@viberaven/cli 1.7.0 → 1.7.1

package/schemas/permissions-matrix.schema.json

@@ -1,90 +1,90 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
-  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
-  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["version", "tables"],
-  "properties": {
-    "$schema": { "type": "string" },
-    "version": { "const": 1 },
-    "description": { "type": "string" },
-    "defaultGrants": {
-      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
-      "enum": ["supabase-legacy", "none"],
-      "default": "supabase-legacy"
-    },
-    "tables": {
-      "type": "object",
-      "minProperties": 1,
-      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
-      "additionalProperties": { "$ref": "#/$defs/table" }
-    }
-  },
-  "$defs": {
-    "table": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["owner", "expect"],
-      "properties": {
-        "description": { "type": "string" },
-        "owner": {
-          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["column", "is"],
-          "properties": {
-            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
-            "is": { "const": "auth.uid()" }
-          }
-        },
-        "expect": { "$ref": "#/$defs/expectation" },
-        "seed": {
-          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
-          "type": "object",
-          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
-          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
-        },
-        "updateColumn": {
-          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
-          "type": "string",
-          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
-        }
-      }
-    },
-    "expectation": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["owner", "other_user", "anon"],
-      "properties": {
-        "owner": { "$ref": "#/$defs/actorCells" },
-        "other_user": { "$ref": "#/$defs/actorCells" },
-        "anon": { "$ref": "#/$defs/actorCells" },
-        "service_role": {
-          "description": "The service role bypasses RLS, so it is never tested.",
-          "const": "excluded"
-        }
-      }
-    },
-    "actorCells": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["select", "insert", "update", "delete"],
-      "properties": {
-        "select": { "$ref": "#/$defs/cell" },
-        "insert": { "$ref": "#/$defs/cell" },
-        "update": { "$ref": "#/$defs/cell" },
-        "delete": { "$ref": "#/$defs/cell" },
-        "reassign": {
-          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
-          "$ref": "#/$defs/cell"
-        }
-      }
-    },
-    "cell": {
-      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
-      "enum": ["allow", "deny", "skip"]
-    }
-  }
-}
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://viberaven.dev/schemas/permissions-matrix.v1.json",
+  "title": "VibeRaven permissions matrix (viberaven.permissions.json)",
+  "description": "Who may read, add, change and delete rows in each table, written by a person. `viberaven rls-test` checks the migrations against it. Never generate it from the app's own policies. Every cell is about rows owned by `owner`: owner acts on their own row, other_user is a different signed-in user acting on the owner's row, anon is a request with only the public anon key. For insert, the new row names the owner as its owner.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["version", "tables"],
+  "properties": {
+    "$schema": { "type": "string" },
+    "version": { "const": 1 },
+    "description": { "type": "string" },
+    "defaultGrants": {
+      "description": "Table grants the test database gives new public tables. supabase-legacy: anon and authenticated get all privileges on new public tables, as on existing Supabase projects (the more exposed assumption). none: no default grants, only what the migrations grant.",
+      "enum": ["supabase-legacy", "none"],
+      "default": "supabase-legacy"
+    },
+    "tables": {
+      "type": "object",
+      "minProperties": 1,
+      "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*(\\.[A-Za-z_][A-Za-z0-9_$]*)?$" },
+      "additionalProperties": { "$ref": "#/$defs/table" }
+    }
+  },
+  "$defs": {
+    "table": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "expect"],
+      "properties": {
+        "description": { "type": "string" },
+        "owner": {
+          "description": "How a row's owner is defined. Only `column = auth.uid()` is supported.",
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["column", "is"],
+          "properties": {
+            "column": { "type": "string", "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+            "is": { "const": "auth.uid()" }
+          }
+        },
+        "expect": { "$ref": "#/$defs/expectation" },
+        "seed": {
+          "description": "Values for columns the test cannot fill by itself (for example a NOT NULL foreign key). Used for every seeded and inserted row. Leave the owner column out.",
+          "type": "object",
+          "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$" },
+          "additionalProperties": { "type": ["string", "number", "boolean", "null"] }
+        },
+        "updateColumn": {
+          "description": "Column the update probe changes. Default: the first plain column that is not the owner column or part of the primary key.",
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_$]*$"
+        }
+      }
+    },
+    "expectation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["owner", "other_user", "anon"],
+      "properties": {
+        "owner": { "$ref": "#/$defs/actorCells" },
+        "other_user": { "$ref": "#/$defs/actorCells" },
+        "anon": { "$ref": "#/$defs/actorCells" },
+        "service_role": {
+          "description": "The service role bypasses RLS, so it is never tested.",
+          "const": "excluded"
+        }
+      }
+    },
+    "actorCells": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["select", "insert", "update", "delete"],
+      "properties": {
+        "select": { "$ref": "#/$defs/cell" },
+        "insert": { "$ref": "#/$defs/cell" },
+        "update": { "$ref": "#/$defs/cell" },
+        "delete": { "$ref": "#/$defs/cell" },
+        "reassign": {
+          "description": "Optional. Setting the owner column of the owner's row to another user: the owner giving the row away, or another user taking it. Not tested when absent.",
+          "$ref": "#/$defs/cell"
+        }
+      }
+    },
+    "cell": {
+      "description": "allow: the action must work on the owner's row. deny: it must return nothing, change nothing, or be refused with a permission error. skip: not tested (N/A).",
+      "enum": ["allow", "deny", "skip"]
+    }
+  }
+}