@rocicorp/zero 0.6.2024112101 → 0.7.2024112700

package/out/zero-cache/src/services/mutagen/write-authorizer.js

@@ -1,168 +0,0 @@
-import { LogContext } from '@rocicorp/logger';
-import { tmpdir } from 'node:os';
-import path from 'node:path';
-import { pid } from 'node:process';
-import { assert } from '../../../../shared/src/asserts.js';
-import { randInt } from '../../../../shared/src/rand.js';
-import * as v from '../../../../shared/src/valita.js';
-import { primaryKeyValueSchema, } from '../../../../zero-protocol/src/primary-key.js';
-import { buildPipeline } from '../../../../zql/src/builder/builder.js';
-import { Database } from '../../../../zqlite/src/db.js';
-import { compile, sql } from '../../../../zqlite/src/internal/sql.js';
-import { TableSource } from '../../../../zqlite/src/table-source.js';
-import { listTables } from '../../db/lite-tables.js';
-import { mapLiteDataTypeToZqlSchemaValue } from '../../types/lite.js';
-import { DatabaseStorage } from '../view-syncer/database-storage.js';
-import { normalize } from '../view-syncer/pipeline-driver.js';
-import { StatementRunner } from '../../db/statements.js';
-export class WriteAuthorizerImpl {
-    #authorizationConfig;
-    #replica;
-    #builderDelegate;
-    #tableSpecs;
-    #tables = new Map();
-    #statementRunner;
-    #lc;
-    constructor(lc, config, authorization, replica, cgID) {
-        this.#lc = lc.withContext('class', 'WriteAuthorizerImpl');
-        this.#authorizationConfig = authorization ?? {};
-        this.#replica = replica;
-        const tmpDir = config.storageDBTmpDir ?? tmpdir();
-        const writeAuthzStorage = DatabaseStorage.create(lc, path.join(tmpDir, `mutagen-${pid}-${randInt(1000000, 9999999)}`));
-        const cgStorage = writeAuthzStorage.createClientGroupStorage(cgID);
-        this.#builderDelegate = {
-            getSource: name => this.#getSource(name),
-            createStorage: () => cgStorage.createStorage(),
-        };
-        this.#tableSpecs = new Map(listTables(replica).map(spec => [spec.name, normalize(spec)]));
-        this.#statementRunner = new StatementRunner(replica);
-    }
-    canInsert(authData, op) {
-        return this.#timedCanDo('insert', authData, op);
-    }
-    canUpdate(authData, op) {
-        return this.#timedCanDo('update', authData, op);
-    }
-    canDelete(authData, op) {
-        return this.#timedCanDo('delete', authData, op);
-    }
-    canUpsert(authData, op) {
-        const preMutationRow = this.#getPreMutationRow(op);
-        if (preMutationRow) {
-            return this.canUpdate(authData, {
-                op: 'update',
-                tableName: op.tableName,
-                primaryKey: op.primaryKey,
-                value: op.value,
-            });
-        }
-        return this.canInsert(authData, {
-            op: 'insert',
-            tableName: op.tableName,
-            primaryKey: op.primaryKey,
-            value: op.value,
-        });
-    }
-    #getSource(tableName) {
-        let source = this.#tables.get(tableName);
-        if (source) {
-            return source;
-        }
-        const tableSpec = this.#tableSpecs.get(tableName);
-        if (!tableSpec) {
-            throw new Error(`Table ${tableName} not found`);
-        }
-        const { columns, primaryKey } = tableSpec;
-        assert(primaryKey.length);
-        source = new TableSource(this.#replica, tableName, Object.fromEntries(Object.entries(columns).map(([name, { dataType }]) => [
-            name,
-            mapLiteDataTypeToZqlSchemaValue(dataType),
-        ])), [primaryKey[0], ...primaryKey.slice(1)]);
-        this.#tables.set(tableName, source);
-        return source;
-    }
-    #timedCanDo(action, authData, op) {
-        const start = performance.now();
-        try {
-            const ret = this.#canDo(action, authData, op);
-            return ret;
-        }
-        finally {
-            this.#lc.info?.('action:', action, 'duration:', performance.now() - start, 'tableName:', op.tableName, 'primaryKey:', op.primaryKey);
-        }
-    }
-    /**
-     * Evaluation order is from static to dynamic, broad to specific.
-     * table -> column -> row -> cell.
-     *
-     * If any step fails, the entire operation is denied.
-     *
-     * That is, table rules supersede column rules, which supersede row rules,
-     *
-     * All steps must allow for the operation to be allowed.
-     */
-    #canDo(action, authData, op) {
-        const rules = this.#authorizationConfig[op.tableName];
-        if (!rules) {
-            return true;
-        }
-        let preMutationRow;
-        if (op.op !== 'insert') {
-            preMutationRow = this.#getPreMutationRow(op);
-        }
-        const rowPolicies = rules.row;
-        if (rowPolicies &&
-            !this.#passesPolicy(rowPolicies[action], authData, preMutationRow)) {
-            return false;
-        }
-        const cellPolicies = rules.cell;
-        if (cellPolicies) {
-            for (const [column, policy] of Object.entries(cellPolicies)) {
-                if (action === 'update' && op.value[column] === undefined) {
-                    // If the column is not being updated, we do not need to check
-                    // the column rules.
-                    continue;
-                }
-                if (!this.#passesPolicy(policy[action], authData, preMutationRow)) {
-                    return false;
-                }
-            }
-        }
-        return true;
-    }
-    #getPreMutationRow(op) {
-        const { value } = op;
-        const conditions = [];
-        const values = [];
-        for (const pk of op.primaryKey) {
-            conditions.push(sql `${sql.ident(pk)}=?`);
-            values.push(v.parse(value[pk], primaryKeyValueSchema));
-        }
-        return this.#statementRunner.get(compile(sql `SELECT * FROM ${sql.ident(op.tableName)} WHERE ${sql.join(conditions, sql ` AND `)}`), ...values);
-    }
-    #passesPolicy(policy, authData, preMutationRow) {
-        if (!policy) {
-            return true;
-        }
-        for (const [_, rule] of policy) {
-            const input = buildPipeline(rule, this.#builderDelegate, {
-                authData: authData,
-                preMutationRow,
-            });
-            try {
-                const res = input.fetch({});
-                for (const _ of res) {
-                    // if any row is returned at all, the
-                    // rule passes.
-                    return true;
-                }
-            }
-            finally {
-                input.destroy();
-            }
-        }
-        // no rows returned by any rules? The policy fails.
-        return false;
-    }
-}
-//# sourceMappingURL=write-authorizer.js.map

package/out/zero-cache/src/services/mutagen/write-authorizer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"write-authorizer.js","sourceRoot":"","sources":["../../../../../../zero-cache/src/services/mutagen/write-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,UAAU,EAAC,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAC,MAAM,EAAC,MAAM,SAAS,CAAC;AAC/B,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAC,GAAG,EAAC,MAAM,cAAc,CAAC;AACjC,OAAO,EAAC,MAAM,EAAC,MAAM,mCAAmC,CAAC;AAEzD,OAAO,EAAC,OAAO,EAAC,MAAM,gCAAgC,CAAC;AACvD,OAAO,KAAK,CAAC,MAAM,kCAAkC,CAAC;AAQtD,OAAO,EACL,qBAAqB,GAEtB,MAAM,8CAA8C,CAAC;AAEtD,OAAO,EAAC,aAAa,EAAC,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAC,QAAQ,EAAC,MAAM,8BAA8B,CAAC;AACtD,OAAO,EAAC,OAAO,EAAE,GAAG,EAAC,MAAM,wCAAwC,CAAC;AACpE,OAAO,EAAC,WAAW,EAAC,MAAM,wCAAwC,CAAC;AAEnE,OAAO,EAAC,UAAU,EAAC,MAAM,yBAAyB,CAAC;AACnD,OAAO,EAAC,+BAA+B,EAAC,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAC,eAAe,EAAC,MAAM,oCAAoC,CAAC;AAEnE,OAAO,EAAC,SAAS,EAAC,MAAM,mCAAmC,CAAC;AAK5D,OAAO,EAAC,eAAe,EAAC,MAAM,wBAAwB,CAAC;AASvD,MAAM,OAAO,mBAAmB;IACrB,oBAAoB,CAAsB;IAC1C,QAAQ,CAAW;IACnB,gBAAgB,CAAkB;IAClC,WAAW,CAAmC;IAC9C,OAAO,GAAG,IAAI,GAAG,EAAuB,CAAC;IACzC,gBAAgB,CAAkB;IAClC,GAAG,CAAa;IAEzB,YACE,EAAc,EACd,MAA2C,EAC3C,aAA8C,EAC9C,OAAiB,EACjB,IAAY;QAEZ,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC1D,IAAI,CAAC,oBAAoB,GAAG,aAAa,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,IAAI,MAAM,EAAE,CAAC;QAClD,MAAM,iBAAiB,GAAG,eAAe,CAAC,MAAM,CAC9C,EAAE,EACF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,GAAG,IAAI,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,CACjE,CAAC;QACF,MAAM,SAAS,GAAG,iBAAiB,CAAC,wBAAwB,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,gBAAgB,GAAG;YACtB,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACxC,aAAa,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE;SAC/C,CAAC;QACF,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CACxB,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAC9D,CAAC;QACF,IAAI,CAAC,gBAAgB,GAAG,IAAI,eAAe,CAAC,OAAO,CAAC,CAAC;IACvD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,SAAS,CAAC,QAAoB,EAAE,EAAY;QAC1C,MAAM,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,cAAc,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;gBAC9B,EAAE,EAAE,QAAQ;gBACZ,SAAS,EAAE,EAAE,CAAC,SAAS;gBACvB,UAAU,EAAE,EAAE,CAAC,UAAU;gBACzB,KAAK,EAAE,EAAE,CAAC,KAAK;aAChB,CAAC,CAAC;QACL,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE;YAC9B,EAAE,EAAE,QAAQ;YACZ,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,UAAU,EAAE,EAAE,CAAC,UAAU;YACzB,KAAK,EAAE,EAAE,CAAC,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,UAAU,CAAC,SAAiB;QAC1B,IAAI,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACzC,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,SAAS,SAAS,YAAY,CAAC,CAAC;QAClD,CAAC;QACD,MAAM,EAAC,OAAO,EAAE,UAAU,EAAC,GAAG,SAAS,CAAC;QACxC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,GAAG,IAAI,WAAW,CACtB,IAAI,CAAC,QAAQ,EACb,SAAS,EACT,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,EAAC,QAAQ,EAAC,CAAC,EAAE,EAAE,CAAC;YAClD,IAAI;YACJ,+BAA+B,CAAC,QAAQ,CAAC;SAC1C,CAAC,CACH,EACD,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACxC,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAEpC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,WAAW,CACT,MAAS,EACT,QAAoB,EACpB,EAAkB;QAElB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9C,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CACb,SAAS,EACT,MAAM,EACN,WAAW,EACX,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,EACzB,YAAY,EACZ,EAAE,CAAC,SAAS,EACZ,aAAa,EACb,EAAE,CAAC,UAAU,CACd,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,MAAM,CACJ,MAAS,EACT,QAAoB,EACpB,EAAkB;QAElB,MAAM,KAAK,GAAG,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,cAA+B,CAAC;QACpC,IAAI,EAAE,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACvB,cAAc,GAAG,IAAI,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,WAAW,GAAG,KAAK,CAAC,GAAG,CAAC;QAC9B,IACE,WAAW;YACX,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,EAClE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC;QAChC,IAAI,YAAY,EAAE,CAAC;YACjB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC5D,IAAI,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;oBAC1D,8DAA8D;oBAC9D,oBAAoB;oBACpB,SAAS;gBACX,CAAC;gBACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,EAAE,CAAC;oBAClE,OAAO,KAAK,CAAC;gBACf,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,kBAAkB,CAAC,EAAkC;QACnD,MAAM,EAAC,KAAK,EAAC,GAAG,EAAE,CAAC;QACnB,MAAM,UAAU,GAAe,EAAE,CAAC;QAClC,MAAM,MAAM,GAAsB,EAAE,CAAC;QACrC,KAAK,MAAM,EAAE,IAAI,EAAE,CAAC,UAAU,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAA,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YACzC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAC9B,OAAO,CACL,GAAG,CAAA,iBAAiB,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,IAAI,CAC3D,UAAU,EACV,GAAG,CAAA,OAAO,CACX,EAAE,CACJ,EACD,GAAG,MAAM,CACV,CAAC;IACJ,CAAC;IAED,aAAa,CACX,MAA0B,EAC1B,QAAoB,EACpB,cAA+B;QAE/B,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE;gBACvD,QAAQ,EAAE,QAAqC;gBAC/C,cAAc;aACf,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;gBAC5B,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;oBACpB,qCAAqC;oBACrC,eAAe;oBACf,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,CAAC;QACH,CAAC;QAED,mDAAmD;QACnD,OAAO,KAAK,CAAC;IACf,CAAC;CACF"}