,MAAM,UAAU,wBAAwB,CACtC,UAAkB,EAClB,SAAiB;IAEjB,OAAO,GAAG,eAAe,CAAC,UAAU,CAAC,IAAI,eAAe,CAAC,SAAS,CAAC,EAAE,CAAC;AACxE,CAAC"}
|
|
@@ -1,12 +1,8 @@
|
|
|
1
1
|
import { RowLevelSecurityContextValue, SnakeCase } from "./row-level-security-context-builder.types.js";
|
|
2
|
-
/** Builds SQL that writes RLS context values into PostgreSQL transaction settings. */
|
|
3
2
|
export declare class RowLevelSecurityContextBuilder {
|
|
4
3
|
private readonly ctx;
|
|
5
4
|
private readonly namespace;
|
|
6
|
-
/** Adds a context key and value, ignoring nullish values. */
|
|
7
5
|
set<S extends string>(key: SnakeCase<S>, value: RowLevelSecurityContextValue): this;
|
|
8
|
-
/** Returns the context entries that will be emitted to SQL. */
|
|
9
6
|
entries(): [string, string][];
|
|
10
|
-
/** Renders a `SELECT set_config(...)` statement for the collected entries. */
|
|
11
7
|
toSQL(): string;
|
|
12
8
|
}
|
|
@@ -1,10 +1,8 @@
|
|
|
1
1
|
import { assertSnakeCase } from "./assert-snake-case.js";
|
|
2
2
|
import { escapeSqlLiteral } from "./escape-sql-literal.js";
|
|
3
|
-
/** Builds SQL that writes RLS context values into PostgreSQL transaction settings. */
|
|
4
3
|
export class RowLevelSecurityContextBuilder {
|
|
5
4
|
ctx = new Map();
|
|
6
5
|
namespace = "app";
|
|
7
|
-
/** Adds a context key and value, ignoring nullish values. */
|
|
8
6
|
set(key, value) {
|
|
9
7
|
assertSnakeCase(key, "Row level security context key");
|
|
10
8
|
if (value === null || value === undefined) {
|
|
@@ -13,22 +11,20 @@ export class RowLevelSecurityContextBuilder {
|
|
|
13
11
|
this.ctx.set(key, String(value));
|
|
14
12
|
return this;
|
|
15
13
|
}
|
|
16
|
-
/** Returns the context entries that will be emitted to SQL. */
|
|
17
14
|
entries() {
|
|
18
15
|
return Array.from(this.ctx.entries());
|
|
19
16
|
}
|
|
20
|
-
/** Renders a `SELECT set_config(...)` statement for the collected entries. */
|
|
21
17
|
toSQL() {
|
|
22
18
|
const statements = this.entries()
|
|
23
19
|
.map(([key, value]) => {
|
|
24
20
|
const escapedValue = escapeSqlLiteral(value);
|
|
25
|
-
return
|
|
21
|
+
return `set_config('${this.namespace}.${key}', '${escapedValue}', true)`;
|
|
26
22
|
})
|
|
27
23
|
.join(",");
|
|
28
24
|
if (!statements) {
|
|
29
25
|
return "SELECT 1;";
|
|
30
26
|
}
|
|
31
|
-
return
|
|
27
|
+
return `SELECT ${statements};`;
|
|
32
28
|
}
|
|
33
29
|
}
|
|
34
30
|
//# sourceMappingURL=row-level-security-context-builder.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"row-level-security-context-builder.js","sourceRoot":"","sources":["../../src/utils/row-level-security-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;
|
|
1
|
+
{"version":3,"file":"row-level-security-context-builder.js","sourceRoot":"","sources":["../../src/utils/row-level-security-context-builder.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAO3D,MAAM,OAAO,8BAA8B;IACxB,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChC,SAAS,GAAG,KAAK,CAAC;IAGnC,GAAG,CACD,GAAiB,EACjB,KAAmC;QAEnC,eAAe,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;QAEvD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAGD,OAAO;QACL,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IACxC,CAAC;IAGD,KAAK;QACH,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,EAAE;aAC9B,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE;YACpB,MAAM,YAAY,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YAC7C,OAAiB,eAAe,IAAI,CAAC,SAAS,IAAI,GAAG,OAAO,YAAY,UAAU,CAAC;QACrF,CAAC,CAAC;aACD,IAAI,CAAC,GAAG,CAAC,CAAC;QAEb,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,WAAW,CAAC;QACrB,CAAC;QAED,OAAiB,UAAU,UAAU,GAAG,CAAC;IAC3C,CAAC;CACF"}
|
|
@@ -1,10 +1,5 @@
|
|
|
1
|
-
/** Lowercase letters allowed in snake_case context keys. */
|
|
2
1
|
export type LowercaseLetter = "a" | "b" | "c" | "d" | "e" | "f" | "g" | "h" | "i" | "j" | "k" | "l" | "m" | "n" | "o" | "p" | "q" | "r" | "s" | "t" | "u" | "v" | "w" | "x" | "y" | "z";
|
|
3
|
-
/** Characters allowed in snake_case context keys. */
|
|
4
2
|
export type ValidChar = LowercaseLetter | "_";
|
|
5
|
-
/** Compile-time predicate that checks whether a string contains only valid characters. */
|
|
6
3
|
export type IsValidSnakeCase<S extends string> = S extends `${infer First}${infer Rest}` ? First extends ValidChar ? IsValidSnakeCase<Rest> : false : true;
|
|
7
|
-
/** Compile-time snake_case constraint used by RLS context helpers. */
|
|
8
4
|
export type SnakeCase<S extends string> = S extends "" ? never : S extends `_${string}` | `${string}_` ? never : S extends `${string}__${string}` ? never : IsValidSnakeCase<S> extends true ? S : never;
|
|
9
|
-
/** Values that can be stored in RLS context and converted to PostgreSQL settings. */
|
|
10
5
|
export type RowLevelSecurityContextValue = string | number | boolean | null | undefined;
|