@sequenceholdings/orm 2.2.0 → 2.3.0

package/dist/cli.cjs

@@ -1429,14 +1429,20 @@ function requiredArtifactIrVersion(operations) {
 var CLAIMS_CONTRACT = {
   sub: "string",
   org: "string?",
+  ext_subject: "string?",
+  ext_email: "string?",
   roles: "string[]",
   capabilities: "string[]"
 };
+var EXTERNAL_POLICY_CLAIM_KEYS = ["ext_subject", "ext_email"];
+function isExternalPolicyClaimKey(key) {
+  return EXTERNAL_POLICY_CLAIM_KEYS.includes(key);
+}
 var scalarLiteral = zod.z.union([zod.z.string(), zod.z.number(), zod.z.boolean(), zod.z.null()]);
 var valueIrSchema = zod.z.discriminatedUnion("kind", [
   zod.z.object({ kind: zod.z.literal("literal"), value: zod.z.union([scalarLiteral, zod.z.array(scalarLiteral)]) }),
   zod.z.object({ kind: zod.z.literal("variable"), name: zod.z.string() }),
-  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org"]) })
+  zod.z.object({ kind: zod.z.literal("claim"), key: zod.z.enum(["sub", "org", ...EXTERNAL_POLICY_CLAIM_KEYS]) })
 ]);
 var CMP_OPS = [
   "eq",
@@ -2353,6 +2359,7 @@ var PolicyCompiler = class {
       case "or":
         return { kind: node.kind, operands: node.operands.map((operand) => this.compile(operand, table, depth)) };
       case "not":
+        assertNoNegatedExternalClaim(node.operand);
         return { kind: "not", operand: this.compile(node.operand, table, depth) };
       case "capability":
         return { kind: "capability", key: node.key };
@@ -2432,6 +2439,9 @@ var PolicyCompiler = class {
         columnCandidates(info)
       );
     }
+    if (valueSide.kind === "claim" && isExternalPolicyClaimKey(valueSide.key)) {
+      assertExternalClaimComparison({ op, key: valueSide.key, column: info.columns.find((c) => c.name === column) });
+    }
     let cmp = this.buildCmp(op, column, valueSide);
     for (let i = links.length - 1; i >= 0; i -= 1) {
       cmp = { kind: "exists", link: links[i].name, where: cmp };
@@ -2452,6 +2462,33 @@ var PolicyCompiler = class {
     return { kind: "cmp", op: CMP_BY_OP[op], column, value };
   }
 };
+function assertExternalClaimComparison({ op, key, column }) {
+  if (op !== "=") {
+    throw new PolicyCompileError(
+      `claim('${key}') supports = comparisons only, got '${op}'`,
+      "unsupported-comparison"
+    );
+  }
+  if (column?.type !== "text") {
+    const actual = column?.type === void 0 ? "of unknown type" : typeof column.type === "string" ? column.type : "an enum";
+    throw new PolicyCompileError(
+      `claim('${key}') is text and compares to a text column only \u2014 '${column?.name ?? "?"}' is ${actual}`,
+      "claim-type-mismatch"
+    );
+  }
+}
+function assertNoNegatedExternalClaim(operand) {
+  walkPolicy(operand, (node) => {
+    if (node.kind !== "compare") return;
+    const claim = [node.left, node.right].find((side) => side.kind === "claim" && isExternalPolicyClaimKey(side.key));
+    if (claim?.kind === "claim") {
+      throw new PolicyCompileError(
+        `claim('${claim.key}') cannot appear under not(): a negated borrower comparison admits other borrowers' rows`,
+        "unsupported-comparison"
+      );
+    }
+  });
+}
 function compilePredicateV2({ expression, table, resolver, maxLinkDepth }) {
   const parsed = typeof expression === "string" ? parsePolicy(expression) : expression;
   const compiler = new PolicyCompiler({ resolver, maxLinkDepth: maxLinkDepth ?? POLICY_MAX_LINK_DEPTH });