@wtfalch/foundry 0.58.0 → 0.60.0

package/dist/plan/worker-app-database.d.ts

@@ -71,7 +71,8 @@ export interface WorkerAppDatabasePort {
     applyMigration(owner: HyperdriveOrigin, migration: DatabaseMigration): Promise<void>;
     /**
      * Creates or updates the `runtime.user` role with `runtime.password`, grants it DML on the
-     * tables and revokes UPDATE, DELETE and TRUNCATE from it on each `appendOnly` table.
+     * tables, revokes UPDATE, DELETE and TRUNCATE from it on each `appendOnly` table, and grants
+     * it EXECUTE on each `grants` function.
      */
     ensureRuntimeRole(input: {
         owner: HyperdriveOrigin;
@@ -80,6 +81,7 @@ export interface WorkerAppDatabasePort {
             password: string;
         };
         appendOnly: string[];
+        grants: string[];
     }): Promise<void>;
 }
 export declare const WORKER_APP_MIGRATION_TIMEOUT_MS = 300000;
@@ -149,6 +151,7 @@ export declare function applyWorkerAppDatabase(deps: WorkerAppDatabaseDeps, org:
     artifactUrl: string;
     database: {
         appendOnly: string[];
+        grants?: string[];
         migrationsSha256?: string;
     };
 }, context: StepExecutionContext, zoneApex: string): Promise<{

package/dist/plan/worker-app-database.js

@@ -264,6 +264,7 @@ export async function applyWorkerAppDatabase(deps, org, entry, scriptName, want,
         owner: ownerOrigin,
         runtime: { user: runtimeUser, password: runtimePassword },
         appendOnly: [...want.database.appendOnly],
+        grants: [...(want.database.grants ?? [])],
     }));
     // 6. Hyperdrive, with the runtime credentials only.
     const name = hyperdriveName(scriptName);

package/dist/plan/worker-app.d.ts

@@ -107,6 +107,11 @@ export interface WorkerAppUpload {
     migrations?: WorkerAppMigrations;
     /** Durable Object classes the upload marks container-enabled; absent when the entry declares no container. */
     containers?: string[];
+    /** Workers Logs: always on, every request sampled. The adapter sends it as the upload metadata's `observability`. */
+    observability: {
+        enabled: true;
+        head_sampling_rate: 1;
+    };
 }
 export interface WorkerAppContainer {
     className: string;
@@ -203,6 +208,7 @@ export interface WorkerAppWant {
     /** `workerApp.database`: the Hyperdrive binding and the tables the runtime role may only append to, sorted. */
     database?: {
         appendOnly: string[];
+        grants?: string[];
         migrationsSha256?: string;
     };
     /** Secret names and where each comes from, sorted. */

package/dist/plan/worker-app.js

@@ -186,6 +186,7 @@ export function wantedWorkerApp(org, entry, recorded, input) {
                 ? {
                     database: {
                         appendOnly: [...(app.database.appendOnly ?? [])].sort(),
+                        ...(app.database.grants?.length ? { grants: [...app.database.grants].sort() } : {}),
                         ...(app.database.migrationsSha256
                             ? { migrationsSha256: app.database.migrationsSha256 }
                             : {}),
@@ -526,6 +527,7 @@ export async function applyWorkerApp(deps, org, action, context) {
                 ? [{ type: 'hyperdrive', name: WORKER_APP_HYPERDRIVE_BINDING, id: hyperdriveId }]
                 : []),
         ],
+        observability: { enabled: true, head_sampling_rate: 1 },
         ...(migrations ? { migrations } : {}),
         ...(want.containers.length > 0
             ? { containers: want.containers.map((c) => c.className) }

package/dist/worker-app-config.d.ts

@@ -60,10 +60,14 @@ export interface WorkerAppConfig {
      * or truncate. `migrationsSha256` (64 lowercase hex) pins the release's
      * `migrations.json`: required when the release has one, and foundry refuses
      * to parse bytes whose sha256 differs. Omit it only for a release with no
-     * `migrations.json`; one that has the file is then refused.
+     * `migrations.json`; one that has the file is then refused. `grants` names
+     * functions the runtime role may execute, as `name(type, ...)` or
+     * `schema.name(type, ...)`: the security definer functions a migration
+     * revoked from public, such as `@wtfalch/audit`'s ledger functions.
      */
     database?: {
         appendOnly?: string[];
+        grants?: string[];
         migrationsSha256?: string;
     };
     /** Plain vars. Never secrets. */
@@ -95,6 +99,8 @@ export declare const entryHasDatabase: (entry: {
 export declare const WORKER_APP_HYPERDRIVE_BINDING = "HYPERDRIVE";
 /** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
 export declare const WORKER_APP_APPEND_ONLY_MAX = 100;
+/** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
+export declare const WORKER_APP_GRANTS_MAX = 100;
 /** Hex characters of the org id's sha256 in a host id. */
 export declare const WORKER_APP_HOST_ID_HASH_LENGTH = 12;
 /**

package/dist/worker-app-config.js

@@ -27,6 +27,9 @@ export const WORKER_APP_HYPERDRIVE_BINDING = 'HYPERDRIVE';
 /** The most tables `database.appendOnly` may name, and the shape of one name (`table` or `schema.table`). */
 export const WORKER_APP_APPEND_ONLY_MAX = 100;
 const TABLE_NAME = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?$/;
+/** The most functions `database.grants` may name, and the shape of one signature. It is spliced into SQL, so nothing else passes. */
+export const WORKER_APP_GRANTS_MAX = 100;
+const FUNCTION_SIGNATURE = /^[A-Za-z_][A-Za-z0-9_]{0,62}(\.[A-Za-z_][A-Za-z0-9_]{0,62})?\(([a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?(, [a-z][a-z0-9_]*( [a-z][a-z0-9_]*)?)*)?\)$/;
 /** The custody Worker's host id shape for a derived (app) host, and its limit. */
 const HOST_ID = /^app-[a-z0-9]+(-[a-z0-9]+)*$/;
 const HOST_ID_MAX_LENGTH = 64;
@@ -342,11 +345,26 @@ function validateWorkerAppDatabase(at, app) {
     if (database === undefined)
         return null;
     if (typeof database !== 'object' || database === null || Array.isArray(database)) {
-        return `${at} database must be an object: { appendOnly?: string[]; migrationsSha256?: string }`;
+        return `${at} database must be an object: { appendOnly?: string[]; grants?: string[]; migrationsSha256?: string }`;
     }
-    const unknown = Object.keys(database).find((key) => key !== 'appendOnly' && key !== 'migrationsSha256');
+    const unknown = Object.keys(database).find((key) => key !== 'appendOnly' && key !== 'grants' && key !== 'migrationsSha256');
     if (unknown) {
-        return `${at} database.${unknown} is not a setting: only appendOnly and migrationsSha256`;
+        return `${at} database.${unknown} is not a setting: only appendOnly, grants and migrationsSha256`;
+    }
+    const grants = database.grants;
+    if (grants !== undefined) {
+        if (!Array.isArray(grants) || grants.length > WORKER_APP_GRANTS_MAX) {
+            return `${at} database.grants must be a list of at most ${WORKER_APP_GRANTS_MAX} function signatures`;
+        }
+        const seenGrants = new Set();
+        for (const signature of grants) {
+            if (typeof signature !== 'string' || !FUNCTION_SIGNATURE.test(signature)) {
+                return `${at} database.grants names '${String(signature).slice(0, 80)}', which is not a function signature (name(type, ...) or schema.name(type, ...))`;
+            }
+            if (seenGrants.has(signature))
+                return `${at} database.grants names '${signature}' twice`;
+            seenGrants.add(signature);
+        }
     }
     const sha = database.migrationsSha256;
     if (sha !== undefined && (typeof sha !== 'string' || !SHA256_HEX.test(sha))) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/foundry",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "Foundry's SDK: the declared org's types, the plan and apply contracts, and the state store's interface.",
   "repository": {
     "type": "git",