@rebasepro/common 0.22.0 → 0.23.0

package/dist/util/policy/index.d.ts

@@ -2,3 +2,4 @@ export * from "./securityRuleToConditions.js";
 export * from "./sqlToPolicy.js";
 export * from "./policyToPostgres.js";
 export * from "./evaluatePolicy.js";
+export * from "./policyToSecurityRule.js";

package/dist/util/policy/policyToSecurityRule.d.ts

@@ -0,0 +1,27 @@
+import type { PostgresPolicy, SecurityRule } from "@rebasepro/types";
+/**
+ * The rule a Postgres policy compiles back from — a `pg_policies` row, or what
+ * a policy editor produced in that shape.
+ *
+ * One definition for every place that turns a policy into a rule: Studio's RLS
+ * editor ("Save" and "Import to codebase"), the collection editor's RLS tab
+ * ("Import to codebase") and "Import from table"
+ * (`buildCollectionFromTableMetadata`). The rule is what `db push` compiles back
+ * into the database, so anything this gets wrong is a policy that changes on
+ * the way back:
+ *
+ * - The `TO` list names *database* roles, which is `pgRoles`. `roles` holds
+ *   *application* roles and compiles to a `rebase.roles()` check: filed there,
+ *   `TO public` is a check no user passes, and on a restrictive policy — which
+ *   compiles to `NOT (roles) OR condition` — a gate every user passes.
+ *   `pgRoles` is omitted at the `public` default, so a rule that targets every
+ *   connection, nearly all of them, carries no advanced field it does not need.
+ * - The WITH CHECK is kept whether or not there is a USING beside it. Every
+ *   INSERT policy has only a check, and a rule with neither clause compiles to
+ *   `WITH CHECK (false)`, which stops every insert.
+ * - `mode` is written when the policy states one: a restrictive policy read
+ *   back as permissive is OR'd with every grant beside it.
+ * - Retired RLS helpers (`auth.uid()`) are respelled, as `sqlToPolicy` does
+ *   for what it reads, because this rule is written into the project's config.
+ */
+export declare function policyToSecurityRule(policy: Partial<PostgresPolicy>): SecurityRule;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rebasepro/common",
-  "version": "0.22.0",
+  "version": "0.23.0",
   "description": "Rebase shared core — collection registry, data driver adapter and fluent query builder. No React dependency.",
   "keywords": [
     "rebase",
@@ -44,8 +44,8 @@
   "dependencies": {
     "fast-equals": "6.0.2",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/utils": "0.22.0",
-    "@rebasepro/types": "0.22.0"
+    "@rebasepro/types": "0.23.0",
+    "@rebasepro/utils": "0.23.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",

package/dist/util/callback-errors.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/util/internal-tables.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/util/permissions.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/util/table-name.test.d.ts

@@ -1 +0,0 @@
-export {};