@rebasepro/common 0.9.1-canary.ad25bc0 → 0.9.1-canary.b10dcdf

package/dist/index.es.js

@@ -1,5 +1,5 @@
 import { ALL_WHERE_FILTER_OPS, ANONYMOUS_USER_ID, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, isPostgresCollectionConfig, policy, toCanonicalOp } from "@rebasepro/types";
-import { deepClone, generateForeignKeyName, getIn, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
+import { deepClone, generateForeignKeyName, getIn, getPolicyOperations, isDefaultFieldConfigId, mergeDeep, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
 //#region src/util/common.ts
@@ -300,12 +300,17 @@ function parseIdValues(idValue, primaryKeys) {
 /**
 * The primary keys of a collection, as declared by its properties.
 *
-* The driver can also infer keys from the Drizzle schema, which the browser
-* cannot see — so the server normalizes what it resolved onto the config it
-* serves (see `stampPrimaryKeys`), and this reads that back. Returns an empty
-* array when a collection declares none, which callers must treat as "not
-* addressable" rather than defaulting to `id`: guessing a key that is not the
-* real one produces confidently wrong addresses.
+* This is the only tier both sides can read, because it is the only one written
+* in the config: the postgres driver can also infer keys from the Drizzle
+* schema, which the browser never sees and is never sent — the admin compiles
+* the collection files into its own bundle rather than being served them. A key
+* that lives only in the Drizzle schema is therefore invisible here, and the
+* server says so at boot (`warnOnKeysTheAdminCannotResolve`) naming the `isId`
+* to add.
+*
+* Returns an empty array when a collection declares none, which callers must
+* treat as "not addressable" rather than defaulting to `id`: guessing a key
+* that is not the real one produces confidently wrong addresses.
 */
 function getDeclaredPrimaryKeys(collection) {
 	const properties = collection.properties;
@@ -330,9 +335,15 @@ function getDeclaredPrimaryKeys(collection) {
 * The postgres driver tries, in order: properties marked `isId`; the primary
 * keys of the Drizzle schema; and finally a column literally named `id`. Only
 * the first and last are visible in a `CollectionConfig`, which is what both
-* sides share — so a collection whose key is *only* known to Drizzle, and is
-* not named `id`, resolves to nothing here. That is reported rather than
-* guessed: inventing a key produces addresses that look right and route wrong.
+* sides share.
+*
+* So the two agree except on a collection that declares no `isId` and whose key
+* is known only to Drizzle. There, the driver reads the real key, and this
+* either resolves nothing (reported to the console by the caller) or — if the
+* table happens to have an unrelated `id` property — resolves `id`, which is
+* the wrong key and cannot be detected from here: the addresses look right and
+* route wrong. Only the config can settle it, so the server names both cases
+* at boot (`warnOnKeysTheAdminCannotResolve`) with the `isId` to add.
 */
 function resolvePrimaryKeys(collection) {
 	const declared = getDeclaredPrimaryKeys(collection);
@@ -1791,7 +1802,7 @@ var buildPropertyCallbacks = (properties) => {
 * Opt out with `disableDefaultPolicies: true` to take full responsibility for
 * the collection's RLS.
 */
-var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 /** Write operations that must be admin-gated by default on auth collections. */
 var DEFAULT_GUARDED_OPS = [
 	"insert",
@@ -1804,7 +1815,7 @@ function isAuthCollection(collection) {
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
 /** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection) {
+function getIdPropertyName$1(collection) {
 	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
 	return "id";
 }
@@ -1824,26 +1835,26 @@ function getEffectiveSecurityRules(collection) {
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
-		condition: SERVER_OR_ADMIN_EXPR
+		condition: SERVER_OR_ADMIN_EXPR$1
 	});
 	injected.push({
 		name: `${tableName}_default_admin_write`,
 		operations: [...DEFAULT_GUARDED_OPS],
-		condition: SERVER_OR_ADMIN_EXPR,
-		check: SERVER_OR_ADMIN_EXPR
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
 	});
 	if (isAuthCollection(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
-			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
 		});
 		injected.push({
 			name: `${tableName}_require_admin_write`,
 			mode: "restrictive",
 			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR,
-			check: SERVER_OR_ADMIN_EXPR
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
 		});
 	}
 	return [...explicit, ...injected];
@@ -1865,6 +1876,208 @@ function getInjectedSecurityRules(collection) {
 	return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
 //#endregion
+//#region src/util/junction-policies.ts
+var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* Walk every collection's resolved relations and aggregate the junction tables
+* they declare. Two collections may declare the same junction from opposite
+* sides (posts→tags and tags→posts through `posts_tags`); both become
+* `declaringSides` of one spec, so derived write grants consider both.
+*/
+function resolveJunctionSpecs(collections) {
+	const specs = /* @__PURE__ */ new Map();
+	for (const collection of collections) {
+		const resolved = resolveCollectionRelations(collection);
+		for (const relation of Object.values(resolved)) {
+			if (!relation.through) continue;
+			const targetCollection = typeof relation.target === "function" ? relation.target() : void 0;
+			if (!targetCollection) continue;
+			const rawName = relation.through.table;
+			const table = rawName.includes(".") ? rawName.split(".").pop() : rawName;
+			const schema = "public";
+			const source = {
+				collection,
+				junctionColumn: relation.through.sourceColumn,
+				relation
+			};
+			const target = {
+				collection: targetCollection,
+				junctionColumn: relation.through.targetColumn
+			};
+			const existing = specs.get(table);
+			if (!existing) specs.set(table, {
+				table,
+				schema,
+				endpoints: [source, target],
+				declaringSides: [source]
+			});
+			else if (!existing.declaringSides.some((s) => s.collection === collection)) existing.declaringSides.push(source);
+		}
+	}
+	return specs;
+}
+/**
+* A synthetic CollectionConfig standing in for the junction during policy
+* compilation and naming. Its two FK columns carry explicit `columnName`s so
+* `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+* whatever their casing.
+*/
+function getJunctionCollectionConfig(spec) {
+	const properties = {};
+	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+		type: "string",
+		columnName: endpoint.junctionColumn
+	};
+	return {
+		slug: spec.table,
+		name: spec.table,
+		table: spec.table,
+		schema: spec.schema,
+		properties
+	};
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint, extra) {
+	const correlation = policy.compare(policy.field(getIdPropertyName(endpoint.collection)), "eq", policy.outerField(endpoint.junctionColumn));
+	return policy.existsIn({
+		collection: endpoint.collection.slug,
+		where: extra ? policy.and(correlation, extra) : correlation
+	});
+}
+/**
+* Whether a parent-rule expression keeps its meaning when moved inside the
+* junction's `EXISTS` subquery — and the re-scoped copy if it does.
+*
+* Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+* anywhere (its `{column}` placeholders would bind to the junction), or an
+* `outerField` inside a nested `existsIn` (it would bind to the junction while
+* the author meant the parent, and no operand can express "the middle scope").
+* Top-level `outerField`s are rewritten to `field`, which is what they meant.
+*/
+function embedParentExpression(expr, depth = 0) {
+	switch (expr.kind) {
+		case "raw": return null;
+		case "and":
+		case "or": {
+			const parts = [];
+			for (const child of expr.operands) {
+				const embedded = embedParentExpression(child, depth);
+				if (!embedded) return null;
+				parts.push(embedded);
+			}
+			return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+		}
+		case "not": {
+			const embedded = embedParentExpression(expr.operand, depth);
+			return embedded ? policy.not(embedded) : null;
+		}
+		case "existsIn": {
+			const where = embedParentExpression(expr.where, depth + 1);
+			return where ? policy.existsIn({
+				collection: expr.collection,
+				where
+			}) : null;
+		}
+		case "compare": {
+			const left = embedOperand(expr.left, depth);
+			const right = embedOperand(expr.right, depth);
+			if (!left || !right) return null;
+			return {
+				...expr,
+				left,
+				right
+			};
+		}
+		default: return expr;
+	}
+}
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand, depth) {
+	if (operand.kind === "outerField") {
+		if (depth === 0) return policy.field(operand.name);
+		return null;
+	}
+	return operand;
+}
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule) {
+	return getPolicyOperations(rule).some((op) => op === "update" || op === "all");
+}
+/**
+* The full derived policy set for a junction table: the locked server/admin
+* baseline, the endpoint-visibility read grant, inherited write grants, and
+* inherited restrictive gates. Returns `[]` when every declaring collection set
+* `disableDefaultPolicies` — the junction is then the author's to police, and
+* stays locked (RLS is still enabled) until they write policies for it.
+*/
+function getJunctionSecurityRules(spec) {
+	if (spec.declaringSides.every((side) => side.collection.disableDefaultPolicies)) return [];
+	const rules = [];
+	rules.push({
+		name: `${spec.table}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_admin_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: SERVER_OR_ADMIN_EXPR,
+		check: SERVER_OR_ADMIN_EXPR
+	});
+	rules.push({
+		name: `${spec.table}_default_edge_read`,
+		operations: ["select"],
+		condition: policy.and(existsEndpoint(spec.endpoints[0]), existsEndpoint(spec.endpoints[1]))
+	});
+	const writeGrants = [];
+	for (const side of spec.declaringSides) {
+		const updateRules = ((isPostgresCollectionConfig(side.collection) ? side.collection.securityRules : void 0) ?? []).filter(coversUpdate);
+		const permissive = updateRules.filter((r) => r.mode !== "restrictive");
+		const restrictive = updateRules.filter((r) => r.mode === "restrictive");
+		const embeddedGates = [];
+		let gatesEmbeddable = true;
+		for (const gate of restrictive) {
+			const using = securityRuleToConditions(gate).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (!embedded) {
+				gatesEmbeddable = false;
+				break;
+			}
+			embeddedGates.push(embedded);
+		}
+		if (!gatesEmbeddable) continue;
+		const grants = [];
+		for (const rule of permissive) {
+			const using = securityRuleToConditions(rule).usingExpr;
+			const embedded = using ? embedParentExpression(using) : null;
+			if (embedded) grants.push(embedded);
+		}
+		if (grants.length === 0) continue;
+		const condition = embeddedGates.length > 0 ? policy.and(policy.or(...grants), ...embeddedGates) : policy.or(...grants);
+		writeGrants.push(existsEndpoint(side, condition));
+	}
+	if (writeGrants.length > 0) rules.push({
+		name: `${spec.table}_default_edge_write`,
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+		check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+	});
+	return rules;
+}
+//#endregion
 //#region src/util/conditions.ts
 /**
 * Access a nested property from an object via dot notation.
@@ -3012,7 +3225,7 @@ function createPrimaryKeyResolver(options) {
 		}
 		if (!warned.has(slug)) {
 			warned.add(slug);
-			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config.`);
+			console.warn(`[rebase] Collection '${slug}' declares no primary key, so its rows have no address: detail links, caching and relations will not work for it. Mark the key property with \`isId\` in its collection config — the server logs which column to mark at boot, if its schema knows the key.`);
 		}
 		return keys;
 	};
@@ -3610,6 +3823,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildCollection, buildCompositeId, buildConditionContext, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, enumToObjectEntries, evaluateCondition, evaluatePolicy, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityImagePreviewPropertyKey, getEnumVarName, getInjectedSecurityRules, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, parseIdValues, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveFilterOperators, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, sqlToPolicy, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, addInitialSlash, and, applyPropertyConditions, buildCollection, buildCompositeId, buildConditionContext, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, cond, createDataSourceRegistry, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getCollectionBySlugWithin, getCollectionPathsCombinations, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityImagePreviewPropertyKey, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getLastSegment, getLocalChangesBackup, getNavigationEntriesFromPath, getParentReferencesFromPath, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isHidden, isPropertyBuilder, isReadOnly, isRebaseInternalTable, normalizeToEntityRelation, or, parseIdValues, policyToPostgres, registerConditionOperations, removeInitialAndTrailingSlashes, removeInitialSlash, removeTrailingSlash, resolveArrayProperties, resolveCollectionPathIds, resolveCollectionRelations, resolveDataSource, resolveDefaultSelectedView, resolveEnumValues, resolveFilterOperators, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolvePropertyRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, sanitizeRelation, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, sqlToPolicy, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map