@objectstack/service-analytics 8.0.0 → 8.0.1

package/dist/index.d.cts

@@ -131,8 +131,13 @@ interface AnalyticsServiceConfig {
      * object (exactly what `RLSCompiler` emits). The service binds the active
      * context per query and the strategy compiles the filter into alias-qualified
      * SQL injected into every base and joined table.
+     *
+     * MAY be async: the production bridge resolves RLS from the `security`
+     * service's `getReadFilter`, which can hit the database. The service
+     * pre-resolves the scope for every base + joined object of a query (before
+     * the synchronous SQL builder runs), so a sync return still works unchanged.
      */
-    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined;
+    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined | Promise<FilterCondition | null | undefined>;
     /**
      * ADR-0021 D-C — join allowlist per cube (the dataset's declared `include`).
      * Joins outside this set are rejected by the strategy. Compiled datasets
@@ -186,6 +191,20 @@ declare class AnalyticsService implements IAnalyticsService {
      * `getReadScope(objectName)` that already knows the active tenant.
      */
     private callCtx;
+    /**
+     * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
+     * AND every joined object of the query's cube, keyed by object name. This is
+     * the async pre-pass that lets the synchronous strategy enforce scoping even
+     * when the provider (security `getReadFilter`) resolves asynchronously.
+     *
+     * The object set is `cube.sql` (base) plus every `cube.joins[*].name` — a
+     * SUPERSET of what the strategy actually scans (the strategy only joins along
+     * declared relationships), so no scanned object is ever left unscoped.
+     *
+     * Fail-closed: if the provider throws for an object, the whole query is
+     * rejected rather than emitting SQL with that object unscoped.
+     */
+    private resolveReadScopes;
     /**
      * Execute an analytical query by delegating to the first capable strategy.
      */
@@ -270,7 +289,7 @@ interface AnalyticsServicePluginOptions {
      * emits). When omitted, the plugin auto-bridges to a registered `'security'`
      * service exposing `getReadFilter(object, context)` if one is present.
      */
-    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined;
+    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined | Promise<FilterCondition | null | undefined>;
     /**
      * ADR-0021 D-C — join allowlist per cube (the dataset's declared `include`).
      * Typically wired from the dataset registry's compiled `allowedRelationships`.

package/dist/index.d.ts

@@ -131,8 +131,13 @@ interface AnalyticsServiceConfig {
      * object (exactly what `RLSCompiler` emits). The service binds the active
      * context per query and the strategy compiles the filter into alias-qualified
      * SQL injected into every base and joined table.
+     *
+     * MAY be async: the production bridge resolves RLS from the `security`
+     * service's `getReadFilter`, which can hit the database. The service
+     * pre-resolves the scope for every base + joined object of a query (before
+     * the synchronous SQL builder runs), so a sync return still works unchanged.
      */
-    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined;
+    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined | Promise<FilterCondition | null | undefined>;
     /**
      * ADR-0021 D-C — join allowlist per cube (the dataset's declared `include`).
      * Joins outside this set are rejected by the strategy. Compiled datasets
@@ -186,6 +191,20 @@ declare class AnalyticsService implements IAnalyticsService {
      * `getReadScope(objectName)` that already knows the active tenant.
      */
     private callCtx;
+    /**
+     * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
+     * AND every joined object of the query's cube, keyed by object name. This is
+     * the async pre-pass that lets the synchronous strategy enforce scoping even
+     * when the provider (security `getReadFilter`) resolves asynchronously.
+     *
+     * The object set is `cube.sql` (base) plus every `cube.joins[*].name` — a
+     * SUPERSET of what the strategy actually scans (the strategy only joins along
+     * declared relationships), so no scanned object is ever left unscoped.
+     *
+     * Fail-closed: if the provider throws for an object, the whole query is
+     * rejected rather than emitting SQL with that object unscoped.
+     */
+    private resolveReadScopes;
     /**
      * Execute an analytical query by delegating to the first capable strategy.
      */
@@ -270,7 +289,7 @@ interface AnalyticsServicePluginOptions {
      * emits). When omitted, the plugin auto-bridges to a registered `'security'`
      * service exposing `getReadFilter(object, context)` if one is present.
      */
-    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined;
+    getReadScope?: (objectName: string, context?: ExecutionContext) => FilterCondition | null | undefined | Promise<FilterCondition | null | undefined>;
     /**
      * ADR-0021 D-C — join allowlist per cube (the dataset's declared `include`).
      * Typically wired from the dataset registry's compiled `allowedRelationships`.

package/dist/index.js

@@ -1139,13 +1139,60 @@ var AnalyticsService = class {
    * current request's ExecutionContext (ADR-0021 D-C). The strategy then sees a
    * `getReadScope(objectName)` that already knows the active tenant.
    */
-  callCtx(context) {
+  async callCtx(query, context) {
     if (!this.readScopeProvider) return this.baseCtx;
+    const scopes = await this.resolveReadScopes(query, context);
     return {
       ...this.baseCtx,
-      getReadScope: (objectName) => this.readScopeProvider(objectName, context)
+      getReadScope: (objectName) => scopes.get(objectName) ?? null
     };
   }
+  /**
+   * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
+   * AND every joined object of the query's cube, keyed by object name. This is
+   * the async pre-pass that lets the synchronous strategy enforce scoping even
+   * when the provider (security `getReadFilter`) resolves asynchronously.
+   *
+   * The object set is `cube.sql` (base) plus every `cube.joins[*].name` — a
+   * SUPERSET of what the strategy actually scans (the strategy only joins along
+   * declared relationships), so no scanned object is ever left unscoped.
+   *
+   * Fail-closed: if the provider throws for an object, the whole query is
+   * rejected rather than emitting SQL with that object unscoped.
+   */
+  async resolveReadScopes(query, context) {
+    const map = /* @__PURE__ */ new Map();
+    const provider = this.readScopeProvider;
+    if (!provider || !query.cube) return map;
+    const cube = this.cubeRegistry.get(query.cube);
+    if (!cube) return map;
+    const objects = /* @__PURE__ */ new Set();
+    if (typeof cube.sql === "string" && cube.sql.trim()) {
+      objects.add(cube.sql.trim());
+    }
+    const joins = cube.joins;
+    if (joins) {
+      for (const [alias, j] of Object.entries(joins)) {
+        objects.add(j?.name ?? alias);
+      }
+    }
+    for (const object of objects) {
+      let filter;
+      try {
+        filter = await provider(object, context);
+      } catch (e) {
+        this.logger.error?.(
+          `[Analytics] read-scope resolution failed for object "${object}" \u2014 rejecting query (fail-closed, ADR-0021 D-C)`,
+          e instanceof Error ? e : new Error(String(e))
+        );
+        throw new Error(
+          `[Analytics] read-scope resolution failed for "${object}"; query denied (fail-closed).`
+        );
+      }
+      if (filter != null) map.set(object, filter);
+    }
+    return map;
+  }
   /**
    * Execute an analytical query by delegating to the first capable strategy.
    */
@@ -1154,7 +1201,7 @@ var AnalyticsService = class {
       throw new Error("Cube name is required in analytics query");
     }
     this.ensureCube(query);
-    const ctx = this.callCtx(context);
+    const ctx = await this.callCtx(query, context);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] Query on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.execute(query, ctx);
@@ -1209,7 +1256,7 @@ var AnalyticsService = class {
       throw new Error("Cube name is required for SQL generation");
     }
     this.ensureCube(query);
-    const ctx = this.callCtx(context);
+    const ctx = await this.callCtx(query, context);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] generateSql on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.generateSql(query, ctx);