better-supabase 0.5.1 → 0.6.1

package/dist/cli/read-sets-VQcPgxU9.js

@@ -1,436 +0,0 @@
-import { i as importModule } from "./config-CPVpXP5I.js";
-import { resolve } from "node:path";
-import { existsSync } from "node:fs";
-import { readFile } from "node:fs/promises";
-import { KIT_ID_TYPES, compileReadSets, kitIdType, permdockKeyStatus } from "better-supabase/sql";
-import { isReadSet } from "better-supabase";
-//#region src/cli/permdock.ts
-const PERMDOCK_CONFIGS = [
-	"permdock.config.ts",
-	"permdock.config.mts",
-	"permdock.config.js",
-	"permdock.config.mjs"
-];
-/** The PermDock config file in `root`, if there is one. */
-function permdockConfig(root) {
-	return PERMDOCK_CONFIGS.find((file) => existsSync(resolve(root, file)));
-}
-const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-const isString = (value) => typeof value === "string";
-const strings = (value) => Array.isArray(value) ? value.filter(isString) : [];
-const column = (value) => isRecord(value) && isString(value["column"]) ? { column: value["column"] } : void 0;
-function manifestValue(value, accept) {
-	if (!isRecord(value)) return void 0;
-	if (isString(value["column"])) return { column: value["column"] };
-	return accept(value["value"]) ? { value: value["value"] } : void 0;
-}
-const roleValue = (value) => isString(value) || Array.isArray(value) && value.every(isString);
-function membership(value) {
-	if (!isRecord(value) || !isString(value["table"])) return void 0;
-	const user = column(value["user"]);
-	const id = column(value["id"]);
-	const scope = manifestValue(value["scope"], isString);
-	if (!user || !id || !scope) return void 0;
-	const role = manifestValue(value["role"], roleValue);
-	const expiresAt = column(value["expiresAt"]);
-	return {
-		table: value["table"],
-		user,
-		scope,
-		id,
-		...role ? { role } : {},
-		...expiresAt ? { expiresAt } : {},
-		columns: strings(value["columns"])
-	};
-}
-/** Reads a parsed manifest; throws with the reason when it isn't version 1. */
-function parseManifest(json) {
-	if (!isRecord(json)) throw new TypeError("not a JSON object");
-	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
-	const hook = json["hook"];
-	const rls = json["rls"];
-	if (isRecord(rls) && rls["mode"] !== "jwt" && rls["mode"] !== "database") throw new TypeError(`rls.mode ${JSON.stringify(rls["mode"])} is not supported (this release reads "jwt" and "database")`);
-	const budget = isRecord(json["budget"]) ? json["budget"]["bytes"] : void 0;
-	return {
-		version: 1,
-		...typeof budget === "number" ? { budget } : {},
-		...isRecord(hook) && isString(hook["schema"]) && isString(hook["function"]) ? { hook: {
-			schema: hook["schema"],
-			function: hook["function"]
-		} } : {},
-		...isString(json["tenantClaim"]) ? { tenantClaim: json["tenantClaim"] } : {},
-		claims: (Array.isArray(json["claims"]) ? json["claims"] : []).flatMap((claim) => isRecord(claim) && isString(claim["name"]) && isString(claim["source"]) ? [{
-			name: claim["name"],
-			source: claim["source"]
-		}] : []),
-		memberships: (Array.isArray(json["memberships"]) ? json["memberships"] : []).flatMap((entry) => {
-			const parsed = membership(entry);
-			return parsed ? [parsed] : [];
-		}),
-		...isRecord(rls) && isString(rls["schema"]) ? { rls: {
-			schema: rls["schema"],
-			mode: rls["mode"] === "jwt" ? "jwt" : "database",
-			...isString(rls["tenantClaim"]) ? { tenantClaim: rls["tenantClaim"] } : {},
-			scopes: (Array.isArray(rls["scopes"]) ? rls["scopes"] : []).flatMap((scope) => isRecord(scope) && isString(scope["name"]) ? [{
-				name: scope["name"],
-				...isString(scope["type"]) ? { type: scope["type"] } : {},
-				...isString(scope["within"]) ? { within: scope["within"] } : {}
-			}] : []),
-			helpers: (Array.isArray(rls["helpers"]) ? rls["helpers"] : []).flatMap((helper) => isRecord(helper) && isString(helper["name"]) && isString(helper["args"]) && isString(helper["returns"]) ? [{
-				name: helper["name"],
-				args: helper["args"],
-				returns: helper["returns"],
-				execute: strings(helper["execute"])
-			}] : []),
-			...Array.isArray(rls["memberships"]) ? { memberships: rls["memberships"].flatMap((entry) => {
-				const parsed = membership(entry);
-				return parsed ? [parsed] : [];
-			}) } : {}
-		} } : {},
-		decidingColumns: strings(json["decidingColumns"])
-	};
-}
-/**
-* The keys of a parsed `permissions.catalog.json`, each with its scope and
-* its `rowConditions` flag when it is a boolean. A non-boolean flag is
-* dropped, so `permdockKeyStatus` reads the key as unknown. Throws unless
-* the catalog is version 1.
-*/
-function parseCatalog(json) {
-	if (!isRecord(json) || !Array.isArray(json["permissions"])) throw new TypeError("has no permissions array");
-	if (json["version"] !== 1) throw new TypeError(`version ${String(json["version"])} is not supported (this release reads version 1)`);
-	return { permissions: json["permissions"].flatMap((permission) => {
-		if (!isRecord(permission) || !isString(permission["key"])) return [];
-		const flag = permission["rowConditions"];
-		const scope = permission["scope"];
-		return [{
-			key: permission["key"],
-			...typeof flag === "boolean" ? { rowConditions: flag } : {},
-			...isString(scope) ? { scope } : {}
-		}];
-	}) };
-}
-async function readJson(root, path) {
-	const absolute = resolve(root, path);
-	if (!existsSync(absolute)) return { missing: true };
-	try {
-		return { json: JSON.parse(await readFile(absolute, "utf8")) };
-	} catch (cause) {
-		return { problem: `${path}: ${cause instanceof Error ? cause.message : String(cause)}` };
-	}
-}
-/**
-* Reads PermDock's JSON outputs: the manifest `permdock supabase inspect
-* --out` writes and the catalog `permdock catalog` writes. Nothing is
-* imported from PermDock. Returns `undefined` when the project has neither a
-* PermDock config nor a manifest.
-*/
-async function readPermdock(root, paths) {
-	const config = permdockConfig(root);
-	const problems = [];
-	const manifestFile = await readJson(root, paths.manifest);
-	let manifest;
-	if ("json" in manifestFile) try {
-		manifest = parseManifest(manifestFile.json);
-	} catch (cause) {
-		problems.push(`${paths.manifest}: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	else if ("problem" in manifestFile) problems.push(manifestFile.problem);
-	if (!config && !manifest && "missing" in manifestFile) return void 0;
-	const catalogFile = await readJson(root, paths.catalog);
-	let catalog;
-	if ("json" in catalogFile) try {
-		catalog = parseCatalog(catalogFile.json);
-	} catch (cause) {
-		problems.push(`${paths.catalog}: ${cause instanceof Error ? cause.message : String(cause)}`);
-	}
-	else if ("problem" in catalogFile) problems.push(catalogFile.problem);
-	return {
-		...config ? { config } : {},
-		manifestPath: paths.manifest,
-		...manifest ? { manifest } : {},
-		catalogPath: paths.catalog,
-		...catalog ? { catalog } : {},
-		problems
-	};
-}
-/** How findings name the PermDock project: its config file or its manifest. */
-const permdockSource = (project) => project.config ?? project.manifestPath;
-const HOOK_MARKER = /^--\s*permdock:hook\s+v(\d+)([^\n]*)$/m;
-const GRANTS_MARKER = /^--\s*permdock:grants\s+v(\d+)([^\n]*)$/m;
-function markerFields(rest) {
-	const fields = /* @__PURE__ */ new Map();
-	for (const match of rest.matchAll(/(\w+)=(\S*)/g)) fields.set(match[1], match[2]);
-	return fields;
-}
-/** The `-- permdock:hook v1 schema=... tenant=... budget=... claims=...` line PermDock's hook file starts with. */
-function parseHookMarker(sql) {
-	const match = HOOK_MARKER.exec(sql);
-	if (!match) return void 0;
-	const fields = markerFields(match[2]);
-	const budget = Number(fields.get("budget"));
-	const schema = fields.get("schema");
-	const tenantClaim = fields.get("tenant");
-	return {
-		version: Number(match[1]),
-		...schema ? { schema } : {},
-		...tenantClaim ? { tenantClaim } : {},
-		...Number.isFinite(budget) && fields.has("budget") ? { budget } : {},
-		claims: (fields.get("claims") ?? "").split(",").filter(Boolean)
-	};
-}
-/** The `-- permdock:grants v1 schema=...` line of the migration `--grants-out` writes. */
-function parseGrantsMarker(sql) {
-	const match = GRANTS_MARKER.exec(sql);
-	if (!match) return void 0;
-	const schema = markerFields(match[2]).get("schema");
-	return {
-		version: Number(match[1]),
-		...schema ? { schema } : {}
-	};
-}
-/**
-* The PermDock scope tenants are: `explicit`, which must be one of the
-* manifest's `rls.scopes`, else the one scope without `within`. A missing or
-* unreadable manifest, no `rls` block, no root scope or several, and a scope
-* without a type this kit renders are invalid rather than a guess.
-*/
-function manifestScope(project, explicit, reader) {
-	const { subject, helpers, setting, optOut } = reader;
-	if (!project.manifest) {
-		const problem = project.problems.find((entry) => entry.startsWith(project.manifestPath));
-		return {
-			kind: "invalid",
-			problem: problem ? `Could not read PermDock's manifest: ${problem}. Run \`permdock supabase inspect --out\` with a current PermDock, ${optOut}` : `${permdockSource(project)} is a PermDock project, but there is no ${project.manifestPath}. Run \`permdock supabase inspect --out\`, ${optOut}`
-		};
-	}
-	const rls = project.manifest.rls;
-	if (!rls) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} has no rls block, so ${subject} can't find PermDock's ${helpers}. Run \`permdock rls generate\`, then \`permdock supabase inspect --out\`, ${optOut}`
-	};
-	const names = rls.scopes.map((scope) => scope.name).join(", ") || "none";
-	let scope;
-	if (explicit === void 0) {
-		const roots = rls.scopes.filter((entry) => entry.within === void 0);
-		if (roots.length !== 1) return {
-			kind: "invalid",
-			problem: `${project.manifestPath} has no single root scope (${roots.map((entry) => entry.name).join(", ") || "none"}), so ${subject} can't tell which scope tenants are. Set ${setting}: { scope } to one of ${names}.`
-		};
-		scope = roots[0].name;
-	} else {
-		scope = explicit;
-		if (!rls.scopes.some((entry) => entry.name === scope)) return {
-			kind: "invalid",
-			problem: `${setting}.scope is "${scope}", but ${project.manifestPath} has the scopes ${names}. Set ${setting}: { scope } to one of them, or remove it to use the root scope.`
-		};
-	}
-	const declared = rls.scopes.find((entry) => entry.name === scope)?.type;
-	if (declared === void 0) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" no type, so ${subject} can't tell its id type. Run \`permdock supabase inspect --out\` with a current PermDock.`
-	};
-	const idType = kitIdType(declared);
-	if (idType === void 0) return {
-		kind: "invalid",
-		problem: `${project.manifestPath} gives scope "${scope}" the type ${declared}, but ${subject} renders only ${KIT_ID_TYPES.join(", ").replace(/, (?=[^,]*$)/, " or ")} ids.`
-	};
-	return {
-		kind: "ok",
-		manifest: project.manifest,
-		rls,
-		scope,
-		idType
-	};
-}
-/**
-* The membership tables PermDock's `member_<scope>_ids_for` reads for
-* `scope`: the manifest's `rls.memberships` that can cover it (a scope
-* column, or a fixed scope equal to `scope`). A manifest from a PermDock
-* without `rls.memberships` falls back to the hook's sources.
-*/
-function scopeMemberships(manifest, scope) {
-	const rls = manifest.rls?.memberships;
-	return {
-		sources: (rls ?? manifest.memberships).filter((source) => !("value" in source.scope) || source.scope.value === scope),
-		from: rls === void 0 ? "hook" : "rls"
-	};
-}
-/**
-* PermDock mode, when the project uses PermDock and `entitlements.permdock`
-* is not `false`. The scope is `entitlements.permdock.scope`, which must be
-* one of the manifest's `rls.scopes`, else the one scope without `within`.
-* No root scope, or more than one, is invalid rather than a guess. A
-* PermDock project without a readable manifest or without its `rls` block
-* is invalid too, so the module never falls back to `tenant` on its own.
-* Memberships come from `rls.memberships`, the tables PermDock's helpers
-* read, and from the hook's sources only when the manifest has none.
-*/
-function entitlementsMode(config, project) {
-	const setting = config.entitlements.permdock;
-	if (setting === false || !project) return { kind: "tenant" };
-	const chosen = manifestScope(project, setting.scope, {
-		subject: "the entitlements module",
-		helpers: "membership helpers",
-		setting: "entitlements.permdock",
-		optOut: "or set entitlements.permdock: false to keep the tenant module's memberships."
-	});
-	if (chosen.kind === "invalid") return chosen;
-	return {
-		kind: "permdock",
-		permdock: {
-			schema: chosen.rls.schema,
-			scope: chosen.scope,
-			idType: chosen.idType,
-			memberships: scopeMemberships(chosen.manifest, chosen.scope).sources.map((source) => ({
-				table: source.table,
-				userColumn: source.user.column,
-				scope: source.scope,
-				idColumn: source.id.column
-			}))
-		}
-	};
-}
-/**
-* The `permdock` access model's helpers, read from the manifest whatever
-* `entitlements` says: `rls.schema`, the root scope (or
-* `kits.access.permdock.scope`, which the manifest must declare) and that
-* scope's id type. `off` when another model is chosen. Without a PermDock
-* project or a usable manifest the model is invalid, never a default.
-*/
-function accessPermdockMode(config, project) {
-	const access = config.kits.access;
-	if (access?.model !== "permdock") return { kind: "off" };
-	const optOut = "or choose another kits.access.model.";
-	if (!project) return {
-		kind: "invalid",
-		problem: `kits.access.model is "permdock", but there is no PermDock project here (no permdock.config.ts and no manifest). Run \`permdock supabase inspect --out\` to write the manifest, ${optOut}`
-	};
-	const chosen = manifestScope(project, access.permdock?.scope, {
-		subject: "the permdock access model",
-		helpers: "permission helpers",
-		setting: "kits.access.permdock",
-		optOut
-	});
-	if (chosen.kind === "invalid") return chosen;
-	const schema = access.permdock?.schema;
-	if (schema !== void 0 && schema !== chosen.rls.schema) return {
-		kind: "invalid",
-		problem: `kits.access.permdock.schema is "${schema}", but ${project.manifestPath} puts PermDock's helpers in "${chosen.rls.schema}". Set it to "${chosen.rls.schema}", or remove it to use the manifest's.`
-	};
-	const idType = access.idType === void 0 ? void 0 : kitIdType(access.idType);
-	if (idType !== void 0 && idType !== chosen.idType) return {
-		kind: "invalid",
-		problem: `kits.access.idType is "${access.idType}", but ${project.manifestPath} gives scope "${chosen.scope}" the type ${chosen.idType}. Set kits.access.idType to "${chosen.idType}", or remove it to use the manifest's.`
-	};
-	return {
-		kind: "permdock",
-		access: {
-			schema: chosen.rls.schema,
-			scope: chosen.scope,
-			idType: chosen.idType
-		}
-	};
-}
-const ROW_CONDITIONS_FIX = "Use the policies `permdock rls generate` writes for it, or a permission whose catalog entry has rowConditions: false.";
-const REGENERATE_FIX = "Regenerate it with a current `permdock catalog`, which writes rowConditions for every permission.";
-/**
-* Why the SQL helpers can't be trusted with `key`, or `undefined` when the
-* catalog marks it `rowConditions: false`. An entry without the flag and a
-* key the catalog doesn't list are unknown, so they count as unsafe.
-*/
-function unsafeKey(catalog, key, catalogPath) {
-	const status = permdockKeyStatus(catalog, key);
-	switch (status) {
-		case "scope-only": return;
-		case "row-conditions": return {
-			status,
-			reason: `has row conditions in ${catalogPath}`,
-			fix: ROW_CONDITIONS_FIX
-		};
-		case "no-flag": return {
-			status,
-			reason: `has no rowConditions flag in ${catalogPath}, so whether it has row conditions is unknown`,
-			fix: REGENERATE_FIX
-		};
-		case "missing": return {
-			status,
-			reason: `is not in ${catalogPath}`,
-			fix: REGENERATE_FIX
-		};
-		default: return status;
-	}
-}
-/**
-* Checks the keys the kit modules pass to PermDock's helpers against
-* `permissions.catalog.json`, with the statuses bucket policies use: only
-* `rowConditions: false` passes. A missing or unreadable catalog is a
-* problem too, since every key is then unknown.
-*/
-function kitKeyProblems(project, keys, access) {
-	if (keys.length === 0) return [];
-	const catalog = project.catalog;
-	if (!catalog) {
-		const unreadable = project.problems.find((problem) => problem.startsWith(project.catalogPath));
-		return [{
-			target: project.catalogPath,
-			message: unreadable ? `Could not read PermDock's catalog: ${unreadable}. The permdock access model passes ${keys.length} kit permission keys to PermDock's helpers, so whether they have row conditions is unknown. Run \`permdock catalog\` with a current PermDock.` : `The permdock access model passes ${keys.length} kit permission keys to PermDock's helpers, but there is no ${project.catalogPath}, so whether they have row conditions is unknown. Run \`permdock catalog\`, or set permdock.catalog in the config.`
-		}];
-	}
-	return keys.flatMap((entry) => {
-		const problem = unsafeKey(catalog, entry.key, project.catalogPath);
-		if (!problem) return [];
-		const helper = entry.scope === "platform" ? `${access.schema}.permdock_has` : `${access.schema}.permitted_${access.scope}_ids`;
-		const setting = `kits.${entry.module}.permissions.${entry.action}`;
-		const fix = problem.status === "row-conditions" ? `PermDock's SQL helpers check role and scope, not row conditions, so the module would grant it everywhere in the scope. Set ${setting} to a permission whose catalog entry has rowConditions: false.` : `${problem.fix} If PermDock doesn't define it, set ${setting} to a key the catalog lists.`;
-		return [{
-			target: setting,
-			message: `The ${entry.module} module checks "${entry.key}" (${entry.action}) with ${helper}, but it ${problem.reason}. ${fix}`
-		}];
-	});
-}
-/** A helper the `permdock` access model calls, as `schema.name`, and the role it runs as. */
-const accessRequirements = (access) => [{
-	helper: `${access.schema}.permitted_${access.scope}_ids`,
-	role: "authenticated"
-}, {
-	helper: `${access.schema}.permdock_has`,
-	role: "authenticated"
-}];
-/**
-* The helpers the `entitlements` module calls for the chosen scope:
-* `member_<scope>_ids` from `has_entitlement` as `authenticated`, and
-* `member_<scope>_ids_for` from `feature_claims`, which PermDock's hook runs
-* as `supabase_auth_admin`.
-*/
-const entitlementRequirements = (permdock) => [{
-	kind: "member",
-	helper: `${permdock.schema}.member_${permdock.scope}_ids`,
-	caller: "has_entitlement",
-	role: "authenticated"
-}, {
-	kind: "member-for",
-	helper: `${permdock.schema}.member_${permdock.scope}_ids_for`,
-	caller: "feature_claims",
-	role: "supabase_auth_admin"
-}];
-//#endregion
-//#region src/cli/read-sets.ts
-/** Every read set exported by the modules in `config.readSets`. */
-async function loadReadSets(config) {
-	const sets = [];
-	for (const entry of config.readSets) {
-		const loaded = await importModule(resolve(config.root, entry));
-		const found = Object.values(loaded).filter(isReadSet);
-		if (found.length === 0) throw new Error(`${entry} exports no read set (defineReadSet)`);
-		for (const set of found) if (!sets.includes(set)) sets.push(set);
-	}
-	return sets;
-}
-/** The compiled functions for `config.readSets`; empty when none are configured. */
-async function compiledReadSets(config) {
-	if (config.readSets.length === 0) return [];
-	return compileReadSets(await loadReadSets(config));
-}
-//#endregion
-export { entitlementsMode as a, parseHookMarker as c, scopeMemberships as d, unsafeKey as f, entitlementRequirements as i, permdockSource as l, accessPermdockMode as n, kitKeyProblems as o, accessRequirements as r, parseGrantsMarker as s, compiledReadSets as t, readPermdock as u };