@palbase/backend 29.0.0 → 30.0.1

package/dist/bin/palbase-backend.js

@@ -3,8 +3,8 @@ import {
   BootRefused,
   createApp,
   loadConfig
-} from "../chunk-DHJ3SYAE.js";
-import "../chunk-ESSQ3YML.js";
+} from "../chunk-RADVOY7Y.js";
+import "../chunk-YRVIWHJC.js";
 import "../chunk-SG4UTNOP.js";
 import "../chunk-3TUJWHC2.js";
 import {

package/dist/{chunk-DHJ3SYAE.js → chunk-RADVOY7Y.js}

@@ -6,7 +6,7 @@ import {
   assertNoOrphanEntryPoints,
   buildContainer,
   buildRelations
-} from "./chunk-ESSQ3YML.js";
+} from "./chunk-YRVIWHJC.js";
 import {
   qualifiedTableKey
 } from "./chunk-SG4UTNOP.js";
@@ -2971,7 +2971,7 @@ var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([
   409,
   429
 ]);
-async function refuseUnlessAuthorized(client, spec, requestId) {
+async function refuseUnlessAuthorized(client, spec, requestId, rolesOfCaller) {
   if (spec.permission !== void 0) {
     const [row] = await client.query("select auth.has_permission($1) as ok", [
       spec.permission
@@ -2981,16 +2981,22 @@ async function refuseUnlessAuthorized(client, spec, requestId) {
     }
   }
   if (spec.role !== void 0) {
-    const [row] = await client.query("select $1 = any(auth.app_roles()) as ok", [
-      spec.role
-    ]);
-    if (row?.ok !== true) {
+    const held = await rolesOfCaller();
+    if (!held.includes(spec.role)) {
       return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
     }
   }
   return null;
 }
 __name(refuseUnlessAuthorized, "refuseUnlessAuthorized");
+function makeRoleResolver(client) {
+  let pending = null;
+  return () => {
+    pending ??= client.query("select unnest(auth.app_roles()) as role").then((rows) => rows.map((r) => r.role));
+    return pending;
+  };
+}
+__name(makeRoleResolver, "makeRoleResolver");
 async function createApp(opts) {
   const { config, controllers } = opts;
   const container = buildContainer();
@@ -3039,6 +3045,7 @@ async function createApp(opts) {
       Database: db?.client ?? stubModule("Database (a start hook runs before any request \u2014 open your own connection here)"),
       Cache: cache,
       Log: log,
+      Auth: modules.Auth ?? stubModule("Auth"),
       Documents: modules.Documents ?? stubModule("Documents"),
       Storage: modules.Storage ?? stubModule("Storage"),
       Notifications: modules.Notifications ?? stubModule("Notifications"),
@@ -3089,7 +3096,7 @@ async function createApp(opts) {
         claimsJson: JSON.stringify(callerClaims)
       });
       try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId);
+        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
         if (refusal) {
           await uploadDb.commit();
           return refusal;
@@ -3136,8 +3143,9 @@ async function createApp(opts) {
       serviceRole: config.dbServiceRole,
       claimsJson: JSON.stringify(claims ?? {})
     });
+    const rolesOfCaller = makeRoleResolver(db.client);
     if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId);
+      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
       if (refusal) return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
@@ -3290,6 +3298,12 @@ async function createApp(opts) {
             role: claims.role,
             emailVerified: claims.email_verified === true,
             metadata: claims.metadata ?? {},
+            // The caller's APPLICATION roles, from `auth.user_roles` — the
+            // same resolution the gate used, so the handler cannot read a
+            // different set than the one it was admitted on. Never from a
+            // claim: a revoked role has to bite on the next request, and a
+            // token says only what was true when it was minted.
+            roles: await rolesOfCaller(),
             // Server-owned and only ever filled from a verdict palauth
             // returned. Never from a raw header, never from JWT metadata —
             // the type has said so since it was written and this is the
@@ -3551,4 +3565,4 @@ export {
   installEgressFence,
   createApp
 };
-//# sourceMappingURL=chunk-DHJ3SYAE.js.map
+//# sourceMappingURL=chunk-RADVOY7Y.js.map