@sixb/core 0.1.7 → 0.1.9

package/src/objects/execution.ts

@@ -1,8 +1,13 @@
-import { assertAuthorized, isAllowed } from "../authorization"
+import { shareSixbErrorReporter } from "../error-reporting/capability"
 import type { ExecutionContext } from "../execution"
+import {
+  assertAuthorizedObjectReaderBinding,
+  getAuthorizedOntologyView,
+} from "../execution/authorized-object-reader"
 import type { ValueType } from "../ontology"
-import { assertObjectTypeRegistered } from "../ontology"
 import type { ObjectTypeWithPropertyTokens } from "../ontology/tokens"
+import { assertObjectTypeRegistered } from "../ontology/validation/properties"
+import { shareOntologyMutationRuntime } from "../runtime/ontology-mutations"
 import type {
   ListResult,
   ObjectByIdHandle,
@@ -20,27 +25,22 @@ import type {
   TimeseriesHistoryBatchResult,
   TimeseriesPoint,
 } from "../storage"
-import {
-  countObjects,
-  type ExecuteObjectCountInput,
-  type ExecuteObjectCountResult,
-  type ExecuteObjectExistsInput,
-  type ExecuteObjectExistsResult,
-  type ExecuteObjectFacetsInput,
-  type ExecuteObjectFacetsResult,
-  type ExecuteObjectQueryInput,
-  type ExecuteObjectQueryLinksInput,
-  type ExecuteObjectQueryLinksResult,
-  type ExecuteObjectQueryResult,
-  executeObjectQuery,
-  executeObjectQueryLinks,
-  existsObjects,
-  facetObjects,
+import type {
+  ExecuteObjectCountInput,
+  ExecuteObjectCountResult,
+  ExecuteObjectExistsInput,
+  ExecuteObjectExistsResult,
+  ExecuteObjectFacetsInput,
+  ExecuteObjectFacetsResult,
+  ExecuteObjectQueryInput,
+  ExecuteObjectQueryLinksInput,
+  ExecuteObjectQueryLinksResult,
+  ExecuteObjectQueryResult,
 } from "./query"
 import { createObjectSet } from "./sdk"
 import type { ListObjectsParams } from "./service"
 import * as objectService from "./service"
-import { getTelemetryHistoryBatch } from "./telemetry"
+import { getLatestTelemetryPoint, getTelemetryHistoryBatch } from "./telemetry"
 
 export interface ExecutionObjectOperations {
   listTypes(): readonly ObjectTypeWithPropertyTokens[]
@@ -173,124 +173,69 @@ export function createObjectsRuntime<TOntologySources extends readonly OntologyS
   runtime: SixbRuntimeContext,
   execution: ExecutionContext
 ): ObjectsRuntime<TOntologySources> {
+  const runtimeAuthorization = runtime.runtimeAuthorization
+  const objectReader = runtime.objectReader
+  assertAuthorizedObjectReaderBinding({
+    reader: objectReader,
+    scope: { execution, authorization: runtimeAuthorization },
+  })
+  const authorization = runtime.authorization
+  const capturedRuntime: SixbRuntimeContext = {
+    projectId: runtime.projectId,
+    broker: runtime.broker,
+    ontology: runtime.ontology,
+    actionRegistry: runtime.actionRegistry,
+    events: runtime.events,
+    storage: runtime.storage,
+    queues: runtime.queues,
+    runtimeAuthorization,
+    objectReader,
+    ...(authorization === undefined ? {} : { authorization }),
+  }
+  shareOntologyMutationRuntime(runtime, capturedRuntime)
+  shareSixbErrorReporter(runtime, capturedRuntime)
+  Object.freeze(capturedRuntime)
+  const ontologyView = () => getAuthorizedOntologyView(objectReader)
   const objects = Object.assign(
     <TObjectType extends RegisteredObjectType<TOntologySources>>(objectType: TObjectType) => {
-      assertObjectTypeRegistered(runtime.ontology.getObjectTypesById(), objectType)
+      assertObjectTypeRegistered(capturedRuntime.ontology.getObjectTypesById(), objectType)
       return createObjectSet<
         TObjectType,
         RegisteredObjectType<TOntologySources>,
         RegisteredValueTypes<TOntologySources>
-      >({ ...runtime, execution, objectType }) as ExecutionObjectSet<
+      >({ ...capturedRuntime, execution, objectType }) as ExecutionObjectSet<
         TObjectType,
         RegisteredValueTypes<TOntologySources>,
         RegisteredObjectType<TOntologySources>
       >
     },
     {
-      listTypes: () =>
-        runtime.ontology.listObjectTypes().filter((objectType) =>
-          isAllowed(runtime.authorization, {
-            kind: "object.view",
-            objectTypeId: objectType.id,
-          })
-        ),
-      getTypeById: (objectTypeId: string) => {
-        const objectType = runtime.ontology.getObjectTypeById(objectTypeId)
-        return objectType && isAllowed(runtime.authorization, { kind: "object.view", objectTypeId })
-          ? objectType
-          : null
-      },
-      resolveType: (objectTypeId: string) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-        return runtime.ontology.resolveObjectType(objectTypeId)
-      },
-      getValueTypesById: () => runtime.ontology.getValueTypesById(),
-      listSubTypes: (objectTypeId: string) => runtime.ontology.listSubTypes(objectTypeId),
+      listTypes: () => ontologyView().listObjectTypes(),
+      getTypeById: (objectTypeId: string) => ontologyView().getObjectTypeById(objectTypeId),
+      resolveType: (objectTypeId: string) => ontologyView().resolveObjectType(objectTypeId),
+      getValueTypesById: () => ontologyView().getValueTypesById(),
+      listSubTypes: (objectTypeId: string) => ontologyView().listSubTypes(objectTypeId),
       isValidLinkTarget: (expected: string | string[], actual: string) =>
-        runtime.ontology.isValidLinkTarget(expected, actual),
+        ontologyView().isValidLinkTarget(expected, actual),
       executeQuery: (input: Omit<ExecuteObjectQueryInput, "projectId">) =>
-        executeObjectQuery(
-          { projectId: runtime.projectId, ...input },
-          {
-            ontology: runtime.ontology,
-            storage: runtime.storage.objects,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
-      queryLinks: (input: ObjectQueryLinksInput) =>
-        executeObjectQueryLinks(
-          { projectId: runtime.projectId, ...input },
-          {
-            ontology: runtime.ontology,
-            storage: runtime.storage.objects,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
-      count: (input: Omit<ExecuteObjectCountInput, "projectId">) =>
-        countObjects(
-          { projectId: runtime.projectId, ...input },
-          {
-            ontology: runtime.ontology,
-            storage: runtime.storage.objects,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
-      exists: (input: Omit<ExecuteObjectExistsInput, "projectId">) =>
-        existsObjects(
-          { projectId: runtime.projectId, ...input },
-          {
-            ontology: runtime.ontology,
-            storage: runtime.storage.objects,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
-      facet: (input: Omit<ExecuteObjectFacetsInput, "projectId">) =>
-        facetObjects(
-          { projectId: runtime.projectId, ...input },
-          {
-            ontology: runtime.ontology,
-            storage: runtime.storage.objects,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
+        objectReader.executeQuery(input),
+      queryLinks: (input: ObjectQueryLinksInput) => objectReader.queryLinks(input),
+      count: (input: Omit<ExecuteObjectCountInput, "projectId">) => objectReader.count(input),
+      exists: (input: Omit<ExecuteObjectExistsInput, "projectId">) => objectReader.exists(input),
+      facet: (input: Omit<ExecuteObjectFacetsInput, "projectId">) => objectReader.facet(input),
       listLinks: async (input: {
         objectTypeId: string
         objectId: string
         linkId?: string
         direction?: LinkDirection
       }) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
-        const links = await runtime.storage.objects.listLinks({
-          projectId: runtime.projectId,
-          ...input,
-        })
-        return links.filter(
-          (link) =>
-            isAllowed(runtime.authorization, {
-              kind: "object.view",
-              objectTypeId: link.sourceTypeId,
-            }) &&
-            isAllowed(runtime.authorization, {
-              kind: "object.view",
-              objectTypeId: link.targetTypeId,
-            })
-        )
+        return objectReader.listLinks(input)
       },
-      getTelemetryHistoryBatch: (input: Omit<TimeseriesHistoryBatchInput, "projectId">) =>
-        getTelemetryHistoryBatch(
-          { projectId: runtime.projectId, ...input },
-          {
-            storage: runtime.storage.timeseries,
-            runtimeAuthorization: runtime.runtimeAuthorization,
-            authorization: runtime.authorization,
-          }
-        ),
-      getTelemetryHistory: (input: {
+      getTelemetryHistoryBatch: (input: Omit<TimeseriesHistoryBatchInput, "projectId">) => {
+        const timeseries = capturedRuntime.storage.timeseries
+        return getTelemetryHistoryBatch(input, { storage: timeseries, objectReader })
+      },
+      getTelemetryHistory: async (input: {
         objectTypeId: string
         objectId: string
         propertyId: string
@@ -299,48 +244,58 @@ export function createObjectsRuntime<TOntologySources extends readonly OntologyS
         limit?: number
         order?: "asc" | "desc"
       }) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
-        return runtime.storage.timeseries.getHistory({
-          projectId: runtime.projectId,
-          ...input,
-        })
+        const timeseries = capturedRuntime.storage.timeseries
+        const objectTypeId = input.objectTypeId
+        const objectId = input.objectId
+        const propertyId = input.propertyId
+        const from = input.from
+        const to = input.to
+        const limit = input.limit
+        const order = input.order
+        const [result] = await getTelemetryHistoryBatch(
+          {
+            series: [{ objectTypeId, objectId, propertyId }],
+            ...(from === undefined ? {} : { from }),
+            ...(to === undefined ? {} : { to }),
+            ...(limit === undefined ? {} : { limitPerSeries: limit }),
+            ...(order === undefined ? {} : { order }),
+          },
+          { storage: timeseries, objectReader }
+        )
+        return result?.points ?? []
       },
-      getLatestTelemetry: (input: {
+      getLatestTelemetry: async (input: {
         objectTypeId: string
         objectId: string
         propertyId: string
       }) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId: input.objectTypeId })
-        return runtime.storage.timeseries.getLatest({
-          projectId: runtime.projectId,
-          ...input,
-        })
-      },
-      list: (params: ListObjectsParams) => objectService.listObjects(runtime, params),
-      get: async (objectTypeId: string, primaryId: string) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-        return runtime.storage.objects.getByPrimaryId({
-          projectId: runtime.projectId,
-          objectTypeId,
-          primaryId,
-        })
+        const timeseries = capturedRuntime.storage.timeseries
+        const objectTypeId = input.objectTypeId
+        const objectId = input.objectId
+        const propertyId = input.propertyId
+        return getLatestTelemetryPoint(
+          { objectTypeId, objectId, propertyId },
+          { storage: timeseries, objectReader }
+        )
       },
+      list: (params: ListObjectsParams) => objectService.listObjects(capturedRuntime, params),
+      get: (objectTypeId: string, primaryId: string) =>
+        objectReader.getByPrimaryId({ objectTypeId, primaryId }),
       getPrimaryPropertyId: (objectTypeId: string) => {
-        assertAuthorized(runtime, { kind: "object.view", objectTypeId })
-        return runtime.ontology.getPrimaryPropertyId(objectTypeId)
+        return ontologyView().getPrimaryPropertyId(objectTypeId)
       },
       upsert: (objectTypeId: string, properties: Record<string, unknown>) =>
-        objectService.upsertObject(runtime, objectTypeId, properties),
+        objectService.upsertObject(capturedRuntime, objectTypeId, properties),
       upsertBatch: (
         objectTypeId: string,
         items: readonly { properties: Record<string, unknown> }[]
-      ) => objectService.upsertObjectBatch(runtime, objectTypeId, items),
+      ) => objectService.upsertObjectBatch(capturedRuntime, objectTypeId, items),
       upsertLink: (
         objectTypeId: string,
         sourceId: string,
         linkId: string,
         target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
-      ) => objectService.upsertLink(runtime, objectTypeId, sourceId, linkId, target),
+      ) => objectService.upsertLink(capturedRuntime, objectTypeId, sourceId, linkId, target),
       upsertLinkBatch: (
         items: readonly {
           objectTypeId: string
@@ -348,17 +303,17 @@ export function createObjectsRuntime<TOntologySources extends readonly OntologyS
           linkId: string
           target: { targetTypeId: string; targetId: string; properties?: Record<string, unknown> }
         }[]
-      ) => objectService.upsertLinkBatch(runtime, items),
+      ) => objectService.upsertLinkBatch(capturedRuntime, items),
       removeLink: (
         objectTypeId: string,
         sourceId: string,
         linkId: string,
         target: { targetTypeId: string; targetId: string }
-      ) => objectService.removeLink(runtime, objectTypeId, sourceId, linkId, target),
+      ) => objectService.removeLink(capturedRuntime, objectTypeId, sourceId, linkId, target),
       appendTelemetry: (
         objectTypeId: string,
         items: readonly { id: string; properties: Record<string, unknown>; at?: Date }[]
-      ) => objectService.appendTelemetry(runtime, objectTypeId, items),
+      ) => objectService.appendTelemetry(capturedRuntime, objectTypeId, items),
     }
   )
 

package/src/objects/link/authorization.ts

@@ -1,7 +1,8 @@
 /**
  * The authorization rule for writing a link, in one place because all three link leaves need it.
  */
-import { type AuthorizationContext, assertAuthorized, assertCanEdit } from "../../authorization"
+import { assertAuthorized, assertCanEdit } from "../../authorization"
+import type { SixbRuntimeContext } from "../../runtime/types"
 
 /**
  * Assert a principal may create or remove a link.
@@ -18,7 +19,7 @@ import { type AuthorizationContext, assertAuthorized, assertCanEdit } from "../.
  * Call this *before* any endpoint lookup, for that second reason.
  */
 export function assertCanWriteLink(
-  ctx: { readonly authorization?: AuthorizationContext },
+  ctx: Pick<SixbRuntimeContext, "projectId" | "runtimeAuthorization" | "authorization">,
   endpoints: { readonly sourceTypeId: string; readonly targetTypeId: string }
 ): void {
   assertCanEdit(ctx, endpoints.sourceTypeId)

package/src/objects/query/executor.ts

@@ -10,14 +10,13 @@ import type {
   ObjectBatchKey,
   ObjectFacetRequest,
   ObjectFacetResult,
-  ObjectLinkRow,
   ObjectQueryCapabilities,
+  ObjectReadStorage,
   ObjectRow,
   ObjectRowLinks,
-  ObjectStorage,
   QueryObjectsResult,
 } from "../../storage"
-import { linkBatchKey, objectBatchKey } from "../../storage"
+import { linkBatchKey, MAX_OBJECT_READ_FACETS, objectBatchKey } from "../../storage"
 import {
   ObjectQueryExecutionError,
   ObjectQueryPlanningError,
@@ -51,7 +50,7 @@ export interface QueryExecutorOptions
     | "hasFacetObjects"
   > {
   ontology: OntologyRegistry
-  storage: ObjectStorage
+  storage: ObjectReadStorage
   maxLimit?: number
   maxPageSize?: number
   maxRefs?: number
@@ -138,7 +137,7 @@ export async function executeObjectQuery(
     maxRefs: options.maxRefs,
     normalize: false,
   })
-  assertQueryViewable(validated, options)
+  assertQueryViewable(input.projectId, validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -206,7 +205,7 @@ export async function countObjects(
     maxRefs: options.maxRefs,
     normalize: false,
   })
-  assertQueryViewable(validated, options)
+  assertQueryViewable(input.projectId, validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -267,7 +266,7 @@ export async function existsObjects(
     maxRefs: options.maxRefs,
     normalize: false,
   })
-  assertQueryViewable(validated, options)
+  assertQueryViewable(input.projectId, validated, options)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
   const hasCountObjects = typeof options.storage.countObjects === "function"
@@ -328,8 +327,8 @@ export async function facetObjects(
     maxRefs: options.maxRefs,
     normalize: false,
   })
-  assertQueryViewable(validated, options)
-  const facets = validateFacetRequests(input.facets, validated.result.objectTypeIds, options)
+  assertQueryViewable(input.projectId, validated, options)
+  const facets = validateObjectFacetRequests(input.facets, validated.result.objectTypeIds, options)
   const aggregateQuery = stripOuterRowShape(validated.query)
   const capabilities = options.storage.queryCapabilities()
   const hasQueryObjects = typeof options.storage.queryObjects === "function"
@@ -388,16 +387,20 @@ export async function facetObjects(
 // Authorization happens at planning time: a scoped query must hold a view
 // grant for every object type it touches, before any storage call runs.
 function assertQueryViewable(
+  projectId: string,
   validated: ValidatedObjectQuery,
   authorization: Pick<QueryExecutorOptions, "authorization" | "runtimeAuthorization">
 ): void {
   // The query engine is also a storage-level utility. Authorization is activated by a runtime
   // context; execution SDKs always provide a registered capability, including auth-disabled ones.
   if (!authorization.runtimeAuthorization && !authorization.authorization) return
-  assertAuthorized(authorization, {
-    kind: "object.query",
-    touchedObjectTypeIds: validated.touchedObjectTypeIds,
-  })
+  assertAuthorized(
+    { projectId, ...authorization },
+    {
+      kind: "object.query",
+      touchedObjectTypeIds: validated.touchedObjectTypeIds,
+    }
+  )
 }
 
 interface ExpansionResolutionContext {
@@ -816,35 +819,32 @@ async function collectIncomingEdges(
   expansion: ObjectExpansion,
   options: QueryExecutorOptions
 ): Promise<ExpansionEdge[][]> {
-  const incident = await options.storage.listIncidentLinksBatch({
+  const linksByKey = await options.storage.listLinksBatch({
     projectId,
+    direction: "incoming",
     items: parents.map((parent) => ({
       objectTypeId: parent.objectTypeId,
       objectId: parent.primaryId,
+      linkId: expansion.linkId,
     })),
   })
 
-  // Index links that point AT a parent (incoming) by that parent. The incident
-  // batch also returns outgoing links, so filter on the parent being the target.
-  const byTarget = new Map<string, ObjectLinkRow[]>()
-  for (const link of incident) {
-    if (link.linkId !== expansion.linkId) continue
-    if (expansion.sourceObjectTypeId && link.sourceTypeId !== expansion.sourceObjectTypeId) continue
-    const key = targetKey(link.targetTypeId, link.targetId)
-    const bucket = byTarget.get(key)
-    if (bucket) bucket.push(link)
-    else byTarget.set(key, [link])
-  }
-
   return parents.map((parent) => {
-    const links = byTarget.get(targetKey(parent.objectTypeId, parent.primaryId))
+    const links = linksByKey.get(
+      linkBatchKey(parent.objectTypeId, parent.primaryId, expansion.linkId)
+    )
     if (!links) return []
     // For an incoming expansion the hydrated object is the link's source.
-    return links.map((link) => ({
-      neighborTypeId: link.sourceTypeId,
-      neighborId: link.sourceId,
-      edgeProperties: link.properties,
-    }))
+    return links
+      .filter(
+        (link) =>
+          !expansion.sourceObjectTypeId || link.sourceTypeId === expansion.sourceObjectTypeId
+      )
+      .map((link) => ({
+        neighborTypeId: link.sourceTypeId,
+        neighborId: link.sourceId,
+        edgeProperties: link.properties,
+      }))
   })
 }
 
@@ -1177,10 +1177,11 @@ function stripOuterRowShape(query: ObjectQuery): ObjectQuery {
   }
 }
 
-function validateFacetRequests(
+/** @internal Shared pre-storage validation; intentionally absent from query barrels. */
+export function validateObjectFacetRequests(
   facets: readonly ObjectFacetRequest[],
   objectTypeIds: readonly string[],
-  options: QueryExecutorOptions
+  options: Pick<QueryExecutorOptions, "ontology" | "maxFacetLimit">
 ): ObjectFacetRequest[] {
   const issues: ObjectQueryValidationIssue[] = []
   const maxLimit = options.maxFacetLimit ?? DEFAULT_MAX_FACET_LIMIT
@@ -1189,6 +1190,16 @@ function validateFacetRequests(
     addFacetIssue(issues, "$.facets", "empty_facets", "At least one facet is required")
   }
 
+  if (facets.length > MAX_OBJECT_READ_FACETS) {
+    throw new ObjectQueryValidationError([
+      {
+        path: "$.facets",
+        code: "too_many_facets",
+        message: `facets must include at most ${MAX_OBJECT_READ_FACETS} facet requests`,
+      },
+    ])
+  }
+
   if (!Number.isInteger(maxLimit) || maxLimit <= 0) {
     addFacetIssue(
       issues,