@proteinjs/db 1.50.0 → 1.50.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proteinjs/db",
-  "version": "1.50.0",
+  "version": "1.50.2",
   "main": "./dist/generated/index.js",
   "types": "./dist/generated/index.d.ts",
   "exports": {
@@ -66,5 +66,5 @@
     "ts-jest": "29.1.1",
     "typescript": "5.2.2"
   },
-  "gitHead": "3b2c70b4497cc965fa829726a88fdcd2e1f2377d"
+  "gitHead": "6a487f9e29bc1ab5e3a7f79e1cce178cd2512beb"
 }

package/src/auth/TableAuth.ts

@@ -132,8 +132,47 @@ export class TableAuth {
 
     // Within a declared block an undeclared operation stays closed to everyone (the block is
     // the whole declaration) — `allows` reads undefined as false, so the two doors are exactly
-    // the ones the table wrote down.
-    return this.allows(tableAuth.all) || this.allows(tableAuth[operation]);
+    // the ones the table wrote down...
+    if (this.allows(tableAuth.all) || this.allows(tableAuth[operation])) {
+      return true;
+    }
+
+    // ...except that a db door the block leaves UNDECLARED mirrors the door the table's SERVICE
+    // block declares for the same operation — and only where that door admits the admin role
+    // ALONE. The RPC runs both doors — the service gate (TableServiceAuth), then the inner Db's
+    // db-api re-check as the calling user — so an ['admin'] service write door with no db mirror
+    // admitted the admin at the gate and refused them behind it, in the gate's own words ("db
+    // doors mirror service doors" was a rule tables hand-copied; the owner derives it). Any wider
+    // service door — a permission, a non-admin role, 'authenticated', 'public' — leaves the
+    // undeclared db door shut: role privilege and the reach of a permission are different things,
+    // so a table that means a wider identity to write through the db api declares that door at
+    // the db block itself. One-way: a service block that omits the door keeps the lock (the
+    // session / audit-trail pattern — no write door on either api, break-glass included), and a
+    // table with no service block keeps its db block as written.
+    return api === 'db' && tableAuth.all === undefined && tableAuth[operation] === undefined
+      ? this.mirrorsAdminOnlyServiceDoor(table, operation)
+      : false;
+  }
+
+  /**
+   * The mirror: the service block's door for `operation` (its `all` and its own entry, as the RPC
+   * gate reads them) where every identity it declares is exactly `['admin']` admits the admin
+   * here too; a door declared any wider, or not at all, mirrors nothing. A table with no service
+   * block declares no door to mirror.
+   */
+  private mirrorsAdminOnlyServiceDoor(table: Table<any>, operation: 'query' | 'insert' | 'update' | 'delete'): boolean {
+    const serviceAuth = table.auth?.service;
+    if (!serviceAuth || Object.keys(serviceAuth).length == 0) {
+      return false;
+    }
+
+    const door = [serviceAuth.all, serviceAuth[operation]].filter((identity) => identity !== undefined);
+    return door.length > 0 && door.every((identity) => this.isAdminOnly(identity)) && UserAuth.hasRole('admin');
+  }
+
+  /** A roles list naming the admin role and nothing else. */
+  private isAdminOnly(identity: Identity | undefined): boolean {
+    return Array.isArray(identity) && identity.length === 1 && identity[0] === 'admin';
   }
 
   /** One identity against the current user; undefined (nothing declared) is not a grant. */

package/test/TableAuthIdentity.test.ts

@@ -11,8 +11,10 @@ import { TableAuth } from '../src/auth/TableAuth';
  * - each identity form resolves against the current user; 'admin' is break-glass throughout;
  * - an UNDECLARED identity is admin-only (default-deny made explicit), never open;
  * - it fails CLOSED when no user can be resolved;
- * - the operation doors (`canPerform`) are byte-for-byte the pre-refactor semantics: within a
- *   declared block an undeclared operation stays closed to everyone, admin included.
+ * - the operation doors (`canPerform`) keep the declared-block semantics: within a declared block
+ *   an undeclared operation stays closed to everyone, admin included — unless the table's SERVICE
+ *   block names that door for the admin role alone, which the db door then mirrors (the last two
+ *   describes).
  *
  * `UserAuth` reads from a static repo; tests stub it directly per identity — no server needed.
  */
@@ -113,3 +115,214 @@ describe('TableAuth operation doors keep their declared-block semantics', () =>
     expect(new TableAuth().canPerform(new QueryOnlyTable(), 'insert')).toBe(false);
   });
 });
+
+/**
+ * The RPC runs BOTH doors — the service gate (`TableServiceAuth`) and then the inner `Db`'s
+ * db-api re-check as the calling user — so a db door a table leaves UNDECLARED mirrors the door
+ * its service block declares for the same operation, where that door admits the admin role ALONE
+ * (declared exactly `['admin']`). "db doors mirror service doors" was a rule tables hand-copied;
+ * the owner derives it now: consumer tables opened `['admin']` writes on the service api over a
+ * query-only db block, and every one refused the admin at the inner check in the gate's own words
+ * — the gate admitted them, the re-check behind it did not, two verdicts for one caller. One-way:
+ * a service block that omits the door keeps the lock (the session / audit-trail pattern — no
+ * write door on either api, break-glass included), and a table with no service block keeps its
+ * db block as written (the pin above). A service door declared any wider than the admin role is
+ * the next describe's: it mirrors nothing.
+ */
+class ReadOpenWriteAdminTable extends Table<Doc> {
+  public name = 'identity_read_open_write_admin_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+    service: { query: 'authenticated', insert: ['admin'], update: ['admin'], delete: ['admin'] },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+class LockedLedgerTable extends Table<Doc> {
+  public name = 'identity_locked_ledger_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: { permission: 'ledger' } },
+    service: { query: { permission: 'ledger' } },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+describe("TableAuth — an undeclared db door mirrors the declared ['admin'] service door", () => {
+  beforeEach(() => {
+    setMapping({ ledger: ['ledger'] });
+  });
+
+  afterEach(() => {
+    (UserAuth as any).userRepo = undefined;
+    (UserAuth as any).permissionRolesMapping = undefined;
+  });
+
+  test("an admin's write clears the ['admin'] service door AND the db-api re-check behind it", () => {
+    setUser(['admin']);
+    const table = new ReadOpenWriteAdminTable();
+    expect(() => new TableAuth().canUpdate(table, 'service')).not.toThrow();
+    expect(() => new TableAuth().canUpdate(table)).not.toThrow();
+    expect(() => new TableAuth().canInsert(table)).not.toThrow();
+    expect(() => new TableAuth().canDelete(table)).not.toThrow();
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(true);
+  });
+
+  test('a signed-in non-admin is refused by name on both apis; the read door stays open', () => {
+    setUser(['ledger']);
+    const table = new ReadOpenWriteAdminTable();
+    expect(() => new TableAuth().canUpdate(table, 'service')).toThrow(
+      'User is not authorized to update records in table: identity_read_open_write_admin_test'
+    );
+    expect(() => new TableAuth().canUpdate(table)).toThrow(
+      'User is not authorized to update records in table: identity_read_open_write_admin_test'
+    );
+    expect(() => new TableAuth().canQuery(table)).not.toThrow();
+  });
+
+  test('a guest is refused every door', () => {
+    setGuest();
+    const table = new ReadOpenWriteAdminTable();
+    expect(() => new TableAuth().canQuery(table)).toThrow(
+      'User is not authorized to query table: identity_read_open_write_admin_test'
+    );
+    expect(() => new TableAuth().canUpdate(table)).toThrow();
+    expect(() => new TableAuth().canInsert(table, 'service')).toThrow();
+  });
+
+  test('one-way: a service block that omits the door keeps the lock on both apis, break-glass included', () => {
+    setUser(['admin']);
+    const table = new LockedLedgerTable();
+    expect(new TableAuth().canPerform(table, 'update', 'service')).toBe(false);
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(false);
+    expect(() => new TableAuth().canUpdate(table)).toThrow(
+      'User is not authorized to update records in table: identity_locked_ledger_test'
+    );
+    expect(() => new TableAuth().canInsert(table, 'service')).toThrow();
+    expect(() => new TableAuth().canQuery(table)).not.toThrow();
+  });
+
+  test('a table with no service block keeps its db block as written — admin included', () => {
+    setUser(['admin']);
+    expect(new TableAuth().canPerform(new QueryOnlyTable(), 'update', 'db')).toBe(false);
+    expect(() => new TableAuth().canUpdate(new QueryOnlyTable())).toThrow(
+      'User is not authorized to update records in table: identity_query_only_test'
+    );
+  });
+});
+
+/**
+ * Role privilege and the reach of a permission are different things: the mirror carries the
+ * admin's break-glass across the two apis, never a wider identity. The service block here opens
+ * three writes to identities wider than the admin role — a permission, a non-admin role, every
+ * signed-in user — over a query-only db block, and none of them is mirrored: the gate admits the
+ * holder and the db door behind it stays shut, exactly as before the mirror existed. A table that
+ * means a wider identity to write through the db api declares that door at the db block itself.
+ */
+class WiderServiceDoorsTable extends Table<Doc> {
+  public name = 'identity_wider_service_doors_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: { permission: 'ledger' } },
+    service: {
+      query: { permission: 'ledger' },
+      update: { permission: 'ledger' },
+      insert: ['ledger'],
+      delete: 'authenticated',
+    },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+/** A service write door the admin role shares with another role: not the admin role alone. */
+class SharedRoleDoorTable extends Table<Doc> {
+  public name = 'identity_shared_role_door_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+    service: { query: 'authenticated', update: ['admin', 'ledger'] },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+/** The admin-only door named by `all`: the same door, read the way the gate reads it. */
+class AllAdminServiceTable extends Table<Doc> {
+  public name = 'identity_all_admin_service_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+    service: { all: ['admin'] },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+/** An `['admin']` entry beside an `all` that widens the door to every signed-in user: not admin alone. */
+class WidenedByAllTable extends Table<Doc> {
+  public name = 'identity_widened_by_all_test';
+  public auth: Table<Doc>['auth'] = {
+    db: { query: 'authenticated' },
+    service: { all: 'authenticated', update: ['admin'] },
+  };
+  public columns = withRecordColumns<Doc>({ title: new StringColumn('title') });
+}
+
+describe('TableAuth — the mirror reaches only a service door that admits the admin role alone', () => {
+  beforeEach(() => {
+    setMapping({ ledger: ['ledger'] });
+  });
+
+  afterEach(() => {
+    (UserAuth as any).userRepo = undefined;
+    (UserAuth as any).permissionRolesMapping = undefined;
+  });
+
+  test('a permission-declared service write with no db door stays shut for the permission holder — the gate admits, the db door does not', () => {
+    setUser(['ledger']);
+    const table = new WiderServiceDoorsTable();
+    expect(new TableAuth().canPerform(table, 'update', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(false);
+    expect(() => new TableAuth().canUpdate(table)).toThrow(
+      'User is not authorized to update records in table: identity_wider_service_doors_test'
+    );
+    expect(() => new TableAuth().canQuery(table)).not.toThrow();
+  });
+
+  test("a non-admin role door and an 'authenticated' door are as shut on the db api as the permission door", () => {
+    setUser(['ledger']);
+    const table = new WiderServiceDoorsTable();
+    expect(new TableAuth().canPerform(table, 'insert', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(table, 'insert', 'db')).toBe(false);
+    expect(new TableAuth().canPerform(table, 'delete', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(table, 'delete', 'db')).toBe(false);
+    expect(() => new TableAuth().canInsert(table)).toThrow(
+      'User is not authorized to insert records into table: identity_wider_service_doors_test'
+    );
+  });
+
+  test('a wider service door opens nothing on the db api for the admin either — shut as it was before the mirror', () => {
+    setUser(['admin']);
+    const table = new WiderServiceDoorsTable();
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(false);
+    expect(new TableAuth().canPerform(table, 'insert', 'db')).toBe(false);
+    expect(new TableAuth().canPerform(table, 'delete', 'db')).toBe(false);
+    expect(() => new TableAuth().canUpdate(table)).toThrow(
+      'User is not authorized to update records in table: identity_wider_service_doors_test'
+    );
+  });
+
+  test('a door the admin role shares with another role is not the admin role alone: shut on the db api for both', () => {
+    const table = new SharedRoleDoorTable();
+    setUser(['admin']);
+    expect(new TableAuth().canPerform(table, 'update', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(false);
+    setUser(['ledger']);
+    expect(new TableAuth().canPerform(table, 'update', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(table, 'update', 'db')).toBe(false);
+  });
+
+  test("the admin-only door may be named by `all`; an `all` that widens the door beside an ['admin'] entry mirrors nothing", () => {
+    setUser(['admin']);
+    expect(new TableAuth().canPerform(new AllAdminServiceTable(), 'update', 'db')).toBe(true);
+    expect(() => new TableAuth().canUpdate(new AllAdminServiceTable())).not.toThrow();
+    expect(new TableAuth().canPerform(new WidenedByAllTable(), 'update', 'service')).toBe(true);
+    expect(new TableAuth().canPerform(new WidenedByAllTable(), 'update', 'db')).toBe(false);
+    setUser(['ledger']);
+    expect(new TableAuth().canPerform(new AllAdminServiceTable(), 'update', 'db')).toBe(false);
+  });
+});