@xemahq/biome-database-nest 0.11.0 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +38 -23
- package/dist/index.d.ts +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -1
- package/dist/index.js.map +1 -1
- package/dist/lib/bootstrap.d.ts +1 -1
- package/dist/lib/bootstrap.d.ts.map +1 -1
- package/dist/lib/bootstrap.js +11 -15
- package/dist/lib/bootstrap.js.map +1 -1
- package/dist/lib/control-plane-client.js +1 -1
- package/dist/lib/control-plane-client.js.map +1 -1
- package/dist/lib/nest/biome-database.module.d.ts.map +1 -1
- package/dist/lib/nest/biome-database.module.js +24 -28
- package/dist/lib/nest/biome-database.module.js.map +1 -1
- package/dist/lib/nest/org-erasure.module.d.ts.map +1 -1
- package/dist/lib/nest/org-erasure.module.js +11 -3
- package/dist/lib/nest/org-erasure.module.js.map +1 -1
- package/dist/lib/tenant-isolation/org-erasure.d.ts +7 -0
- package/dist/lib/tenant-isolation/org-erasure.d.ts.map +1 -1
- package/dist/lib/tenant-isolation/org-erasure.js +34 -2
- package/dist/lib/tenant-isolation/org-erasure.js.map +1 -1
- package/package.json +6 -6
- package/src/index.ts +2 -0
- package/src/lib/bootstrap.ts +2 -7
- package/src/lib/control-plane-client.ts +7 -4
- package/src/lib/nest/biome-database.module.ts +39 -40
- package/src/lib/nest/org-erasure.module.ts +38 -4
- package/src/lib/tenant-isolation/org-erasure.ts +82 -5
package/README.md
CHANGED
|
@@ -28,19 +28,33 @@
|
|
|
28
28
|
|
|
29
29
|
## Overview
|
|
30
30
|
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
31
|
+
Gives a Xema biome service its database without the service knowing anything
|
|
32
|
+
about databases. It resolves the connection from `org-database-pool-api` at
|
|
33
|
+
boot, builds a schema-qualified Prisma client for it, and applies the service's
|
|
34
|
+
own Prisma migrations before the app serves traffic.
|
|
35
|
+
|
|
36
|
+
A biome carries **no** database configuration: no host, no credential, no URL,
|
|
37
|
+
no schema name, nothing to put in a Helm chart or a secret. Those are facts the
|
|
38
|
+
platform owns, and a biome that had to know them would be a biome that breaks
|
|
39
|
+
when they change.
|
|
40
|
+
|
|
41
|
+
## What a biome gets
|
|
42
|
+
|
|
43
|
+
- **A database of its own, on first boot.** The pool binds the service to it and
|
|
44
|
+
holds it there, so the name can never silently move to an empty schema.
|
|
45
|
+
- **A schema-qualified Prisma client**, already pointed at that database.
|
|
46
|
+
- **Migrations applied at boot** — `prisma migrate deploy`, which THROWS on
|
|
47
|
+
failure, so a bad migration stops the pod becoming ready instead of half-
|
|
48
|
+
applying under live traffic.
|
|
49
|
+
- **More than one database when it needs one.** A biome that ships several API
|
|
50
|
+
services gives each its own; a single service that needs a second declares a
|
|
51
|
+
`dbKey`. Physically these are schemas in the shared `xema_biomes` database —
|
|
52
|
+
`biome_<biomeId>` for the primary, `biome_<biomeId>__<dbKey>` for the rest.
|
|
39
53
|
|
|
40
54
|
## When to use it
|
|
41
55
|
|
|
42
|
-
|
|
43
|
-
|
|
56
|
+
Use it in any NestJS biome service that stores data. There is no second way to
|
|
57
|
+
reach a biome database, and nothing for the service to configure.
|
|
44
58
|
|
|
45
59
|
## Installation
|
|
46
60
|
|
|
@@ -50,6 +64,8 @@ pnpm add @xemahq/biome-database-nest
|
|
|
50
64
|
|
|
51
65
|
## Usage
|
|
52
66
|
|
|
67
|
+
The whole integration:
|
|
68
|
+
|
|
53
69
|
```ts
|
|
54
70
|
import {
|
|
55
71
|
BiomeDatabaseMigrationMode,
|
|
@@ -58,26 +74,25 @@ import {
|
|
|
58
74
|
|
|
59
75
|
BiomeDatabaseModule.forRoot({
|
|
60
76
|
biomeId: 'example',
|
|
61
|
-
migrationMode: BiomeDatabaseMigrationMode.
|
|
62
|
-
databases: [
|
|
77
|
+
migrationMode: BiomeDatabaseMigrationMode.ApplicationManaged,
|
|
78
|
+
databases: [{ workspaceDir: process.cwd() }],
|
|
63
79
|
});
|
|
64
80
|
```
|
|
65
81
|
|
|
66
|
-
|
|
82
|
+
`biomeId` names the database this service owns; it is pinned by the pool on
|
|
83
|
+
first resolve, so changing it later is refused rather than silently pointing the
|
|
84
|
+
service at a fresh empty schema. `workspaceDir` is where the Prisma schema and
|
|
85
|
+
`migrations/` live.
|
|
86
|
+
|
|
87
|
+
A second database for the same service:
|
|
67
88
|
|
|
68
89
|
```ts
|
|
69
|
-
|
|
70
|
-
|
|
71
|
-
workspaceDir: process.cwd(),
|
|
72
|
-
|
|
73
|
-
}
|
|
90
|
+
databases: [
|
|
91
|
+
{ workspaceDir: process.cwd() },
|
|
92
|
+
{ key: 'analytics', workspaceDir: `${process.cwd()}/analytics` },
|
|
93
|
+
],
|
|
74
94
|
```
|
|
75
95
|
|
|
76
|
-
Runtime declarations use closed privilege enums. Views, materialized views,
|
|
77
|
-
and foreign tables are SELECT-only unless a writable view or foreign table is
|
|
78
|
-
explicitly named. Runtime-callable functions are exact-overload allowlists;
|
|
79
|
-
`SECURITY DEFINER` functions are never accepted.
|
|
80
|
-
|
|
81
96
|
## Peer requirements
|
|
82
97
|
|
|
83
98
|
- NestJS 10 or 11 and Prisma 7.
|
package/dist/index.d.ts
CHANGED
|
@@ -14,6 +14,6 @@ export { TenantIsolationError, TenantIsolationViolationKind, formatTenantIsolati
|
|
|
14
14
|
export { PrismaModelOperation, scopeArgsToOrg, type OrgScopeOutcome, type OrgScopeRequest, } from './lib/tenant-isolation/org-scope';
|
|
15
15
|
export { DEFAULT_ORG_FIELD, collectOrgScopedModels, createTenantIsolationExtension, readRuntimeModels, type CreateTenantIsolationExtensionOptions, type RuntimeDataModelField, type RuntimeDataModelModel, type TenantIsolationExtensionDefinition, type TenantIsolationLogger, type TenantIsolationQueryContext, } from './lib/tenant-isolation/tenant-isolation.extension';
|
|
16
16
|
export { assertUnscopedModelsDeclared, collectUnscopableModels, formatUnscopedModelReport, normalizeUnscopedModelDeclarations, UndeclaredUnscopedModelsError, type AssertUnscopedModelsOptions, type NormalizedUnscopedModelDeclaration, type UnscopedModelDeclaration, type UnscopedModelDeclarations, } from './lib/tenant-isolation/unscoped-models';
|
|
17
|
-
export { eraseOrgData, OrgErasureBlockedError, type EraseOrgDataOptions, type OrgErasureReport, } from './lib/tenant-isolation/org-erasure';
|
|
17
|
+
export { assertOrgErasureMatchesModels, eraseOrgData, OrgErasureBlockedError, OrgErasureMatchesNothingError, type EraseOrgDataOptions, type OrgErasureReport, } from './lib/tenant-isolation/org-erasure';
|
|
18
18
|
export { OrgErasureModule, OrgErasureController, ORG_ERASURE_RUNNER, ORG_DATA_ERASURE_CAPABILITY, ORG_ERASURE_ROUTE_PATH, type OrgErasureModuleOptions, type OrgErasureRunner, } from './lib/nest/org-erasure.module';
|
|
19
19
|
//# sourceMappingURL=index.d.ts.map
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,4CAA4C,EACjD,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,YAAY,EACZ,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAChF,OAAO,EACL,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,8BAA8B,EAC9B,uBAAuB,EACvB,yBAAyB,EACzB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,GACxB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,cAAc,EACd,cAAc,EACd,cAAc,EACd,cAAc,EACd,2BAA2B,EAC3B,yBAAyB,EACzB,KAAK,eAAe,GACrB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iCAAiC,EACjC,KAAK,mBAAmB,GACzB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,wBAAwB,EACxB,+BAA+B,GAChC,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,yBAAyB,EACzB,KAAK,2BAA2B,GACjC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,KAAK,4BAA4B,GAClC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,uBAAuB,EACvB,KAAK,wBAAwB,EAC7B,KAAK,8BAA8B,GACpC,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,0BAA0B,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,KAAK,4CAA4C,EACjD,KAAK,0BAA0B,GAChC,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,qBAAqB,EAC1B,KAAK,0BAA0B,EAC/B,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EAClC,KAAK,eAAe,GACrB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,mBAAmB,EACnB,6BAA6B,EAC7B,0BAA0B,GAC3B,MAAM,8CAA8C,CAAC;AACtD,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,+CAA+C,CAAC;AACvD,OAAO,EACL,oBAAoB,EACpB,cAAc,EACd,KAAK,eAAe,EACpB,KAAK,eAAe,GACrB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,8BAA8B,EAC9B,iBAAiB,EACjB,KAAK,qCAAqC,EAC1C,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,KAAK,kCAAkC,EACvC,KAAK,qBAAqB,EAC1B,KAAK,2BAA2B,GACjC,MAAM,mDAAmD,CAAC;AAC3D,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,yBAAyB,EACzB,kCAAkC,EAClC,6BAA6B,EAC7B,KAAK,2BAA2B,EAChC,KAAK,kCAAkC,EACvC,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,GAC/B,MAAM,wCAAwC,CAAC;AAChD,OAAO,EACL,6BAA6B,EAC7B,YAAY,EACZ,sBAAsB,EACtB,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,GACtB,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EACL,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,2BAA2B,EAC3B,sBAAsB,EACtB,KAAK,uBAAuB,EAC5B,KAAK,gBAAgB,GACtB,MAAM,+BAA+B,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.
|
|
3
|
+
exports.ORG_DATA_ERASURE_CAPABILITY = exports.ORG_ERASURE_RUNNER = exports.OrgErasureController = exports.OrgErasureModule = exports.OrgErasureMatchesNothingError = exports.OrgErasureBlockedError = exports.eraseOrgData = exports.assertOrgErasureMatchesModels = exports.UndeclaredUnscopedModelsError = exports.normalizeUnscopedModelDeclarations = exports.formatUnscopedModelReport = exports.collectUnscopableModels = exports.assertUnscopedModelsDeclared = exports.readRuntimeModels = exports.createTenantIsolationExtension = exports.collectOrgScopedModels = exports.DEFAULT_ORG_FIELD = exports.scopeArgsToOrg = exports.PrismaModelOperation = exports.formatTenantIsolationViolation = exports.TenantIsolationViolationKind = exports.TenantIsolationError = exports.resolveTenantIsolationMode = exports.TENANT_ISOLATION_MODE_ENV_VAR = exports.TenantIsolationMode = exports.createBiomePrismaService = exports.BIOME_DATABASE_READY = exports.BiomeDatabaseModule = exports.BiomeDatabaseMigrationMode = exports.bootstrapBiomeDatabases = exports.ORG_DATABASE_POOL_SERVICE_NAME = exports.resolveControlPlaneBaseUrl = exports.fetchSystemDatabaseConfig = exports.createBiomePrismaAdapterFromEnv = exports.createBiomePrismaAdapter = exports.resolveBiomeDatabaseConfigFromEnv = exports.SCHEMA_ROLE_SUFFIX_LENGTH = exports.SCHEMA_ROLE_BASE_MAX_LENGTH = exports.SchemaRoleKind = exports.schemaRoleName = exports.schemaRoleBase = exports.rolesForSchema = exports.sanitizeIdentifierSegment = exports.sanitizeIdentifierChars = exports.POSTGRES_MAX_IDENTIFIER_LENGTH = exports.IDENTIFIER_HASH_LENGTH = exports.fitIdentifier = exports.composeIdentifier = exports.deriveBiomeSchemaName = exports.DEFAULT_BIOME_DB_KEY = void 0;
|
|
4
|
+
exports.ORG_ERASURE_ROUTE_PATH = void 0;
|
|
4
5
|
var schema_name_1 = require("./lib/schema-name");
|
|
5
6
|
Object.defineProperty(exports, "DEFAULT_BIOME_DB_KEY", { enumerable: true, get: function () { return schema_name_1.DEFAULT_BIOME_DB_KEY; } });
|
|
6
7
|
Object.defineProperty(exports, "deriveBiomeSchemaName", { enumerable: true, get: function () { return schema_name_1.deriveBiomeSchemaName; } });
|
|
@@ -60,8 +61,10 @@ Object.defineProperty(exports, "formatUnscopedModelReport", { enumerable: true,
|
|
|
60
61
|
Object.defineProperty(exports, "normalizeUnscopedModelDeclarations", { enumerable: true, get: function () { return unscoped_models_1.normalizeUnscopedModelDeclarations; } });
|
|
61
62
|
Object.defineProperty(exports, "UndeclaredUnscopedModelsError", { enumerable: true, get: function () { return unscoped_models_1.UndeclaredUnscopedModelsError; } });
|
|
62
63
|
var org_erasure_1 = require("./lib/tenant-isolation/org-erasure");
|
|
64
|
+
Object.defineProperty(exports, "assertOrgErasureMatchesModels", { enumerable: true, get: function () { return org_erasure_1.assertOrgErasureMatchesModels; } });
|
|
63
65
|
Object.defineProperty(exports, "eraseOrgData", { enumerable: true, get: function () { return org_erasure_1.eraseOrgData; } });
|
|
64
66
|
Object.defineProperty(exports, "OrgErasureBlockedError", { enumerable: true, get: function () { return org_erasure_1.OrgErasureBlockedError; } });
|
|
67
|
+
Object.defineProperty(exports, "OrgErasureMatchesNothingError", { enumerable: true, get: function () { return org_erasure_1.OrgErasureMatchesNothingError; } });
|
|
65
68
|
var org_erasure_module_1 = require("./lib/nest/org-erasure.module");
|
|
66
69
|
Object.defineProperty(exports, "OrgErasureModule", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureModule; } });
|
|
67
70
|
Object.defineProperty(exports, "OrgErasureController", { enumerable: true, get: function () { return org_erasure_module_1.OrgErasureController; } });
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;AAAA,iDAAgF;AAAvE,mHAAA,oBAAoB,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AACpD,+CAS0B;AARxB,+GAAA,iBAAiB,OAAA;AACjB,2GAAA,aAAa,OAAA;AACb,oHAAA,sBAAsB,OAAA;AACtB,4HAAA,8BAA8B,OAAA;AAC9B,qHAAA,uBAAuB,OAAA;AACvB,uHAAA,yBAAyB,OAAA;AAI3B,+CAQ0B;AAPxB,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,4GAAA,cAAc,OAAA;AACd,yHAAA,2BAA2B,OAAA;AAC3B,uHAAA,yBAAyB,OAAA;AAG3B,uCAGsB;AAFpB,2HAAA,iCAAiC,OAAA;AAGnC,yCAGuB;AAFrB,mHAAA,wBAAwB,OAAA;AACxB,0HAAA,+BAA+B,OAAA;AAEjC,mEAGoC;AAFlC,iIAAA,yBAAyB,OAAA;AAG3B,yEAIuC;AAHrC,qIAAA,0BAA0B,OAAA;AAC1B,yIAAA,8BAA8B,OAAA;AAGhC,6CAIyB;AAHvB,oHAAA,uBAAuB,OAAA;AAIzB,uDAAkE;AAAzD,4HAAA,0BAA0B,OAAA;AACnC,0EAK0C;AAJxC,4HAAA,mBAAmB,OAAA;AACnB,6HAAA,oBAAoB,OAAA;AAItB,4EAQ2C;AAPzC,kIAAA,wBAAwB,OAAA;AAQ1B,sFAIsD;AAHpD,4HAAA,mBAAmB,OAAA;AACnB,sIAAA,6BAA6B,OAAA;AAC7B,mIAAA,0BAA0B,OAAA;AAE5B,wFAKuD;AAJrD,8HAAA,oBAAoB,OAAA;AACpB,sIAAA,4BAA4B,OAAA;AAC5B,wIAAA,8BAA8B,OAAA;AAGhC,8DAK0C;AAJxC,iHAAA,oBAAoB,OAAA;AACpB,2GAAA,cAAc,OAAA;AAIhB,gGAW2D;AAVzD,+HAAA,iBAAiB,OAAA;AACjB,oIAAA,sBAAsB,OAAA;AACtB,4IAAA,8BAA8B,OAAA;AAC9B,+HAAA,iBAAiB,OAAA;AAQnB,0EAUgD;AAT9C,+HAAA,4BAA4B,OAAA;AAC5B,0HAAA,uBAAuB,OAAA;AACvB,4HAAA,yBAAyB,OAAA;AACzB,qIAAA,kCAAkC,OAAA;AAClC,gIAAA,6BAA6B,OAAA;AAM/B,kEAO4C;AAN1C,4HAAA,6BAA6B,OAAA;AAC7B,2GAAA,YAAY,OAAA;AACZ,qHAAA,sBAAsB,OAAA;AACtB,4HAAA,6BAA6B,OAAA;AAI/B,oEAQuC;AAPrC,sHAAA,gBAAgB,OAAA;AAChB,0HAAA,oBAAoB,OAAA;AACpB,wHAAA,kBAAkB,OAAA;AAClB,iIAAA,2BAA2B,OAAA;AAC3B,4HAAA,sBAAsB,OAAA"}
|
package/dist/lib/bootstrap.d.ts
CHANGED
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { type ControlPlaneDiscoveryOptions } from './control-plane-discovery';
|
|
2
|
-
import { BiomeDatabaseMigrationMode } from './migration-mode';
|
|
2
|
+
import type { BiomeDatabaseMigrationMode } from './migration-mode';
|
|
3
3
|
import type { KernelState } from '@xemahq/kernel-contracts/kernel-state';
|
|
4
4
|
export interface BiomeDatabaseDeclaration {
|
|
5
5
|
readonly key?: string;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;
|
|
1
|
+
{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":"AAgBA,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,2BAA2B,CAAC;AAInC,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uCAAuC,CAAC;AAGzE,MAAM,WAAW,wBAAwB;IAEvC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEtB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAGD,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAMzB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAOzD,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAElC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,4BAA4B,CAAC;CAC/D;AAED,MAAM,WAAW,kCACf,SAAQ,oCAAoC;IAC5C,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;IACtE,QAAQ,CAAC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAWxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAGD,MAAM,MAAM,8BAA8B,GACxC,kCAAkC,CAAC;AAqTrC,wBAAsB,uBAAuB,CAC3C,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,IAAI,CAAC,CA2Cf"}
|
package/dist/lib/bootstrap.js
CHANGED
|
@@ -13,7 +13,6 @@ const pg_1 = require("pg");
|
|
|
13
13
|
const config_1 = require("./config");
|
|
14
14
|
const control_plane_client_1 = require("./control-plane-client");
|
|
15
15
|
const control_plane_discovery_1 = require("./control-plane-discovery");
|
|
16
|
-
const migration_mode_1 = require("./migration-mode");
|
|
17
16
|
const schema_name_1 = require("./schema-name");
|
|
18
17
|
const LOG_PREFIX = '[biome-database]';
|
|
19
18
|
const bootstrapLogger = new common_1.Logger('BiomeDatabaseBootstrap');
|
|
@@ -177,20 +176,17 @@ async function bootstrapBiomeDatabases(opts) {
|
|
|
177
176
|
}
|
|
178
177
|
return cachedBaseUrl;
|
|
179
178
|
};
|
|
180
|
-
|
|
181
|
-
|
|
182
|
-
|
|
183
|
-
|
|
184
|
-
|
|
185
|
-
|
|
186
|
-
|
|
187
|
-
|
|
188
|
-
|
|
189
|
-
|
|
190
|
-
|
|
191
|
-
bootstrapLogger.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`);
|
|
192
|
-
}
|
|
193
|
-
return;
|
|
179
|
+
for (const decl of opts.databases) {
|
|
180
|
+
const key = decl.key ?? schema_name_1.DEFAULT_BIOME_DB_KEY;
|
|
181
|
+
bootstrapLogger.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config for mode=${opts.migrationMode}`);
|
|
182
|
+
const rawConfig = await resolveDatabaseConfig(opts, key, getControlPlaneBaseUrl);
|
|
183
|
+
const config = await materializeInlineCaCert(opts.biomeId, key, rawConfig);
|
|
184
|
+
const directUrl = buildDirectConnectionUrl(opts.biomeId, key, config);
|
|
185
|
+
await ensureSchemaExists(opts.biomeId, key, config, opts.requiredExtensions ?? []);
|
|
186
|
+
await runMigrations(opts.biomeId, key, decl.workspaceDir, directUrl);
|
|
187
|
+
const runtimeUrl = buildRuntimeUrl(opts.biomeId, key, config, directUrl);
|
|
188
|
+
exportResolvedEnv(key, config, runtimeUrl);
|
|
189
|
+
bootstrapLogger.log(`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`);
|
|
194
190
|
}
|
|
195
191
|
}
|
|
196
192
|
//# sourceMappingURL=bootstrap.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":";;
|
|
1
|
+
{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/lib/bootstrap.ts"],"names":[],"mappings":";;AA8XA,0DA6CC;AA3aD,6CAAyC;AACzC,qCAAuC;AACvC,+CAA6C;AAC7C,qCAAiC;AACjC,yCAAiC;AAEjC,2CAAwC;AACxC,6EAAwE;AACxE,6DAGiC;AACjC,2BAA4B;AAE5B,qCAA6D;AAC7D,iEAAmE;AACnE,uEAGmC;AACnC,+CAAqD;AAuDrD,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAStC,MAAM,eAAe,GAAG,IAAI,eAAM,CAAC,wBAAwB,CAAC,CAAC;AAE7D,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,GAAG,KAAK,kCAAoB;QACjC,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;AACzD,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,YAA0D;IAE1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,yDAAyD;YACpE,2CAA2C,CAC9C,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,YAAY,KAAK,UAAU,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;AAC5E,CAAC;AASD,KAAK,UAAU,qBAAqB,CAClC,IAA0C,EAC1C,GAAW,EACX,sBAA6C;IAE7C,MAAM,KAAK,GAAG,IAAA,0CAAiC,EAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAClE,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,sBAAsB,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,mBAAmB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC3D,OAAO,IAAA,gDAAyB,EAAC,OAAO,EAAE,KAAK,EAAE;QAC/C,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,GAAG,CAAC,GAAG,KAAK,kCAAoB,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxD,CAAC,CAAC;AACL,CAAC;AASD,KAAK,UAAU,uBAAuB,CACpC,OAAe,EACf,GAAW,EACX,MAA2B;IAE3B,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QAC9D,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,MAAM,IAAI,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC;SAC9B,MAAM,CAAC,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;SAC3B,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChB,MAAM,QAAQ,GAAG,IAAA,gBAAI,EAAC,IAAA,gBAAM,GAAE,EAAE,oBAAoB,IAAI,MAAM,CAAC,CAAC;IAChE,MAAM,IAAA,oBAAS,EAAC,QAAQ,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAE7D,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;IACvC,CAAC;IACD,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,QAAQ,EAAE,CACjF,CAAC;IACF,OAAO,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACrD,CAAC;AAiBD,SAAS,UAAU,CACjB,MAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,aAAa,CAAC;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IACzC,MAAM,EAAE,GACN,MAAM,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAA,sBAAY,EAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1E,OAAO;QACL,GAAG,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,kBAAkB,EAAE,MAAM;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACpC,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,kBAAqC;IAErC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE,CAAC;IACxD,IAAI,CAAC,SAAS,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,WAAM,CAAC;QACxB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;IACvB,IAAI,CAAC;QAKH,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;YACrC,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,6BAA6B,GAAG,IAAI,CACnE,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAChB,mCAAmC,GAAG,iBAAiB,CACxD,CAAC;YACF,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wBAAwB,GAAG,aAAa,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE;gBAC/D,MAAM;aACP,CAAC,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,GAAG,CAAC,CAAC;YAC9D,MAAM,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAC7B,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,qBAAqB,MAAM,UAAU,CAC/E,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACtD,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AAGD,SAAS,wBAAwB,CAC/B,OAAe,EACf,GAAW,EACX,MAA2B;IAE3B,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC;QACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,mDAAmD,CAC7F,CAAC;IACJ,CAAC;IACD,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,GAAW,EACX,YAAoB,EACpB,UAAkB;IAElB,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,wCAAwC,YAAY,GAAG,CACjG,CAAC;IAUF,MAAM,MAAM,GAAG,MAAM,IAAI,+CAAqB,EAAE,CAAC,GAAG,CAAC;QACnD,YAAY;QACZ,aAAa,EAAE,UAAU;QACzB,GAAG,EAAE,EAAE;KACR,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,6BAA6B,MAAM,CAAC,QAAQ,OAAO,MAAM,CAAC,MAAM,EAAE,CAC5G,CAAC;IACJ,CAAC;AACH,CAAC;AAiBD,SAAS,eAAe,CACtB,OAAe,EACf,GAAW,EACX,MAA2B,EAC3B,SAAiB;IAEjB,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,UAAU,KAAK,EAAE,EAAE,CAAC;QAChE,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,SAAS,GAAG,IAAA,yCAAuB,EAAC;QACxC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,UAAU;QACvB,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC;QAC9C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,SAAS,EAAE,MAAM,CAAC,eAAe,IAAI,iBAAiB;KACvD,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,yDAAyD,CACnG,CAAC;IACJ,CAAC;IACD,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,OAAO,QAAQ,GAAG,mCAAmC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CACpI,CAAC;IACF,OAAO,IAAA,yCAAuB,EAAC,SAAS,CAAC,CAAC;AAC5C,CAAC;AAUD,SAAS,iBAAiB,CACxB,GAAW,EACX,MAA2B,EAC3B,UAAkB;IAElB,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,eAAe,MAAM,EAAE,CAAC,GAAG,UAAU,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;QACxD,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;IACpD,CAAC;AACH,CAAC;AAYM,KAAK,UAAU,uBAAuB,CAC3C,IAAoC;IAIpC,IAAI,aAAiC,CAAC;IACtC,MAAM,sBAAsB,GAAG,KAAK,IAAqB,EAAE;QACzD,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;YAChC,aAAa,GAAG,MAAM,IAAA,oDAA0B,EAC9C,IAAI,CAAC,WAAW,EAChB,IAAI,CAAC,qBAAqB,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC;IACvB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,kCAAoB,CAAC;QAC7C,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,+BAA+B,IAAI,CAAC,aAAa,EAAE,CAClG,CAAC;QACF,MAAM,SAAS,GAAG,MAAM,qBAAqB,CAC3C,IAAI,EACJ,GAAG,EACH,sBAAsB,CACvB,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAC1C,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,SAAS,CACV,CAAC;QACF,MAAM,SAAS,GAAG,wBAAwB,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACtE,MAAM,kBAAkB,CACtB,IAAI,CAAC,OAAO,EACZ,GAAG,EACH,MAAM,EACN,IAAI,CAAC,kBAAkB,IAAI,EAAE,CAC9B,CAAC;QACF,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;QACrE,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;QACzE,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC3C,eAAe,CAAC,GAAG,CACjB,GAAG,UAAU,UAAU,IAAI,CAAC,OAAO,QAAQ,GAAG,sBAAsB,CACrE,CAAC;IACN,CAAC;AACH,CAAC"}
|
|
@@ -33,7 +33,7 @@ const REQUIRED_CONFIG_FIELDS = [
|
|
|
33
33
|
];
|
|
34
34
|
function assertCompleteConfig(config, url) {
|
|
35
35
|
const record = config !== null && typeof config === 'object'
|
|
36
|
-
? config
|
|
36
|
+
? Object.fromEntries(Object.entries(config))
|
|
37
37
|
: {};
|
|
38
38
|
const missing = REQUIRED_CONFIG_FIELDS.filter((field) => {
|
|
39
39
|
const value = record[field];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"control-plane-client.js","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":";;AAmDA,8DAiCC;AApDD,6DAAyE;AAmBlE,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,YAAoB,EACpB,GAAgC;IAEhC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,
|
|
1
|
+
{"version":3,"file":"control-plane-client.js","sourceRoot":"","sources":["../../src/lib/control-plane-client.ts"],"names":[],"mappings":";;AAmDA,8DAiCC;AApDD,6DAAyE;AAmBlE,KAAK,UAAU,yBAAyB,CAC7C,OAAe,EACf,YAAoB,EACpB,GAAgC;IAEhC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,0BAA0B,CAAC;IAEpE,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAChC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;KACH,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;QACpE,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,cAAc,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,EAAE,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,MAAM,GAAY,IAAA,gDAA8B,EACpD,OAAO,EACP,8BAA8B,GAAG,EAAE,CACpC,CAAC;IACF,oBAAoB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,sBAAsB,GAAG;IAC7B,MAAM;IACN,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;CACF,CAAC;AASX,SAAS,oBAAoB,CAC3B,MAAe,EACf,GAAW;IAIX,MAAM,MAAM,GACV,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ;QAC3C,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC5B,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;IAC/D,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,8BAA8B,GAAG,sCAAsC;YACrE,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB;YACjD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mCAAmC;YACrE,gDAAgD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"biome-database.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EACV,wBAAwB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAYpD,eAAO,MAAM,oBAAoB,eAEhC,CAAC;AAEF,UAAU,gCAAgC;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4CACf,SAAQ,gCAAgC;IACxC,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;IAKtE,QAAQ,CAAC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAMxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAID,MAAM,MAAM,0BAA0B,GACpC,4CAA4C,CAAC;
|
|
1
|
+
{"version":3,"file":"biome-database.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAE/D,OAAO,KAAK,EACV,wBAAwB,EACzB,MAAM,cAAc,CAAC;AACtB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAYpD,eAAO,MAAM,oBAAoB,eAEhC,CAAC;AAEF,UAAU,gCAAgC;IAExC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,4CACf,SAAQ,gCAAgC;IACxC,QAAQ,CAAC,aAAa,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;IAKtE,QAAQ,CAAC,SAAS,EAAE,SAAS,wBAAwB,EAAE,CAAC;IAMxD,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACjD;AAID,MAAM,MAAM,0BAA0B,GACpC,4CAA4C,CAAC;AAsE/C,qBACa,mBAAmB;IAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,0BAA0B,GAAG,aAAa;CAgDhE"}
|
|
@@ -14,14 +14,22 @@ const service_registry_nest_1 = require("@xemahq/service-registry-nest");
|
|
|
14
14
|
const bootstrap_1 = require("../bootstrap");
|
|
15
15
|
const migration_mode_1 = require("../migration-mode");
|
|
16
16
|
exports.BIOME_DATABASE_READY = Symbol.for('@xemahq/biome-database-nest:ready');
|
|
17
|
+
function assertBiomeDatabaseModuleOptions(opts) {
|
|
18
|
+
if (opts === null ||
|
|
19
|
+
typeof opts !== 'object' ||
|
|
20
|
+
!('migrationMode' in opts) ||
|
|
21
|
+
opts.migrationMode !== migration_mode_1.BiomeDatabaseMigrationMode.ApplicationManaged) {
|
|
22
|
+
throw new Error('[biome-database] migrationMode is required and must be ApplicationManaged.');
|
|
23
|
+
}
|
|
24
|
+
if (!('databases' in opts) ||
|
|
25
|
+
!Array.isArray(opts.databases) ||
|
|
26
|
+
opts.databases.length === 0) {
|
|
27
|
+
throw new Error('[biome-database] every migration mode requires at least one explicit database declaration.');
|
|
28
|
+
}
|
|
29
|
+
}
|
|
17
30
|
let BiomeDatabaseModule = BiomeDatabaseModule_1 = class BiomeDatabaseModule {
|
|
18
31
|
static forRoot(opts) {
|
|
19
|
-
|
|
20
|
-
throw new Error('[biome-database] migrationMode is required and must be a BiomeDatabaseMigrationMode.');
|
|
21
|
-
}
|
|
22
|
-
if (opts.databases.length === 0) {
|
|
23
|
-
throw new Error('[biome-database] every migration mode requires at least one explicit database declaration.');
|
|
24
|
-
}
|
|
32
|
+
assertBiomeDatabaseModuleOptions(opts);
|
|
25
33
|
const databases = opts.databases;
|
|
26
34
|
if ((0, service_registry_nest_1.isOpenApiExtraction)()) {
|
|
27
35
|
return {
|
|
@@ -38,28 +46,16 @@ let BiomeDatabaseModule = BiomeDatabaseModule_1 = class BiomeDatabaseModule {
|
|
|
38
46
|
{
|
|
39
47
|
provide: exports.BIOME_DATABASE_READY,
|
|
40
48
|
useFactory: async (identityBootstrap, kernelState) => {
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
kernelState,
|
|
52
|
-
});
|
|
53
|
-
}
|
|
54
|
-
else {
|
|
55
|
-
await (0, bootstrap_1.bootstrapBiomeDatabases)({
|
|
56
|
-
biomeId: opts.biomeId,
|
|
57
|
-
migrationMode: opts.migrationMode,
|
|
58
|
-
databases: databases,
|
|
59
|
-
serviceToken: () => identityBootstrap.getAccessToken(),
|
|
60
|
-
kernelState,
|
|
61
|
-
});
|
|
62
|
-
}
|
|
49
|
+
await (0, bootstrap_1.bootstrapBiomeDatabases)({
|
|
50
|
+
biomeId: opts.biomeId,
|
|
51
|
+
migrationMode: opts.migrationMode,
|
|
52
|
+
databases,
|
|
53
|
+
...(opts.requiredExtensions !== undefined
|
|
54
|
+
? { requiredExtensions: opts.requiredExtensions }
|
|
55
|
+
: {}),
|
|
56
|
+
serviceToken: () => identityBootstrap.getAccessToken(),
|
|
57
|
+
kernelState,
|
|
58
|
+
});
|
|
63
59
|
return true;
|
|
64
60
|
},
|
|
65
61
|
inject: [identity_client_1.IdentityBootstrapService, service_registry_nest_1.KERNEL_STATE_TOKEN],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"biome-database.module.js","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAwC;AACxC,6DAAmE;AACnE,yEAGuC;AAEvC,4CAAuD;AACvD,sDAA+D;AAiBlD,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAC5C,mCAAmC,CACpC,CAAC;
|
|
1
|
+
{"version":3,"file":"biome-database.module.js","sourceRoot":"","sources":["../../../src/lib/nest/biome-database.module.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAAwC;AACxC,6DAAmE;AACnE,yEAGuC;AAEvC,4CAAuD;AACvD,sDAA+D;AAiBlD,QAAA,oBAAoB,GAAG,MAAM,CAAC,GAAG,CAC5C,mCAAmC,CACpC,CAAC;AA4BF,SAAS,gCAAgC,CACvC,IAAa;IAEb,IACE,IAAI,KAAK,IAAI;QACb,OAAO,IAAI,KAAK,QAAQ;QACxB,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC;QAC1B,IAAI,CAAC,aAAa,KAAK,2CAA0B,CAAC,kBAAkB,EACpE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,IACE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC,EAC3B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4FAA4F,CAC7F,CAAC;IACJ,CAAC;AACH,CAAC;AA8CM,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAE9B,MAAM,CAAC,OAAO,CAAC,IAAa;QAC1B,gCAAgC,CAAC,IAAI,CAAC,CAAC;QACvC,MAAM,SAAS,GAAwC,IAAI,CAAC,SAAS,CAAC;QAQtE,IAAI,IAAA,2CAAmB,GAAE,EAAE,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,qBAAmB;gBAC3B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,4BAAoB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;gBAC9D,OAAO,EAAE,CAAC,4BAAoB,CAAC;aAChC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,MAAM,EAAE,qBAAmB;YAC3B,MAAM,EAAE,IAAI;YACZ,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,4BAAoB;oBAC7B,UAAU,EAAE,KAAK,EACf,iBAA2C,EAC3C,WAAwB,EACT,EAAE;wBACjB,MAAM,IAAA,mCAAuB,EAAC;4BAC5B,OAAO,EAAE,IAAI,CAAC,OAAO;4BACrB,aAAa,EAAE,IAAI,CAAC,aAAa;4BACjC,SAAS;4BACT,GAAG,CAAC,IAAI,CAAC,kBAAkB,KAAK,SAAS;gCACvC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE;gCACjD,CAAC,CAAC,EAAE,CAAC;4BACP,YAAY,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,cAAc,EAAE;4BACtD,WAAW;yBACZ,CAAC,CAAC;wBACH,OAAO,IAAI,CAAC;oBACd,CAAC;oBACD,MAAM,EAAE,CAAC,0CAAwB,EAAE,0CAAkB,CAAC;iBACvD;aACF;YACD,OAAO,EAAE,CAAC,4BAAoB,CAAC;SAChC,CAAC;IACJ,CAAC;CACF,CAAA;AAjDY,kDAAmB;8BAAnB,mBAAmB;IAD/B,IAAA,eAAM,EAAC,EAAE,CAAC;GACE,mBAAmB,CAiD/B"}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-erasure.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"org-erasure.module.d.ts","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":"AAoCA,OAAO,EAOL,KAAK,aAAa,EAClB,KAAK,IAAI,EACV,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAGL,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACtB,MAAM,iCAAiC,CAAC;AAMzC,eAAO,MAAM,kBAAkB,eAE9B,CAAC;AAUF,eAAO,MAAM,2BAA2B,0BAA0B,CAAC;AAGnE,eAAO,MAAM,sBAAsB,yBAAyB,CAAC;AAE7D,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjD;AAED,qBAGa,oBAAoB;IAED,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,gBAAgB;IASvE,KAAK,CAAiB,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;CAGhE;AAED,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAMlE,QAAQ,CAAC,kBAAkB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,MAAM,GAAG,MAAM,CAAC;CAC9D;AAQD,qBAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,uBAAuB,GAAG,aAAa;CAwChE"}
|
|
@@ -18,6 +18,7 @@ const swagger_1 = require("@nestjs/swagger");
|
|
|
18
18
|
const platform_common_1 = require("@xemahq/platform-common");
|
|
19
19
|
const xema_decorators_1 = require("@xemahq/xema-decorators");
|
|
20
20
|
const org_erasure_1 = require("../tenant-isolation/org-erasure");
|
|
21
|
+
const tenant_isolation_extension_1 = require("../tenant-isolation/tenant-isolation.extension");
|
|
21
22
|
exports.ORG_ERASURE_RUNNER = Symbol.for('@xemahq/biome-database-nest/org-erasure-runner');
|
|
22
23
|
exports.ORG_DATA_ERASURE_CAPABILITY = 'xema.org-data-erasure';
|
|
23
24
|
exports.ORG_ERASURE_ROUTE_PATH = 'internal/org-erasure';
|
|
@@ -58,9 +59,16 @@ class OrgErasureModule {
|
|
|
58
59
|
providers: [
|
|
59
60
|
{
|
|
60
61
|
provide: exports.ORG_ERASURE_RUNNER,
|
|
61
|
-
useFactory: (prisma) =>
|
|
62
|
-
|
|
63
|
-
|
|
62
|
+
useFactory: (prisma) => {
|
|
63
|
+
const client = prisma.asSystem();
|
|
64
|
+
const models = [
|
|
65
|
+
...(0, org_erasure_1.assertOrgErasureMatchesModels)(client, eraseOptions),
|
|
66
|
+
].sort();
|
|
67
|
+
new common_1.Logger(OrgErasureModule.name).log(`org-erasure participant armed on "${eraseOptions.orgField ?? tenant_isolation_extension_1.DEFAULT_ORG_FIELD}" over ${models.length} model(s): ${models.join(', ')}`);
|
|
68
|
+
return {
|
|
69
|
+
erase: (orgId) => (0, org_erasure_1.eraseOrgData)(prisma.asSystem(), orgId, eraseOptions),
|
|
70
|
+
};
|
|
71
|
+
},
|
|
64
72
|
inject: [prismaServiceToken],
|
|
65
73
|
},
|
|
66
74
|
],
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-erasure.module.js","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"org-erasure.module.js","sourceRoot":"","sources":["../../../src/lib/nest/org-erasure.module.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAoCA,2CASwB;AACxB,6CAAwD;AACxD,6DAA4D;AAC5D,6DAAmF;AAEnF,iEAKyC;AACzC,+FAAmF;AAKtE,QAAA,kBAAkB,GAAG,MAAM,CAAC,GAAG,CAC1C,gDAAgD,CACjD,CAAC;AAUW,QAAA,2BAA2B,GAAG,uBAAuB,CAAC;AAGtD,QAAA,sBAAsB,GAAG,sBAAsB,CAAC;AAStD,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAEgB;IAD/C,YAC+C,MAAwB;QAAxB,WAAM,GAAN,MAAM,CAAkB;IACpE,CAAC;IAQJ,KAAK,CAAiB,KAAa;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;CACF,CAAA;AAdY,oDAAoB;AAW/B;IANC,IAAA,mCAAiB,EAAC,EAAE,QAAQ,EAAE,uCAAqB,CAAC,OAAO,EAAE,CAAC;IAC9D,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,sBAAY,EAAC;QACZ,OAAO,EACL,6EAA6E;KAChF,CAAC;IACK,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;iDAEpB;+BAbU,oBAAoB;IAHhC,IAAA,iBAAO,EAAC,aAAa,CAAC;IACtB,IAAA,kBAAS,EAAC,mCAAiB,CAAC;IAC5B,IAAA,mBAAU,EAAC,sBAAsB,CAAC;IAG9B,WAAA,IAAA,eAAM,EAAC,0BAAkB,CAAC,CAAA;;GAFlB,oBAAoB,CAchC;AAiBD,MAAa,gBAAgB;IAC3B,MAAM,CAAC,OAAO,CAAC,OAAgC;QAC7C,MAAM,EAAE,kBAAkB,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,CAAC;QACxD,OAAO;YACL,MAAM,EAAE,gBAAgB;YACxB,WAAW,EAAE,CAAC,oBAAoB,CAAC;YACnC,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,0BAAkB;oBAC3B,UAAU,EAAE,CAAC,MAAwB,EAAoB,EAAE;wBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;wBAajC,MAAM,MAAM,GAAG;4BACb,GAAG,IAAA,2CAA6B,EAAC,MAAM,EAAE,YAAY,CAAC;yBACvD,CAAC,IAAI,EAAE,CAAC;wBACT,IAAI,eAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,GAAG,CACnC,qCACE,YAAY,CAAC,QAAQ,IAAI,8CAC3B,UAAU,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzD,CAAC;wBACF,OAAO;4BACL,KAAK,EAAE,CAAC,KAAa,EAA6B,EAAE,CAClD,IAAA,0BAAY,EAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC;yBACvD,CAAC;oBACJ,CAAC;oBACD,MAAM,EAAE,CAAC,kBAAkB,CAAC;iBAC7B;aACF;SACF,CAAC;IACJ,CAAC;CACF;AAzCD,4CAyCC"}
|
|
@@ -13,5 +13,12 @@ export declare class OrgErasureBlockedError extends Error {
|
|
|
13
13
|
readonly blockedModels: readonly string[];
|
|
14
14
|
constructor(orgId: string, blockedModels: readonly string[]);
|
|
15
15
|
}
|
|
16
|
+
export declare class OrgErasureMatchesNothingError extends Error {
|
|
17
|
+
readonly orgField: string;
|
|
18
|
+
readonly knownModels: readonly string[];
|
|
19
|
+
readonly exemptModels: readonly string[];
|
|
20
|
+
constructor(orgField: string, knownModels: readonly string[], exemptModels: readonly string[]);
|
|
21
|
+
}
|
|
22
|
+
export declare function assertOrgErasureMatchesModels(client: unknown, options?: EraseOrgDataOptions): ReadonlySet<string>;
|
|
16
23
|
export declare function eraseOrgData(client: unknown, orgId: string, options?: EraseOrgDataOptions): Promise<OrgErasureReport>;
|
|
17
24
|
//# sourceMappingURL=org-erasure.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-erasure.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"org-erasure.d.ts","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":"AAmCA,MAAM,WAAW,mBAAmB;IAElC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAQ3B,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAEvB,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1D,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAE9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAGD,qBAAa,sBAAuB,SAAQ,KAAK;IAE7C,QAAQ,CAAC,KAAK,EAAE,MAAM;IACtB,QAAQ,CAAC,aAAa,EAAE,SAAS,MAAM,EAAE;gBADhC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,SAAS,MAAM,EAAE;CAY5C;AAiBD,qBAAa,6BAA8B,SAAQ,KAAK;IAEpD,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE;IACvC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE;gBAF/B,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,SAAS,MAAM,EAAE,EAC9B,YAAY,EAAE,SAAS,MAAM,EAAE;CAkB3C;AAoBD,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,OAAO,EACf,OAAO,GAAE,mBAAwB,GAChC,WAAW,CAAC,MAAM,CAAC,CAYrB;AA2BD,wBAAsB,YAAY,CAChC,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,MAAM,EACb,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAwD3B"}
|
|
@@ -1,6 +1,7 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.OrgErasureBlockedError = void 0;
|
|
3
|
+
exports.OrgErasureMatchesNothingError = exports.OrgErasureBlockedError = void 0;
|
|
4
|
+
exports.assertOrgErasureMatchesModels = assertOrgErasureMatchesModels;
|
|
4
5
|
exports.eraseOrgData = eraseOrgData;
|
|
5
6
|
const tenant_isolation_extension_1 = require("./tenant-isolation.extension");
|
|
6
7
|
const PRISMA_FK_VIOLATION_CODE = 'P2003';
|
|
@@ -18,6 +19,37 @@ class OrgErasureBlockedError extends Error {
|
|
|
18
19
|
}
|
|
19
20
|
}
|
|
20
21
|
exports.OrgErasureBlockedError = OrgErasureBlockedError;
|
|
22
|
+
class OrgErasureMatchesNothingError extends Error {
|
|
23
|
+
orgField;
|
|
24
|
+
knownModels;
|
|
25
|
+
exemptModels;
|
|
26
|
+
constructor(orgField, knownModels, exemptModels) {
|
|
27
|
+
super(`[org-erasure] this erasure participant matched ZERO models on org ` +
|
|
28
|
+
`field "${orgField}" — it cannot delete anything, so it MUST NOT ` +
|
|
29
|
+
`report a successful erasure (the orchestrator would record proof of ` +
|
|
30
|
+
`an erasure that never happened). Known models: [${knownModels.join(', ')}]` +
|
|
31
|
+
(exemptModels.length > 0
|
|
32
|
+
? `; exemptModels: [${exemptModels.join(', ')}]` +
|
|
33
|
+
` — exempting every org-scoped model leaves nothing to erase`
|
|
34
|
+
: '') +
|
|
35
|
+
`. Fix the participant's orgField (or stop registering the service as ` +
|
|
36
|
+
`an org-erasure participant) rather than relaxing this check.`);
|
|
37
|
+
this.orgField = orgField;
|
|
38
|
+
this.knownModels = knownModels;
|
|
39
|
+
this.exemptModels = exemptModels;
|
|
40
|
+
this.name = 'OrgErasureMatchesNothingError';
|
|
41
|
+
}
|
|
42
|
+
}
|
|
43
|
+
exports.OrgErasureMatchesNothingError = OrgErasureMatchesNothingError;
|
|
44
|
+
function assertOrgErasureMatchesModels(client, options = {}) {
|
|
45
|
+
const orgField = options.orgField ?? tenant_isolation_extension_1.DEFAULT_ORG_FIELD;
|
|
46
|
+
const exemptModels = options.exemptModels ?? [];
|
|
47
|
+
const scoped = (0, tenant_isolation_extension_1.collectOrgScopedModels)(client, orgField, exemptModels);
|
|
48
|
+
if (scoped.size === 0) {
|
|
49
|
+
throw new OrgErasureMatchesNothingError(orgField, Object.keys((0, tenant_isolation_extension_1.readRuntimeModels)(client)), exemptModels);
|
|
50
|
+
}
|
|
51
|
+
return scoped;
|
|
52
|
+
}
|
|
21
53
|
function delegateKeyForModel(modelName) {
|
|
22
54
|
return modelName.charAt(0).toLowerCase() + modelName.slice(1);
|
|
23
55
|
}
|
|
@@ -31,7 +63,7 @@ async function eraseOrgData(client, orgId, options = {}) {
|
|
|
31
63
|
if (orgId.trim() === '') {
|
|
32
64
|
throw new Error('[org-erasure] orgId must be a non-empty string.');
|
|
33
65
|
}
|
|
34
|
-
const scoped = (
|
|
66
|
+
const scoped = assertOrgErasureMatchesModels(client, options);
|
|
35
67
|
const deletedByModel = {};
|
|
36
68
|
let remaining = [...scoped];
|
|
37
69
|
let passes = 0;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"org-erasure.js","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":";;;
|
|
1
|
+
{"version":3,"file":"org-erasure.js","sourceRoot":"","sources":["../../../src/lib/tenant-isolation/org-erasure.ts"],"names":[],"mappings":";;;AAoIA,sEAeC;AA2BD,oCA4DC;AAhND,6EAIsC;AAGtC,MAAM,wBAAwB,GAAG,OAAO,CAAC;AAyBzC,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,KAAa,EACb,aAAgC;QAEzC,KAAK,CACH,sCAAsC,KAAK,cAAc,aAAa,CAAC,IAAI,CACzE,IAAI,CACL,2EAA2E;YAC1E,2EAA2E;YAC3E,2EAA2E;YAC3E,0CAA0C,CAC7C,CAAC;QAVO,UAAK,GAAL,KAAK,CAAQ;QACb,kBAAa,GAAb,aAAa,CAAmB;QAUzC,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAfD,wDAeC;AAiBD,MAAa,6BAA8B,SAAQ,KAAK;IAE3C;IACA;IACA;IAHX,YACW,QAAgB,EAChB,WAA8B,EAC9B,YAA+B;QAExC,KAAK,CACH,oEAAoE;YAClE,UAAU,QAAQ,gDAAgD;YAClE,sEAAsE;YACtE,mDAAmD,WAAW,CAAC,IAAI,CACjE,IAAI,CACL,GAAG;YACJ,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;gBACtB,CAAC,CAAC,oBAAoB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;oBAC9C,6DAA6D;gBAC/D,CAAC,CAAC,EAAE,CAAC;YACP,uEAAuE;YACvE,8DAA8D,CACjE,CAAC;QAjBO,aAAQ,GAAR,QAAQ,CAAQ;QAChB,gBAAW,GAAX,WAAW,CAAmB;QAC9B,iBAAY,GAAZ,YAAY,CAAmB;QAgBxC,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC9C,CAAC;CACF;AAtBD,sEAsBC;AAoBD,SAAgB,6BAA6B,CAC3C,MAAe,EACf,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,8CAAiB,CAAC;IACvD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAChD,MAAM,MAAM,GAAG,IAAA,mDAAsB,EAAC,MAAM,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,6BAA6B,CACrC,QAAQ,EACR,MAAM,CAAC,IAAI,CAAC,IAAA,8CAAiB,EAAC,MAAM,CAAC,CAAC,EACtC,YAAY,CACb,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAOD,SAAS,mBAAmB,CAAC,SAAiB;IAC5C,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAA4B,CAAC,IAAI,KAAK,wBAAwB,CAChE,CAAC;AACJ,CAAC;AAUM,KAAK,UAAU,YAAY,CAChC,MAAe,EACf,KAAa,EACb,UAA+B,EAAE;IAEjC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,8CAAiB,CAAC;IACvD,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAID,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAE9D,MAAM,cAAc,GAA2B,EAAE,CAAC;IAClD,IAAI,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;IAC5B,IAAI,MAAM,GAAG,CAAC,CAAC;IAEf,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,CAAC;QACZ,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,UAAU,GAAG,KAAK,CAAC;QAEvB,KAAK,MAAM,SAAS,IAAI,SAAS,EAAE,CAAC;YAClC,MAAM,QAAQ,GAAI,MAAkC,CAClD,mBAAmB,CAAC,SAAS,CAAC,CACG,CAAC;YACpC,IAAI,QAAQ,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;gBACvC,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACjE,IAAI,SAAS,iBAAiB,mBAAmB,CAAC,SAAS,CAAC,KAAK,CACpE,CAAC;YACJ,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,UAAU,CAAC;oBAC1C,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE;iBAC7B,CAAC,CAAC;gBACH,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC;gBACrE,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBACjC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;oBACxB,SAAS;gBACX,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,SAAS,GAAG,OAAO,CAAC;IACtB,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,MAAM,CACvD,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,EACnB,CAAC,CACF,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AACzD,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@xemahq/biome-database-nest",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.12.1",
|
|
4
4
|
"description": "Explicit database migration ownership, least-privilege runtime verification, and schema-qualified Prisma wiring for Xema biome services.",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"author": "Neuralchowder Inc. <developer@xema.dev> (https://xema.dev)",
|
|
@@ -28,15 +28,15 @@
|
|
|
28
28
|
"@types/jest": "^30.0.0",
|
|
29
29
|
"@types/node": "25.2.3",
|
|
30
30
|
"@types/pg": "^8.16.0",
|
|
31
|
-
"@xemahq/identity-client": "^0.
|
|
32
|
-
"@xemahq/kernel-contracts": "^
|
|
33
|
-
"@xemahq/xema-decorators": "^0.5.0",
|
|
31
|
+
"@xemahq/identity-client": "^0.9.1",
|
|
32
|
+
"@xemahq/kernel-contracts": "^8.0.0",
|
|
34
33
|
"jest": "^30.3.0",
|
|
35
34
|
"prettier": "3.6.2",
|
|
36
35
|
"ts-jest": "^29.4.9",
|
|
37
36
|
"typescript": "5.9.3",
|
|
38
|
-
"@xemahq/platform-common": "^0.7.
|
|
39
|
-
"@xemahq/
|
|
37
|
+
"@xemahq/platform-common": "^0.7.4",
|
|
38
|
+
"@xemahq/xema-decorators": "0.5.3",
|
|
39
|
+
"@xemahq/service-registry-nest": "0.7.0"
|
|
40
40
|
},
|
|
41
41
|
"peerDependencies": {
|
|
42
42
|
"@nestjs/common": "^10 || ^11",
|
package/src/index.ts
CHANGED
|
@@ -97,8 +97,10 @@ export {
|
|
|
97
97
|
type UnscopedModelDeclarations,
|
|
98
98
|
} from './lib/tenant-isolation/unscoped-models';
|
|
99
99
|
export {
|
|
100
|
+
assertOrgErasureMatchesModels,
|
|
100
101
|
eraseOrgData,
|
|
101
102
|
OrgErasureBlockedError,
|
|
103
|
+
OrgErasureMatchesNothingError,
|
|
102
104
|
type EraseOrgDataOptions,
|
|
103
105
|
type OrgErasureReport,
|
|
104
106
|
} from './lib/tenant-isolation/org-erasure';
|
package/src/lib/bootstrap.ts
CHANGED
|
@@ -18,12 +18,10 @@ import {
|
|
|
18
18
|
resolveControlPlaneBaseUrl,
|
|
19
19
|
type ControlPlaneDiscoveryOptions,
|
|
20
20
|
} from './control-plane-discovery';
|
|
21
|
-
import {
|
|
22
|
-
BiomeDatabaseMigrationMode,
|
|
23
|
-
} from './migration-mode';
|
|
24
21
|
import { DEFAULT_BIOME_DB_KEY } from './schema-name';
|
|
25
22
|
|
|
26
23
|
import type { BiomeDatabaseConfig } from './config';
|
|
24
|
+
import type { BiomeDatabaseMigrationMode } from './migration-mode';
|
|
27
25
|
import type { KernelState } from '@xemahq/kernel-contracts/kernel-state';
|
|
28
26
|
|
|
29
27
|
/** One database whose schema and Prisma migrations the application owns. */
|
|
@@ -398,8 +396,7 @@ export async function bootstrapBiomeDatabases(
|
|
|
398
396
|
return cachedBaseUrl;
|
|
399
397
|
};
|
|
400
398
|
|
|
401
|
-
|
|
402
|
-
for (const decl of opts.databases) {
|
|
399
|
+
for (const decl of opts.databases) {
|
|
403
400
|
const key = decl.key ?? DEFAULT_BIOME_DB_KEY;
|
|
404
401
|
bootstrapLogger.log(
|
|
405
402
|
`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: resolving config for mode=${opts.migrationMode}`,
|
|
@@ -427,7 +424,5 @@ export async function bootstrapBiomeDatabases(
|
|
|
427
424
|
bootstrapLogger.log(
|
|
428
425
|
`${LOG_PREFIX} biome=${opts.biomeId} key=${key}: bootstrap complete`,
|
|
429
426
|
);
|
|
430
|
-
}
|
|
431
|
-
return;
|
|
432
427
|
}
|
|
433
428
|
}
|
|
@@ -76,7 +76,7 @@ export async function fetchSystemDatabaseConfig(
|
|
|
76
76
|
}
|
|
77
77
|
|
|
78
78
|
const payload = await response.json();
|
|
79
|
-
const config = unwrapPlatformResponseEnvelope<
|
|
79
|
+
const config: unknown = unwrapPlatformResponseEnvelope<unknown>(
|
|
80
80
|
payload,
|
|
81
81
|
`fetchSystemDatabaseConfig: ${url}`,
|
|
82
82
|
);
|
|
@@ -99,12 +99,15 @@ const REQUIRED_CONFIG_FIELDS = [
|
|
|
99
99
|
* fields and the keys actually present, to distinguish "control plane returned
|
|
100
100
|
* a partial config" from "response envelope was not unwrapped".
|
|
101
101
|
*/
|
|
102
|
-
function assertCompleteConfig(
|
|
102
|
+
function assertCompleteConfig(
|
|
103
|
+
config: unknown,
|
|
104
|
+
url: string,
|
|
105
|
+
): asserts config is BiomeDatabaseConfig {
|
|
103
106
|
// A null / non-object body coerces to `{}`, so every required field reads as
|
|
104
107
|
// missing and the diagnostic below fires with "Present keys: []".
|
|
105
|
-
const record =
|
|
108
|
+
const record: Record<string, unknown> =
|
|
106
109
|
config !== null && typeof config === 'object'
|
|
107
|
-
? (config
|
|
110
|
+
? Object.fromEntries(Object.entries(config))
|
|
108
111
|
: {};
|
|
109
112
|
const missing = REQUIRED_CONFIG_FIELDS.filter((field) => {
|
|
110
113
|
const value = record[field];
|
|
@@ -53,6 +53,31 @@ export interface ApplicationManagedBiomeDatabaseModuleOptions
|
|
|
53
53
|
export type BiomeDatabaseModuleOptions =
|
|
54
54
|
ApplicationManagedBiomeDatabaseModuleOptions;
|
|
55
55
|
|
|
56
|
+
function assertBiomeDatabaseModuleOptions(
|
|
57
|
+
opts: unknown,
|
|
58
|
+
): asserts opts is BiomeDatabaseModuleOptions {
|
|
59
|
+
if (
|
|
60
|
+
opts === null ||
|
|
61
|
+
typeof opts !== 'object' ||
|
|
62
|
+
!('migrationMode' in opts) ||
|
|
63
|
+
opts.migrationMode !== BiomeDatabaseMigrationMode.ApplicationManaged
|
|
64
|
+
) {
|
|
65
|
+
throw new Error(
|
|
66
|
+
'[biome-database] migrationMode is required and must be ApplicationManaged.',
|
|
67
|
+
);
|
|
68
|
+
}
|
|
69
|
+
|
|
70
|
+
if (
|
|
71
|
+
!('databases' in opts) ||
|
|
72
|
+
!Array.isArray(opts.databases) ||
|
|
73
|
+
opts.databases.length === 0
|
|
74
|
+
) {
|
|
75
|
+
throw new Error(
|
|
76
|
+
'[biome-database] every migration mode requires at least one explicit database declaration.',
|
|
77
|
+
);
|
|
78
|
+
}
|
|
79
|
+
}
|
|
80
|
+
|
|
56
81
|
/**
|
|
57
82
|
* Global Nest dynamic module that bootstraps a biome's database using an
|
|
58
83
|
* explicitly selected migration ownership mode.
|
|
@@ -98,22 +123,10 @@ export type BiomeDatabaseModuleOptions =
|
|
|
98
123
|
*/
|
|
99
124
|
@Module({})
|
|
100
125
|
export class BiomeDatabaseModule {
|
|
101
|
-
static forRoot(opts: BiomeDatabaseModuleOptions): DynamicModule
|
|
102
|
-
|
|
103
|
-
|
|
104
|
-
|
|
105
|
-
throw new Error(
|
|
106
|
-
'[biome-database] migrationMode is required and must be a BiomeDatabaseMigrationMode.',
|
|
107
|
-
);
|
|
108
|
-
}
|
|
109
|
-
if (opts.databases.length === 0) {
|
|
110
|
-
throw new Error(
|
|
111
|
-
'[biome-database] every migration mode requires at least one explicit database declaration.',
|
|
112
|
-
);
|
|
113
|
-
}
|
|
114
|
-
const databases:
|
|
115
|
-
| readonly BiomeDatabaseDeclaration[]
|
|
116
|
-
= opts.databases;
|
|
126
|
+
static forRoot(opts: BiomeDatabaseModuleOptions): DynamicModule;
|
|
127
|
+
static forRoot(opts: unknown): DynamicModule {
|
|
128
|
+
assertBiomeDatabaseModuleOptions(opts);
|
|
129
|
+
const databases: readonly BiomeDatabaseDeclaration[] = opts.databases;
|
|
117
130
|
|
|
118
131
|
// Build-time OpenAPI extraction compiles the DI graph for decorator
|
|
119
132
|
// metadata only: it never calls `app.init()`, never issues a query, and
|
|
@@ -140,30 +153,16 @@ export class BiomeDatabaseModule {
|
|
|
140
153
|
identityBootstrap: IdentityBootstrapService,
|
|
141
154
|
kernelState: KernelState,
|
|
142
155
|
): Promise<true> => {
|
|
143
|
-
|
|
144
|
-
opts.
|
|
145
|
-
|
|
146
|
-
|
|
147
|
-
|
|
148
|
-
|
|
149
|
-
|
|
150
|
-
|
|
151
|
-
|
|
152
|
-
|
|
153
|
-
: {}),
|
|
154
|
-
serviceToken: () => identityBootstrap.getAccessToken(),
|
|
155
|
-
kernelState,
|
|
156
|
-
});
|
|
157
|
-
} else {
|
|
158
|
-
await bootstrapBiomeDatabases({
|
|
159
|
-
biomeId: opts.biomeId,
|
|
160
|
-
migrationMode: opts.migrationMode,
|
|
161
|
-
databases:
|
|
162
|
-
databases,
|
|
163
|
-
serviceToken: () => identityBootstrap.getAccessToken(),
|
|
164
|
-
kernelState,
|
|
165
|
-
});
|
|
166
|
-
}
|
|
156
|
+
await bootstrapBiomeDatabases({
|
|
157
|
+
biomeId: opts.biomeId,
|
|
158
|
+
migrationMode: opts.migrationMode,
|
|
159
|
+
databases,
|
|
160
|
+
...(opts.requiredExtensions !== undefined
|
|
161
|
+
? { requiredExtensions: opts.requiredExtensions }
|
|
162
|
+
: {}),
|
|
163
|
+
serviceToken: () => identityBootstrap.getAccessToken(),
|
|
164
|
+
kernelState,
|
|
165
|
+
});
|
|
167
166
|
return true;
|
|
168
167
|
},
|
|
169
168
|
inject: [IdentityBootstrapService, KERNEL_STATE_TOKEN],
|
|
@@ -25,10 +25,19 @@
|
|
|
25
25
|
*
|
|
26
26
|
* The org filter is applied inside {@link eraseOrgData}; the runner passes the
|
|
27
27
|
* unscoped client so scoping is neither doubled nor left to ambient context.
|
|
28
|
+
*
|
|
29
|
+
* **The module refuses to boot a participant that can erase nothing.** Wiring
|
|
30
|
+
* the runner asserts (via {@link assertOrgErasureMatchesModels}) that the
|
|
31
|
+
* configured `orgField` matches at least one model of THIS service's schema. A
|
|
32
|
+
* participant registered against a column its schema does not spell matches
|
|
33
|
+
* zero models, deletes nothing, and returns `{totalDeleted: 0}` — which the
|
|
34
|
+
* orchestrator records as a successful erasure. That must fail at deploy, not
|
|
35
|
+
* silently succeed during a Data Subject Request.
|
|
28
36
|
*/
|
|
29
37
|
import {
|
|
30
38
|
Controller,
|
|
31
39
|
Inject,
|
|
40
|
+
Logger,
|
|
32
41
|
Param,
|
|
33
42
|
Post,
|
|
34
43
|
UseGuards,
|
|
@@ -40,10 +49,12 @@ import { ServiceActorGuard } from '@xemahq/platform-common';
|
|
|
40
49
|
import { InternalRouteAudience, XemaInternalRoute } from '@xemahq/xema-decorators';
|
|
41
50
|
|
|
42
51
|
import {
|
|
52
|
+
assertOrgErasureMatchesModels,
|
|
43
53
|
eraseOrgData,
|
|
44
54
|
type EraseOrgDataOptions,
|
|
45
55
|
type OrgErasureReport,
|
|
46
56
|
} from '../tenant-isolation/org-erasure';
|
|
57
|
+
import { DEFAULT_ORG_FIELD } from '../tenant-isolation/tenant-isolation.extension';
|
|
47
58
|
|
|
48
59
|
import type { TenantScopedApi } from './prisma-service-factory';
|
|
49
60
|
|
|
@@ -112,10 +123,33 @@ export class OrgErasureModule {
|
|
|
112
123
|
providers: [
|
|
113
124
|
{
|
|
114
125
|
provide: ORG_ERASURE_RUNNER,
|
|
115
|
-
useFactory: (prisma: AsSystemProvider): OrgErasureRunner =>
|
|
116
|
-
|
|
117
|
-
|
|
118
|
-
|
|
126
|
+
useFactory: (prisma: AsSystemProvider): OrgErasureRunner => {
|
|
127
|
+
const client = prisma.asSystem();
|
|
128
|
+
// BOOT GATE. A participant whose orgField matches no model can
|
|
129
|
+
// never delete a row, and `eraseOrgData` would have answered every
|
|
130
|
+
// erasure `{totalDeleted: 0}` — which the orchestrator saga records
|
|
131
|
+
// as a successful erasure. Discovering that during a live Data
|
|
132
|
+
// Subject Request is discovering it too late, so the service
|
|
133
|
+
// refuses to START rather than advertise `xema.org-data-erasure`
|
|
134
|
+
// it cannot honour. Throwing here aborts Nest's bootstrap.
|
|
135
|
+
//
|
|
136
|
+
// This is the CONFIGURATION proof; `eraseOrgData` re-asserts per
|
|
137
|
+
// request, which is the proof of the RUN being recorded as
|
|
138
|
+
// evidence. The assertion is on MODELS matched — an org that
|
|
139
|
+
// genuinely holds no rows here still erases successfully.
|
|
140
|
+
const models = [
|
|
141
|
+
...assertOrgErasureMatchesModels(client, eraseOptions),
|
|
142
|
+
].sort();
|
|
143
|
+
new Logger(OrgErasureModule.name).log(
|
|
144
|
+
`org-erasure participant armed on "${
|
|
145
|
+
eraseOptions.orgField ?? DEFAULT_ORG_FIELD
|
|
146
|
+
}" over ${models.length} model(s): ${models.join(', ')}`,
|
|
147
|
+
);
|
|
148
|
+
return {
|
|
149
|
+
erase: (orgId: string): Promise<OrgErasureReport> =>
|
|
150
|
+
eraseOrgData(prisma.asSystem(), orgId, eraseOptions),
|
|
151
|
+
};
|
|
152
|
+
},
|
|
119
153
|
inject: [prismaServiceToken],
|
|
120
154
|
},
|
|
121
155
|
],
|
|
@@ -19,10 +19,15 @@
|
|
|
19
19
|
* row, or a cycle) blocks deletion — we FAIL LOUD with the blocked models
|
|
20
20
|
* rather than leave a silent partial erasure. Idempotent + resumable: re-running
|
|
21
21
|
* re-deletes already-gone rows as no-ops, so the orchestrator saga can retry.
|
|
22
|
+
*
|
|
23
|
+
* A participant that matches ZERO models is likewise a FAILURE, not a clean run
|
|
24
|
+
* — see {@link assertOrgErasureMatchesModels} for why, and for the distinction
|
|
25
|
+
* (models vs rows) that makes that assertion correct rather than a new bug.
|
|
22
26
|
*/
|
|
23
27
|
import {
|
|
24
28
|
DEFAULT_ORG_FIELD,
|
|
25
29
|
collectOrgScopedModels,
|
|
30
|
+
readRuntimeModels,
|
|
26
31
|
} from './tenant-isolation.extension';
|
|
27
32
|
|
|
28
33
|
/** Prisma's error code for a foreign-key constraint failure on delete. */
|
|
@@ -68,6 +73,80 @@ export class OrgErasureBlockedError extends Error {
|
|
|
68
73
|
}
|
|
69
74
|
}
|
|
70
75
|
|
|
76
|
+
/**
|
|
77
|
+
* Thrown when an erasure participant's configuration matches NO org-scoped
|
|
78
|
+
* model at all — it is structurally incapable of deleting anything.
|
|
79
|
+
*
|
|
80
|
+
* This is a MISCONFIGURATION, never an empty org. `memory-api` shipped as a
|
|
81
|
+
* registered GDPR erasure participant whose every model spells the org column
|
|
82
|
+
* `organizationId` while the participant was registered with no `orgField`, so
|
|
83
|
+
* {@link collectOrgScopedModels} returned an empty set, the delete loop never
|
|
84
|
+
* executed, and every erasure answered `200 {totalDeleted: 0}` — which the
|
|
85
|
+
* orchestrator saga records as a SUCCESSFUL erasure. A Data Subject Request
|
|
86
|
+
* answered from that record is false in writing.
|
|
87
|
+
*
|
|
88
|
+
* There is no degraded mode here: a participant that cannot delete anything
|
|
89
|
+
* must not be allowed to report success.
|
|
90
|
+
*/
|
|
91
|
+
export class OrgErasureMatchesNothingError extends Error {
|
|
92
|
+
constructor(
|
|
93
|
+
readonly orgField: string,
|
|
94
|
+
readonly knownModels: readonly string[],
|
|
95
|
+
readonly exemptModels: readonly string[],
|
|
96
|
+
) {
|
|
97
|
+
super(
|
|
98
|
+
`[org-erasure] this erasure participant matched ZERO models on org ` +
|
|
99
|
+
`field "${orgField}" — it cannot delete anything, so it MUST NOT ` +
|
|
100
|
+
`report a successful erasure (the orchestrator would record proof of ` +
|
|
101
|
+
`an erasure that never happened). Known models: [${knownModels.join(
|
|
102
|
+
', ',
|
|
103
|
+
)}]` +
|
|
104
|
+
(exemptModels.length > 0
|
|
105
|
+
? `; exemptModels: [${exemptModels.join(', ')}]` +
|
|
106
|
+
` — exempting every org-scoped model leaves nothing to erase`
|
|
107
|
+
: '') +
|
|
108
|
+
`. Fix the participant's orgField (or stop registering the service as ` +
|
|
109
|
+
`an org-erasure participant) rather than relaxing this check.`,
|
|
110
|
+
);
|
|
111
|
+
this.name = 'OrgErasureMatchesNothingError';
|
|
112
|
+
}
|
|
113
|
+
}
|
|
114
|
+
|
|
115
|
+
/**
|
|
116
|
+
* Assert the participant can possibly delete something, and return the models
|
|
117
|
+
* it covers.
|
|
118
|
+
*
|
|
119
|
+
* **Models, never rows.** Zero MODELS matched means the participant is
|
|
120
|
+
* structurally incapable of erasing — a configuration defect. Zero ROWS deleted
|
|
121
|
+
* across a non-empty model set is a legitimate clean run: an org that genuinely
|
|
122
|
+
* holds no data in this service must succeed (and re-running an erasure must
|
|
123
|
+
* stay idempotent). Conflating the two would fail every honest erasure for an
|
|
124
|
+
* org with no data here, which is strictly worse than the bug this closes.
|
|
125
|
+
*
|
|
126
|
+
* Exported so a participant can gate at BOOT as well as per request:
|
|
127
|
+
* {@link OrgErasureModule} calls it while wiring its runner, so a service
|
|
128
|
+
* refuses to start rather than advertise `xema.org-data-erasure` it cannot
|
|
129
|
+
* honour. Boot proves the CONFIGURATION; the per-request call inside
|
|
130
|
+
* {@link eraseOrgData} proves the RUN that is about to be recorded as erasure
|
|
131
|
+
* evidence. Both are cheap and neither subsumes the other.
|
|
132
|
+
*/
|
|
133
|
+
export function assertOrgErasureMatchesModels(
|
|
134
|
+
client: unknown,
|
|
135
|
+
options: EraseOrgDataOptions = {},
|
|
136
|
+
): ReadonlySet<string> {
|
|
137
|
+
const orgField = options.orgField ?? DEFAULT_ORG_FIELD;
|
|
138
|
+
const exemptModels = options.exemptModels ?? [];
|
|
139
|
+
const scoped = collectOrgScopedModels(client, orgField, exemptModels);
|
|
140
|
+
if (scoped.size === 0) {
|
|
141
|
+
throw new OrgErasureMatchesNothingError(
|
|
142
|
+
orgField,
|
|
143
|
+
Object.keys(readRuntimeModels(client)),
|
|
144
|
+
exemptModels,
|
|
145
|
+
);
|
|
146
|
+
}
|
|
147
|
+
return scoped;
|
|
148
|
+
}
|
|
149
|
+
|
|
71
150
|
interface DeleteManyDelegate {
|
|
72
151
|
deleteMany(args: { where: Record<string, unknown> }): Promise<{ count: number }>;
|
|
73
152
|
}
|
|
@@ -103,11 +182,9 @@ export async function eraseOrgData(
|
|
|
103
182
|
throw new Error('[org-erasure] orgId must be a non-empty string.');
|
|
104
183
|
}
|
|
105
184
|
|
|
106
|
-
|
|
107
|
-
|
|
108
|
-
|
|
109
|
-
options.exemptModels ?? [],
|
|
110
|
-
);
|
|
185
|
+
// Matching no model is a misconfiguration, not an empty org — never let it
|
|
186
|
+
// return `{ totalDeleted: 0 }`, which the orchestrator reads as success.
|
|
187
|
+
const scoped = assertOrgErasureMatchesModels(client, options);
|
|
111
188
|
|
|
112
189
|
const deletedByModel: Record<string, number> = {};
|
|
113
190
|
let remaining = [...scoped];
|