dzql 0.6.37 → 0.8.0

package/src/cli/codegen/sql/search.ts

@@ -1,19 +1,31 @@
-import { compilePermission } from "../../compiler/permissions.js";
+import { compileRuleList } from "../../compiler/permissions.js";
 import type { EntityIR, ManyToManyIR, ColumnInfo } from "./types.js";
-import { buildVisibleJsonb } from "./utils.js";
+import { buildVisibleJsonb, buildVisibleJsonbForEntity } from "./utils.js";
 
 // === SEARCH FUNCTION ===
-export function generateSearchFunction(name: string, entityIR: EntityIR): string {
+export function generateSearchFunction(name: string, entityIR: EntityIR, entities: Record<string, EntityIR> = {}): string {
   const pk = entityIR.primaryKey[0] || 'id';
   const softDelete = entityIR.softDelete || false;
   const hidden = entityIR.hidden || [];
   const temporal = entityIR.temporal;
 
-  // For dynamic SQL in EXECUTE, we need to use $1 instead of p_user_id
-  const viewPermRaw = entityIR.permissions?.view?.length > 0
-    ? entityIR.permissions.view.map((rule: string) => compilePermission(name, rule, null, name)).join(' OR ')
-    : 'TRUE';
-  const viewPerm = viewPermRaw.replace(/p_user_id/g, '$1');
+  // Allow-list of columns a client may filter or sort on: every real column
+  // except hidden ones. These names come from the domain at compile time, never
+  // from the request, so embedding them as SQL literals is safe. Fixes two leaks:
+  // (1) filtering/sorting on a hidden column (e.g. password_hash) as an oracle,
+  // (2) an unvalidated sort_order string being spliced into the ORDER BY.
+  const allowedCols = entityIR.columns
+    .map((c: ColumnInfo) => c.name)
+    .filter((n: string) => !hidden.includes(n));
+  const allowedColsSql = `ARRAY[${allowedCols.map(n => `'${n}'`).join(', ')}]::text[]`;
+
+  // The view rule is spliced into a format() string run by EXECUTE: p_user_id
+  // becomes the $1 bind, quotes are doubled for the string literal, and % is
+  // escaped for format(). An empty view list denies everyone.
+  const viewPerm = compileRuleList(name, entityIR.permissions?.view, name)
+    .replace(/\bp_user_id\b/g, '$1')
+    .replace(/'/g, "''")
+    .replace(/%/g, '%%');
 
   // Soft delete filter
   const softDeleteFilter = softDelete ? ' AND deleted_at IS NULL' : '';
@@ -37,9 +49,12 @@ export function generateSearchFunction(name: string, entityIR: EntityIR): string
       ) m2m_${config.idField} ON true`;
 
     if (config.expand) {
+      // Project the expanded target through its visible columns (single quotes
+      // doubled because this becomes part of a dynamic-SQL format string).
+      const targetSelect = buildVisibleJsonbForEntity('target', entities[config.targetEntity]).replace(/'/g, "''");
       sql += `
       LEFT JOIN LATERAL (
-        SELECT COALESCE(jsonb_agg(to_jsonb(target.*) ORDER BY target.id), ''[]''::jsonb) as ${key}
+        SELECT COALESCE(jsonb_agg(${targetSelect} ORDER BY target.id), ''[]''::jsonb) as ${key}
         FROM ${config.junctionTable} jt
         JOIN ${config.targetEntity} target ON target.id = jt.${config.foreignKey}
         WHERE jt.${config.localKey} = t.${pk}
@@ -80,17 +95,36 @@ DECLARE
   v_filter jsonb;
   v_operator text;
   v_value jsonb;
+  v_allowed_cols text[] := ${allowedColsSql};
 BEGIN
   -- Extract query parameters
   v_filters := COALESCE(p_query->'filters', '{}'::jsonb);
   v_sort_field := COALESCE(p_query->>'sort_field', '${labelField}');
-  v_sort_order := COALESCE(p_query->>'sort_order', 'asc');
+  v_sort_order := lower(COALESCE(p_query->>'sort_order', 'asc'));
+
+  -- Validate sort against the compile-time allow-list. sort_order reaches the
+  -- ORDER BY via %s, so it must be exactly asc/desc; sort_field must be a real,
+  -- non-hidden column. Fail closed rather than splice an untrusted string.
+  IF v_sort_order NOT IN ('asc', 'desc') THEN
+    RAISE EXCEPTION 'dzql: invalid sort_order %', v_sort_order
+      USING ERRCODE = '22023';
+  END IF;
+  IF NOT (v_sort_field = ANY(v_allowed_cols)) THEN
+    RAISE EXCEPTION 'dzql: invalid sort_field %', v_sort_field
+      USING ERRCODE = '22023';
+  END IF;
 
   -- Build WHERE clause from filters
   -- Note: We avoid ::TEXT casts to preserve index usage on numeric/date columns
   -- The %L format specifier handles proper escaping for all types
   FOR v_field, v_filter IN SELECT * FROM jsonb_each(v_filters)
   LOOP
+    -- Reject filters on columns that are not in the visible allow-list, so a
+    -- hidden column (e.g. password_hash) can never be probed via filter result.
+    IF NOT (v_field = ANY(v_allowed_cols)) THEN
+      RAISE EXCEPTION 'dzql: invalid filter field %', v_field
+        USING ERRCODE = '22023';
+    END IF;
     -- Handle simple value (exact match)
     IF jsonb_typeof(v_filter) = 'number' THEN
       -- Numeric: compare without casting

package/src/cli/codegen/sql/utils.ts

@@ -1,4 +1,4 @@
-import type { ColumnInfo } from "./types.js";
+import type { ColumnInfo, EntityIR } from "./types.js";
 
 /**
  * Generate a jsonb_build_object expression that excludes hidden fields.
@@ -17,6 +17,21 @@ export function buildVisibleJsonb(alias: string, columns: ColumnInfo[], hidden:
   return `jsonb_build_object(${pairs})`;
 }
 
+/**
+ * Project a RELATED entity (FK/M2M expansion target) through its own visible
+ * columns, so a related object never leaks the target's hidden fields (e.g. a
+ * post's `author` must not expose users.password_hash). Falls back to
+ * to_jsonb(alias.*) only when the target entity is unknown to the generator.
+ * @param alias - Table alias the related row is selected under (e.g. 't', 'target')
+ * @param targetEntity - IR of the related entity, if available
+ */
+export function buildVisibleJsonbForEntity(alias: string, targetEntity?: EntityIR): string {
+  if (!targetEntity) {
+    return `to_jsonb(${alias}.*)`;
+  }
+  return buildVisibleJsonb(alias, targetEntity.columns, targetEntity.hidden || []);
+}
+
 /**
  * Get the SQL cast for a column type
  */

package/src/cli/codegen/subscribable_sql.ts

@@ -9,7 +9,8 @@
  */
 
 import type { SubscribableIR, IncludeIR, EntityIR } from "../../shared/ir.js";
-import { parsePath } from "../compiler/paths.js";
+import { parsePath, PathCompileError } from "../compiler/paths.js";
+import { compileRuleList } from "../compiler/permissions.js";
 
 export function generateSubscribableSQL(name: string, sub: SubscribableIR, entities: Record<string, EntityIR> = {}): string {
   // Validate: if root.key is set, it must exist in params or start with '@'
@@ -28,6 +29,7 @@ export function generateSubscribableSQL(name: string, sub: SubscribableIR, entit
   sections.push(generateHeader(name, sub));
   sections.push(generateCanSubscribeFunction(name, sub));
   sections.push(generateGetFunction(name, sub, entities));
+  sections.push(generateCanReceiveFunction(name, sub, entities));
   sections.push(generateAffectedKeysFunction(name, sub));
 
   return sections.join('\n\n');
@@ -43,13 +45,11 @@ function generateHeader(name: string, sub: SubscribableIR): string {
 }
 
 function generateCanSubscribeFunction(name: string, sub: SubscribableIR): string {
-  const subscribePaths = sub.canSubscribe || [];
+  const rules = sub.canSubscribe || [];
   const rootKey = sub.root.key;
   const isList = !rootKey; // No key means it's a list subscribable
 
-  // If no paths, it's public
-  if (subscribePaths.length === 0) {
-    return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
+  const header = `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
   p_user_id INT,
   p_params JSONB
 ) RETURNS BOOLEAN
@@ -57,45 +57,40 @@ LANGUAGE plpgsql
 STABLE
 SECURITY DEFINER
 SET search_path = dzql_v2, public
-AS $$
+AS $$`;
+
+  // No rules: nobody may subscribe. Use TRUE for public, AUTHENTICATED for any signed-in user.
+  if (rules.length === 0) {
+    return `${header}
 BEGIN
-  RETURN TRUE; -- Public access
+  RETURN FALSE; -- canSubscribe is empty: nobody may subscribe
 END;
 $$;`;
   }
 
-  // List subscribables with permission paths: check authentication only
-  // (Row-level filtering happens in the query, not the permission check)
+  // A list subscribable has no root row for a path to start from, so only
+  // literal rules (TRUE, FALSE, AUTHENTICATED) can be enforced. Anything else is
+  // a build error rather than a silent fallback.
   if (isList) {
-    return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
-  p_user_id INT,
-  p_params JSONB
-) RETURNS BOOLEAN
-LANGUAGE plpgsql
-STABLE
-SECURITY DEFINER
-SET search_path = dzql_v2, public
-AS $$
+    for (const rule of rules) {
+      if (!parsePath(rule).literal) {
+        throw new PathCompileError(
+          `${name}.canSubscribe: a list subscribable has no root row to follow a path from; use TRUE, FALSE or AUTHENTICATED`,
+          rule
+        );
+      }
+    }
+    return `${header}
 BEGIN
-  -- List subscribable: user must be authenticated
-  -- Row-level access is filtered in the get function
-  RETURN p_user_id IS NOT NULL;
+  RETURN (${compileRuleList(name, rules)});
 END;
 $$;`;
   }
 
-  // Single-entity subscribable: check permissions against specific root entity
-  // Generate permission checks using RECORD dot notation
-  // Pass the root key so we can map param references to root entity's id
-  const compiledChecks = subscribePaths.map(path =>
-    compileSubscribePermission(sub.root.entity, path, rootKey)
-  );
-
-  // If all checks compile to FALSE (unsupported paths), fall back to authenticated users
-  const allFalse = compiledChecks.every(c => c === 'FALSE');
-  const checks = allFalse
-    ? 'p_user_id IS NOT NULL -- Fallback: multi-level paths not yet supported'
-    : compiledChecks.join(' OR\n    ');
+  // Single-entity subscribable: rules are checked against the root row (v_root).
+  // A rule's reference to the key param means the root's id.
+  const fieldMap: Record<string, string> = rootKey.startsWith('@') ? {} : { [rootKey]: 'id' };
+  const checks = compileRuleList(name, rules, { kind: 'row', name: 'v_root', fieldMap });
 
   // Extract params
   const paramNames = Object.keys(sub.params);
@@ -109,15 +104,7 @@ $$;`;
     ? `p_${rootKey.slice(1)}`  // @user_id -> p_user_id
     : `v_${rootKey}`;          // venue_id -> v_venue_id
 
-  return `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_subscribe(
-  p_user_id INT,
-  p_params JSONB
-) RETURNS BOOLEAN
-LANGUAGE plpgsql
-STABLE
-SECURITY DEFINER
-SET search_path = dzql_v2, public
-AS $$
+  return `${header}
 DECLARE
 ${paramDecls}
   v_root RECORD;
@@ -143,94 +130,91 @@ $$;`;
 }
 
 /**
- * Compile permission for subscribable can_subscribe function.
- * Uses RECORD dot notation since v_root is a RECORD, not JSONB.
- * Supports unlimited traversal depth using the shared path parser.
+ * <name>_can_receive(p_user_id, p_params, p_table, p_op, p_data): may this
+ * subscriber be pushed this change? The runtime calls it before every push.
+ * Returns 'row' (send the change), 'pk' (send only its key: a delete), or
+ * NULL (send nothing).
  *
- * @param entityName - The root entity name
- * @param rule - The permission rule (e.g., "@org_id->acts_for[org_id=$]{active}.user_id")
- * @param rootKey - The param key used to look up the root entity (e.g., "org_id")
- *                  When @field matches rootKey, it maps to v_root.id (the root entity's PK)
+ * - Nobody who fails can_subscribe receives anything.
+ * - A single-document subscription: canSubscribe is the whole gate.
+ * - A list: canSubscribe can only be a literal, so rows are filtered here, the
+ *   same way the list query filters them. A root row needs the root's view
+ *   rules; an included row must appear in one of the subscriber's documents.
+ *   An included row that was deleted is in no document any more, so its
+ *   delete goes to every subscriber as its key alone, which is all a client
+ *   uses to remove it.
  */
-function compileSubscribePermission(entityName: string, rule: string, rootKey: string = ''): string {
-  // Helper to resolve field reference - if field matches rootKey param, use 'id' instead
-  const resolveField = (field: string): string => {
-    return field === rootKey ? 'id' : field;
-  };
-
-  // Parse the path using the shared parser
-  const parsed = parsePath(rule);
-
-  if (!parsed.isValid) {
-    console.warn(`[Compiler] Warning: Invalid permission path '${rule}': ${parsed.error}`);
-    return 'FALSE';
-  }
-
-  // TRUE/FALSE literals
-  if (parsed.hops.length === 0) {
-    return rule === 'TRUE' || rule === 'true' ? 'TRUE' : 'FALSE';
-  }
-
-  // Simple field reference: @org_id implies checking acts_for membership
-  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
-    const field = parsed.hops[0].field!;
-    const rootField = resolveField(field);
-    return `EXISTS (SELECT 1 FROM acts_for WHERE acts_for.${field} = v_root.${rootField} AND acts_for.user_id = p_user_id AND acts_for.active)`;
-  }
-
-  // Traversal path - build EXISTS with nested subqueries for unlimited hops
-  // Start with the field from v_root
-  const startField = parsed.startField!;
-  const rootField = resolveField(startField);
-
-  // Build value expression starting from v_root
-  let valueExpr = `v_root.${rootField}`;
-
-  // Process intermediate hops (all but first field and last final)
-  for (let i = 1; i < parsed.hops.length - 1; i++) {
-    const hop = parsed.hops[i];
-    if (hop.type === 'table' && hop.table && hop.outputField) {
-      valueExpr = `(SELECT ${hop.outputField} FROM ${hop.table} WHERE id = ${valueExpr})`;
-    }
-  }
-
-  // Final hop - build EXISTS check
-  const finalHop = parsed.hops[parsed.hops.length - 1];
-  if (finalHop.type !== 'final' || !finalHop.table) {
-    return 'FALSE';
-  }
-
-  const conditions: string[] = [];
+function generateCanReceiveFunction(name: string, sub: SubscribableIR, entities: Record<string, EntityIR>): string {
+  const isList = !sub.root.key;
+  const header = `CREATE OR REPLACE FUNCTION dzql_v2.${name}_can_receive(
+  p_user_id INT,
+  p_params JSONB,
+  p_table TEXT,
+  p_op TEXT,
+  p_data JSONB
+) RETURNS TEXT
+LANGUAGE plpgsql
+STABLE
+SECURITY DEFINER
+SET search_path = dzql_v2, public
+AS $$
+BEGIN
+  IF NOT dzql_v2.${name}_can_subscribe(p_user_id, p_params) THEN
+    RETURN NULL;
+  END IF;
+`;
+  const kind = `CASE WHEN p_op = 'delete' THEN 'pk' ELSE 'row' END`;
 
-  // Join condition
-  if (finalHop.filter && finalHop.filter.value === '$') {
-    conditions.push(`${finalHop.table}.${finalHop.filter.field} = ${valueExpr}`);
-  } else {
-    conditions.push(`${finalHop.table}.id = ${valueExpr}`);
+  if (!isList) {
+    return `${header}
+  RETURN ${kind};
+END;
+$$;`;
   }
 
-  // User check
-  if (finalHop.outputField === 'user_id') {
-    conditions.push(`${finalHop.table}.user_id = p_user_id`);
-  } else if (finalHop.outputField) {
-    conditions.push(`${finalHop.table}.${finalHop.outputField} = p_user_id`);
-  }
+  const root = sub.root.entity;
+  const viewRules = compileRuleList(root, entities[root]?.permissions?.view, { kind: 'jsonb', name: 'p_data' });
 
-  // Additional conditions from {active} or {role=admin}
-  for (const cond of finalHop.conditions || []) {
-    if (cond.type === 'boolean') {
-      conditions.push(`${finalHop.table}.${cond.field} = true`);
-    } else if (cond.type === 'equality') {
-      if (cond.value === 'NULL') {
-        conditions.push(`${finalHop.table}.${cond.field} IS NULL`);
-      } else {
-        const value = cond.value!.match(/^\d+$/) ? cond.value : `'${cond.value}'`;
-        conditions.push(`${finalHop.table}.${cond.field} = ${value}`);
-      }
+  // Where each included table sits in a list document: root columns || { rel: ... }
+  const pathsByTable: Record<string, string[]> = {};
+  const collect = (incl: Record<string, IncludeIR>, prefix: string) => {
+    for (const [rel, cfg] of Object.entries(incl || {})) {
+      const path = `${prefix}."${rel}"`;
+      (pathsByTable[cfg.entity] ??= []).push(path);
+      if (cfg.includes) collect(cfg.includes, path);
     }
-  }
+  };
+  collect(sub.includes, '$');
+  delete pathsByTable[root];
+
+  const includeCases = Object.entries(pathsByTable).map(([table, paths]) => {
+    const shown = paths
+      .map(path => `jsonb_path_exists(d, '${path} ? (@.id == $id)', jsonb_build_object('id', p_data->'id'))`)
+      .join(' OR ');
+    return `  IF p_table = '${table}' THEN
+    IF p_op = 'delete' THEN
+      RETURN 'pk';
+    END IF;
+    IF EXISTS (SELECT 1 FROM dzql_v2.get_${name}(p_params, p_user_id) d WHERE ${shown}) THEN
+      RETURN 'row';
+    END IF;
+    RETURN NULL;
+  END IF;
+`;
+  }).join('\n');
+
+  return `${header}
+  IF p_table = '${root}' THEN
+    IF ${viewRules} THEN
+      RETURN ${kind};
+    END IF;
+    RETURN NULL;
+  END IF;
 
-  return `EXISTS (SELECT 1 FROM ${finalHop.table} WHERE ${conditions.join(' AND ')})`;
+${includeCases}
+  RETURN NULL;
+END;
+$$;`;
 }
 
 /** Column info from EntityIR */
@@ -307,6 +291,13 @@ function generateGetFunction(name: string, sub: SubscribableIR, entities: Record
       }
     }
   }
+  if (isList) {
+    // canSubscribe on a list can only be a literal, so it can't tell rows apart.
+    // Return just the rows the subscriber may view: the root's view rules,
+    // checked against each root row ([] shows nobody any row).
+    const viewRules = entities[sub.root.entity]?.permissions?.view;
+    whereConditions.push(`(${compileRuleList(sub.root.entity, viewRules, { kind: 'row', name: 'root' })})`);
+  }
   const whereClause = whereConditions.length > 0
     ? `WHERE ${whereConditions.join(' AND ')}`
     : '';
@@ -334,9 +325,10 @@ ${paramExtracts}
     RAISE EXCEPTION 'permission_denied';
   END IF;
 
-  -- Return stream of documents
+  -- Return stream of documents (root projected to visible columns; ::jsonb so
+  -- the || merge works even when the projection is row_to_json)
   RETURN QUERY
-  SELECT to_jsonb(root.*) || jsonb_build_object(${relationSelects ? relationSelects.slice(1) : ''})
+  SELECT (${rootSelectExpr})::jsonb || jsonb_build_object(${relationSelects ? relationSelects.slice(1) : ''})
   FROM ${sub.root.entity} root
   ${whereClause};
 END;