@venturekit-pro/tenancy 0.0.13 → 0.0.14

package/dist/middleware/index.d.ts

@@ -5,6 +5,7 @@ export { createTenantMiddleware, TenantNotFoundError, TenantSuspendedError, Tena
 export { createQuotaMiddleware, QuotaExceededError, checkQuotas } from './quota-middleware.js';
 export { createRuntimeTenantMiddleware, hostPrefixDomainResolver, } from './runtime-tenant-middleware.js';
 export type { RuntimeTenantResolver, RuntimeTenantMiddlewareOptions, HostPrefixDomainResolverOptions, } from './runtime-tenant-middleware.js';
+export { createTenantRlsMiddleware } from './rls-middleware.js';
 export { createTenantUserScopesMiddleware, getTenantUser, requireTenantUser, } from './tenant-user-scopes-middleware.js';
 export type { TenantUserWithRole, TenantUserResolver, TenantUserScopesMiddlewareOptions, RoleScopesLookup, } from './tenant-user-scopes-middleware.js';
 export { TENANT_ROLES_CLAIM, TENANT_ROLES_MAX_LENGTH, packTenantRoles, unpackTenantRoles, } from './tenant-roles-claim.js';

package/dist/middleware/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iCAAiC,EACjC,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EACV,qBAAqB,EACrB,8BAA8B,EAC9B,+BAA+B,GAChC,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAC5C,YAAY,EACV,kBAAkB,EAClB,kBAAkB,EAClB,iCAAiC,EACjC,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,qBAAqB,EACrB,6BAA6B,GAC9B,MAAM,wBAAwB,CAAC"}

package/dist/middleware/index.js

@@ -4,6 +4,7 @@
 export { createTenantMiddleware, TenantNotFoundError, TenantSuspendedError, TenantInactiveError, } from './tenant-middleware.js';
 export { createQuotaMiddleware, QuotaExceededError, checkQuotas } from './quota-middleware.js';
 export { createRuntimeTenantMiddleware, hostPrefixDomainResolver, } from './runtime-tenant-middleware.js';
+export { createTenantRlsMiddleware } from './rls-middleware.js';
 export { createTenantUserScopesMiddleware, getTenantUser, requireTenantUser, } from './tenant-user-scopes-middleware.js';
 export { TENANT_ROLES_CLAIM, TENANT_ROLES_MAX_LENGTH, packTenantRoles, unpackTenantRoles, } from './tenant-roles-claim.js';
 export { createTenantHandoffAuthorize, normalizeHandoffHost, } from './handoff-authorize.js';

package/dist/middleware/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAC/F,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AAMxC,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAChE,OAAO,EACL,gCAAgC,EAChC,aAAa,EACb,iBAAiB,GAClB,MAAM,oCAAoC,CAAC;AAO5C,OAAO,EACL,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,OAAO,EACL,4BAA4B,EAC5B,oBAAoB,GACrB,MAAM,wBAAwB,CAAC"}

package/dist/middleware/rls-middleware.d.ts

@@ -0,0 +1,28 @@
+import type { Middleware, RequestContext } from '@venturekit/runtime';
+/**
+ * Build the middleware that opens a `@venturekit/data` tenant scope for
+ * the resolved `ctx.tenant`, so Postgres RLS policies apply to every
+ * query in the request.
+ *
+ * Takes no options: the scope is derived entirely from `ctx.tenant`,
+ * and "no tenant" is not configurable because inheriting a stale scope
+ * is never the safe choice.
+ *
+ * @example
+ * ```ts
+ * import { handler } from '@venturekit/runtime';
+ * import {
+ *   createRuntimeTenantMiddleware,
+ *   createTenantRlsMiddleware,
+ * } from '@venturekit-pro/tenancy';
+ *
+ * const tenancy = createRuntimeTenantMiddleware({ resolver });
+ * const rls = createTenantRlsMiddleware();
+ *
+ * export const main = handler(async () => listPosts(), {
+ *   middleware: [tenancy, rls],
+ * });
+ * ```
+ */
+export declare function createTenantRlsMiddleware(): Middleware<RequestContext>;
+//# sourceMappingURL=rls-middleware.d.ts.map

package/dist/middleware/rls-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-middleware.d.ts","sourceRoot":"","sources":["../../src/middleware/rls-middleware.ts"],"names":[],"mappings":"AAoDA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAEtE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAgB,yBAAyB,IAAI,UAAU,CAAC,cAAc,CAAC,CAStE"}

package/dist/middleware/rls-middleware.js

@@ -0,0 +1,89 @@
+/**
+ * Row-level-security scope middleware.
+ *
+ * Bridges the tenant this package RESOLVES (`ctx.tenant`, set by
+ * {@link createRuntimeTenantMiddleware}) to the tenant
+ * `@venturekit/data` PUBLISHES to Postgres, so RLS policies enforce
+ * isolation for every query the request makes.
+ *
+ * Without this, tenant isolation rests entirely on each query carrying
+ * a hand-written tenant predicate. That is unenforceable in practice:
+ * the common safe shape — check the tenant in one query, then act on
+ * the primary key in the next — is textually indistinguishable from
+ * the unsafe shape, so neither the compiler nor review catches an
+ * omission. With this middleware plus the policies described in
+ * `@venturekit/data`'s `query/tenant.ts`, a forgotten predicate returns
+ * zero rows instead of another tenant's data.
+ *
+ * # Placement (this ordering is load-bearing)
+ *
+ * ```ts
+ * middleware: [
+ *   tenancy,              // resolves ctx.tenant
+ *   tenantRls(),          // ← opens the RLS scope
+ *   tenantUserScopes(),   // QUERIES the membership row
+ * ]
+ * ```
+ *
+ * It must come AFTER tenant resolution (it reads `ctx.tenant`) and
+ * BEFORE any middleware that touches the database. In particular
+ * {@link createTenantUserScopesMiddleware} loads the caller's
+ * tenant-user row on the store-fallback path; if RLS is not yet scoped
+ * when that runs, the row is invisible, no scopes are granted, and
+ * every privileged route 403s. Ordering this wrong fails loudly rather
+ * than silently, which is the intended trade-off.
+ *
+ * # No tenant resolved
+ *
+ * Public routes and platform-level endpoints run through
+ * `runWithoutTenant()` rather than being left un-scoped. That matters:
+ * pooled connections are reused, so inheriting whichever tenant last
+ * touched the connection would be both wrong and non-deterministic.
+ * Clearing it means tenant-scoped tables return nothing — the
+ * fail-closed default. Genuinely cross-tenant work (operator tooling,
+ * sweeps over every tenant) belongs on a database role that bypasses
+ * RLS, not on an ambient scope left over from another request.
+ *
+ * Like `tenant-user-scopes-middleware.ts`, this module imports VALUES
+ * from an optional peer (`@venturekit/data`). That is deliberate and
+ * consistent: an RLS bridge is meaningless unless the app's data layer
+ * is the one publishing the GUC.
+ */
+import { runWithTenant, runWithoutTenant } from '@venturekit/data';
+/**
+ * Build the middleware that opens a `@venturekit/data` tenant scope for
+ * the resolved `ctx.tenant`, so Postgres RLS policies apply to every
+ * query in the request.
+ *
+ * Takes no options: the scope is derived entirely from `ctx.tenant`,
+ * and "no tenant" is not configurable because inheriting a stale scope
+ * is never the safe choice.
+ *
+ * @example
+ * ```ts
+ * import { handler } from '@venturekit/runtime';
+ * import {
+ *   createRuntimeTenantMiddleware,
+ *   createTenantRlsMiddleware,
+ * } from '@venturekit-pro/tenancy';
+ *
+ * const tenancy = createRuntimeTenantMiddleware({ resolver });
+ * const rls = createTenantRlsMiddleware();
+ *
+ * export const main = handler(async () => listPosts(), {
+ *   middleware: [tenancy, rls],
+ * });
+ * ```
+ */
+export function createTenantRlsMiddleware() {
+    return {
+        name: 'tenant-rls',
+        fn: async (ctx, next) => {
+            const tenantId = ctx.tenant?.id;
+            if (!tenantId)
+                return runWithoutTenant(next);
+            return runWithTenant(tenantId, next);
+        },
+    };
+}
+//# sourceMappingURL=rls-middleware.js.map

package/dist/middleware/rls-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rls-middleware.js","sourceRoot":"","sources":["../../src/middleware/rls-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AACH,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAGnE;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;YACtB,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,QAAQ;gBAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@venturekit-pro/tenancy",
-  "version": "0.0.13",
+  "version": "0.0.14",
   "description": "Multi-tenant utilities for VentureKit",
   "type": "module",
   "main": "./dist/index.js",
@@ -25,24 +25,29 @@
   "licenseHeader": "VentureKit Pro Commercial License — production use requires a valid VentureKit Pro license key. See https://venturekit.dev/pricing.",
   "exports": {
     ".": {
-      "import": "./dist/index.js",
-      "types": "./dist/index.d.ts"
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
     }
   },
   "dependencies": {
-    "@venturekit/core": "0.0.13"
+    "@venturekit/core": "0.0.14"
   },
   "peerDependencies": {
-    "@venturekit/runtime": "0.0.13"
+    "@venturekit/data": "0.0.14",
+    "@venturekit/runtime": "0.0.14"
   },
   "peerDependenciesMeta": {
+    "@venturekit/data": {
+      "optional": true
+    },
     "@venturekit/runtime": {
       "optional": true
     }
   },
   "devDependencies": {
     "@types/node": "^26.1.0",
-    "@venturekit/runtime": "0.0.13",
+    "@venturekit/data": "0.0.14",
+    "@venturekit/runtime": "0.0.14",
     "typescript": "^5.3.0"
   },
   "scripts": {