@stratum-hq/lib 1.7.0 → 1.8.0

package/dist/migration-sql.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ROLE_NAME = exports.STRATUM_CONTROL_ROLE = void 0;
+exports.assertRoleName = assertRoleName;
+exports.migrationSql = migrationSql;
+exports.isSuperuser = isSuperuser;
+exports.setControlRole = setControlRole;
+exports.setApplyControlRole = setApplyControlRole;
+/** The default name of the NOLOGIN control role (migration 032). */
+exports.STRATUM_CONTROL_ROLE = "stratum_control";
+/** A role name Stratum accepts: a plain lowercase identifier. */
+exports.ROLE_NAME = /^[a-z_][a-z0-9_]{0,62}$/;
+/** Throws when `role` is not a plain lowercase identifier. */
+function assertRoleName(role, what) {
+    if (!exports.ROLE_NAME.test(role)) {
+        throw new Error(`[stratum] Invalid ${what} '${role}': use lowercase letters, digits and underscores`);
+    }
+}
+// Migrations 029 and 031 created their helper functions with
+// `SET app.bypass_rls = 'on'` (and `SET app.tenant_scope = ''`) clauses.
+// PostgreSQL lets only a superuser, or a role granted SET on the parameter,
+// put a custom setting in a function, so a fresh install by a role that is
+// not a superuser stopped at 029. For such a role the runner drops the
+// clauses from these two files. Migration 032 re-creates both functions
+// without them (SECURITY DEFINER, owned by the control role) when it applies
+// the control role, in the same run or later through
+// stratum_apply_control_role(). Until then the functions see what their
+// caller sees, which can only narrow what they return. A superuser runs the
+// files as they are.
+const SUPERSEDED_SET_CLAUSES = new Set(["029_tenant_parent_cycle_guard.sql", "031_subtree_read_scope.sql"]);
+const APP_SET_CLAUSE = /^SET app\.[a-z_]+ = '[^']*'\n/gm;
+/** The SQL to run for one migration file. */
+function migrationSql(name, sql, superuser) {
+    if (superuser || !SUPERSEDED_SET_CLAUSES.has(name))
+        return sql;
+    return sql.replace(APP_SET_CLAUSE, "");
+}
+/** Whether the role of `client` is a superuser. */
+async function isSuperuser(client) {
+    const res = await client.query("SELECT rolsuper FROM pg_catalog.pg_roles WHERE rolname = current_user");
+    return res.rows[0]?.rolsuper === true;
+}
+/**
+ * Sets stratum.control_role for the current transaction, which migration 032
+ * reads. Without a name the setting stays as the session has it.
+ */
+async function setControlRole(client, controlRole) {
+    if (controlRole === undefined)
+        return;
+    await client.query("SELECT pg_catalog.set_config('stratum.control_role', $1, true)", [controlRole]);
+}
+/**
+ * Sets stratum.apply_control_role = 'on' for the current transaction when
+ * `apply` is true. Migration 032 grants the control role to the migrating
+ * login only with this opt-in (or when the login is a superuser or already a
+ * member), because that login must be the library's admin login and never
+ * the application's.
+ */
+async function setApplyControlRole(client, apply) {
+    if (!apply)
+        return;
+    await client.query("SELECT pg_catalog.set_config('stratum.apply_control_role', 'on', true)");
+}
+//# sourceMappingURL=migration-sql.js.map

package/dist/migration-sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-sql.js","sourceRoot":"","sources":["../src/migration-sql.ts"],"names":[],"mappings":";;;AASA,wCAIC;AAiBD,oCAGC;AAGD,kCAKC;AAMD,wCAGC;AASD,kDAGC;AA5DD,oEAAoE;AACvD,QAAA,oBAAoB,GAAG,iBAAiB,CAAC;AAEtD,iEAAiE;AACpD,QAAA,SAAS,GAAG,yBAAyB,CAAC;AAEnD,8DAA8D;AAC9D,SAAgB,cAAc,CAAC,IAAY,EAAE,IAAY;IACvD,IAAI,CAAC,iBAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,IAAI,KAAK,IAAI,kDAAkD,CAAC,CAAC;IACxG,CAAC;AACH,CAAC;AAED,6DAA6D;AAC7D,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,qDAAqD;AACrD,wEAAwE;AACxE,4EAA4E;AAC5E,qBAAqB;AACrB,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,mCAAmC,EAAE,4BAA4B,CAAC,CAAC,CAAC;AAC5G,MAAM,cAAc,GAAG,iCAAiC,CAAC;AAEzD,6CAA6C;AAC7C,SAAgB,YAAY,CAAC,IAAY,EAAE,GAAW,EAAE,SAAkB;IACxE,IAAI,SAAS,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC/D,OAAO,GAAG,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;AACzC,CAAC;AAED,mDAAmD;AAC5C,KAAK,UAAU,WAAW,CAAC,MAA+B;IAC/D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,KAAK,CAC5B,uEAAuE,CACxE,CAAC;IACF,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,KAAK,IAAI,CAAC;AACxC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,cAAc,CAAC,MAAqB,EAAE,WAA+B;IACzF,IAAI,WAAW,KAAK,SAAS;QAAE,OAAO;IACtC,MAAM,MAAM,CAAC,KAAK,CAAC,gEAAgE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;AACtG,CAAC;AAED;;;;;;GAMG;AACI,KAAK,UAAU,mBAAmB,CAAC,MAAqB,EAAE,KAA0B;IACzF,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;AAC/F,CAAC"}

package/dist/migrations/029_tenant_parent_cycle_guard.sql

@@ -48,9 +48,9 @@ END;
 $$ language 'plpgsql';
 
 DO $pin$ BEGIN
-  EXECUTE format(
+  EXECUTE pg_catalog.format(
     'ALTER FUNCTION refuse_tenant_parent_cycle() SET search_path = pg_catalog, %I',
-    current_schema()
+    pg_catalog.current_schema()
   );
 END $pin$;
 

package/dist/migrations/031_subtree_read_scope.sql

@@ -106,9 +106,9 @@ AS $$
 $$;
 
 DO $pin$ BEGIN
-  EXECUTE format(
+  EXECUTE pg_catalog.format(
     'ALTER FUNCTION stratum_subtree_tenant_ids() SET search_path = pg_catalog, %I, pg_temp',
-    current_schema()
+    pg_catalog.current_schema()
   );
 END $pin$;
 
@@ -255,9 +255,9 @@ END;
 $$ language 'plpgsql';
 
 DO $pin$ BEGIN
-  EXECUTE format(
+  EXECUTE pg_catalog.format(
     'ALTER FUNCTION refuse_tenant_tree_column_change() SET search_path = pg_catalog, %I, pg_temp',
-    current_schema()
+    pg_catalog.current_schema()
   );
 END $pin$;
 
@@ -300,8 +300,8 @@ END;
 $$ language 'plpgsql';
 
 DO $pin$ BEGIN
-  EXECUTE format(
+  EXECUTE pg_catalog.format(
     'ALTER FUNCTION refuse_tenant_parent_cycle() SET search_path = pg_catalog, %I, pg_temp',
-    current_schema()
+    pg_catalog.current_schema()
   );
 END $pin$;