@tailor-platform/sdk 1.80.0 → 1.81.0

package/CHANGELOG.md

@@ -1,5 +1,33 @@
 # @tailor-platform/sdk
 
+## 1.81.0
+
+### Minor Changes
+
+- [#1824](https://github.com/tailor-platform/sdk/pull/1824) [`617a263`](https://github.com/tailor-platform/sdk/commit/617a2632ae50f9b4db8e436d1da4c4888c907a58) Thanks [@haru0017](https://github.com/haru0017)! - Add a `logger` API for structured logging from Tailor Platform functions, exposing `debug`, `info`, `warn`, `error`, and `setAttributes`. The message is written to standard output, and the full entry with its attributes is exported over OpenTelemetry, where the attributes are queryable. Attribute values are typed to what OpenTelemetry can carry (`string`, `number`, `boolean`, and homogeneous arrays of those).
+
+- [#1718](https://github.com/tailor-platform/sdk/pull/1718) [`d688c30`](https://github.com/tailor-platform/sdk/commit/d688c303be1b6693a36b50a03d52c670c05d035a) Thanks [@toiroakr](https://github.com/toiroakr)! - Add `permission` field to `createResolver` for declaring a resolver's access requirement, using the same `conditions`/`permit` policy notation as TailorDB's `.permission()` (restricted to `user` operands, e.g. `permission: [{ conditions: [[{ user: "_loggedIn" }, "=", true]], permit: true }]`). Rejects non-matching callers before `body` runs. At least one `permit: true` policy is required (deny by default, granted only by a match); a matching `permit: false` policy always overrides that grant, for carving out an explicit exception. `permission: "allowAnonymous"` explicitly documents that anonymous callers are allowed. Omitting `permission` keeps prior behavior unchanged. `tailor-sdk function test-run` enforces the same guard.
+
+### Patch Changes
+
+- [#1797](https://github.com/tailor-platform/sdk/pull/1797) [`93c1659`](https://github.com/tailor-platform/sdk/commit/93c16590eb21537ded9272ec12ecc683b61de04e) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix deploy reporting spurious updates on every run: TailorDB types no longer drift when the platform proto gains new fields, IdP services without an explicit userAuthPolicy no longer drift against the platform's default password policy, and deploys with pending migrations no longer silently skip type changes in namespaces that have no migrations
+
+- [#1842](https://github.com/tailor-platform/sdk/pull/1842) [`b19c22b`](https://github.com/tailor-platform/sdk/commit/b19c22bd8a22c8ec79a5f02545222706101926c6) Thanks [@toiroakr](https://github.com/toiroakr)! - fix(deps): update transitive dependency fast-uri to 3.1.4 [security]
+
+- [#1822](https://github.com/tailor-platform/sdk/pull/1822) [`bcfc9ea`](https://github.com/tailor-platform/sdk/commit/bcfc9ea550744c9481fb29d8ed1629851fc0b1f0) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update dependency execa to v10
+
+- [#1826](https://github.com/tailor-platform/sdk/pull/1826) [`bc85e4a`](https://github.com/tailor-platform/sdk/commit/bc85e4a72e25a9d0e0dadd7e2fae3a7be4d1ce59) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update oxc
+
+## 1.80.1
+
+### Patch Changes
+
+- [#1831](https://github.com/tailor-platform/sdk/pull/1831) [`e24b3da`](https://github.com/tailor-platform/sdk/commit/e24b3da17656317a3729626d1cb34d90b8116356) Thanks [@toiroakr](https://github.com/toiroakr)! - Fix `IdPConfig`'s `permission` type so `defineIdp` calls with valid permission definitions using project-specific attribute keys are no longer rejected by `tsc`
+
+- [#1828](https://github.com/tailor-platform/sdk/pull/1828) [`46f2d49`](https://github.com/tailor-platform/sdk/commit/46f2d496407ec8c248ed60a3f519ef526e0896e4) Thanks [@renovate](https://github.com/apps/renovate)! - fix(deps): update rolldown
+
+- [#1818](https://github.com/tailor-platform/sdk/pull/1818) [`56608cc`](https://github.com/tailor-platform/sdk/commit/56608ccc445c1aeb683ddfd72965446b1062cfbd) Thanks [@toiroakr](https://github.com/toiroakr)! - Adopt Vitest 4.1 `aroundEach`/`aroundAll` hooks across the test suites, and update the TailorDB client mock example in the testing docs to the same style
+
 ## 1.80.0
 
 ### Minor Changes

package/dist/application-B1_7Wm37.mjs

@@ -0,0 +1,3 @@
+import { n as generatePluginFilesIfNeeded, r as loadApplication, t as defineApplication } from "./application-DDe0er6L.mjs";
+
+export { defineApplication, generatePluginFilesIfNeeded };

package/dist/{application-C1d52JP9.mjs → application-DDe0er6L.mjs}

@@ -180,7 +180,7 @@ function initOAuth2Client(config) {
 */
 async function initOperatorClient(accessToken, config) {
 	const platformConfig = config ?? getPlatformConfigForToken(accessToken);
-	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-D-q1rvRl.mjs"), import("./service_pb-r1T7kpJc.mjs")]);
+	const [{ createTracingInterceptor }, { OperatorService }] = await Promise.all([import("./interceptor-D-q1rvRl.mjs"), import("./service_pb-wRkxUta6.mjs")]);
 	const interceptors = [
 		await userAgentInterceptor(),
 		await bearerTokenInterceptor(accessToken),
@@ -3918,6 +3918,111 @@ function buildExecutorArgsExpr(triggerKind, env) {
 function buildResolverOperationHookExpr(env) {
 	return `({ ...context.pipeline, input: context.args, user: ${tailorUserMap}, env: ${JSON.stringify(env)} });`;
 }
+function isSingleResolverCondition(conditions) {
+	return conditions.length === 3 && typeof conditions[1] === "string";
+}
+function resolverPermissionOperandExpr(operand) {
+	if (typeof operand === "object") {
+		if (operand.user === "_loggedIn") return `(context.user.type !== "")`;
+		if (operand.user === "id") return `context.user.id`;
+		return `context.user.attributes?.[${JSON.stringify(operand.user)}]`;
+	}
+	return JSON.stringify(operand);
+}
+function isArbitraryAttributeOperand(operand) {
+	return typeof operand === "object" && operand.user !== "_loggedIn" && operand.user !== "id";
+}
+function resolverPermissionConditionExpr(condition) {
+	const [left, operator, right] = condition;
+	const leftExpr = resolverPermissionOperandExpr(left);
+	const rightExpr = resolverPermissionOperandExpr(right);
+	if (operator === "!=") {
+		const userOperandExpr = isArbitraryAttributeOperand(left) ? leftExpr : isArbitraryAttributeOperand(right) ? rightExpr : void 0;
+		if (userOperandExpr) return `(${userOperandExpr} !== undefined && ${leftExpr} !== ${rightExpr})`;
+	}
+	return `(${leftExpr} ${operator === "=" ? "===" : "!=="} ${rightExpr})`;
+}
+function resolverPermissionPolicyExpr(policy) {
+	const conditions = isSingleResolverCondition(policy.conditions) ? [policy.conditions] : policy.conditions;
+	if (conditions.length === 0) throw new Error("Resolver permission policy must have at least one condition, got an empty array.");
+	return conditions.map(resolverPermissionConditionExpr).join(" && ");
+}
+/**
+* Build a JS object literal capturing whether `policy` matched and its
+* (possibly empty) description, for runtime denial-reason attribution.
+* @param policy - The policy to compile
+* @returns A JS object literal expression: `{ matched, description }`
+*/
+function policyEntryExpr(policy) {
+	return `{ matched: ${resolverPermissionPolicyExpr(policy)}, description: ${JSON.stringify(policy.description ?? "")} }`;
+}
+/**
+* Build the permission guard statement injected at resolver entry.
+*
+* Rejects the call with `TailorErrorMessage` when the caller doesn't match
+* `permission`, evaluated against `context.user` — the original caller,
+* unaffected by `authInvoker`. `permission` is deny-by-default: a caller is
+* granted only by a matching `permit: true` policy, and a matching
+* `permit: false` policy always overrides that grant. The thrown message only
+* includes the description(s) of the policy/policies that actually caused the
+* denial.
+*
+* The schema requires at least one `permit: true` policy (an array of only
+* `permit: false` policies is rejected at build time), so `allowPolicies` is
+* never empty here for schema-valid input; this function still handles that
+* case defensively since it also runs against test-authored raw shapes.
+* @param permission - The resolver's `permission` config
+* @returns A JS statement, or `undefined` when `permission` is omitted or `"allowAnonymous"`
+*/
+function buildResolverPermissionGuardExpr(permission) {
+	if (!permission || permission === "allowAnonymous") return;
+	if (permission.length === 0) throw new Error("Resolver permission must have at least one policy, got an empty array.");
+	const denyPolicies = permission.filter((policy) => policy.permit === false);
+	const allowPolicies = permission.filter((policy) => policy.permit !== false);
+	return `{
+    const $denyPolicies = ${`[${denyPolicies.map(policyEntryExpr).join(", ")}]`};
+    const $allowPolicies = ${`[${allowPolicies.map(policyEntryExpr).join(", ")}]`};
+    const $matchedDeny = $denyPolicies.filter((p) => p.matched);
+    const $anyAllowMatched = $allowPolicies.some((p) => p.matched);
+    if ($matchedDeny.length > 0 || ($allowPolicies.length > 0 && !$anyAllowMatched)) {
+      const $reasons = ($matchedDeny.length > 0 ? $matchedDeny : $allowPolicies)
+        .map((p) => p.description)
+        .filter(Boolean);
+      throw new TailorErrorMessage($reasons.length > 0 ? "access denied: " + $reasons.join("; ") : "access denied");
+    }
+  }`;
+}
+/**
+* Build the permission guard and input-validation statements shared by every
+* resolver entry wrapper (production bundling and `function test-run`).
+*
+* Kept as a single generator so a resolver-wrapping behavior (like the
+* permission guard) can't be added to one entry-point template and forgotten
+* in the other. References `context.user`, `context.input`, and
+* `_internalResolver` — the caller's wrapper must bind a `context` object
+* with `user`/`input` properties before inlining this expression.
+* @param permission - The resolver's `permission` config
+* @returns A JS statement block to inline before calling `_internalResolver.body(...)`
+*/
+function buildResolverPermissionAndInputCheckExpr(permission) {
+	return `
+    ${buildResolverPermissionGuardExpr(permission) ?? ""}
+    if (_internalResolver.input) {
+      const result = t.object(_internalResolver.input).parse({
+        value: context.input,
+        data: context.input,
+        user: context.user,
+      });
+
+      if (result.issues) {
+        throw new TailorErrors(result.issues.map(issue => ({
+          message: issue.message,
+          path: issue.path ?? [],
+        })));
+      }
+    }
+  `;
+}
 
 //#endregion
 //#region src/cli/services/executor/loader.ts
@@ -4338,6 +4443,42 @@ function isAsyncFunction(fn) {
 //#endregion
 //#region src/parser/service/resolver/schema.ts
 const QueryTypeSchema = z.union([z.literal("query"), z.literal("mutation")]).describe("GraphQL operation type");
+const ResolverPermissionOperandSchema = z.union([
+	z.object({ user: z.string() }).strict(),
+	z.string(),
+	z.boolean()
+]);
+const ResolverPermissionOperatorSchema = z.union([z.literal("="), z.literal("!=")]);
+const isUserOperand = (operand) => typeof operand === "object";
+const KNOWN_USER_OPERAND_TYPES = {
+	_loggedIn: "boolean",
+	id: "string"
+};
+const operandTypeMismatch = (userOperand, otherOperand) => {
+	if (typeof userOperand !== "object") return;
+	const expected = KNOWN_USER_OPERAND_TYPES[userOperand.user];
+	if (expected === void 0 || typeof otherOperand === "object" || typeof otherOperand === expected) return;
+	return {
+		key: userOperand.user,
+		expected
+	};
+};
+const ResolverPermissionConditionSchema = z.tuple([
+	ResolverPermissionOperandSchema,
+	ResolverPermissionOperatorSchema,
+	ResolverPermissionOperandSchema
+]).refine(([left, , right]) => isUserOperand(left) !== isUserOperand(right), "Resolver permission condition must reference a `user` operand on exactly one side (comparing two `user` operands to each other can match on `undefined === undefined`)").superRefine(([left, , right], ctx) => {
+	for (const mismatch of [operandTypeMismatch(left, right), operandTypeMismatch(right, left)]) if (mismatch) ctx.addIssue({
+		code: "custom",
+		message: `\`${mismatch.key}\` must compare to a ${mismatch.expected}`
+	});
+}).readonly();
+const ResolverPermissionPolicySchema = z.object({
+	conditions: z.union([ResolverPermissionConditionSchema, z.array(ResolverPermissionConditionSchema).min(1, "Resolver permission policy must have at least one condition").readonly()]),
+	permit: z.boolean(),
+	description: z.string().optional().describe("Reason recorded for this policy, used in the access-denied error message")
+});
+const ResolverPermissionSchema = z.union([z.array(ResolverPermissionPolicySchema).min(1, "Resolver permission must have at least one policy").refine((policies) => policies.some((policy) => policy.permit === true), "Resolver permission must include at least one `permit: true` policy — a policy array with only `permit: false` policies still lets any caller through by simply not authenticating, since none of the deny conditions apply to a caller with no user attributes at all").readonly(), z.literal("allowAnonymous")]).describe("Access requirement for this resolver, evaluated against the original caller (unaffected by `authInvoker`) before `body` runs. \"allowAnonymous\" documents that anonymous callers are allowed. Omitted (default): unchanged, anonymous callers can reach the resolver");
 const ResolverSchema = z.object({
 	operation: QueryTypeSchema.describe("GraphQL operation type (query or mutation)"),
 	name: z.string().describe("Resolver name"),
@@ -4346,7 +4487,8 @@ const ResolverSchema = z.object({
 	body: functionSchema.describe("Resolver implementation function"),
 	output: TailorFieldSchema.describe("Output field definition"),
 	publishEvents: z.boolean().optional().describe("Enable publishing events from this resolver"),
-	authInvoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as")
+	authInvoker: AuthInvokerSchema.optional().describe("Machine user to execute this resolver as"),
+	permission: ResolverPermissionSchema.optional()
 });
 
 //#endregion
@@ -4399,7 +4541,8 @@ async function bundleResolvers(namespace, config, baseDir, triggerContext, cache
 		}
 		resolvers.push({
 			name: resolver.name,
-			sourceFile: file
+			sourceFile: file,
+			permission: resolver.permission
 		});
 	}
 	const tsconfig = await resolveTSConfigWithFallback(baseDir);
@@ -4431,21 +4574,7 @@ async function bundleSingleResolver(namespace, resolver, tsconfig, triggerContex
 
         const $tailor_resolver_body = async (context) => {
           const invoker = ${INVOKER_EXPR};
-          if (_internalResolver.input) {
-            const result = t.object(_internalResolver.input).parse({
-              value: context.input,
-              data: context.input,
-              user: context.user,
-            });
-
-            if (result.issues) {
-              throw new TailorErrors(result.issues.map(issue => ({
-                message: issue.message,
-                path: issue.path ?? [],
-              })));
-            }
-          }
-
+          ${buildResolverPermissionAndInputCheckExpr(resolver.permission)}
           return _internalResolver.body({ ...context, invoker });
         };
 
@@ -5611,5 +5740,5 @@ async function loadApplication(params) {
 }
 
 //#endregion
-export { fetchAll as A, initOAuth2Client as B, hasGenerationHooks as C, hashFile as D, hashContent as E, fetchUserInfo as F, resolveStaticWebsiteUrls as G, isDefaultPlatform as H, getConsoleBaseUrl as I, LOG_LEVELS as J, byName as K, getOAuth2ClientId as L, fetchMachineUserToken as M, fetchPaged as N, closeConnectionPool as O, fetchPlatformMachineUserToken as P, getOrNull as R, getPluginGenerationDependencies as S, getDistDir as T, normalizeBaseUrl as U, initOperatorClient as V, rememberPlatformConfigForToken as W, resolveTSConfigWithFallback as _, resolveInlineSourcemap as a, createLogLevelTreeshakeOptions as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, stringifyFunction as g, TailorDBTypeSchema as h, resolverBundleKey as i, fetchAllTolerant as j, defaultPlatformBaseUrl as k, HTTP_METHODS as l, assertUniqueTailorDBTypeNamesWithExternal as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, assertUniqueLocalTailorDBTypeNames as p, createApplyLimiter as q, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, platformBundleDefinePlugin as v, createBundleCache as w, resolveBundleLogLevel as x, composeFunctionTreeshakeOptions as y, getPlatformBaseUrl as z };
-//# sourceMappingURL=application-C1d52JP9.mjs.map
+export { defaultPlatformBaseUrl as A, getPlatformBaseUrl as B, getPluginGenerationDependencies as C, hashContent as D, getDistDir as E, fetchPlatformMachineUserToken as F, rememberPlatformConfigForToken as G, initOperatorClient as H, fetchUserInfo as I, createApplyLimiter as J, resolveStaticWebsiteUrls as K, getConsoleBaseUrl as L, fetchAllTolerant as M, fetchMachineUserToken as N, hashFile as O, fetchPaged as P, getOAuth2ClientId as R, resolveBundleLogLevel as S, createBundleCache as T, isDefaultPlatform as U, initOAuth2Client as V, normalizeBaseUrl as W, LOG_LEVELS as Y, stringifyFunction as _, resolveInlineSourcemap as a, composeFunctionTreeshakeOptions as b, ResolverSchema as c, buildExecutorArgsExpr as d, buildResolverOperationHookExpr as f, TailorDBTypeSchema as g, assertUniqueTailorDBTypeNamesWithExternal as h, resolverBundleKey as i, fetchAll as j, closeConnectionPool as k, HTTP_METHODS as l, assertUniqueLocalTailorDBTypeNames as m, generatePluginFilesIfNeeded as n, WorkflowJobFunctionExecutionPolicySchema as o, buildResolverPermissionAndInputCheckExpr as p, byName as q, loadApplication as r, WorkflowJobSchema as s, defineApplication as t, INVOKER_EXPR as u, resolveTSConfigWithFallback as v, hasGenerationHooks as w, createLogLevelTreeshakeOptions as x, platformBundleDefinePlugin as y, getOrNull as z };
+//# sourceMappingURL=application-DDe0er6L.mjs.map