@rebasepro/common 0.7.0 → 0.8.0

package/src/util/permissions.ts

@@ -1,4 +1,6 @@
-import { CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+import { Entity, EntityCollection, getDataSourceCapabilities, SecurityOperation, SecurityRule, User } from "@rebasepro/types";
+import { securityRuleToConditions } from "./policy/securityRuleToConditions";
+import { evaluatePolicy, PolicyEvalContext, TriState } from "./policy/evaluatePolicy";
 
 /**
  * Minimal auth context for permission checking.
@@ -9,195 +11,120 @@ export interface AuthContext<USER extends User = User> {
     user: USER | null;
 }
 
-function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
-    // This is a client-side SQL evaluator used *only* for optimistic UI updates.
-    // It parses basic AND / OR statements to evaluate RLS without backend roundtrips.
-    if (!entity) return true;
-
-    // 1. Clean outer parentheses
-    let cleanedSQL = sqlString.trim();
-    while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-        let openCount = 0;
-        let isEnclosing = true;
-        for (let i = 0; i < cleanedSQL.length - 1; i++) {
-            if (cleanedSQL[i] === "(") openCount++;
-            else if (cleanedSQL[i] === ")") openCount--;
-            if (openCount === 0) {
-                isEnclosing = false;
-                break;
-            }
-        }
-        if (isEnclosing) {
-            cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-        } else {
-            break;
-        }
-    }
-
-    // 2. Split top-level OR / AND
-    const splitByTopLevel = (str: string, delimiter: string) => {
-        const parts: string[] = [];
-        let current = "";
-        let openCount = 0;
-        let i = 0;
-        while (i < str.length) {
-            if (str[i] === "(") openCount++;
-            else if (str[i] === ")") openCount--;
-
-            if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-                parts.push(current);
-                current = "";
-                i += delimiter.length;
-            } else {
-                current += str[i];
-                i++;
-            }
-        }
-        parts.push(current);
-        return parts;
-    };
-
-    const orParts = splitByTopLevel(cleanedSQL, " OR ");
-    if (orParts.length > 1) {
-        return orParts.some(part => evaluateAST(part, auth, entity));
-    }
-
-    const andParts = splitByTopLevel(cleanedSQL, " AND ");
-    if (andParts.length > 1) {
-        return andParts.every(part => evaluateAST(part, auth, entity));
-    }
-
-    const upperSQL = cleanedSQL.toUpperCase();
-
-    // 3. Fallback for unparseable complex queries
-    if (upperSQL.includes(" IN ") || upperSQL.includes(" EXISTS ")) {
-        return true;
-    }
-
-    // 4. Role array checks
-    // Pattern: `string_to_array(auth.roles(), ',') && ARRAY['admin', 'editor']`
-    const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-    if (roleIntersectMatch && roleIntersectMatch[1]) {
-        const requiredRoles = roleIntersectMatch[1].split(",").map(r => r.trim().replace(/'/g, ""));
-        const userRoles = auth.user?.roles || [];
-        return requiredRoles.some(r => userRoles.includes(r));
-    }
-
-    // Pattern: `string_to_array(auth.roles(), ',') @> ARRAY['admin']`
-    const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-    if (roleContainMatch && roleContainMatch[1]) {
-        const requiredRoles = roleContainMatch[1].split(",").map(r => r.trim().replace(/'/g, ""));
-        const userRoles = auth.user?.roles || [];
-        return requiredRoles.every(r => userRoles.includes(r));
-    }
-
-    // 5. Existing ID patterns
-    const pattern1 = new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-    const pattern2 = new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-
-    const match1 = cleanedSQL.match(pattern1);
-    if (match1 && match1[1]) {
-        return entity.values[match1[1]] === auth.user?.uid;
-    }
+/**
+ * How to resolve a policy result that cannot be decided client-side (a raw-SQL
+ * escape-hatch rule, or a row-column reference with no row in hand).
+ *
+ * - `"allow"` (default): optimistic — used for admin-UI gating, where Postgres
+ *   remains the authoritative gate and hiding a working action is worse than
+ *   showing one the server may reject.
+ * - `"deny"`: fail-closed — used by real enforcement callers (e.g. a driver
+ *   applying policies in-process), so an undecidable rule never silently allows.
+ */
+export type UnknownResolution = "allow" | "deny";
 
-    const match2 = cleanedSQL.match(pattern2);
-    if (match2 && match2[1]) {
-        return entity.values[match2[1]] === auth.user?.uid;
-    }
+export interface CheckOperationOptions {
+    onUnknown?: UnknownResolution;
+}
 
-    // 6. Simple equality
-    // Pattern: `field = 'value'` or `{field} != 'value'`
-    const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-    if (simpleEqualityMatch) {
-        const field = simpleEqualityMatch[1];
-        const operator = simpleEqualityMatch[2];
-        const value = simpleEqualityMatch[3];
-        const entityValue = entity.values[field];
-        if (operator === "=") return entityValue === value;
-        if (operator === "!=") return entityValue !== value;
-    }
+/** Combine clause results with AND under three-valued (Kleene) logic. */
+function kleeneAnd(values: TriState[]): TriState {
+    if (values.some(v => v === false)) return false;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return true;
+}
 
-    return true; // Optimistic fallback for anything else
+/** The operations a rule covers, mirroring the Postgres generator's resolution. */
+function ruleOperations(rule: SecurityRule): SecurityOperation[] {
+    return rule.operations && rule.operations.length > 0
+        ? rule.operations
+        : [rule.operation ?? "all"];
 }
 
-function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
+function ruleApplies(rule: SecurityRule, targetOperation: SecurityOperation): boolean {
+    const ops = ruleOperations(rule);
+    return ops.includes(targetOperation) || ops.includes("all");
+}
 
-    if (rule.access === "public") return true;
+/**
+ * Evaluate a single rule for one operation, returning a tri-state.
+ *
+ * A `null` clause (the rule contributes no condition for a required clause)
+ * denies — matching Postgres, which emits `USING (false)` / `WITH CHECK (false)`
+ * in that case. USING applies to SELECT/UPDATE/DELETE; WITH CHECK to
+ * INSERT/UPDATE; both must pass for UPDATE.
+ */
+function evaluateRuleForOperation(rule: SecurityRule, ctx: PolicyEvalContext, targetOperation: SecurityOperation): TriState {
+    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+    const clause = (expr: typeof usingExpr): TriState => expr === null ? false : evaluatePolicy(expr, ctx);
 
-    if (rule.ownerField) {
-        if (!entity) {
-            // null entity: optimistic — we can't evaluate ownership without data
-            // Fall through to SQL checks below (if any). If none, will return true.
-        } else {
-            // Entity present: strictly check ownership. Fail immediately if mismatch.
-            if (entity.values[rule.ownerField] !== auth.user?.uid) return false;
-        }
-    }
+    const needsUsing = targetOperation !== "insert";
+    const needsWithCheck = targetOperation === "insert" || targetOperation === "update";
 
-    // In PostgreSQL RLS, USING and WITH CHECK have distinct semantics:
-    // USING applies to existing rows (SELECT/UPDATE/DELETE read phase)
-    // WITH CHECK applies to new/modified values (INSERT/UPDATE write phase)
-    // Both must pass. We evaluate both independently.
-    if (rule.using && !evaluateAST(rule.using, auth, entity)) return false;
-    if (rule.withCheck && !evaluateAST(rule.withCheck, auth, entity)) return false;
+    const results: TriState[] = [];
+    if (needsUsing) results.push(clause(usingExpr));
+    if (needsWithCheck) results.push(clause(withCheckExpr));
+    return kleeneAnd(results);
+}
 
-    return true;
+function resolveTriState(value: TriState, onUnknown: UnknownResolution): boolean {
+    if (value === "unknown") return onUnknown === "allow";
+    return value;
 }
 
+/**
+ * Decide whether an operation is permitted for a user on a (possibly null) row,
+ * by evaluating the collection's security rules with the shared policy model —
+ * the same model compiled to Postgres RLS DDL, so the decision matches database
+ * enforcement for every non-raw rule.
+ *
+ * @param options.onUnknown how to treat rules that cannot be decided
+ *   client-side (raw SQL, or row predicates with no row). Defaults to `"allow"`
+ *   for optimistic UI gating; enforcement callers should pass `"deny"`.
+ */
 export function checkOperation<M extends Record<string, unknown>, USER extends User>(
     collection: EntityCollection<M>,
     authContext: AuthContext<USER>,
     entity: Entity<M> | null,
-    targetOperation: "select" | "insert" | "update" | "delete"
+    targetOperation: SecurityOperation,
+    options?: CheckOperationOptions
 ): boolean {
-    const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? (collection as CollectionWithRelations).securityRules : undefined;
+    const onUnknown = options?.onUnknown ?? "allow";
+    const securityRules = getDataSourceCapabilities(collection.engine).supportsRLS ? collection.securityRules : undefined;
     if (!securityRules || securityRules.length === 0) {
         return true;
     }
 
-    const applicableRules = securityRules.filter((r: SecurityRule) =>
-        r.operation === targetOperation ||
-        r.operation === "all" ||
-        r.operations?.includes(targetOperation) ||
-        r.operations?.includes("all")
-    );
-
+    const applicableRules = securityRules.filter((r: SecurityRule) => ruleApplies(r, targetOperation));
     if (applicableRules.length === 0) return false;
 
-    const userRoleIds = authContext.user?.roles ?? [];
-    const userRoles = [...userRoleIds, "public"];
-    const roleApplicableRules = applicableRules.filter((rule: SecurityRule) => {
-        if (!rule.roles || rule.roles.length === 0) return true;
-        return rule.roles.some((r: string) => userRoles.includes(r));
-    });
-
-    if (roleApplicableRules.length === 0) return false;
+    const ctx: PolicyEvalContext = {
+        uid: authContext.user?.uid,
+        roles: authContext.user?.roles ?? [],
+        entity
+    };
 
     let grantedByPermissive = false;
     let deniedByRestrictive = false;
+    let hasPermissive = false;
 
-    for (const rule of roleApplicableRules) {
+    for (const rule of applicableRules) {
         const mode = rule.mode || "permissive";
-        const passed = evaluateRule(rule, authContext, entity);
+        const passed = resolveTriState(evaluateRuleForOperation(rule, ctx, targetOperation), onUnknown);
 
-        if (mode === "restrictive" && !passed) {
-            deniedByRestrictive = true;
-            break;
-        }
-
-        if (mode === "permissive" && passed) {
-            grantedByPermissive = true;
+        if (mode === "restrictive") {
+            if (!passed) {
+                deniedByRestrictive = true;
+                break;
+            }
+        } else {
+            hasPermissive = true;
+            if (passed) grantedByPermissive = true;
         }
     }
 
     if (deniedByRestrictive) return false;
-
-    const hasPermissive = roleApplicableRules.some((r: SecurityRule) => (r.mode || "permissive") === "permissive");
-    if (hasPermissive) {
-        return grantedByPermissive;
-    } else {
-        return false;
-    }
+    return hasPermissive ? grantedByPermissive : false;
 }
 
 export function canReadCollection<M extends Record<string, unknown>, USER extends User>

package/src/util/policy/evaluatePolicy.ts

@@ -0,0 +1,146 @@
+import { Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
+
+/**
+ * Result of evaluating a policy client-side. `"unknown"` means the expression
+ * could not be decided without more information — either a raw-SQL escape-hatch
+ * node (which the client deliberately never guesses) or a row-column reference
+ * with no entity in hand (e.g. list-level gating). Callers decide how to resolve
+ * `"unknown"`: fail-closed for an enforcement decision, optimistic for pure
+ * visibility gating.
+ */
+export type TriState = boolean | "unknown";
+
+/**
+ * Context for {@link evaluatePolicy}: the acting user (or none) and the row
+ * being evaluated (or none, for collection-level gating).
+ */
+export interface PolicyEvalContext {
+    /** The current user's id, or null/undefined when unauthenticated. */
+    uid?: string | null;
+    /** The current user's application roles. */
+    roles?: string[];
+    /** The row being evaluated, or null when no specific row is available. */
+    entity: Entity | null;
+}
+
+/**
+ * Evaluates a {@link PolicyExpression} against a user + row, using three-valued
+ * (Kleene) logic so that `"unknown"` sub-results propagate soundly.
+ *
+ * This is the JavaScript twin of {@link policyToPostgres}: both derive from the
+ * same expression, so the admin UI matches database enforcement by construction
+ * for every non-raw rule.
+ */
+export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext): TriState {
+    switch (expr.kind) {
+        case "true":
+            return true;
+        case "false":
+            return false;
+        case "and":
+            return kleeneAnd(expr.operands.map(o => evaluatePolicy(o, ctx)));
+        case "or":
+            return kleeneOr(expr.operands.map(o => evaluatePolicy(o, ctx)));
+        case "not":
+            return kleeneNot(evaluatePolicy(expr.operand, ctx));
+        case "compare":
+            return evaluateCompare(expr.op, expr.left, expr.right, ctx);
+        case "rolesOverlap": {
+            const userRoles = ctx.roles ?? [];
+            return expr.roles.some(r => r === "public" || userRoles.includes(r));
+        }
+        case "rolesContain": {
+            const userRoles = ctx.roles ?? [];
+            return expr.roles.every(r => r === "public" || userRoles.includes(r));
+        }
+        case "authenticated":
+            return ctx.uid != null;
+        case "raw":
+            // Arbitrary SQL cannot be evaluated client-side — never guess.
+            return "unknown";
+    }
+}
+
+// ── Three-valued logic ───────────────────────────────────────────────
+
+function kleeneAnd(values: TriState[]): TriState {
+    if (values.some(v => v === false)) return false;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return true;
+}
+
+function kleeneOr(values: TriState[]): TriState {
+    if (values.some(v => v === true)) return true;
+    if (values.some(v => v === "unknown")) return "unknown";
+    return false;
+}
+
+function kleeneNot(value: TriState): TriState {
+    if (value === "unknown") return "unknown";
+    return !value;
+}
+
+// ── Comparison ───────────────────────────────────────────────────────
+
+type ResolvedOperand = { known: false } | { known: true; value: unknown };
+
+function resolveOperand(operand: PolicyOperand, ctx: PolicyEvalContext): ResolvedOperand {
+    switch (operand.kind) {
+        case "literal":
+            return { known: true, value: operand.value };
+        case "authUid":
+            return { known: true, value: ctx.uid ?? null };
+        case "authRoles":
+            return { known: true, value: ctx.roles ?? [] };
+        case "field":
+            // Can't resolve a row column without the row.
+            if (!ctx.entity) return { known: false };
+            return { known: true, value: ctx.entity.values[operand.name] };
+    }
+}
+
+function evaluateCompare(
+    op: PolicyCompareOperator,
+    left: PolicyOperand,
+    right: PolicyOperand,
+    ctx: PolicyEvalContext
+): TriState {
+    const l = resolveOperand(left, ctx);
+    const r = resolveOperand(right, ctx);
+    if (!l.known || !r.known) return "unknown";
+
+    const a = l.value;
+    const b = r.value;
+
+    if (a === null || b === null) {
+        if (op === "eq") return false;
+        if (op === "neq") return true;
+        return "unknown";
+    }
+
+    if (op === "eq") return a === b;
+    if (op === "neq") return a !== b;
+
+    if (typeof a === "string" && typeof b === "string") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    if (typeof a === "number" && typeof b === "number") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    if (typeof a === "bigint" && typeof b === "bigint") {
+        if (op === "lt") return a < b;
+        if (op === "lte") return a <= b;
+        if (op === "gt") return a > b;
+        if (op === "gte") return a >= b;
+    }
+
+    return "unknown";
+}

package/src/util/policy/index.ts

@@ -0,0 +1,3 @@
+export * from "./securityRuleToConditions";
+export * from "./policyToPostgres";
+export * from "./evaluatePolicy";

package/src/util/policy/policyToPostgres.ts

@@ -0,0 +1,85 @@
+import { EntityCollection, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property } from "@rebasepro/types";
+import { toSnakeCase } from "@rebasepro/utils";
+
+/**
+ * Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
+ * suitable for a `USING (...)` / `WITH CHECK (...)` clause.
+ *
+ * This is one of the two consumers of the shared policy model (the other being
+ * {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
+ * and the admin UI derive from the exact same expression.
+ */
+export function policyToPostgres(expr: PolicyExpression, collection?: EntityCollection): string {
+    switch (expr.kind) {
+        case "true":
+            return "true";
+        case "false":
+            return "false";
+        case "and":
+            return expr.operands.length === 0
+                ? "true"
+                : expr.operands.map(o => `(${policyToPostgres(o, collection)})`).join(" AND ");
+        case "or":
+            return expr.operands.length === 0
+                ? "false"
+                : expr.operands.map(o => `(${policyToPostgres(o, collection)})`).join(" OR ");
+        case "not":
+            // Render the common `auth.uid() IS NULL` (unauthenticated) form directly.
+            if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
+            return `NOT (${policyToPostgres(expr.operand, collection)})`;
+        case "compare":
+            return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+        case "rolesOverlap":
+            return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+        case "rolesContain":
+            return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+        case "authenticated":
+            return "auth.uid() IS NOT NULL";
+        case "raw":
+            // Full-power escape hatch: `{column}` references resolve to the bare
+            // column name (matching the previous raw-SQL behavior).
+            return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+    }
+}
+
+const COMPARE_SQL: Record<PolicyCompareOperator, string> = {
+    eq: "=",
+    neq: "!=",
+    lt: "<",
+    lte: "<=",
+    gt: ">",
+    gte: ">="
+};
+
+function operandToSql(operand: PolicyOperand, collection?: EntityCollection): string {
+    switch (operand.kind) {
+        case "field":
+            return resolveColumnName(operand.name, collection);
+        case "literal":
+            return quoteLiteral(operand.value);
+        case "authUid":
+            return "auth.uid()";
+        case "authRoles":
+            return "string_to_array(auth.roles(), ',')";
+    }
+}
+
+function resolveColumnName(propName: string, collection?: EntityCollection): string {
+    const prop = collection?.properties?.[propName] as Property | undefined;
+    if (prop && "columnName" in prop && typeof (prop as { columnName?: unknown }).columnName === "string") {
+        return (prop as { columnName: string }).columnName;
+    }
+    return toSnakeCase(propName);
+}
+
+function quoteLiteral(value: string | number | boolean | null): string {
+    if (value === null) return "NULL";
+    if (typeof value === "boolean") return value ? "true" : "false";
+    if (typeof value === "number") return String(value);
+    return `'${value.replace(/'/g, "''")}'`;
+}
+
+/** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
+function rolesArraySql(roles: string[]): string {
+    return `ARRAY[${[...roles].sort().map(r => `'${r}'`).join(",")}]`;
+}

package/src/util/policy/securityRuleToConditions.ts

@@ -0,0 +1,67 @@
+import { PolicyExpression, SecurityRule, policy } from "@rebasepro/types";
+import { sqlToPolicy } from "./sqlToPolicy";
+
+/**
+ * The normalized `USING` / `WITH CHECK` conditions for a single security rule,
+ * expressed in the engine-agnostic {@link PolicyExpression} model.
+ *
+ * A `null` clause means "this rule contributes no condition for that clause";
+ * consumers apply the default (Postgres denies with `false`).
+ */
+export interface RuleConditions {
+    usingExpr: PolicyExpression | null;
+    withCheckExpr: PolicyExpression | null;
+}
+
+/**
+ * Desugars a {@link SecurityRule} — its `access`/`ownerField`/`roles` shortcuts,
+ * structured `condition`/`check`, and raw `using`/`withCheck` — into a single
+ * normalized {@link PolicyExpression} pair.
+ *
+ * **This is the linchpin against drift:** both the Postgres DDL generators and
+ * the client-side evaluator consume this one function, so there is exactly one
+ * definition of what a rule means. In particular, application `roles` are folded
+ * into the expression here (AND'd with the base condition, matching how Postgres
+ * generates the clause) rather than being handled separately by each consumer.
+ */
+export function securityRuleToConditions(rule: SecurityRule): RuleConditions {
+    return {
+        usingExpr: withRoles(baseUsing(rule), rule),
+        withCheckExpr: withRoles(baseWithCheck(rule), rule)
+    };
+}
+
+function baseUsing(rule: SecurityRule): PolicyExpression | null {
+    if (rule.condition) return rule.condition;
+    if (rule.using != null) return sqlToPolicy(rule.using);
+    if (rule.access === "public") return policy.true();
+    if (rule.ownerField) return policy.compare(policy.field(rule.ownerField), "eq", policy.authUid());
+    return null;
+}
+
+function baseWithCheck(rule: SecurityRule): PolicyExpression | null {
+    if (rule.check) return rule.check;
+    if (rule.withCheck != null) return sqlToPolicy(rule.withCheck);
+    // No explicit WITH CHECK → fall back to the USING condition, matching
+    // PostgreSQL's own default behavior.
+    return baseUsing(rule);
+}
+
+/**
+ * AND the base condition with an application-role check, or produce a roles-only
+ * condition when there is no base. Mirrors the Postgres generator so that a
+ * role-scoped restrictive rule denies exactly the same set of users on both
+ * sides.
+ */
+function withRoles(base: PolicyExpression | null, rule: SecurityRule): PolicyExpression | null {
+    if (!rule.roles || rule.roles.length === 0) return base;
+    const rolesExpr = policy.rolesOverlap(rule.roles);
+    if (rule.mode === "restrictive") {
+        // Restrictive rule: applies ONLY if user has the roles.
+        // If user DOES NOT have the roles, they are NOT restricted (passes).
+        // If user HAS the roles, they must pass the base condition.
+        // Logical equivalent: NOT(roles) OR base
+        return base ? policy.or(policy.not(rolesExpr), base) : policy.not(rolesExpr);
+    }
+    return base ? policy.and(base, rolesExpr) : rolesExpr;
+}