@palbase/backend 29.0.0 → 30.0.1

package/dist/db/index.d.cts

@@ -1,4 +1,4 @@
-export { f as AnyColumn, k as ColumnBuilder, l as ColumnDef, m as ColumnMap, n as ColumnType, E as EXTENSION_DEPENDENCIES, s as EmbeddingModelRef, u as EnvServiceDatabase, w as EnvTypedDatabase, N as InsertShape, V as Materialized, a0 as OnDeleteAction, a1 as PALBASE_EXTENSIONS, aA as PalbaseExtension, bx as PolicyBuilder, by as PolicyCommand, bz as PolicyDef, bC as PolicyMode, bE as RawConstraintDef, bG as Ref, bI as RowShape, S as SchemaDef, bR as TABLE_META, bS as TableDef, bT as TableHandle, bU as TableInput, bW as TxColumnExpr, bX as TxInsertShape, bZ as TxNow, b_ as TxPlan, T as TxPlanBody, b$ as TxPlanError, c0 as TxPlanHandle, c1 as TxPlanOpResult, c2 as TxPlanRejection, b as TxPlanResponse, c3 as TxRefError, c4 as TxRow, c5 as TxRows, c6 as TxSelectOptions, c7 as TxSetShape, c9 as TxTable, ca as TxTables, cb as TxWhere, ch as TypedDB, ci as TypedTable, cj as TypedTx, cs as bigint, ct as boolean, cv as dec, cy as defineSchema, cz as defineTable, cA as enumType, cC as inc, cF as installationRef, cG as integer, cH as isPalbaseExtension, cJ as jsonb, cK as makeTypedDB, cL as now, cP as openai, cQ as ownedByUser, cR as policy, cS as raw, cU as text, cV as timestamp, cW as userRef, cX as uuid, cY as vector } from '../index-ChvoVczS.cjs';
+export { f as AnyColumn, l as ColumnBuilder, m as ColumnDef, n as ColumnMap, o as ColumnType, E as EXTENSION_DEPENDENCIES, t as EmbeddingModelRef, v as EnvServiceDatabase, x as EnvTypedDatabase, O as InsertShape, W as Materialized, a1 as OnDeleteAction, a2 as PALBASE_EXTENSIONS, aC as PalbaseExtension, bz as PolicyBuilder, bA as PolicyCommand, bB as PolicyDef, bE as PolicyMode, bG as RawConstraintDef, bI as Ref, bK as RowShape, S as SchemaDef, bT as TABLE_META, bU as TableDef, bV as TableHandle, bW as TableInput, bY as TxColumnExpr, bZ as TxInsertShape, b$ as TxNow, c0 as TxPlan, T as TxPlanBody, c1 as TxPlanError, c2 as TxPlanHandle, c3 as TxPlanOpResult, c4 as TxPlanRejection, b as TxPlanResponse, c5 as TxRefError, c6 as TxRow, c7 as TxRows, c8 as TxSelectOptions, c9 as TxSetShape, cb as TxTable, cc as TxTables, cd as TxWhere, cj as TypedDB, ck as TypedTable, cl as TypedTx, cu as bigint, cv as boolean, cx as dec, cA as defineSchema, cB as defineTable, cC as enumType, cE as inc, cH as installationRef, cI as integer, cJ as isPalbaseExtension, cL as jsonb, cM as makeTypedDB, cN as now, cR as openai, cS as ownedByUser, cT as policy, cU as raw, cW as text, cX as timestamp, cY as userRef, cZ as uuid, c_ as vector } from '../index-DtCgaZAg.cjs';
 import './env.cjs';
 import '../stack.cjs';
 import 'zod';

package/dist/db/index.d.ts

@@ -1,4 +1,4 @@
-export { f as AnyColumn, k as ColumnBuilder, l as ColumnDef, m as ColumnMap, n as ColumnType, E as EXTENSION_DEPENDENCIES, s as EmbeddingModelRef, u as EnvServiceDatabase, w as EnvTypedDatabase, N as InsertShape, V as Materialized, a0 as OnDeleteAction, a1 as PALBASE_EXTENSIONS, aA as PalbaseExtension, bx as PolicyBuilder, by as PolicyCommand, bz as PolicyDef, bC as PolicyMode, bE as RawConstraintDef, bG as Ref, bI as RowShape, S as SchemaDef, bR as TABLE_META, bS as TableDef, bT as TableHandle, bU as TableInput, bW as TxColumnExpr, bX as TxInsertShape, bZ as TxNow, b_ as TxPlan, T as TxPlanBody, b$ as TxPlanError, c0 as TxPlanHandle, c1 as TxPlanOpResult, c2 as TxPlanRejection, b as TxPlanResponse, c3 as TxRefError, c4 as TxRow, c5 as TxRows, c6 as TxSelectOptions, c7 as TxSetShape, c9 as TxTable, ca as TxTables, cb as TxWhere, ch as TypedDB, ci as TypedTable, cj as TypedTx, cs as bigint, ct as boolean, cv as dec, cy as defineSchema, cz as defineTable, cA as enumType, cC as inc, cF as installationRef, cG as integer, cH as isPalbaseExtension, cJ as jsonb, cK as makeTypedDB, cL as now, cP as openai, cQ as ownedByUser, cR as policy, cS as raw, cU as text, cV as timestamp, cW as userRef, cX as uuid, cY as vector } from '../index-BOe82fsK.js';
+export { f as AnyColumn, l as ColumnBuilder, m as ColumnDef, n as ColumnMap, o as ColumnType, E as EXTENSION_DEPENDENCIES, t as EmbeddingModelRef, v as EnvServiceDatabase, x as EnvTypedDatabase, O as InsertShape, W as Materialized, a1 as OnDeleteAction, a2 as PALBASE_EXTENSIONS, aC as PalbaseExtension, bz as PolicyBuilder, bA as PolicyCommand, bB as PolicyDef, bE as PolicyMode, bG as RawConstraintDef, bI as Ref, bK as RowShape, S as SchemaDef, bT as TABLE_META, bU as TableDef, bV as TableHandle, bW as TableInput, bY as TxColumnExpr, bZ as TxInsertShape, b$ as TxNow, c0 as TxPlan, T as TxPlanBody, c1 as TxPlanError, c2 as TxPlanHandle, c3 as TxPlanOpResult, c4 as TxPlanRejection, b as TxPlanResponse, c5 as TxRefError, c6 as TxRow, c7 as TxRows, c8 as TxSelectOptions, c9 as TxSetShape, cb as TxTable, cc as TxTables, cd as TxWhere, cj as TypedDB, ck as TypedTable, cl as TypedTx, cu as bigint, cv as boolean, cx as dec, cA as defineSchema, cB as defineTable, cC as enumType, cE as inc, cH as installationRef, cI as integer, cJ as isPalbaseExtension, cL as jsonb, cM as makeTypedDB, cN as now, cR as openai, cS as ownedByUser, cT as policy, cU as raw, cW as text, cX as timestamp, cY as userRef, cZ as uuid, c_ as vector } from '../index-8qy3kIuA.js';
 import './env.js';
 import '../stack.js';
 import 'zod';

package/dist/engine/index.cjs

@@ -1092,6 +1092,7 @@ var Storage = Object.assign({
 });
 var Cache = makeServiceProxy("Cache");
 var Secrets = makeServiceProxy("Secrets");
+var Auth = makeServiceProxy("Auth");
 var Log = makeServiceProxy("Log");
 var Notifications = makeServiceProxy("Notifications");
 var rawFlags = makeServiceProxy("Flags");
@@ -4608,7 +4609,7 @@ var AUTHOR_ANSWERED = /* @__PURE__ */ new Set([
   409,
   429
 ]);
-async function refuseUnlessAuthorized(client, spec, requestId) {
+async function refuseUnlessAuthorized(client, spec, requestId, rolesOfCaller) {
   if (spec.permission !== void 0) {
     const [row] = await client.query("select auth.has_permission($1) as ok", [
       spec.permission
@@ -4618,16 +4619,22 @@ async function refuseUnlessAuthorized(client, spec, requestId) {
     }
   }
   if (spec.role !== void 0) {
-    const [row] = await client.query("select $1 = any(auth.app_roles()) as ok", [
-      spec.role
-    ]);
-    if (row?.ok !== true) {
+    const held = await rolesOfCaller();
+    if (!held.includes(spec.role)) {
       return envelope("forbidden", `This endpoint requires the "${spec.role}" role`, 403, requestId);
     }
   }
   return null;
 }
 __name(refuseUnlessAuthorized, "refuseUnlessAuthorized");
+function makeRoleResolver(client) {
+  let pending = null;
+  return () => {
+    pending ??= client.query("select unnest(auth.app_roles()) as role").then((rows) => rows.map((r) => r.role));
+    return pending;
+  };
+}
+__name(makeRoleResolver, "makeRoleResolver");
 async function createApp(opts) {
   const { config, controllers } = opts;
   const container = buildContainer();
@@ -4676,6 +4683,7 @@ async function createApp(opts) {
       Database: db?.client ?? stubModule("Database (a start hook runs before any request \u2014 open your own connection here)"),
       Cache: cache,
       Log: log,
+      Auth: modules.Auth ?? stubModule("Auth"),
       Documents: modules.Documents ?? stubModule("Documents"),
       Storage: modules.Storage ?? stubModule("Storage"),
       Notifications: modules.Notifications ?? stubModule("Notifications"),
@@ -4726,7 +4734,7 @@ async function createApp(opts) {
         claimsJson: JSON.stringify(callerClaims)
       });
       try {
-        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId);
+        const refusal = await refuseUnlessAuthorized(uploadDb.client, spec, requestId, makeRoleResolver(uploadDb.client));
         if (refusal) {
           await uploadDb.commit();
           return refusal;
@@ -4773,8 +4781,9 @@ async function createApp(opts) {
       serviceRole: config.dbServiceRole,
       claimsJson: JSON.stringify(claims ?? {})
     });
+    const rolesOfCaller = makeRoleResolver(db.client);
     if (claims) {
-      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId);
+      const refusal = await refuseUnlessAuthorized(db.client, spec, requestId, rolesOfCaller);
       if (refusal) return refusal;
     }
     if (claims && spec.verifiedEmail && claims.email_verified !== true) {
@@ -4927,6 +4936,12 @@ async function createApp(opts) {
             role: claims.role,
             emailVerified: claims.email_verified === true,
             metadata: claims.metadata ?? {},
+            // The caller's APPLICATION roles, from `auth.user_roles` — the
+            // same resolution the gate used, so the handler cannot read a
+            // different set than the one it was admitted on. Never from a
+            // claim: a revoked role has to bite on the next request, and a
+            // token says only what was true when it was minted.
+            roles: await rolesOfCaller(),
             // Server-owned and only ever filled from a verdict palauth
             // returned. Never from a raw header, never from JWT metadata —
             // the type has said so since it was written and this is the