@supacloud/cli 0.8.0 → 0.9.0

package/dist/index.js

@@ -14777,7 +14777,9 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     user_id: exports_external.string().optional().describe("[get_auth_user] User UUID"),
     limit: exports_external.number().optional().describe("[list_auth_users] Max users (default: 20)"),
     name: exports_external.string().optional().describe("[apply_migration] Migration name"),
-    columns: exports_external.string().optional().describe("[create_table_rls] Column definitions")
+    columns: exports_external.string().optional().describe("[create_table_rls] Column definitions"),
+    policy_mode: exports_external.enum(["deny_all", "owner"]).optional().describe("[create_table_rls] RLS policy mode (default: deny_all)"),
+    owner_column: exports_external.string().optional().describe("[create_table_rls owner] UUID owner column matched to auth.uid()")
   }, async (args) => {
     const { action } = args;
     const ref = projectRef || args.ref;
@@ -15053,9 +15055,15 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
       case "create_table_rls": {
         if (!args.table || !args.columns)
           throw new Error("'table' and 'columns' required");
-        const sql = `BEGIN; CREATE TABLE IF NOT EXISTS "${schema}"."${args.table}" (${args.columns}); ALTER TABLE "${schema}"."${args.table}" ENABLE ROW LEVEL SECURITY; CREATE POLICY "Enable ALL for authenticated" ON "${schema}"."${args.table}" FOR ALL TO authenticated USING (true) WITH CHECK (true); COMMIT;`;
+        const qualifiedTable = `${quoteIdentifier(schema, "schema")}.${quoteIdentifier(args.table, "table")}`;
+        const columns = validateColumnDefinitions(args.columns);
+        const policyMode = args.policy_mode || "deny_all";
+        if (policyMode !== "deny_all" && policyMode !== "owner")
+          throw new Error("Invalid RLS policy mode");
+        const policySql = buildRlsPolicySql(qualifiedTable, policyMode, args.owner_column);
+        const sql = `BEGIN; CREATE TABLE IF NOT EXISTS ${qualifiedTable} (${columns}); ALTER TABLE ${qualifiedTable} ENABLE ROW LEVEL SECURITY; ${policySql} COMMIT;`;
         const r = await execSql(sql);
-        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
+        text = r.ok ? `✅ Table '${schema}.${args.table}' created with RLS (${policyMode === "owner" ? "auth.uid() owner policy" : "deny-all by default"})` : `❌ Failed (${r.status}): ${JSON.stringify(r.data)}`;
         break;
       }
       default:
@@ -15064,6 +15072,42 @@ Actions: ${allActions.join(", ")}${readOnly ? " (read-only mode)" : ""}`, {
     return { content: [{ type: "text", text }] };
   });
 }
+function quoteIdentifier(value, label) {
+  if (typeof value !== "string" || !/^[A-Za-z_][A-Za-z0-9_]{0,62}$/.test(value)) {
+    throw new Error(`Invalid ${label} identifier`);
+  }
+  return `"${value}"`;
+}
+function validateColumnDefinitions(value) {
+  if (typeof value !== "string")
+    throw new Error("Invalid column definitions");
+  const columns = value.trim();
+  if (!columns || columns.length > 16384)
+    throw new Error("Invalid column definitions");
+  if (/[;\0]/.test(columns) || /--|\/\*|\*\//.test(columns) || /\b(?:ALTER|CREATE|DROP|GRANT|REVOKE|TRUNCATE|COPY|CALL|DO)\b/i.test(columns)) {
+    throw new Error("Unsafe column definitions");
+  }
+  return columns;
+}
+function buildRlsPolicySql(qualifiedTable, policyMode, ownerColumnValue) {
+  const policyNames = [
+    "Enable ALL for authenticated",
+    "SupaCloud owner select",
+    "SupaCloud owner insert",
+    "SupaCloud owner update",
+    "SupaCloud owner delete"
+  ];
+  const dropPolicies = policyNames.map((name) => `DROP POLICY IF EXISTS "${name}" ON ${qualifiedTable};`).join(" ");
+  if (policyMode === "deny_all")
+    return dropPolicies;
+  const ownerColumn = quoteIdentifier(ownerColumnValue, "owner column");
+  const predicate = `auth.uid() IS NOT NULL AND auth.uid() = ${ownerColumn}`;
+  return `${dropPolicies}
+      CREATE POLICY "SupaCloud owner select" ON ${qualifiedTable} FOR SELECT TO authenticated USING (${predicate});
+      CREATE POLICY "SupaCloud owner insert" ON ${qualifiedTable} FOR INSERT TO authenticated WITH CHECK (${predicate});
+      CREATE POLICY "SupaCloud owner update" ON ${qualifiedTable} FOR UPDATE TO authenticated USING (${predicate}) WITH CHECK (${predicate});
+      CREATE POLICY "SupaCloud owner delete" ON ${qualifiedTable} FOR DELETE TO authenticated USING (${predicate});`;
+}
 function sqlString(value) {
   return `'${value.replace(/'/g, "''")}'`;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@supacloud/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Project-scoped CLI for SupaCloud users",
   "type": "module",
   "main": "./dist/index.js",