@rbacbee-lib/postgres 0.1.0

package/README.md

@@ -0,0 +1,10 @@
+# @rbacbee-lib/postgres
+
+Postgres adapter for `@rbacbee-lib/core`.
+
+```ts
+import { createPostgresRbacStore } from '@rbacbee-lib/postgres';
+
+const store = createPostgresRbacStore({ connectionString: process.env.DATABASE_URL });
+await store.migrate();
+```

package/dist/index.cjs

@@ -0,0 +1,264 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  POSTGRES_RBAC_SCHEMA: () => POSTGRES_RBAC_SCHEMA,
+  PostgresRbacStore: () => PostgresRbacStore,
+  createPostgresRbacStore: () => createPostgresRbacStore
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/postgres-rbac-schema.ts
+var POSTGRES_RBAC_SCHEMA = `
+CREATE TABLE IF NOT EXISTS rbac_permissions (
+  key text PRIMARY KEY,
+  description text NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),
+  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')
+);
+
+CREATE TABLE IF NOT EXISTS rbac_roles (
+  id text PRIMARY KEY,
+  name text NOT NULL,
+  tenant_id text NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),
+  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)
+);
+
+CREATE TABLE IF NOT EXISTS rbac_role_permissions (
+  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,
+  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (role_id, permission_key)
+);
+
+CREATE TABLE IF NOT EXISTS rbac_user_roles (
+  id bigserial PRIMARY KEY,
+  user_id text NOT NULL,
+  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,
+  tenant_id text NULL,
+  resource_type text NULL,
+  resource_id text NULL,
+  expires_at timestamptz NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)
+);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant
+  ON rbac_user_roles (user_id, tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role
+  ON rbac_user_roles (role_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource
+  ON rbac_user_roles (resource_type, resource_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission
+  ON rbac_role_permissions (permission_key);
+`;
+
+// src/postgres-rbac-store.ts
+var import_pg = require("pg");
+var PostgresRbacStore = class {
+  constructor(pool, ownsPool = false) {
+    this.pool = pool;
+    this.ownsPool = ownsPool;
+  }
+  pool;
+  ownsPool;
+  async migrate() {
+    await this.pool.query(POSTGRES_RBAC_SCHEMA);
+  }
+  async close() {
+    if (this.ownsPool) {
+      await this.pool.end();
+    }
+  }
+  async getAccessProfile(query) {
+    const tenantId = query.tenantId ?? null;
+    const [rolesResult, permissionsResult] = await Promise.all([
+      this.pool.query(
+        `
+        SELECT r.id, r.name, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at
+        FROM rbac_user_roles ur
+        INNER JOIN rbac_roles r ON r.id = ur.role_id
+        WHERE ur.user_id = $1
+          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)
+          AND (ur.expires_at IS NULL OR ur.expires_at > now())
+        `,
+        [query.userId, tenantId]
+      ),
+      this.pool.query(
+        `
+        SELECT p.key, ur.role_id, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at
+        FROM rbac_user_roles ur
+        INNER JOIN rbac_role_permissions rp ON rp.role_id = ur.role_id
+        INNER JOIN rbac_permissions p ON p.key = rp.permission_key
+        WHERE ur.user_id = $1
+          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)
+          AND (ur.expires_at IS NULL OR ur.expires_at > now())
+        `,
+        [query.userId, tenantId]
+      )
+    ]);
+    if (rolesResult.rowCount === 0 && permissionsResult.rowCount === 0) {
+      return null;
+    }
+    const profile = {
+      userId: query.userId,
+      ...query.tenantId === void 0 ? {} : { tenantId: query.tenantId },
+      loadedAt: /* @__PURE__ */ new Date(),
+      roles: rolesResult.rows.map(mapRole),
+      permissions: permissionsResult.rows.map(mapPermission)
+    };
+    return profile;
+  }
+  async upsertPermission(permission) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_permissions (key, description)
+      VALUES ($1, $2)
+      ON CONFLICT (key) DO UPDATE
+        SET description = EXCLUDED.description,
+            updated_at = now()
+      `,
+      [permission.key, permission.description ?? null]
+    );
+  }
+  async deletePermission(permissionKey) {
+    await this.pool.query("DELETE FROM rbac_permissions WHERE key = $1", [permissionKey]);
+  }
+  async createRole(role) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_roles (id, name, tenant_id)
+      VALUES ($1, $2, $3)
+      ON CONFLICT (id) DO UPDATE
+        SET name = EXCLUDED.name,
+            tenant_id = EXCLUDED.tenant_id,
+            updated_at = now()
+      `,
+      [role.id, role.name, role.tenantId ?? null]
+    );
+    for (const permission of role.permissions ?? []) {
+      await this.upsertPermission({ key: permission });
+      await this.grantPermissionToRole(role.id, permission);
+    }
+  }
+  async deleteRole(roleId) {
+    await this.pool.query("DELETE FROM rbac_roles WHERE id = $1", [roleId]);
+  }
+  async grantPermissionToRole(roleId, permissionKey) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_role_permissions (role_id, permission_key)
+      VALUES ($1, $2)
+      ON CONFLICT (role_id, permission_key) DO NOTHING
+      `,
+      [roleId, permissionKey]
+    );
+  }
+  async revokePermissionFromRole(roleId, permissionKey) {
+    await this.pool.query(
+      "DELETE FROM rbac_role_permissions WHERE role_id = $1 AND permission_key = $2",
+      [roleId, permissionKey]
+    );
+  }
+  async assignRole(assignment) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_user_roles (
+        user_id,
+        role_id,
+        tenant_id,
+        resource_type,
+        resource_id,
+        expires_at
+      )
+      VALUES ($1, $2, $3, $4, $5, $6)
+      `,
+      [
+        assignment.userId,
+        assignment.roleId,
+        assignment.tenantId ?? null,
+        assignment.resourceType ?? null,
+        assignment.resourceId ?? null,
+        assignment.expiresAt ?? null
+      ]
+    );
+  }
+  async revokeRole(revocation) {
+    await this.pool.query(
+      `
+      DELETE FROM rbac_user_roles
+      WHERE user_id = $1
+        AND role_id = $2
+        AND ($3::text IS NULL OR tenant_id = $3)
+        AND ($4::text IS NULL OR resource_type = $4)
+        AND ($5::text IS NULL OR resource_id = $5)
+      `,
+      [
+        revocation.userId,
+        revocation.roleId,
+        revocation.tenantId ?? null,
+        revocation.resourceType ?? null,
+        revocation.resourceId ?? null
+      ]
+    );
+  }
+};
+function createPostgresRbacStore(options) {
+  if (options.pool !== void 0) {
+    return new PostgresRbacStore(options.pool);
+  }
+  return new PostgresRbacStore(new import_pg.Pool(options), true);
+}
+function mapRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    ...row.tenant_id === null ? {} : { tenantId: row.tenant_id },
+    ...row.resource_type === null ? {} : { resourceType: row.resource_type },
+    ...row.resource_id === null ? {} : { resourceId: row.resource_id },
+    ...row.expires_at === null ? {} : { expiresAt: row.expires_at }
+  };
+}
+function mapPermission(row) {
+  return {
+    key: row.key,
+    sourceRoleId: row.role_id,
+    ...row.tenant_id === null ? {} : { tenantId: row.tenant_id },
+    ...row.resource_type === null ? {} : { resourceType: row.resource_type },
+    ...row.resource_id === null ? {} : { resourceId: row.resource_id },
+    ...row.expires_at === null ? {} : { expiresAt: row.expires_at }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  POSTGRES_RBAC_SCHEMA,
+  PostgresRbacStore,
+  createPostgresRbacStore
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/postgres-rbac-schema.ts","../src/postgres-rbac-store.ts"],"sourcesContent":["export * from './postgres-rbac-schema';\nexport * from './postgres-rbac-store';\n","export const POSTGRES_RBAC_SCHEMA = `\nCREATE TABLE IF NOT EXISTS rbac_permissions (\n  key text PRIMARY KEY,\n  description text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),\n  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')\n);\n\nCREATE TABLE IF NOT EXISTS rbac_roles (\n  id text PRIMARY KEY,\n  name text NOT NULL,\n  tenant_id text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),\n  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_role_permissions (\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (role_id, permission_key)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_user_roles (\n  id bigserial PRIMARY KEY,\n  user_id text NOT NULL,\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  tenant_id text NULL,\n  resource_type text NULL,\n  resource_id text NULL,\n  expires_at timestamptz NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)\n);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant\n  ON rbac_user_roles (user_id, tenant_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role\n  ON rbac_user_roles (role_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource\n  ON rbac_user_roles (resource_type, resource_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission\n  ON rbac_role_permissions (permission_key);\n`;\n","import { Pool, type PoolConfig } from 'pg';\nimport type {\n  AccessPermission,\n  AccessProfile,\n  AccessProfileQuery,\n  AccessRepository,\n  AccessRole,\n  AssignmentRepository,\n  PermissionDefinition,\n  PermissionRepository,\n  RoleAssignment,\n  RoleAssignmentRevocation,\n  RoleDefinition,\n  RoleRepository\n} from '@rbacbee-lib/core';\nimport { POSTGRES_RBAC_SCHEMA } from './postgres-rbac-schema';\n\nexport interface PostgresRbacStoreOptions extends PoolConfig {\n  readonly pool?: Pool;\n}\n\ninterface RoleRow {\n  readonly id: string;\n  readonly name: string;\n  readonly tenant_id: string | null;\n  readonly resource_type: string | null;\n  readonly resource_id: string | null;\n  readonly expires_at: Date | null;\n}\n\ninterface PermissionRow {\n  readonly key: string;\n  readonly role_id: string;\n  readonly tenant_id: string | null;\n  readonly resource_type: string | null;\n  readonly resource_id: string | null;\n  readonly expires_at: Date | null;\n}\n\nexport class PostgresRbacStore\n  implements AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository\n{\n  private readonly ownsPool: boolean;\n\n  public constructor(\n    private readonly pool: Pool,\n    ownsPool = false\n  ) {\n    this.ownsPool = ownsPool;\n  }\n\n  public async migrate(): Promise<void> {\n    await this.pool.query(POSTGRES_RBAC_SCHEMA);\n  }\n\n  public async close(): Promise<void> {\n    if (this.ownsPool) {\n      await this.pool.end();\n    }\n  }\n\n  public async getAccessProfile(query: AccessProfileQuery): Promise<AccessProfile | null> {\n    const tenantId = query.tenantId ?? null;\n    const [rolesResult, permissionsResult] = await Promise.all([\n      this.pool.query<RoleRow>(\n        `\n        SELECT r.id, r.name, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at\n        FROM rbac_user_roles ur\n        INNER JOIN rbac_roles r ON r.id = ur.role_id\n        WHERE ur.user_id = $1\n          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)\n          AND (ur.expires_at IS NULL OR ur.expires_at > now())\n        `,\n        [query.userId, tenantId]\n      ),\n      this.pool.query<PermissionRow>(\n        `\n        SELECT p.key, ur.role_id, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at\n        FROM rbac_user_roles ur\n        INNER JOIN rbac_role_permissions rp ON rp.role_id = ur.role_id\n        INNER JOIN rbac_permissions p ON p.key = rp.permission_key\n        WHERE ur.user_id = $1\n          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)\n          AND (ur.expires_at IS NULL OR ur.expires_at > now())\n        `,\n        [query.userId, tenantId]\n      )\n    ]);\n\n    if (rolesResult.rowCount === 0 && permissionsResult.rowCount === 0) {\n      return null;\n    }\n\n    const profile: AccessProfile = {\n      userId: query.userId,\n      ...(query.tenantId === undefined ? {} : { tenantId: query.tenantId }),\n      loadedAt: new Date(),\n      roles: rolesResult.rows.map(mapRole),\n      permissions: permissionsResult.rows.map(mapPermission)\n    };\n\n    return profile;\n  }\n\n  public async upsertPermission(permission: PermissionDefinition): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_permissions (key, description)\n      VALUES ($1, $2)\n      ON CONFLICT (key) DO UPDATE\n        SET description = EXCLUDED.description,\n            updated_at = now()\n      `,\n      [permission.key, permission.description ?? null]\n    );\n  }\n\n  public async deletePermission(permissionKey: string): Promise<void> {\n    await this.pool.query('DELETE FROM rbac_permissions WHERE key = $1', [permissionKey]);\n  }\n\n  public async createRole(role: RoleDefinition): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_roles (id, name, tenant_id)\n      VALUES ($1, $2, $3)\n      ON CONFLICT (id) DO UPDATE\n        SET name = EXCLUDED.name,\n            tenant_id = EXCLUDED.tenant_id,\n            updated_at = now()\n      `,\n      [role.id, role.name, role.tenantId ?? null]\n    );\n\n    for (const permission of role.permissions ?? []) {\n      await this.upsertPermission({ key: permission });\n      await this.grantPermissionToRole(role.id, permission);\n    }\n  }\n\n  public async deleteRole(roleId: string): Promise<void> {\n    await this.pool.query('DELETE FROM rbac_roles WHERE id = $1', [roleId]);\n  }\n\n  public async grantPermissionToRole(roleId: string, permissionKey: string): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_role_permissions (role_id, permission_key)\n      VALUES ($1, $2)\n      ON CONFLICT (role_id, permission_key) DO NOTHING\n      `,\n      [roleId, permissionKey]\n    );\n  }\n\n  public async revokePermissionFromRole(roleId: string, permissionKey: string): Promise<void> {\n    await this.pool.query(\n      'DELETE FROM rbac_role_permissions WHERE role_id = $1 AND permission_key = $2',\n      [roleId, permissionKey]\n    );\n  }\n\n  public async assignRole(assignment: RoleAssignment): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_user_roles (\n        user_id,\n        role_id,\n        tenant_id,\n        resource_type,\n        resource_id,\n        expires_at\n      )\n      VALUES ($1, $2, $3, $4, $5, $6)\n      `,\n      [\n        assignment.userId,\n        assignment.roleId,\n        assignment.tenantId ?? null,\n        assignment.resourceType ?? null,\n        assignment.resourceId ?? null,\n        assignment.expiresAt ?? null\n      ]\n    );\n  }\n\n  public async revokeRole(revocation: RoleAssignmentRevocation): Promise<void> {\n    await this.pool.query(\n      `\n      DELETE FROM rbac_user_roles\n      WHERE user_id = $1\n        AND role_id = $2\n        AND ($3::text IS NULL OR tenant_id = $3)\n        AND ($4::text IS NULL OR resource_type = $4)\n        AND ($5::text IS NULL OR resource_id = $5)\n      `,\n      [\n        revocation.userId,\n        revocation.roleId,\n        revocation.tenantId ?? null,\n        revocation.resourceType ?? null,\n        revocation.resourceId ?? null\n      ]\n    );\n  }\n}\n\nexport function createPostgresRbacStore(options: PostgresRbacStoreOptions): PostgresRbacStore {\n  if (options.pool !== undefined) {\n    return new PostgresRbacStore(options.pool);\n  }\n\n  return new PostgresRbacStore(new Pool(options), true);\n}\n\nfunction mapRole(row: RoleRow): AccessRole {\n  return {\n    id: row.id,\n    name: row.name,\n    ...(row.tenant_id === null ? {} : { tenantId: row.tenant_id }),\n    ...(row.resource_type === null ? {} : { resourceType: row.resource_type }),\n    ...(row.resource_id === null ? {} : { resourceId: row.resource_id }),\n    ...(row.expires_at === null ? {} : { expiresAt: row.expires_at })\n  };\n}\n\nfunction mapPermission(row: PermissionRow): AccessPermission {\n  return {\n    key: row.key,\n    sourceRoleId: row.role_id,\n    ...(row.tenant_id === null ? {} : { tenantId: row.tenant_id }),\n    ...(row.resource_type === null ? {} : { resourceType: row.resource_type }),\n    ...(row.resource_id === null ? {} : { resourceId: row.resource_id }),\n    ...(row.expires_at === null ? {} : { expiresAt: row.expires_at })\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAO,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACApC,gBAAsC;AAuC/B,IAAM,oBAAN,MAEP;AAAA,EAGS,YACY,MACjB,WAAW,OACX;AAFiB;AAGjB,SAAK,WAAW;AAAA,EAClB;AAAA,EAJmB;AAAA,EAHF;AAAA,EASjB,MAAa,UAAyB;AACpC,UAAM,KAAK,KAAK,MAAM,oBAAoB;AAAA,EAC5C;AAAA,EAEA,MAAa,QAAuB;AAClC,QAAI,KAAK,UAAU;AACjB,YAAM,KAAK,KAAK,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAa,iBAAiB,OAA0D;AACtF,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,CAAC,aAAa,iBAAiB,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzD,KAAK,KAAK;AAAA,QACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,CAAC,MAAM,QAAQ,QAAQ;AAAA,MACzB;AAAA,MACA,KAAK,KAAK;AAAA,QACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QASA,CAAC,MAAM,QAAQ,QAAQ;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,YAAY,aAAa,KAAK,kBAAkB,aAAa,GAAG;AAClE,aAAO;AAAA,IACT;AAEA,UAAM,UAAyB;AAAA,MAC7B,QAAQ,MAAM;AAAA,MACd,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,MACnE,UAAU,oBAAI,KAAK;AAAA,MACnB,OAAO,YAAY,KAAK,IAAI,OAAO;AAAA,MACnC,aAAa,kBAAkB,KAAK,IAAI,aAAa;AAAA,IACvD;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,YAAiD;AAC7E,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,CAAC,WAAW,KAAK,WAAW,eAAe,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAa,iBAAiB,eAAsC;AAClE,UAAM,KAAK,KAAK,MAAM,+CAA+C,CAAC,aAAa,CAAC;AAAA,EACtF;AAAA,EAEA,MAAa,WAAW,MAAqC;AAC3D,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,CAAC,KAAK,IAAI,KAAK,MAAM,KAAK,YAAY,IAAI;AAAA,IAC5C;AAEA,eAAW,cAAc,KAAK,eAAe,CAAC,GAAG;AAC/C,YAAM,KAAK,iBAAiB,EAAE,KAAK,WAAW,CAAC;AAC/C,YAAM,KAAK,sBAAsB,KAAK,IAAI,UAAU;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,QAA+B;AACrD,UAAM,KAAK,KAAK,MAAM,wCAAwC,CAAC,MAAM,CAAC;AAAA,EACxE;AAAA,EAEA,MAAa,sBAAsB,QAAgB,eAAsC;AACvF,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,QAAQ,aAAa;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAa,yBAAyB,QAAgB,eAAsC;AAC1F,UAAM,KAAK,KAAK;AAAA,MACd;AAAA,MACA,CAAC,QAAQ,aAAa;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,YAA2C;AACjE,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWA;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,YAAY;AAAA,QACvB,WAAW,gBAAgB;AAAA,QAC3B,WAAW,cAAc;AAAA,QACzB,WAAW,aAAa;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,YAAqD;AAC3E,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,YAAY;AAAA,QACvB,WAAW,gBAAgB;AAAA,QAC3B,WAAW,cAAc;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,SAAsD;AAC5F,MAAI,QAAQ,SAAS,QAAW;AAC9B,WAAO,IAAI,kBAAkB,QAAQ,IAAI;AAAA,EAC3C;AAEA,SAAO,IAAI,kBAAkB,IAAI,eAAK,OAAO,GAAG,IAAI;AACtD;AAEA,SAAS,QAAQ,KAA0B;AACzC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,UAAU;AAAA,IAC5D,GAAI,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc;AAAA,IACxE,GAAI,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,IAAI,YAAY;AAAA,IAClE,GAAI,IAAI,eAAe,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,WAAW;AAAA,EACjE;AACF;AAEA,SAAS,cAAc,KAAsC;AAC3D,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT,cAAc,IAAI;AAAA,IAClB,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,UAAU;AAAA,IAC5D,GAAI,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc;AAAA,IACxE,GAAI,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,IAAI,YAAY;AAAA,IAClE,GAAI,IAAI,eAAe,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,WAAW;AAAA,EACjE;AACF;","names":[]}

package/dist/index.d.cts

@@ -0,0 +1,27 @@
+import { Pool, PoolConfig } from 'pg';
+import { AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository, AccessProfileQuery, AccessProfile, PermissionDefinition, RoleDefinition, RoleAssignment, RoleAssignmentRevocation } from '@rbacbee-lib/core';
+
+declare const POSTGRES_RBAC_SCHEMA = "\nCREATE TABLE IF NOT EXISTS rbac_permissions (\n  key text PRIMARY KEY,\n  description text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),\n  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')\n);\n\nCREATE TABLE IF NOT EXISTS rbac_roles (\n  id text PRIMARY KEY,\n  name text NOT NULL,\n  tenant_id text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),\n  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_role_permissions (\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (role_id, permission_key)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_user_roles (\n  id bigserial PRIMARY KEY,\n  user_id text NOT NULL,\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  tenant_id text NULL,\n  resource_type text NULL,\n  resource_id text NULL,\n  expires_at timestamptz NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)\n);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant\n  ON rbac_user_roles (user_id, tenant_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role\n  ON rbac_user_roles (role_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource\n  ON rbac_user_roles (resource_type, resource_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission\n  ON rbac_role_permissions (permission_key);\n";
+
+interface PostgresRbacStoreOptions extends PoolConfig {
+    readonly pool?: Pool;
+}
+declare class PostgresRbacStore implements AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository {
+    private readonly pool;
+    private readonly ownsPool;
+    constructor(pool: Pool, ownsPool?: boolean);
+    migrate(): Promise<void>;
+    close(): Promise<void>;
+    getAccessProfile(query: AccessProfileQuery): Promise<AccessProfile | null>;
+    upsertPermission(permission: PermissionDefinition): Promise<void>;
+    deletePermission(permissionKey: string): Promise<void>;
+    createRole(role: RoleDefinition): Promise<void>;
+    deleteRole(roleId: string): Promise<void>;
+    grantPermissionToRole(roleId: string, permissionKey: string): Promise<void>;
+    revokePermissionFromRole(roleId: string, permissionKey: string): Promise<void>;
+    assignRole(assignment: RoleAssignment): Promise<void>;
+    revokeRole(revocation: RoleAssignmentRevocation): Promise<void>;
+}
+declare function createPostgresRbacStore(options: PostgresRbacStoreOptions): PostgresRbacStore;
+
+export { POSTGRES_RBAC_SCHEMA, PostgresRbacStore, type PostgresRbacStoreOptions, createPostgresRbacStore };

package/dist/index.d.ts

@@ -0,0 +1,27 @@
+import { Pool, PoolConfig } from 'pg';
+import { AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository, AccessProfileQuery, AccessProfile, PermissionDefinition, RoleDefinition, RoleAssignment, RoleAssignmentRevocation } from '@rbacbee-lib/core';
+
+declare const POSTGRES_RBAC_SCHEMA = "\nCREATE TABLE IF NOT EXISTS rbac_permissions (\n  key text PRIMARY KEY,\n  description text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),\n  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')\n);\n\nCREATE TABLE IF NOT EXISTS rbac_roles (\n  id text PRIMARY KEY,\n  name text NOT NULL,\n  tenant_id text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),\n  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_role_permissions (\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (role_id, permission_key)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_user_roles (\n  id bigserial PRIMARY KEY,\n  user_id text NOT NULL,\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  tenant_id text NULL,\n  resource_type text NULL,\n  resource_id text NULL,\n  expires_at timestamptz NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)\n);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant\n  ON rbac_user_roles (user_id, tenant_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role\n  ON rbac_user_roles (role_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource\n  ON rbac_user_roles (resource_type, resource_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission\n  ON rbac_role_permissions (permission_key);\n";
+
+interface PostgresRbacStoreOptions extends PoolConfig {
+    readonly pool?: Pool;
+}
+declare class PostgresRbacStore implements AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository {
+    private readonly pool;
+    private readonly ownsPool;
+    constructor(pool: Pool, ownsPool?: boolean);
+    migrate(): Promise<void>;
+    close(): Promise<void>;
+    getAccessProfile(query: AccessProfileQuery): Promise<AccessProfile | null>;
+    upsertPermission(permission: PermissionDefinition): Promise<void>;
+    deletePermission(permissionKey: string): Promise<void>;
+    createRole(role: RoleDefinition): Promise<void>;
+    deleteRole(roleId: string): Promise<void>;
+    grantPermissionToRole(roleId: string, permissionKey: string): Promise<void>;
+    revokePermissionFromRole(roleId: string, permissionKey: string): Promise<void>;
+    assignRole(assignment: RoleAssignment): Promise<void>;
+    revokeRole(revocation: RoleAssignmentRevocation): Promise<void>;
+}
+declare function createPostgresRbacStore(options: PostgresRbacStoreOptions): PostgresRbacStore;
+
+export { POSTGRES_RBAC_SCHEMA, PostgresRbacStore, type PostgresRbacStoreOptions, createPostgresRbacStore };

package/dist/index.js

@@ -0,0 +1,235 @@
+// src/postgres-rbac-schema.ts
+var POSTGRES_RBAC_SCHEMA = `
+CREATE TABLE IF NOT EXISTS rbac_permissions (
+  key text PRIMARY KEY,
+  description text NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),
+  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')
+);
+
+CREATE TABLE IF NOT EXISTS rbac_roles (
+  id text PRIMARY KEY,
+  name text NOT NULL,
+  tenant_id text NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),
+  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)
+);
+
+CREATE TABLE IF NOT EXISTS rbac_role_permissions (
+  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,
+  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (role_id, permission_key)
+);
+
+CREATE TABLE IF NOT EXISTS rbac_user_roles (
+  id bigserial PRIMARY KEY,
+  user_id text NOT NULL,
+  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,
+  tenant_id text NULL,
+  resource_type text NULL,
+  resource_id text NULL,
+  expires_at timestamptz NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)
+);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant
+  ON rbac_user_roles (user_id, tenant_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role
+  ON rbac_user_roles (role_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource
+  ON rbac_user_roles (resource_type, resource_id);
+
+CREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission
+  ON rbac_role_permissions (permission_key);
+`;
+
+// src/postgres-rbac-store.ts
+import { Pool } from "pg";
+var PostgresRbacStore = class {
+  constructor(pool, ownsPool = false) {
+    this.pool = pool;
+    this.ownsPool = ownsPool;
+  }
+  pool;
+  ownsPool;
+  async migrate() {
+    await this.pool.query(POSTGRES_RBAC_SCHEMA);
+  }
+  async close() {
+    if (this.ownsPool) {
+      await this.pool.end();
+    }
+  }
+  async getAccessProfile(query) {
+    const tenantId = query.tenantId ?? null;
+    const [rolesResult, permissionsResult] = await Promise.all([
+      this.pool.query(
+        `
+        SELECT r.id, r.name, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at
+        FROM rbac_user_roles ur
+        INNER JOIN rbac_roles r ON r.id = ur.role_id
+        WHERE ur.user_id = $1
+          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)
+          AND (ur.expires_at IS NULL OR ur.expires_at > now())
+        `,
+        [query.userId, tenantId]
+      ),
+      this.pool.query(
+        `
+        SELECT p.key, ur.role_id, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at
+        FROM rbac_user_roles ur
+        INNER JOIN rbac_role_permissions rp ON rp.role_id = ur.role_id
+        INNER JOIN rbac_permissions p ON p.key = rp.permission_key
+        WHERE ur.user_id = $1
+          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)
+          AND (ur.expires_at IS NULL OR ur.expires_at > now())
+        `,
+        [query.userId, tenantId]
+      )
+    ]);
+    if (rolesResult.rowCount === 0 && permissionsResult.rowCount === 0) {
+      return null;
+    }
+    const profile = {
+      userId: query.userId,
+      ...query.tenantId === void 0 ? {} : { tenantId: query.tenantId },
+      loadedAt: /* @__PURE__ */ new Date(),
+      roles: rolesResult.rows.map(mapRole),
+      permissions: permissionsResult.rows.map(mapPermission)
+    };
+    return profile;
+  }
+  async upsertPermission(permission) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_permissions (key, description)
+      VALUES ($1, $2)
+      ON CONFLICT (key) DO UPDATE
+        SET description = EXCLUDED.description,
+            updated_at = now()
+      `,
+      [permission.key, permission.description ?? null]
+    );
+  }
+  async deletePermission(permissionKey) {
+    await this.pool.query("DELETE FROM rbac_permissions WHERE key = $1", [permissionKey]);
+  }
+  async createRole(role) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_roles (id, name, tenant_id)
+      VALUES ($1, $2, $3)
+      ON CONFLICT (id) DO UPDATE
+        SET name = EXCLUDED.name,
+            tenant_id = EXCLUDED.tenant_id,
+            updated_at = now()
+      `,
+      [role.id, role.name, role.tenantId ?? null]
+    );
+    for (const permission of role.permissions ?? []) {
+      await this.upsertPermission({ key: permission });
+      await this.grantPermissionToRole(role.id, permission);
+    }
+  }
+  async deleteRole(roleId) {
+    await this.pool.query("DELETE FROM rbac_roles WHERE id = $1", [roleId]);
+  }
+  async grantPermissionToRole(roleId, permissionKey) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_role_permissions (role_id, permission_key)
+      VALUES ($1, $2)
+      ON CONFLICT (role_id, permission_key) DO NOTHING
+      `,
+      [roleId, permissionKey]
+    );
+  }
+  async revokePermissionFromRole(roleId, permissionKey) {
+    await this.pool.query(
+      "DELETE FROM rbac_role_permissions WHERE role_id = $1 AND permission_key = $2",
+      [roleId, permissionKey]
+    );
+  }
+  async assignRole(assignment) {
+    await this.pool.query(
+      `
+      INSERT INTO rbac_user_roles (
+        user_id,
+        role_id,
+        tenant_id,
+        resource_type,
+        resource_id,
+        expires_at
+      )
+      VALUES ($1, $2, $3, $4, $5, $6)
+      `,
+      [
+        assignment.userId,
+        assignment.roleId,
+        assignment.tenantId ?? null,
+        assignment.resourceType ?? null,
+        assignment.resourceId ?? null,
+        assignment.expiresAt ?? null
+      ]
+    );
+  }
+  async revokeRole(revocation) {
+    await this.pool.query(
+      `
+      DELETE FROM rbac_user_roles
+      WHERE user_id = $1
+        AND role_id = $2
+        AND ($3::text IS NULL OR tenant_id = $3)
+        AND ($4::text IS NULL OR resource_type = $4)
+        AND ($5::text IS NULL OR resource_id = $5)
+      `,
+      [
+        revocation.userId,
+        revocation.roleId,
+        revocation.tenantId ?? null,
+        revocation.resourceType ?? null,
+        revocation.resourceId ?? null
+      ]
+    );
+  }
+};
+function createPostgresRbacStore(options) {
+  if (options.pool !== void 0) {
+    return new PostgresRbacStore(options.pool);
+  }
+  return new PostgresRbacStore(new Pool(options), true);
+}
+function mapRole(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    ...row.tenant_id === null ? {} : { tenantId: row.tenant_id },
+    ...row.resource_type === null ? {} : { resourceType: row.resource_type },
+    ...row.resource_id === null ? {} : { resourceId: row.resource_id },
+    ...row.expires_at === null ? {} : { expiresAt: row.expires_at }
+  };
+}
+function mapPermission(row) {
+  return {
+    key: row.key,
+    sourceRoleId: row.role_id,
+    ...row.tenant_id === null ? {} : { tenantId: row.tenant_id },
+    ...row.resource_type === null ? {} : { resourceType: row.resource_type },
+    ...row.resource_id === null ? {} : { resourceId: row.resource_id },
+    ...row.expires_at === null ? {} : { expiresAt: row.expires_at }
+  };
+}
+export {
+  POSTGRES_RBAC_SCHEMA,
+  PostgresRbacStore,
+  createPostgresRbacStore
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/postgres-rbac-schema.ts","../src/postgres-rbac-store.ts"],"sourcesContent":["export const POSTGRES_RBAC_SCHEMA = `\nCREATE TABLE IF NOT EXISTS rbac_permissions (\n  key text PRIMARY KEY,\n  description text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_permissions_key_length CHECK (length(key) BETWEEN 1 AND 128),\n  CONSTRAINT rbac_permissions_key_safe CHECK (key ~ '^[A-Za-z0-9*][A-Za-z0-9:_.*-]{0,127}$')\n);\n\nCREATE TABLE IF NOT EXISTS rbac_roles (\n  id text PRIMARY KEY,\n  name text NOT NULL,\n  tenant_id text NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  updated_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_roles_id_length CHECK (length(id) BETWEEN 1 AND 256),\n  CONSTRAINT rbac_roles_name_length CHECK (length(name) BETWEEN 1 AND 256)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_role_permissions (\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  permission_key text NOT NULL REFERENCES rbac_permissions(key) ON DELETE CASCADE,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  PRIMARY KEY (role_id, permission_key)\n);\n\nCREATE TABLE IF NOT EXISTS rbac_user_roles (\n  id bigserial PRIMARY KEY,\n  user_id text NOT NULL,\n  role_id text NOT NULL REFERENCES rbac_roles(id) ON DELETE CASCADE,\n  tenant_id text NULL,\n  resource_type text NULL,\n  resource_id text NULL,\n  expires_at timestamptz NULL,\n  created_at timestamptz NOT NULL DEFAULT now(),\n  CONSTRAINT rbac_user_roles_user_id_length CHECK (length(user_id) BETWEEN 1 AND 256)\n);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_user_tenant\n  ON rbac_user_roles (user_id, tenant_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_role\n  ON rbac_user_roles (role_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_user_roles_resource\n  ON rbac_user_roles (resource_type, resource_id);\n\nCREATE INDEX IF NOT EXISTS idx_rbac_role_permissions_permission\n  ON rbac_role_permissions (permission_key);\n`;\n","import { Pool, type PoolConfig } from 'pg';\nimport type {\n  AccessPermission,\n  AccessProfile,\n  AccessProfileQuery,\n  AccessRepository,\n  AccessRole,\n  AssignmentRepository,\n  PermissionDefinition,\n  PermissionRepository,\n  RoleAssignment,\n  RoleAssignmentRevocation,\n  RoleDefinition,\n  RoleRepository\n} from '@rbacbee-lib/core';\nimport { POSTGRES_RBAC_SCHEMA } from './postgres-rbac-schema';\n\nexport interface PostgresRbacStoreOptions extends PoolConfig {\n  readonly pool?: Pool;\n}\n\ninterface RoleRow {\n  readonly id: string;\n  readonly name: string;\n  readonly tenant_id: string | null;\n  readonly resource_type: string | null;\n  readonly resource_id: string | null;\n  readonly expires_at: Date | null;\n}\n\ninterface PermissionRow {\n  readonly key: string;\n  readonly role_id: string;\n  readonly tenant_id: string | null;\n  readonly resource_type: string | null;\n  readonly resource_id: string | null;\n  readonly expires_at: Date | null;\n}\n\nexport class PostgresRbacStore\n  implements AccessRepository, PermissionRepository, RoleRepository, AssignmentRepository\n{\n  private readonly ownsPool: boolean;\n\n  public constructor(\n    private readonly pool: Pool,\n    ownsPool = false\n  ) {\n    this.ownsPool = ownsPool;\n  }\n\n  public async migrate(): Promise<void> {\n    await this.pool.query(POSTGRES_RBAC_SCHEMA);\n  }\n\n  public async close(): Promise<void> {\n    if (this.ownsPool) {\n      await this.pool.end();\n    }\n  }\n\n  public async getAccessProfile(query: AccessProfileQuery): Promise<AccessProfile | null> {\n    const tenantId = query.tenantId ?? null;\n    const [rolesResult, permissionsResult] = await Promise.all([\n      this.pool.query<RoleRow>(\n        `\n        SELECT r.id, r.name, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at\n        FROM rbac_user_roles ur\n        INNER JOIN rbac_roles r ON r.id = ur.role_id\n        WHERE ur.user_id = $1\n          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)\n          AND (ur.expires_at IS NULL OR ur.expires_at > now())\n        `,\n        [query.userId, tenantId]\n      ),\n      this.pool.query<PermissionRow>(\n        `\n        SELECT p.key, ur.role_id, ur.tenant_id, ur.resource_type, ur.resource_id, ur.expires_at\n        FROM rbac_user_roles ur\n        INNER JOIN rbac_role_permissions rp ON rp.role_id = ur.role_id\n        INNER JOIN rbac_permissions p ON p.key = rp.permission_key\n        WHERE ur.user_id = $1\n          AND ($2::text IS NULL OR ur.tenant_id IS NULL OR ur.tenant_id = $2)\n          AND (ur.expires_at IS NULL OR ur.expires_at > now())\n        `,\n        [query.userId, tenantId]\n      )\n    ]);\n\n    if (rolesResult.rowCount === 0 && permissionsResult.rowCount === 0) {\n      return null;\n    }\n\n    const profile: AccessProfile = {\n      userId: query.userId,\n      ...(query.tenantId === undefined ? {} : { tenantId: query.tenantId }),\n      loadedAt: new Date(),\n      roles: rolesResult.rows.map(mapRole),\n      permissions: permissionsResult.rows.map(mapPermission)\n    };\n\n    return profile;\n  }\n\n  public async upsertPermission(permission: PermissionDefinition): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_permissions (key, description)\n      VALUES ($1, $2)\n      ON CONFLICT (key) DO UPDATE\n        SET description = EXCLUDED.description,\n            updated_at = now()\n      `,\n      [permission.key, permission.description ?? null]\n    );\n  }\n\n  public async deletePermission(permissionKey: string): Promise<void> {\n    await this.pool.query('DELETE FROM rbac_permissions WHERE key = $1', [permissionKey]);\n  }\n\n  public async createRole(role: RoleDefinition): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_roles (id, name, tenant_id)\n      VALUES ($1, $2, $3)\n      ON CONFLICT (id) DO UPDATE\n        SET name = EXCLUDED.name,\n            tenant_id = EXCLUDED.tenant_id,\n            updated_at = now()\n      `,\n      [role.id, role.name, role.tenantId ?? null]\n    );\n\n    for (const permission of role.permissions ?? []) {\n      await this.upsertPermission({ key: permission });\n      await this.grantPermissionToRole(role.id, permission);\n    }\n  }\n\n  public async deleteRole(roleId: string): Promise<void> {\n    await this.pool.query('DELETE FROM rbac_roles WHERE id = $1', [roleId]);\n  }\n\n  public async grantPermissionToRole(roleId: string, permissionKey: string): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_role_permissions (role_id, permission_key)\n      VALUES ($1, $2)\n      ON CONFLICT (role_id, permission_key) DO NOTHING\n      `,\n      [roleId, permissionKey]\n    );\n  }\n\n  public async revokePermissionFromRole(roleId: string, permissionKey: string): Promise<void> {\n    await this.pool.query(\n      'DELETE FROM rbac_role_permissions WHERE role_id = $1 AND permission_key = $2',\n      [roleId, permissionKey]\n    );\n  }\n\n  public async assignRole(assignment: RoleAssignment): Promise<void> {\n    await this.pool.query(\n      `\n      INSERT INTO rbac_user_roles (\n        user_id,\n        role_id,\n        tenant_id,\n        resource_type,\n        resource_id,\n        expires_at\n      )\n      VALUES ($1, $2, $3, $4, $5, $6)\n      `,\n      [\n        assignment.userId,\n        assignment.roleId,\n        assignment.tenantId ?? null,\n        assignment.resourceType ?? null,\n        assignment.resourceId ?? null,\n        assignment.expiresAt ?? null\n      ]\n    );\n  }\n\n  public async revokeRole(revocation: RoleAssignmentRevocation): Promise<void> {\n    await this.pool.query(\n      `\n      DELETE FROM rbac_user_roles\n      WHERE user_id = $1\n        AND role_id = $2\n        AND ($3::text IS NULL OR tenant_id = $3)\n        AND ($4::text IS NULL OR resource_type = $4)\n        AND ($5::text IS NULL OR resource_id = $5)\n      `,\n      [\n        revocation.userId,\n        revocation.roleId,\n        revocation.tenantId ?? null,\n        revocation.resourceType ?? null,\n        revocation.resourceId ?? null\n      ]\n    );\n  }\n}\n\nexport function createPostgresRbacStore(options: PostgresRbacStoreOptions): PostgresRbacStore {\n  if (options.pool !== undefined) {\n    return new PostgresRbacStore(options.pool);\n  }\n\n  return new PostgresRbacStore(new Pool(options), true);\n}\n\nfunction mapRole(row: RoleRow): AccessRole {\n  return {\n    id: row.id,\n    name: row.name,\n    ...(row.tenant_id === null ? {} : { tenantId: row.tenant_id }),\n    ...(row.resource_type === null ? {} : { resourceType: row.resource_type }),\n    ...(row.resource_id === null ? {} : { resourceId: row.resource_id }),\n    ...(row.expires_at === null ? {} : { expiresAt: row.expires_at })\n  };\n}\n\nfunction mapPermission(row: PermissionRow): AccessPermission {\n  return {\n    key: row.key,\n    sourceRoleId: row.role_id,\n    ...(row.tenant_id === null ? {} : { tenantId: row.tenant_id }),\n    ...(row.resource_type === null ? {} : { resourceType: row.resource_type }),\n    ...(row.resource_id === null ? {} : { resourceId: row.resource_id }),\n    ...(row.expires_at === null ? {} : { expiresAt: row.expires_at })\n  };\n}\n"],"mappings":";AAAO,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACApC,SAAS,YAA6B;AAuC/B,IAAM,oBAAN,MAEP;AAAA,EAGS,YACY,MACjB,WAAW,OACX;AAFiB;AAGjB,SAAK,WAAW;AAAA,EAClB;AAAA,EAJmB;AAAA,EAHF;AAAA,EASjB,MAAa,UAAyB;AACpC,UAAM,KAAK,KAAK,MAAM,oBAAoB;AAAA,EAC5C;AAAA,EAEA,MAAa,QAAuB;AAClC,QAAI,KAAK,UAAU;AACjB,YAAM,KAAK,KAAK,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAa,iBAAiB,OAA0D;AACtF,UAAM,WAAW,MAAM,YAAY;AACnC,UAAM,CAAC,aAAa,iBAAiB,IAAI,MAAM,QAAQ,IAAI;AAAA,MACzD,KAAK,KAAK;AAAA,QACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAQA,CAAC,MAAM,QAAQ,QAAQ;AAAA,MACzB;AAAA,MACA,KAAK,KAAK;AAAA,QACR;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QASA,CAAC,MAAM,QAAQ,QAAQ;AAAA,MACzB;AAAA,IACF,CAAC;AAED,QAAI,YAAY,aAAa,KAAK,kBAAkB,aAAa,GAAG;AAClE,aAAO;AAAA,IACT;AAEA,UAAM,UAAyB;AAAA,MAC7B,QAAQ,MAAM;AAAA,MACd,GAAI,MAAM,aAAa,SAAY,CAAC,IAAI,EAAE,UAAU,MAAM,SAAS;AAAA,MACnE,UAAU,oBAAI,KAAK;AAAA,MACnB,OAAO,YAAY,KAAK,IAAI,OAAO;AAAA,MACnC,aAAa,kBAAkB,KAAK,IAAI,aAAa;AAAA,IACvD;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,MAAa,iBAAiB,YAAiD;AAC7E,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOA,CAAC,WAAW,KAAK,WAAW,eAAe,IAAI;AAAA,IACjD;AAAA,EACF;AAAA,EAEA,MAAa,iBAAiB,eAAsC;AAClE,UAAM,KAAK,KAAK,MAAM,+CAA+C,CAAC,aAAa,CAAC;AAAA,EACtF;AAAA,EAEA,MAAa,WAAW,MAAqC;AAC3D,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA,CAAC,KAAK,IAAI,KAAK,MAAM,KAAK,YAAY,IAAI;AAAA,IAC5C;AAEA,eAAW,cAAc,KAAK,eAAe,CAAC,GAAG;AAC/C,YAAM,KAAK,iBAAiB,EAAE,KAAK,WAAW,CAAC;AAC/C,YAAM,KAAK,sBAAsB,KAAK,IAAI,UAAU;AAAA,IACtD;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,QAA+B;AACrD,UAAM,KAAK,KAAK,MAAM,wCAAwC,CAAC,MAAM,CAAC;AAAA,EACxE;AAAA,EAEA,MAAa,sBAAsB,QAAgB,eAAsC;AACvF,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,QAAQ,aAAa;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAa,yBAAyB,QAAgB,eAAsC;AAC1F,UAAM,KAAK,KAAK;AAAA,MACd;AAAA,MACA,CAAC,QAAQ,aAAa;AAAA,IACxB;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,YAA2C;AACjE,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAWA;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,YAAY;AAAA,QACvB,WAAW,gBAAgB;AAAA,QAC3B,WAAW,cAAc;AAAA,QACzB,WAAW,aAAa;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAa,WAAW,YAAqD;AAC3E,UAAM,KAAK,KAAK;AAAA,MACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQA;AAAA,QACE,WAAW;AAAA,QACX,WAAW;AAAA,QACX,WAAW,YAAY;AAAA,QACvB,WAAW,gBAAgB;AAAA,QAC3B,WAAW,cAAc;AAAA,MAC3B;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wBAAwB,SAAsD;AAC5F,MAAI,QAAQ,SAAS,QAAW;AAC9B,WAAO,IAAI,kBAAkB,QAAQ,IAAI;AAAA,EAC3C;AAEA,SAAO,IAAI,kBAAkB,IAAI,KAAK,OAAO,GAAG,IAAI;AACtD;AAEA,SAAS,QAAQ,KAA0B;AACzC,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,MAAM,IAAI;AAAA,IACV,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,UAAU;AAAA,IAC5D,GAAI,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc;AAAA,IACxE,GAAI,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,IAAI,YAAY;AAAA,IAClE,GAAI,IAAI,eAAe,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,WAAW;AAAA,EACjE;AACF;AAEA,SAAS,cAAc,KAAsC;AAC3D,SAAO;AAAA,IACL,KAAK,IAAI;AAAA,IACT,cAAc,IAAI;AAAA,IAClB,GAAI,IAAI,cAAc,OAAO,CAAC,IAAI,EAAE,UAAU,IAAI,UAAU;AAAA,IAC5D,GAAI,IAAI,kBAAkB,OAAO,CAAC,IAAI,EAAE,cAAc,IAAI,cAAc;AAAA,IACxE,GAAI,IAAI,gBAAgB,OAAO,CAAC,IAAI,EAAE,YAAY,IAAI,YAAY;AAAA,IAClE,GAAI,IAAI,eAAe,OAAO,CAAC,IAAI,EAAE,WAAW,IAAI,WAAW;AAAA,EACjE;AACF;","names":[]}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@rbacbee-lib/postgres",
+  "version": "0.1.0",
+  "description": "Postgres storage adapter for @rbacbee-lib/core.",
+  "license": "MIT",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts --format esm,cjs --dts --sourcemap --clean --external pg --external @rbacbee-lib/core",
+    "dev": "tsup src/index.ts --format esm,cjs --dts --sourcemap --watch --external pg --external @rbacbee-lib/core",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "lint": "eslint src --max-warnings=0",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist coverage"
+  },
+  "dependencies": {
+    "@rbacbee-lib/core": "workspace:^",
+    "pg": "^8.13.1"
+  },
+  "devDependencies": {
+    "@types/pg": "^8.11.10"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}