@rebasepro/studio 0.23.0 → 0.24.0

package/dist/{RLSEditor-Djh43lBE.js → RLSEditor-BlLLV6xs.js}

@@ -5,7 +5,7 @@ import { Alert, AlertTriangleIcon, Button, Chip, CircularProgress, DatabaseIcon,
 import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { RLS_JWT_SQL, RLS_ROLES_SQL, RLS_UID_SQL, isPostgresCollectionConfig, policy } from "@rebasepro/types";
 import { getPolicyNamesForRule, getPolicyNamesForRules, getPolicyOperations } from "@rebasepro/utils";
-import { JUNCTION_TABLES_SQL, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_USER_ROLE, getEffectiveSecurityRules, getJunctionSecurityRules, getTableName, policyToPostgres, policyToSecurityRule, resolveJunctionSpecs } from "@rebasepro/common";
+import { JUNCTION_TABLES_SQL, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_USER_ROLE, compileRulePolicies, getEffectiveSecurityRules, getInjectedSecurityRules, getJunctionSecurityRules, getTableName, policyToPostgres, policyToSecurityRule, resolveJunctionSpecs } from "@rebasepro/common";
 //#region src/components/RLSEditor/policy-presets.ts
 /**
 * What the RLS editor offers before the user types anything: the roles a `TO`
@@ -506,23 +506,20 @@ var PolicyEditor = ({ policy, schema, table, roleOptions, onSave, onCancel }) =>
 										}),
 										/* @__PURE__ */ jsxs("ul", {
 											className: "list-disc pl-5 space-y-1 text-sm text-text-secondary dark:text-text-secondary-dark",
-											children: [
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "public" }),
-													": ",
-													t("studio_policy_help_role_public")
-												] }),
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "authenticated" }),
-													": ",
-													t("studio_policy_help_role_authenticated")
-												] }),
-												/* @__PURE__ */ jsxs("li", { children: [
-													/* @__PURE__ */ jsx("strong", { children: "anon" }),
-													": ",
-													t("studio_policy_help_role_anon")
-												] })
-											]
+											children: [/* @__PURE__ */ jsxs("li", { children: [
+												/* @__PURE__ */ jsx("strong", { children: "public" }),
+												": ",
+												t("studio_policy_help_role_public")
+											] }), /* @__PURE__ */ jsxs("li", { children: [
+												/* @__PURE__ */ jsx("strong", { children: REBASE_USER_ROLE }),
+												": ",
+												t("studio_policy_help_role_rebase_user")
+											] })]
+										}),
+										/* @__PURE__ */ jsx(Typography, {
+											variant: "body2",
+											className: "text-text-secondary dark:text-text-secondary-dark mt-1",
+											children: t("studio_policy_help_roles_not_users")
 										})
 									]
 								}),
@@ -814,7 +811,7 @@ function editedRule(rule, original, edited) {
 		result.operation = next.operation;
 	}
 	if (edited.permissive !== original.permissive) result.mode = next.mode;
-	if (!sameRoles(edited.roles, original.roles)) if (next.pgRoles) result.pgRoles = next.pgRoles;
+	if (!sameRoles$1(edited.roles, original.roles)) if (next.pgRoles) result.pgRoles = next.pgRoles;
 	else delete result.pgRoles;
 	if ((edited.qual || null) !== (original.qual || null) || (edited.with_check || null) !== (original.with_check || null)) {
 		delete result.ownerField;
@@ -828,12 +825,123 @@ function editedRule(rule, original, edited) {
 	}
 	return result;
 }
-function sameRoles(a, b) {
+function sameRoles$1(a, b) {
 	const left = [...a ?? []].sort();
 	const right = [...b ?? []].sort();
 	return left.length === right.length && left.every((role, i) => role === right[i]);
 }
 //#endregion
+//#region src/components/RLSEditor/policyListing.ts
+var COMMANDS = {
+	select: "SELECT",
+	insert: "INSERT",
+	update: "UPDATE",
+	delete: "DELETE",
+	all: "ALL"
+};
+/** A compiled policy, in the shape `pg_policies` describes one. */
+function asPostgresPolicy(compiled, tableName) {
+	return {
+		policyname: compiled.name,
+		tablename: tableName,
+		permissive: compiled.mode === "restrictive" ? "RESTRICTIVE" : "PERMISSIVE",
+		cmd: COMMANDS[compiled.operation],
+		roles: compiled.roles,
+		qual: compiled.using,
+		with_check: compiled.withCheck
+	};
+}
+/**
+* The rule's own clauses, for a rule the compiler could not compile — an
+* `existsIn` naming a collection the registry does not hold, say. Only ever a
+* `code_only` row's content: nothing is compared against it.
+*/
+function uncompiledPolicy(rule, operation, name, tableName) {
+	return {
+		policyname: name,
+		tablename: tableName,
+		permissive: rule.mode === "restrictive" ? "RESTRICTIVE" : "PERMISSIVE",
+		cmd: COMMANDS[operation],
+		roles: [...rule.pgRoles ?? ["public"]],
+		qual: rule.using || null,
+		with_check: rule.withCheck || null
+	};
+}
+function sameRoles(a, b) {
+	const left = [...a].sort();
+	const right = [...b].sort();
+	return left.length === right.length && left.every((role, i) => role === right[i]);
+}
+/**
+* Where a live policy differs from the one the code compiles to.
+*
+* The same comparison `rebase doctor` makes: the `TO` list, the command, the
+* mode, and whether each clause is there at all. Never the clause text —
+* Postgres rewrites an expression when it stores it, so the text of a policy
+* that matches its declaration exactly still differs from the declaration's.
+* A clause that is missing is not a rewrite, though: a `USING` that is gone
+* changes who the policy admits.
+*/
+function policyDrift(declared, live) {
+	const drift = [];
+	if (!sameRoles(declared.roles, live.roles)) drift.push("roles");
+	if (declared.cmd !== live.cmd) drift.push("command");
+	if (declared.permissive !== live.permissive) drift.push("mode");
+	if (declared.qual != null !== (live.qual != null)) drift.push("USING");
+	if (declared.with_check != null !== (live.with_check != null)) drift.push("WITH CHECK");
+	return drift;
+}
+/**
+* The policies of one table: every policy the database has, as the database
+* has it, and every policy the code declares for the table that it does not.
+*
+* A policy in both keeps the database's fields — this list is what Postgres
+* enforces — and carries the declaration beside them, with where the two
+* differ.
+*
+* @param live        The table's `pg_policies` rows.
+* @param collection  The collection the table belongs to, if any.
+* @param collections Every collection, to resolve the ones a rule refers to.
+*/
+function listPolicies(live, collection, tableName, collections) {
+	const listed = /* @__PURE__ */ new Map();
+	for (const policy of live) listed.set(policy.policyname, {
+		...policy,
+		status: "live"
+	});
+	if (!collection || !isPostgresCollectionConfig(collection)) return [...listed.values()];
+	const resolveCollection = (slug) => collections.find((c) => c.slug === slug || getTableName(c) === slug);
+	const injectedNames = getPolicyNamesForRules(getInjectedSecurityRules(collection), tableName);
+	const livePolicies = new Map(live.map((policy) => [policy.policyname, policy]));
+	for (const rule of getEffectiveSecurityRules(collection)) {
+		const operations = getPolicyOperations(rule);
+		let compiled;
+		try {
+			compiled = compileRulePolicies(collection, rule, { resolveCollection });
+		} catch {
+			compiled = void 0;
+		}
+		getPolicyNamesForRule(rule, tableName).forEach((name, index) => {
+			const declared = compiled ? asPostgresPolicy(compiled[index], tableName) : void 0;
+			const generated = injectedNames.has(name);
+			const existing = livePolicies.get(name);
+			if (existing) listed.set(name, {
+				...existing,
+				status: "both",
+				declared,
+				drift: declared ? policyDrift(declared, existing) : void 0,
+				generated
+			});
+			else listed.set(name, {
+				...declared ?? uncompiledPolicy(rule, operations[index] ?? "all", name, tableName),
+				status: "code_only",
+				generated
+			});
+		});
+	}
+	return [...listed.values()];
+}
+//#endregion
 //#region src/components/RLSEditor/RLSEditor.tsx
 /**
 * Whether `collection` is the one `db push` writes `table` for: the table
@@ -1213,41 +1321,55 @@ var RLSEditor = ({ apiUrl = "" }) => {
 		activeCollection,
 		junctionTableNames
 	]);
+	/**
+	* The junction a relation derives this table as, when it is one. Its
+	* policies are Rebase's — derived from the endpoints' relations — and the
+	* server re-creates them on every start, like a collection's. `null` when
+	* the registry's collections carry no resolvable relations (serialized
+	* configs without relation closures).
+	*/
+	const activeJunctionSpec = useMemo(() => {
+		if (!activeTableData || activeCollection) return null;
+		try {
+			return resolveJunctionSpecs(collectionRegistry.collections ?? []).get(activeTableData.tableName) ?? null;
+		} catch {
+			return null;
+		}
+	}, [
+		activeTableData,
+		activeCollection,
+		collectionRegistry.collections
+	]);
+	/**
+	* Whether the server re-asserts this table's RLS on every start: it switches
+	* RLS back on and re-creates every policy the project declares for it.
+	*/
+	const activeTableManaged = Boolean(activeCollection || activeJunctionSpec);
+	/**
+	* What Postgres enforces on the selected table, and what the code declares
+	* that it does not have yet.
+	*
+	* A policy in both is listed with the *database's* fields, and the
+	* declaration rides beside it with where the two differ (`listPolicies`).
+	* The declaration's fields in their place would make a policy changed in
+	* SQL look exactly like its declaration, and would show every rule written
+	* as a structured condition — all of Rebase's own policies — with no USING.
+	*/
 	const mergedPolicies = useMemo(() => {
 		if (!activeTableData) return [];
-		const policiesMap = {};
-		(activeTableData.policies || []).forEach((p) => {
-			policiesMap[p.policyname] = {
-				...p,
-				status: "live"
-			};
-		});
-		if (activeCollection && isPostgresCollectionConfig(activeCollection)) getEffectiveSecurityRules(activeCollection).forEach((rule) => {
-			const ops = getPolicyOperations(rule);
-			getPolicyNamesForRule(rule, activeTableData.tableName).forEach((policyName, opIdx) => {
-				policiesMap[policyName] = {
-					policyname: policyName,
-					tablename: activeTableData.tableName,
-					permissive: (rule.mode || "permissive").toUpperCase(),
-					cmd: (ops[opIdx] ?? rule.operation ?? "ALL").toUpperCase(),
-					roles: [...rule.pgRoles ?? ["public"]],
-					qual: rule.using || null,
-					with_check: rule.withCheck || null,
-					status: policiesMap[policyName] ? "both" : "code_only"
-				};
-			});
-		});
-		if (!activeCollection) try {
-			const spec = resolveJunctionSpecs(collectionRegistry.collections ?? []).get(activeTableData.tableName);
-			if (spec) {
-				const generatedNames = getPolicyNamesForRules(getJunctionSecurityRules(spec), spec.table);
-				for (const p of Object.values(policiesMap)) if (generatedNames.has(p.policyname)) p.status = "both";
+		const listed = listPolicies(activeTableData.policies || [], activeCollection, activeTableData.tableName, collectionRegistry.collections ?? []);
+		if (activeJunctionSpec) {
+			const generatedNames = getPolicyNamesForRules(getJunctionSecurityRules(activeJunctionSpec), activeJunctionSpec.table);
+			for (const p of listed) if (generatedNames.has(p.policyname)) {
+				p.status = "both";
+				p.generated = true;
 			}
-		} catch {}
-		return Object.values(policiesMap).sort((a, b) => a.policyname.localeCompare(b.policyname));
+		}
+		return listed.sort((a, b) => a.policyname.localeCompare(b.policyname));
 	}, [
 		activeTableData,
 		activeCollection,
+		activeJunctionSpec,
 		collectionRegistry.collections
 	]);
 	const rlsStats = useMemo(() => {
@@ -1548,7 +1670,8 @@ var RLSEditor = ({ apiUrl = "" }) => {
 									onClick: () => setConfirmToggleRls({
 										table: activeTableData.tableName,
 										schema: activeTableData.schemaName,
-										enabled: activeTableData.rlsEnabled
+										enabled: activeTableData.rlsEnabled,
+										managed: activeTableManaged
 									}),
 									children: activeTableData.rlsEnabled ? t("studio_rls_disable_rls") : t("studio_rls_enable_rls")
 								}),
@@ -1619,6 +1742,13 @@ var RLSEditor = ({ apiUrl = "" }) => {
 										return;
 									}
 									newRules = edit.rules;
+									if (JSON.stringify(newRules) === JSON.stringify(existingRules)) {
+										snackbarController.open({
+											type: "info",
+											message: t("studio_rls_nothing_changed")
+										});
+										return;
+									}
 								}
 								try {
 									await saveSecurityRules(activeCollection.slug, newRules);
@@ -1631,31 +1761,40 @@ var RLSEditor = ({ apiUrl = "" }) => {
 								} catch (e) {
 									reportSaveFailure(e);
 								}
-							} else try {
-								const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
-								const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
-								const cmd = newPolicy.cmd || "ALL";
-								const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
-								const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
-								let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
-								sql += ` AS ${permissive}`;
-								sql += ` FOR ${cmd}`;
-								sql += ` TO ${roles}`;
-								if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
-								if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
-								if (editingPolicy !== "new") sql = `DROP POLICY IF EXISTS ${sanitizeSqlIdentifier(editingPolicy.policyname)} ON ${qualifiedTable}; ${sql}`;
-								await databaseAdmin.executeSql(sql);
-								snackbarController.open({
-									type: "success",
-									message: `Policy "${newPolicy.policyname}" applied to the database`
-								});
-								setEditingPolicy(null);
-								fetchRLSData();
-							} catch (e) {
-								snackbarController.open({
-									type: "error",
-									message: e instanceof Error ? e.message : String(e)
-								});
+							} else {
+								if (editingPolicy !== "new" && editingPolicy.generated) {
+									snackbarController.open({
+										type: "error",
+										message: t(POLICY_EDIT_REFUSALS.generated, { policy: editingPolicy.policyname })
+									});
+									return;
+								}
+								try {
+									const qualifiedTable = `${sanitizeSqlIdentifier(activeTableData.schemaName)}.${sanitizeSqlIdentifier(activeTableData.tableName)}`;
+									const policyName = sanitizeSqlIdentifier(newPolicy.policyname || "unnamed_policy");
+									const cmd = newPolicy.cmd || "ALL";
+									const permissive = (newPolicy.permissive || "PERMISSIVE") === "PERMISSIVE" ? "PERMISSIVE" : "RESTRICTIVE";
+									const roles = newPolicy.roles && newPolicy.roles.length > 0 ? newPolicy.roles.map((r) => sanitizeSqlIdentifier(r)).join(", ") : "public";
+									let sql = `CREATE POLICY ${policyName} ON ${qualifiedTable}`;
+									sql += ` AS ${permissive}`;
+									sql += ` FOR ${cmd}`;
+									sql += ` TO ${roles}`;
+									if (newPolicy.qual) sql += ` USING (${newPolicy.qual})`;
+									if (newPolicy.with_check) sql += ` WITH CHECK (${newPolicy.with_check})`;
+									if (editingPolicy !== "new") sql = `DROP POLICY IF EXISTS ${sanitizeSqlIdentifier(editingPolicy.policyname)} ON ${qualifiedTable}; ${sql}`;
+									await databaseAdmin.executeSql(sql);
+									snackbarController.open({
+										type: "success",
+										message: `Policy "${newPolicy.policyname}" applied to the database`
+									});
+									setEditingPolicy(null);
+									fetchRLSData();
+								} catch (e) {
+									snackbarController.open({
+										type: "error",
+										message: e instanceof Error ? e.message : String(e)
+									});
+								}
 							}
 						},
 						onCancel: () => setEditingPolicy(null)
@@ -1666,6 +1805,19 @@ var RLSEditor = ({ apiUrl = "" }) => {
 							children: /* @__PURE__ */ jsxs("div", {
 								className: "max-w-4xl mx-auto flex flex-col gap-6",
 								children: [
+									activeTableData && activeTableManaged && !(activeCollection && hasCodebase) && /* @__PURE__ */ jsx(Alert, {
+										color: "info",
+										children: /* @__PURE__ */ jsxs("div", {
+											className: "flex items-start gap-2",
+											children: [/* @__PURE__ */ jsx(RefreshCwIcon, {
+												size: 16,
+												className: "shrink-0 mt-0.5"
+											}), /* @__PURE__ */ jsx(Typography, {
+												variant: "caption",
+												children: t("studio_rls_reapplied_on_start", { table: activeTableData.tableName })
+											})]
+										})
+									}),
 									activeTableData && activeTableCategory === "internal" && /* @__PURE__ */ jsx(Alert, {
 										color: "info",
 										children: /* @__PURE__ */ jsxs("div", {
@@ -1775,6 +1927,13 @@ var RLSEditor = ({ apiUrl = "" }) => {
 																children: t("studio_rls_unapplied")
 															})
 														}),
+														policy.drift && policy.drift.length > 0 && /* @__PURE__ */ jsx(Tooltip, {
+															title: t("studio_rls_drift_tooltip", { fields: policy.drift.join(", ") }),
+															children: /* @__PURE__ */ jsx("div", {
+																className: "px-1.5 py-0.5 rounded text-[10px] bg-orange-500/10 text-orange-600 border border-orange-500/20 shrink-0",
+																children: `${t("studio_rls_drift")}: ${policy.drift.join(", ")}`
+															})
+														}),
 														policy.status === "live" && hasCodebase && /* @__PURE__ */ jsx(Tooltip, {
 															title: "This policy is live in the database but missing from your codebase schema.",
 															children: /* @__PURE__ */ jsx("div", {
@@ -1821,6 +1980,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 														title: t("studio_rls_delete"),
 														asChild: true,
 														children: /* @__PURE__ */ jsx(IconButton, {
+															"aria-label": t("studio_rls_delete"),
 															size: "small",
 															onClick: () => setConfirmDropPolicy({
 																policyName: policy.policyname,
@@ -1891,7 +2051,7 @@ var RLSEditor = ({ apiUrl = "" }) => {
 				onAccept: applyToggleRls,
 				onCancel: () => setConfirmToggleRls(null),
 				title: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_title") : t("studio_rls_enable_confirm_title"),
-				body: confirmToggleRls?.enabled ? t("studio_rls_disable_confirm_body", { table: confirmToggleRls?.table ?? "" }) : t("studio_rls_enable_confirm_body", { table: confirmToggleRls?.table ?? "" })
+				body: confirmToggleRls?.enabled ? [t("studio_rls_disable_confirm_body", { table: confirmToggleRls.table }), confirmToggleRls.managed ? t("studio_rls_disable_reapplied", { table: confirmToggleRls.table }) : ""].filter(Boolean).join(" ") : t("studio_rls_enable_confirm_body", { table: confirmToggleRls?.table ?? "" })
 			}),
 			/* @__PURE__ */ jsx(ConfirmationDialog, {
 				open: confirmDropPolicy !== null,
@@ -1910,4 +2070,4 @@ var RLSEditor = ({ apiUrl = "" }) => {
 //#endregion
 export { RLSEditor };
 
-//# sourceMappingURL=RLSEditor-Djh43lBE.js.map
+//# sourceMappingURL=RLSEditor-BlLLV6xs.js.map