forgeos 0.1.0-alpha.0

package/src/forge/compiler/data-graph/parse.ts

@@ -0,0 +1,176 @@
+import Parser from "tree-sitter";
+import TypeScript from "tree-sitter-typescript";
+import type { SyntaxNode } from "tree-sitter";
+import type { DataField } from "../types/data-graph.ts";
+
+const tsParser = new Parser();
+tsParser.setLanguage(TypeScript.typescript as unknown as Parser.Language);
+
+export interface ParsedDefineTable {
+  tableName: string | null;
+  fields: DataField[];
+}
+
+function unwrapStringLiteral(node: SyntaxNode): string | null {
+  if (node.type === "string") {
+    const text = node.text;
+    if (
+      (text.startsWith('"') && text.endsWith('"')) ||
+      (text.startsWith("'") && text.endsWith("'"))
+    ) {
+      return text.slice(1, -1);
+    }
+    return text;
+  }
+
+  if (node.type === "template_string") {
+    const fragments = node.namedChildren.filter(
+      (child) => child.type === "string_fragment",
+    );
+    if (fragments.length === 1 && node.namedChildren.length === 1) {
+      return fragments[0]?.text ?? null;
+    }
+    return null;
+  }
+
+  return null;
+}
+
+function extractFieldsFromObject(objectNode: SyntaxNode): DataField[] {
+  const fields: DataField[] = [];
+
+  for (const child of objectNode.namedChildren) {
+    if (child.type !== "pair") {
+      continue;
+    }
+
+    const keyNode = child.childForFieldName("key");
+    const valueNode = child.childForFieldName("value");
+    if (!keyNode || !valueNode) {
+      continue;
+    }
+
+    const key =
+      keyNode.type === "property_identifier" || keyNode.type === "identifier"
+        ? keyNode.text
+        : unwrapStringLiteral(keyNode);
+
+    if (!key || key === "name") {
+      continue;
+    }
+
+    if (key === "fields" && valueNode.type === "object") {
+      fields.push(...extractFieldsFromObject(valueNode));
+      continue;
+    }
+
+    const typeValue = unwrapStringLiteral(valueNode);
+    if (typeValue !== null) {
+      fields.push({ name: key, type: typeValue });
+    }
+  }
+
+  return fields.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+}
+
+function extractNameFromObject(objectNode: SyntaxNode): string | null {
+  for (const child of objectNode.namedChildren) {
+    if (child.type !== "pair") {
+      continue;
+    }
+
+    const keyNode = child.childForFieldName("key");
+    const valueNode = child.childForFieldName("value");
+    if (!keyNode || !valueNode) {
+      continue;
+    }
+
+    const key =
+      keyNode.type === "property_identifier" || keyNode.type === "identifier"
+        ? keyNode.text
+        : unwrapStringLiteral(keyNode);
+
+    if (key === "name") {
+      return unwrapStringLiteral(valueNode);
+    }
+  }
+
+  return null;
+}
+
+function parseCallArguments(callNode: SyntaxNode): ParsedDefineTable | null {
+  const argsNode = callNode.childForFieldName("arguments");
+  if (!argsNode) {
+    return { tableName: null, fields: [] };
+  }
+
+  const args = argsNode.namedChildren.filter(
+    (child) =>
+      child.type !== "," &&
+      child.type !== "comment" &&
+      child.type !== "(" &&
+      child.type !== ")",
+  );
+
+  if (args.length === 0) {
+    return { tableName: null, fields: [] };
+  }
+
+  const first = args[0];
+  if (!first) {
+    return { tableName: null, fields: [] };
+  }
+
+  if (first.type === "string" || first.type === "template_string") {
+    const tableName = unwrapStringLiteral(first);
+    const second = args[1];
+    const fields =
+      second?.type === "object" ? extractFieldsFromObject(second) : [];
+    return { tableName, fields };
+  }
+
+  if (first.type === "object") {
+    const tableName = extractNameFromObject(first);
+    const fields = extractFieldsFromObject(first);
+    return { tableName, fields };
+  }
+
+  return null;
+}
+
+function findDefineTableCall(root: SyntaxNode): SyntaxNode | null {
+  if (root.type === "call_expression") {
+    const functionNode = root.childForFieldName("function");
+    if (functionNode?.type === "identifier" && functionNode.text === "defineTable") {
+      return root;
+    }
+  }
+
+  for (const child of root.namedChildren) {
+    const found = findDefineTableCall(child);
+    if (found) {
+      return found;
+    }
+  }
+
+  return null;
+}
+
+/**
+ * Parse a defineTable call slice extracted by AppGraph.
+ */
+export function parseDefineTableSlice(sourceSlice: string): ParsedDefineTable | null {
+  const trimmed = sourceSlice.trim();
+  if (trimmed.length === 0) {
+    return null;
+  }
+
+  const wrapped = `(${trimmed})`;
+  const tree = tsParser.parse(wrapped);
+  const callNode = findDefineTableCall(tree.rootNode);
+  if (!callNode) {
+    return null;
+  }
+
+  return parseCallArguments(callNode);
+}

package/src/forge/compiler/data-graph/rls/build.ts

@@ -0,0 +1,222 @@
+import { createDiagnostic } from "../../diagnostics/create.ts";
+import {
+  FORGE_RLS_TENANT_FIELD_MISSING,
+  FORGE_RLS_UNSUPPORTED_TENANT_TYPE,
+} from "../../diagnostics/codes.ts";
+import type { SqlChange, SqlPlan } from "../sql/types.ts";
+import { quoteIdent } from "../sql/naming.ts";
+import type { TenantScope } from "../../types/policy-registry.ts";
+import type { Diagnostic } from "../../types/diagnostic.ts";
+import type {
+  DbSecurityManifest,
+  DbSessionContextArtifact,
+  RlsArtifacts,
+  RlsOperation,
+  RlsPolicy,
+  RlsTableSecurity,
+  RlsTenantType,
+} from "./types.ts";
+
+const OPERATIONS: RlsOperation[] = ["select", "insert", "update", "delete"];
+
+function tenantTypeFromSqlType(sqlType: string): RlsTenantType | null {
+  if (sqlType === "uuid") {
+    return "uuid";
+  }
+  if (sqlType === "text") {
+    return "text";
+  }
+  return null;
+}
+
+function findTable(plan: SqlPlan, tableName: string): SqlChange | undefined {
+  return plan.tables.find((change) => change.table === tableName);
+}
+
+function tenantExpression(tenantColumn: string, tenantType: RlsTenantType): string {
+  const right =
+    tenantType === "uuid" ? "forge.current_tenant_id()" : "forge.current_tenant_text()";
+  return `${quoteIdent(tenantColumn)} = ${right}`;
+}
+
+function policyName(table: string, operation: RlsOperation): string {
+  return `forge_${table}_${operation}`;
+}
+
+function buildPolicy(
+  table: string,
+  tenantColumn: string,
+  tenantType: RlsTenantType,
+  operation: RlsOperation,
+): RlsPolicy {
+  const expression = tenantExpression(tenantColumn, tenantType);
+  const base = {
+    table,
+    tenantColumn,
+    tenantType,
+    operation,
+    policyName: policyName(table, operation),
+  };
+
+  if (operation === "insert") {
+    return { ...base, withCheck: expression };
+  }
+  if (operation === "update") {
+    return { ...base, using: expression, withCheck: expression };
+  }
+  return { ...base, using: expression };
+}
+
+function renderPolicySql(table: string, policy: RlsPolicy): string {
+  const lines = [
+    `DROP POLICY IF EXISTS ${quoteIdent(policy.policyName)} ON ${quoteIdent(table)};`,
+    `CREATE POLICY ${quoteIdent(policy.policyName)}`,
+    `ON ${quoteIdent(table)}`,
+    `FOR ${policy.operation.toUpperCase()}`,
+  ];
+
+  if (policy.using) {
+    lines.push(`USING (${policy.using})`);
+  }
+  if (policy.withCheck) {
+    lines.push(`WITH CHECK (${policy.withCheck})`);
+  }
+
+  return `${lines.join("\n")};`;
+}
+
+function renderRlsSql(tables: RlsTableSecurity[]): string {
+  const header = `CREATE SCHEMA IF NOT EXISTS forge;
+
+CREATE OR REPLACE FUNCTION forge.current_tenant_id()
+RETURNS uuid
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT NULLIF(current_setting('forge.tenant_id', true), '')::uuid
+$$;
+
+CREATE OR REPLACE FUNCTION forge.current_tenant_text()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT NULLIF(current_setting('forge.tenant_id', true), '')
+$$;
+
+CREATE OR REPLACE FUNCTION forge.current_user_id()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT NULLIF(current_setting('forge.user_id', true), '')
+$$;
+
+CREATE OR REPLACE FUNCTION forge.current_role()
+RETURNS text
+LANGUAGE sql
+STABLE
+AS $$
+  SELECT NULLIF(current_setting('forge.role', true), '')
+$$;`;
+
+  const sections = tables.map((table) => {
+    const tableName = quoteIdent(table.table);
+    return [
+      `ALTER TABLE ${tableName} ENABLE ROW LEVEL SECURITY;`,
+      `ALTER TABLE ${tableName} FORCE ROW LEVEL SECURITY;`,
+      ...table.policies.map((policy) => renderPolicySql(table.table, policy)),
+    ].join("\n\n");
+  });
+
+  return [header, ...sections].join("\n\n").trimEnd().concat("\n");
+}
+
+function buildSessionContext(): DbSessionContextArtifact {
+  return {
+    schemaVersion: "0.1.0",
+    method: "set_config",
+    transactionScoped: true,
+    settings: [
+      { name: "forge.tenant_id", required: true, source: "ctx.auth", transactionScoped: true },
+      { name: "forge.user_id", required: false, source: "ctx.auth", transactionScoped: true },
+      { name: "forge.role", required: false, source: "ctx.auth", transactionScoped: true },
+      { name: "forge.roles", required: false, source: "ctx.auth", transactionScoped: true },
+      { name: "forge.permissions", required: false, source: "ctx.auth", transactionScoped: true },
+    ],
+    diagnostics: [],
+  };
+}
+
+export function buildRlsArtifacts(plan: SqlPlan, tenantScope: TenantScope): RlsArtifacts {
+  const diagnostics: Diagnostic[] = [];
+  const tables: RlsTableSecurity[] = [];
+
+  for (const scoped of [...tenantScope.tables].sort((a, b) => a.table.localeCompare(b.table))) {
+    const table = findTable(plan, scoped.table);
+    const column = table?.columns?.find(
+      (candidate) => candidate.name === scoped.tenantIdColumn,
+    );
+
+    if (!table || !column) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RLS_TENANT_FIELD_MISSING,
+          message: `tenant-scoped table '${scoped.table}' is missing tenant column '${scoped.tenantIdColumn}' in the SQL plan`,
+          file: scoped.file,
+        }),
+      );
+      continue;
+    }
+
+    const tenantType = tenantTypeFromSqlType(column.sqlType);
+    if (!tenantType) {
+      diagnostics.push(
+        createDiagnostic({
+          severity: "error",
+          code: FORGE_RLS_UNSUPPORTED_TENANT_TYPE,
+          message: `tenant column '${scoped.table}.${scoped.tenantIdColumn}' uses unsupported SQL type '${column.sqlType}' for RLS`,
+          file: scoped.file,
+        }),
+      );
+      continue;
+    }
+
+    tables.push({
+      table: scoped.table,
+      tenantColumn: scoped.tenantIdColumn,
+      tenantType,
+      rowLevelSecurityEnabled: true,
+      forceRowLevelSecurity: true,
+      policies: OPERATIONS.map((operation) =>
+        buildPolicy(scoped.table, scoped.tenantIdColumn, tenantType, operation),
+      ),
+    });
+  }
+
+  const sortedTables = tables.sort((a, b) => a.table.localeCompare(b.table));
+  const policies = {
+    schemaVersion: "0.1.0" as const,
+    tables: sortedTables,
+    sql: renderRlsSql(sortedTables),
+    diagnostics,
+  };
+  const dbSecurityManifest: DbSecurityManifest = {
+    schemaVersion: "0.1.0",
+    provider: "postgres",
+    tenantIsolation: "postgres-rls",
+    authoritativeAdapters: ["postgres"],
+    nonAuthoritativeAdapters: ["pglite", "memory"],
+    tables: sortedTables,
+    diagnostics,
+  };
+  const dbSessionContext = buildSessionContext();
+
+  return {
+    policies,
+    dbSecurityManifest,
+    dbSessionContext,
+    diagnostics,
+  };
+}

package/src/forge/compiler/data-graph/rls/types.ts

@@ -0,0 +1,62 @@
+import type { Diagnostic } from "../../types/diagnostic.ts";
+
+export type RlsTenantType = "uuid" | "text";
+export type RlsOperation = "select" | "insert" | "update" | "delete";
+
+export interface RlsPolicy {
+  table: string;
+  tenantColumn: string;
+  tenantType: RlsTenantType;
+  operation: RlsOperation;
+  policyName: string;
+  using?: string;
+  withCheck?: string;
+}
+
+export interface RlsTableSecurity {
+  table: string;
+  tenantColumn: string;
+  tenantType: RlsTenantType;
+  rowLevelSecurityEnabled: boolean;
+  forceRowLevelSecurity: boolean;
+  policies: RlsPolicy[];
+}
+
+export interface RlsPoliciesArtifact {
+  schemaVersion: "0.1.0";
+  tables: RlsTableSecurity[];
+  sql: string;
+  diagnostics: Diagnostic[];
+}
+
+export interface DbSecurityManifest {
+  schemaVersion: "0.1.0";
+  provider: "postgres";
+  tenantIsolation: "postgres-rls";
+  authoritativeAdapters: ["postgres"];
+  nonAuthoritativeAdapters: ["pglite", "memory"];
+  tables: RlsTableSecurity[];
+  diagnostics: Diagnostic[];
+}
+
+export interface DbSessionSetting {
+  name: string;
+  required: boolean;
+  source: "ctx.auth";
+  transactionScoped: true;
+}
+
+export interface DbSessionContextArtifact {
+  schemaVersion: "0.1.0";
+  method: "set_config";
+  transactionScoped: true;
+  settings: DbSessionSetting[];
+  diagnostics: Diagnostic[];
+}
+
+export interface RlsArtifacts {
+  policies: RlsPoliciesArtifact;
+  dbSecurityManifest: DbSecurityManifest;
+  dbSessionContext: DbSessionContextArtifact;
+  diagnostics: Diagnostic[];
+}