@rehearsal-db/core 0.1.0-beta.13 → 0.1.0-beta.14

package/src/project/install_scaffold.mjs

@@ -138,6 +138,31 @@ const uniqueProjects = (projects) => [
 
 const skip = (reason) => ({ status: "skipped", reason });
 
+export const renderInstalledRehearsalScaffold = (result) => {
+  if (result.status !== "ready") {
+    return `Rehearsal did not create project files: ${result.reason}.\nNext: run npx rehearsal from the application directory.`;
+  }
+  const changed = result.files.filter((file) => file.action !== "unchanged");
+  return [
+    "Rehearsal is ready in this project.",
+    `Configuration: ${result.configurationPath} (${result.configurationAction === "create" ? "created" : "existing"})`,
+    ...(result.rootConfigGenerationSkipped
+      ? [
+          `  Existing supported configuration detected at ${result.configurationPath}.`,
+          "  rehearsal.config.mjs was not created because Rehearsal preserves one active configuration and never creates a competing file.",
+        ]
+      : []),
+    ...(changed.length
+      ? [
+          ...changed.map(
+            (file) => `  ${file.action === "create" ? "+" : "~"} ${file.path}`,
+          ),
+        ]
+      : ["  Existing Rehearsal files preserved."]),
+    `Next: review ${result.configurationPath}, then run npx rehearsal.`,
+  ].join("\n");
+};
+
 export const resolveRehearsalConsumerRoot = async ({
   packageRoot,
   initCwd,
@@ -281,11 +306,20 @@ export const createInstalledRehearsalScaffold = async ({
     isPortAvailable,
   });
   const result = await applyRehearsalSetup(plan);
-  await loadRehearsalConfig({ projectRoot: resolution.projectRoot });
+  const loaded = await loadRehearsalConfig({
+    projectRoot: resolution.projectRoot,
+  });
+  const configurationPath = relative(resolution.projectRoot, loaded.configPath);
+  const configurationAction =
+    result.files.find(({ path }) => path === configurationPath)?.action ??
+    "unchanged";
   return {
     status: "ready",
     projectRoot: resolution.projectRoot,
     target: plan.target,
     files: result.files,
+    configurationPath,
+    configurationAction,
+    rootConfigGenerationSkipped: configurationPath !== "rehearsal.config.mjs",
   };
 };

package/src/project/setup.mjs

@@ -374,6 +374,9 @@ export const planRehearsalSetup = async ({
   ];
   return {
     projectRoot: root,
+    configurationPath: existingConfigPath
+      ? relative(root, existingConfigPath)
+      : CONFIG_PATH,
     project: detected.projectName,
     projectId,
     target: runtimeTarget,
@@ -444,6 +447,11 @@ export const applyRehearsalSetup = async (plan) => {
 
 export const summarizeRehearsalSetup = (plan, { mode }) => ({
   mode,
+  configurationPath: plan.configurationPath,
+  configurationAction:
+    plan.files.find((file) => file.path === plan.configurationPath)?.action ??
+    "unchanged",
+  rootConfigGenerationSkipped: plan.configurationPath !== CONFIG_PATH,
   project: plan.project,
   projectId: plan.projectId,
   target: plan.target,
@@ -461,6 +469,6 @@ export const summarizeRehearsalSetup = (plan, { mode }) => ({
   safety: plan.safety,
   nextAction:
     mode === "written"
-      ? "Review the generated commands and sanitization policy path, then run rehearsal doctor."
+      ? `Review ${plan.configurationPath}, including its commands and sanitization policy path, then run rehearsal doctor.`
       : "Review this plan, then rerun rehearsal setup --write to create it.",
 });

package/src/source/access.mjs

@@ -115,6 +115,7 @@ export const validateSourceAccessPolicy = (policy) => {
       : [
           "mode",
           "role",
+          "allowedMemberships",
           "connectionEnvironmentVariable",
           "credentialFile",
           "maximumValidForMinutes",
@@ -137,6 +138,7 @@ export const validateSourceAccessPolicy = (policy) => {
   let validForMinutes;
   let connectionEnvironmentVariable;
   let maximumValidForMinutes;
+  let allowedMemberships = Object.freeze([]);
   if (readerMode === "managed") {
     ownerRole = identifier(
       policy.reader.ownerRole,
@@ -155,6 +157,33 @@ export const validateSourceAccessPolicy = (policy) => {
     }
     validForMinutes = policy.reader.validForMinutes;
   } else {
+    if (
+      policy.reader.allowedMemberships !== undefined &&
+      (!Array.isArray(policy.reader.allowedMemberships) ||
+        policy.reader.allowedMemberships.length > 8)
+    ) {
+      throw new Error(
+        "sourcePolicy.reader.allowedMemberships must contain at most 8 role names.",
+      );
+    }
+    allowedMemberships = Object.freeze(
+      (policy.reader.allowedMemberships ?? []).map((membership, index) =>
+        identifier(
+          membership,
+          `sourcePolicy.reader.allowedMemberships[${index}]`,
+        ),
+      ),
+    );
+    if (new Set(allowedMemberships).size !== allowedMemberships.length) {
+      throw new Error(
+        "sourcePolicy.reader.allowedMemberships must not contain duplicates.",
+      );
+    }
+    if (allowedMemberships.includes(role)) {
+      throw new Error(
+        "sourcePolicy.reader.allowedMemberships must not include the login role.",
+      );
+    }
     connectionEnvironmentVariable = envKey(
       policy.reader.connectionEnvironmentVariable,
       "sourcePolicy.reader.connectionEnvironmentVariable",
@@ -170,13 +199,22 @@ export const validateSourceAccessPolicy = (policy) => {
     }
     maximumValidForMinutes = policy.reader.maximumValidForMinutes;
   }
+  const credentialParts =
+    typeof policy.reader.credentialFile === "string"
+      ? policy.reader.credentialFile.split(/[\\/]/u)
+      : [];
+  const rehearsalIndex = credentialParts.lastIndexOf(".rehearsal");
   if (
     typeof policy.reader.credentialFile !== "string" ||
-    !policy.reader.credentialFile.startsWith(".rehearsal/") ||
-    policy.reader.credentialFile.split(/[\\/]/u).includes("..")
+    policy.reader.credentialFile.startsWith("/") ||
+    /^[A-Za-z]:[\\/]/u.test(policy.reader.credentialFile) ||
+    credentialParts.some((part) => !part || part === "." || part === "..") ||
+    rehearsalIndex < 0 ||
+    credentialParts[rehearsalIndex + 1] !== "secrets" ||
+    rehearsalIndex + 2 >= credentialParts.length
   ) {
     throw new Error(
-      "sourcePolicy.reader.credentialFile must stay under .rehearsal/.",
+      "sourcePolicy.reader.credentialFile must be a project-relative file under the configured .rehearsal/secrets directory.",
     );
   }
   const exportSchema = identifier(
@@ -488,7 +526,11 @@ export const validateSourceAccessPolicy = (policy) => {
       credentialFile: policy.reader.credentialFile,
       ...(readerMode === "managed"
         ? { ownerRole, validForMinutes }
-        : { connectionEnvironmentVariable, maximumValidForMinutes }),
+        : {
+            allowedMemberships,
+            connectionEnvironmentVariable,
+            maximumValidForMinutes,
+          }),
     }),
     exportSchema,
     migrationLedger,
@@ -580,6 +622,7 @@ export const createSourceAccessPlan = ({
         : {
             connectionEnvironmentVariable:
               normalized.reader.connectionEnvironmentVariable,
+            allowedMemberships: normalized.reader.allowedMemberships,
             maximumValidForMinutes: normalized.reader.maximumValidForMinutes,
             sourceChanges: false,
           }),
@@ -632,7 +675,9 @@ export const createSourceAccessPlan = ({
         : [
             "all non-system readable columns match the approved views and migration ledger",
             "no relation, column, schema, or database writes",
-            "no inherited roles or privileged role attributes",
+            "role memberships exactly match the reviewed allowlist",
+            "allowed groups cannot log in, escalate, switch roles, delegate membership, or inherit other roles",
+            "no privileged role attributes",
             "no executable non-system security-definer functions",
             "database-enforced credential expiration",
             "unrelated private assets",

package/src/source/asset_transfer.mjs

@@ -2,6 +2,8 @@
 
 const BUCKET = /^[a-z0-9][a-z0-9.-]{0,99}$/u;
 const LOOPBACK = new Set(["127.0.0.1", "::1", "localhost"]);
+const MAXIMUM_STORAGE_DEPTH = 64;
+const MAXIMUM_STORAGE_PATH_BYTES = 4096;
 
 const safeBaseUrl = (value) => {
   let url;
@@ -34,9 +36,20 @@ const safePath = (value, label) => {
   ) {
     throw new Error(`${label} is unsafe.`);
   }
+  if (Buffer.byteLength(value) > MAXIMUM_STORAGE_PATH_BYTES) {
+    throw new Error(`${label} is too long.`);
+  }
   return value;
 };
 
+const safeInventoryName = (value) => {
+  const name = safePath(value, "Storage inventory name");
+  if (name.includes("/") || name.includes("\\")) {
+    throw new Error("Storage inventory name is not a single path segment.");
+  }
+  return name;
+};
+
 const readError = (label, response) =>
   new Error(
     `${label} failed with HTTP ${response.status}; response content was withheld.`,
@@ -93,115 +106,154 @@ export const streamApprovedSupabaseAssets = async function* ({
   if (!Array.isArray(declarations) || declarations.length === 0) return;
   let objectCount = 0;
   let totalBytes = 0;
+  const inventoryPaths = new Set();
   for (const declaration of declarations) {
     if (!BUCKET.test(declaration.bucket ?? "")) {
       throw new Error("Approved Storage bucket is invalid.");
     }
-    const prefix = safePath(
+    const approvedPrefix = safePath(
       declaration.prefix.replace(/\/$/u, ""),
       "Approved Storage prefix",
     );
-    let offset = 0;
-    while (true) {
-      const response = await fetchImplementation(
-        `${endpoint}/storage/v1/object/list/${encodeURIComponent(declaration.bucket)}`,
-        {
-          method: "POST",
-          headers: {
-            authorization: `Bearer ${token}`,
-            "content-type": "application/json",
-          },
-          body: JSON.stringify({
-            prefix,
-            limit: 100,
-            offset,
-            sortBy: { column: "name", order: "asc" },
-          }),
-        },
-      );
-      if (!response.ok) throw readError("Storage inventory", response);
-      const inventory = await response.json();
-      if (!Array.isArray(inventory))
-        throw new Error("Storage inventory response is invalid.");
-      for (const object of inventory) {
-        const name = safePath(
-          `${prefix}/${object.name}`,
-          "Storage object path",
-        );
-        if (!name.startsWith(`${prefix}/`))
-          throw new Error("Storage inventory escaped its approved prefix.");
-        const expectedBytes = Number(
-          object.metadata?.size ?? object.metadata?.contentLength,
-        );
-        if (!Number.isSafeInteger(expectedBytes) || expectedBytes < 0) {
-          throw new Error("Storage inventory omitted an exact object size.");
-        }
-        if (expectedBytes > maximumObjectBytes) {
-          throw new Error("Storage object exceeds its reviewed size limit.");
-        }
-        objectCount += 1;
-        totalBytes += expectedBytes;
-        if (objectCount > maximumObjects || totalBytes > maximumTotalBytes) {
-          throw new Error(
-            "Storage inventory exceeds its reviewed transfer boundary.",
-          );
-        }
-        const encodedPath = name.split("/").map(encodeURIComponent).join("/");
-        const download = await fetchImplementation(
-          `${endpoint}/storage/v1/object/authenticated/${encodeURIComponent(declaration.bucket)}/${encodedPath}`,
+    const prefixes = [{ path: approvedPrefix, depth: 0 }];
+    const scheduledPrefixes = new Set([approvedPrefix]);
+    for (let prefixIndex = 0; prefixIndex < prefixes.length; prefixIndex += 1) {
+      const prefix = prefixes[prefixIndex];
+      let offset = 0;
+      while (true) {
+        const response = await fetchImplementation(
+          `${endpoint}/storage/v1/object/list/${encodeURIComponent(declaration.bucket)}`,
           {
+            method: "POST",
             headers: {
               authorization: `Bearer ${token}`,
-              ...(object.metadata?.eTag
-                ? { "if-match": object.metadata.eTag }
-                : {}),
+              "content-type": "application/json",
             },
+            body: JSON.stringify({
+              prefix: prefix.path,
+              limit: 100,
+              offset,
+              sortBy: { column: "name", order: "asc" },
+            }),
           },
         );
-        if (!download.ok) throw readError("Storage object transfer", download);
-        const responseEtag = download.headers.get("etag");
-        if (object.metadata?.eTag) {
-          if (!responseEtag) {
+        if (!response.ok) throw readError("Storage inventory", response);
+        const inventory = await response.json();
+        if (!Array.isArray(inventory))
+          throw new Error("Storage inventory response is invalid.");
+        for (const object of inventory) {
+          if (
+            object === null ||
+            typeof object !== "object" ||
+            Array.isArray(object)
+          ) {
+            throw new Error("Storage inventory entry is invalid.");
+          }
+          const entryName = safeInventoryName(object.name);
+          const name = safePath(
+            `${prefix.path}/${entryName}`,
+            "Storage object path",
+          );
+          if (!name.startsWith(`${approvedPrefix}/`))
+            throw new Error("Storage inventory escaped its approved prefix.");
+          const inventoryKey = `${declaration.bucket}\0${name}`;
+          if (inventoryPaths.has(inventoryKey)) {
+            throw new Error("Storage inventory returned a duplicate path.");
+          }
+          inventoryPaths.add(inventoryKey);
+          objectCount += 1;
+          if (objectCount > maximumObjects) {
             throw new Error(
-              "Storage transfer omitted the reviewed object version.",
+              "Storage inventory exceeds its reviewed transfer boundary.",
             );
           }
-          if (responseEtag !== object.metadata.eTag) {
+          const directory = object.id === null && object.metadata === null;
+          if (directory) {
+            if (prefix.depth >= MAXIMUM_STORAGE_DEPTH) {
+              throw new Error(
+                "Storage inventory exceeds its safe folder depth.",
+              );
+            }
+            if (scheduledPrefixes.has(name)) {
+              throw new Error("Storage inventory returned a duplicate folder.");
+            }
+            scheduledPrefixes.add(name);
+            prefixes.push({ path: name, depth: prefix.depth + 1 });
+            continue;
+          }
+          const expectedBytes = Number(
+            object.metadata?.size ?? object.metadata?.contentLength,
+          );
+          if (!Number.isSafeInteger(expectedBytes) || expectedBytes < 0) {
+            throw new Error("Storage inventory omitted an exact object size.");
+          }
+          if (expectedBytes > maximumObjectBytes) {
+            throw new Error("Storage object exceeds its reviewed size limit.");
+          }
+          totalBytes += expectedBytes;
+          if (totalBytes > maximumTotalBytes) {
             throw new Error(
-              "Storage object changed between inventory and transfer.",
+              "Storage inventory exceeds its reviewed transfer boundary.",
             );
           }
-        }
-        if (declaration.pathMapping && typeof pathMapper !== "function") {
-          throw new Error(
-            "Storage path mapping requires the package-owned privacy mapper.",
+          const encodedPath = name.split("/").map(encodeURIComponent).join("/");
+          const download = await fetchImplementation(
+            `${endpoint}/storage/v1/object/authenticated/${encodeURIComponent(declaration.bucket)}/${encodedPath}`,
+            {
+              headers: {
+                authorization: `Bearer ${token}`,
+                ...(object.metadata?.eTag
+                  ? { "if-match": object.metadata.eTag }
+                  : {}),
+              },
+            },
           );
+          if (!download.ok)
+            throw readError("Storage object transfer", download);
+          const responseEtag = download.headers.get("etag");
+          if (object.metadata?.eTag) {
+            if (!responseEtag) {
+              throw new Error(
+                "Storage transfer omitted the reviewed object version.",
+              );
+            }
+            if (responseEtag !== object.metadata.eTag) {
+              throw new Error(
+                "Storage object changed between inventory and transfer.",
+              );
+            }
+          }
+          if (declaration.pathMapping && typeof pathMapper !== "function") {
+            throw new Error(
+              "Storage path mapping requires the package-owned privacy mapper.",
+            );
+          }
+          const objectPath = declaration.pathMapping
+            ? safePath(
+                pathMapper({
+                  mapping: declaration.pathMapping,
+                  value: name,
+                }),
+                "Mapped Storage object path",
+              )
+            : name;
+          yield {
+            bucket: declaration.bucket,
+            objectPath,
+            contentType: canonicalContentType(
+              object.metadata?.mimetype,
+              download.headers.get("content-type"),
+            ),
+            content: responseBody({
+              response: download,
+              expectedBytes,
+              maximumBytes: maximumObjectBytes,
+            }),
+          };
         }
-        const objectPath = declaration.pathMapping
-          ? safePath(
-              pathMapper({
-                mapping: declaration.pathMapping,
-                value: name,
-              }),
-              "Mapped Storage object path",
-            )
-          : name;
-        yield {
-          bucket: declaration.bucket,
-          objectPath,
-          contentType: canonicalContentType(
-            object.metadata?.mimetype,
-            download.headers.get("content-type"),
-          ),
-          content: responseBody({
-            response: download,
-            expectedBytes,
-            maximumBytes: maximumObjectBytes,
-          }),
-        };
+        if (inventory.length < 100) break;
+        offset += inventory.length;
       }
-      if (inventory.length < 100) break;
-      offset += inventory.length;
     }
   }
 };