@polardbx/pxbaas-client 0.1.0-beta.1 → 0.1.0-beta.10

package/dist/drivers/tenant-admin.driver.d.ts

@@ -0,0 +1,130 @@
+/**
+ * Tenant Admin Driver — 多租户实例的「平台管理员」侧客户端。
+ *
+ * 对接 Studio BFF 的平台管理端点（经 Kong `dashboard` catch-all + basic-auth 保护，
+ * 见 kong/mysql/kong.yml 的 dashboard 服务与 DASHBOARD consumer）：
+ *   - GET    /api/platform/tenants            列租户（`{ tenants, multiTenantMode }`）
+ *   - GET    /api/platform/tenants/{id}       单租户（响应即租户行，顶层展开）
+ *   - POST   /api/platform/tenants            建/复活租户（201，响应为租户行 + `realtime_provisioned`）
+ *   - PATCH  /api/platform/tenants/{id}       改属性/改键（白名单字段，不含 jwt_secret）
+ *   - PATCH  /api/platform/tenants            补空密钥（仅 anon_key/service_role_key 为 NULL 的行）
+ *   - DELETE /api/platform/tenants/{id}       删除（软删）
+ *
+ * 认证模型：HTTP Basic（DASHBOARD_USERNAME / DASHBOARD_PASSWORD）。数据面的 anon /
+ * service_role key 在这里一律不适用——全局密钥访问租户管理面会被网关挡掉。
+ *
+ * ── 脱敏纪律（务必遵守）──────────────────────────────────────────────
+ * 这些端点的响应体**同时包含 `jwt_secret`（租户签名母密钥）与两把明文密钥**。母密钥
+ * 一旦外泄，持有者可自签任意 role / tenant_id / 期限的 token，危害高于 service_role。
+ * 因此本 driver 在**解析层**就把 `jwt_secret` 从所有返回类型里剥离，密钥值只在调用方
+ * 显式要求（{@link TenantAdminDriver.getKeys} / {@link TenantAdminDriver.create}）时以
+ * `TenantKeyBundle` 单独返回，其余任何路径都拿不到密钥明文。脱敏不依赖调用方自觉。
+ */
+export interface TenantAdminDriverOptions {
+    /** Kong 网关地址（必须是网关，不能是 Studio 端口，否则绕过 basic-auth）。 */
+    endpoint: string;
+    username: string;
+    password: string;
+    timeout?: number;
+}
+/** 平台侧租户行中可安全外传的部分（无任何密钥材料）。 */
+export interface RedactedTenant {
+    tenantId: string;
+    tenantCode?: string;
+    displayName?: string;
+    status: string;
+    plan?: string;
+    dbName?: string;
+    dbUser?: string;
+    ossPrefix?: string;
+    retentionDays?: number | string | null;
+    createdAt?: string;
+    updatedAt?: string;
+    deletedAt?: string | null;
+    /** `anon_key` 是否已签发（NULL 表示存量租户缺密钥，需要 repair-keys）。 */
+    hasAnonKey: boolean;
+    hasServiceRoleKey: boolean;
+    /** 是否处于软删除态：同名 create 会走「复活并重置密钥」分支，属破坏性动作。 */
+    softDeleted: boolean;
+}
+/** 仅由显式取键路径返回；调用方只能把它写进钥匙串或 0600 交付包，绝不打印。 */
+export interface TenantKeyBundle {
+    anonKey: string | null;
+    serviceRoleKey: string | null;
+}
+export interface TenantListResult {
+    multiTenantMode: boolean;
+    tenants: RedactedTenant[];
+}
+export interface TenantCreateInput {
+    tenantId: string;
+    plan?: string;
+    ossPrefix?: string;
+    retentionDays?: number;
+    tenantCode?: string;
+    displayName?: string;
+    dbName?: string;
+    dbUser?: string;
+}
+export interface TenantCreateResult {
+    tenant: RedactedTenant;
+    keys: TenantKeyBundle;
+    /** 平台是否在创建时成功把租户注册进 Realtime（false 时该租户的 WS 握手会 403）。 */
+    realtimeProvisioned?: boolean;
+}
+/** 补空密钥的结果（`PATCH /api/platform/tenants`）。 */
+export interface TenantRepairKeysResult {
+    message: string;
+    updated: number;
+}
+/** 平台管理面调用的统一错误（携带机器码 + HTTP 状态）。 */
+export declare class TenantAdminError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    constructor(code: string, message: string, status?: number);
+}
+export declare class TenantAdminDriver {
+    private readonly client;
+    constructor(options: TenantAdminDriverOptions);
+    /**
+     * 列租户。注意 Studio 侧在多租户关闭时返回 `{ tenants: [], multiTenantMode: false }`，
+     * 而元数据查询失败时同样返回 200 + 空列表（`multiTenantMode: true`）——两者需在
+     * 上层区分，见 `tenant/probe.ts`。
+     */
+    list(statusFilter?: string): Promise<TenantListResult>;
+    /** 单租户详情（脱敏行）。404 归一化为 TENANT_NOT_FOUND。 */
+    get(tenantId: string): Promise<RedactedTenant>;
+    /**
+     * 显式取该租户的密钥。唯一会返回密钥明文的读路径：调用方必须只把它送进
+     * 钥匙串或 `0600` 交付包，不得写入 stdout / `--json` / 日志。
+     */
+    getKeys(tenantId: string): Promise<TenantKeyBundle>;
+    /**
+     * 建租户。**撞名是破坏性的**：同名租户若处于软删除态，平台会复活它并**重新生成
+     * `jwt_secret`、覆写两把密钥**。调用方必须先 `get()` 判重并显式确认。
+     */
+    create(input: TenantCreateInput): Promise<TenantCreateResult>;
+    /** 改租户属性（服务端白名单：display_name/status/plan/db_name/db_user/oss_prefix/anon_key/service_role_key）。 */
+    update(tenantId: string, patch: {
+        displayName?: string;
+        status?: string;
+        plan?: string;
+    }): Promise<RedactedTenant>;
+    /**
+     * 补空密钥：只对 `jwt_secret` 有值但 `anon_key`/`service_role_key` 为 NULL 的存量行，
+     * 用**原 secret** 重签两把键。幂等、非破坏性。
+     *
+     * 这不是轮换：已签发的密钥不会被作废（HS256 无 jti / 无撤销表）。
+     */
+    repairKeys(): Promise<TenantRepairKeysResult>;
+    /** 删除租户（平台侧软删 + 资源回收，具体语义由平台 purge 流程负责）。 */
+    remove(tenantId: string): Promise<void>;
+    private request;
+}
+/**
+ * Studio 的错误体是 `{ error: { message } }`（apiWrapper 兜底时为 `{ error: "<msg>" }`），
+ * 401 也可能是 Kong basic-auth 直接返回的 `{ message }`。逐级兜底并保留状态码语义，
+ * 否则调用方无法区分"口令错"与"租户不存在"。
+ */
+export declare function normalizeTenantAdminError(error: unknown): TenantAdminError;
+//# sourceMappingURL=tenant-admin.driver.d.ts.map

package/dist/drivers/tenant-admin.driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-admin.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/tenant-admin.driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,MAAM,WAAW,wBAAwB;IACvC,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,gCAAgC;AAChC,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IACvC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,uDAAuD;IACvD,UAAU,EAAE,OAAO,CAAC;IACpB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,+CAA+C;IAC/C,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,8CAA8C;AAC9C,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,cAAc,CAAC;IACvB,IAAI,EAAE,eAAe,CAAC;IACtB,yDAAyD;IACzD,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B;AAED,8CAA8C;AAC9C,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qCAAqC;AACrC,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAM3D;AAsBD,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,OAAO,EAAE,wBAAwB;IAS7C;;;;OAIG;IACG,IAAI,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAe5D,4CAA4C;IACtC,GAAG,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOpD;;;OAGG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOzD;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAmBnE,mGAAmG;IAC7F,MAAM,CACV,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,cAAc,CAAC;IAW1B;;;;;OAKG;IACG,UAAU,IAAI,OAAO,CAAC,sBAAsB,CAAC;IAUnD,6CAA6C;IACvC,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAM/B,OAAO;CAUtB;AAwCD;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CA0C1E"}

package/dist/drivers/tenant-admin.driver.js

@@ -0,0 +1,222 @@
+/**
+ * Tenant Admin Driver — 多租户实例的「平台管理员」侧客户端。
+ *
+ * 对接 Studio BFF 的平台管理端点（经 Kong `dashboard` catch-all + basic-auth 保护，
+ * 见 kong/mysql/kong.yml 的 dashboard 服务与 DASHBOARD consumer）：
+ *   - GET    /api/platform/tenants            列租户（`{ tenants, multiTenantMode }`）
+ *   - GET    /api/platform/tenants/{id}       单租户（响应即租户行，顶层展开）
+ *   - POST   /api/platform/tenants            建/复活租户（201，响应为租户行 + `realtime_provisioned`）
+ *   - PATCH  /api/platform/tenants/{id}       改属性/改键（白名单字段，不含 jwt_secret）
+ *   - PATCH  /api/platform/tenants            补空密钥（仅 anon_key/service_role_key 为 NULL 的行）
+ *   - DELETE /api/platform/tenants/{id}       删除（软删）
+ *
+ * 认证模型：HTTP Basic（DASHBOARD_USERNAME / DASHBOARD_PASSWORD）。数据面的 anon /
+ * service_role key 在这里一律不适用——全局密钥访问租户管理面会被网关挡掉。
+ *
+ * ── 脱敏纪律（务必遵守）──────────────────────────────────────────────
+ * 这些端点的响应体**同时包含 `jwt_secret`（租户签名母密钥）与两把明文密钥**。母密钥
+ * 一旦外泄，持有者可自签任意 role / tenant_id / 期限的 token，危害高于 service_role。
+ * 因此本 driver 在**解析层**就把 `jwt_secret` 从所有返回类型里剥离，密钥值只在调用方
+ * 显式要求（{@link TenantAdminDriver.getKeys} / {@link TenantAdminDriver.create}）时以
+ * `TenantKeyBundle` 单独返回，其余任何路径都拿不到密钥明文。脱敏不依赖调用方自觉。
+ */
+import axios from "axios";
+/** 平台管理面调用的统一错误（携带机器码 + HTTP 状态）。 */
+export class TenantAdminError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = "TenantAdminError";
+        this.code = code;
+        this.status = status;
+    }
+}
+export class TenantAdminDriver {
+    client;
+    constructor(options) {
+        const endpoint = options.endpoint.replace(/\/$/, "");
+        this.client = axios.create({
+            baseURL: `${endpoint}/api/platform/tenants`,
+            timeout: options.timeout ?? 30_000,
+            auth: { username: options.username, password: options.password },
+        });
+    }
+    /**
+     * 列租户。注意 Studio 侧在多租户关闭时返回 `{ tenants: [], multiTenantMode: false }`，
+     * 而元数据查询失败时同样返回 200 + 空列表（`multiTenantMode: true`）——两者需在
+     * 上层区分，见 `tenant/probe.ts`。
+     */
+    async list(statusFilter) {
+        const response = await this.request(() => this.client.get("", {
+            params: statusFilter ? { status: statusFilter } : undefined,
+        }));
+        return {
+            multiTenantMode: response?.multiTenantMode !== false,
+            tenants: (response?.tenants ?? []).map(redact),
+        };
+    }
+    /** 单租户详情（脱敏行）。404 归一化为 TENANT_NOT_FOUND。 */
+    async get(tenantId) {
+        const row = await this.request(() => this.client.get(`/${encodeURIComponent(tenantId)}`));
+        return redact(row);
+    }
+    /**
+     * 显式取该租户的密钥。唯一会返回密钥明文的读路径：调用方必须只把它送进
+     * 钥匙串或 `0600` 交付包，不得写入 stdout / `--json` / 日志。
+     */
+    async getKeys(tenantId) {
+        const row = await this.request(() => this.client.get(`/${encodeURIComponent(tenantId)}`));
+        return keysOf(row);
+    }
+    /**
+     * 建租户。**撞名是破坏性的**：同名租户若处于软删除态，平台会复活它并**重新生成
+     * `jwt_secret`、覆写两把密钥**。调用方必须先 `get()` 判重并显式确认。
+     */
+    async create(input) {
+        const body = { tenant_id: input.tenantId };
+        if (input.plan !== undefined)
+            body.plan = input.plan;
+        if (input.ossPrefix !== undefined)
+            body.oss_prefix = input.ossPrefix;
+        if (input.retentionDays !== undefined)
+            body.retention_days = input.retentionDays;
+        if (input.tenantCode !== undefined)
+            body.tenant_code = input.tenantCode;
+        if (input.displayName !== undefined)
+            body.display_name = input.displayName;
+        if (input.dbName !== undefined)
+            body.db_name = input.dbName;
+        if (input.dbUser !== undefined)
+            body.db_user = input.dbUser;
+        const row = await this.request(() => this.client.post("", body));
+        return {
+            tenant: redact(row),
+            keys: keysOf(row),
+            realtimeProvisioned: typeof row?.realtime_provisioned === "boolean" ? row.realtime_provisioned : undefined,
+        };
+    }
+    /** 改租户属性（服务端白名单：display_name/status/plan/db_name/db_user/oss_prefix/anon_key/service_role_key）。 */
+    async update(tenantId, patch) {
+        const body = {};
+        if (patch.displayName !== undefined)
+            body.display_name = patch.displayName;
+        if (patch.status !== undefined)
+            body.status = patch.status;
+        if (patch.plan !== undefined)
+            body.plan = patch.plan;
+        const row = await this.request(() => this.client.patch(`/${encodeURIComponent(tenantId)}`, body));
+        return redact(row);
+    }
+    /**
+     * 补空密钥：只对 `jwt_secret` 有值但 `anon_key`/`service_role_key` 为 NULL 的存量行，
+     * 用**原 secret** 重签两把键。幂等、非破坏性。
+     *
+     * 这不是轮换：已签发的密钥不会被作废（HS256 无 jti / 无撤销表）。
+     */
+    async repairKeys() {
+        const body = await this.request(() => this.client.patch("", {}));
+        return {
+            message: typeof body?.message === "string" ? body.message : "backfill attempted",
+            updated: typeof body?.updated === "number" ? body.updated : 0,
+        };
+    }
+    /** 删除租户（平台侧软删 + 资源回收，具体语义由平台 purge 流程负责）。 */
+    async remove(tenantId) {
+        await this.request(() => this.client.delete(`/${encodeURIComponent(tenantId)}`));
+    }
+    async request(operation) {
+        try {
+            const response = await operation();
+            return (response.data ?? {});
+        }
+        catch (error) {
+            throw normalizeTenantAdminError(error);
+        }
+    }
+}
+/**
+ * 租户行 → 可安全外传的结构。**显式构造**而非展开，新增列默认不会外泄；
+ * `jwt_secret` 因此无论平台侧返回什么都不会离开解析层。
+ */
+function redact(row) {
+    const r = row ?? {};
+    const status = str(r.status) ?? "";
+    return {
+        tenantId: str(r.tenant_id) ?? "",
+        tenantCode: optStr(r.tenant_code),
+        displayName: optStr(r.display_name),
+        status,
+        plan: optStr(r.plan),
+        dbName: optStr(r.db_name),
+        dbUser: optStr(r.db_user),
+        ossPrefix: optStr(r.oss_prefix),
+        retentionDays: typeof r.retention_days === "number" || r.retention_days == null
+            ? r.retention_days
+            : String(r.retention_days),
+        createdAt: optStr(r.created_at),
+        updatedAt: optStr(r.updated_at),
+        deletedAt: r.deleted_at == null ? null : String(r.deleted_at),
+        hasAnonKey: isNonEmptyString(r.anon_key),
+        hasServiceRoleKey: isNonEmptyString(r.service_role_key),
+        softDeleted: status === "deleted",
+    };
+}
+function keysOf(row) {
+    return {
+        anonKey: isNonEmptyString(row?.anon_key) ? String(row?.anon_key) : null,
+        serviceRoleKey: isNonEmptyString(row?.service_role_key)
+            ? String(row?.service_role_key)
+            : null,
+    };
+}
+/**
+ * Studio 的错误体是 `{ error: { message } }`（apiWrapper 兜底时为 `{ error: "<msg>" }`），
+ * 401 也可能是 Kong basic-auth 直接返回的 `{ message }`。逐级兜底并保留状态码语义，
+ * 否则调用方无法区分"口令错"与"租户不存在"。
+ */
+export function normalizeTenantAdminError(error) {
+    if (!axios.isAxiosError(error)) {
+        const message = error instanceof Error ? error.message : String(error);
+        return new TenantAdminError("TENANT_ADMIN_UNKNOWN_ERROR", message);
+    }
+    const axiosError = error;
+    const status = axiosError.response?.status;
+    const body = axiosError.response?.data;
+    const nested = body?.error && typeof body.error === "object"
+        ? body.error.message
+        : typeof body?.error === "string"
+            ? body.error
+            : undefined;
+    const message = typeof nested === "string" && nested
+        ? nested
+        : typeof body?.message === "string" && body.message
+            ? body.message
+            : status
+                ? `Tenant admin request failed (HTTP ${status})`
+                : axiosError.message || "Tenant admin network request failed";
+    const code = status === 401
+        ? "TENANT_ADMIN_UNAUTHORIZED"
+        : status === 403
+            ? "TENANT_ADMIN_FORBIDDEN"
+            : status === 404
+                ? "TENANT_NOT_FOUND"
+                : status === 409
+                    ? "TENANT_ALREADY_EXISTS"
+                    : status === 400
+                        ? "TENANT_ADMIN_BAD_REQUEST"
+                        : status
+                            ? `TENANT_ADMIN_HTTP_${status}`
+                            : "TENANT_ADMIN_NETWORK_ERROR";
+    return new TenantAdminError(code, message, status);
+}
+function str(value) {
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+function optStr(value) {
+    return value == null ? undefined : String(value);
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.length > 0;
+}
+//# sourceMappingURL=tenant-admin.driver.js.map

package/dist/drivers/tenant-admin.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-admin.driver.js","sourceRoot":"","sources":["../../src/drivers/tenant-admin.driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAA8C,MAAM,OAAO,CAAC;AAkEnE,qCAAqC;AACrC,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAS;IACb,MAAM,CAAU;IAEzB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAsBD,MAAM,OAAO,iBAAiB;IACX,MAAM,CAAgB;IAEvC,YAAY,OAAiC;QAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,GAAG,QAAQ,uBAAuB;YAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM;YAClC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,IAAI,CAAC,YAAqB;QAC9B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAGhC,GAAG,EAAE,CACN,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;YAClB,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CACH,CAAC;QACF,OAAO;YACL,eAAe,EAAE,QAAQ,EAAE,eAAe,KAAK,KAAK;YACpD,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;SAC/C,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,KAAK,CAAC,GAAG,CAAC,QAAgB;QACxB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAY,GAAG,EAAE,CAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAY,GAAG,EAAE,CAC7C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CACpD,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAwB;QACnC,MAAM,IAAI,GAA4B,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;QACpE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACrD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,IAAI,KAAK,CAAC,aAAa,KAAK,SAAS;YAAE,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,aAAa,CAAC;QACjF,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC,UAAU,CAAC;QACxE,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;QAE5D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAY,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;QAC5E,OAAO;YACL,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;YACnB,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC;YACjB,mBAAmB,EACjB,OAAO,GAAG,EAAE,oBAAoB,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,SAAS;SACxF,CAAC;IACJ,CAAC;IAED,mGAAmG;IACnG,KAAK,CAAC,MAAM,CACV,QAAgB,EAChB,KAA+D;QAE/D,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QAC3E,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3D,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACrD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAY,GAAG,EAAE,CAC7C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC,CAC5D,CAAC;QACF,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU;QACd,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAA2C,GAAG,EAAE,CAC7E,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAC1B,CAAC;QACF,OAAO;YACL,OAAO,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB;YAChF,OAAO,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,MAAM,IAAI,CAAC,OAAO,CAAU,GAAG,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CACvD,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,SAA2C;QAE3C,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;YACnC,OAAO,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,CAAM,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,MAAM,CAAC,GAAiC;IAC/C,MAAM,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO;QACL,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;QAChC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;QACnC,MAAM;QACN,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,aAAa,EACX,OAAO,CAAC,CAAC,cAAc,KAAK,QAAQ,IAAI,CAAC,CAAC,cAAc,IAAI,IAAI;YAC9D,CAAC,CAAE,CAAC,CAAC,cAA4C;YACjD,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC/B,SAAS,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC;QAC7D,UAAU,EAAE,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;QACxC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;QACvD,WAAW,EAAE,MAAM,KAAK,SAAS;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,GAAiC;IAC/C,OAAO;QACL,OAAO,EAAE,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI;QACvE,cAAc,EAAE,gBAAgB,CAAC,GAAG,EAAE,gBAAgB,CAAC;YACrD,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC;YAC/B,CAAC,CAAC,IAAI;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,gBAAgB,CAAC,4BAA4B,EAAE,OAAO,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,KAA4B,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAErB,CAAC;IACd,MAAM,MAAM,GACV,IAAI,EAAE,KAAK,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC3C,CAAC,CAAE,IAAI,CAAC,KAA+B,CAAC,OAAO;QAC/C,CAAC,CAAC,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ;YAC/B,CAAC,CAAC,IAAI,CAAC,KAAK;YACZ,CAAC,CAAC,SAAS,CAAC;IAClB,MAAM,OAAO,GACX,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM;QAClC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,OAAO;YACjD,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,MAAM;gBACN,CAAC,CAAC,qCAAqC,MAAM,GAAG;gBAChD,CAAC,CAAC,UAAU,CAAC,OAAO,IAAI,qCAAqC,CAAC;IAEtE,MAAM,IAAI,GACR,MAAM,KAAK,GAAG;QACZ,CAAC,CAAC,2BAA2B;QAC7B,CAAC,CAAC,MAAM,KAAK,GAAG;YACd,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,MAAM,KAAK,GAAG;gBACd,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,MAAM,KAAK,GAAG;oBACd,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,GAAG;wBACd,CAAC,CAAC,0BAA0B;wBAC5B,CAAC,CAAC,MAAM;4BACN,CAAC,CAAC,qBAAqB,MAAM,EAAE;4BAC/B,CAAC,CAAC,4BAA4B,CAAC;IAE7C,OAAO,IAAI,gBAAgB,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AACvD,CAAC"}

package/dist/drivers/tenant-ddl.driver.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Tenant DDL Driver — 多租户「普通租户」自助 DDL / RLS 注册客户端。
+ *
+ * 对接 Studio BFF 的租户自助端点（Aone #87795993）：
+ *   - POST   /api/tenant-ddl/query            在租户自有库执行 DDL/DML
+ *   - POST   /api/tenant-ddl/rls/tables       开/关表级 RLS
+ *   - GET    /api/tenant-ddl/rls/tables       列出本租户已注册 RLS 的表
+ *   - DELETE /api/tenant-ddl/rls/tables       移除一张表的 RLS 注册（开关行）
+ *   - POST   /api/tenant-ddl/rls/policies     增/改一条 RLS 策略
+ *   - GET    /api/tenant-ddl/rls/policies     列出本租户策略（可按 table 过滤）
+ *   - DELETE /api/tenant-ddl/rls/policies     删除一条策略
+ *
+ * 认证模型（务必遵守，见方案文档「三、认证与信任链」）：
+ *   只发送 `Authorization: Bearer <per-tenant service_role key>`。**绝不**自行拼
+ *   `X-Tenant-Id`——Kong 入口会剥离客户端伪造的该头、验签 per-tenant JWT 后注入
+ *   可信 X-Tenant-Id，并把下游 Authorization 替换为全局 key。租户身份完全由网关推导。
+ *
+ * 成功响应统一为 `{ data: ... }`，失败为 `{ code, message }`；本 driver 解包 data、
+ * 并把失败规范化为 TenantDdlError（携带 code/message/status）。
+ */
+/** RLS 命令行枚举（与服务端 resolver 白名单一致）。 */
+export type RlsCommand = "ALL" | "SELECT" | "INSERT" | "UPDATE" | "DELETE";
+export interface TenantDdlDriverOptions {
+    endpoint: string;
+    /** per-tenant service_role key（带 tenant_id claim）。不可用全局 key。 */
+    serviceRoleKey: string;
+    timeout?: number;
+}
+export interface RlsTableInput {
+    table_name: string;
+    /** 默认 true（启用 RLS）。 */
+    rls_enabled?: boolean;
+    /** 默认 false。 */
+    rls_forced?: boolean;
+}
+export interface RlsPolicyInput {
+    table_name: string;
+    policy_name: string;
+    /** `*` 或 `[a-zA-Z0-9_]`；缺省服务端按 `*` 处理。 */
+    role_name?: string;
+    command?: RlsCommand | string;
+    using_expr?: string | null;
+    check_expr?: string | null;
+    permissive?: boolean;
+}
+/** GET /rls/tables 的一行（rls_* 以 tinyint 0/1 返回）。 */
+export interface RlsTableRow {
+    table_schema: string;
+    table_name: string;
+    rls_enabled: number | boolean;
+    rls_forced: number | boolean;
+}
+/** GET /rls/policies 的一行。 */
+export interface RlsPolicyRow {
+    table_schema: string;
+    table_name: string;
+    policy_name: string;
+    role_name: string;
+    command: string;
+    using_expr: string | null;
+    check_expr: string | null;
+    permissive: number | boolean;
+}
+/** 租户自助 DDL/RLS 调用的统一错误（携带机器码 + HTTP 状态）。 */
+export declare class TenantDdlError extends Error {
+    readonly code: string;
+    readonly status?: number;
+    constructor(code: string, message: string, status?: number);
+}
+export declare class TenantDdlDriver {
+    private readonly client;
+    constructor(options: TenantDdlDriverOptions);
+    /**
+     * Execute a DDL/DML statement on the tenant's OWN database. The tenant MySQL
+     * account (GRANT ALL ON own_db.* only) is the hard isolation boundary; the
+     * server additionally pre-checks and rejects privilege/instance-level statements.
+     * Returns the raw pg-meta rows (`data`), or `[]` for statements with no result set.
+     */
+    query(sql: string): Promise<unknown[]>;
+    /** Enable/force RLS on one of the tenant's tables (central registry, schema server-bound). */
+    upsertRlsTable(input: RlsTableInput): Promise<void>;
+    /** List the tenant's own RLS-registered tables. */
+    listRlsTables(): Promise<RlsTableRow[]>;
+    /**
+     * Remove a table's RLS registration (the central enable/force toggle row),
+     * symmetric to {@link deleteRlsPolicy}. The server binds table_schema to the
+     * tenant db and does NOT require the table to still exist, so this is safe to
+     * call after a DROP (idempotent cleanup).
+     */
+    deleteRlsTable(tableName: string): Promise<void>;
+    /** Insert/update one RLS policy for the tenant (schema server-bound). */
+    upsertRlsPolicy(input: RlsPolicyInput): Promise<void>;
+    /** List the tenant's own policies, optionally filtered by table name. */
+    listRlsPolicies(tableName?: string): Promise<RlsPolicyRow[]>;
+    /** Delete one of the tenant's policies (scoped by table + policy name). */
+    deleteRlsPolicy(tableName: string, policyName: string): Promise<void>;
+    private request;
+}
+/**
+ * Map any failure to a TenantDdlError. Server errors carry `{ code, message }`
+ * (e.g. PERMISSION_DENIED / GLOBAL_KEY_NOT_ALLOWED / ROLE_NOT_ALLOWED /
+ * TENANT_NOT_ACTIVE / STATEMENT_NOT_ALLOWED); fall back to an HTTP-status code
+ * or a network code when the body is absent.
+ */
+export declare function normalizeTenantDdlError(error: unknown): TenantDdlError;
+//# sourceMappingURL=tenant-ddl.driver.d.ts.map

package/dist/drivers/tenant-ddl.driver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-ddl.driver.d.ts","sourceRoot":"","sources":["../../src/drivers/tenant-ddl.driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,sCAAsC;AACtC,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE3E,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,gEAAgE;IAChE,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,gBAAgB;IAChB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,mDAAmD;AACnD,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC;CAC9B;AAED,6CAA6C;AAC7C,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAM3D;AAQD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAgB;gBAE3B,OAAO,EAAE,sBAAsB;IAW3C;;;;;OAKG;IACG,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;IAO5C,8FAA8F;IACxF,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAMzD,mDAAmD;IAC7C,aAAa,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;IAO7C;;;;;OAKG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD,yEAAyE;IACnE,eAAe,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;IAM3D,yEAAyE;IACnE,eAAe,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IASlE,2EAA2E;IACrE,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;YAQ7D,OAAO;CAUtB;AAQD;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,cAAc,CAwBtE"}

package/dist/drivers/tenant-ddl.driver.js

@@ -0,0 +1,131 @@
+/**
+ * Tenant DDL Driver — 多租户「普通租户」自助 DDL / RLS 注册客户端。
+ *
+ * 对接 Studio BFF 的租户自助端点（Aone #87795993）：
+ *   - POST   /api/tenant-ddl/query            在租户自有库执行 DDL/DML
+ *   - POST   /api/tenant-ddl/rls/tables       开/关表级 RLS
+ *   - GET    /api/tenant-ddl/rls/tables       列出本租户已注册 RLS 的表
+ *   - DELETE /api/tenant-ddl/rls/tables       移除一张表的 RLS 注册（开关行）
+ *   - POST   /api/tenant-ddl/rls/policies     增/改一条 RLS 策略
+ *   - GET    /api/tenant-ddl/rls/policies     列出本租户策略（可按 table 过滤）
+ *   - DELETE /api/tenant-ddl/rls/policies     删除一条策略
+ *
+ * 认证模型（务必遵守，见方案文档「三、认证与信任链」）：
+ *   只发送 `Authorization: Bearer <per-tenant service_role key>`。**绝不**自行拼
+ *   `X-Tenant-Id`——Kong 入口会剥离客户端伪造的该头、验签 per-tenant JWT 后注入
+ *   可信 X-Tenant-Id，并把下游 Authorization 替换为全局 key。租户身份完全由网关推导。
+ *
+ * 成功响应统一为 `{ data: ... }`，失败为 `{ code, message }`；本 driver 解包 data、
+ * 并把失败规范化为 TenantDdlError（携带 code/message/status）。
+ */
+import axios from "axios";
+/** 租户自助 DDL/RLS 调用的统一错误（携带机器码 + HTTP 状态）。 */
+export class TenantDdlError extends Error {
+    code;
+    status;
+    constructor(code, message, status) {
+        super(message);
+        this.name = "TenantDdlError";
+        this.code = code;
+        this.status = status;
+    }
+}
+export class TenantDdlDriver {
+    client;
+    constructor(options) {
+        const endpoint = options.endpoint.replace(/\/$/, "");
+        this.client = axios.create({
+            baseURL: `${endpoint}/api/tenant-ddl`,
+            timeout: options.timeout ?? 60_000,
+            // Only the per-tenant service_role bearer. Never send X-Tenant-Id here —
+            // Kong strips any client-supplied value and injects the trusted one.
+            headers: { Authorization: `Bearer ${options.serviceRoleKey}` },
+        });
+    }
+    /**
+     * Execute a DDL/DML statement on the tenant's OWN database. The tenant MySQL
+     * account (GRANT ALL ON own_db.* only) is the hard isolation boundary; the
+     * server additionally pre-checks and rejects privilege/instance-level statements.
+     * Returns the raw pg-meta rows (`data`), or `[]` for statements with no result set.
+     */
+    async query(sql) {
+        const data = await this.request(() => this.client.post("/query", { sql }));
+        return data ?? [];
+    }
+    /** Enable/force RLS on one of the tenant's tables (central registry, schema server-bound). */
+    async upsertRlsTable(input) {
+        await this.request(() => this.client.post("/rls/tables", compact(input)));
+    }
+    /** List the tenant's own RLS-registered tables. */
+    async listRlsTables() {
+        const data = await this.request(() => this.client.get("/rls/tables"));
+        return data ?? [];
+    }
+    /**
+     * Remove a table's RLS registration (the central enable/force toggle row),
+     * symmetric to {@link deleteRlsPolicy}. The server binds table_schema to the
+     * tenant db and does NOT require the table to still exist, so this is safe to
+     * call after a DROP (idempotent cleanup).
+     */
+    async deleteRlsTable(tableName) {
+        await this.request(() => this.client.delete("/rls/tables", {
+            params: { table_name: tableName },
+        }));
+    }
+    /** Insert/update one RLS policy for the tenant (schema server-bound). */
+    async upsertRlsPolicy(input) {
+        await this.request(() => this.client.post("/rls/policies", compact(input)));
+    }
+    /** List the tenant's own policies, optionally filtered by table name. */
+    async listRlsPolicies(tableName) {
+        const data = await this.request(() => this.client.get("/rls/policies", {
+            params: tableName ? { table_name: tableName } : undefined,
+        }));
+        return data ?? [];
+    }
+    /** Delete one of the tenant's policies (scoped by table + policy name). */
+    async deleteRlsPolicy(tableName, policyName) {
+        await this.request(() => this.client.delete("/rls/policies", {
+            params: { table_name: tableName, policy_name: policyName },
+        }));
+    }
+    async request(operation) {
+        try {
+            const response = await operation();
+            return response.data?.data;
+        }
+        catch (error) {
+            throw normalizeTenantDdlError(error);
+        }
+    }
+}
+function compact(value) {
+    return Object.fromEntries(Object.entries(value).filter(([, entry]) => entry !== undefined));
+}
+/**
+ * Map any failure to a TenantDdlError. Server errors carry `{ code, message }`
+ * (e.g. PERMISSION_DENIED / GLOBAL_KEY_NOT_ALLOWED / ROLE_NOT_ALLOWED /
+ * TENANT_NOT_ACTIVE / STATEMENT_NOT_ALLOWED); fall back to an HTTP-status code
+ * or a network code when the body is absent.
+ */
+export function normalizeTenantDdlError(error) {
+    if (!axios.isAxiosError(error)) {
+        const message = error instanceof Error ? error.message : String(error);
+        return new TenantDdlError("TENANT_DDL_UNKNOWN_ERROR", message);
+    }
+    const axiosError = error;
+    const status = axiosError.response?.status;
+    const body = axiosError.response?.data;
+    const code = typeof body?.code === "string"
+        ? body.code
+        : status
+            ? `TENANT_DDL_HTTP_${status}`
+            : "TENANT_DDL_NETWORK_ERROR";
+    const message = typeof body?.message === "string"
+        ? body.message
+        : status
+            ? `Tenant DDL request failed (HTTP ${status})`
+            : axiosError.message || "Tenant DDL network request failed";
+    return new TenantDdlError(code, message, status);
+}
+//# sourceMappingURL=tenant-ddl.driver.js.map

package/dist/drivers/tenant-ddl.driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tenant-ddl.driver.js","sourceRoot":"","sources":["../../src/drivers/tenant-ddl.driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAA8C,MAAM,OAAO,CAAC;AAmDnE,6CAA6C;AAC7C,MAAM,OAAO,cAAe,SAAQ,KAAK;IAC9B,IAAI,CAAS;IACb,MAAM,CAAU;IAEzB,YAAY,IAAY,EAAE,OAAe,EAAE,MAAe;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC7B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAQD,MAAM,OAAO,eAAe;IACT,MAAM,CAAgB;IAEvC,YAAY,OAA+B;QACzC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,GAAG,QAAQ,iBAAiB;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,MAAM;YAClC,yEAAyE;YACzE,qEAAqE;YACrE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,cAAc,EAAE,EAAE;SAC/D,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,GAAW;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAY,GAAG,EAAE,CAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAA+B,QAAQ,EAAE,EAAE,GAAG,EAAE,CAAC,CAClE,CAAC;QACF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,cAAc,CAAC,KAAoB;QACvC,MAAM,IAAI,CAAC,OAAO,CAAU,GAAG,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAA6B,aAAa,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;IACJ,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,aAAa;QACjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgB,GAAG,EAAE,CAClD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAmC,aAAa,CAAC,CACjE,CAAC;QACF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,OAAO,CAAU,GAAG,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAA6B,aAAa,EAAE;YAC5D,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;SAClC,CAAC,CACH,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,eAAe,CAAC,KAAqB;QACzC,MAAM,IAAI,CAAC,OAAO,CAAU,GAAG,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,IAAI,CAA6B,eAAe,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAC9E,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,eAAe,CAAC,SAAkB;QACtC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAiB,GAAG,EAAE,CACnD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAoC,eAAe,EAAE;YAClE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CACH,CAAC;QACF,OAAO,IAAI,IAAI,EAAE,CAAC;IACpB,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,UAAkB;QACzD,MAAM,IAAI,CAAC,OAAO,CAAU,GAAG,EAAE,CAC/B,IAAI,CAAC,MAAM,CAAC,MAAM,CAA6B,eAAe,EAAE;YAC9D,MAAM,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE;SAC3D,CAAC,CACH,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,SAAwD;QAExD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,EAAE,CAAC;YACnC,OAAO,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;QAC7B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;CACF;AAED,SAAS,OAAO,CAAmB,KAAQ;IACzC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAC5D,CAAC;AACT,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAc;IACpD,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvE,OAAO,IAAI,cAAc,CAAC,0BAA0B,EAAE,OAAO,CAAC,CAAC;IACjE,CAAC;IAED,MAAM,UAAU,GAAG,KAA4B,CAAC;IAChD,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,EAAE,IAErB,CAAC;IACd,MAAM,IAAI,GACR,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;QAC5B,CAAC,CAAC,IAAI,CAAC,IAAI;QACX,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,mBAAmB,MAAM,EAAE;YAC7B,CAAC,CAAC,0BAA0B,CAAC;IACnC,MAAM,OAAO,GACX,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QAC/B,CAAC,CAAC,IAAI,CAAC,OAAO;QACd,CAAC,CAAC,MAAM;YACN,CAAC,CAAC,mCAAmC,MAAM,GAAG;YAC9C,CAAC,CAAC,UAAU,CAAC,OAAO,IAAI,mCAAmC,CAAC;IAClE,OAAO,IAAI,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AACnD,CAAC"}