@rebasepro/common 0.17.3 → 0.18.1

package/src/util/permissions.ts

@@ -1,206 +0,0 @@
-import { AuthState, Entity, CollectionConfig, SecurityOperation, SecurityRule, User } from "@rebasepro/types";
-import { securityRuleToConditions } from "./policy/securityRuleToConditions";
-import { evaluatePolicy, PolicyEvalContext, TriState } from "./policy/evaluatePolicy";
-
-/**
- * Minimal auth context for permission checking.
- * Only requires the user object — avoids forcing callers to construct
- * a full AuthController just to check permissions.
- *
- * An alias, not a second definition: {@link AuthState} in `@rebasepro/types` is
- * the same shape and is what `dynamicProps` and the JSON-Logic condition context
- * now take, so declaring it twice would be the `WhereFilterOp` mistake again —
- * two copies that agree only by luck.
- */
-export type AuthContext<USER extends User = User> = AuthState<USER>;
-
-/**
- * How to resolve a policy result that cannot be decided client-side (a raw-SQL
- * escape-hatch rule, or a row-column reference with no row in hand).
- *
- * - `"allow"` (default): optimistic — used for admin-UI gating, where Postgres
- *   remains the authoritative gate and hiding a working action is worse than
- *   showing one the server may reject.
- * - `"deny"`: fail-closed — used by real enforcement callers (e.g. a driver
- *   applying policies in-process), so an undecidable rule never silently allows.
- */
-export type UnknownResolution = "allow" | "deny";
-
-/**
- * Which half of a rule to evaluate.
- *
- * Postgres evaluates `USING` against the row as it is *now* and `WITH CHECK`
- * against the row as it *will be*, both inside the transaction. A driver
- * enforcing an update in-process has two different rows in hand and therefore
- * needs to ask the two questions separately — asking one question about one row
- * either checks the new values against the old row's ownership or the reverse.
- *
- * - `"both"` (default): what a single-row decision means (`USING ∧ WITH CHECK`).
- * - `"using"`: the read/target clause only — ask it about the stored row.
- * - `"withCheck"`: the write clause only — ask it about the row being written.
- *
- * Rule *selection* is unaffected: the target operation still decides which rules
- * apply, so `"using"` on an `update` evaluates the update rules' USING clause,
- * not the delete rules'.
- */
-export type PolicyClauses = "both" | "using" | "withCheck";
-
-export interface CheckOperationOptions {
-    onUnknown?: UnknownResolution;
-    clauses?: PolicyClauses;
-}
-
-/** Combine clause results with AND under three-valued (Kleene) logic. */
-function kleeneAnd(values: TriState[]): TriState {
-    if (values.some(v => v === false)) return false;
-    if (values.some(v => v === "unknown")) return "unknown";
-    return true;
-}
-
-/** The operations a rule covers, mirroring the Postgres generator's resolution. */
-function ruleOperations(rule: SecurityRule): readonly SecurityOperation[] {
-    return rule.operations && rule.operations.length > 0
-        ? rule.operations
-        : [rule.operation ?? "all"];
-}
-
-function ruleApplies(rule: SecurityRule, targetOperation: SecurityOperation): boolean {
-    const ops = ruleOperations(rule);
-    return ops.includes(targetOperation) || ops.includes("all");
-}
-
-/**
- * Evaluate a single rule for one operation, returning a tri-state.
- *
- * A `null` clause (the rule contributes no condition for a required clause)
- * denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
- * in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
- * INSERT/UPDATE; both must pass for UPDATE.
- */
-function evaluateRuleForOperation(
-    rule: SecurityRule,
-    ctx: PolicyEvalContext,
-    targetOperation: SecurityOperation,
-    clauses: PolicyClauses = "both"
-): TriState {
-    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-    const clause = (expr: typeof usingExpr): TriState => expr === null ? false : evaluatePolicy(expr, ctx);
-
-    const needsUsing = targetOperation !== "insert" && clauses !== "withCheck";
-    const needsWithCheck = (targetOperation === "insert" || targetOperation === "update") && clauses !== "using";
-
-    const results: TriState[] = [];
-    if (needsUsing) results.push(clause(usingExpr));
-    if (needsWithCheck) results.push(clause(withCheckExpr));
-    return kleeneAnd(results);
-}
-
-function resolveTriState(value: TriState, onUnknown: UnknownResolution): boolean {
-    if (value === "unknown") return onUnknown === "allow";
-    return value;
-}
-
-/**
- * Decide whether an operation is permitted for a user on a (possibly null) row,
- * by evaluating the collection's security rules with the shared policy model —
- * the same model compiled to Postgres RLS DDL, so the decision matches database
- * enforcement for every non-raw rule.
- *
- * Engine-independent by design. `securityRules` are a declaration about the
- * data, not about Postgres: the engine decides *who* enforces them (Postgres
- * compiles them to RLS DDL, a document driver applies them in-process), never
- * *whether* they hold. Gating this function on the engine's `supportsRLS`
- * capability is what made every `{ onUnknown: "deny" }` call site in the Mongo
- * driver return `true` before it evaluated anything — and it did so only for
- * collections that spelled their engine out, so declaring `engine: "mongodb"`
- * was what switched authorization off.
- *
- * @param options.onUnknown how to treat rules that cannot be decided
- *   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
- *   for optimistic UI gating; enforcement callers should pass `"deny"`.
- * @param options.clauses which half of each rule to evaluate. See
- *   {@link PolicyClauses}; defaults to `"both"`.
- */
-export function checkOperation<M extends Record<string, unknown>, USER extends User>(
-    collection: CollectionConfig<M>,
-    authContext: AuthContext<USER>,
-    entity: Entity<M> | null,
-    targetOperation: SecurityOperation,
-    options?: CheckOperationOptions
-): boolean {
-    const onUnknown = options?.onUnknown ?? "allow";
-    const clauses = options?.clauses ?? "both";
-    const securityRules = collection.securityRules;
-    if (!securityRules || securityRules.length === 0) {
-        return true;
-    }
-
-    const applicableRules = securityRules.filter((r: SecurityRule) => ruleApplies(r, targetOperation));
-    if (applicableRules.length === 0) return false;
-
-    const ctx: PolicyEvalContext = {
-        uid: authContext.user?.uid,
-        roles: authContext.user?.roles ?? [],
-        entity
-    };
-
-    let grantedByPermissive = false;
-    let deniedByRestrictive = false;
-    let hasPermissive = false;
-
-    for (const rule of applicableRules) {
-        const mode = rule.mode || "permissive";
-        const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation, clauses), onUnknown);
-
-        if (mode === "restrictive") {
-            if (!passed) {
-                deniedByRestrictive = true;
-                break;
-            }
-        } else {
-            hasPermissive = true;
-            if (passed) grantedByPermissive = true;
-        }
-    }
-
-    if (deniedByRestrictive) return false;
-    return hasPermissive ? grantedByPermissive : false;
-}
-
-export function canReadCollection<M extends Record<string, unknown>, USER extends User>
-    (
-        collection: CollectionConfig<M>,
-        authContext: AuthContext<USER>
-    ): boolean {
-    return checkOperation(collection, authContext, null, "select");
-}
-
-export function canEditEntity<M extends Record<string, unknown>, USER extends User>
-    (
-        collection: CollectionConfig<M>,
-        authContext: AuthContext<USER>,
-        path: string,
-        entity: Entity<M> | null
-    ): boolean {
-    return checkOperation(collection, authContext, entity, "update");
-}
-
-export function canCreateEntity<M extends Record<string, unknown>, USER extends User>
-    (
-        collection: CollectionConfig<M>,
-        authContext: AuthContext<USER>,
-        path: string,
-        entity: Entity<M> | null
-    ): boolean {
-    return checkOperation(collection, authContext, entity, "insert");
-}
-
-export function canDeleteEntity<M extends Record<string, unknown>, USER extends User>
-    (
-        collection: CollectionConfig<M>,
-        authContext: AuthContext<USER>,
-        path: string,
-        entity: Entity<M> | null
-    ): boolean {
-    return checkOperation(collection, authContext, entity, "delete");
-}

package/src/util/pg-column-to-property.ts

@@ -1,377 +0,0 @@
-import { rewriteLegacyRlsFunctions } from "@rebasepro/types";
-import type {
-    ArrayProperty,
-    NumberProperty,
-    PostgresProperties,
-    Property,
-    Relation,
-    SecurityOperation,
-    SecurityRule,
-    StringProperty,
-    TableColumnInfo,
-    TableMetadata
-} from "@rebasepro/types";
-import { firstFreeKey, prettifyIdentifier, toWireKey } from "@rebasepro/utils";
-
-/**
- * A collection as introspection can describe it: the table, its columns, the
- * relations its foreign keys imply, and the RLS policies already on it.
- *
- * Deliberately not `Partial<AdminCollection>`, which is what this returned
- * while it lived in `@rebasepro/studio`. `propertiesOrder` is the only admin
- * key it produces, and naming the admin view model for one field would put
- * `@rebasepro/cms-types` on the dependency path of a package the backend
- * loads.
- */
-export interface IntrospectedCollection {
-    name: string;
-    slug: string;
-    table: string;
-    properties: PostgresProperties;
-    propertiesOrder: string[];
-    relations?: Relation[];
-    securityRules?: SecurityRule[];
-}
-
-/**
- * Maps a PostgreSQL column data type to a Rebase property type.
- */
-function pgTypeToRebaseProperty(column: TableColumnInfo): Property | null {
-    const {
-        column_name,
-        data_type,
-        udt_name,
-        is_nullable,
-        column_default,
-        character_maximum_length,
-        enum_values
-    } = column;
-
-    const required = is_nullable === "NO";
-    const prettifiedName = prettifyIdentifier(column_name);
-
-    // Detect if this column is a primary key (auto-generated id)
-    const isAutoId = column_default != null && (
-        column_default.includes("nextval") ||
-        column_default.includes("gen_random_uuid") ||
-        column_default.includes("uuid_generate") ||
-        column_default.includes("identity")
-    );
-
-    // USER-DEFINED = PostgreSQL enums
-    if (data_type === "USER-DEFINED" && enum_values && enum_values.length > 0) {
-        return {
-            type: "string",
-            name: prettifiedName,
-            enum: enum_values.map((v: string) => ({ id: v,
-label: prettifyIdentifier(v) })),
-            validation: required ? { required: true } : undefined
-        } as StringProperty;
-    }
-
-    const dt = data_type.toLowerCase();
-    switch (dt) {
-        case "character varying":
-        case "varchar":
-        case "text":
-        case "char":
-        case "character":
-        case "citext": {
-            let colType: "varchar" | "text" | "char" = "varchar";
-            if (dt === "text" || dt === "citext") colType = "text";
-            if (dt === "char" || dt === "character") colType = "char";
-            // Carry the declared width across. Dropping it made introspection
-            // lossy in the one direction that costs data: a `character
-            // varying(500)` column read back as a bare `varchar` regenerates as
-            // `VARCHAR(255)`, narrowing a column that already holds longer
-            // values. TEXT has no width, and reporting one would invent a limit
-            // the database does not have.
-            const declaredLength = colType === "text" ? null : character_maximum_length;
-            const prop: StringProperty = {
-                type: "string",
-                name: prettifiedName,
-                columnType: colType,
-                validation: required || declaredLength
-                    ? {
-                        ...(required ? { required: true } : {}),
-                        ...(declaredLength ? { max: declaredLength } : {})
-                    }
-                    : undefined
-            };
-            if (isAutoId) {
-                prop.isId = "manual";
-            }
-            return prop;
-        }
-
-        case "uuid": {
-            const prop: StringProperty = {
-                type: "string",
-                name: prettifiedName,
-                validation: required ? { required: true } : undefined
-            };
-            if (isAutoId) {
-                prop.isId = "uuid";
-            }
-            return prop;
-        }
-
-        case "integer":
-        case "bigint":
-        case "smallint": {
-            const colType = dt === "bigint" ? "bigint" : "integer";
-            const prop: NumberProperty = {
-                type: "number",
-                name: prettifiedName,
-                columnType: colType,
-                validation: {
-                    ...(required ? { required: true } : {}),
-                    integer: true
-                }
-            };
-            if (isAutoId) {
-                prop.isId = "increment";
-            }
-            return prop;
-        }
-
-        case "serial":
-        case "bigserial":
-        case "smallserial": {
-            const colType = dt === "bigserial" ? "bigserial" : "serial";
-            return {
-                type: "number",
-                name: prettifiedName,
-                columnType: colType,
-                isId: "increment",
-                validation: {
-                    ...(required ? { required: true } : {}),
-                    integer: true
-                }
-            } as NumberProperty;
-        }
-
-        case "numeric":
-        case "decimal":
-        case "real":
-        case "double precision": {
-            let colType: "numeric" | "real" | "double precision" = "numeric";
-            if (dt === "real") colType = "real";
-            if (dt === "double precision") colType = "double precision";
-            return {
-                type: "number",
-                name: prettifiedName,
-                columnType: colType,
-                validation: required ? { required: true } : undefined
-            };
-        }
-
-        case "boolean":
-            return {
-                type: "boolean",
-                name: prettifiedName,
-                validation: required ? { required: true } : undefined
-            };
-
-        case "timestamp with time zone":
-        case "timestamp without time zone":
-        case "timestamp":
-        case "timestamptz":
-        case "date":
-        case "time with time zone":
-        case "time without time zone":
-        case "time": {
-            let colType: "timestamp" | "date" | "time" = "timestamp";
-            if (dt.startsWith("date")) colType = "date";
-            if (dt.startsWith("time ") || dt === "time") colType = "time";
-            return {
-                type: "date",
-                name: prettifiedName,
-                columnType: colType,
-                validation: required ? { required: true } : undefined
-            };
-        }
-
-        case "jsonb":
-        case "json":
-            return {
-                type: "map",
-                name: prettifiedName,
-                columnType: dt === "jsonb" ? "jsonb" : "json",
-                keyValue: true,
-                properties: {}
-            };
-
-        case "array":
-        case "ARRAY": {
-            let innerType = "string";
-            let colType: ArrayProperty["columnType"] = undefined;
-            if (udt_name === "_text" || udt_name === "_varchar") {
-                innerType = "string";
-                colType = "text[]";
-            } else if (udt_name === "_int4" || udt_name === "_int2" || udt_name === "_int8") {
-                innerType = "number";
-                colType = "integer[]";
-            } else if (udt_name === "_bool") {
-                innerType = "boolean";
-                colType = "boolean[]";
-            } else if (udt_name === "_numeric") {
-                innerType = "number";
-                colType = "numeric[]";
-            }
-            return {
-                type: "array",
-                name: prettifiedName,
-                columnType: colType,
-                of: { type: innerType }
-            } as ArrayProperty;
-        }
-
-        default:
-            // Fallback: treat unknown types as string
-            return {
-                type: "string",
-                name: prettifiedName,
-                validation: required ? { required: true } : undefined
-            };
-    }
-}
-
-/**
- * Builds a collection description from PostgreSQL table metadata.
- * This is used when creating a new collection from an existing database table.
- */
-export function buildCollectionFromTableMetadata(
-    tableName: string,
-    metadata: TableMetadata
-): IntrospectedCollection {
-    const properties: Record<string, Property> = {};
-    const propertiesOrder: string[] = [];
-    // Introspection can only ever produce two shapes: a foreign key on this
-    // table, or a junction between two. Both are named by their kind.
-    const relations: Array<{
-        id: string;
-        relationName: string;
-        target: string;
-        kind: "belongsTo" | "manyToMany";
-        localKey?: string;
-        through?: { table: string; sourceColumn: string; targetColumn: string };
-    }> = [];
-    const securityRules: SecurityRule[] = [];
-
-    // Parse columns
-    for (const column of metadata.columns) {
-        const property = pgTypeToRebaseProperty(column);
-        if (property) {
-            const propRecord = property as unknown as Record<string, unknown>;
-            Object.keys(propRecord).forEach(key => propRecord[key] === undefined && delete propRecord[key]);
-
-            // The key is the wire name; `columnName` carries the column. This
-            // used to key by the column and rely on the two being the same
-            // string, which is what put `user_id` on the API of an imported
-            // collection and `displayName` on the API of an authored one.
-            //
-            // `columnName` is stamped unconditionally rather than left to the
-            // snake_case default, because the default is not the inverse of
-            // camel-casing for every name — the mapping has to be recorded, not
-            // recomputed.
-            //
-            // First free candidate: `user_id` and `userId` as two real columns
-            // camel-case to one key, and one of them would otherwise overwrite
-            // the other and be silently dropped.
-            const key = firstFreeKey(
-                [toWireKey(column.column_name), column.column_name],
-                { has: (candidate: string) => candidate in properties }
-            );
-            if (key !== column.column_name) propRecord.columnName = column.column_name;
-            properties[key] = property;
-            propertiesOrder.push(key);
-        }
-    }
-
-    // Parse Outgoing Foreign Keys -> Many-to-One / One-to-One
-    if (metadata.foreignKeys) {
-        for (const fk of metadata.foreignKeys) {
-            const relName = toWireKey(
-                fk.column_name.endsWith("_id")
-                    ? fk.column_name.substring(0, fk.column_name.length - 3)
-                    : fk.column_name
-            );
-            relations.push({
-                id: fk.column_name,
-                relationName: relName,
-                target: fk.foreign_table_name, // Will be hydrated later
-                kind: "belongsTo",
-                localKey: fk.column_name
-            });
-        }
-    }
-
-    // Parse Incoming Junctions -> Many-to-Many
-    if (metadata.junctions) {
-        for (const junction of metadata.junctions) {
-            const relName = junction.target_table_name; // E.g., 'roles'
-            relations.push({
-                id: junction.target_table_name + "_relation",
-                relationName: relName,
-                target: junction.target_table_name, // Will be hydrated later
-                kind: "manyToMany",
-                through: {
-                    table: junction.junction_table_name,
-                    sourceColumn: junction.source_column_name,
-                    targetColumn: junction.target_column_name
-                }
-            });
-        }
-    }
-
-    // Parse RLS Policies
-    if (metadata.policies) {
-        for (const policy of metadata.policies) {
-            // Attempt to map typical cmds to operations.
-            // Postgres cmd: SELECT, INSERT, UPDATE, DELETE, ALL
-            let operations: SecurityOperation[] = [];
-            switch (policy.cmd) {
-                case "ALL": operations = ["all"]; break;
-                case "SELECT": operations = ["select"]; break;
-                case "INSERT": operations = ["insert"]; break;
-                case "UPDATE": operations = ["update"]; break;
-                case "DELETE": operations = ["delete"]; break;
-            }
-            // Normalised on the way in, the same way `sqlToPolicy` normalises
-            // what the admin UI reads back. Without it, importing a table from a
-            // database provisioned before 1.0 copies `auth.uid()` straight into
-            // the project's config — a call to a function the framework no
-            // longer creates, which then boots with a legacy-helper warning
-            // forever and holds the `auth` schema open.
-            const qual = policy.qual ? rewriteLegacyRlsFunctions(policy.qual) : undefined;
-            const withCheck = policy.with_check ? rewriteLegacyRlsFunctions(policy.with_check) : undefined;
-            if (qual) {
-                securityRules.push({
-                    name: policy.policy_name,
-                    operations,
-                    roles: policy.roles ?? [],
-                    using: qual,
-                    ...(withCheck ? { withCheck } : {})
-                });
-            } else {
-                securityRules.push({
-                    name: policy.policy_name,
-                    operations,
-                    roles: policy.roles ?? []
-                });
-            }
-        }
-    }
-
-    return {
-        name: prettifyIdentifier(tableName),
-        slug: tableName,
-        table: tableName,
-        properties: properties as PostgresProperties,
-        propertiesOrder,
-        // `target` is still a slug here — the caller hydrates it into a thunk.
-        ...(relations.length > 0 ? { relations: relations as unknown as Relation[] } : {}),
-        ...(securityRules.length > 0 ? { securityRules } : {})
-    };
-}