@tailor-platform/sdk 1.78.0 → 1.79.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @tailor-platform/sdk
 
+## 1.79.0
+
+### Minor Changes
+
+- [#1768](https://github.com/tailor-platform/sdk/pull/1768) [`813f86e`](https://github.com/tailor-platform/sdk/commit/813f86eb0b0df1a768db5de6a39a550d6633749a) Thanks [@k1LoW](https://github.com/k1LoW)! - Add canonical `tailor.workflow.*` names that mirror the public `tailor.v1` RPC vocabulary. The `startWorkflow`, `startJobFunction`, and `resumeWorkflowExecution` methods are now available on `tailor.workflow`, alongside `workflow.startWorkflow` / `workflow.startJobFunction` / `workflow.resumeWorkflowExecution` from `@tailor-platform/sdk/runtime`. The pre-alignment names (`triggerWorkflow`, `triggerJobFunction`, `resumeWorkflow`) continue to work as frozen aliases, but are now marked `@deprecated` so IDEs surface a hint to migrate to the canonical names.
+
+### Patch Changes
+
+- [#1769](https://github.com/tailor-platform/sdk/pull/1769) [`9837182`](https://github.com/tailor-platform/sdk/commit/983718288eab23a4c15762c179a67569dd78a287) Thanks [@dqn](https://github.com/dqn)! - Fix `tailor function test-run` crashing with `TypeError: Cannot convert undefined or null to object` when `--arg` is a non-object JSON value such as `null`. The argument is now forwarded to the server, which reports the validation error. Local input validation also runs the same logic as deployed resolvers.
+
+- [#1777](https://github.com/tailor-platform/sdk/pull/1777) [`322b69c`](https://github.com/tailor-platform/sdk/commit/322b69c843953551ccb4b32d7cbd528ae2b0e10c) Thanks [@toiroakr](https://github.com/toiroakr)! - Fail fast at `generate`/`deploy` time when a TailorDB type is missing `.permission()`, or missing `.gqlPermission()` while GraphQL operations are enabled for it (`.gqlPermission()` is not required when GraphQL exposure is fully disabled via `gqlOperations`). Previously these omissions deployed silently and only surfaced later as an opaque `internal error` on insert.
+
 ## 1.78.0
 
 ### Minor Changes

package/dist/application-BB6BlUfk.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-fjqb-Gh8.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/{application-CUxVA7Fs.mjs → application-fjqb-Gh8.mjs}

@@ -2491,6 +2491,36 @@ function findOmittedPermitRules(rawPermissions) {
 	});
 	return locations;
 }
+/**
+* Check whether GraphQL exposure is fully disabled for a type, given its
+* effective gqlOperations (the type's own setting, falling back to the
+* TailorDB namespace default). `undefined` means the default of all
+* operations enabled, so it is never considered fully disabled.
+* @param gqlOperations - Effective, normalized gqlOperations configuration
+* @returns Whether create, update, delete, and read are all explicitly disabled
+*/
+function isGqlOperationsFullyDisabled(gqlOperations) {
+	if (!gqlOperations) return false;
+	return gqlOperations.create === false && gqlOperations.update === false && gqlOperations.delete === false && gqlOperations.read === false;
+}
+/**
+* Find missing permission configuration for a TailorDB type.
+*
+* Record-level permission is always required: TailorDB denies all record
+* operations for a type without it, regardless of whether the type is
+* exposed via GraphQL. GraphQL permission is required whenever GraphQL
+* exposure is enabled for the type (the default, unless every operation is
+* explicitly disabled via `gqlOperations`).
+* @param rawPermissions - Raw permissions definition for the type
+* @param effectiveGqlOperations - The type's own gqlOperations, falling back to the namespace default
+* @returns Which permission configuration, if any, is missing
+*/
+function findMissingPermissionConfig(rawPermissions, effectiveGqlOperations) {
+	return {
+		missingPermission: !rawPermissions.record,
+		missingGqlPermission: !rawPermissions.gql && !isGqlOperationsFullyDisabled(effectiveGqlOperations)
+	};
+}
 
 //#endregion
 //#region src/parser/service/tailordb/relation.ts
@@ -3533,6 +3563,19 @@ function createTailorDBService(params) {
 			if (locations.length > 0) logger.warn(`TailorDB type "${typeName}" has permission rule(s) ${locations.join(", ")} in object form without an explicit "permit"; they default to "deny". Set permit: true (allow) or permit: false (deny) to silence this warning.`);
 		}
 	};
+	const validateRequiredPermissions = () => {
+		const errors = [];
+		for (const fileTypes of Object.values(rawTypes)) for (const [typeName, type] of Object.entries(fileTypes)) {
+			const effectiveGqlOperations = type.metadata.settings?.gqlOperations ?? config.gqlOperations;
+			const { missingPermission, missingGqlPermission } = findMissingPermissionConfig(type.metadata.permissions, effectiveGqlOperations);
+			if (!missingPermission && !missingGqlPermission) continue;
+			const source = formatTailorDBTypeSourceInfo(typeSourceInfo[typeName]);
+			const location = source ? ` (${source})` : "";
+			if (missingPermission) errors.push(`TailorDB type "${typeName}"${location} has no .permission() configured. TailorDB denies all record operations for types without permission; call .permission(...) to grant access explicitly.`);
+			if (missingGqlPermission) errors.push(`TailorDB type "${typeName}"${location} has no .gqlPermission() configured, but GraphQL operations are enabled for it. Call .gqlPermission(...) to grant GraphQL access explicitly, or disable GraphQL exposure with .features({ gqlOperations: { create: false, update: false, delete: false, read: false } }).`);
+		}
+		if (errors.length > 0) throw new Error(`TailorDB permission configuration errors in service "${namespace}":\n${errors.map((e) => `  - ${e}`).join("\n")}`);
+	};
 	/**
 	* Process plugins for a type and add generated types to rawTypes
 	* @param rawType - The raw TailorDB type being processed
@@ -3625,6 +3668,7 @@ function createTailorDBService(params) {
 				else await Promise.all(typeFiles.map((typeFile) => loadTypeFile(typeFile, tsconfig)));
 				doParseTypes();
 				warnOmittedPermit();
+				validateRequiredPermissions();
 				return types;
 			})();
 			return loadPromise;
@@ -3666,7 +3710,10 @@ function createTailorDBService(params) {
 				hasGeneratedTypes = true;
 				logger.log(`  Generated: ${styles.success(generatedType.name)} by namespace plugin ${styles.info(pluginId)}`);
 			}
-			if (hasGeneratedTypes || hadPreviousGeneratedTypes) doParseTypes();
+			if (hasGeneratedTypes || hadPreviousGeneratedTypes) {
+				doParseTypes();
+				validateRequiredPermissions();
+			}
 		}
 	};
 }
@@ -4819,7 +4866,7 @@ const RetryPolicySchema = z.object({
 });
 const ConcurrencyPolicySchema = z.object({ maxConcurrentExecutions: z.number().int().min(1).max(1e3).describe("Maximum number of concurrent executions (1-1000)") });
 const ExecutionPolicyNameSchema = z.string().regex(/^[a-z0-9][a-z0-9-]{1,61}[a-z0-9]$/, "Invalid execution policy name: must match [a-z0-9-] (3-63 chars; must start and end with [a-z0-9])").describe("Workspace-unique execution policy name embedded in the resource TRN");
-const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to triggerJobFunction's executionPolicyKey option");
+const ExecutionPolicyKeySchema = z.string().regex(/^[a-z0-9][a-z0-9_:.-]{0,62}[a-z0-9*]$/, "Invalid execution policy key: must match [a-z0-9_:.-] (2-64 chars; must start with [a-z0-9] and end with [a-z0-9] or a trailing '*')").describe("Execution policy key passed to startJobFunction's (or its frozen alias triggerJobFunction's) executionPolicyKey option");
 const WorkflowJobFunctionExecutionPolicySchema = z.object({
 	name: ExecutionPolicyNameSchema,
 	key: ExecutionPolicyKeySchema,
@@ -5546,4 +5593,4 @@ async function loadApplication(params) {
 
 //#endregion
 export { fetchAllTolerant as A, initOperatorClient as B, createBundleCache as C, closeConnectionPool as D, hashFile as E, getConsoleBaseUrl as F, byName as G, normalizeBaseUrl as H, getOAuth2ClientId as I, LOG_LEVELS as K, getOrNull as L, fetchPaged as M, fetchPlatformMachineUserToken as N, defaultPlatformBaseUrl as O, fetchUserInfo as P, getPlatformBaseUrl as R, hasGenerationHooks as S, hashContent as T, rememberPlatformConfigForToken as U, isDefaultPlatform as V, resolveStaticWebsiteUrls as W, platformBundleDefinePlugin as _, resolveInlineSourcemap as a, resolveBundleLogLevel as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, stringifyFunction as g, TailorDBTypeSchema as h, resolverBundleKey as i, fetchMachineUserToken as j, fetchAll as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, assertUniqueLocalTailorDBTypeNames as p, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, composeFunctionTreeshakeOptions as v, getDistDir as w, getPluginGenerationDependencies as x, createLogLevelTreeshakeOptions as y, initOAuth2Client as z };
-//# sourceMappingURL=application-CUxVA7Fs.mjs.map
+//# sourceMappingURL=application-fjqb-Gh8.mjs.map