@rebasepro/types 0.10.0 → 0.10.1-canary.0a881d4

package/dist/types/properties.d.ts

@@ -1,9 +1,8 @@
-import type { ComponentRef } from "./component_ref";
 import type { Entity, EntityReference, EntityRelation, EntityValues, GeoPoint, Vector } from "./entities";
 import type { JoinStep, OnAction, Relation } from "./relations";
-import type { CollectionConfig, FilterValues, WhereFilterOp } from "./collections";
+import type { CollectionConfig, FilterValues } from "./collections";
 import type { ColorKey, ColorScheme } from "./chips";
-import type { AuthController } from "../controllers/auth";
+import type { AuthState } from "../controllers/auth_state";
 import type { AfterReadProps, BeforeSaveProps } from "./entity_callbacks";
 import type { User } from "../users";
 /**
@@ -103,47 +102,7 @@ export type InferEntityType<P extends Properties> = {
 } & {
     -readonly [K in OptionalPropertyKeys<P>]?: InferPropertyType<P[K]>;
 };
-/**
- * Interface including all common properties of a CMS property.
- * @group Entity properties
- */
-export interface BaseUIConfig<CustomProps = unknown> {
-    columnWidth?: number;
-    hideFromCollection?: boolean;
-    readOnly?: boolean;
-    disabled?: boolean | PropertyDisabledConfig;
-    widthPercentage?: number;
-    customProps?: CustomProps;
-    Field?: ComponentRef<any>;
-    Preview?: ComponentRef<any>;
-    /**
-     * Narrow the filter operators offered for this property in collection
-     * filter UIs (table header filters and the Filters dialog).
-     *
-     * The final offered set is the **intersection** of the engine's
-     * capabilities, the property-type defaults, and this list — you can only
-     * *restrict*, never enable an operator the underlying engine cannot run.
-     *
-     * Pass an empty array to disable filtering on this property entirely.
-     *
-     * @example
-     * // Email column: exact match, contains, and null check only
-     * ui: { filterOperators: ["==", "ilike", "is-null"] }
-     */
-    filterOperators?: readonly WhereFilterOp[];
-    /**
-     * Replace the filter field rendered for this property in collection
-     * filter UIs. The component receives `FilterFieldBindingProps`
-     * (property, resolved `operators`, `value`, `setValue`, …).
-     *
-     * Takes precedence over the collection-level
-     * `components["Collection.FilterField"]` override and the built-in
-     * per-type filter fields.
-     */
-    Filter?: ComponentRef<any>;
-}
 export interface BaseProperty<CustomProps = unknown> {
-    ui?: BaseUIConfig<CustomProps>;
     /**
      * Property name (e.g. Product)
      */
@@ -219,35 +178,7 @@ export interface BaseProperty<CustomProps = unknown> {
      */
     metadata?: Record<string, unknown>;
 }
-/**
- * @group Entity properties
- */
-export interface StringUIConfig extends BaseUIConfig {
-    /**
-     * Is this string property long enough so it should be displayed in
-     * a multiple line field. Defaults to false. If set to true,
-     * the number of lines adapts to the content
-     */
-    multiline?: boolean;
-    /**
-     * Should this string property be displayed as a markdown field. If true,
-     * the field is rendered as a text editor that supports markdown highlight
-     * syntax. It also includes a preview of the result.
-     */
-    markdown?: boolean;
-    /**
-     * Should this string be rendered as a tag instead of just text.
-     */
-    previewAsTag?: boolean;
-    clearable?: boolean;
-    /**
-     * If the value of this property is a URL, you can set this flag to true
-     * to add a link, or one of the supported media types to render a preview
-     */
-    url?: boolean | PreviewType;
-}
 export interface StringProperty extends BaseProperty {
-    ui?: StringUIConfig;
     type: "string";
     /**
      * Default value for new entities. Must be a string.
@@ -305,15 +236,17 @@ export interface StringProperty extends BaseProperty {
      * Does this field include an email
      */
     email?: boolean;
-}
-/**
- * @group Entity properties
- */
-export interface NumberUIConfig extends BaseUIConfig {
-    clearable?: boolean;
+    /**
+     * Does this string hold a URL?
+     *
+     * A statement about the *data*, which is why it sits here beside `email`
+     * rather than in the admin block: the OpenAPI generator turns it into
+     * `format: "uri"`, so it is part of the published API contract. How the panel
+     * renders it — as a link, an image, a video — is `admin.urlPreview`.
+     */
+    url?: boolean;
 }
 export interface NumberProperty extends BaseProperty {
-    ui?: NumberUIConfig;
     type: "number";
     /**
      * Default value for new entities. Must be a number.
@@ -350,7 +283,6 @@ export interface NumberProperty extends BaseProperty {
  * @group Entity properties
  */
 export interface BooleanProperty extends BaseProperty {
-    ui?: BaseUIConfig;
     type: "boolean";
     /**
      * Default value for new entities. Must be a boolean.
@@ -361,14 +293,7 @@ export interface BooleanProperty extends BaseProperty {
      */
     validation?: PropertyValidationSchema;
 }
-/**
- * @group Entity properties
- */
-export interface VectorUIConfig extends BaseUIConfig {
-    clearable?: boolean;
-}
 export interface VectorProperty extends BaseProperty {
-    ui?: VectorUIConfig;
     type: "vector";
     /**
      * Default value for new entities.
@@ -388,17 +313,7 @@ export interface BinaryProperty extends BaseProperty {
     defaultValue?: string;
     validation?: PropertyValidationSchema;
 }
-/**
- * @group Entity properties
- */
-export interface DateUIConfig extends BaseUIConfig {
-    /**
-     * Add an icon to clear the value and set it to `null`. Defaults to `false`
-     */
-    clearable?: boolean;
-}
 export interface DateProperty extends BaseProperty {
-    ui?: DateUIConfig;
     type: "date";
     /**
      * Default value for new entities. Must be a Date.
@@ -434,7 +349,6 @@ export interface DateProperty extends BaseProperty {
  * @group Entity properties
  */
 export interface GeopointProperty extends BaseProperty {
-    ui?: BaseUIConfig;
     type: "geopoint";
     /**
      * Default value for new entities. Must be a GeoPoint.
@@ -445,12 +359,6 @@ export interface GeopointProperty extends BaseProperty {
      */
     validation?: PropertyValidationSchema;
 }
-/**
- * @group Entity properties
- */
-export interface ReferenceUIConfig extends BaseUIConfig {
-    previewProperties?: string[];
-}
 /**
  * A pointer to a entity, stored **as a value** on the row (id + path, and
  * optionally a `driver`/`databaseId` for cross-datasource pointers).
@@ -468,7 +376,6 @@ export interface ReferenceUIConfig extends BaseUIConfig {
  * @group Entity properties
  */
 export interface ReferenceProperty extends BaseProperty {
-    ui?: ReferenceUIConfig;
     type: "reference";
     /**
      * Default value for new entities. Must be a EntityReference.
@@ -505,13 +412,6 @@ export interface ReferenceProperty extends BaseProperty {
      */
     includeEntityLink?: boolean;
 }
-/**
- * @group Entity properties
- */
-export interface RelationUIConfig extends BaseUIConfig {
-    previewProperties?: string[];
-    widget?: "select" | "dialog";
-}
 /**
  * A schema-level relationship between collections **within a single
  * datasource** — backed by a foreign key, junction table, or explicit join
@@ -529,7 +429,6 @@ export interface RelationUIConfig extends BaseUIConfig {
  * @group Entity properties
  */
 export interface RelationProperty extends BaseProperty {
-    ui?: RelationUIConfig;
     type: "relation";
     /**
      * Default value for new entities. Must be a EntityRelation or array of EntityRelation.
@@ -637,15 +536,7 @@ export interface RelationProperty extends BaseProperty {
      */
     widget?: "select" | "dialog";
 }
-/**
- * @group Entity properties
- */
-export interface ArrayUIConfig extends BaseUIConfig {
-    expanded?: boolean;
-    minimalistView?: boolean;
-}
 export interface ArrayProperty extends BaseProperty {
-    ui?: ArrayUIConfig;
     type: "array";
     /**
      * Default value for new entities. Must be an array.
@@ -717,16 +608,7 @@ export interface ArrayProperty extends BaseProperty {
      */
     canAddElements?: boolean;
 }
-/**
- * @group Entity properties
- */
-export interface MapUIConfig extends BaseUIConfig {
-    expanded?: boolean;
-    minimalistView?: boolean;
-    spreadChildren?: boolean;
-}
 export interface MapProperty extends BaseProperty {
-    ui?: MapUIConfig;
     type: "map";
     /**
      * Default value for new entities. Must be a record/object.
@@ -772,30 +654,8 @@ export type PropertyBuilderProps<M extends Record<string, unknown> = Record<stri
     index?: number;
     path: string;
     entityId?: string | number;
-    authController: AuthController;
+    authController: AuthState;
 };
-/**
- * @group Entity properties
- */
-export interface PropertyDisabledConfig {
-    /**
-     * Enable this flag if you would like to clear the value of the field
-     * when the corresponding property gets disabled.
-     *
-     * This is useful for keeping data consistency when you have conditional
-     * properties.
-     */
-    clearOnDisabled?: boolean;
-    /**
-     * Explanation of why this property is disabled (e.g. a different field
-     * needs to be enabled)
-     */
-    disabledMessage?: string;
-    /**
-     * Set this flag to true if you want to hide this field when disabled
-     */
-    hidden?: boolean;
-}
 /**
  * We use this type to define mapping between string or number values in
  * the data source to a label (such in a select dropdown).
@@ -1046,11 +906,6 @@ export interface UploadedFileContext {
      */
     storage: StorageConfig;
 }
-/**
- * Used for previewing urls if the download file is known
- * @group Entity properties
- */
-export type PreviewType = "image" | "video" | "audio" | "file";
 /**
  * MIME types for storage fields
  * @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types/Common_types

package/dist/types/schema_version.d.ts

@@ -0,0 +1,18 @@
+import type { CollectionConfig } from "./collections";
+/**
+ * Compute the canonical string a schema version hashes.
+ *
+ * Exposed separately so the hashing itself can differ by environment: Node has
+ * `crypto`, and callers without it can still compare canonical forms directly.
+ */
+export declare function canonicalSchemaPayload(collections: CollectionConfig[]): string;
+/**
+ * A short, non-cryptographic digest of the canonical payload.
+ *
+ * FNV-1a style, 64 bits, as two 32-bit halves. This is an identity, not a
+ * security boundary: nothing trusts a schema version to prove anything, it only
+ * answers "is this the same schema as before". A hand-rolled hash keeps this
+ * module free of `node:crypto`, so the identical function runs in the browser,
+ * in the CLI, and in the runtime — which is the property that actually matters.
+ */
+export declare function computeSchemaVersion(collections: CollectionConfig[]): string;

package/dist/types/security_rules.d.ts

@@ -0,0 +1,320 @@
+/**
+ * Row-level security rules for a collection.
+ *
+ * 325 lines of RLS policy contract that used to sit in the middle of
+ * `collections.ts`, between the admin panel's table view-models and the auth
+ * collection config. It has no relationship to the shape of a collection — it is
+ * the most-read part of the BaaS surface, and it now reads on its own.
+ *
+ * A rule is compiled to Postgres `CREATE POLICY` DDL and, for the structured
+ * flavour, independently evaluated in JavaScript, so the admin UI's idea of what
+ * a user may do derives from the same expression the database enforces.
+ *
+ * Note that rule *names* are not what you write: an unnamed rule compiles to
+ * `<table>_<op>_<sha1[0:7]>`, plus an injected `default_admin` baseline. Derive
+ * them with `getPolicyNamesForRule`/`getEffectiveSecurityRules` rather than
+ * matching on `rule.name`.
+ */
+import type { PolicyExpression } from "./policy";
+/**
+ * SQL operation that a policy applies to.
+ * @group Models
+ */
+export type SecurityOperation = "select" | "insert" | "update" | "delete" | "all";
+/**
+ * Flexible Row Level Security rule for a collection.
+ *
+ * Built on PostgreSQL Row Level Security. Rules can range from
+ * simple convenience shortcuts to fully custom SQL expressions, giving you the
+ * full power of PostgreSQL Row Level Security.
+ *
+ * The authenticated user's identity is available in raw SQL via:
+ * - `auth.uid()`   — the user's ID
+ * - `auth.roles()` — comma-separated app role IDs
+ * - `auth.jwt()`   — full JWT claims as JSONB
+ *
+ * These are set automatically per-transaction by the backend.
+ *
+ * **How rules combine:** PostgreSQL evaluates all matching policies for an
+ * operation. Permissive rules are OR'd together (any one passing is enough).
+ * Restrictive rules are AND'd (all must pass). This is standard PostgreSQL RLS behavior.
+ *
+ * **Mutual exclusivity:** `ownerField`, `access`, structured `condition`, and
+ * raw SQL (`using`/`withCheck`) cannot be combined. The type system enforces
+ * this — attempting to set conflicting fields will produce a compile-time
+ * error.
+ *
+ * **Which form to reach for:** prefer the structured {@link StructuredSecurityRule}
+ * (`condition`/`check`) or the shortcuts (`ownerField`, `access`, `roles`). These
+ * are engine-agnostic and evaluated identically by the database and the admin UI,
+ * so the UI never shows an action the database will reject. Raw SQL
+ * ({@link RawSQLSecurityRule}) keeps full PostgreSQL power but is Postgres-only
+ * and server-authoritative (the UI cannot evaluate arbitrary SQL locally).
+ *
+ * @group Models
+ */
+export type SecurityRule = OwnerSecurityRule | PublicSecurityRule | StructuredSecurityRule | RawSQLSecurityRule | RolesOnlySecurityRule;
+/**
+ * Shared fields for all SecurityRule variants.
+ * @group Models
+ */
+export interface SecurityRuleBase {
+    /**
+     * Optional human-readable name for the policy.
+     * If not provided, one will be auto-generated from the table name and operation.
+     * Must be unique per table.
+     *
+     * When using `operations` (array), each generated policy will have the
+     * operation name appended, e.g. `"owner_access_select"`, `"owner_access_update"`.
+     */
+    name?: string;
+    /**
+     * Which SQL operation this policy applies to.
+     * Use this when the policy targets a single operation or all operations.
+     *
+     * For multiple specific operations, use `operations` (array) instead.
+     * If neither is specified, defaults to `"all"`.
+     *
+     * @default "all"
+     */
+    operation?: SecurityOperation;
+    /**
+     * Array of SQL operations this policy applies to.
+     * The compiler will generate one PostgreSQL policy per operation, sharing
+     * the same configuration.
+     *
+     * This reduces boilerplate when the same rule applies to multiple (but not all)
+     * operations.
+     *
+     * Takes precedence over `operation` (singular) if both are specified.
+     *
+     * @example
+     * // Same rule for select and update
+     * { operations: ["select", "update"], ownerField: "user_id" }
+     *
+     * @example
+     * // Equivalent to operation: "all"
+     * { operations: ["all"], ownerField: "user_id" }
+     */
+    operations?: readonly SecurityOperation[];
+    /**
+     * Whether this policy is `"permissive"` (default) or `"restrictive"`.
+     *
+     * - **permissive**: Multiple permissive policies for the same operation are
+     *   OR'd together — if *any* passes, access is granted.
+     * - **restrictive**: Restrictive policies are AND'd with all permissive
+     *   policies — they act as additional gates that *must* also pass.
+     *
+     * This is the standard PostgreSQL RLS model.
+     *
+     * @default "permissive"
+     */
+    mode?: "permissive" | "restrictive";
+    /**
+     * **Shortcut.** Restrict this rule to users that have one of these
+     * application-level roles.
+     *
+     * **Important:** These are NOT native PostgreSQL database roles — names
+     * like `public`, `anon` or `authenticated` belong to {@link pgRoles} and
+     * produce a condition no user can satisfy if used here. These are
+     * application roles managed by Rebase, stored as an inline `roles TEXT[]`
+     * column on the users table, and injected into each transaction as
+     * `app.user_roles` — which `auth.roles()` reads.
+     *
+     * There is no roles registry: a role exists once it is assigned to a user.
+     *
+     * Generates a safe array-overlap condition — the user passes if they hold
+     * *any* of the listed roles:
+     *   `string_to_array(auth.roles(), ',') && ARRAY['<role1>', '<role2>']`
+     *
+     * (Note: this is a true set intersection, NOT a regex/substring match, so
+     * a role named `admin` never matches `nonadmin` or `superadmin`.)
+     *
+     * Can be combined with `ownerField`, `access`, `condition`, or raw
+     * `using`/`withCheck`. When combined, the role check is AND'd with the
+     * other condition.
+     *
+     * @example
+     * // Only admins can delete
+     * { operation: "delete", roles: ["admin"] }
+     *
+     * @example
+     * // Admins have unfiltered read access to all rows
+     * { operation: "select", roles: ["admin"], using: "true" }
+     */
+    roles?: readonly string[];
+    /**
+     * **Advanced.** Native PostgreSQL database roles the policy applies to.
+     *
+     * By default, all generated policies target the `public` role (i.e.
+     * every database connection). This is correct for most setups where
+     * a single database role is used for all connections.
+     *
+     * **Important:** These are NOT the same as the application-level
+     * {@link roles} (admin, editor, viewer, etc.) — those are enforced in the
+     * USING/WITH CHECK clauses via `auth.roles()`. This field controls the
+     * PostgreSQL `TO` clause in `CREATE POLICY ... TO role_name`.
+     *
+     * Use this if you have dedicated PostgreSQL roles (e.g. `app_read`,
+     * `app_write`) and want policies to target specific ones.
+     *
+     * @default ["public"]
+     *
+     * @example
+     * // Only apply this policy when connected as `app_role`
+     * { operation: "select", access: "public", pgRoles: ["app_role"] }
+     */
+    pgRoles?: readonly string[];
+}
+/**
+ * Security rule that grants access based on row ownership.
+ * Generates a USING/WITH CHECK clause like: `<column> = auth.uid()`
+ *
+ * Cannot be combined with `using`, `withCheck`, or `access`.
+ *
+ * @example
+ * { operation: "all", ownerField: "user_id" }
+ *
+ * @group Models
+ */
+export interface OwnerSecurityRule extends SecurityRuleBase {
+    /** The property (column) that stores the owner's user ID. */
+    ownerField: string;
+    access?: never;
+    using?: never;
+    withCheck?: never;
+    condition?: never;
+    check?: never;
+}
+/**
+ * Security rule that grants unrestricted row access (no row filtering).
+ * Generates `USING (true)`.
+ *
+ * This means "no row-level filter", NOT "anonymous/unauthenticated access".
+ * Authentication is still enforced at the API layer — this only controls which
+ * *rows* authenticated users can see.
+ *
+ * Cannot be combined with `using`, `withCheck`, or `ownerField`.
+ *
+ * @example
+ * // Public read (any authenticated user sees all rows)
+ * { operation: "select", access: "public" }
+ *
+ * @group Models
+ */
+export interface PublicSecurityRule extends SecurityRuleBase {
+    /** Grant unrestricted row access for this operation. */
+    access: "public";
+    ownerField?: never;
+    using?: never;
+    withCheck?: never;
+    condition?: never;
+    check?: never;
+}
+/**
+ * Security rule expressed as a structured, engine-agnostic
+ * {@link PolicyExpression}. This is the **recommended** way to write a
+ * non-trivial condition: it compiles to PostgreSQL `USING`/`WITH CHECK` SQL
+ * *and* is evaluated identically by the admin UI, so the UI can never show an
+ * action the database will reject.
+ *
+ * Cannot be combined with `ownerField`, `access`, or raw `using`/`withCheck`.
+ *
+ * @example
+ * // Owner, or any user holding the `moderator` role
+ * {
+ *   operation: "update",
+ *   condition: policy.or(
+ *       policy.compare(policy.field("user_id"), "eq", policy.authUid()),
+ *       policy.rolesOverlap(["moderator"])
+ *   )
+ * }
+ *
+ * @group Models
+ */
+export interface StructuredSecurityRule extends SecurityRuleBase {
+    /**
+     * Structured condition for the `USING` clause — which *existing* rows are
+     * visible / can be modified / deleted (SELECT, UPDATE, DELETE).
+     */
+    condition: PolicyExpression;
+    /**
+     * Structured condition for the `WITH CHECK` clause — which *new/updated*
+     * row values are allowed (INSERT, UPDATE). Defaults to `condition` when
+     * omitted, mirroring PostgreSQL's own behavior.
+     */
+    check?: PolicyExpression;
+    ownerField?: never;
+    access?: never;
+    using?: never;
+    withCheck?: never;
+}
+/**
+ * Security rule using raw SQL expressions for full PostgreSQL RLS power.
+ *
+ * **Postgres-only and server-authoritative.** Arbitrary SQL cannot be
+ * evaluated by the admin UI, so a rule using this form is treated as *unknown*
+ * client-side (never silently allowed) and its effect on visible actions is
+ * reflected from the server. For conditions that should also drive the UI
+ * precisely, prefer the structured {@link StructuredSecurityRule}.
+ *
+ * Cannot be combined with `ownerField`, `access`, or structured `condition`.
+ *
+ * You can reference columns via `{column_name}` which will be resolved to
+ * `table.column_name` in the generated Drizzle code.
+ *
+ * @example
+ * // Rows published in the last 30 days are visible
+ * { operation: "select", using: "{published_at} > now() - interval '30 days'" }
+ *
+ * @example
+ * // Only the owner, or users with 'moderator' role
+ * {
+ *   operation: "select",
+ *   using: "{user_id} = auth.uid() OR auth.roles() ~ 'moderator'"
+ * }
+ *
+ * @group Models
+ */
+export interface RawSQLSecurityRule extends SecurityRuleBase {
+    /**
+     * Raw SQL expression for the `USING` clause.
+     * This controls which *existing* rows are visible / can be modified / deleted.
+     * Applied to SELECT, UPDATE, and DELETE.
+     */
+    using: string;
+    /**
+     * Raw SQL expression for the `WITH CHECK` clause.
+     * This controls which *new/updated* row values are allowed.
+     * Applied to INSERT and UPDATE.
+     *
+     * If not provided on INSERT/UPDATE policies, falls back to `using`
+     * (which matches PostgreSQL's own default behavior).
+     */
+    withCheck?: string;
+    ownerField?: never;
+    access?: never;
+    condition?: never;
+    check?: never;
+}
+/**
+ * Security rule that only filters by application roles, without any
+ * row-level condition (USING/WITH CHECK).
+ *
+ * Useful for simple "only admins can access this table" rules where
+ * no per-row filtering is needed.
+ *
+ * @example
+ * // Only admins can delete
+ * { operation: "delete", roles: ["admin"] }
+ *
+ * @group Models
+ */
+export interface RolesOnlySecurityRule extends SecurityRuleBase {
+    ownerField?: never;
+    access?: never;
+    using?: never;
+    withCheck?: never;
+    condition?: never;
+    check?: never;
+}

package/dist/types/storage_authorize.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The storage access-control contract.
+ *
+ * Lives here rather than in `@rebasepro/server` because a project declares its
+ * `storageAuthorize` hook from its **config package**, and a config package
+ * depends on `@rebasepro/types` alone. A type the contract requires but the
+ * contract's author cannot import is not much of a contract.
+ *
+ * `@rebasepro/server` re-exports all of this, so existing imports keep working.
+ */
+export type StorageOperation = "read" | "write" | "delete" | "list";
+/** The caller, as resolved by whichever auth middleware ran. */
+export interface StorageAuthorizeUser {
+    uid: string;
+    email?: string;
+    roles?: string[];
+}
+export interface StorageAuthorizeContext {
+    /** Object key, bucket prefix stripped and traversal already sanitized. */
+    key: string;
+    bucket: string;
+    operation: StorageOperation;
+    /** Null when the route allows unauthenticated access. */
+    user: StorageAuthorizeUser | null;
+    /** Named backend the request targeted, when one was given. */
+    storageId?: string;
+    /**
+     * Trusted, RLS-bypassing data access, so the hook can answer the question it
+     * actually has to answer: *who owns this object?*
+     *
+     * Without it the hook can only do prefix arithmetic on the key, which
+     * expresses no real multi-tenant rule — ownership lives in a row, not in a
+     * string. And it cannot simply import the server to get one: a project
+     * declares this hook from its **config** package, which depends on
+     * `@rebasepro/types` alone and cannot resolve `@rebasepro/server` at
+     * runtime. So the accessor is handed in.
+     *
+     * It bypasses row-level security on purpose. The hook IS the authorization
+     * decision; asking it to make that decision through a reader that has
+     * already been narrowed by the caller's own permissions is circular.
+     */
+    data?: StorageAuthorizeData;
+}
+/**
+ * The slice of the data API a storage hook needs: read a collection, in the
+ * trusted server context.
+ *
+ * Deliberately read-only and deliberately tiny. A hook that can write is a hook
+ * that can be tricked into writing, and an authorization check has no business
+ * mutating anything.
+ */
+export interface StorageAuthorizeData {
+    collection(slug: string): {
+        find(query?: Record<string, unknown>): Promise<{
+            data: Record<string, unknown>[];
+        }>;
+        findById(id: string): Promise<Record<string, unknown> | null>;
+    };
+}
+/**
+ * Per-object access control for storage, the analogue of an RLS policy on a
+ * collection.
+ *
+ * Without it, storage routes authenticate but do not authorize: `requireAuth`
+ * and `publicRead` are global switches, so any signed-in user could read any
+ * key they could name. That is fine for a single-tenant app and useless for a
+ * multi-tenant one, where the only thing separating two tenants' files would be
+ * key unguessability — not an access-control model. Multi-tenant apps were
+ * left to route every byte through a custom function to get an ownership check
+ * in, and each of them had to invent it.
+ *
+ * Return false (or throw) to deny. Denials surface as 403.
+ */
+export type StorageAuthorize = (ctx: StorageAuthorizeContext) => boolean | Promise<boolean>;