@objectstack/verify 9.11.0

package/dist/index.cjs

@@ -0,0 +1,547 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  bootStack: () => bootStack,
+  deriveCrudCases: () => deriveCrudCases,
+  fillRelationalRefs: () => fillRelationalRefs,
+  formatReport: () => formatReport,
+  formatRlsReport: () => formatRlsReport,
+  runCrudVerification: () => runCrudVerification,
+  runRlsProofs: () => runRlsProofs
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/harness.ts
+var import_runtime = require("@objectstack/runtime");
+var import_objectql = require("@objectstack/objectql");
+var import_driver_sqlite_wasm = require("@objectstack/driver-sqlite-wasm");
+var import_plugin_hono_server = require("@objectstack/plugin-hono-server");
+var import_rest = require("@objectstack/rest");
+var import_plugin_auth = require("@objectstack/plugin-auth");
+var import_plugin_security = require("@objectstack/plugin-security");
+var import_plugin_sharing = require("@objectstack/plugin-sharing");
+var import_service_settings = require("@objectstack/service-settings");
+var import_service_analytics = require("@objectstack/service-analytics");
+var API_PREFIX = "/api/v1";
+var DEFAULT_ADMIN_EMAIL = "admin@objectos.ai";
+var DEFAULT_ADMIN_PASSWORD = "admin123";
+var DEFAULT_AUTH_SECRET = "objectstack-verify-secret";
+async function bootStack(config, opts = {}) {
+  process.env.NODE_ENV = "development";
+  const kernel = new import_runtime.ObjectKernel();
+  await kernel.use(new import_objectql.ObjectQLPlugin());
+  await kernel.use(new import_runtime.DriverPlugin(new import_driver_sqlite_wasm.SqliteWasmDriver({ filename: ":memory:" })));
+  await kernel.use(new import_plugin_hono_server.HonoServerPlugin({ port: 0 }));
+  await kernel.use(new import_runtime.AppPlugin(config));
+  await kernel.use(new import_service_settings.SettingsServicePlugin());
+  await kernel.use(new import_service_analytics.AnalyticsServicePlugin());
+  await kernel.use(new import_plugin_auth.AuthPlugin({ secret: opts.authSecret ?? DEFAULT_AUTH_SECRET }));
+  if (opts.multiTenant) {
+    const { OrgScopingPlugin } = await import("@objectstack/plugin-org-scoping");
+    await kernel.use(new OrgScopingPlugin());
+  }
+  if (opts.automation) {
+    const { AutomationServicePlugin } = await import("@objectstack/service-automation");
+    await kernel.use(new AutomationServicePlugin({ suspendedRunStore: "memory" }));
+  }
+  await kernel.use(opts.security ?? new import_plugin_security.SecurityPlugin());
+  await kernel.use(new import_plugin_sharing.SharingServicePlugin());
+  await kernel.use((0, import_rest.createRestApiPlugin)({ api: { api: { requireAuth: true } } }));
+  await kernel.use((0, import_runtime.createDispatcherPlugin)({}));
+  await kernel.bootstrap();
+  try {
+    const engine = await kernel.getServiceAsync("objectql");
+    if (engine && typeof engine.setCryptoProvider === "function") {
+      engine.setCryptoProvider(new import_service_settings.LocalCryptoProvider());
+    }
+  } catch {
+  }
+  const httpServer = await kernel.getServiceAsync(
+    "http-server"
+  );
+  const app = httpServer.getRawApp();
+  const ORIGIN = "http://localhost:3000";
+  const raw = (path, init) => app.request(`${ORIGIN}${path}`, init);
+  const api = (path, init) => raw(`${API_PREFIX}${path}`, init);
+  const admin = opts.admin ?? { email: DEFAULT_ADMIN_EMAIL, password: DEFAULT_ADMIN_PASSWORD };
+  const signIn = async (email = admin.email, password = admin.password) => {
+    const res = await api("/auth/sign-in/email", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password })
+    });
+    if (!res.ok) {
+      throw new Error(`verify signIn failed: ${res.status} ${await res.text()}`);
+    }
+    const data = await res.json();
+    if (!data.token) throw new Error("verify signIn: no token in response");
+    return data.token;
+  };
+  const signUp = async (email, password = "Member-Pass-123", name) => {
+    const res = await api("/auth/sign-up/email", {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ email, password, name: name ?? email.split("@")[0] })
+    });
+    if (!res.ok) {
+      throw new Error(`verify signUp failed: ${res.status} ${await res.text()}`);
+    }
+    const data = await res.json();
+    if (!data.token) throw new Error("verify signUp: no token in response");
+    return data.token;
+  };
+  const apiAs = (token, method, path, body) => api(path, {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${token}`
+    },
+    ...body !== void 0 ? { body: JSON.stringify(body) } : {}
+  });
+  const stop = async () => {
+    try {
+      await httpServer.close?.();
+    } catch {
+    }
+    try {
+      await kernel.shutdown?.();
+    } catch {
+    }
+  };
+  return { kernel, api, raw, signIn, signUp, apiAs, stop };
+}
+
+// src/derive.ts
+var COMPUTED = /* @__PURE__ */ new Set(["formula", "summary", "autonumber", "rollup", "vector"]);
+var RELATIONAL = /* @__PURE__ */ new Set(["lookup", "master_detail", "master-detail", "masterdetail", "tree"]);
+var STRUCTURED = /* @__PURE__ */ new Set(["composite", "repeater", "record", "location", "address"]);
+var MEDIA = /* @__PURE__ */ new Set(["image", "file", "avatar", "video", "audio", "signature", "qrcode"]);
+var SYSTEM_NAMES = /* @__PURE__ */ new Set([
+  "id",
+  "created_at",
+  "updated_at",
+  "created_by",
+  "updated_by",
+  "owner",
+  "space",
+  "instance_state",
+  "record_id",
+  "is_deleted"
+]);
+function clampNum(f, fallback) {
+  const { min, max, step } = f;
+  let v = fallback;
+  if (typeof min === "number" && v < min) v = min;
+  if (typeof max === "number" && v > max) v = max;
+  if (typeof step === "number" && typeof min === "number") {
+    v = min + step * Math.round((v - min) / step);
+  }
+  return v;
+}
+function synth(type, f) {
+  switch (type) {
+    case "text":
+    case "textarea":
+    case "string":
+    case "markdown":
+    case "html":
+    case "richtext":
+    case "code":
+      return { value: "verify-sample", kind: "equal" };
+    case "email":
+      return { value: "verify@example.com", kind: "equal" };
+    case "url":
+      return { value: "https://example.com", kind: "equal" };
+    case "phone":
+      return { value: "+14155550100", kind: "equal" };
+    case "color":
+      return { value: "#3366CC", kind: "equal" };
+    case "number":
+      return { value: clampNum(f, 7), kind: "equal" };
+    case "currency":
+      return { value: clampNum(f, 100), kind: "equal" };
+    case "percent":
+      return { value: clampNum(f, 50), kind: "equal" };
+    case "rating":
+      return { value: clampNum(f, Math.min(3, f.max ?? 5)), kind: "equal" };
+    case "slider":
+    case "progress":
+      return { value: clampNum(f, 25), kind: "equal" };
+    case "boolean":
+    case "toggle":
+      return { value: true, kind: "equal" };
+    case "date":
+      return { value: "2024-03-15", kind: "equal" };
+    case "datetime":
+      return { value: "2024-03-15T08:30:00.000Z", kind: "equal" };
+    case "time":
+      return { value: "14:30:00", kind: "equal" };
+    case "json":
+      return { value: { sample: true }, kind: "equal" };
+    case "select":
+    case "radio": {
+      const opt = f.options?.[0]?.value;
+      return opt != null ? { value: opt, kind: "equal" } : null;
+    }
+    case "multiselect":
+    case "checkboxes": {
+      const opt = f.options?.[0]?.value;
+      return opt != null ? { value: [opt], kind: "set" } : null;
+    }
+    case "tags":
+      return { value: ["alpha", "beta"], kind: "set" };
+    // Opaque-on-read: write a value but don't assert a round-trip (hashed/encrypted).
+    case "password":
+    case "secret":
+      return { value: "Sample-Secret-123", kind: "none" };
+    default:
+      return null;
+  }
+}
+function relationTarget(f) {
+  const ref = f?.reference ?? f?.reference_to ?? f?.referenceTo;
+  return typeof ref === "string" && ref.length > 0 ? ref : null;
+}
+function deriveCrudCases(config) {
+  const objects = config?.objects ?? [];
+  const byName = /* @__PURE__ */ new Map();
+  for (const o of objects) if (o?.name) byName.set(o.name, o);
+  const drafts = /* @__PURE__ */ new Map();
+  for (const obj of objects) {
+    if (!obj?.name) continue;
+    const fields = obj?.fields ?? {};
+    const d = {
+      name: obj.name,
+      body: {},
+      asserts: [],
+      skippedFields: [],
+      relationalRefs: [],
+      requiredTargets: []
+    };
+    for (const [name, f] of Object.entries(fields)) {
+      const type = String(f?.type ?? "").toLowerCase();
+      const isRequired = !!f?.required;
+      if (SYSTEM_NAMES.has(name) || f?.system || f?.readonly) continue;
+      if (COMPUTED.has(type)) continue;
+      if (RELATIONAL.has(type)) {
+        const target = relationTarget(f);
+        if (!target) {
+          if (isRequired) {
+            d.blocked = `required ${type} field "${name}" has no \`reference\` target`;
+            break;
+          }
+          d.skippedFields.push({ name, type, reason: "relation-missing-reference" });
+          continue;
+        }
+        if (!byName.has(target)) {
+          if (isRequired) {
+            d.blocked = `required ${type} field "${name}" \u2192 target "${target}" not in app config`;
+            break;
+          }
+          d.skippedFields.push({ name, type, reason: `relation-target-external:${target}` });
+          continue;
+        }
+        d.relationalRefs.push({ field: name, target, required: isRequired, multiple: !!f?.multiple });
+        if (isRequired) d.requiredTargets.push(target);
+        continue;
+      }
+      if (STRUCTURED.has(type) || MEDIA.has(type)) {
+        if (isRequired) {
+          d.blocked = `required ${type} field "${name}" (needs structured/media value)`;
+          break;
+        }
+        d.skippedFields.push({ name, type, reason: "unsynthesizable-optional" });
+        continue;
+      }
+      const s = synth(type, f);
+      if (!s) {
+        if (isRequired) {
+          d.blocked = `required field "${name}" of type "${type}" is not synthesizable`;
+          break;
+        }
+        d.skippedFields.push({ name, type, reason: "no-synth" });
+        continue;
+      }
+      d.body[name] = s.value;
+      if (s.kind !== "none") d.asserts.push({ field: name, type, value: s.value, kind: s.kind });
+    }
+    drafts.set(obj.name, d);
+  }
+  let changed = true;
+  while (changed) {
+    changed = false;
+    for (const d of drafts.values()) {
+      if (d.blocked) continue;
+      for (const t of d.requiredTargets) {
+        const td = drafts.get(t);
+        if (!td || td.blocked) {
+          d.blocked = `required relational target "${t}" is ${!td ? "missing" : "not synthesizable"}`;
+          changed = true;
+          break;
+        }
+      }
+    }
+  }
+  const emitted = /* @__PURE__ */ new Set();
+  const order = [];
+  const live = [...drafts.values()].filter((d) => !d.blocked).map((d) => d.name);
+  let progress = true;
+  while (progress) {
+    progress = false;
+    for (const name of live) {
+      if (emitted.has(name)) continue;
+      const d = drafts.get(name);
+      if (d.requiredTargets.every((t) => emitted.has(t))) {
+        emitted.add(name);
+        order.push(name);
+        progress = true;
+      }
+    }
+  }
+  for (const name of live) {
+    if (!emitted.has(name)) drafts.get(name).blocked = "unsatisfiable required-reference cycle";
+  }
+  const cases = [];
+  for (const name of order) {
+    const d = drafts.get(name);
+    cases.push({
+      object: d.name,
+      body: d.body,
+      asserts: d.asserts,
+      skippedFields: d.skippedFields,
+      ...d.relationalRefs.length ? { relationalRefs: d.relationalRefs } : {}
+    });
+  }
+  for (const d of drafts.values()) {
+    if (d.blocked) cases.push({ object: d.name, blocked: d.blocked });
+  }
+  return cases;
+}
+function fillRelationalRefs(c, created) {
+  const body = { ...c.body ?? {} };
+  for (const ref of c.relationalRefs ?? []) {
+    const id = created.get(ref.target);
+    if (id == null) {
+      if (ref.required) return { body, missing: `required relation "${ref.field}" \u2192 no created "${ref.target}" record` };
+      continue;
+    }
+    body[ref.field] = ref.multiple ? [id] : id;
+  }
+  return { body };
+}
+
+// src/verify.ts
+function setEqual(a, b) {
+  if (!Array.isArray(a)) return false;
+  return JSON.stringify([...a].sort()) === JSON.stringify([...b].sort());
+}
+function deepEqual(a, b) {
+  return JSON.stringify(a) === JSON.stringify(b);
+}
+async function runCrudVerification(stack, token, config) {
+  const cases = deriveCrudCases(config);
+  const results = [];
+  const createdIds = /* @__PURE__ */ new Map();
+  for (const c of cases) {
+    if (c.blocked) {
+      results.push({ object: c.object, status: "skipped", reason: c.blocked });
+      continue;
+    }
+    const { body, missing } = fillRelationalRefs(c, createdIds);
+    if (missing) {
+      results.push({ object: c.object, status: "skipped", reason: missing });
+      continue;
+    }
+    let created;
+    try {
+      created = await stack.apiAs(token, "POST", `/data/${c.object}`, body);
+    } catch (e) {
+      results.push({ object: c.object, status: "create-failed", detail: String(e?.message ?? e).slice(0, 200) });
+      continue;
+    }
+    if (created.status >= 300) {
+      const text = (await created.text()).slice(0, 280);
+      const isValidation = created.status === 400 && /VALIDATION_FAILED|Validation failed/i.test(text);
+      results.push({
+        object: c.object,
+        status: isValidation ? "needs-fixture" : "create-failed",
+        code: created.status,
+        detail: text
+      });
+      continue;
+    }
+    const cj = await created.json();
+    const id = cj?.id ?? cj?.record?.id;
+    if (!id) {
+      results.push({ object: c.object, status: "create-failed", detail: "no id returned" });
+      continue;
+    }
+    createdIds.set(c.object, String(id));
+    const got = await stack.apiAs(token, "GET", `/data/${c.object}/${id}`);
+    if (got.status !== 200) {
+      results.push({ object: c.object, status: "read-failed", code: got.status });
+      continue;
+    }
+    const rec = (await got.json())?.record ?? {};
+    const mismatches = [];
+    for (const a of c.asserts ?? []) {
+      const actual = rec[a.field];
+      const ok = a.kind === "set" ? setEqual(actual, a.value) : deepEqual(actual, a.value);
+      if (!ok) mismatches.push({ field: a.field, type: a.type, wrote: a.value, read: actual });
+    }
+    results.push({
+      object: c.object,
+      status: mismatches.length ? "fidelity-gaps" : "verified",
+      checked: (c.asserts ?? []).length,
+      ...mismatches.length ? { mismatches } : {}
+    });
+  }
+  const summary = {
+    objects: results.length,
+    verified: results.filter((r) => r.status === "verified").length,
+    fidelityGaps: results.filter((r) => r.status === "fidelity-gaps").length,
+    createFailed: results.filter((r) => r.status === "create-failed").length,
+    needsFixture: results.filter((r) => r.status === "needs-fixture").length,
+    readFailed: results.filter((r) => r.status === "read-failed").length,
+    skipped: results.filter((r) => r.status === "skipped").length,
+    mismatchTotal: results.reduce((n, r) => n + (r.mismatches?.length ?? 0), 0)
+  };
+  return { app: config?.manifest?.id ?? config?.manifest?.namespace ?? "app", results, summary };
+}
+function formatReport(report) {
+  const lines = [`
+=== objectstack verify \u2014 ${report.app} ===`];
+  for (const r of report.results) {
+    if (r.status === "verified") lines.push(`  \u2713 ${r.object}  (${r.checked} fields)`);
+    else if (r.status === "fidelity-gaps") {
+      lines.push(`  \u26A0 ${r.object}  ${r.mismatches.length} fidelity gap(s):`);
+      for (const m of r.mismatches) lines.push(`      ${m.field} <${m.type}>: wrote ${JSON.stringify(m.wrote)} \u2192 read ${JSON.stringify(m.read)}`);
+    } else if (r.status === "skipped") lines.push(`  \u2013 ${r.object}  skipped: ${r.reason}`);
+    else if (r.status === "needs-fixture") lines.push(`  ~ ${r.object}  needs-fixture (app validation rejected the auto-record): ${(r.detail ?? "").slice(0, 120)}`);
+    else lines.push(`  \u2717 ${r.object}  ${r.status}${r.code ? ` (${r.code})` : ""}: ${r.detail ?? ""}`);
+  }
+  const s = report.summary;
+  lines.push(`  \u2500\u2500 ${s.verified} verified, ${s.fidelityGaps} gaps, ${s.createFailed + s.readFailed} FAILED, ${s.needsFixture} needs-fixture, ${s.skipped} skipped (${s.mismatchTotal} mismatches)`);
+  return lines.join("\n");
+}
+
+// src/rls.ts
+var PROBE_TYPES = /* @__PURE__ */ new Set(["text", "textarea", "string"]);
+var MUTATION = "rls-mutated-by-B";
+async function runRlsProofs(stack, adminToken, memberToken, config) {
+  const cases = deriveCrudCases(config);
+  const results = [];
+  const createdIds = /* @__PURE__ */ new Map();
+  for (const c of cases) {
+    if (c.blocked) {
+      results.push({ object: c.object, status: "skipped", detail: c.blocked });
+      continue;
+    }
+    const probe = (c.asserts ?? []).find((a) => PROBE_TYPES.has(a.type));
+    if (!probe) {
+      results.push({ object: c.object, status: "skipped", detail: "no plain-text probe field" });
+      continue;
+    }
+    const { body, missing } = fillRelationalRefs(c, createdIds);
+    if (missing) {
+      results.push({ object: c.object, status: "skipped", detail: missing });
+      continue;
+    }
+    const created = await stack.apiAs(adminToken, "POST", `/data/${c.object}`, body);
+    if (created.status >= 300) {
+      results.push({ object: c.object, status: "skipped", detail: `admin create failed (${created.status})` });
+      continue;
+    }
+    const cj = await created.json();
+    const id = cj?.id ?? cj?.record?.id;
+    if (!id) {
+      results.push({ object: c.object, status: "skipped", detail: "no id from create" });
+      continue;
+    }
+    createdIds.set(c.object, String(id));
+    const bRead = await stack.apiAs(memberToken, "GET", `/data/${c.object}/${id}`);
+    let canRead = false;
+    if (bRead.status === 200) {
+      const rec = (await bRead.json())?.record;
+      canRead = !!rec && rec.id === id;
+    }
+    const bWrite = await stack.apiAs(memberToken, "PATCH", `/data/${c.object}/${id}`, { [probe.field]: MUTATION });
+    const after = await stack.apiAs(adminToken, "GET", `/data/${c.object}/${id}`);
+    const afterVal = ((await after.json())?.record ?? {})[probe.field];
+    const changed = afterVal === MUTATION;
+    if (canRead) {
+      results.push({ object: c.object, status: "member-visible", detail: "member can read this object \u2014 not a cross-owner scenario (no RLS isolation, or read is granted)" });
+    } else if (changed) {
+      results.push({
+        object: c.object,
+        status: "rls-hole",
+        detail: `member B cannot read it (GET ${bRead.status}) yet MUTATED it by id (PATCH ${bWrite.status}) \u2014 by-id write bypassed RLS (#1994 class)`
+      });
+    } else {
+      results.push({
+        object: c.object,
+        status: "rls-consistent",
+        detail: `member B cannot read (GET ${bRead.status}) and could not mutate (PATCH ${bWrite.status}, row unchanged)`
+      });
+    }
+  }
+  const summary = {
+    objects: results.length,
+    consistent: results.filter((r) => r.status === "rls-consistent").length,
+    holes: results.filter((r) => r.status === "rls-hole").length,
+    memberVisible: results.filter((r) => r.status === "member-visible").length,
+    skipped: results.filter((r) => r.status === "skipped").length
+  };
+  return { app: config?.manifest?.id ?? "app", results, summary };
+}
+function formatRlsReport(report) {
+  const lines = [`
+=== objectstack verify (RLS / #1994) \u2014 ${report.app} ===`];
+  for (const r of report.results) {
+    const mark = r.status === "rls-hole" ? "\u2717\u2717" : r.status === "rls-consistent" ? "\u2713" : r.status === "member-visible" ? "\xB7" : "\u2013";
+    lines.push(`  ${mark} ${r.object}  [${r.status}] ${r.detail ?? ""}`);
+  }
+  const s = report.summary;
+  lines.push(`  \u2500\u2500 ${s.consistent} consistent, ${s.holes} HOLES, ${s.memberVisible} member-visible, ${s.skipped} skipped`);
+  return lines.join("\n");
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  bootStack,
+  deriveCrudCases,
+  fillRelationalRefs,
+  formatReport,
+  formatRlsReport,
+  runCrudVerification,
+  runRlsProofs
+});
+//# sourceMappingURL=index.cjs.map