@vibeorm/schema 5.6.0 → 5.7.0

package/dist/errors.d.ts

@@ -194,7 +194,11 @@ export declare const SCOPED_REFUSAL_REASONS: readonly [
 /** A create leaves out a column a list scope restricts — the handle never picks a value from the list. */
 "scope_value_required", 
 /** `$scoped({ scopes: {} })` — the named form binds at least one scope. */
-"no_scope_bound"];
+"no_scope_bound", 
+/** A { through } relation's effective onDelete/onUpdate is SetDefault, or SetNull on an all-nullable key: the database could detach the row from its parent. */
+"through_detachable", 
+/** A { column } entry's column is part of a foreign key declaring SetDefault: the database could write another tenant's value into it. */
+"column_set_default"];
 export type ScopedRefusalReason = (typeof SCOPED_REFUSAL_REASONS)[number];
 /**
  * A refusal from a tenant-scoped handle (`$scoped`). Carries the model, the

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { PREDICATE_COMPARISON_OPS, assertPredicateCapabilities, inspectPredicate
 export type { PredicateBooleanUsage, PredicateCapabilityInput, PredicateCapabilityIssue, PredicateCapabilityTable, PredicateComparisonOp, PredicateExpression, PredicateFieldRef, PredicateInspection, PredicateIR, PredicateNodeKind, PredicateNumericType, PredicateOperand, PredicateResultType, PredicateUsage, PredicateValue } from "./predicate.ts";
 export { CHECK_RULE_GROUP_MAX, checkRulePredicate } from "./check-rules.ts";
 export type { CheckRule, CheckRuleGroupKind, CheckRuleLiteral } from "./check-rules.ts";
-export { resolveOnDelete, resolveOnUpdate, resolveReferentialActions } from "./referential-actions.ts";
+export { resolveOnDelete, resolveOnUpdate, resolveReferentialActions, setDefaultRelationOf } from "./referential-actions.ts";
 export { assertMigrationObjects, isSqlObjectDefinition, isSqlObjectIdentity, sqlObjectKey, sqlObjectNamespace } from "./migration-objects.ts";
 export type { MigrationObjectIR, QualifiedSqlName, SqlObjectDefinition, SqlObjectDefinitionFormat, SqlObjectFacts, SqlObjectIdentity } from "./migration-objects.ts";
 export type { AdvisoryLockMode, DialectCapabilities, FullTextEngine, RowLockStrength, RowLockWaitPolicy, TimeOfDayType, } from "./capabilities.ts";

package/dist/index.js

@@ -109,7 +109,9 @@ var SCOPED_REFUSAL_REASONS = [
   "conflict_target_unscoped",
   "model_denied",
   "scope_value_required",
-  "no_scope_bound"
+  "no_scope_bound",
+  "through_detachable",
+  "column_set_default"
 ];
 
 class ScopedQueryError extends VibeError {
@@ -1596,6 +1598,9 @@ function resolveReferentialActions(params) {
   const required = (relation.fields ?? []).every((name) => params.field(name)?.isOptional !== true);
   return { onDelete: resolveOnDelete({ explicit: relation.onDelete, required }), onUpdate: resolveOnUpdate({ explicit: relation.onUpdate }) };
 }
+function setDefaultRelationOf(params) {
+  return params.relations.find((relation) => !relation.isList && (relation.fields ?? []).includes(params.field) && (relation.onDelete === "SetDefault" || relation.onUpdate === "SetDefault"));
+}
 
 // packages/schema/src/generated-columns.ts
 function declarationIssue(params) {
@@ -3955,6 +3960,16 @@ function validateModel(params) {
         model: model.name,
         field: policyField.name
       });
+    } else {
+      const repointing = setDefaultRelationOf({ relations: model.relations, field: policyField.name });
+      if (repointing !== undefined) {
+        issues.push({
+          rule: "policy-set-default",
+          message: `@@policy field "${model.name}.${policyField.name}" is a foreign key the database can re-point: relation "${repointing.name}" declares SetDefault, so deleting or re-keying its ${repointing.targetModel} writes the column's default, which can be another tenant's value. Declare onDelete and onUpdate as Cascade, Restrict or NoAction`,
+          model: model.name,
+          field: policyField.name
+        });
+      }
     }
   }
   const checkNames = new Set;
@@ -4448,6 +4463,10 @@ function validateNativeRls(params) {
           else if (slot.type !== field.type)
             add({ rule: "rls-context-type-mismatch", message: `Context ${ref.context} does not match ${model.name}.${field.name}`, field: field.name });
         }
+        const repointing = field === undefined ? undefined : setDefaultRelationOf({ relations: model.relations, field: field.name });
+        if (repointing !== undefined) {
+          add({ rule: "rls-where-set-default", message: `Native RLS ownership column ${model.name}.${String(fieldName)} is a foreign key the database can re-point: relation "${repointing.name}" declares SetDefault, and referential actions bypass row security, so deleting or re-keying its ${repointing.targetModel} writes the column's default, which can be another tenant's value. Declare onDelete and onUpdate as Cascade, Restrict, NoAction or SetNull`, field: String(fieldName) });
+        }
       }
       continue;
     }
@@ -4462,6 +4481,11 @@ function validateNativeRls(params) {
         add({ rule: "rls-nullable-through", message: "Native RLS through requires a non-nullable parent relation and foreign key; NULL parent links cannot satisfy WITH CHECK. Make the link required or use a direct ownership rule", field: relation.name });
         continue;
       }
+      const actions = resolveReferentialActions({ relation, field: (name) => model.fields.find((field) => field.name === name) });
+      if (actions.onDelete === "SetDefault" || actions.onUpdate === "SetDefault") {
+        add({ rule: "rls-through-set-default", message: `Native RLS through requires a foreign key the database cannot re-point: ON ${actions.onDelete === "SetDefault" ? "DELETE" : "UPDATE"} SET DEFAULT moves the row to its key's default parent, which can belong to another tenant, and referential actions bypass row security. Declare onDelete and onUpdate as Cascade, Restrict or NoAction`, field: relation.name });
+        continue;
+      }
       if (table === "parent")
         add({ rule: "rls-through-alias-conflict", message: "A through table mapped to parent would shadow the fixed policy parent alias; use another table name" });
       throughTargets.set(model.name, target.name);
@@ -4627,6 +4651,7 @@ export {
   scalarListDefault,
   schemaRowRuleIdentities,
   serializeJsonDefault,
+  setDefaultRelationOf,
   sqlNamespaceIssue,
   sqlObjectKey,
   sqlObjectNamespace,
@@ -4642,4 +4667,4 @@ export {
   validatorRefIssue
 };
 
-//# debugId=908B9801B15F7FB564756E2164756E21
+//# debugId=8784FDF6327C16F164756E2164756E21