@rebasepro/common 0.21.1 → 0.22.0

package/dist/collections/auth-secrets.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Which columns of the user store are the server's alone, and which properties
+ * of a given auth collection hold one without saying so.
+ *
+ * `users` is the one collection a project is expected to redeclare: it is
+ * scaffolded into `config/collections/users.ts` so the panel can present it, and
+ * the declaration replaces the default outright rather than merging with it. The
+ * flag that goes missing unnoticed in that copy is `excludeFromApi` — the
+ * neighbouring `admin.hideFromCollection` and `admin.disabled.hidden` keep the
+ * field off the screen and look like they did the job.
+ *
+ * The rule has two readers and they must agree. The server restores the flag so
+ * a read does not serve the scrypt hash and a write cannot set it. The panel
+ * needs it just as much: a form opens with a value for every property that is
+ * not excluded, and submits that baseline, so a panel that does not know sends
+ * `passwordHash: null` with every new user and the server refuses the create.
+ */
+/**
+ * What the rule reads off a collection. A `CollectionConfig` is one; so is a
+ * collection a server has loaded and not yet validated.
+ */
+export interface AuthSecretCandidate {
+    auth?: unknown;
+    properties?: Record<string, {
+        excludeFromApi?: boolean;
+        columnName?: string;
+    } | undefined>;
+}
+/**
+ * The keys of the properties on `collection` that hold an auth secret and do not
+ * carry `excludeFromApi`. Empty for any collection that is not the user store: a
+ * `password_hash` column elsewhere — a CRM importing hashes, say — is that
+ * project's data, not this rule's business.
+ */
+export declare function authSecretsMissingExclusion(collection: AuthSecretCandidate): string[];

package/dist/collections/engine-support.d.ts

@@ -0,0 +1,23 @@
+import type { CollectionConfig } from "@rebasepro/types";
+/**
+ * Refuse a `beforeQuery` hook on a collection Postgres does not serve.
+ *
+ * `beforeQuery` narrows a read *before it is compiled*, which means compiling
+ * a declarative filter into the query the engine is about to run. Only
+ * `@rebasepro/server-postgres` does that today. On any other engine the hook
+ * would look configured and do nothing — and for a hook whose whole purpose is
+ * to restrict which rows come back, "nothing" means every row served to
+ * everybody.
+ *
+ * So it is a boot failure, named. The alternative — declaring the hook only on
+ * `PostgresCollectionConfig`, the way `search` is — is not available:
+ * `callbacks` is one engine-agnostic type shared by every collection, and
+ * splitting it would fork `afterRead` and the five write hooks along with it.
+ *
+ * Lives here rather than in either driver because both have to run it: the
+ * Postgres schema planner sees every collection in a mixed app, and a
+ * Mongo-only app never boots a Postgres planner at all.
+ *
+ * Called with *every* collection, before an engine filters any out.
+ */
+export declare const assertBeforeQueryIsPostgresOnly: (collections: CollectionConfig[]) => void;

package/dist/collections/index.d.ts

@@ -1,3 +1,5 @@
+export * from "./auth-secrets.js";
 export * from "./CollectionRegistry.js";
 export * from "./default-collections.js";
+export * from "./engine-support.js";
 export * from "./field-access.js";

package/dist/index.es.js

@@ -2816,7 +2816,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
+function isAuthCollection$1(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2869,7 +2869,7 @@ function getEffectiveSecurityRules(collection) {
 	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [
 		...explicit,
 		...tenantRule(collection),
-		...isAuthCollection(collection) ? [adminWriteGate(tableName)] : []
+		...isAuthCollection$1(collection) ? [adminWriteGate(tableName)] : []
 	];
 	injected.push({
 		name: `${tableName}_default_admin_read`,
@@ -2882,7 +2882,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection(collection)) {
+	if (isAuthCollection$1(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -2905,7 +2905,7 @@ function getEffectiveSecurityRules(collection) {
 * DDL, which policies are injected and how to take them off.
 */
 function getInjectedSecurityRules(collection) {
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [...tenantRule(collection), ...isAuthCollection(collection) ? [adminWriteGate(getTableName(collection))] : []];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [...tenantRule(collection), ...isAuthCollection$1(collection) ? [adminWriteGate(getTableName(collection))] : []];
 	const explicitCount = (collection.securityRules ?? []).length;
 	return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
@@ -3780,6 +3780,165 @@ function firstSqlRow(result) {
 	return sqlRows(result)[0];
 }
 //#endregion
+//#region src/collections/default-collections.ts
+/**
+* Default users collection.
+*
+* Prepended to the developer's collections array by the admin and server.
+* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
+* override by defining their own collection with `slug: "users"`.
+*
+* Schema only — no `admin` block. This package is on the backend's dependency path,
+* where that field does not exist: `@rebasepro/cms-types` adds it by declaration
+* merging, and a BaaS install never installs that. The scaffolded
+* `config/collections/users.ts` carries the presentation for projects that want this
+* collection in their panel, which is also where it is editable.
+*/
+var defaultUsersCollection = defineCollection({
+	name: "Users",
+	singularName: "User",
+	slug: "users",
+	auth: true,
+	table: "users",
+	schema: "rebase",
+	securityRules: [{
+		operation: "select",
+		roles: ["admin"]
+	}, {
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		roles: ["admin"]
+	}],
+	properties: {
+		id: {
+			name: "ID",
+			type: "string",
+			isId: "uuid"
+		},
+		email: {
+			name: "Email",
+			type: "string",
+			validation: {
+				required: true,
+				unique: true
+			}
+		},
+		displayName: {
+			name: "Name",
+			type: "string",
+			columnName: "display_name",
+			validation: { required: true }
+		},
+		photoURL: {
+			name: "Photo URL",
+			type: "string",
+			columnName: "photo_url"
+		},
+		roles: {
+			name: "Roles",
+			type: "array",
+			columnType: "text[]",
+			of: {
+				name: "Role",
+				type: "string",
+				enum: {
+					admin: "Admin",
+					editor: "Editor",
+					viewer: "Viewer"
+				}
+			}
+		},
+		passwordHash: {
+			name: "Password Hash",
+			type: "string",
+			columnName: "password_hash",
+			excludeFromApi: true
+		},
+		emailVerified: {
+			name: "Email Verified",
+			type: "boolean",
+			columnName: "email_verified",
+			defaultValue: false
+		},
+		emailVerificationToken: {
+			name: "Email Verification Token",
+			type: "string",
+			columnName: "email_verification_token",
+			excludeFromApi: true
+		},
+		emailVerificationSentAt: {
+			name: "Email Verification Sent At",
+			type: "date",
+			columnName: "email_verification_sent_at"
+		},
+		metadata: {
+			name: "Metadata",
+			type: "map",
+			keyValue: true,
+			properties: {},
+			defaultValue: {}
+		},
+		createdAt: {
+			name: "Created At",
+			type: "date",
+			columnName: "created_at",
+			autoValue: "on_create"
+		},
+		updatedAt: {
+			name: "Updated At",
+			type: "date",
+			columnName: "updated_at",
+			autoValue: "on_update"
+		}
+	}
+});
+//#endregion
+//#region src/collections/auth-secrets.ts
+/** Is this collection the one the auth subsystem stores users in? */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	if (auth === true) return true;
+	return typeof auth === "object" && auth !== null && "enabled" in auth && auth.enabled === true;
+}
+/**
+* The column names, and property keys, the default users collection marks
+* `excludeFromApi`.
+*
+* Both spellings, because a redeclaration is free to rename the property: one
+* project's copy says `password_hash` where the default says `passwordHash`, and
+* the column is the same either way. Read off {@link defaultUsersCollection}, so
+* a secret added there is covered on the same commit.
+*/
+function defaultSecretNames() {
+	const properties = defaultUsersCollection.properties;
+	const names = /* @__PURE__ */ new Set();
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		names.add(key);
+		if (property.columnName) names.add(property.columnName);
+	}
+	return names;
+}
+/**
+* The keys of the properties on `collection` that hold an auth secret and do not
+* carry `excludeFromApi`. Empty for any collection that is not the user store: a
+* `password_hash` column elsewhere — a CRM importing hashes, say — is that
+* project's data, not this rule's business.
+*/
+function authSecretsMissingExclusion(collection) {
+	if (!collection.properties || !isAuthCollection(collection)) return [];
+	const secrets = defaultSecretNames();
+	const missing = [];
+	for (const [key, property] of Object.entries(collection.properties)) {
+		if (!property || property.excludeFromApi) continue;
+		if (secrets.has(key) || secrets.has(property.columnName ?? key)) missing.push(key);
+	}
+	return missing;
+}
+//#endregion
 //#region src/data/resolveDataSource.ts
 /**
 * Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -3986,7 +4145,9 @@ var CollectionRegistry = class {
 			if (!result.dataSource) result.dataSource = resolved.key;
 			if (!result.engine) result.engine = resolved.engine;
 		}
-		result.properties = this.normalizeProperties(result.properties, result);
+		const properties = this.normalizeProperties(result.properties, result);
+		result.properties = properties;
+		for (const key of authSecretsMissingExclusion(result)) properties[key].excludeFromApi = true;
 		return result;
 	}
 	normalizeProperties(properties, collection) {
@@ -4104,121 +4265,36 @@ var CollectionRegistry = class {
 	}
 };
 //#endregion
-//#region src/collections/default-collections.ts
+//#region src/collections/engine-support.ts
 /**
-* Default users collection.
+* Refuse a `beforeQuery` hook on a collection Postgres does not serve.
 *
-* Prepended to the developer's collections array by the admin and server.
-* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
-* override by defining their own collection with `slug: "users"`.
+* `beforeQuery` narrows a read *before it is compiled*, which means compiling
+* a declarative filter into the query the engine is about to run. Only
+* `@rebasepro/server-postgres` does that today. On any other engine the hook
+* would look configured and do nothing — and for a hook whose whole purpose is
+* to restrict which rows come back, "nothing" means every row served to
+* everybody.
 *
-* Schema only — no `admin` block. This package is on the backend's dependency path,
-* where that field does not exist: `@rebasepro/cms-types` adds it by declaration
-* merging, and a BaaS install never installs that. The scaffolded
-* `config/collections/users.ts` carries the presentation for projects that want this
-* collection in their panel, which is also where it is editable.
+* So it is a boot failure, named. The alternative — declaring the hook only on
+* `PostgresCollectionConfig`, the way `search` is — is not available:
+* `callbacks` is one engine-agnostic type shared by every collection, and
+* splitting it would fork `afterRead` and the five write hooks along with it.
+*
+* Lives here rather than in either driver because both have to run it: the
+* Postgres schema planner sees every collection in a mixed app, and a
+* Mongo-only app never boots a Postgres planner at all.
+*
+* Called with *every* collection, before an engine filters any out.
 */
-var defaultUsersCollection = defineCollection({
-	name: "Users",
-	singularName: "User",
-	slug: "users",
-	auth: true,
-	table: "users",
-	schema: "rebase",
-	securityRules: [{
-		operation: "select",
-		roles: ["admin"]
-	}, {
-		operations: [
-			"insert",
-			"update",
-			"delete"
-		],
-		roles: ["admin"]
-	}],
-	properties: {
-		id: {
-			name: "ID",
-			type: "string",
-			isId: "uuid"
-		},
-		email: {
-			name: "Email",
-			type: "string",
-			validation: {
-				required: true,
-				unique: true
-			}
-		},
-		displayName: {
-			name: "Name",
-			type: "string",
-			columnName: "display_name",
-			validation: { required: true }
-		},
-		photoURL: {
-			name: "Photo URL",
-			type: "string",
-			columnName: "photo_url"
-		},
-		roles: {
-			name: "Roles",
-			type: "array",
-			columnType: "text[]",
-			of: {
-				name: "Role",
-				type: "string",
-				enum: {
-					admin: "Admin",
-					editor: "Editor",
-					viewer: "Viewer"
-				}
-			}
-		},
-		passwordHash: {
-			name: "Password Hash",
-			type: "string",
-			columnName: "password_hash",
-			excludeFromApi: true
-		},
-		emailVerified: {
-			name: "Email Verified",
-			type: "boolean",
-			columnName: "email_verified",
-			defaultValue: false
-		},
-		emailVerificationToken: {
-			name: "Email Verification Token",
-			type: "string",
-			columnName: "email_verification_token",
-			excludeFromApi: true
-		},
-		emailVerificationSentAt: {
-			name: "Email Verification Sent At",
-			type: "date",
-			columnName: "email_verification_sent_at"
-		},
-		metadata: {
-			name: "Metadata",
-			type: "map",
-			keyValue: true,
-			properties: {},
-			defaultValue: {}
-		},
-		createdAt: {
-			name: "Created At",
-			type: "date",
-			columnName: "created_at",
-			autoValue: "on_create"
-		},
-		updatedAt: {
-			name: "Updated At",
-			type: "date",
-			columnName: "updated_at",
-			autoValue: "on_update"
-		}
+var assertBeforeQueryIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.callbacks?.beforeQuery) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new Error(`${collection.slug}.callbacks.beforeQuery: narrowing a read before it is compiled is a Postgres feature, and this collection is served by \`${engine}\`. Remove the hook — it would otherwise look configured while every read kept returning every row the engine allows. Redaction that works on every engine is \`afterRead\`.`);
 	}
-});
+};
 //#endregion
 //#region src/collections/field-access.ts
 /**
@@ -6950,6 +7026,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, firstSqlRow, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionConfigForRelation, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, requireCallbackClient, requireCallbackCollection, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlRows, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, assertBeforeQueryIsPostgresOnly, authSecretsMissingExclusion, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, firstSqlRow, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionConfigForRelation, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, requireCallbackClient, requireCallbackCollection, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlRows, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map