@palbase/backend 28.0.0 → 30.0.0

package/dist/bin/palbase-backend.cjs

@@ -912,6 +912,7 @@ function makeTableProxy(ops, prefix) {
         // DÖRDÜNCÜ FİİL, aynı gerekçeyle: tip söz veriyor, ops katmanı
         // uyguluyor, ve bir handler'ın gerçekten dokunduğu yer BURASI.
         // `runtime-table-verbs` kapısı bunu adıyla saydı.
+        aggregate: /* @__PURE__ */ __name((q) => ops().aggregate(name, q), "aggregate"),
         insertMany: /* @__PURE__ */ __name((rows, opts) => ops().insertMany(name, rows, opts), "insertMany"),
         update: /* @__PURE__ */ __name((q) => ops().update(name, q.where.id, q.set), "update"),
         delete: /* @__PURE__ */ __name((id) => ops().delete(name, id), "delete"),
@@ -969,6 +970,7 @@ function makeTypedSurface(raw) {
     $claim: /* @__PURE__ */ __name((table, unique, extra) => reco.claim(table, unique, extra), "$claim"),
     $lockRows: /* @__PURE__ */ __name((table, ids) => reco.lockRows(table, ids), "$lockRows"),
     $advisoryXactLock: /* @__PURE__ */ __name((key) => reco.advisoryXactLock(key), "$advisoryXactLock"),
+    $aggregate: /* @__PURE__ */ __name((table, q) => raw.aggregate(table, q), "$aggregate"),
     $insertMany: /* @__PURE__ */ __name((table, rows, opts) => raw.insertMany(table, rows, opts), "$insertMany"),
     $supersede: /* @__PURE__ */ __name((table, id, row) => raw.supersede(table, id, row), "$supersede")
   };
@@ -1054,6 +1056,7 @@ var Storage = Object.assign({
 });
 var Cache = makeServiceProxy("Cache");
 var Secrets = makeServiceProxy("Secrets");
+var Auth = makeServiceProxy("Auth");
 var Log = makeServiceProxy("Log");
 var Notifications = makeServiceProxy("Notifications");
 var rawFlags = makeServiceProxy("Flags");
@@ -1299,9 +1302,11 @@ function effectiveAuth(routeAuth, controllerAuth) {
   };
   const o = spec;
   const role = typeof o.role === "string" && o.role.trim() !== "" ? o.role.trim() : void 0;
+  const permission = typeof o.permission === "string" && o.permission.trim() !== "" ? o.permission.trim() : void 0;
   return {
     required: o.required !== false,
     role,
+    permission,
     verifiedEmail: o.verifiedEmail === true
   };
 }
@@ -2289,6 +2294,26 @@ function buildValueTuple(table, cols, data, add, caller) {
   }).join(", ");
 }
 __name(buildValueTuple, "buildValueTuple");
+function columnTypeOf(table, col) {
+  const def = tableDefOf(table);
+  const c = def?.columns?.[col];
+  if (c === void 0 || c === null) return null;
+  const d = typeof c === "object" && "_def" in c ? c._def : c;
+  return d !== null && typeof d === "object" && typeof d.type === "string" ? d.type : null;
+}
+__name(columnTypeOf, "columnTypeOf");
+var NUMERIC_PG_TYPES = /* @__PURE__ */ new Set([
+  "integer",
+  "bigint",
+  "numeric"
+]);
+function aggregateExpr(table, fn, col, alias) {
+  const q = `t.${quoteIdent(col)}`;
+  const t = columnTypeOf(table, col);
+  if (fn === "sum" || fn === "avg") return `${fn}(${q})::text AS ${quoteIdent(alias)}`;
+  return t !== null && NUMERIC_PG_TYPES.has(t) && t !== "integer" ? `${fn}(${q})::text AS ${quoteIdent(alias)}` : `${fn}(${q}) AS ${quoteIdent(alias)}`;
+}
+__name(aggregateExpr, "aggregateExpr");
 function createOps(tx) {
   const at = /* @__PURE__ */ __name(() => resolveTx(tx), "at");
   const ops = {
@@ -2569,7 +2594,7 @@ function createOps(tx) {
     * should not silently succeed. Callers who mean every row say so with a
     * predicate that is true for every row.
     */
-    async updateMany(table, where, set) {
+    async updateMany(table, where, set, opts) {
       assertNotAppendOnly("updateMany", table);
       const cols = Object.keys(set);
       if (cols.length === 0) {
@@ -2592,8 +2617,15 @@ function createOps(tx) {
       const whereSql = compileWhere(table, known, where, add, "updateMany");
       assertHasPredicate(whereSql, "updateMany", table);
       const pk = primaryKeyOf(table);
-      const sql = isSinglePkEquality(where, pk) || pk === null ? `UPDATE ${quoteTable(table)} AS t SET ${assignments} WHERE true${whereSql} RETURNING *` : `WITH locked AS (SELECT t.${quoteIdent(pk)} FROM ${quoteTable(table)} t WHERE true${whereSql} ORDER BY t.${quoteIdent(pk)} FOR NO KEY UPDATE) UPDATE ${quoteTable(table)} AS t SET ${assignments} FROM locked WHERE t.${quoteIdent(pk)} = locked.${quoteIdent(pk)} RETURNING t.*`;
-      return asTableRows(table, await (await at()).unsafe(sql, params));
+      const wantRows = opts?.returning !== false;
+      const tail = wantRows ? "RETURNING *" : "RETURNING 1";
+      const simple = isSinglePkEquality(where, pk) || pk === null;
+      const body = simple ? `UPDATE ${quoteTable(table)} AS t SET ${assignments} WHERE true${whereSql} ${tail}` : `UPDATE ${quoteTable(table)} AS t SET ${assignments} FROM locked WHERE t.${quoteIdent(pk)} = locked.${quoteIdent(pk)} ` + (wantRows ? "RETURNING t.*" : "RETURNING 1");
+      const lockedCte = simple ? "" : `WITH locked AS (SELECT t.${quoteIdent(pk)} FROM ${quoteTable(table)} t WHERE true${whereSql} ORDER BY t.${quoteIdent(pk)} FOR NO KEY UPDATE) `;
+      const sql = wantRows ? `${lockedCte}${body}` : simple ? `WITH upd AS (${body}) SELECT count(*)::int AS n FROM upd` : `${lockedCte.replace(/ $/, "")}, upd AS (${body}) SELECT count(*)::int AS n FROM upd`;
+      const out = await (await at()).unsafe(sql, params);
+      if (!wantRows) return Number(out[0]?.["n"] ?? 0);
+      return asTableRows(table, out);
     },
     /**
     * Delete every row the filter matches, in ONE statement; resolves to how
@@ -2623,6 +2655,78 @@ function createOps(tx) {
     * An empty filter is legitimate HERE: counting a whole table is a read, and
     * reads do not destroy anything.
     */
+    /**
+    * Toplama — `count`'un yanına `sum`/`avg`/`min`/`max` ve `groupBy`.
+    *
+    * Var olma nedeni: bunlar olmadan "bu hesabın toplamı" ya `$query`'ye ya da
+    * TÜM satırları çekip JS'te toplamaya düşüyor. İkincisi hem N+1 hem de para
+    * için YANLIŞ — `numeric` JS `number`'ına uğradığı anda kesinliğini
+    * kaybeder.
+    *
+    * `groupBy` verilirse SATIRLAR döner, verilmezse TEK sonuç. Boş kümede
+    * Postgres NULL döndürür, 0 değil — ve bu SDK onu `null` olarak geçiriyor:
+    * "hiç satır yoktu" ile "toplam sıfırdı" farklı şeyler.
+    */
+    async aggregate(table, q = {}) {
+      const known = schemaColumns(table);
+      const check = /* @__PURE__ */ __name((col, where) => {
+        if (known !== null && !known.has(col)) {
+          throw new Error(`aggregate(${table}): ${where} kolonu "${col}" tabloda yok (FR-016)`);
+        }
+      }, "check");
+      const parts = [];
+      const wants = [];
+      for (const fn of [
+        "sum",
+        "avg",
+        "min",
+        "max"
+      ]) {
+        for (const col of q[fn] ?? []) {
+          check(col, fn);
+          if (fn === "sum" || fn === "avg") {
+            const t = columnTypeOf(table, col);
+            if (t !== null && !NUMERIC_PG_TYPES.has(t)) {
+              throw new Error(`aggregate(${table}): ${fn}("${col}") say\u0131sal olmayan bir kolonda \u2014 "${col}" bir ${t} kolonu. Toplama yaln\u0131z integer/bigint/numeric kolonlarda anlaml\u0131; ka\xE7 sat\u0131r oldu\u011Funu saymak i\xE7in count: true kullan\u0131n.`);
+            }
+          }
+          const alias = `${fn}__${col}`;
+          wants.push({
+            fn,
+            col,
+            alias
+          });
+          parts.push(aggregateExpr(table, fn, col, alias));
+        }
+      }
+      if (q.count === true) parts.push('count(*) AS "_count"');
+      if (parts.length === 0) {
+        throw new Error(`aggregate(${table}): hi\xE7bir toplama istenmedi \u2014 sonu\xE7 bo\u015F bir nesne olurdu. sum/avg/min/max kolonlar\u0131n\u0131 ya da count: true'yu verin.`);
+      }
+      const groups = q.groupBy ?? [];
+      for (const col of groups) check(col, "groupBy");
+      const groupSel = groups.map((c) => `t.${quoteIdent(c)} AS ${quoteIdent(`g__${c}`)}`);
+      const params = [];
+      const add = /* @__PURE__ */ __name((v) => `$${params.push(v)}`, "add");
+      const whereSql = compileWhere(table, known, q.where ?? {}, add, "aggregate");
+      const groupSql = groups.length > 0 ? ` GROUP BY ${groups.map((c) => `t.${quoteIdent(c)}`).join(", ")}` : "";
+      const sql = `SELECT ${[
+        ...groupSel,
+        ...parts
+      ].join(", ")} FROM ${quoteTable(table)} t WHERE true${whereSql}${groupSql}`;
+      const rows = await (await at()).unsafe(sql, params);
+      const shape = /* @__PURE__ */ __name((r) => {
+        const out = {};
+        for (const c of groups) out[c] = r[`g__${c}`];
+        for (const w of wants) {
+          const bucket = out[w.fn] ??= {};
+          bucket[w.col] = r[w.alias] ?? null;
+        }
+        if (q.count === true) out["count"] = Number(r["_count"] ?? 0);
+        return out;
+      }, "shape");
+      return groups.length > 0 ? rows.map(shape) : shape(rows[0] ?? {});
+    },
     async count(table, where = {}) {
       const params = [];
       const add = /* @__PURE__ */ __name((v) => {
@@ -4411,6 +4515,32 @@ var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([
   409,
   429
 ]);
+async function refuseUnlessAuthorized(client, spec, requestId, rolesOfCaller) {
+  if (spec.permission !== void 0) {
+    const [row] = await client.query("select auth.has_permission($1) as ok", [
+      spec.permission
+    ]);
+    if (row?.ok !== true) {
+      return envelope("forbidden", `This endpoint requires the "${spec.permission}" permission`, 403, requestId);
+    }
+  }
+  if (spec.role !== void 0) {
+    const held = await rolesOfCaller();
+    if (!held.includes(spec.role)) {
+      return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
+    }
+  }
+  return null;
+}
+__name(refuseUnlessAuthorized, "refuseUnlessAuthorized");
+function makeRoleResolver(client) {
+  let pending = null;
+  return () => {
+    pending ??= client.query("select unnest(auth.app_roles()) as role").then((rows) => rows.map((r) => r.role));
+    return pending;
+  };
+}
+__name(makeRoleResolver, "makeRoleResolver");
 async function createApp(opts) {
   const { config, controllers } = opts;
   const container = buildContainer();
@@ -4459,6 +4589,7 @@ async function createApp(opts) {
       Database: db?.client ?? stubModule("Database (a start hook runs before any request \u2014 open your own connection here)"),
       Cache: cache,
       Log: log,
+      Auth: modules.Auth ?? stubModule("Auth"),
       Documents: modules.Documents ?? stubModule("Documents"),
       Storage: modules.Storage ?? stubModule("Storage"),
       Notifications: modules.Notifications ?? stubModule("Notifications"),
@@ -4502,8 +4633,23 @@ async function createApp(opts) {
     if (spec.required && !callerClaims) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
-    if (callerClaims && spec.role && callerClaims.role !== spec.role) {
-      return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
+    if (callerClaims) {
+      const uploadDb = createRequestDatabase(sql, {
+        role: config.dbRole,
+        serviceRole: config.dbServiceRole,
+        claimsJson: JSON.stringify(callerClaims)
+      });
+      try {
+        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
+        if (refusal) {
+          await uploadDb.commit();
+          return refusal;
+        }
+        await uploadDb.commit();
+      } catch (err) {
+        await uploadDb.rollback(err);
+        throw err;
+      }
     }
     const grant = grantFor(target?.entry, {
       userId: typeof callerClaims?.sub === "string" ? callerClaims.sub : null,
@@ -4536,8 +4682,15 @@ async function createApp(opts) {
       return envelope("unauthorized", "A valid access token is required", 401, requestId);
     }
     const userId = typeof claims?.sub === "string" ? claims.sub : void 0;
-    if (claims && spec.role && claims.role !== spec.role) {
-      return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
+    const db = createRequestDatabase(sql, {
+      role: config.dbRole,
+      serviceRole: config.dbServiceRole,
+      claimsJson: JSON.stringify(claims ?? {})
+    });
+    const rolesOfCaller = makeRoleResolver(db.client);
+    if (claims) {
+      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
+      if (refusal) return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
       return envelope("email_not_verified", "A verified email address is required", 403, requestId);
@@ -4689,6 +4842,12 @@ async function createApp(opts) {
             role: claims.role,
             emailVerified: claims.email_verified === true,
             metadata: claims.metadata ?? {},
+            // The caller's APPLICATION roles, from `auth.user_roles` — the
+            // same resolution the gate used, so the handler cannot read a
+            // different set than the one it was admitted on. Never from a
+            // claim: a revoked role has to bite on the next request, and a
+            // token says only what was true when it was minted.
+            roles: await rolesOfCaller(),
             // Server-owned and only ever filled from a verdict palauth
             // returned. Never from a raw header, never from JWT metadata —
             // the type has said so since it was written and this is the
@@ -4758,11 +4917,6 @@ async function createApp(opts) {
           args[p.index] = void 0;
       }
     }
-    const db = createRequestDatabase(sql, {
-      role: config.dbRole,
-      serviceRole: config.dbServiceRole,
-      claimsJson: JSON.stringify(claims ?? {})
-    });
     try {
       const services = buildServices(db);
       if (meta.options?.sseConfig !== void 0) {