@nodii/db-rls 0.7.1 → 0.8.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/postgres-js-client.d.ts +22 -1
- package/dist/postgres-js-client.d.ts.map +1 -1
- package/dist/postgres-js-client.js +28 -0
- package/dist/postgres-js-client.js.map +1 -1
- package/dist/verify-rls.d.ts +20 -3
- package/dist/verify-rls.d.ts.map +1 -1
- package/dist/verify-rls.js +26 -8
- package/dist/verify-rls.js.map +1 -1
- package/package.json +1 -1
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { type PostgresJsDatabase } from "drizzle-orm/postgres-js";
|
|
2
2
|
import type { Sql } from "postgres";
|
|
3
3
|
import { type OwnerContextOpts } from "./migrate-guard";
|
|
4
|
-
import { type PgPool, type PgTx, type PoolKind, type SystemContextOpts, type UserContextOpts } from "./types";
|
|
4
|
+
import { type PgPool, type PgTx, type PlatformOpsContextOpts, type PoolKind, type SystemContextOpts, type UserContextOpts } from "./types";
|
|
5
5
|
type PostgresJsDrizzleClient<TSchema extends Record<string, unknown> = Record<string, unknown>> = PostgresJsDatabase<TSchema>;
|
|
6
6
|
/**
|
|
7
7
|
* PgPool adapter wrapping a postgres-js `Sql` instance. Caller owns the
|
|
@@ -71,6 +71,27 @@ export declare function withUserContextDbPostgresJs<T, TSchema extends Record<st
|
|
|
71
71
|
* `services` pool with `app.tenant_id` GUC bound; yields a Drizzle client.
|
|
72
72
|
*/
|
|
73
73
|
export declare function withSystemContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: SystemContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
|
|
74
|
+
/**
|
|
75
|
+
* postgres-js Drizzle variant of `withPlatformOpsContext`. Opens a tx on the
|
|
76
|
+
* `platform_ops` pool (`nodii_platform_ops` Postgres role, RLS-bound per hub
|
|
77
|
+
* decision D185 — NOT a BYPASSRLS escape hatch) and sets the three
|
|
78
|
+
* transaction-local GUCs the platform-ops RLS predicates read (D185 § 4):
|
|
79
|
+
* - `app.user_id` — verified principal id (sub) from the JWT;
|
|
80
|
+
* - `app.platform_ops_service_id` — which consumer service's platform-ops
|
|
81
|
+
* surface this request exercises;
|
|
82
|
+
* - `app.platform_ops_permission` — the catalog entry being exercised.
|
|
83
|
+
*
|
|
84
|
+
* The RLS is BYTE-IDENTICAL to the raw `withPlatformOpsContext` (same three
|
|
85
|
+
* GUCs, same `platform_ops_grants_replica` predicate) — this variant only
|
|
86
|
+
* yields a Drizzle client instead of a raw `PgTx`, completing the postgres-js
|
|
87
|
+
* parity surface alongside the user/system/owner variants (request f0afde20).
|
|
88
|
+
* `grantId`/`supportTicketId` are optional audit-trail bindings and, exactly as
|
|
89
|
+
* in the raw helper, are NOT pushed into GUCs (the policy predicate ignores them).
|
|
90
|
+
*
|
|
91
|
+
* Throws `PoolUnavailable("platform_ops")` if db-rls was initialized without a
|
|
92
|
+
* platform_ops pool (3-pool / 2-pool mode).
|
|
93
|
+
*/
|
|
94
|
+
export declare function withPlatformOpsContextDbPostgresJs<T, TSchema extends Record<string, unknown> = Record<string, unknown>>(opts: PlatformOpsContextOpts, fn: (db: PostgresJsDrizzleClient<TSchema>) => Promise<T>): Promise<T>;
|
|
74
95
|
/**
|
|
75
96
|
* postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
|
|
76
97
|
* `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"postgres-js-client.d.ts","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAW,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAkB,MAAM,UAAU,CAAC;AAYpD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,QAAQ,EAEb,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB,KAAK,uBAAuB,CAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,gBAAiB,YAAW,MAAM;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B;gFAC4E;IAC5E,OAAO,CAAC,SAAS,CAAC,CAA4C;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAGpB;IACX,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAIjB;gBAEC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;QACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE,QAAQ,CAAC;YACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC;SACpB,KAAK,IAAI,CAAC;KACZ;IAQD;qEACiE;IACjE,IAAI,MAAM,IAAI,GAAG,CAEhB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwDlE;;;;;;;;;;;;;;;;;OAiBG;IACG,sBAAsB,CAAC,CAAC,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrE,EAAE,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAClD,OAAO,CAAC,CAAC,CAAC;CA6Dd;AAwDD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAkBZ;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EACJ,gBAAgB,GAChB,CAAC,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,CAAC,CAAC,CAWZ;AAsBD,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAaxC,OAAO,EACL,cAAc,EACd,cAAc,EACd,KAAK,eAAe,EACpB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,KAAK,aAAa,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
|
|
1
|
+
{"version":3,"file":"postgres-js-client.d.ts","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAW,KAAK,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,KAAK,EAAE,GAAG,EAAkB,MAAM,UAAU,CAAC;AAYpD,OAAO,EAAwB,KAAK,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EAEL,KAAK,MAAM,EACX,KAAK,IAAI,EACT,KAAK,sBAAsB,EAC3B,KAAK,QAAQ,EAEb,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACrB,MAAM,SAAS,CAAC;AAEjB,KAAK,uBAAuB,CAC1B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,IAC/D,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAEhC;;;;;;;;;GASG;AACH,qBAAa,gBAAiB,YAAW,MAAM;IAC7C,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAM;IAC1B;gFAC4E;IAC5E,OAAO,CAAC,SAAS,CAAC,CAA4C;IAC9D,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IACvC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAGpB;IACX,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAIjB;gBAEC,IAAI,EAAE;QAChB,GAAG,EAAE,GAAG,CAAC;QACT,IAAI,EAAE,QAAQ,CAAC;QACf,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,QAAQ,CAAC;YAAC,UAAU,EAAE,MAAM,CAAA;SAAE,KAAK,IAAI,CAAC;QACvE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE;YAClB,IAAI,EAAE,QAAQ,CAAC;YACf,OAAO,EAAE,WAAW,GAAG,aAAa,GAAG,OAAO,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC;SACpB,KAAK,IAAI,CAAC;KACZ;IAQD;qEACiE;IACjE,IAAI,MAAM,IAAI,GAAG,CAEhB;IAEK,eAAe,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAwDlE;;;;;;;;;;;;;;;;;OAiBG;IACG,sBAAsB,CAAC,CAAC,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACrE,EAAE,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAClD,OAAO,CAAC,CAAC,CAAC;CA6Dd;AAwDD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAC/C,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,eAAe,EACrB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAkBZ;AAED;;;GAGG;AACH,wBAAsB,6BAA6B,CACjD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,iBAAiB,EACvB,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAYZ;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAsB,kCAAkC,CACtD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,IAAI,EAAE,sBAAsB,EAC5B,EAAE,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GACvD,OAAO,CAAC,CAAC,CAAC,CAiBZ;AAED;;;;;GAKG;AACH,wBAAsB,4BAA4B,CAChD,CAAC,EACD,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAEjE,QAAQ,EACJ,gBAAgB,GAChB,CAAC,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,EAC1D,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7D,OAAO,CAAC,CAAC,CAAC,CAWZ;AAsBD,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAaxC,OAAO,EACL,cAAc,EACd,cAAc,EACd,KAAK,eAAe,EACpB,SAAS,EACT,YAAY,EACZ,WAAW,EACX,KAAK,aAAa,GACnB,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
|
|
@@ -274,6 +274,34 @@ export async function withSystemContextDbPostgresJs(opts, fn) {
|
|
|
274
274
|
await db.execute(drizzleSql `SELECT auth.init_tenant(${opts.tenantId}::uuid)`);
|
|
275
275
|
}, fn);
|
|
276
276
|
}
|
|
277
|
+
/**
|
|
278
|
+
* postgres-js Drizzle variant of `withPlatformOpsContext`. Opens a tx on the
|
|
279
|
+
* `platform_ops` pool (`nodii_platform_ops` Postgres role, RLS-bound per hub
|
|
280
|
+
* decision D185 — NOT a BYPASSRLS escape hatch) and sets the three
|
|
281
|
+
* transaction-local GUCs the platform-ops RLS predicates read (D185 § 4):
|
|
282
|
+
* - `app.user_id` — verified principal id (sub) from the JWT;
|
|
283
|
+
* - `app.platform_ops_service_id` — which consumer service's platform-ops
|
|
284
|
+
* surface this request exercises;
|
|
285
|
+
* - `app.platform_ops_permission` — the catalog entry being exercised.
|
|
286
|
+
*
|
|
287
|
+
* The RLS is BYTE-IDENTICAL to the raw `withPlatformOpsContext` (same three
|
|
288
|
+
* GUCs, same `platform_ops_grants_replica` predicate) — this variant only
|
|
289
|
+
* yields a Drizzle client instead of a raw `PgTx`, completing the postgres-js
|
|
290
|
+
* parity surface alongside the user/system/owner variants (request f0afde20).
|
|
291
|
+
* `grantId`/`supportTicketId` are optional audit-trail bindings and, exactly as
|
|
292
|
+
* in the raw helper, are NOT pushed into GUCs (the policy predicate ignores them).
|
|
293
|
+
*
|
|
294
|
+
* Throws `PoolUnavailable("platform_ops")` if db-rls was initialized without a
|
|
295
|
+
* platform_ops pool (3-pool / 2-pool mode).
|
|
296
|
+
*/
|
|
297
|
+
export async function withPlatformOpsContextDbPostgresJs(opts, fn) {
|
|
298
|
+
const pool = requirePostgresJsPool("platform_ops");
|
|
299
|
+
return withPostgresJsTx(pool, async (db) => {
|
|
300
|
+
await db.execute(drizzleSql `SELECT set_config('app.user_id', ${opts.userId}, true)`);
|
|
301
|
+
await db.execute(drizzleSql `SELECT set_config('app.platform_ops_service_id', ${opts.serviceId}, true)`);
|
|
302
|
+
await db.execute(drizzleSql `SELECT set_config('app.platform_ops_permission', ${opts.permission}, true)`);
|
|
303
|
+
}, fn);
|
|
304
|
+
}
|
|
277
305
|
/**
|
|
278
306
|
* postgres-js Drizzle variant of `withOwnerContext`. Opens a tx on the
|
|
279
307
|
* `owner` (BYPASSRLS) pool with no GUCs. Migrations only per § 5.3 +
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,oBAAoB,
|
|
1
|
+
{"version":3,"file":"postgres-js-client.js","sourceRoot":"","sources":["../src/postgres-js-client.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,EAAE;AACF,mEAAmE;AACnE,kEAAkE;AAClE,wEAAwE;AACxE,+DAA+D;AAC/D,oEAAoE;AACpE,sBAAsB;AACtB,EAAE;AACF,WAAW;AACX,0EAA0E;AAC1E,kEAAkE;AAClE,qBAAqB;AACrB,oEAAoE;AACpE,uEAAuE;AACvE,mEAAmE;AACnE,EAAE;AACF,6DAA6D;AAC7D,gCAAgC;AAChC,2DAA2D;AAC3D,sCAAsC;AACtC,6CAA6C;AAC7C,qEAAqE;AACrE,sCAAsC;AAEtC,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,OAAO,EAA2B,MAAM,yBAAyB,CAAC;AAG3E,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EACL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,4BAA4B,EAC5B,gBAAgB,EAChB,UAAU,GACX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAyB,MAAM,iBAAiB,CAAC;AAC9E,OAAO,EACL,oBAAoB,EAKpB,qBAAqB,GAGtB,MAAM,SAAS,CAAC;AAMjB;;;;;;;;;GASG;AACH,MAAM,OAAO,gBAAgB;IAClB,IAAI,CAAW;IACP,GAAG,CAAM;IAC1B;gFAC4E;IACpE,SAAS,CAA6C;IAC7C,aAAa,CAAS;IACtB,aAAa,CAGnB;IACM,UAAU,CAIhB;IAEX,YAAY,IAUX;QACC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;QACtB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;QACpB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,IAAI,EAAE,CAAC;QAC9C,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;QACxC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;qEACiE;IACjE,IAAI,MAAM;QACR,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,eAAe,CAAI,EAA4B;QACnD,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,MAAM,IAAI,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBAC7C,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;wBAC3B,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,6DAA6D;gBAC7D,oDAAoD;gBACpD,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,sBAAsB,CAC1B,EAAmD;QAEnD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,uEAAuE;YACvE,mEAAmE;YACnE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC;QAC9B,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,IAAI,OAAO,GAA0C,OAAO,CAAC;QAC7D,IAAI,YAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE;gBAC9D,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;oBAC7C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,CAAC;oBAC5C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBACxC,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;oBAChD,IAAI,SAAS,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACpC,mBAAmB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;wBAC1C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;4BACvB,IAAI,CAAC;gCACH,IAAI,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;4BACjE,CAAC;4BAAC,MAAM,CAAC;gCACP,eAAe;4BACjB,CAAC;wBACH,CAAC;oBACH,CAAC;oBACD,IAAI,CAAC;wBACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAClB,IAA8C,CAC/C,CAAC;wBACF,OAAO,GAAG,WAAW,CAAC;wBACtB,UAAU,CAAC,WAAW,CAAC,CAAC;wBACxB,OAAO,GAAG,CAAC;oBACb,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,OAAO,GAAG,aAAa,CAAC;wBACxB,UAAU,CAAC,aAAa,CAAC,CAAC;wBAC1B,YAAY,GAAG,GAAG,CAAC;wBACnB,MAAM,GAAG,CAAC;oBACZ,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;YACH,OAAO,MAAW,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;gBACxC,OAAO,GAAG,aAAa,CAAC;gBACxB,YAAY,GAAG,GAAG,CAAC;YACrB,CAAC;YACD,MAAM,YAAY,IAAI,GAAG,CAAC;QAC5B,CAAC;gBAAS,CAAC;YACT,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;YACxC,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC;gBACH,IAAI,CAAC,UAAU,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;IACH,CAAC;CACF;AAED,MAAM,YAAY;IACP,QAAQ,CAAW;IACnB,GAAG,CAAiB;IAE7B,YAAY,IAAc,EAAE,GAAmB;QAC7C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,GAAW,EAAE,SAA6B,EAAE;QACrD,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,MAAmB,CAAC,CAAC;IAClD,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,KAAa;QACxC,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED,SAAS,qBAAqB,CAC5B,IAA6D;IAE7D,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,YAAY,gBAAgB,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,WAAW,IAAI,wLAAwL,CACxM,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAsB,EACtB,KAA8D,EAC9D,EAAwD;IAExD,8EAA8E;IAC9E,wEAAwE;IACxE,sEAAsE;IACtE,OAAO,IAAI,CAAC,sBAAsB,CAAa,KAAK,EAAE,EAAE,EAAE,EAAE;QAC1D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,qBAAqB,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAI/C,IAAqB,EACrB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACnD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACpD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oBAAoB,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,QAAQ,SAAS,CAC3E,CAAC;QACF,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,sCAAsC,IAAI,CAAC,QAAQ,SAAS,CACvE,CAAC;QACJ,CAAC;IACH,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAIjD,IAAuB,EACvB,EAAwD;IAExD,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,oBAAoB,EAAE,CAAC;IACrD,MAAM,IAAI,GAAG,qBAAqB,CAAC,UAAU,CAAC,CAAC;IAC/C,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,2BAA2B,IAAI,CAAC,QAAQ,SAAS,CAC5D,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAItD,IAA4B,EAC5B,EAAwD;IAExD,MAAM,IAAI,GAAG,qBAAqB,CAAC,cAAc,CAAC,CAAC;IACnD,OAAO,gBAAgB,CACrB,IAAI,EACJ,KAAK,EAAE,EAAE,EAAE,EAAE;QACX,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oCAAoC,IAAI,CAAC,MAAM,SAAS,CACnE,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,SAAS,SAAS,CACtF,CAAC;QACF,MAAM,EAAE,CAAC,OAAO,CACd,UAAU,CAAA,oDAAoD,IAAI,CAAC,UAAU,SAAS,CACvF,CAAC;IACJ,CAAC,EACD,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAIhD,QAE0D,EAC1D,OAA8D;IAE9D,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,kBAAkB,CAAa,QAAQ,EAAE,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,4BAA4B,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,4BAA4B,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAC5C,OAAO,gBAAgB,CAAa,IAAI,EAAE,KAAK,IAAI,EAAE,GAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,kBAAkB,CACzB,QAE0D,EAC1D,OAA8D;IAK9D,IAAI,OAAO,QAAQ,KAAK,UAAU,EAAE,CAAC;QACnC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,SAAS,CACjB,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AACzC,CAAC;AAID,8EAA8E;AAC9E,+EAA+E;AAC/E,EAAE;AACF,4EAA4E;AAC5E,qEAAqE;AACrE,gFAAgF;AAChF,gFAAgF;AAChF,6EAA6E;AAC7E,6EAA6E;AAC7E,kFAAkF;AAClF,0EAA0E;AAC1E,OAAO,EACL,cAAc,EACd,cAAc,EAEd,SAAS,EACT,YAAY,EACZ,WAAW,GAEZ,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,eAAe,EACf,qBAAqB,GACtB,MAAM,SAAS,CAAC"}
|
package/dist/verify-rls.d.ts
CHANGED
|
@@ -35,6 +35,19 @@ export interface VerifyRlsOpts {
|
|
|
35
35
|
* `false`, reference-table exemption is disabled and a reference table
|
|
36
36
|
* missing RLS WOULD be flagged. Defaults to `true` (exemptions on). */
|
|
37
37
|
allowReferenceTables?: boolean;
|
|
38
|
+
/** When `true`, additionally asserts FORCE ROW LEVEL SECURITY
|
|
39
|
+
* (`pg_class.relforcerowsecurity = true`) on every checked table — not
|
|
40
|
+
* just ENABLE. A table with ENABLE but not FORCE still lets the TABLE
|
|
41
|
+
* OWNER role bypass every policy, so ENABLE-only is false assurance
|
|
42
|
+
* whenever the querying role owns the table.
|
|
43
|
+
*
|
|
44
|
+
* Defaults to `false` to preserve the locked 08-rls A1 posture: the
|
|
45
|
+
* canonical pool model owns tables under `nodii_owner` (a BYPASSRLS role
|
|
46
|
+
* gated by the migrate guard) and runs live requests on NON-owner roles,
|
|
47
|
+
* for which ENABLE alone is sufficient — and the canonical `withRls` DDL
|
|
48
|
+
* emits ENABLE, not FORCE. Set `true` when the deployment owns its tables
|
|
49
|
+
* under a non-BYPASSRLS role and wants owner-proof verification. */
|
|
50
|
+
requireForce?: boolean;
|
|
38
51
|
}
|
|
39
52
|
/** One RLS-required table whose coverage is missing or whose catalog row
|
|
40
53
|
* could not be found. */
|
|
@@ -49,8 +62,11 @@ export interface RlsCoverageOffender {
|
|
|
49
62
|
* - `"rls_disabled"` — the table exists but `relrowsecurity = false`.
|
|
50
63
|
* - `"not_found"` — no `pg_class` row matched (table absent / wrong
|
|
51
64
|
* schema). Also a failure: a required table that doesn't exist can't
|
|
52
|
-
* be protected.
|
|
53
|
-
|
|
65
|
+
* be protected.
|
|
66
|
+
* - `"force_disabled"` — the table has ENABLE but not FORCE ROW LEVEL
|
|
67
|
+
* SECURITY (`relforcerowsecurity = false`). Only emitted when
|
|
68
|
+
* `requireForce` is set; the table owner bypasses every policy. */
|
|
69
|
+
reason: "rls_disabled" | "not_found" | "force_disabled";
|
|
54
70
|
}
|
|
55
71
|
/**
|
|
56
72
|
* Thrown by `verifyRls` when one or more RLS-required tables are missing
|
|
@@ -64,7 +80,8 @@ export declare class RlsCoverageError extends DbRlsError {
|
|
|
64
80
|
}
|
|
65
81
|
/**
|
|
66
82
|
* Verifies that every table in `requiredTables` has row-level security
|
|
67
|
-
* enabled (`pg_class.relrowsecurity = true`),
|
|
83
|
+
* enabled (`pg_class.relrowsecurity = true`) — and, when `requireForce` is
|
|
84
|
+
* set, forced (`pg_class.relforcerowsecurity = true`) — exempting any § 7.6
|
|
68
85
|
* reference table. Resolves OK (returns `void`) when all required tables
|
|
69
86
|
* are covered; throws `RlsCoverageError` listing the offenders otherwise.
|
|
70
87
|
*
|
package/dist/verify-rls.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"verify-rls.d.ts","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAErC;;;iDAGiD;AACjD,MAAM,WAAW,UAAU;IACzB,KAAK,CAAC,CAAC,GAAG,OAAO,EACf,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,SAAS,OAAO,EAAE,GAC1B,OAAO,CAAC;QAAE,IAAI,EAAE,CAAC,EAAE,CAAA;KAAE,CAAC,CAAC;CAC3B;AAED;;;mEAGmE;AACnE,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;AAEjE,MAAM,WAAW,aAAa;IAC5B;;0CAEsC;IACtC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,yEAAyE;IACzE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;oEAIgE;IAChE,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC;;;sCAGkC;IAClC,gBAAgB,CAAC,EAAE,uBAAuB,CAAC;IAC3C;;4EAEwE;IACxE,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;;;;;;;;;yEAWqE;IACrE,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;0BAC0B;AAC1B,MAAM,WAAW,mBAAmB;IAClC,kDAAkD;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,wEAAwE;IACxE,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;2EAOuE;IACvE,MAAM,EAAE,cAAc,GAAG,WAAW,GAAG,gBAAgB,CAAC;CACzD;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,SAAQ,UAAU;IAC9C,QAAQ,CAAC,SAAS,EAAE,SAAS,mBAAmB,EAAE,CAAC;gBACvC,SAAS,EAAE,SAAS,mBAAmB,EAAE;CAKtD;AA+CD;;;;;;;;;;GAUG;AACH,wBAAsB,SAAS,CAC7B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,IAAI,CAAC,CAyFf"}
|
package/dist/verify-rls.js
CHANGED
|
@@ -43,9 +43,13 @@ export class RlsCoverageError extends DbRlsError {
|
|
|
43
43
|
function formatMessage(offenders) {
|
|
44
44
|
const lines = offenders.map((o) => {
|
|
45
45
|
const qualified = `${o.schema}.${o.relname}`;
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
46
|
+
if (o.reason === "not_found") {
|
|
47
|
+
return ` - ${qualified} (NOT FOUND — required RLS table is absent from the catalog)`;
|
|
48
|
+
}
|
|
49
|
+
if (o.reason === "force_disabled") {
|
|
50
|
+
return ` - ${qualified} (relforcerowsecurity = false — RLS enabled but NOT forced; the table owner bypasses every policy)`;
|
|
51
|
+
}
|
|
52
|
+
return ` - ${qualified} (relrowsecurity = false — RLS not enabled)`;
|
|
49
53
|
});
|
|
50
54
|
return `rls_coverage: ${offenders.length} RLS-required table(s) missing row-level security (08-rls § A1). A migration created the table but never \`ALTER TABLE ... ENABLE ROW LEVEL SECURITY\` — these tables leak every tenant's rows to the services/authenticated pools. Offenders:\n${lines.join("\n")}\nFix: add the canonical 5-policy DDL (withRls) for each, or register it as a § 7.6 reference table if it is genuinely platform-global GRANT-controlled data.`;
|
|
51
55
|
}
|
|
@@ -70,7 +74,8 @@ function key(r) {
|
|
|
70
74
|
}
|
|
71
75
|
/**
|
|
72
76
|
* Verifies that every table in `requiredTables` has row-level security
|
|
73
|
-
* enabled (`pg_class.relrowsecurity = true`),
|
|
77
|
+
* enabled (`pg_class.relrowsecurity = true`) — and, when `requireForce` is
|
|
78
|
+
* set, forced (`pg_class.relforcerowsecurity = true`) — exempting any § 7.6
|
|
74
79
|
* reference table. Resolves OK (returns `void`) when all required tables
|
|
75
80
|
* are covered; throws `RlsCoverageError` listing the offenders otherwise.
|
|
76
81
|
*
|
|
@@ -81,6 +86,7 @@ function key(r) {
|
|
|
81
86
|
export async function verifyRls(pool, opts) {
|
|
82
87
|
const defaultSchema = opts.schema ?? "public";
|
|
83
88
|
const exemptionsEnabled = opts.allowReferenceTables ?? true;
|
|
89
|
+
const requireForce = opts.requireForce ?? false;
|
|
84
90
|
// Build the exempt set (normalized schema.relname keys) + predicate.
|
|
85
91
|
const exemptKeys = new Set();
|
|
86
92
|
if (exemptionsEnabled && opts.referenceTables) {
|
|
@@ -107,7 +113,7 @@ export async function verifyRls(pool, opts) {
|
|
|
107
113
|
// resolves every table; missing rows are detected by set difference.
|
|
108
114
|
const schemas = toCheck.map((t) => t.schema);
|
|
109
115
|
const relnames = toCheck.map((t) => t.relname);
|
|
110
|
-
const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity
|
|
116
|
+
const res = await pool.query(`SELECT n.nspname, c.relname, c.relrowsecurity, c.relforcerowsecurity
|
|
111
117
|
FROM unnest($1::text[], $2::text[]) AS req(schemaname, tablename)
|
|
112
118
|
JOIN pg_namespace n ON n.nspname = req.schemaname
|
|
113
119
|
JOIN pg_class c ON c.relnamespace = n.oid
|
|
@@ -116,12 +122,16 @@ export async function verifyRls(pool, opts) {
|
|
|
116
122
|
// Index the catalog rows by schema.relname.
|
|
117
123
|
const found = new Map();
|
|
118
124
|
for (const row of res.rows) {
|
|
119
|
-
found.set(`${row.nspname}.${row.relname}`,
|
|
125
|
+
found.set(`${row.nspname}.${row.relname}`, {
|
|
126
|
+
enabled: row.relrowsecurity,
|
|
127
|
+
forced: row.relforcerowsecurity,
|
|
128
|
+
});
|
|
120
129
|
}
|
|
121
130
|
const offenders = [];
|
|
122
131
|
for (const t of toCheck) {
|
|
123
132
|
const k = key(t);
|
|
124
|
-
|
|
133
|
+
const state = found.get(k);
|
|
134
|
+
if (state === undefined) {
|
|
125
135
|
offenders.push({
|
|
126
136
|
table: t.original,
|
|
127
137
|
schema: t.schema,
|
|
@@ -129,7 +139,7 @@ export async function verifyRls(pool, opts) {
|
|
|
129
139
|
reason: "not_found",
|
|
130
140
|
});
|
|
131
141
|
}
|
|
132
|
-
else if (
|
|
142
|
+
else if (state.enabled === false) {
|
|
133
143
|
offenders.push({
|
|
134
144
|
table: t.original,
|
|
135
145
|
schema: t.schema,
|
|
@@ -137,6 +147,14 @@ export async function verifyRls(pool, opts) {
|
|
|
137
147
|
reason: "rls_disabled",
|
|
138
148
|
});
|
|
139
149
|
}
|
|
150
|
+
else if (requireForce && state.forced === false) {
|
|
151
|
+
offenders.push({
|
|
152
|
+
table: t.original,
|
|
153
|
+
schema: t.schema,
|
|
154
|
+
relname: t.relname,
|
|
155
|
+
reason: "force_disabled",
|
|
156
|
+
});
|
|
157
|
+
}
|
|
140
158
|
}
|
|
141
159
|
if (offenders.length > 0) {
|
|
142
160
|
throw new RlsCoverageError(offenders);
|
package/dist/verify-rls.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;
|
|
1
|
+
{"version":3,"file":"verify-rls.js","sourceRoot":"","sources":["../src/verify-rls.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,wEAAwE;AACxE,6DAA6D;AAC7D,uEAAuE;AACvE,oCAAoC;AACpC,EAAE;AACF,2EAA2E;AAC3E,oEAAoE;AACpE,oEAAoE;AACpE,yEAAyE;AACzE,sCAAsC;AACtC,EAAE;AACF,wEAAwE;AACxE,8DAA8D;AAC9D,kFAAkF;AAClF,0EAA0E;AAC1E,6EAA6E;AAC7E,8DAA8D;AAC9D,EAAE;AACF,yEAAyE;AACzE,sEAAsE;AACtE,+DAA+D;AAC/D,2EAA2E;AAC3E,iCAAiC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AA4ErC;;;;;GAKG;AACH,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IACrC,SAAS,CAAiC;IACnD,YAAY,SAAyC;QACnD,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAED,SAAS,aAAa,CAAC,SAAyC;IAC9D,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,SAAS,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7C,IAAI,CAAC,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAC7B,OAAO,OAAO,SAAS,8DAA8D,CAAC;QACxF,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,gBAAgB,EAAE,CAAC;YAClC,OAAO,OAAO,SAAS,oGAAoG,CAAC;QAC9H,CAAC;QACD,OAAO,OAAO,SAAS,6CAA6C,CAAC;IACvE,CAAC,CAAC,CAAC;IACH,OAAO,iBAAiB,SAAS,CAAC,MAAM,mPAAmP,KAAK,CAAC,IAAI,CACnS,IAAI,CACL,+JAA+J,CAAC;AACnK,CAAC;AASD,yEAAyE;AACzE,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;AACpC,CAAC;AAED;yEACyE;AACzE,SAAS,YAAY,CAAC,KAAa,EAAE,aAAqB;IACxD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9C,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED,8DAA8D;AAC9D,SAAS,GAAG,CAAC,CAAsC;IACjD,OAAO,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;AACpC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAgB,EAChB,IAAmB;IAEnB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC9C,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC;IAEhD,qEAAqE;IACrE,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;IACrC,IAAI,iBAAiB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACrC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACb,iBAAiB,IAAI,IAAI,CAAC,gBAAgB;QACxC,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,SAAS,CAAC;IAEhB,gEAAgE;IAChE,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;QAC3C,MAAM,QAAQ,GAAG,YAAY,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;QACvD,MAAM,QAAQ,GACZ,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC;IAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAM1B;;;;;oCAKgC,EAChC,CAAC,OAAO,EAAE,QAAQ,CAAC,CACpB,CAAC;IAEF,4CAA4C;IAC5C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAiD,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC3B,KAAK,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE;YACzC,OAAO,EAAE,GAAG,CAAC,cAAc;YAC3B,MAAM,EAAE,GAAG,CAAC,mBAAmB;SAChC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;YACnC,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAClD,SAAS,CAAC,IAAI,CAAC;gBACb,KAAK,EAAE,CAAC,CAAC,QAAQ;gBACjB,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,OAAO,EAAE,CAAC,CAAC,OAAO;gBAClB,MAAM,EAAE,gBAAgB;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@nodii/db-rls",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.8.0",
|
|
4
4
|
"description": "Three-pool RLS dispatch + GUC-set + entry-point helpers + RLS policy DDL generator for the Nodii microservice stack. Polyglot per D159 (TS + Python + Go). Spec: planning hub docKey=db-rls.",
|
|
5
5
|
"license": "MIT",
|
|
6
6
|
"type": "module",
|