@pgpmjs/core 7.32.8 → 7.33.0

package/esm/init/client.js

@@ -69,12 +69,12 @@ export class PgpmInit {
      * @param username - The username to create
      * @param password - The password for the user
      * @param roles - Role mapping from getConnEnvOptions().roles!
-     * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+     * @param options - Role locking and explicit RLS bypass (off by default).
      */
-    async bootstrapDbRoles(username, password, roles, useLocksForRoles = false) {
+    async bootstrapDbRoles(username, password, roles, options = {}) {
         try {
             log.info(`Bootstrapping PGPM database roles for user: ${username}...`);
-            const sql = generateCreateUserSQL(username, password, roles, useLocksForRoles);
+            const sql = generateCreateUserSQL(username, password, roles, options);
             await this.pool.query(sql);
             log.success(`Successfully bootstrapped PGPM database roles for user: ${username}`);
         }

package/esm/roles/index.js

@@ -183,12 +183,12 @@ COMMIT;
 `;
 }
 /**
- * Generate SQL to create a user with password and grant base roles.
+ * Generate SQL to create or reconcile a login and grant base roles.
  * Callers should use getConnEnvOptions() from @pgpmjs/env to get merged values.
  * @param roles - Role mapping from getConnEnvOptions().roles!
- * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+ * @param options - Role locking and explicit RLS bypass (off by default).
  */
-export function generateCreateUserSQL(username, password, roles, useLocksForRoles = false) {
+export function generateCreateUserSQL(username, password, roles, { useLocksForRoles = false, bypassRls = false } = {}) {
     if (!roles) {
         throw new Error('generateCreateUserSQL: roles parameter is undefined. ' +
             'Ensure getConnEnvOptions().roles is defined.');
@@ -231,6 +231,8 @@ BEGIN
     END;
   END IF;
 
+  EXECUTE format('ALTER ROLE %I LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION ${bypassRls ? 'BYPASSRLS' : 'NOBYPASSRLS'} PASSWORD %L', v_username, v_password);
+
   -- Grant anonymous to user
   IF NOT EXISTS (
     SELECT 1 FROM pg_auth_members am
@@ -245,8 +247,7 @@ BEGIN
         -- 23505: Membership was granted concurrently; safe to ignore
         NULL;
       WHEN undefined_object THEN
-        -- 42704: One of the roles doesn't exist; log notice and continue
-        RAISE NOTICE 'Missing role when granting % to %', v_anonymous, v_username;
+        RAISE;
       WHEN insufficient_privilege THEN
         -- 42501: Must surface this error - caller lacks permission
         RAISE;
@@ -270,8 +271,7 @@ BEGIN
         -- 23505: Membership was granted concurrently; safe to ignore
         NULL;
       WHEN undefined_object THEN
-        -- 42704: One of the roles doesn't exist; log notice and continue
-        RAISE NOTICE 'Missing role when granting % to %', v_authenticated, v_username;
+        RAISE;
       WHEN insufficient_privilege THEN
         -- 42501: Must surface this error - caller lacks permission
         RAISE;

package/init/client.d.ts

@@ -1,5 +1,6 @@
 import { RoleMapping, TestUserCredentials } from '@pgpmjs/types';
 import { PgConfig } from 'pg-env';
+import { CreateUserOptions } from '../roles';
 export declare class PgpmInit {
     private pool;
     private pgConfig;
@@ -30,9 +31,9 @@ export declare class PgpmInit {
      * @param username - The username to create
      * @param password - The password for the user
      * @param roles - Role mapping from getConnEnvOptions().roles!
-     * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+     * @param options - Role locking and explicit RLS bypass (off by default).
      */
-    bootstrapDbRoles(username: string, password: string, roles: RoleMapping, useLocksForRoles?: boolean): Promise<void>;
+    bootstrapDbRoles(username: string, password: string, roles: RoleMapping, options?: CreateUserOptions): Promise<void>;
     /**
      * Remove database roles and revoke grants.
      * Callers should use getConnEnvOptions() from @pgpmjs/env to get merged values.

package/init/client.js

@@ -72,12 +72,12 @@ class PgpmInit {
      * @param username - The username to create
      * @param password - The password for the user
      * @param roles - Role mapping from getConnEnvOptions().roles!
-     * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+     * @param options - Role locking and explicit RLS bypass (off by default).
      */
-    async bootstrapDbRoles(username, password, roles, useLocksForRoles = false) {
+    async bootstrapDbRoles(username, password, roles, options = {}) {
         try {
             log.info(`Bootstrapping PGPM database roles for user: ${username}...`);
-            const sql = (0, roles_1.generateCreateUserSQL)(username, password, roles, useLocksForRoles);
+            const sql = (0, roles_1.generateCreateUserSQL)(username, password, roles, options);
             await this.pool.query(sql);
             log.success(`Successfully bootstrapped PGPM database roles for user: ${username}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pgpmjs/core",
-  "version": "7.32.8",
+  "version": "7.33.0",
   "author": "Constructive <developers@constructive.io>",
   "description": "PGPM Package and Migration Tools",
   "main": "index.js",
@@ -49,15 +49,15 @@
     "makage": "^0.8.0"
   },
   "dependencies": {
-    "@pgpmjs/ast": "^0.15.7",
-    "@pgpmjs/bundle": "^0.18.7",
-    "@pgpmjs/diff": "^0.8.9",
-    "@pgpmjs/env": "^2.47.0",
+    "@pgpmjs/ast": "^0.15.8",
+    "@pgpmjs/bundle": "^0.18.8",
+    "@pgpmjs/diff": "^0.8.10",
+    "@pgpmjs/env": "^2.47.1",
     "@pgpmjs/logger": "^2.26.0",
-    "@pgpmjs/server-utils": "^3.29.7",
-    "@pgpmjs/slice": "^0.19.9",
-    "@pgpmjs/transform": "^0.28.9",
-    "@pgpmjs/types": "^2.57.0",
+    "@pgpmjs/server-utils": "^3.29.8",
+    "@pgpmjs/slice": "^0.19.10",
+    "@pgpmjs/transform": "^0.28.10",
+    "@pgpmjs/types": "^2.57.1",
     "cross-spawn": "^7.0.6",
     "csv-to-pg": "^4.14.3",
     "genomic": "^5.6.6",
@@ -65,12 +65,12 @@
     "glob": "^13.0.6",
     "parse-package-name": "^1.0.0",
     "pg": "^8.21.0",
-    "pg-cache": "^3.29.7",
-    "pg-env": "^1.32.0",
+    "pg-cache": "^3.29.8",
+    "pg-env": "^1.32.1",
     "pgsql-deparser": "^18.3.12",
     "pgsql-parser": "^18.2.12",
     "yaml": "^2.9.0",
     "yanse": "^0.2.2"
   },
-  "gitHead": "850fc5e75a3a31e2db2fc28aa58377e886fe3c6a"
+  "gitHead": "bf845a1b0701f57f6900d9e2a3c66ea48e125cc3"
 }

package/roles/index.d.ts

@@ -20,13 +20,17 @@ export declare function generateCreateBaseRolesSQL(roles: RoleMapping): string;
  * @param statementTimeout - Baseline statement_timeout for the role (default '15s')
  */
 export declare function generateCreateClientRoleSQL(roles: RoleMapping, statementTimeout?: string): string;
+export interface CreateUserOptions {
+    useLocksForRoles?: boolean;
+    bypassRls?: boolean;
+}
 /**
- * Generate SQL to create a user with password and grant base roles.
+ * Generate SQL to create or reconcile a login and grant base roles.
  * Callers should use getConnEnvOptions() from @pgpmjs/env to get merged values.
  * @param roles - Role mapping from getConnEnvOptions().roles!
- * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+ * @param options - Role locking and explicit RLS bypass (off by default).
  */
-export declare function generateCreateUserSQL(username: string, password: string, roles: RoleMapping, useLocksForRoles?: boolean): string;
+export declare function generateCreateUserSQL(username: string, password: string, roles: RoleMapping, { useLocksForRoles, bypassRls }?: CreateUserOptions): string;
 /**
  * Generate SQL to create test users with grants to base roles.
  * Callers should use getConnEnvOptions() from @pgpmjs/env to get merged values.

package/roles/index.js

@@ -192,12 +192,12 @@ COMMIT;
 `;
 }
 /**
- * Generate SQL to create a user with password and grant base roles.
+ * Generate SQL to create or reconcile a login and grant base roles.
  * Callers should use getConnEnvOptions() from @pgpmjs/env to get merged values.
  * @param roles - Role mapping from getConnEnvOptions().roles!
- * @param useLocksForRoles - Whether to use advisory locks (from getConnEnvOptions().useLocksForRoles)
+ * @param options - Role locking and explicit RLS bypass (off by default).
  */
-function generateCreateUserSQL(username, password, roles, useLocksForRoles = false) {
+function generateCreateUserSQL(username, password, roles, { useLocksForRoles = false, bypassRls = false } = {}) {
     if (!roles) {
         throw new Error('generateCreateUserSQL: roles parameter is undefined. ' +
             'Ensure getConnEnvOptions().roles is defined.');
@@ -240,6 +240,8 @@ BEGIN
     END;
   END IF;
 
+  EXECUTE format('ALTER ROLE %I LOGIN INHERIT NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION ${bypassRls ? 'BYPASSRLS' : 'NOBYPASSRLS'} PASSWORD %L', v_username, v_password);
+
   -- Grant anonymous to user
   IF NOT EXISTS (
     SELECT 1 FROM pg_auth_members am
@@ -254,8 +256,7 @@ BEGIN
         -- 23505: Membership was granted concurrently; safe to ignore
         NULL;
       WHEN undefined_object THEN
-        -- 42704: One of the roles doesn't exist; log notice and continue
-        RAISE NOTICE 'Missing role when granting % to %', v_anonymous, v_username;
+        RAISE;
       WHEN insufficient_privilege THEN
         -- 42501: Must surface this error - caller lacks permission
         RAISE;
@@ -279,8 +280,7 @@ BEGIN
         -- 23505: Membership was granted concurrently; safe to ignore
         NULL;
       WHEN undefined_object THEN
-        -- 42704: One of the roles doesn't exist; log notice and continue
-        RAISE NOTICE 'Missing role when granting % to %', v_authenticated, v_username;
+        RAISE;
       WHEN insufficient_privilege THEN
         -- 42501: Must surface this error - caller lacks permission
         RAISE;