@nodii/db-rls 0.7.1 → 0.7.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/verify-rls.d.ts +20 -3
- package/dist/verify-rls.d.ts.map +1 -1
- package/dist/verify-rls.js +26 -8
- package/dist/verify-rls.js.map +1 -1
- package/package.json +1 -1
package/dist/verify-rls.d.ts
CHANGED
|
@@ -35,6 +35,19 @@ export interface VerifyRlsOpts {
|
|
|
35
35
|
* `false`, reference-table exemption is disabled and a reference table
|
|
36
36
|
* missing RLS WOULD be flagged. Defaults to `true` (exemptions on). */
|
|
37
37
|
allowReferenceTables?: boolean;
|
|
38
|
+
/** When `true`, additionally asserts FORCE ROW LEVEL SECURITY
|
|
39
|
+
* (`pg_class.relforcerowsecurity = true`) on every checked table — not
|
|
40
|
+
* just ENABLE. A table with ENABLE but not FORCE still lets the TABLE
|
|
41
|
+
* OWNER role bypass every policy, so ENABLE-only is false assurance
|
|
42
|
+
* whenever the querying role owns the table.
|
|
43
|
+
*
|
|
44
|
+
* Defaults to `false` to preserve the locked 08-rls A1 posture: the
|
|
45
|
+
* canonical pool model owns tables under `nodii_owner` (a BYPASSRLS role
|
|
46
|
+
* gated by the migrate guard) and runs live requests on NON-owner roles,
|
|
47
|
+
* for which ENABLE alone is sufficient — and the canonical `withRls` DDL
|
|
48
|
+
* emits ENABLE, not FORCE. Set `true` when the deployment owns its tables
|
|
49
|
+
* under a non-BYPASSRLS role and wants owner-proof verification. */
|
|
50
|
+
requireForce?: boolean;
|
|
38
51
|
}
|
|
39
52
|
/** One RLS-required table whose coverage is missing or whose catalog row
|
|
40
53
|
* could not be found. */
|
|
@@ -49,8 +62,11 @@ export interface RlsCoverageOffender {
|
|
|
49
62
|
* - `"rls_disabled"` — the table exists but `relrowsecurity = false`.
|
|
50
63
|
* - `"not_found"` — no `pg_class` row matched (table absent / wrong
|
|
51
64
|
* schema). Also a failure: a required table that doesn't exist can't
|
|
52
|
-
* be protected.
|
|
53
|
-
|
|
65
|
+
* be protected.
|
|
66
|
+
* - `"force_disabled"` — the table has ENABLE but not FORCE ROW LEVEL
|
|
67
|
+
* SECURITY (`relforcerowsecurity = false`). Only emitted when
|
|
68
|
+
* `requireForce` is set; the table owner bypasses every policy. */
|
|
69
|
+
reason: "rls_disabled" | "not_found" | "force_disabled";
|
|
54
70
|
}
|
|
55
71
|
/**
|
|
56
72
|
* Thrown by `verifyRls` when one or more RLS-required tables are missing
|
|
@@ -64,7 +80,8 @@ export declare class RlsCoverageError extends DbRlsError {
|
|
|
64
80
|
}
|
|
65
81
|
/**
|
|
66
82
|
* Verifies that every table in `requiredTables` has row-level security
|
|
67
|
-
* enabled (`pg_class.relrowsecurity = true`),
|
|
83
|
+
* enabled (`pg_class.relrowsecurity = true`) — and, when `requireForce` is
|
|
84
|
+
* set, forced (`pg_class.relforcerowsecurity = true`) — exempting any § 7.6
|
|
68
85
|
* reference table. Resolves OK (returns `void`) when all required tables
|
|
69
86
|
* are covered; throws `RlsCoverageError` listing the offenders otherwise.
|
|
70
87
|
*
|
package/dist/verify-rls.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;yEAWqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;2EAOuE;IACvE,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;CACzD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA+CD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAyFf"}
|
package/dist/verify-rls.js
CHANGED
|
@@ -43,9 +43,13 @@ export class RlsCoverageError extends DbRlsError {
|
|
|
43
43
|
function formatMessage(offenders) {
|
|
44
44
|
const lines = offenders.map((o) => {
|
|
45
45
|
const qualified = `${o.schema}.${o.relname}`;
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
46
|
+
if (o.reason === "not_found") {
|
|
47
|
+
return ` - ${qualified} (NOT FOUND — required RLS table is absent from the catalog)`;
|
|
48
|
+
}
|
|
49
|
+
if (o.reason === "force_disabled") {
|
|
50
|
+
return ` - ${qualified} (relforcerowsecurity = false — RLS enabled but NOT forced; the table owner bypasses every policy)`;
|
|
51
|
+
}
|
|
52
|
+
return ` - ${qualified} (relrowsecurity = false — RLS not enabled)`;
|
|
49
53
|
});
|
|
50
54
|
return `rls_coverage: ${offenders.length} RLS-required table(s) missing row-level security (08-rls § A1). A migration created the table but never \`ALTER TABLE ... ENABLE ROW LEVEL SECURITY\` — these tables leak every tenant's rows to the services/authenticated pools. Offenders:\n${lines.join("\n")}\nFix: add the canonical 5-policy DDL (withRls) for each, or register it as a § 7.6 reference table if it is genuinely platform-global GRANT-controlled data.`;
|
|
51
55
|
}
|
|
@@ -70,7 +74,8 @@ function key(r) {
|
|
|
70
74
|
}
|
|
71
75
|
/**
|
|
72
76
|
* Verifies that every table in `requiredTables` has row-level security
|
|
73
|
-
* enabled (`pg_class.relrowsecurity = true`),
|
|
77
|
+
* enabled (`pg_class.relrowsecurity = true`) — and, when `requireForce` is
|
|
78
|
+
* set, forced (`pg_class.relforcerowsecurity = true`) — exempting any § 7.6
|
|
74
79
|
* reference table. Resolves OK (returns `void`) when all required tables
|
|
75
80
|
* are covered; throws `RlsCoverageError` listing the offenders otherwise.
|
|
76
81
|
*
|
|
@@ -81,6 +86,7 @@ function key(r) {
|
|
|
81
86
|
export async function verifyRls(pool, opts) {
|
|
82
87
|
const defaultSchema = opts.schema ?? "public";
|
|
83
88
|
const exemptionsEnabled = opts.allowReferenceTables ?? true;
|
|
89
|
+
const requireForce = opts.requireForce ?? false;
|
|
84
90
|
// Build the exempt set (normalized schema.relname keys) + predicate.
|
|
85
91
|
const exemptKeys = new Set();
|
|
86
92
|
if (exemptionsEnabled && opts.referenceTables) {
|
|
@@ -107,7 +113,7 @@ export async function verifyRls(pool, opts) {
|
|
|
107
113
|
// resolves every table; missing rows are detected by set difference.
|
|
108
114
|
const schemas = toCheck.map((t) => t.schema);
|
|
109
115
|
const relnames = toCheck.map((t) => t.relname);
|
|
110
|
-
const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity
|
|
116
|
+
const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity, c.relforcerowsecurity
|
|
111
117
|
FROM unnest($1::text[], $2::text[]) AS req(schemaname, tablename)
|
|
112
118
|
JOIN pg_namespace n ON n.nspname = req.schemaname
|
|
113
119
|
JOIN pg_class c ON c.relnamespace = n.oid
|
|
@@ -116,12 +122,16 @@ export async function verifyRls(pool, opts) {
|
|
|
116
122
|
// Index the catalog rows by schema.relname.
|
|
117
123
|
const found = new Map();
|
|
118
124
|
for (const row of res.rows) {
|
|
119
|
-
found.set(`${row.nspname}.${row.relname}`,
|
|
125
|
+
found.set(`${row.nspname}.${row.relname}`, {
|
|
126
|
+
enabled: row.relrowsecurity,
|
|
127
|
+
forced: row.relforcerowsecurity,
|
|
128
|
+
});
|
|
120
129
|
}
|
|
121
130
|
const offenders = [];
|
|
122
131
|
for (const t of toCheck) {
|
|
123
132
|
const k = key(t);
|
|
124
|
-
|
|
133
|
+
const state = found.get(k);
|
|
134
|
+
if (state === undefined) {
|
|
125
135
|
offenders.push({
|
|
126
136
|
table: t.original,
|
|
127
137
|
schema: t.schema,
|
|
@@ -129,7 +139,7 @@ export async function verifyRls(pool, opts) {
|
|
|
129
139
|
reason: "not_found",
|
|
130
140
|
});
|
|
131
141
|
}
|
|
132
|
-
else if (
|
|
142
|
+
else if (state.enabled === false) {
|
|
133
143
|
offenders.push({
|
|
134
144
|
table: t.original,
|
|
135
145
|
schema: t.schema,
|
|
@@ -137,6 +147,14 @@ export async function verifyRls(pool, opts) {
|
|
|
137
147
|
reason: "rls_disabled",
|
|
138
148
|
});
|
|
139
149
|
}
|
|
150
|
+
else if (requireForce && state.forced === false) {
|
|
151
|
+
offenders.push({
|
|
152
|
+
table: t.original,
|
|
153
|
+
schema: t.schema,
|
|
154
|
+
relname: t.relname,
|
|
155
|
+
reason: "force_disabled",
|
|
156
|
+
});
|
|
157
|
+
}
|
|
140
158
|
}
|
|
141
159
|
if (offenders.length > 0) {
|
|
142
160
|
throw new RlsCoverageError(offenders);
|
package/dist/verify-rls.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4ErC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,OAAO,SAAS,8DAA8D,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,OAAO,SAAS,oGAAoG,CAAC;QAC9H,CAAC;QACD,OAAO,OAAO,SAAS,6CAA6C,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAEhD,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAM1B;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodii/db-rls",
|
|
3
|
-
"version": "0.7.
|
|
3
|
+
"version": "0.7.2",
|
|
4
4
|
"description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|