@soulbatical/tetra-dev-toolkit 1.15.0 → 1.15.1

package/bin/tetra-migration-lint.js

@@ -48,7 +48,9 @@ const RULES = [
       const authWhitelist = [
         'auth_org_id', 'auth_uid', 'auth_role', 'auth_user_role',
         'auth_admin_organizations', 'auth_user_id', 'requesting_user_id',
-        'get_auth_org_id', 'get_current_user_id'
+        'get_auth_org_id', 'get_current_user_id',
+        'auth_user_organizations', 'auth_creator_organizations',
+        'auth_organization_id', 'auth_is_admin', 'auth_is_superadmin'
       ]
       return !authWhitelist.includes(funcName)
     },
@@ -74,9 +76,22 @@ const RULES = [
     pattern: /DROP\s+POLICY\s+(?:IF\s+EXISTS\s+)?["']?(\w+)["']?\s+ON\s+(?:public\.)?(\w+)/gi,
     message: (match) => `DROP POLICY "${match[1]}" on "${match[2]}" — removes security. Ensure a replacement policy exists in the same migration.`,
     test: (match, fullContent) => {
+      const table = match[2]
       // OK if there's a CREATE POLICY in the same migration for the same table
-      const createPattern = new RegExp(`CREATE\\s+POLICY.*ON\\s+(?:public\\.)?${match[2]}`, 'i')
-      return !createPattern.test(fullContent)
+      const createPattern = new RegExp(`CREATE\\s+POLICY.*ON\\s+(?:public\\.)?${table}`, 'i')
+      if (createPattern.test(fullContent)) return false
+      // OK if there's a DO $$ block that references the table (dynamic policy creation)
+      const doBlockPattern = new RegExp(`DO\\s+\\$\\$[\\s\\S]*?['"]${table}['"][\\s\\S]*?\\$\\$`, 'i')
+      if (doBlockPattern.test(fullContent)) return false
+      // OK if DROP POLICY IF EXISTS (safe — only drops if present)
+      const dropIfExists = new RegExp(`DROP\\s+POLICY\\s+IF\\s+EXISTS`, 'i')
+      const matchStr = match[0]
+      if (dropIfExists.test(matchStr)) {
+        // Check if ANY policy creation exists for this table (even dynamic)
+        const anyCreate = new RegExp(`(CREATE\\s+POLICY|EXECUTE\\s+format.*CREATE\\s+POLICY)`, 'i')
+        if (anyCreate.test(fullContent)) return false
+      }
+      return true
     },
     fix: (match) => `-- Add replacement policy:\n-- CREATE POLICY "${match[1]}" ON ${match[2]} FOR ALL USING (organization_id = auth_org_id());`
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@soulbatical/tetra-dev-toolkit",
-  "version": "1.15.0",
+  "version": "1.15.1",
   "publishConfig": {
     "access": "restricted"
   },