@wtfalch/authz-store 0.1.0 → 0.2.1

package/dist/migrate.js

@@ -1,7 +1,17 @@
 import { readFile, readdir } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { sql } from 'drizzle-orm';
-/** The shipped SQL, next to `dist/` in the package and next to `src/` in this repository. */
-const MIGRATIONS = new URL('../migrations/', import.meta.url);
+/**
+ * The shipped SQL, next to `dist/` in the package and next to `src/` in this repository. Computed
+ * lazily inside `migrateStore` rather than as a module-level `new URL('../migrations/',
+ * import.meta.url)`: Turbopack resolves that literal statically when an app imports the package
+ * barrel, and fails with "Can't resolve '../migrations/'" because the directory holds no importable
+ * module.
+ */
+function migrationsDir() {
+    return join(dirname(fileURLToPath(import.meta.url)), '..', 'migrations');
+}
 /** Files split on this line, the marker drizzle-kit writes, so any driver can run them one statement at a time. */
 const BREAKPOINT = '--> statement-breakpoint';
 /** One key for every host, so two containers starting at once apply each file once between them. */
@@ -12,10 +22,11 @@ const LOCK = 7_310_422_001;
  * migrations, so everything the package owns exists before a host migration references it.
  */
 export async function migrateStore(db) {
-    const names = (await readdir(MIGRATIONS)).filter((n) => n.endsWith('.sql')).sort();
+    const dir = migrationsDir();
+    const names = (await readdir(dir)).filter((n) => n.endsWith('.sql')).sort();
     const applied = [];
     for (const name of names) {
-        const text = await readFile(new URL(name, MIGRATIONS), 'utf8');
+        const text = await readFile(join(dir, name), 'utf8');
         const ran = await db.transaction(async (tx) => {
             await tx.execute(sql `select pg_advisory_xact_lock(${LOCK})`);
             // Created under the lock: two runners creating it at once collide in pg_type.

package/dist/owners.d.ts

@@ -17,7 +17,12 @@ export interface OwnerCoverageOptions {
     readonly excludePrincipalId?: string;
     readonly excludePrincipalClass?: string;
 }
-/** A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority. */
+/**
+ * A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority.
+ *
+ * Owners are counted by the fixed `owner` role key, not the `builtIn` flag: the owner role is
+ * fixed, one per org, never renamed (decided in https://github.com/wtfalch/authz/issues/67).
+ */
 export declare function ownerCoverage(tx: DbOrTx, binding: PolicyBinding, tenantId: string, options?: OwnerCoverageOptions): Promise<OwnerCoverage>;
 export declare function ownerSeatCovered(coverage: OwnerCoverage): boolean;
 export declare function principalIsReachable(): import("drizzle-orm").SQL<unknown>;

package/dist/owners.js

@@ -1,7 +1,12 @@
 import { and, eq, gt, isNull, sql } from 'drizzle-orm';
 import { policyAssignments, policyRoles } from './policy-schema.js';
 import { credentials, invitations, memberships } from './schema.js';
-/** A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority. */
+/**
+ * A credential cannot be the recovery owner: expiry or issuer revocation can remove its authority.
+ *
+ * Owners are counted by the fixed `owner` role key, not the `builtIn` flag: the owner role is
+ * fixed, one per org, never renamed (decided in https://github.com/wtfalch/authz/issues/67).
+ */
 export async function ownerCoverage(tx, binding, tenantId, options = {}) {
     const a = policyAssignments;
     const r = policyRoles;
@@ -11,7 +16,6 @@ export async function ownerCoverage(tx, binding, tenantId, options = {}) {
         eq(a.platformId, binding.platformId),
         eq(a.source, 'direct'),
         eq(a.principalClass, 'human'),
-        eq(r.builtIn, true),
         eq(r.key, 'owner'),
         isNull(a.expiresAt),
         sql `${a.scope}->>'kind' = 'organisation'`,
@@ -29,7 +33,7 @@ export async function ownerCoverage(tx, binding, tenantId, options = {}) {
         .select({ count: sql `count(*)::int` })
         .from(invitations)
         .innerJoin(r, eq(invitations.roleId, r.id))
-        .where(and(eq(invitations.tenantId, tenantId), eq(r.builtIn, true), eq(r.key, 'owner'), eq(invitations.status, 'pending'), gt(invitations.expiresAt, sql `now()`)));
+        .where(and(eq(invitations.tenantId, tenantId), eq(r.key, 'owner'), eq(invitations.status, 'pending'), gt(invitations.expiresAt, sql `now()`)));
     return { directOwners: owners?.count ?? 0, pendingOwnerInvitations: pending?.count ?? 0 };
 }
 export function ownerSeatCovered(coverage) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/authz-store",
-  "version": "0.1.0",
+  "version": "0.2.1",
   "description": "Persistence and lifecycle for @wtfalch/authz: the storage a host would otherwise write itself.",
   "type": "module",
   "files": [
@@ -16,8 +16,8 @@
     "./package.json": "./package.json"
   },
   "peerDependencies": {
-    "@wtfalch/authz": "^0.12.0",
-    "drizzle-orm": "^0.39.0"
+    "@wtfalch/authz": "^0.15.0",
+    "drizzle-orm": ">=0.39.0 <1.0.0"
   },
   "engines": {
     "node": ">=22.0.0"