@stratum-hq/db-adapters 1.2.0 → 1.3.0

package/README.md

@@ -56,6 +56,16 @@ try {
 }
 ```
 
+`createPolicy` checks every row-level security policy already on the table (the table the name resolves to through the `search_path`) before it adds the `tenant_isolation` policy or keeps an existing one, and throws without changing anything if any check fails:
+
+- PostgreSQL ORs permissive policies together, so every permissive policy, whatever its name or roles, must compare `tenant_id` with the current tenant setting `app.current_tenant_id` for the commands it covers (`USING` for reads, updates and deletes; `WITH CHECK` for inserts, and for updates when set). A role-specific permissive policy counts too, because `createPolicy` cannot know which role your application connects as.
+- Restrictive policies can only narrow access, so they may check anything.
+- An existing `tenant_isolation` policy must be permissive, apply to all commands, and apply to `PUBLIC` (no `TO` clause), like the one `createPolicy` generates and every policy Stratum ships.
+
+The check recognizes the form Stratum generates, with the operands in either order, with casts, ANDed with other conditions, or ORed with Stratum's `app.bypass_rls` bypass. A policy that isolates correctly but is written in another form is also refused; replace it with the generated form. This is a breaking change for callers that relied on the old skip, shipped in a minor release.
+
+`isRLSEnabled` reports on the table that the name resolves to through the `search_path`, not on a table with the same name in another schema.
+
 Also available: `disableRLS`, `dropPolicy`, `isRLSEnabled`, `addTenantColumn`, `createIsolationPolicy`, and low-level session helpers `setTenantContext` / `resetTenantContext` / `getCurrentTenantId`. Schema-per-tenant and database-per-tenant variants (`SchemaRawAdapter`, `DatabasePoolManager`, …) are exported too.
 
 ## Schema-per-tenant search_path

package/dist/rls/manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAUpB,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAaf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CASlB"}
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AAapB,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAGf;AAED,wBAAsB,SAAS,CAC7B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,UAAU,CAC9B,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,wBAAsB,YAAY,CAChC,MAAM,EAAE,EAAE,CAAC,UAAU,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAWlB"}

package/dist/rls/manager.js

@@ -5,6 +5,8 @@ exports.dropPolicy = dropPolicy;
 exports.enableRLS = enableRLS;
 exports.disableRLS = disableRLS;
 exports.isRLSEnabled = isRLSEnabled;
+const policy_check_js_1 = require("./policy-check.js");
+const TENANT_FILTER = "tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid";
 // Validate table name to prevent SQL injection (only allows alphanumeric + underscores)
 function validateTableName(tableName) {
     if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(tableName)) {
@@ -14,11 +16,24 @@ function validateTableName(tableName) {
 }
 async function createPolicy(client, tableName) {
     const safe = validateTableName(tableName);
-    // Cannot use parameterized queries inside DO blocks or for DDL identifiers.
-    // Table name is validated via allowlist regex above.
-    const exists = await client.query(`SELECT count(*) FROM pg_policies WHERE tablename = $1 AND policyname = 'tenant_isolation'`, [safe]);
-    if (parseInt(exists.rows[0].count, 10) === 0) {
-        await client.query(`CREATE POLICY tenant_isolation ON ${safe} USING (tenant_id = NULLIF(current_setting('app.current_tenant_id', true), '')::uuid)`);
+    // Read every policy on the table that the name resolves to, in whichever
+    // schema that is. PostgreSQL ORs permissive policies together, so each one
+    // must filter by tenant, and a policy's name proves nothing.
+    const existing = await client.query(`SELECT p.policyname, p.permissive, p.cmd, p.qual, p.with_check, p.roles::text[] AS roles
+       FROM pg_policies p
+       JOIN pg_class c ON c.relname = p.tablename
+       JOIN pg_namespace n ON n.oid = c.relnamespace AND n.nspname = p.schemaname
+      WHERE c.oid = to_regclass($1)`, [safe]);
+    const issues = (0, policy_check_js_1.tablePolicyIssues)(existing.rows);
+    if (issues.length > 0) {
+        throw new Error(`[stratum] Table ${safe} has row-level security policies that do not isolate it by tenant: ` +
+            `${issues.join("; ")} (expected ${TENANT_FILTER}). ` +
+            `Drop or correct those policies, then call createPolicy again.`);
+    }
+    if (!existing.rows.some((p) => p.policyname === "tenant_isolation")) {
+        // Cannot use parameterized queries inside DO blocks or for DDL identifiers.
+        // Table name is validated via allowlist regex above.
+        await client.query(`CREATE POLICY tenant_isolation ON ${safe} USING (${TENANT_FILTER})`);
     }
 }
 async function dropPolicy(client, tableName) {
@@ -36,7 +51,9 @@ async function disableRLS(client, tableName) {
     await client.query(`ALTER TABLE ${safe} DISABLE ROW LEVEL SECURITY`);
 }
 async function isRLSEnabled(client, tableName) {
-    const res = await client.query(`SELECT relrowsecurity FROM pg_class WHERE relname = $1`, [tableName]);
+    const safe = validateTableName(tableName);
+    // The table the name resolves to, in whichever schema that is.
+    const res = await client.query(`SELECT relrowsecurity FROM pg_class WHERE oid = to_regclass($1)`, [safe]);
     if (res.rows.length === 0) {
         return false;
     }

package/dist/rls/manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":";;AAUA,oCAgBC;AAED,gCAMC;AAED,8BAOC;AAED,gCAOC;AAED,oCAYC;AAhED,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,4EAA4E;IAC5E,qDAAqD;IACrD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAC/B,2FAA2F,EAC3F,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,MAAM,MAAM,CAAC,KAAK,CAChB,qCAAqC,IAAI,uFAAuF,CACjI,CAAC;IACJ,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,8BAA8B,CAAC,CAAC;IACtE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,wDAAwD,EACxD,CAAC,SAAS,CAAC,CACZ,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACpC,CAAC"}
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../src/rls/manager.ts"],"names":[],"mappings":";;AAaA,oCA6BC;AAED,gCAMC;AAED,8BAOC;AAED,gCAOC;AAED,oCAcC;AAnFD,uDAAsE;AAEtE,MAAM,aAAa,GAAG,8EAA8E,CAAC;AAErG,wFAAwF;AACxF,SAAS,iBAAiB,CAAC,SAAiB;IAC1C,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,yEAAyE;IACzE,2EAA2E;IAC3E,6DAA6D;IAC7D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,CACjC;;;;oCAIgC,EAChC,CAAC,IAAI,CAAC,CACP,CAAC;IACF,MAAM,MAAM,GAAG,IAAA,mCAAiB,EAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,qEAAqE;YAC1F,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,aAAa,KAAK;YACpD,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,kBAAkB,CAAC,EAAE,CAAC;QACpE,4EAA4E;QAC5E,qDAAqD;QACrD,MAAM,MAAM,CAAC,KAAK,CAAC,qCAAqC,IAAI,WAAW,aAAa,GAAG,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;AAC1E,CAAC;AAEM,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,4BAA4B,CAAC,CAAC;IACpE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,2BAA2B,CAAC,CAAC;AACrE,CAAC;AAEM,KAAK,UAAU,UAAU,CAC9B,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,8BAA8B,CAAC,CAAC;IACtE,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,IAAI,6BAA6B,CAAC,CAAC;AACvE,CAAC;AAEM,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,+DAA+D;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACF,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC;AACpC,CAAC"}

package/dist/rls/policy-check.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Decides whether the row-level security policies on a table restrict rows to
+ * the current tenant, from the expressions PostgreSQL stores in pg_policies.
+ *
+ * `createPolicy` uses this before it keeps an existing tenant_isolation policy
+ * or adds one, because a policy's name proves nothing about what it checks, and
+ * PostgreSQL ORs permissive policies together: one permissive policy that does
+ * not filter by tenant opens the table whatever tenant_isolation says.
+ *
+ * Rules:
+ * - Every permissive policy must filter by tenant for the commands it covers:
+ *   USING for SELECT, UPDATE, DELETE and ALL, WITH CHECK for INSERT, and WITH
+ *   CHECK for UPDATE and ALL when it is set. This applies whatever roles the
+ *   policy names, because this package cannot know which role the
+ *   application connects as.
+ * - Restrictive policies can only narrow access, so they may check anything.
+ * - The tenant_isolation policy itself must be permissive, apply to ALL
+ *   commands, and apply to PUBLIC, like the one `createPolicy` generates and
+ *   every policy Stratum ships.
+ *
+ * The check recognises the form this package generates, with the operands in
+ * either order, with casts, inside an AND with other conditions, and ORed with
+ * Stratum's administrative bypass. Anything else is reported as not filtering
+ * by tenant, so an unusual but correct policy is refused, never accepted.
+ */
+/** One row of pg_policies. */
+export interface PolicyRow {
+    policyname: string;
+    /** "PERMISSIVE" or "RESTRICTIVE". */
+    permissive: string;
+    /** "ALL", "SELECT", "INSERT", "UPDATE" or "DELETE". */
+    cmd: string;
+    qual: string | null;
+    with_check: string | null;
+    /** The roles the policy applies to; ["public"] for PUBLIC. */
+    roles: string[];
+}
+/**
+ * Every reason the table's policies do not isolate it by tenant. Empty when
+ * they do, or when the table has no policies.
+ */
+export declare function tablePolicyIssues(policies: PolicyRow[]): string[];
+//# sourceMappingURL=policy-check.d.ts.map

package/dist/rls/policy-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.d.ts","sourceRoot":"","sources":["../../src/rls/policy-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,8BAA8B;AAC9B,MAAM,WAAW,SAAS;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,qCAAqC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8DAA8D;IAC9D,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AA0JD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,MAAM,EAAE,CAgBjE"}

package/dist/rls/policy-check.js

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * Decides whether the row-level security policies on a table restrict rows to
+ * the current tenant, from the expressions PostgreSQL stores in pg_policies.
+ *
+ * `createPolicy` uses this before it keeps an existing tenant_isolation policy
+ * or adds one, because a policy's name proves nothing about what it checks, and
+ * PostgreSQL ORs permissive policies together: one permissive policy that does
+ * not filter by tenant opens the table whatever tenant_isolation says.
+ *
+ * Rules:
+ * - Every permissive policy must filter by tenant for the commands it covers:
+ *   USING for SELECT, UPDATE, DELETE and ALL, WITH CHECK for INSERT, and WITH
+ *   CHECK for UPDATE and ALL when it is set. This applies whatever roles the
+ *   policy names, because this package cannot know which role the
+ *   application connects as.
+ * - Restrictive policies can only narrow access, so they may check anything.
+ * - The tenant_isolation policy itself must be permissive, apply to ALL
+ *   commands, and apply to PUBLIC, like the one `createPolicy` generates and
+ *   every policy Stratum ships.
+ *
+ * The check recognises the form this package generates, with the operands in
+ * either order, with casts, inside an AND with other conditions, and ORed with
+ * Stratum's administrative bypass. Anything else is reported as not filtering
+ * by tenant, so an unusual but correct policy is refused, never accepted.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tablePolicyIssues = tablePolicyIssues;
+/** The session setting that holds the current tenant (see rls/session.ts). */
+const TENANT_SETTING = "app.current_tenant_id";
+/** The setting Stratum's own policies admit for administrative access. */
+const BYPASS_SETTING = "app.bypass_rls";
+/** Drops whitespace and casts, lower-cases, and keeps string literals intact. */
+function normalize(expr) {
+    let out = "";
+    for (let i = 0; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            const stop = end === -1 ? expr.length : end + 1;
+            out += expr.slice(i, stop);
+            i = stop - 1;
+        }
+        else if (!/\s/.test(ch)) {
+            out += ch.toLowerCase();
+        }
+    }
+    // Casts such as ::text, ::uuid and ::character varying (spaces already gone).
+    return out.replace(/::[a-z_]+(?:\[\])?/g, "");
+}
+/** Index of the parenthesis that closes the one at `open`. */
+function closingParen(expr, open) {
+    let depth = 0;
+    for (let i = open; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            if (end === -1)
+                return -1;
+            i = end;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0)
+                return i;
+        }
+    }
+    return -1;
+}
+/** Removes parentheses that wrap the whole expression. */
+function stripOuterParens(expr) {
+    let e = expr;
+    while (e.startsWith("(") && e.endsWith(")") && closingParen(e, 0) === e.length - 1) {
+        e = e.slice(1, -1);
+    }
+    return e;
+}
+/**
+ * Splits a normalized expression on a top-level boolean operator. Whitespace
+ * is gone, so the operator is found between a closing parenthesis and an
+ * opening one, which is how PostgreSQL prints every operand of AND / OR.
+ */
+function splitTopLevel(expr, op) {
+    const parts = [];
+    let depth = 0;
+    let start = 0;
+    for (let i = 0; i < expr.length; i++) {
+        const ch = expr[i];
+        if (ch === "'") {
+            const end = expr.indexOf("'", i + 1);
+            if (end === -1)
+                break;
+            i = end;
+        }
+        else if (ch === "(") {
+            depth++;
+        }
+        else if (ch === ")") {
+            depth--;
+            if (depth === 0 && expr.startsWith(`${op}(`, i + 1)) {
+                parts.push(expr.slice(start, i + 1));
+                start = i + 1 + op.length;
+            }
+        }
+    }
+    parts.push(expr.slice(start));
+    return parts.map(stripOuterParens);
+}
+/** Removes every parenthesis; only safe on an operand with no AND / OR in it. */
+function flatten(expr) {
+    return expr.replace(/[()]/g, "");
+}
+const SETTING_READ = `current_setting'${TENANT_SETTING.replace(".", "\\.")}'(?:,(?:true|false))?`;
+/** The current tenant, read directly or through NULLIF(..., ''). */
+const CURRENT_TENANT = `(?:nullif${SETTING_READ},''|${SETTING_READ})`;
+const TENANT_MATCH = new RegExp(`^(?:tenant_id=${CURRENT_TENANT}|${CURRENT_TENANT}=tenant_id)$`);
+const BYPASS_MATCH = new RegExp(`^current_setting'${BYPASS_SETTING.replace(".", "\\.")}'(?:,(?:true|false))?='on'$`);
+/** True when the normalized expression only admits rows of the current tenant. */
+function filtersByTenant(expr) {
+    const e = stripOuterParens(expr);
+    const disjuncts = splitTopLevel(e, "or");
+    if (disjuncts.length > 1) {
+        // Every branch must be safe; Stratum's administrative bypass is one of them.
+        return (disjuncts.every((d) => BYPASS_MATCH.test(flatten(d)) || filtersByTenant(d)) &&
+            disjuncts.some((d) => !BYPASS_MATCH.test(flatten(d))));
+    }
+    const conjuncts = splitTopLevel(e, "and");
+    if (conjuncts.length > 1) {
+        return conjuncts.some((c) => filtersByTenant(c));
+    }
+    return TENANT_MATCH.test(flatten(e));
+}
+/** An expression on one line, for messages. */
+function oneLine(expr) {
+    return expr === null ? "none" : expr.replace(/\s+/g, " ");
+}
+/** Why one permissive policy lets rows of other tenants through, or null. */
+function permissiveIssue(p) {
+    const name = `policy "${oneLine(p.policyname)}" (${p.cmd})`;
+    // INSERT policies have only WITH CHECK; SELECT and DELETE only USING. For
+    // ALL and UPDATE a missing WITH CHECK means PostgreSQL reuses USING.
+    if (p.cmd !== "INSERT") {
+        if (p.qual === null || !filtersByTenant(normalize(p.qual))) {
+            return `${name} USING (${oneLine(p.qual)}) does not filter by tenant`;
+        }
+    }
+    if (p.cmd === "INSERT" || p.with_check !== null) {
+        if (p.with_check === null || !filtersByTenant(normalize(p.with_check))) {
+            return `${name} WITH CHECK (${oneLine(p.with_check)}) does not filter by tenant`;
+        }
+    }
+    return null;
+}
+/** Why the tenant_isolation policy is not the shape createPolicy generates, or null. */
+function tenantIsolationShapeIssue(p) {
+    const name = `policy "${oneLine(p.policyname)}"`;
+    if (p.permissive !== "PERMISSIVE") {
+        return `${name} is ${p.permissive.toLowerCase()}, not permissive`;
+    }
+    if (p.cmd !== "ALL") {
+        return `${name} applies to ${p.cmd} only, not ALL commands`;
+    }
+    if (p.roles.length !== 1 || p.roles[0] !== "public") {
+        return `${name} applies to roles ${p.roles.join(", ")}, not PUBLIC`;
+    }
+    return null;
+}
+/**
+ * Every reason the table's policies do not isolate it by tenant. Empty when
+ * they do, or when the table has no policies.
+ */
+function tablePolicyIssues(policies) {
+    const issues = [];
+    for (const p of policies) {
+        if (p.policyname === "tenant_isolation") {
+            const shape = tenantIsolationShapeIssue(p);
+            if (shape !== null) {
+                issues.push(shape);
+                continue;
+            }
+        }
+        if (p.permissive === "PERMISSIVE") {
+            const issue = permissiveIssue(p);
+            if (issue !== null)
+                issues.push(issue);
+        }
+    }
+    return issues;
+}
+//# sourceMappingURL=policy-check.js.map

package/dist/rls/policy-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-check.js","sourceRoot":"","sources":["../../src/rls/policy-check.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;;AA2KH,8CAgBC;AA5KD,8EAA8E;AAC9E,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAC/C,0EAA0E;AAC1E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,iFAAiF;AACjF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAChD,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;YAC3B,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC;QACf,CAAC;aAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1B,GAAG,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,8EAA8E;IAC9E,OAAO,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,EAAE,CAAC,CAAC;AAChD,CAAC;AAED,8DAA8D;AAC9D,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC,CAAC;YAC1B,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,0DAA0D;AAC1D,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnF,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,aAAa,CAAC,IAAY,EAAE,EAAgB;IACnD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;YACrC,IAAI,GAAG,KAAK,CAAC,CAAC;gBAAE,MAAM;YACtB,CAAC,GAAG,GAAG,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACrC,KAAK,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC;YAC5B,CAAC;QACH,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AACrC,CAAC;AAED,iFAAiF;AACjF,SAAS,OAAO,CAAC,IAAY;IAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAAG,mBAAmB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,uBAAuB,CAAC;AAClG,oEAAoE;AACpE,MAAM,cAAc,GAAG,YAAY,YAAY,OAAO,YAAY,GAAG,CAAC;AACtE,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,iBAAiB,cAAc,IAAI,cAAc,cAAc,CAAC,CAAC;AACjG,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,oBAAoB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,6BAA6B,CACpF,CAAC;AAEF,kFAAkF;AAClF,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAEjC,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,6EAA6E;QAC7E,OAAO,CACL,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,CAAC,CAAC,CAAC;YAC3E,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CACtD,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC1C,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,+CAA+C;AAC/C,SAAS,OAAO,CAAC,IAAmB;IAClC,OAAO,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AAED,6EAA6E;AAC7E,SAAS,eAAe,CAAC,CAAY;IACnC,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC;IAC5D,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC3D,OAAO,GAAG,IAAI,WAAW,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC;QACxE,CAAC;IACH,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAChD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,GAAG,IAAI,gBAAgB,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,6BAA6B,CAAC;QACnF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,yBAAyB,CAAC,CAAY;IAC7C,MAAM,IAAI,GAAG,WAAW,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IACjD,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;QAClC,OAAO,GAAG,IAAI,OAAO,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,kBAAkB,CAAC;IACpE,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO,GAAG,IAAI,eAAe,CAAC,CAAC,GAAG,yBAAyB,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,OAAO,GAAG,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;IACtE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,QAAqB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,CAAC,UAAU,KAAK,kBAAkB,EAAE,CAAC;YACxC,MAAM,KAAK,GAAG,yBAAyB,CAAC,CAAC,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBACnB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,CAAC,UAAU,KAAK,YAAY,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,CAAC;YACjC,IAAI,KAAK,KAAK,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stratum-hq/db-adapters",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Stratum PostgreSQL adapters for tenant-scoped query isolation",
   "keywords": [
     "multi-tenancy",