@nodii/db-rls 0.6.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/context.d.ts +1 -1
- package/dist/context.d.ts.map +1 -1
- package/dist/context.js +10 -4
- package/dist/context.js.map +1 -1
- package/dist/migrate-gen.d.ts +18 -2
- package/dist/migrate-gen.d.ts.map +1 -1
- package/dist/migrate-gen.js +15 -6
- package/dist/migrate-gen.js.map +1 -1
- package/package.json +2 -2
package/dist/context.d.ts
CHANGED
|
@@ -2,7 +2,7 @@ import { type OwnerContextOpts } from "./migrate-guard";
|
|
|
2
2
|
import { type AutoDispatchOpts, type PgTx, type PlatformOpsContextOpts, type SystemContextOpts, type UserContextOpts } from "./types";
|
|
3
3
|
/**
|
|
4
4
|
* withUserContext — opens a tx on the `authenticated` pool, sets
|
|
5
|
-
* `
|
|
5
|
+
* `app.user_id` + `app.tenant_id` (+ optional `app.source_ip`) via
|
|
6
6
|
* `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
|
|
7
7
|
* back per the PgPool contract.
|
|
8
8
|
*
|
package/dist/context.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,
|
|
1
|
+
{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AASA,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,KAAK,gBAAgB,EAErB,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAoBZ;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,CAAC,EACvC,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAUZ;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,QAAQ,EAAE,gBAAgB,GAAG,CAAC,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EACvD,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GACjC,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAiBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAsB,sBAAsB,CAAC,CAAC,EAC5C,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAYZ;AAMD,4DAA4D;AAC5D,wBAAgB,8CAA8C,IAAI,IAAI,CAErE;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CAAC,CAAC,EACrC,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAClC,IAAI,EAAE,gBAAgB,EACtB,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3B,OAAO,CAAC,CAAC,CAAC,CAeZ"}
|
package/dist/context.js
CHANGED
|
@@ -10,7 +10,7 @@ import { assertMigrateAllowed } from "./migrate-guard";
|
|
|
10
10
|
import { MissingTenantContext, TransactionRolledBack, } from "./types";
|
|
11
11
|
/**
|
|
12
12
|
* withUserContext — opens a tx on the `authenticated` pool, sets
|
|
13
|
-
* `
|
|
13
|
+
* `app.user_id` + `app.tenant_id` (+ optional `app.source_ip`) via
|
|
14
14
|
* `set_config(..., true)` tx-scoped GUCs, yields the tx, commits/rolls
|
|
15
15
|
* back per the PgPool contract.
|
|
16
16
|
*
|
|
@@ -20,10 +20,16 @@ import { MissingTenantContext, TransactionRolledBack, } from "./types";
|
|
|
20
20
|
export async function withUserContext(opts, fn) {
|
|
21
21
|
const pool = requirePool("authenticated");
|
|
22
22
|
return pool.withTransaction(async (tx) => {
|
|
23
|
-
|
|
24
|
-
|
|
23
|
+
// Canonical GUC namespace is `app.*` (08-rls §2/§6): the generated
|
|
24
|
+
// `authenticated` policies read `current_setting('app.user_id')` and the
|
|
25
|
+
// `auth.*` helper functions set `app.*`. Writing `auth.user_id` here set the
|
|
26
|
+
// WRONG namespace, leaving `app.user_id` empty → `auth.user_tenant_ids(NULL)`
|
|
27
|
+
// → every authenticated SELECT returns 0 rows / writes rejected by WITH CHECK
|
|
28
|
+
// on the raw (non-Drizzle) path. (`auth.` is the helper SCHEMA, not a GUC.)
|
|
29
|
+
await tx.setConfig("app.user_id", opts.userId);
|
|
30
|
+
await tx.setConfig("app.tenant_id", opts.tenantId);
|
|
25
31
|
if (opts.sourceIp !== undefined) {
|
|
26
|
-
await tx.setConfig("
|
|
32
|
+
await tx.setConfig("app.source_ip", opts.sourceIp);
|
|
27
33
|
}
|
|
28
34
|
try {
|
|
29
35
|
return await fn(tx);
|
package/dist/context.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,oBAAoB,EAIpB,qBAAqB,GAEtB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,
|
|
1
|
+
{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,EAAE;AACF,uEAAuE;AACvE,0EAA0E;AAC1E,kEAAkE;AAClE,YAAY;AAEZ,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,4BAA4B,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,oBAAoB,EAIpB,qBAAqB,GAEtB,MAAM,SAAS,CAAC;AAEjB;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAqB,EACrB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,eAAe,CAAC,CAAC;IAC1C,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,mEAAmE;QACnE,yEAAyE;QACzE,6EAA6E;QAC7E,8EAA8E;QAC9E,8EAA8E;QAC9E,4EAA4E;QAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,IAAuB,EACvB,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAuD,EACvD,OAAkC;IAElC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAuD,EACvD,OAAkC;IAElC,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,IAA4B,EAC5B,EAA4B;IAE5B,MAAM,IAAI,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC;IACzC,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,EAAE,CAAC,SAAS,CAAC,6BAA6B,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mEAAmE;AACnE,0CAA0C;AAC1C,IAAI,iCAAiC,GAAG,KAAK,CAAC;AAE9C,4DAA4D;AAC5D,MAAM,UAAU,8CAA8C;IAC5D,iCAAiC,GAAG,KAAK,CAAC;AAC5C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAA4B,EAC5B,EAA4B;IAE5B,IAAI,CAAC,iCAAiC,EAAE,CAAC;QACvC,iCAAiC,GAAG,IAAI,CAAC;QACzC,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,uDAAuD;YACrD,+DAA+D;YAC/D,0CAA0C,CAC7C,CAAC;IACJ,CAAC;IACD,OAAO,sBAAsB,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAsB,EACtB,EAA4B;IAE5B,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACrB,OAAO,eAAe,CACpB;YACE,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,MAAM;YAC/B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;YACnC,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ;SACpC,EACD,EAAE,CACH,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAChC,OAAO,iBAAiB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,IAAI,oBAAoB,EAAE,CAAC;AACnC,CAAC"}
|
package/dist/migrate-gen.d.ts
CHANGED
|
@@ -60,6 +60,22 @@ export interface MigrateGenInput {
|
|
|
60
60
|
* a file `0003_reference_table_grants.sql` is emitted with the
|
|
61
61
|
* GRANT-controlled (NO RLS) DDL. Applies only in the non-stub path. */
|
|
62
62
|
referenceTables?: readonly ReferenceTableSpec[];
|
|
63
|
+
/**
|
|
64
|
+
* D391 (08-rls § 3 / § 9) — emit the `auth.user_tenant_ids` policy-helper as
|
|
65
|
+
* `SECURITY DEFINER` with a pinned `search_path` (`SET search_path = public,
|
|
66
|
+
* pg_temp`). **Default `false` → `SECURITY INVOKER`** (the common case: the
|
|
67
|
+
* generated helper reads the RLS-EXEMPT `employees_mirror` / `customers_mirror`
|
|
68
|
+
* tables, so INVOKER is correct).
|
|
69
|
+
*
|
|
70
|
+
* Set `true` ONLY when a service overrides the helper body to read an
|
|
71
|
+
* RLS-PROTECTED source guarded by the calling policy (e.g. nodii-auth's
|
|
72
|
+
* `user_tenant_ids` → `user_memberships`): `SECURITY DEFINER` + a pinned
|
|
73
|
+
* `search_path` breaks the policy↔helper infinite recursion (proven 54001),
|
|
74
|
+
* and the pinned path closes the search-path-injection vector that DEFINER
|
|
75
|
+
* otherwise opens. Lets the service declare it via the generator instead of
|
|
76
|
+
* hand-overriding the generated SQL.
|
|
77
|
+
*/
|
|
78
|
+
securityDefiner?: boolean;
|
|
63
79
|
}
|
|
64
80
|
export interface MigrateGenResult {
|
|
65
81
|
/** Absolute path of the file that was written. */
|
|
@@ -81,11 +97,11 @@ export interface MigrateGenResult {
|
|
|
81
97
|
* SQL text for the real (joins mirror tables) helper. Module-level
|
|
82
98
|
* constant so parity-fence can byte-compare.
|
|
83
99
|
*/
|
|
84
|
-
export declare function userTenantIdsRealSql(serviceName: string): string;
|
|
100
|
+
export declare function userTenantIdsRealSql(serviceName: string, securityDefiner?: boolean): string;
|
|
85
101
|
/**
|
|
86
102
|
* SQL text for the chicken-and-egg stub variant (returns empty set).
|
|
87
103
|
*/
|
|
88
|
-
export declare function userTenantIdsStubSql(serviceName: string): string;
|
|
104
|
+
export declare function userTenantIdsStubSql(serviceName: string, securityDefiner?: boolean): string;
|
|
89
105
|
/**
|
|
90
106
|
* SQL text for the per-verb platform-ops policy file (08-rls § 7.6 /
|
|
91
107
|
* D185). One `CREATE POLICY` block per configured table, in input order.
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,IAAI,EAAE,2BAA2B,CAAC;IAClC,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;sEAEkE;IAClE,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,eAAe,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;
|
|
1
|
+
{"version":3,"file":"migrate-gen.d.ts","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AA8BA,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,sBAAsB,EAK5B,MAAM,kBAAkB,CAAC;AAE1B;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC;qCACiC;IACjC,KAAK,EAAE,MAAM,CAAC;IACd;wDACoD;IACpD,KAAK,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAC3B;qCACiC;IACjC,WAAW,EAAE,6BAA6B,CAAC;IAC3C;yBACqB;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,kBAAkB;IACjC,4EAA4E;IAC5E,IAAI,EAAE,2BAA2B,CAAC;IAClC,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd;;sEAEkE;IAClE,SAAS,CAAC,EAAE,SAAS,sBAAsB,EAAE,CAAC;CAC/C;AAED,MAAM,WAAW,eAAe;IAC9B;wDACoD;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;6CAEyC;IACzC,IAAI,CAAC,EAAE,OAAO,CAAC;IACf;;6EAEyE;IACzE,WAAW,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC9C;;4EAEwE;IACxE,eAAe,CAAC,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAChD;;;;;;;;;;;;;;OAcG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,kDAAkD;IAClD,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;2CACuC;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;2CACuC;IACvC,uBAAuB,CAAC,EAAE,MAAM,CAAC;CAClC;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,eAAe,UAAQ,GACtB,MAAM,CAqBR;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,EACnB,eAAe,UAAQ,GACtB,MAAM,CAcR;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,oBAAoB,EAAE,GACtC,MAAM,CAoBR;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,SAAS,kBAAkB,EAAE,GACpC,MAAM,CAoCR;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAuDnE;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CA6BhE"}
|
package/dist/migrate-gen.js
CHANGED
|
@@ -31,14 +31,20 @@ import { REFERENCE_TABLE_SKIP_RLS_MARKER, referenceTableGrantsSql, withPlatformO
|
|
|
31
31
|
* SQL text for the real (joins mirror tables) helper. Module-level
|
|
32
32
|
* constant so parity-fence can byte-compare.
|
|
33
33
|
*/
|
|
34
|
-
export function userTenantIdsRealSql(serviceName) {
|
|
34
|
+
export function userTenantIdsRealSql(serviceName, securityDefiner = false) {
|
|
35
|
+
// D391: `SECURITY DEFINER` + a pinned `search_path` when the service reads an
|
|
36
|
+
// RLS-protected source; default `SECURITY INVOKER` (no clause) for the
|
|
37
|
+
// RLS-exempt-mirror case this generated body targets.
|
|
38
|
+
const securityClause = securityDefiner
|
|
39
|
+
? " SECURITY DEFINER SET search_path = public, pg_temp"
|
|
40
|
+
: "";
|
|
35
41
|
return `-- Service: ${serviceName}
|
|
36
42
|
-- Generated by @nodii/db-rls migrate-gen
|
|
37
43
|
-- Phase: 004-helpers-and-grants — service-owned auth.user_tenant_ids
|
|
38
44
|
-- Spec: § 5.7 (terraform-bootstrap split)
|
|
39
45
|
|
|
40
46
|
CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
|
|
41
|
-
LANGUAGE sql STABLE AS $$
|
|
47
|
+
LANGUAGE sql STABLE${securityClause} AS $$
|
|
42
48
|
SELECT tenant_id FROM employees_mirror WHERE id = p_user_id
|
|
43
49
|
UNION
|
|
44
50
|
SELECT tenant_id FROM customers_mirror WHERE id = p_user_id
|
|
@@ -50,14 +56,17 @@ GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenti
|
|
|
50
56
|
/**
|
|
51
57
|
* SQL text for the chicken-and-egg stub variant (returns empty set).
|
|
52
58
|
*/
|
|
53
|
-
export function userTenantIdsStubSql(serviceName) {
|
|
59
|
+
export function userTenantIdsStubSql(serviceName, securityDefiner = false) {
|
|
60
|
+
const securityClause = securityDefiner
|
|
61
|
+
? " SECURITY DEFINER SET search_path = public, pg_temp"
|
|
62
|
+
: "";
|
|
54
63
|
return `-- Service: ${serviceName}
|
|
55
64
|
-- Generated by @nodii/db-rls migrate-gen --stub
|
|
56
65
|
-- Phase: 004-helpers-and-grants — stub variant (returns empty set)
|
|
57
66
|
-- Spec: § 5.7 (chicken-and-egg)
|
|
58
67
|
|
|
59
68
|
CREATE OR REPLACE FUNCTION auth.user_tenant_ids(p_user_id uuid) RETURNS SETOF uuid
|
|
60
|
-
LANGUAGE sql STABLE AS $$ SELECT NULL::uuid WHERE false $$;
|
|
69
|
+
LANGUAGE sql STABLE${securityClause} AS $$ SELECT NULL::uuid WHERE false $$;
|
|
61
70
|
|
|
62
71
|
GRANT EXECUTE ON FUNCTION auth.user_tenant_ids(uuid) TO nodii_services, authenticated;
|
|
63
72
|
`;
|
|
@@ -157,8 +166,8 @@ export function referenceTablesSql(serviceName, tables) {
|
|
|
157
166
|
*/
|
|
158
167
|
export function migrateGen(input) {
|
|
159
168
|
const contents = input.stub
|
|
160
|
-
? userTenantIdsStubSql(input.serviceName)
|
|
161
|
-
: userTenantIdsRealSql(input.serviceName);
|
|
169
|
+
? userTenantIdsStubSql(input.serviceName, input.securityDefiner)
|
|
170
|
+
: userTenantIdsRealSql(input.serviceName, input.securityDefiner);
|
|
162
171
|
const fileName = input.stub
|
|
163
172
|
? "0000_user_tenant_ids_stub.sql"
|
|
164
173
|
: "0001_user_tenant_ids.sql";
|
package/dist/migrate-gen.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAGL,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;
|
|
1
|
+
{"version":3,"file":"migrate-gen.js","sourceRoot":"","sources":["../src/migrate-gen.ts"],"names":[],"mappings":"AAAA,mEAAmE;AACnE,aAAa;AACb,EAAE;AACF,UAAU;AACV,6DAA6D;AAC7D,0EAA0E;AAC1E,iEAAiE;AACjE,EAAE;AACF,mEAAmE;AACnE,oEAAoE;AACpE,kEAAkE;AAClE,gEAAgE;AAChE,+DAA+D;AAC/D,EAAE;AACF,kEAAkE;AAClE,yEAAyE;AACzE,yEAAyE;AACzE,+DAA+D;AAC/D,mDAAmD;AACnD,EAAE;AACF,aAAa;AACb,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,yEAAyE;AACzE,oBAAoB;AAEpB,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEnD,OAAO,EAGL,+BAA+B,EAC/B,uBAAuB,EACvB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAoG1B;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,eAAe,GAAG,KAAK;IAEvB,8EAA8E;IAC9E,uEAAuE;IACvE,sDAAsD;IACtD,MAAM,cAAc,GAAG,eAAe;QACpC,CAAC,CAAC,qDAAqD;QACvD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,eAAe,WAAW;;;;;;qBAMd,cAAc;;;;;;;CAOlC,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmB,EACnB,eAAe,GAAG,KAAK;IAEvB,MAAM,cAAc,GAAG,eAAe;QACpC,CAAC,CAAC,qDAAqD;QACvD,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,eAAe,WAAW;;;;;;qBAMd,cAAc;;;CAGlC,CAAC;AACF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,WAAmB,EACnB,MAAuC;IAEvC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG;YACX,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,KAAK,GACT,IAAI,CAAC,KAAK,KAAK,QAAQ;YACrB,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC;YAC9D,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;CAI1C,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAChC,WAAmB,EACnB,MAAqC;IAErC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CACb,8CAA+C,IAAyB,CAAC,IAAI,0DAA0D,CACxI,CAAC;QACJ,CAAC;QACD,MAAM,KAAK,GAAG,uBAAuB,CAAC,IAAI,CAAC,KAAK,EAAE;YAChD,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;QACH,sEAAsE;QACtE,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,oEAAoE;QACpE,qDAAqD;QACrD,MAAM,aAAa,GAAG,KAAK;aACxB,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;aACpD,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,IAAI,kCAAkC,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,iCAAiC,IAAI,CAAC,KAAK,kIAAkI,CAC9K,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,WAAW;;;;KAItC,+BAA+B,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;CACvD,CAAC;IACA,OAAO,GAAG,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC;QAChE,CAAC,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI;QACzB,CAAC,CAAC,+BAA+B;QACjC,CAAC,CAAC,0BAA0B,CAAC;IAC/B,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,IAAI,kBAAkB,CAAC,CAAC;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC3C,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9C,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE9B,MAAM,MAAM,GAAqB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAEpD,mEAAmE;IACnE,kEAAkE;IAClE,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IACtE,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,MAAM,mBAAmB,GAAG,sBAAsB,CAChD,KAAK,CAAC,WAAW,EACjB,iBAAiB,CAClB,CAAC;QACF,MAAM,eAAe,GAAG,IAAI,CAC1B,MAAM,EACN,KAAK,EACL,gCAAgC,CACjC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,aAAa,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;QACpD,MAAM,CAAC,eAAe,GAAG,eAAe,CAAC;QACzC,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;IACnD,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,eAAe,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC;IACxE,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,uBAAuB,GAAG,kBAAkB,CAChD,KAAK,CAAC,WAAW,EACjB,eAAe,CAChB,CAAC;QACF,MAAM,mBAAmB,GAAG,IAAI,CAC9B,MAAM,EACN,KAAK,EACL,iCAAiC,CAClC,CAAC;QACF,SAAS,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,aAAa,CAAC,mBAAmB,EAAE,uBAAuB,CAAC,CAAC;QAC5D,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QACjD,MAAM,CAAC,uBAAuB,GAAG,uBAAuB,CAAC;IAC3D,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAA0B,CAAC;IAC/B,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QACrB,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1B,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;aAAM,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACxC,UAAU,EAAE,CAAC;YACb,OAAO,CAAC,CAAC;QACX,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IACD,yEAAyE;IACzE,iEAAiE;IACjE,MAAM,WAAW,GACf,UAAU,CAAC,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,UAAU,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,UAAU;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC;;;;;uDAKyC,CAAC,CAAC;AACzD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodii/db-rls",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.7.1",
|
|
4
4
|
"description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|
|
@@ -58,7 +58,7 @@
|
|
|
58
58
|
}
|
|
59
59
|
},
|
|
60
60
|
"devDependencies": {
|
|
61
|
-
"@nodii/telemetry": "0.
|
|
61
|
+
"@nodii/telemetry": "0.9.0",
|
|
62
62
|
"@types/bun": "^1.3.13",
|
|
63
63
|
"@types/pg": "^8.11.10",
|
|
64
64
|
"drizzle-orm": "^0.45.2",
|