@teleporthq/teleport-shared 0.44.0 → 0.44.1

package/dist/esm/utils/table-access.js

@@ -232,6 +232,120 @@ export var resolveAdminPanelRoles = function (auth) {
 export var resolveTrustedReaderRoles = function (auth) {
     return resolveAdminPanelRoles(auth);
 };
+/**
+ * What a page shows of a member to whoever opens it: their public profile —
+ * who they are, never how to reach them. A page's own data, read for a visitor,
+ * carries only these columns of the auth users table: never an email, a phone
+ * or an address, a credential, a role or anything else of the account. The
+ * member's own private fields reach their own page from their session.
+ */
+export var PUBLIC_PROFILE_COLUMNS = [
+    'id',
+    'name',
+    'display_name',
+    'image',
+    'avatar',
+    'avatar_url',
+    'bio',
+];
+var bareTableName = function (tableName) {
+    var parts = String(tableName || '')
+        .trim()
+        .toLowerCase()
+        .split('.');
+    return parts[parts.length - 1].replace(/"/g, '');
+};
+/**
+ * The tables a page's own data, read for a visitor (`pageReadsAsStore` false),
+ * gets no row of — so it need not ask: the protected ones, and the feed tables,
+ * whose one visitor projection lives on the data API. Not the auth users table:
+ * a page reads its members' public profiles (`PUBLIC_PROFILE_COLUMNS`).
+ */
+export var pageDataReadsNoRowOf = function (tableName) {
+    var bare = bareTableName(tableName);
+    if (AUTH_CREDENTIAL_TABLES.indexOf(bare) !== -1) {
+        return false;
+    }
+    return (PROTECTED_TABLES.indexOf(bare) !== -1 ||
+        Object.prototype.hasOwnProperty.call(PUBLIC_FEED_TABLES, bare));
+};
+var isAdminRoute = function (route) {
+    return route === ADMIN_ROUTE_PREFIX || route.startsWith("".concat(ADMIN_ROUTE_PREFIX, "/"));
+};
+/**
+ * The gate the generated middleware puts on each route it knows
+ * (`generateMiddlewareFile`): a page's own protection, the roles of the
+ * role-gated folders it sits in merged in, and `/admin` — when any admin page
+ * is protected — admitting the admin panel's roles. A row-owned page is left
+ * to its own SQL there, so it gates nothing here either.
+ */
+var middlewareRouteGates = function (auth) {
+    var gates = new Map();
+    var folders = Object.values(auth.folderProtection || {});
+    Object.entries(auth.pageProtection || {}).forEach(function (_a) {
+        var pageId = _a[0], page = _a[1];
+        if (!page || typeof page.route !== 'string' || page.rowOwnerColumn) {
+            return;
+        }
+        var folderRoles = folders
+            .filter(function (folder) { var _a; return ((_a = folder === null || folder === void 0 ? void 0 : folder.children) === null || _a === void 0 ? void 0 : _a[pageId]) === 'page'; })
+            .flatMap(function (folder) { return folder.allowedRoles || []; });
+        var existing = gates.get(page.route);
+        gates.set(page.route, {
+            requiresAuth: !!(existing === null || existing === void 0 ? void 0 : existing.requiresAuth) || !!page.requiresAuth,
+            roles: Array.from(new Set(__spreadArray(__spreadArray(__spreadArray([], ((existing === null || existing === void 0 ? void 0 : existing.roles) || []), true), (page.allowedRoles || []), true), folderRoles, true))),
+        });
+    });
+    if (!gates.has(ADMIN_ROUTE_PREFIX) && Array.from(gates.keys()).some(isAdminRoute)) {
+        var panelRoles = resolveAdminPanelRoles(auth);
+        gates.set(ADMIN_ROUTE_PREFIX, {
+            requiresAuth: true,
+            roles: panelRoles.length > 0 ? panelRoles : ['admin'],
+        });
+    }
+    return gates;
+};
+/**
+ * Whether a page's own data — what its getStaticProps / getServerSideProps
+ * read to render it — may be read as the store rather than as a visitor.
+ *
+ * Only an admin panel page that nobody but the store's trusted readers may
+ * open: at `/admin` or below, behind the middleware, with every role its gate
+ * admits in `resolveTrustedReaderRoles`. Whoever receives that page's data
+ * could read the same rows through the data routes. Every other page — public,
+ * members-only, or an admin screen another role may open — is rendered with
+ * what a visitor is served, since its data reaches whoever opens it, and
+ * through `/_next/data` without rendering it at all. `route` is the page's
+ * path when its own protection does not name it.
+ */
+export var pageReadsAsStore = function (page, auth) {
+    var _a;
+    if (!auth) {
+        return false;
+    }
+    var trustedRoles = resolveTrustedReaderRoles(auth);
+    if (trustedRoles.length === 0) {
+        return false;
+    }
+    var own = page.pageId ? (_a = auth.pageProtection) === null || _a === void 0 ? void 0 : _a[page.pageId] : undefined;
+    if (own === null || own === void 0 ? void 0 : own.rowOwnerColumn) {
+        return false;
+    }
+    var route = typeof (own === null || own === void 0 ? void 0 : own.route) === 'string' ? own.route : page.route;
+    if (!route || !isAdminRoute(route)) {
+        return false;
+    }
+    // The middleware's resolution: the route's own gate, else its nearest gated ancestor.
+    var gates = middlewareRouteGates(auth);
+    var ancestor = Array.from(gates.keys())
+        .filter(function (gated) { return route.startsWith("".concat(gated, "/")); })
+        .sort(function (a, b) { return b.length - a.length; })[0];
+    var gate = gates.get(route) || (ancestor ? gates.get(ancestor) : undefined);
+    if (!gate || !gate.requiresAuth || gate.roles.length === 0) {
+        return false;
+    }
+    return gate.roles.every(function (role) { return trustedRoles.indexOf(role) !== -1; });
+};
 /**
  * ES5 source of the guard, inlined into a generated route. Declares:
  *  - `__taIsInternalRequest(req)` — the caller presented the app secret, or
@@ -266,6 +380,6 @@ export var resolveTrustedReaderRoles = function (auth) {
  *    `__tqSessionToken` resolver, which the host route must inline as well.
  */
 export var generateTableAccessHelperCode = function (params) {
-    return "// GENERATED \u2014 see generateTableAccessHelperCode in\n// @teleporthq/teleport-shared/src/utils/table-access.ts.\n//\n// Tables that ARE money, and tables that decide how much of it is given away.\n// A browser reads the first group only as a trusted role (the generated admin)\n// and writes the second group never; server-side workflow segments present the\n// app secret instead. One list for both data-route families.\nvar __TA_PROTECTED_TABLES = ".concat(JSON.stringify(PROTECTED_TABLES), ";\nvar __TA_WRITE_PROTECTED_TABLES = ").concat(JSON.stringify(WRITE_PROTECTED_TABLES), ";\n// Readable from a browser only as this projection of the rows the database\n// calls live \u2014 see PUBLIC_FEED_TABLES. The per-table routes serve a whole\n// table (and raw SQL), which cannot express a feed, so there they are refused\n// like a protected table.\nvar __TA_PUBLIC_FEED_TABLES = ").concat(JSON.stringify(PUBLIC_FEED_TABLES), ";\nvar __TA_FEED_TABLES = Object.keys(__TA_PUBLIC_FEED_TABLES);\nvar __TA_TRUSTED_READER_ROLES = ").concat(JSON.stringify(params.trustedReaderRoles), ";\nvar __TA_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(AUTH_CREDENTIAL_COLUMNS), ";\nvar __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(UNAMBIGUOUS_CREDENTIAL_COLUMNS), ";\nvar __TA_CREDENTIAL_TABLES = ").concat(JSON.stringify(AUTH_CREDENTIAL_TABLES), ";\nvar __TA_SQL_WRITE_RE = /\\b(?:insert|update|delete|merge|truncate)\\b/i;\n// What a statement can reach without spelling a table's name where this scan\n// can see it: a Unicode-escaped identifier (U&\"\\0075sers\" is `users`), the\n// functions that run SQL text or dump whole tables, schemas or the database\n// (the table name then sits in a string, or is not named at all), and the\n// planner statistics, which hold sampled column values of every table.\nvar __TA_OPAQUE_SQL_RE = /u&\"|\\b(?:query|table|cursor|schema|database)_to_xml\\w*\\s*\\(|\\bts_(?:stat|rewrite)\\s*\\(|\\bdblink\\w*\\s*\\(|\\bpg_read_(?:binary_)?file\\s*\\(|\\blo_(?:import|export|get)\\s*\\(|\\bpg_stat(?:s|istic)\\w*/i;\n\n// Only server code can read NEXTAUTH_SECRET, so a browser cannot forge the\n// header a server segment sends. An in-process call (getStaticProps and the\n// page-load workflows call the handler directly with a synthetic request)\n// marks its request object instead \u2014 a property, never a header, so nothing\n// on the wire can claim it.\nfunction __taPresentsAppSecret(req) {\n  var secret = req && req.headers && req.headers['x-internal-data-secret'];\n  return !!(secret && process.env.NEXTAUTH_SECRET && secret === process.env.NEXTAUTH_SECRET);\n}\n\nfunction __taIsRestrictedRequest(req) {\n  return __taPresentsAppSecret(req) && !!(req.headers && req.headers['x-tq-restricted-sql'] === '1');\n}\n\nfunction __taIsInternalRequest(req) {\n  if (req && req.__tqServerCall === true) return true;\n  return __taPresentsAppSecret(req) && !__taIsRestrictedRequest(req);\n}\n\n// Generated browser code reads through the structured routes and never sends\n// SQL or a write of its own \u2014 every data node runs server-side and presents\n// the secret. So where a secret exists to tell the two apart, anything else a\n// browser sends is refused whole: no statement scan has to be right about it.\n// An app without one (no authentication, hence no store) keeps the scan.\nfunction __taBrowserIsReadOnly(req) {\n  return !!process.env.NEXTAUTH_SECRET && !__taIsInternalRequest(req) && !__taIsRestrictedRequest(req);\n}\n\n// Comments and string literals out, so a table name inside a string neither\n// hides a reference nor fakes one. Quoted identifiers stay, whole: in Postgres\n// they name tables, which is exactly what is being looked for.\n//\n// \u26D4 This is a lexer, not a search: a quote or comment marker inside a quoted\n// identifier (\"x'\", \"--\") is part of the name, a `$` or an `E` inside an\n// identifier (a$b$, ELSE'\u2026') starts neither a dollar quote nor an escape\n// string, and a dollar-quoted body is consumed by its own tag. An UNTERMINATED\n// literal, identifier, comment or dollar quote makes the whole scan fail closed\n// (ok:false): a statement this cleaner cannot read is one it cannot vouch for.\nfunction __taCleanSql(sql) {\n  var text = String(sql || '');\n  var out = '';\n  var i = 0;\n  function inIdentifier(at) { return at > 0 && /[A-Za-z0-9_$]/.test(text[at - 1]); }\n  while (i < text.length) {\n    var ch = text[i];\n    var next = text[i + 1];\n    if (ch === '-' && next === '-') {\n      while (i < text.length && text[i] !== '\\n') i++;\n      continue;\n    }\n    if (ch === '/' && next === '*') {\n      i += 2;\n      var depth = 1;\n      while (i < text.length && depth > 0) {\n        if (text[i] === '/' && text[i + 1] === '*') { depth++; i += 2; continue; }\n        if (text[i] === '*' && text[i + 1] === '/') { depth--; i += 2; continue; }\n        i++;\n      }\n      if (depth > 0) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    // \"\u2026\" is one identifier token; \"\" inside it is an escaped quote.\n    if (ch === '\"') {\n      var end = i + 1;\n      var closedIdentifier = false;\n      while (end < text.length) {\n        if (text[end] === '\"' && text[end + 1] === '\"') { end += 2; continue; }\n        if (text[end] === '\"') { closedIdentifier = true; break; }\n        end++;\n      }\n      if (!closedIdentifier) return { ok: false, text: out };\n      out += text.slice(i, end + 1);\n      i = end + 1;\n      continue;\n    }\n    // $tag$ \u2026 $tag$ \u2014 the body is data whatever it holds.\n    if (ch === '$' && !inIdentifier(i)) {\n      var tagMatch = /^\\$[A-Za-z_][A-Za-z0-9_]*\\$|^\\$\\$/.exec(text.slice(i));\n      if (tagMatch) {\n        var tag = tagMatch[0];\n        var close = text.indexOf(tag, i + tag.length);\n        if (close === -1) return { ok: false, text: out };\n        i = close + tag.length;\n        out += ' ';\n        continue;\n      }\n    }\n    // E'\u2026' understands backslash escapes; a plain '\u2026' doubles the quote.\n    if (ch === \"'\" || ((ch === 'E' || ch === 'e') && next === \"'\" && !inIdentifier(i))) {\n      var escapes = ch !== \"'\";\n      if (escapes) i++;\n      i++;\n      var closed = false;\n      while (i < text.length) {\n        if (escapes && text[i] === '\\\\') { i += 2; continue; }\n        if (text[i] === \"'\" && text[i + 1] === \"'\") { i += 2; continue; }\n        if (text[i] === \"'\") { i++; closed = true; break; }\n        i++;\n      }\n      if (!closed) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    out += ch;\n    i++;\n  }\n  return { ok: true, text: out };\n}\n\nfunction __taNormalizeTable(tableName) {\n  var name = String(tableName || '').trim().toLowerCase();\n  var parts = name.split('.');\n  return parts[parts.length - 1].replace(/\"/g, '');\n}\n\n// An unreadable statement, or one that can reach a table without naming it,\n// counts as mentioning EVERY protected table: fail closed rather than let a\n// spelling this scan cannot see decide it is harmless.\nfunction __taSqlMentionsTable(sql, table) {\n  var cleaned = __taCleanSql(sql);\n  if (!cleaned.ok || __TA_OPAQUE_SQL_RE.test(cleaned.text)) return true;\n  var pattern = new RegExp('(?:^|[^A-Za-z0-9_])\"?' + table + '\"?(?![A-Za-z0-9_])', 'i');\n  return pattern.test(cleaned.text);\n}\n\nfunction __taIsCredentialTable(tableName) {\n  return __TA_CREDENTIAL_TABLES.indexOf(__taNormalizeTable(tableName)) !== -1;\n}\n\n// Credentials never travel in a row: a column is dropped by name, however the\n// caller spelled it in its projection.\nfunction __taWithoutCredentials(rows, tableName) {\n  if (!Array.isArray(rows)) return rows;\n  var dropped = tableName && __taIsCredentialTable(tableName)\n    ? __TA_CREDENTIAL_COLUMNS\n    : tableName ? [] : __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS;\n  if (dropped.length === 0) return rows;\n  return rows.map(function(row) {\n    if (!row || typeof row !== 'object') return row;\n    var copy = {};\n    Object.keys(row).forEach(function(key) {\n      if (dropped.indexOf(String(key).toLowerCase()) === -1) copy[key] = row[key];\n    });\n    return copy;\n  });\n}\n\nfunction __taForbid(table) {\n  var err = new Error('Forbidden: ' + table + ' is only accessible to server-side workflow nodes');\n  err.status = 403;\n  throw err;\n}\n\nfunction __taAssertSqlTextAllowed(sql) {\n  var text = String(sql || '');\n  // A statement can hand back a whole row (`SELECT u FROM users u`,\n  // `row_to_json(u)`) without naming a credential column, so the table itself\n  // is out of reach of anything but the server's own calls.\n  for (var ci = 0; ci < __TA_CREDENTIAL_TABLES.length; ci++) {\n    if (__taSqlMentionsTable(text, __TA_CREDENTIAL_TABLES[ci])) __taForbid(__TA_CREDENTIAL_TABLES[ci]);\n  }\n  for (var pi = 0; pi < __TA_PROTECTED_TABLES.length; pi++) {\n    if (__taSqlMentionsTable(text, __TA_PROTECTED_TABLES[pi])) __taForbid(__TA_PROTECTED_TABLES[pi]);\n  }\n  // A feed table has exactly one browser-readable shape, and a statement the\n  // caller wrote is not it.\n  for (var fi = 0; fi < __TA_FEED_TABLES.length; fi++) {\n    if (__taSqlMentionsTable(text, __TA_FEED_TABLES[fi])) __taForbid(__TA_FEED_TABLES[fi]);\n  }\n  var cleaned = __taCleanSql(text);\n  // Unreadable, or a write: either way the write-protected tables are refused.\n  if (cleaned.ok && !__TA_SQL_WRITE_RE.test(cleaned.text)) return;\n  for (var wi = 0; wi < __TA_WRITE_PROTECTED_TABLES.length; wi++) {\n    if (__taSqlMentionsTable(text, __TA_WRITE_PROTECTED_TABLES[wi])) __taForbid(__TA_WRITE_PROTECTED_TABLES[wi]);\n  }\n}\n\nfunction __taRoleOf(token) {\n  if (!token || typeof token !== 'object') return null;\n  if (typeof token.role === 'string') return token.role;\n  if (typeof token.roleName === 'string') return token.roleName;\n  if (Array.isArray(token.roles) && typeof token.roles[0] === 'string') return token.roles[0];\n  return null;\n}\n\n// The tables a read of `tableName` (or the raw statement) touches that this\n// route family may not serve to a browser: the protected ones, and the feed\n// tables, whose one browser-readable projection lives on the data API instead.\nvar __TA_ROUTE_PROTECTED_TABLES = __TA_PROTECTED_TABLES.concat(__TA_FEED_TABLES);\n\nfunction __taProtectedTablesRead(tableName, rawQuery) {\n  var touched = [];\n  var bare = __taNormalizeTable(tableName);\n  if (__TA_ROUTE_PROTECTED_TABLES.indexOf(bare) !== -1) touched.push(bare);\n  if (typeof rawQuery === 'string' && rawQuery.length > 0) {\n    for (var i = 0; i < __TA_ROUTE_PROTECTED_TABLES.length; i++) {\n      if (touched.indexOf(__TA_ROUTE_PROTECTED_TABLES[i]) === -1 && __taSqlMentionsTable(rawQuery, __TA_ROUTE_PROTECTED_TABLES[i])) {\n        touched.push(__TA_ROUTE_PROTECTED_TABLES[i]);\n      }\n    }\n  }\n  return touched;\n}\n\n// The projection an untrusted caller gets of a feed table, or null when the\n// table has no feed or the caller is a server-side one reading it whole.\nfunction __taPublicFeed(req, tableName) {\n  if (__taIsInternalRequest(req)) return null;\n  var feed = __TA_PUBLIC_FEED_TABLES[__taNormalizeTable(tableName)];\n  return feed || null;\n}\n\n// A feed is filtered and sorted only by the columns it serves: a condition on\n// any other column (or an expression over one) would answer for it.\nfunction __taAssertFeedFields(tableName, feed, fields) {\n  for (var i = 0; i < fields.length; i++) {\n    if (!fields[i]) continue;\n    var column = String(fields[i]).trim().replace(/\"/g, '').toLowerCase();\n    if (feed.columns.indexOf(column) === -1) __taForbid(__taNormalizeTable(tableName) + '.' + fields[i]);\n  }\n}\n\n// null when the read may proceed, else { status, message }.\nasync function __taGuardRead(req, tableName, rawQuery) {\n  if (typeof rawQuery === 'string' && rawQuery.length > 0 && __taBrowserIsReadOnly(req)) {\n    return { status: 403, message: 'Forbidden: raw queries are only available to server-side calls' };\n  }\n  var touched = __taProtectedTablesRead(tableName, rawQuery);\n  if (touched.length === 0) return null;\n  if (__taIsInternalRequest(req)) return null;\n  var token = null;\n  try {\n    token = await __tqSessionToken(req);\n  } catch (e) {\n    token = null;\n  }\n  if (!token) return { status: 401, message: 'Unauthenticated' };\n  var role = __taRoleOf(token);\n  if (!role || __TA_TRUSTED_READER_ROLES.indexOf(role) === -1) {\n    return { status: 403, message: 'Forbidden: ' + touched[0] + ' is only readable by the store administrators' };\n  }\n  return null;\n}\n");
+    return "// GENERATED \u2014 see generateTableAccessHelperCode in\n// @teleporthq/teleport-shared/src/utils/table-access.ts.\n//\n// Tables that ARE money, and tables that decide how much of it is given away.\n// A browser reads the first group only as a trusted role (the generated admin)\n// and writes the second group never; server-side workflow segments present the\n// app secret instead. One list for both data-route families.\nvar __TA_PROTECTED_TABLES = ".concat(JSON.stringify(PROTECTED_TABLES), ";\nvar __TA_WRITE_PROTECTED_TABLES = ").concat(JSON.stringify(WRITE_PROTECTED_TABLES), ";\n// Readable from a browser only as this projection of the rows the database\n// calls live \u2014 see PUBLIC_FEED_TABLES. The per-table routes serve a whole\n// table (and raw SQL), which cannot express a feed, so there they are refused\n// like a protected table.\nvar __TA_PUBLIC_FEED_TABLES = ").concat(JSON.stringify(PUBLIC_FEED_TABLES), ";\nvar __TA_FEED_TABLES = Object.keys(__TA_PUBLIC_FEED_TABLES);\nvar __TA_TRUSTED_READER_ROLES = ").concat(JSON.stringify(params.trustedReaderRoles), ";\nvar __TA_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(AUTH_CREDENTIAL_COLUMNS), ";\nvar __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS = ").concat(JSON.stringify(UNAMBIGUOUS_CREDENTIAL_COLUMNS), ";\nvar __TA_CREDENTIAL_TABLES = ").concat(JSON.stringify(AUTH_CREDENTIAL_TABLES), ";\nvar __TA_SQL_WRITE_RE = /\\b(?:insert|update|delete|merge|truncate)\\b/i;\n// What a statement can reach without spelling a table's name where this scan\n// can see it: a Unicode-escaped identifier (U&\"\\0075sers\" is `users`), the\n// functions that run SQL text or dump whole tables, schemas or the database\n// (the table name then sits in a string, or is not named at all), and the\n// planner statistics, which hold sampled column values of every table.\nvar __TA_OPAQUE_SQL_RE = /u&\"|\\b(?:query|table|cursor|schema|database)_to_xml\\w*\\s*\\(|\\bts_(?:stat|rewrite)\\s*\\(|\\bdblink\\w*\\s*\\(|\\bpg_read_(?:binary_)?file\\s*\\(|\\blo_(?:import|export|get)\\s*\\(|\\bpg_stat(?:s|istic)\\w*/i;\n\n// Only server code can read NEXTAUTH_SECRET, so a browser cannot forge the\n// header a server segment sends. An in-process call (getStaticProps and the\n// page-load workflows call the handler directly with a synthetic request)\n// marks its request object instead \u2014 a property, never a header, so nothing\n// on the wire can claim it.\nfunction __taPresentsAppSecret(req) {\n  var secret = req && req.headers && req.headers['x-internal-data-secret'];\n  return !!(secret && process.env.NEXTAUTH_SECRET && secret === process.env.NEXTAUTH_SECRET);\n}\n\nfunction __taIsRestrictedRequest(req) {\n  return __taPresentsAppSecret(req) && !!(req.headers && req.headers['x-tq-restricted-sql'] === '1');\n}\n\nfunction __taIsInternalRequest(req) {\n  if (req && req.__tqServerCall === true) return true;\n  return __taPresentsAppSecret(req) && !__taIsRestrictedRequest(req);\n}\n\n// A page's own data, read to render it (the module's `fetchData(params, { as:\n// 'visitor' })`): served what an anonymous visitor is, through a statement the\n// page itself wrote. Marked on the request object, like an internal call, so\n// nothing on the wire can claim it.\nfunction __taIsVisitorView(req) {\n  return !!(req && req.__tqVisitorView === true);\n}\n\n// Generated browser code reads through the structured routes and never sends\n// SQL or a write of its own \u2014 every data node runs server-side and presents\n// the secret. So where a secret exists to tell the two apart, anything else a\n// browser sends is refused whole: no statement scan has to be right about it.\n// An app without one (no authentication, hence no store) keeps the scan.\nfunction __taBrowserIsReadOnly(req) {\n  return !!process.env.NEXTAUTH_SECRET && !__taIsInternalRequest(req) && !__taIsRestrictedRequest(req);\n}\n\n// Comments and string literals out, so a table name inside a string neither\n// hides a reference nor fakes one. Quoted identifiers stay, whole: in Postgres\n// they name tables, which is exactly what is being looked for.\n//\n// \u26D4 This is a lexer, not a search: a quote or comment marker inside a quoted\n// identifier (\"x'\", \"--\") is part of the name, a `$` or an `E` inside an\n// identifier (a$b$, ELSE'\u2026') starts neither a dollar quote nor an escape\n// string, and a dollar-quoted body is consumed by its own tag. An UNTERMINATED\n// literal, identifier, comment or dollar quote makes the whole scan fail closed\n// (ok:false): a statement this cleaner cannot read is one it cannot vouch for.\nfunction __taCleanSql(sql) {\n  var text = String(sql || '');\n  var out = '';\n  var i = 0;\n  function inIdentifier(at) { return at > 0 && /[A-Za-z0-9_$]/.test(text[at - 1]); }\n  while (i < text.length) {\n    var ch = text[i];\n    var next = text[i + 1];\n    if (ch === '-' && next === '-') {\n      while (i < text.length && text[i] !== '\\n') i++;\n      continue;\n    }\n    if (ch === '/' && next === '*') {\n      i += 2;\n      var depth = 1;\n      while (i < text.length && depth > 0) {\n        if (text[i] === '/' && text[i + 1] === '*') { depth++; i += 2; continue; }\n        if (text[i] === '*' && text[i + 1] === '/') { depth--; i += 2; continue; }\n        i++;\n      }\n      if (depth > 0) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    // \"\u2026\" is one identifier token; \"\" inside it is an escaped quote.\n    if (ch === '\"') {\n      var end = i + 1;\n      var closedIdentifier = false;\n      while (end < text.length) {\n        if (text[end] === '\"' && text[end + 1] === '\"') { end += 2; continue; }\n        if (text[end] === '\"') { closedIdentifier = true; break; }\n        end++;\n      }\n      if (!closedIdentifier) return { ok: false, text: out };\n      out += text.slice(i, end + 1);\n      i = end + 1;\n      continue;\n    }\n    // $tag$ \u2026 $tag$ \u2014 the body is data whatever it holds.\n    if (ch === '$' && !inIdentifier(i)) {\n      var tagMatch = /^\\$[A-Za-z_][A-Za-z0-9_]*\\$|^\\$\\$/.exec(text.slice(i));\n      if (tagMatch) {\n        var tag = tagMatch[0];\n        var close = text.indexOf(tag, i + tag.length);\n        if (close === -1) return { ok: false, text: out };\n        i = close + tag.length;\n        out += ' ';\n        continue;\n      }\n    }\n    // E'\u2026' understands backslash escapes; a plain '\u2026' doubles the quote.\n    if (ch === \"'\" || ((ch === 'E' || ch === 'e') && next === \"'\" && !inIdentifier(i))) {\n      var escapes = ch !== \"'\";\n      if (escapes) i++;\n      i++;\n      var closed = false;\n      while (i < text.length) {\n        if (escapes && text[i] === '\\\\') { i += 2; continue; }\n        if (text[i] === \"'\" && text[i + 1] === \"'\") { i += 2; continue; }\n        if (text[i] === \"'\") { i++; closed = true; break; }\n        i++;\n      }\n      if (!closed) return { ok: false, text: out };\n      out += ' ';\n      continue;\n    }\n    out += ch;\n    i++;\n  }\n  return { ok: true, text: out };\n}\n\nfunction __taNormalizeTable(tableName) {\n  var name = String(tableName || '').trim().toLowerCase();\n  var parts = name.split('.');\n  return parts[parts.length - 1].replace(/\"/g, '');\n}\n\n// An unreadable statement, or one that can reach a table without naming it,\n// counts as mentioning EVERY protected table: fail closed rather than let a\n// spelling this scan cannot see decide it is harmless.\nfunction __taSqlMentionsTable(sql, table) {\n  var cleaned = __taCleanSql(sql);\n  if (!cleaned.ok || __TA_OPAQUE_SQL_RE.test(cleaned.text)) return true;\n  var pattern = new RegExp('(?:^|[^A-Za-z0-9_])\"?' + table + '\"?(?![A-Za-z0-9_])', 'i');\n  return pattern.test(cleaned.text);\n}\n\nfunction __taIsCredentialTable(tableName) {\n  return __TA_CREDENTIAL_TABLES.indexOf(__taNormalizeTable(tableName)) !== -1;\n}\n\n// Credentials never travel in a row: a column is dropped by name, however the\n// caller spelled it in its projection.\nfunction __taWithoutCredentials(rows, tableName) {\n  if (!Array.isArray(rows)) return rows;\n  var dropped = tableName && __taIsCredentialTable(tableName)\n    ? __TA_CREDENTIAL_COLUMNS\n    : tableName ? [] : __TA_UNAMBIGUOUS_CREDENTIAL_COLUMNS;\n  if (dropped.length === 0) return rows;\n  return rows.map(function(row) {\n    if (!row || typeof row !== 'object') return row;\n    var copy = {};\n    Object.keys(row).forEach(function(key) {\n      if (dropped.indexOf(String(key).toLowerCase()) === -1) copy[key] = row[key];\n    });\n    return copy;\n  });\n}\n\nfunction __taForbid(table) {\n  var err = new Error('Forbidden: ' + table + ' is only accessible to server-side workflow nodes');\n  err.status = 403;\n  throw err;\n}\n\nfunction __taAssertSqlTextAllowed(sql) {\n  var text = String(sql || '');\n  // A statement can hand back a whole row (`SELECT u FROM users u`,\n  // `row_to_json(u)`) without naming a credential column, so the table itself\n  // is out of reach of anything but the server's own calls.\n  for (var ci = 0; ci < __TA_CREDENTIAL_TABLES.length; ci++) {\n    if (__taSqlMentionsTable(text, __TA_CREDENTIAL_TABLES[ci])) __taForbid(__TA_CREDENTIAL_TABLES[ci]);\n  }\n  for (var pi = 0; pi < __TA_PROTECTED_TABLES.length; pi++) {\n    if (__taSqlMentionsTable(text, __TA_PROTECTED_TABLES[pi])) __taForbid(__TA_PROTECTED_TABLES[pi]);\n  }\n  // A feed table has exactly one browser-readable shape, and a statement the\n  // caller wrote is not it.\n  for (var fi = 0; fi < __TA_FEED_TABLES.length; fi++) {\n    if (__taSqlMentionsTable(text, __TA_FEED_TABLES[fi])) __taForbid(__TA_FEED_TABLES[fi]);\n  }\n  var cleaned = __taCleanSql(text);\n  // Unreadable, or a write: either way the write-protected tables are refused.\n  if (cleaned.ok && !__TA_SQL_WRITE_RE.test(cleaned.text)) return;\n  for (var wi = 0; wi < __TA_WRITE_PROTECTED_TABLES.length; wi++) {\n    if (__taSqlMentionsTable(text, __TA_WRITE_PROTECTED_TABLES[wi])) __taForbid(__TA_WRITE_PROTECTED_TABLES[wi]);\n  }\n}\n\nfunction __taRoleOf(token) {\n  if (!token || typeof token !== 'object') return null;\n  if (typeof token.role === 'string') return token.role;\n  if (typeof token.roleName === 'string') return token.roleName;\n  if (Array.isArray(token.roles) && typeof token.roles[0] === 'string') return token.roles[0];\n  return null;\n}\n\n// The tables a read of `tableName` (or the raw statement) touches that this\n// route family may not serve to a browser: the protected ones, and the feed\n// tables, whose one browser-readable projection lives on the data API instead.\nvar __TA_ROUTE_PROTECTED_TABLES = __TA_PROTECTED_TABLES.concat(__TA_FEED_TABLES);\n\nfunction __taProtectedTablesRead(tableName, rawQuery) {\n  var touched = [];\n  var bare = __taNormalizeTable(tableName);\n  if (__TA_ROUTE_PROTECTED_TABLES.indexOf(bare) !== -1) touched.push(bare);\n  if (typeof rawQuery === 'string' && rawQuery.length > 0) {\n    for (var i = 0; i < __TA_ROUTE_PROTECTED_TABLES.length; i++) {\n      if (touched.indexOf(__TA_ROUTE_PROTECTED_TABLES[i]) === -1 && __taSqlMentionsTable(rawQuery, __TA_ROUTE_PROTECTED_TABLES[i])) {\n        touched.push(__TA_ROUTE_PROTECTED_TABLES[i]);\n      }\n    }\n  }\n  return touched;\n}\n\n// The projection an untrusted caller gets of a feed table, or null when the\n// table has no feed or the caller is a server-side one reading it whole.\nfunction __taPublicFeed(req, tableName) {\n  if (__taIsInternalRequest(req)) return null;\n  var feed = __TA_PUBLIC_FEED_TABLES[__taNormalizeTable(tableName)];\n  return feed || null;\n}\n\n// A feed is filtered and sorted only by the columns it serves: a condition on\n// any other column (or an expression over one) would answer for it.\nfunction __taAssertFeedFields(tableName, feed, fields) {\n  for (var i = 0; i < fields.length; i++) {\n    if (!fields[i]) continue;\n    var column = String(fields[i]).trim().replace(/\"/g, '').toLowerCase();\n    if (feed.columns.indexOf(column) === -1) __taForbid(__taNormalizeTable(tableName) + '.' + fields[i]);\n  }\n}\n\n// null when the read may proceed, else { status, message }.\nasync function __taGuardRead(req, tableName, rawQuery) {\n  var visitorView = __taIsVisitorView(req);\n  if (typeof rawQuery === 'string' && rawQuery.length > 0 && __taBrowserIsReadOnly(req) && !visitorView) {\n    return { status: 403, message: 'Forbidden: raw queries are only available to server-side calls' };\n  }\n  var touched = __taProtectedTablesRead(tableName, rawQuery);\n  if (touched.length === 0) return null;\n  if (__taIsInternalRequest(req)) return null;\n  if (visitorView) {\n    // A page reads its members' public profiles: the auth users table alone,\n    // through the structured read, which the route's row policy projects onto\n    // the public profile columns. Nothing else protected, and no statement.\n    var readsProfiles = !(typeof rawQuery === 'string' && rawQuery.length > 0) &&\n      touched.length === 1 && __taIsCredentialTable(tableName);\n    // A visitor is nobody in particular: no session to read.\n    return readsProfiles ? null : { status: 401, message: 'Unauthenticated' };\n  }\n  var token = null;\n  try {\n    token = await __tqSessionToken(req);\n  } catch (e) {\n    token = null;\n  }\n  if (!token) return { status: 401, message: 'Unauthenticated' };\n  var role = __taRoleOf(token);\n  if (!role || __TA_TRUSTED_READER_ROLES.indexOf(role) === -1) {\n    return { status: 403, message: 'Forbidden: ' + touched[0] + ' is only readable by the store administrators' };\n  }\n  return null;\n}\n");
 };
 //# sourceMappingURL=table-access.js.map

package/dist/esm/utils/table-access.js.map

@@ -1 +1 @@
-{"version":3,"file":"table-access.js","sourceRoot":"","sources":["../../../src/utils/table-access.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,IAAM,YAAY,GAA0B;IACjD,qBAAqB;IACrB,iCAAiC;IACjC,mBAAmB;IACnB,8BAA8B;IAC9B,uEAAuE;IACvE,sEAAsE;IACtE,0DAA0D;IAC1D,sBAAsB;IACtB,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB;IACvB,wEAAwE;IACxE,qEAAqE;IACrE,yDAAyD;IACzD,wBAAwB;IACxB,uBAAuB;CACxB,CAAA;AAED,MAAM,CAAC,IAAM,sBAAsB;IACjC,OAAO;IACP,iBAAiB;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,yBAAyB;IACzB,8BAA8B;IAC9B,mCAAmC;IACnC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IACrB,qBAAqB;IACrB,8EAA8E;IAC9E,gEAAgE;IAChE,wBAAwB;IACxB,oBAAoB;IACpB,uEAAuE;IACvE,qEAAqE;IACrE,6BAA6B;IAC7B,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;GAK1B,uBAAuB;IAC1B,4EAA4E;IAC5E,mEAAmE;IACnE,mDAAmD;IACnD,oCAAoC;IACpC,4BAA4B;IAC5B,gCAAgC;IAChC,2BAA2B;IAC3B,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,8BAA8B;IAC9B,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;IAC3B,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,4BAA4B;IAC5B,kCAAkC;SACnC,CAAA;AAED,MAAM,CAAC,IAAM,gBAAgB,mCAA8B,YAAY,SAAK,sBAAsB,OAAC,CAAA;AAEnG,MAAM,CAAC,IAAM,sBAAsB,GAA0B,CAAC,oBAAoB,CAAC,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,IAAM,uBAAuB,GAA0B;IAC5D,UAAU;IACV,cAAc;IACd,eAAe;IACf,UAAU;IACV,eAAe;IACf,YAAY;IACZ,OAAO;IACP,YAAY;CACb,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,IAAM,sBAAsB,GAA0B,CAAC,OAAO,CAAC,CAAA;AAEtE;;;;;GAKG;AACH,IAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CACnE,UAAC,MAAM,IAAK,OAAA,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,EAA7C,CAA6C,CAC1D,CAAA;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,IAAM,kBAAkB,GAA8C;IAC3E,kBAAkB,EAAE;QAClB,+EAA+E;QAC/E,uEAAuE;QACvE,wEAAwE;QACxE,YAAY;QACZ,OAAO,EAAE;YACP,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,UAAU;YACV,eAAe;YACf,gBAAgB;YAChB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,cAAc;YACd,cAAc;YACd,WAAW;SACZ;QACD,SAAS,EACP,0GAA0G;KAC7G;CACF,CAAA;AAED,oFAAoF;AACpF,IAAM,iBAAiB,GAAG,aAAa,CAAA;AACvC,IAAM,kBAAkB,GAAG,QAAQ,CAAA;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,IAAM,sBAAsB,GAAG,UAAC,IAAgC;IACrE,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,CAAA;KACV;IACD,IAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,MAAM;QACxD,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE;YACrD,CAAC;YAAA,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,IAAI,IAAK,OAAA,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAArB,CAAqB,CAAC,CAAA;SACtE;IACH,CAAC,CAAC,CAAA;IACF,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;KACtC;IAED,IAAI,eAAe,GAAoB,IAAI,CAAA;4BAChC,IAAI;QACb,IAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,IAAI,KAAK,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAG,kBAAkB,MAAG,CAAC,EAAE;;SAEhF;QACD,IAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAA;QACzC,eAAe;YACb,eAAe,KAAK,IAAI;gBACtB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAChC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAA9B,CAA8B,CAAC,CAAA;;IATxE,KAAmB,UAAwC,EAAxC,KAAA,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EAAxC,cAAwC,EAAxC,IAAwC;QAAtD,IAAM,IAAI,SAAA;gBAAJ,IAAI;KAUd;IACD,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AACvC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,IAAM,yBAAyB,GAAG,UAAC,IAAgC;IACxE,OAAA,sBAAsB,CAAC,IAAI,CAAC;AAA5B,CAA4B,CAAA;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,IAAM,6BAA6B,GAAG,UAAC,MAE7C;IACC,OAAO,gdAOqB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,kDAC1B,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,wTAK1C,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,8GAEhC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,8CAC3C,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,0DAC3B,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,6CAC3D,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,29VA6PpE,CAAA;AACD,CAAC,CAAA"}
+{"version":3,"file":"table-access.js","sourceRoot":"","sources":["../../../src/utils/table-access.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAA;AAE1D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,IAAM,YAAY,GAA0B;IACjD,qBAAqB;IACrB,iCAAiC;IACjC,mBAAmB;IACnB,8BAA8B;IAC9B,uEAAuE;IACvE,sEAAsE;IACtE,0DAA0D;IAC1D,sBAAsB;IACtB,0EAA0E;IAC1E,qEAAqE;IACrE,uBAAuB;IACvB,wEAAwE;IACxE,qEAAqE;IACrE,yDAAyD;IACzD,wBAAwB;IACxB,uBAAuB;CACxB,CAAA;AAED,MAAM,CAAC,IAAM,sBAAsB;IACjC,OAAO;IACP,iBAAiB;IACjB,sBAAsB;IACtB,mBAAmB;IACnB,wBAAwB;IACxB,iBAAiB;IACjB,oBAAoB;IACpB,yBAAyB;IACzB,8BAA8B;IAC9B,mCAAmC;IACnC,0BAA0B;IAC1B,eAAe;IACf,qBAAqB;IACrB,qBAAqB;IACrB,8EAA8E;IAC9E,gEAAgE;IAChE,wBAAwB;IACxB,oBAAoB;IACpB,uEAAuE;IACvE,qEAAqE;IACrE,6BAA6B;IAC7B,0BAA0B;IAC1B,0EAA0E;IAC1E,0EAA0E;IAC1E,6BAA6B;GAK1B,uBAAuB;IAC1B,4EAA4E;IAC5E,mEAAmE;IACnE,mDAAmD;IACnD,oCAAoC;IACpC,4BAA4B;IAC5B,gCAAgC;IAChC,2BAA2B;IAC3B,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,yEAAyE;IACzE,8BAA8B;IAC9B,mBAAmB;IACnB,wBAAwB;IACxB,2BAA2B;IAC3B,0EAA0E;IAC1E,4EAA4E;IAC5E,gEAAgE;IAChE,4BAA4B;IAC5B,kCAAkC;SACnC,CAAA;AAED,MAAM,CAAC,IAAM,gBAAgB,mCAA8B,YAAY,SAAK,sBAAsB,OAAC,CAAA;AAEnG,MAAM,CAAC,IAAM,sBAAsB,GAA0B,CAAC,oBAAoB,CAAC,CAAA;AAEnF;;;;;GAKG;AACH,MAAM,CAAC,IAAM,uBAAuB,GAA0B;IAC5D,UAAU;IACV,cAAc;IACd,eAAe;IACf,UAAU;IACV,eAAe;IACf,YAAY;IACZ,OAAO;IACP,YAAY;CACb,CAAA;AAED,0EAA0E;AAC1E,MAAM,CAAC,IAAM,sBAAsB,GAA0B,CAAC,OAAO,CAAC,CAAA;AAEtE;;;;;GAKG;AACH,IAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CACnE,UAAC,MAAM,IAAK,OAAA,MAAM,KAAK,OAAO,IAAI,MAAM,KAAK,YAAY,EAA7C,CAA6C,CAC1D,CAAA;AASD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,IAAM,kBAAkB,GAA8C;IAC3E,kBAAkB,EAAE;QAClB,+EAA+E;QAC/E,uEAAuE;QACvE,wEAAwE;QACxE,YAAY;QACZ,OAAO,EAAE;YACP,IAAI;YACJ,MAAM;YACN,QAAQ;YACR,UAAU;YACV,eAAe;YACf,gBAAgB;YAChB,yBAAyB;YACzB,aAAa;YACb,cAAc;YACd,iBAAiB;YACjB,cAAc;YACd,kBAAkB;YAClB,cAAc;YACd,cAAc;YACd,WAAW;SACZ;QACD,SAAS,EACP,0GAA0G;KAC7G;CACF,CAAA;AAED,oFAAoF;AACpF,IAAM,iBAAiB,GAAG,aAAa,CAAA;AACvC,IAAM,kBAAkB,GAAG,QAAQ,CAAA;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,IAAM,sBAAsB,GAAG,UAAC,IAAgC;IACrE,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,EAAE,CAAA;KACV;IACD,IAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;IACrC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,MAAM;QACxD,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,iBAAiB,EAAE;YACrD,CAAC;YAAA,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,IAAI,IAAK,OAAA,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAArB,CAAqB,CAAC,CAAA;SACtE;IACH,CAAC,CAAC,CAAA;IACF,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,EAAE;QACxB,OAAO,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAA;KACtC;IAED,IAAI,eAAe,GAAoB,IAAI,CAAA;4BAChC,IAAI;QACb,IAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;QACtE,IAAI,KAAK,KAAK,kBAAkB,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,UAAG,kBAAkB,MAAG,CAAC,EAAE;;SAEhF;QACD,IAAM,SAAS,GAAG,IAAI,CAAC,YAAY,IAAI,EAAE,CAAA;QACzC,eAAe;YACb,eAAe,KAAK,IAAI;gBACtB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;gBAChC,CAAC,CAAC,eAAe,CAAC,MAAM,CAAC,UAAC,IAAI,IAAK,OAAA,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAA9B,CAA8B,CAAC,CAAA;;IATxE,KAAmB,UAAwC,EAAxC,KAAA,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,EAAxC,cAAwC,EAAxC,IAAwC;QAAtD,IAAM,IAAI,SAAA;gBAAJ,IAAI;KAUd;IACD,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;AACvC,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,IAAM,yBAAyB,GAAG,UAAC,IAAgC;IACxE,OAAA,sBAAsB,CAAC,IAAI,CAAC;AAA5B,CAA4B,CAAA;AAE9B;;;;;;GAMG;AACH,MAAM,CAAC,IAAM,sBAAsB,GAA0B;IAC3D,IAAI;IACJ,MAAM;IACN,cAAc;IACd,OAAO;IACP,QAAQ;IACR,YAAY;IACZ,KAAK;CACN,CAAA;AAED,IAAM,aAAa,GAAG,UAAC,SAAiB;IACtC,IAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;SAClC,IAAI,EAAE;SACN,WAAW,EAAE;SACb,KAAK,CAAC,GAAG,CAAC,CAAA;IACb,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;AAClD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,IAAM,oBAAoB,GAAG,UAAC,SAAiB;IACpD,IAAM,IAAI,GAAG,aAAa,CAAC,SAAS,CAAC,CAAA;IACrC,IAAI,sBAAsB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE;QAC/C,OAAO,KAAK,CAAA;KACb;IACD,OAAO,CACL,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,CAAC,CAC/D,CAAA;AACH,CAAC,CAAA;AAED,IAAM,YAAY,GAAG,UAAC,KAAa;IACjC,OAAA,KAAK,KAAK,kBAAkB,IAAI,KAAK,CAAC,UAAU,CAAC,UAAG,kBAAkB,MAAG,CAAC;AAA1E,CAA0E,CAAA;AAO5E;;;;;;GAMG;AACH,IAAM,oBAAoB,GAAG,UAAC,IAAwB;IACpD,IAAM,KAAK,GAAG,IAAI,GAAG,EAAqB,CAAA;IAC1C,IAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAA;IAC1D,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,UAAC,EAAc;YAAb,MAAM,QAAA,EAAE,IAAI,QAAA;QAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE;YAClE,OAAM;SACP;QACD,IAAM,WAAW,GAAG,OAAO;aACxB,MAAM,CAAC,UAAC,MAAM,YAAK,OAAA,CAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,QAAQ,0CAAG,MAAM,CAAC,MAAK,MAAM,CAAA,EAAA,CAAC;aACzD,OAAO,CAAC,UAAC,MAAM,IAAK,OAAA,MAAM,CAAC,YAAY,IAAI,EAAE,EAAzB,CAAyB,CAAC,CAAA;QACjD,IAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE;YACpB,YAAY,EAAE,CAAC,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,YAAY,CAAA,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY;YAC7D,KAAK,EAAE,KAAK,CAAC,IAAI,CACf,IAAI,GAAG,+CAAK,CAAC,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,KAAK,KAAI,EAAE,CAAC,SAAK,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,SAAK,WAAW,QAAE,CACpF;SACF,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IACF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE;QACjF,IAAM,UAAU,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC/C,KAAK,CAAC,GAAG,CAAC,kBAAkB,EAAE;YAC5B,YAAY,EAAE,IAAI;YAClB,KAAK,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;SACtD,CAAC,CAAA;KACH;IACD,OAAO,KAAK,CAAA;AACd,CAAC,CAAA;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,IAAM,gBAAgB,GAAG,UAC9B,IAAyC,EACzC,IAAgC;;IAEhC,IAAI,CAAC,IAAI,EAAE;QACT,OAAO,KAAK,CAAA;KACb;IACD,IAAM,YAAY,GAAG,yBAAyB,CAAC,IAAI,CAAC,CAAA;IACpD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE;QAC7B,OAAO,KAAK,CAAA;KACb;IACD,IAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAA,IAAI,CAAC,cAAc,0CAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACxE,IAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,cAAc,EAAE;QACvB,OAAO,KAAK,CAAA;KACb;IACD,IAAM,KAAK,GAAG,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAA;IACrE,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE;QAClC,OAAO,KAAK,CAAA;KACb;IACD,sFAAsF;IACtF,IAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAA;IACxC,IAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SACtC,MAAM,CAAC,UAAC,KAAK,IAAK,OAAA,KAAK,CAAC,UAAU,CAAC,UAAG,KAAK,MAAG,CAAC,EAA7B,CAA6B,CAAC;SAChD,IAAI,CAAC,UAAC,CAAC,EAAE,CAAC,IAAK,OAAA,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,EAAnB,CAAmB,CAAC,CAAC,CAAC,CAAC,CAAA;IACzC,IAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC7E,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE;QAC1D,OAAO,KAAK,CAAA;KACb;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAC,IAAI,IAAK,OAAA,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAjC,CAAiC,CAAC,CAAA;AACtE,CAAC,CAAA;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,IAAM,6BAA6B,GAAG,UAAC,MAE7C;IACC,OAAO,gdAOqB,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,kDAC1B,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,wTAK1C,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,8GAEhC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC,8CAC3C,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,0DAC3B,IAAI,CAAC,SAAS,CAAC,8BAA8B,CAAC,6CAC3D,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,o7XA+QpE,CAAA;AACD,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@teleporthq/teleport-shared",
-  "version": "0.44.0",
+  "version": "0.44.1",
   "description": "A utility belt for the entire teleportHQ ecosystem",
   "author": "teleportHQ",
   "license": "MIT",
@@ -29,5 +29,5 @@
     "jss": "^10.0.0",
     "jss-preset-default": "^10.0.0"
   },
-  "gitHead": "3f8ab44ace8163b154799b7ea68ece45b3cf9022"
+  "gitHead": "f17c2064dd4ed978d9a022e98777a7ebf14d3e63"
 }

package/src/index.ts

@@ -25,6 +25,7 @@ import * as SessionCookieResolver from './utils/session-cookie-resolver'
 import * as SubscriptionAccess from './utils/subscription-access'
 import * as FontPreconnect from './utils/font-preconnect'
 import * as EmailDate from './utils/email-date'
+import * as EmailSender from './utils/email-sender'
 import * as RichTextEmbeds from './utils/rich-text-embeds'
 import * as RichTextEmbedsCodegen from './utils/rich-text-embeds-codegen'
 import * as RichTextContent from './utils/rich-text-content'
@@ -67,6 +68,7 @@ export {
   SubscriptionAccess,
   FontPreconnect,
   EmailDate,
+  EmailSender,
   RichTextEmbeds,
   RichTextEmbedsCodegen,
   RichTextContent,

package/src/page-transition/view-transition-css.ts

@@ -18,13 +18,16 @@ import * as PageTransition from './variants'
  *          arriving page; the first animates over [0, D], the second waits D
  *          and animates over [D, 2D]. Same order, same timing.
  *
- * The reveals (Circle, the Wipes) are the exception, in both exports: the
- * arriving page is revealed OVER the leaving one, which holds still underneath
- * for the whole run. Played one after the other, the leaving page was wiped
- * away to the site's bare background and the arriving one wiped in over it —
- * a white sheet between every two pages. Here the leaving picture keeps no
- * animation (the browser would otherwise fade it out under the arriving one)
- * and the arriving picture opens over [0, D].
+ * The reveals (Circle, the Wipes) and the dissolves (Fade, Crossfade) are the
+ * exception, in both exports: the arriving page comes in OVER the leaving one,
+ * which holds still underneath for the whole run. Played one after the other,
+ * the leaving page was wiped or faded away to the site's bare background before
+ * the arriving one came in — an empty screen between every two pages. Here the
+ * leaving picture keeps no animation (the browser would otherwise fade it out
+ * under the arriving one) and the arriving picture comes in over [0, D]. A
+ * picture of a page is opaque (the site's background included), so a dissolve
+ * shows the two pages mixed and never the background between them; faded both
+ * at once, the background showed through the two.
  *
  * A browser without the feature (Firefox today) simply navigates, which is
  * also what a visitor who asked for less motion gets.
@@ -81,6 +84,10 @@ const COVER_CLIPS: Record<string, { covered: string; opening: string }> = {
 }
 const OPEN = 'inset(0 0 0 0)'
 
+/** A dissolve (Fade, Crossfade): the arriving page fades in over the leaving one, which holds. */
+export const pageTransitionDissolves = (preset: string): boolean =>
+  preset === 'fade' || preset === 'crossfade'
+
 interface Animations {
   leave: [State, State]
   arrive: [State, State]
@@ -128,6 +135,8 @@ export interface ViewTransitionPlan {
   flies: boolean
   /** The arriving page is revealed over the leaving one, which holds (Circle, the Wipes). */
   revealsOver: boolean
+  /** The arriving page comes in over the leaving one, which holds: a reveal, or a dissolve (Fade, Crossfade). */
+  arrivesOver: boolean
 }
 
 export const viewTransitionPlan = (
@@ -170,20 +179,21 @@ export const viewTransitionPlan = (
     : null
 
   const timing = `${duration}s cubic-bezier(${curve.join(', ')})`
-  // A reveal opens the arriving page over the leaving one: only the arrival
-  // animates, from the start, and the leaving picture just stays.
+  // A reveal or a dissolve brings the arriving page in over the leaving one:
+  // only the arrival animates, from the start, and the leaving picture just stays.
   const revealsOver = !COVER_CLIPS[preset] && forward.arrive[1].clipPath !== undefined
-  const arriveTiming = revealsOver ? `${timing} both` : `${timing} ${duration}s both`
+  const arrivesOver = revealsOver || pageTransitionDissolves(preset)
+  const arriveTiming = arrivesOver ? `${timing} both` : `${timing} ${duration}s both`
   const rules = [
     // Opting every page in is for page-to-page navigations only; a single-page
     // app starts its own transitions and must not turn full reloads into them.
     ...(target.crossDocument ? ['@view-transition {\n  navigation: auto;\n}'] : []),
     '::view-transition-old(root),\n::view-transition-new(root) {\n  mix-blend-mode: normal;\n}',
-    revealsOver
+    arrivesOver
       ? '::view-transition-old(root) {\n  animation: none;\n}'
       : `::view-transition-old(root) {\n  animation: tq-page-leave ${timing} both;\n}`,
     `::view-transition-new(root) {\n  animation: tq-page-arrive ${arriveTiming};\n}`,
-    ...(revealsOver ? [] : [keyframes('tq-page-leave', forward.leave[0], forward.leave[1])]),
+    ...(arrivesOver ? [] : [keyframes('tq-page-leave', forward.leave[0], forward.leave[1])]),
     keyframes('tq-page-arrive', forward.arrive[0], forward.arrive[1]),
   ]
   if (COVER_CLIPS[preset]) {
@@ -194,14 +204,14 @@ export const viewTransitionPlan = (
     )
   }
   if (back) {
-    if (!revealsOver) {
+    if (!arrivesOver) {
       rules.push(
         `html[${BACK_ATTR}="back"]::view-transition-old(root) {\n  animation-name: tq-page-leave-back;\n}`
       )
     }
     rules.push(
       `html[${BACK_ATTR}="back"]::view-transition-new(root) {\n  animation-name: tq-page-arrive-back;\n}`,
-      ...(revealsOver ? [] : [keyframes('tq-page-leave-back', back.leave[0], back.leave[1])]),
+      ...(arrivesOver ? [] : [keyframes('tq-page-leave-back', back.leave[0], back.leave[1])]),
       keyframes('tq-page-arrive-back', back.arrive[0], back.arrive[1])
     )
   }
@@ -212,13 +222,13 @@ export const viewTransitionPlan = (
   // with its page instead of lingering over the next one.
   const flies = config.flyingPictures !== false
   if (flies) {
-    const flight = revealsOver ? duration : duration * 2
+    const flight = arrivesOver ? duration : duration * 2
     rules.push(
       `::view-transition-group(${MORPH_NAME}) {\n  animation-duration: ${flight}s;\n  animation-timing-function: cubic-bezier(${curve.join(
         ', '
       )});\n}`,
       `::view-transition-old(${MORPH_NAME}),\n::view-transition-new(${MORPH_NAME}) {\n  height: 100%;\n  object-fit: cover;\n  overflow: clip;\n  animation-duration: ${flight}s;\n}`,
-      revealsOver
+      arrivesOver
         ? `::view-transition-old(${MORPH_NAME}):only-child {\n  animation: tq-morph-away ${timing} both;\n}`
         : `::view-transition-old(${MORPH_NAME}):only-child {\n  animation: tq-page-leave ${timing} both, tq-morph-away ${timing} both;\n}`,
       `::view-transition-new(${MORPH_NAME}):only-child {\n  animation: tq-page-arrive ${arriveTiming}, tq-morph-in ${arriveTiming};\n}`,
@@ -233,5 +243,6 @@ export const viewTransitionPlan = (
     needsOrigin,
     flies,
     revealsOver,
+    arrivesOver,
   }
 }

package/src/utils/email-sender.ts

@@ -0,0 +1,74 @@
+/**
+ * The sender ("From") of an email a published site sends, as ES5 source for the
+ * generated runtime code that cannot import from this package: the workflow
+ * email nodes, the welcome and farewell routes, the invoice sender and the
+ * store's order-notification sender. One rule, so every path names the sender
+ * the same way.
+ *
+ * The editor stores the sender as an address plus a separate display name
+ * (`from` and `fromName`). A provider takes it either as one RFC 5322 mailbox
+ * string (Postmark, Resend, Mailgun, nodemailer) or as its two parts
+ * (SendGrid's `{ email, name }`, MailerSend's `Sender`), so the emitted
+ * `__emailSender({ from, name })` answers both: `{ email, name, header }`.
+ *
+ * - No name: the bare address, as before.
+ * - A name holding an RFC 5322 special — `( ) < > [ ] : ; @ \ , . "` — is
+ *   quoted, its `"` and `\` escaped. Unquoted, `Smith, Jones & Co <a@x.test>`
+ *   reaches the provider as two addresses.
+ * - Line breaks and other control characters become spaces: a header ends at a
+ *   line break, so a name carrying one would break the header.
+ * - A `from` that already names its sender (`Shop <a@x.test>`) keeps that name
+ *   and is never wrapped a second time; a name typed with its own quotes is not
+ *   quoted twice.
+ *
+ * ⛔ ONE parameter. The source is appended to serialized node handlers whose
+ * entry point a minified build finds by arity (a 2-param declaration wins, see
+ * `resolveHandlerEntryName`), so a 2-param helper would be called in place of
+ * the handler. A string literal rather than a `.toString()`, so a consumer's
+ * minifier can neither drop nor rename the declaration (see
+ * `commerce-tracking.ts` in teleport-plugin-next-workflows).
+ */
+
+/** What a caller passes: the stored address and display name. */
+export interface EmailSenderInput {
+  from?: unknown
+  name?: unknown
+}
+
+/** What the emitted helper answers. */
+export interface EmailSenderParts {
+  email: string
+  name: string
+  header: string
+}
+
+export const generateEmailSenderHelperCode = (): string => `
+// The sender of an email as { email, name, header }: header is the mailbox for a
+// provider taking the From as one string, email and name are its two parts.
+function __emailSender(sender) {
+  function text(value) {
+    return typeof value === 'string' || typeof value === 'number' ? String(value) : '';
+  }
+  function plainName(value) {
+    var name = text(value).replace(/[\\s\\u0000-\\u001f\\u007f]+/g, ' ').trim();
+    var quoted = /^"((?:[^"\\\\]|\\\\.)*)"$/.exec(name);
+    return quoted ? quoted[1].replace(/\\\\(.)/g, '$1').trim() : name;
+  }
+  var email = text(sender && sender.from).trim();
+  var name = plainName(sender && sender.name);
+  var named = /^([^<>]*)<([^<>]*)>$/.exec(email);
+  if (named) {
+    email = named[2].trim();
+    name = plainName(named[1]) || name;
+  } else if (/[<>]/.test(email)) {
+    return { email: email, name: '', header: email };
+  }
+  if (!email || !name) {
+    return { email: email, name: '', header: email };
+  }
+  var display = /[()<>\\[\\]:;@\\\\,."]/.test(name)
+    ? '"' + name.replace(/(["\\\\])/g, '\\\\$1') + '"'
+    : name;
+  return { email: email, name: name, header: display + ' <' + email + '>' };
+}
+`

package/src/utils/table-access.ts

@@ -245,6 +245,135 @@ export const resolveAdminPanelRoles = (auth?: UIDLAuthentication | null): string
 export const resolveTrustedReaderRoles = (auth?: UIDLAuthentication | null): string[] =>
   resolveAdminPanelRoles(auth)
 
+/**
+ * What a page shows of a member to whoever opens it: their public profile —
+ * who they are, never how to reach them. A page's own data, read for a visitor,
+ * carries only these columns of the auth users table: never an email, a phone
+ * or an address, a credential, a role or anything else of the account. The
+ * member's own private fields reach their own page from their session.
+ */
+export const PUBLIC_PROFILE_COLUMNS: ReadonlyArray<string> = [
+  'id',
+  'name',
+  'display_name',
+  'image',
+  'avatar',
+  'avatar_url',
+  'bio',
+]
+
+const bareTableName = (tableName: string): string => {
+  const parts = String(tableName || '')
+    .trim()
+    .toLowerCase()
+    .split('.')
+  return parts[parts.length - 1].replace(/"/g, '')
+}
+
+/**
+ * The tables a page's own data, read for a visitor (`pageReadsAsStore` false),
+ * gets no row of — so it need not ask: the protected ones, and the feed tables,
+ * whose one visitor projection lives on the data API. Not the auth users table:
+ * a page reads its members' public profiles (`PUBLIC_PROFILE_COLUMNS`).
+ */
+export const pageDataReadsNoRowOf = (tableName: string): boolean => {
+  const bare = bareTableName(tableName)
+  if (AUTH_CREDENTIAL_TABLES.indexOf(bare) !== -1) {
+    return false
+  }
+  return (
+    PROTECTED_TABLES.indexOf(bare) !== -1 ||
+    Object.prototype.hasOwnProperty.call(PUBLIC_FEED_TABLES, bare)
+  )
+}
+
+const isAdminRoute = (route: string): boolean =>
+  route === ADMIN_ROUTE_PREFIX || route.startsWith(`${ADMIN_ROUTE_PREFIX}/`)
+
+interface RouteGate {
+  requiresAuth: boolean
+  roles: string[]
+}
+
+/**
+ * The gate the generated middleware puts on each route it knows
+ * (`generateMiddlewareFile`): a page's own protection, the roles of the
+ * role-gated folders it sits in merged in, and `/admin` — when any admin page
+ * is protected — admitting the admin panel's roles. A row-owned page is left
+ * to its own SQL there, so it gates nothing here either.
+ */
+const middlewareRouteGates = (auth: UIDLAuthentication): Map<string, RouteGate> => {
+  const gates = new Map<string, RouteGate>()
+  const folders = Object.values(auth.folderProtection || {})
+  Object.entries(auth.pageProtection || {}).forEach(([pageId, page]) => {
+    if (!page || typeof page.route !== 'string' || page.rowOwnerColumn) {
+      return
+    }
+    const folderRoles = folders
+      .filter((folder) => folder?.children?.[pageId] === 'page')
+      .flatMap((folder) => folder.allowedRoles || [])
+    const existing = gates.get(page.route)
+    gates.set(page.route, {
+      requiresAuth: !!existing?.requiresAuth || !!page.requiresAuth,
+      roles: Array.from(
+        new Set([...(existing?.roles || []), ...(page.allowedRoles || []), ...folderRoles])
+      ),
+    })
+  })
+  if (!gates.has(ADMIN_ROUTE_PREFIX) && Array.from(gates.keys()).some(isAdminRoute)) {
+    const panelRoles = resolveAdminPanelRoles(auth)
+    gates.set(ADMIN_ROUTE_PREFIX, {
+      requiresAuth: true,
+      roles: panelRoles.length > 0 ? panelRoles : ['admin'],
+    })
+  }
+  return gates
+}
+
+/**
+ * Whether a page's own data — what its getStaticProps / getServerSideProps
+ * read to render it — may be read as the store rather than as a visitor.
+ *
+ * Only an admin panel page that nobody but the store's trusted readers may
+ * open: at `/admin` or below, behind the middleware, with every role its gate
+ * admits in `resolveTrustedReaderRoles`. Whoever receives that page's data
+ * could read the same rows through the data routes. Every other page — public,
+ * members-only, or an admin screen another role may open — is rendered with
+ * what a visitor is served, since its data reaches whoever opens it, and
+ * through `/_next/data` without rendering it at all. `route` is the page's
+ * path when its own protection does not name it.
+ */
+export const pageReadsAsStore = (
+  page: { route?: string; pageId?: string },
+  auth?: UIDLAuthentication | null
+): boolean => {
+  if (!auth) {
+    return false
+  }
+  const trustedRoles = resolveTrustedReaderRoles(auth)
+  if (trustedRoles.length === 0) {
+    return false
+  }
+  const own = page.pageId ? auth.pageProtection?.[page.pageId] : undefined
+  if (own?.rowOwnerColumn) {
+    return false
+  }
+  const route = typeof own?.route === 'string' ? own.route : page.route
+  if (!route || !isAdminRoute(route)) {
+    return false
+  }
+  // The middleware's resolution: the route's own gate, else its nearest gated ancestor.
+  const gates = middlewareRouteGates(auth)
+  const ancestor = Array.from(gates.keys())
+    .filter((gated) => route.startsWith(`${gated}/`))
+    .sort((a, b) => b.length - a.length)[0]
+  const gate = gates.get(route) || (ancestor ? gates.get(ancestor) : undefined)
+  if (!gate || !gate.requiresAuth || gate.roles.length === 0) {
+    return false
+  }
+  return gate.roles.every((role) => trustedRoles.indexOf(role) !== -1)
+}
+
 /**
  * ES5 source of the guard, inlined into a generated route. Declares:
  *  - `__taIsInternalRequest(req)` — the caller presented the app secret, or
@@ -327,6 +456,14 @@ function __taIsInternalRequest(req) {
   return __taPresentsAppSecret(req) && !__taIsRestrictedRequest(req);
 }
 
+// A page's own data, read to render it (the module's \`fetchData(params, { as:
+// 'visitor' })\`): served what an anonymous visitor is, through a statement the
+// page itself wrote. Marked on the request object, like an internal call, so
+// nothing on the wire can claim it.
+function __taIsVisitorView(req) {
+  return !!(req && req.__tqVisitorView === true);
+}
+
 // Generated browser code reads through the structured routes and never sends
 // SQL or a write of its own — every data node runs server-side and presents
 // the secret. So where a secret exists to tell the two apart, anything else a
@@ -533,12 +670,22 @@ function __taAssertFeedFields(tableName, feed, fields) {
 
 // null when the read may proceed, else { status, message }.
 async function __taGuardRead(req, tableName, rawQuery) {
-  if (typeof rawQuery === 'string' && rawQuery.length > 0 && __taBrowserIsReadOnly(req)) {
+  var visitorView = __taIsVisitorView(req);
+  if (typeof rawQuery === 'string' && rawQuery.length > 0 && __taBrowserIsReadOnly(req) && !visitorView) {
     return { status: 403, message: 'Forbidden: raw queries are only available to server-side calls' };
   }
   var touched = __taProtectedTablesRead(tableName, rawQuery);
   if (touched.length === 0) return null;
   if (__taIsInternalRequest(req)) return null;
+  if (visitorView) {
+    // A page reads its members' public profiles: the auth users table alone,
+    // through the structured read, which the route's row policy projects onto
+    // the public profile columns. Nothing else protected, and no statement.
+    var readsProfiles = !(typeof rawQuery === 'string' && rawQuery.length > 0) &&
+      touched.length === 1 && __taIsCredentialTable(tableName);
+    // A visitor is nobody in particular: no session to read.
+    return readsProfiles ? null : { status: 401, message: 'Unauthenticated' };
+  }
   var token = null;
   try {
     token = await __tqSessionToken(req);