@palbase/backend 29.0.0 → 30.0.1

package/dist/bin/palbase-backend.cjs

@@ -1056,6 +1056,7 @@ var Storage = Object.assign({
 });
 var Cache = makeServiceProxy("Cache");
 var Secrets = makeServiceProxy("Secrets");
+var Auth = makeServiceProxy("Auth");
 var Log = makeServiceProxy("Log");
 var Notifications = makeServiceProxy("Notifications");
 var rawFlags = makeServiceProxy("Flags");
@@ -4514,7 +4515,7 @@ var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([
   409,
   429
 ]);
-async function refuseUnlessAuthorized(client, spec, requestId) {
+async function refuseUnlessAuthorized(client, spec, requestId, rolesOfCaller) {
   if (spec.permission !== void 0) {
     const [row] = await client.query("select auth.has_permission($1) as ok", [
       spec.permission
@@ -4524,16 +4525,22 @@ async function refuseUnlessAuthorized(client, spec, requestId) {
     }
   }
   if (spec.role !== void 0) {
-    const [row] = await client.query("select $1 = any(auth.app_roles()) as ok", [
-      spec.role
-    ]);
-    if (row?.ok !== true) {
+    const held = await rolesOfCaller();
+    if (!held.includes(spec.role)) {
       return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
     }
   }
   return null;
 }
 __name(refuseUnlessAuthorized, "refuseUnlessAuthorized");
+function makeRoleResolver(client) {
+  let pending = null;
+  return () => {
+    pending ??= client.query("select unnest(auth.app_roles()) as role").then((rows) => rows.map((r) => r.role));
+    return pending;
+  };
+}
+__name(makeRoleResolver, "makeRoleResolver");
 async function createApp(opts) {
   const { config, controllers } = opts;
   const container = buildContainer();
@@ -4582,6 +4589,7 @@ async function createApp(opts) {
       Database: db?.client ?? stubModule("Database (a start hook runs before any request \u2014 open your own connection here)"),
       Cache: cache,
       Log: log,
+      Auth: modules.Auth ?? stubModule("Auth"),
       Documents: modules.Documents ?? stubModule("Documents"),
       Storage: modules.Storage ?? stubModule("Storage"),
       Notifications: modules.Notifications ?? stubModule("Notifications"),
@@ -4632,7 +4640,7 @@ async function createApp(opts) {
         claimsJson: JSON.stringify(callerClaims)
       });
       try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId);
+        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
         if (refusal) {
           await uploadDb.commit();
           return refusal;
@@ -4679,8 +4687,9 @@ async function createApp(opts) {
       serviceRole: config.dbServiceRole,
       claimsJson: JSON.stringify(claims ?? {})
     });
+    const rolesOfCaller = makeRoleResolver(db.client);
     if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId);
+      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
       if (refusal) return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
@@ -4833,6 +4842,12 @@ async function createApp(opts) {
             role: claims.role,
             emailVerified: claims.email_verified === true,
             metadata: claims.metadata ?? {},
+            // The caller's APPLICATION roles, from `auth.user_roles` — the
+            // same resolution the gate used, so the handler cannot read a
+            // different set than the one it was admitted on. Never from a
+            // claim: a revoked role has to bite on the next request, and a
+            // token says only what was true when it was minted.
+            roles: await rolesOfCaller(),
             // Server-owned and only ever filled from a verdict palauth
             // returned. Never from a raw header, never from JWT metadata —
             // the type has said so since it was written and this is the