@sequenceholdings/orm 0.1.1 → 0.1.2

package/templates/orm-namespace/graphql/example/queries.ts

@@ -0,0 +1,56 @@
+/**
+ * Handwritten GraphQL operations. `seq-studio orm apply` compiles every
+ * exported document at push time; the wire carries only `{ op: <hash>,
+ * variables }` — never query text, never SQL. Type names come from the
+ * generated `schema.graphql` (`seq-studio orm generate`).
+ *
+ * Gate an operation with `@requires(capability: "…")` or
+ * `@requires(role: "…")` — checked before execution, on top of the
+ * table policies that are always compiled in.
+ */
+
+export const GetOpenDeals = /* GraphQL */ `
+  query GetOpenDeals($status: DealStatus!) @requires(capability: "deals-read") {
+    deals(where: { status: { _eq: $status } }, orderBy: [{ createdAt: DESC }], limit: 20) {
+      id
+      title
+      amount
+      author {
+        name
+        email
+      }
+      comments(limit: 3, orderBy: [{ createdAt: DESC }]) {
+        id
+        body
+      }
+    }
+  }
+`
+
+/**
+ * Policy-bounded dynamic arguments (§4f): the filter tree is built by the
+ * caller at runtime, validated against the schema-derived whitelist, and
+ * always AND-ed with the table's read policy — clients can only narrow
+ * within policy-visible rows.
+ */
+export const SearchDeals = /* GraphQL */ `
+  query SearchDeals($where: DealBoolExp, $orderBy: [DealOrderBy!], $limit: Int)
+  @requires(capability: "deals-read") {
+    deals(where: $where, orderBy: $orderBy, limit: $limit) {
+      id
+      title
+      status
+      amount
+    }
+  }
+`
+
+export const AddComment = /* GraphQL */ `
+  mutation AddComment($dealId: uuid!, $body: String!) {
+    insertCommentsOne(object: { dealId: $dealId, body: $body }) {
+      id
+      body
+      createdAt
+    }
+  }
+`

package/templates/orm-namespace/package.json

@@ -0,0 +1,24 @@
+{
+  "name": "my-namespace",
+  "private": true,
+  "type": "module",
+  "scripts": {
+    "validate": "seq-studio orm validate",
+    "generate": "seq-studio orm generate",
+    "diff": "seq-studio orm diff",
+    "apply": "seq-studio orm apply",
+    "type-check": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@apollo/client": "^3.11.0",
+    "@sequenceholdings/orm": "^2.0.0",
+    "graphql": "^16.11.0"
+  },
+  "devDependencies": {
+    "@graphql-codegen/cli": "^5.0.7",
+    "typescript": "^5.6.0"
+  },
+  "engines": {
+    "node": ">=20"
+  }
+}

package/templates/orm-namespace/schema/tables.ts

@@ -0,0 +1,71 @@
+import { defineEnum, defineTable, t, toMany, toOne, toPlatformUser } from '@sequenceholdings/orm'
+
+/**
+ * Tables are TypeScript, but they SERIALIZE to data — the server never runs
+ * this file. Property names are camelCase and become snake_case Postgres
+ * columns (`authorSub` → `author_sub`); pass a string to the builder to
+ * override (`t.text('legacy_name')`).
+ *
+ * Every table carries its own row-level policies. The policy DSL:
+ *   - `claim('sub')` / `claim('org')` — the caller's identity claims
+ *   - `capability('x')` / `role('y')` — boolean grants, resolved per caller
+ *   - `exists(link, <predicate>)` — traverse a declared link
+ *   - variants: `default` applies to everyone; each variant WIDENS access
+ *     when its `when` guard matches (permissive union — grants only ever
+ *     widen, never narrow).
+ */
+export const dealStatus = defineEnum('deal_status', ['open', 'won', 'lost'])
+
+export const deals = defineTable(
+  'deals',
+  {
+    id: t.uuid().primaryKey().default('gen_random_uuid()'),
+    title: t.text().notNull(),
+    status: t.enum(dealStatus).notNull().default('open'),
+    amount: t.numeric(),
+    org: t.text().notNull().description('Organization the deal belongs to'),
+    authorSub: t.text().notNull().description('Auth0 sub of the creator'),
+    createdAt: t.timestamptz().notNull().default('now()'),
+  },
+  {
+    description: 'Deals owned by their author, readable org-wide with the deals-read capability',
+    indexes: [{ columns: ['org'] }, { columns: ['authorSub'] }],
+    links: {
+      comments: toMany(() => comments, { on: 'dealId' }),
+      author: toPlatformUser({ on: 'authorSub' }),
+    },
+    policies: {
+      read: {
+        default: "author_sub = claim('sub')",
+        variants: [
+          { when: "capability('deals-read')", policy: "org = claim('org')" },
+          { when: "role('deal-manager')", allow: true },
+        ],
+      },
+      write: "author_sub = claim('sub')",
+    },
+  },
+)
+
+export const comments = defineTable(
+  'comments',
+  {
+    id: t.uuid().primaryKey().default('gen_random_uuid()'),
+    dealId: t.uuid().notNull(),
+    body: t.text().notNull(),
+    authorSub: t.text().notNull(),
+    createdAt: t.timestamptz().notNull().default('now()'),
+  },
+  {
+    description: 'Comments on deals — visibility follows the parent deal',
+    indexes: [{ columns: ['dealId'] }],
+    links: {
+      deal: toOne(() => deals, { on: 'dealId' }),
+      author: toPlatformUser({ on: 'authorSub' }),
+    },
+    policies: {
+      read: "exists(deal, org = claim('org'))",
+      write: "author_sub = claim('sub')",
+    },
+  },
+)

package/templates/orm-namespace/sequence.config.ts

@@ -0,0 +1,32 @@
+import { defineNamespace } from '@sequenceholdings/orm'
+
+/**
+ * The namespace config — exactly one per directory.
+ *
+ * Capabilities and roles are DECLARED here (verbatim custom-roles grammar);
+ * who HOLDS them is granted later in the Permissions UI (FGA), never in code.
+ * Table policies reference them with `capability('…')` / `role('…')`.
+ */
+export default defineNamespace({
+  // Rename me: the namespace becomes your Postgres schema (orm_<namespace>).
+  namespace: 'my_namespace',
+  description: 'Describe what this namespace stores and who uses it.',
+  capabilities: {
+    roles: {
+      definitions: {
+        'deal-manager': {
+          description: 'Full access to every deal in the namespace',
+          default: false,
+          inherits: [],
+          grants: ['deals-read'],
+        },
+      },
+      capabilities: {
+        'deals-read': {
+          description: 'Read all deals in the caller org (instead of author-only)',
+        },
+      },
+    },
+    uses: [],
+  },
+})

package/templates/orm-namespace/tsconfig.json

@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "ESNext",
+    "moduleResolution": "bundler",
+    "lib": ["ES2022", "DOM"],
+    "strict": true,
+    "noEmit": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "isolatedModules": true
+  },
+  "include": ["sequence.config.ts", "codegen.ts", "schema", "graphql", "generated"]
+}