gencow 0.1.80 → 0.1.82

package/bin/gencow.mjs

@@ -2,16 +2,14 @@
 /**
  * @gencow/cli — Gencow CLI
  *
- * Like `npx convex dev` but for Gencow projects.
- *
  * Commands:
  *   gencow dev         — push schema → start server with hot-reload
- *   gencow db:push     — push schema.ts changes to DB (Convex-like, no migration files)
+ *   gencow db:push     — push schema.ts changes to DB (instant, no migration files)
  *   gencow db:generate — generate SQL migration files from schema.ts
  *   gencow db:migrate  — apply pending migrations
  *   gencow db:reset    — backup + reset DB (safe reset)
  *   gencow db:restore  — restore DB from backup
- *   gencow db:studio   — open Drizzle Studio (like Convex dashboard)
+ *   gencow db:studio   — open Drizzle Studio (visual DB browser)
  *   gencow dashboard   — open /_admin in browser
  *   gencow backup      — manage database backups (list/create/restore/delete/download)
  *   gencow help        — show this help
@@ -1351,7 +1349,7 @@ ${hasPrompt ? `
     async "db:studio"() {
             const config = loadConfig();
             log(`\n${BOLD}${CYAN}Gencow DB Studio${RESET}\n`);
-            info("Opening Drizzle Studio (Convex Dashboard equivalent)...");
+            info("Opening Drizzle Studio...");
             runInServer("pnpm db:studio", buildEnv(config));
         },
 
@@ -1739,12 +1737,14 @@ ${BOLD}Examples:${RESET}
             }
 
             // 1-0. Pre-deploy dependency audit (informational — user deps auto-installed)
+            // + Phase B: filter package.json to backend-only deps
+            let auditResult = null;
             if (!forceDeploy) {
                 try {
                     const { auditDeployDependencies, formatAuditError } = await import("../lib/deploy-auditor.mjs");
                     const entryPoint = resolve(process.cwd(), "gencow", "index.ts");
                     if (existsSync(entryPoint)) {
-                        const auditResult = await auditDeployDependencies(entryPoint);
+                        auditResult = await auditDeployDependencies(entryPoint);
                         const auditMsg = formatAuditError(auditResult);
                         if (auditMsg) log(auditMsg);
                     }
@@ -1753,13 +1753,61 @@ ${BOLD}Examples:${RESET}
                 }
             }
 
+            // Generate filtered package.json with only backend runtime deps
+            let useFilteredPkg = false;
+            const filteredPkgPath = resolve(process.cwd(), ".gencow", "deploy-package.json");
+            if (auditResult?.runtimeDeps?.length >= 0) {
+                try {
+                    const projectPkg = JSON.parse(readFileSync(resolve(process.cwd(), "package.json"), "utf8"));
+                    const allDeps = { ...projectPkg.dependencies, ...projectPkg.devDependencies };
+                    const runtimeDeps = {};
+                    for (const dep of auditResult.runtimeDeps) {
+                        if (allDeps[dep]) runtimeDeps[dep] = allDeps[dep];
+                    }
+                    const filteredPkg = { name: projectPkg.name || "gencow-app", dependencies: runtimeDeps };
+                    writeFileSync(filteredPkgPath, JSON.stringify(filteredPkg, null, 2));
+                    useFilteredPkg = true;
+
+                    const totalDeps = Object.keys(allDeps).length;
+                    const runtimeCount = Object.keys(runtimeDeps).length;
+                    if (totalDeps > runtimeCount) {
+                        info(`${DIM}package.json 필터링: ${runtimeCount}/${totalDeps} 패키지만 서버에 설치됩니다.${RESET}`);
+                    }
+                } catch {
+                    // Fallback: use original package.json
+                    useFilteredPkg = false;
+                }
+            }
+
             try {
-                exec(`tar -czf "${tmpBundle}" ${filesToPack.join(" ")}`, { cwd: process.cwd() });
+                if (useFilteredPkg) {
+                    // macOS-safe: stage files in temp dir with filtered package.json
+                    const otherFiles = filesToPack.filter(f => f !== "package.json");
+                    const tmpDir = resolve(process.cwd(), ".gencow", "deploy-staging");
+                    mkdirSync(tmpDir, { recursive: true });
+                    writeFileSync(resolve(tmpDir, "package.json"), readFileSync(filteredPkgPath, "utf8"));
+                    for (const f of otherFiles) {
+                        const src = resolve(process.cwd(), f);
+                        const dst = resolve(tmpDir, f);
+                        if (f.endsWith("/")) {
+                            exec(`cp -r "${src}" "${dst}"`, { cwd: process.cwd() });
+                        } else if (existsSync(src)) {
+                            exec(`cp "${src}" "${dst}"`, { cwd: process.cwd() });
+                        }
+                    }
+                    exec(`tar -czf "${tmpBundle}" .`, { cwd: tmpDir });
+                    exec(`rm -rf "${tmpDir}"`, { cwd: process.cwd() });
+                } else {
+                    exec(`tar -czf "${tmpBundle}" ${filesToPack.join(" ")}`, { cwd: process.cwd() });
+                }
             } catch (e) {
                 error(`패키징 실패: ${e.message}`);
                 process.exit(1);
             }
 
+            // Clean up temp filtered package.json
+            try { if (useFilteredPkg) unlinkSync(filteredPkgPath); } catch {}
+
             const bundleSize = statSync(tmpBundle).size;
             success(`번들 생성: ${(bundleSize / 1024).toFixed(1)} KB`);
 
@@ -2011,13 +2059,14 @@ ${BOLD}Examples:${RESET}
             if (shouldDeployBackend) {
                 log(`  ${BOLD}── 백엔드 배포 ──────────────────────${RESET}\n`);
 
-                // 1-0. Pre-deploy dependency audit (informational — user deps auto-installed)
+                // 1-0. Pre-deploy dependency audit + Phase B: filter package.json
+                let auditResult = null;
                 if (!forceDeploy) {
                     try {
                         const { auditDeployDependencies, formatAuditError } = await import("../lib/deploy-auditor.mjs");
                         const entryPoint = resolve(backendRoot, "gencow", "index.ts");
                         if (existsSync(entryPoint)) {
-                            const auditResult = await auditDeployDependencies(entryPoint);
+                            auditResult = await auditDeployDependencies(entryPoint);
                             const auditMsg = formatAuditError(auditResult);
                             if (auditMsg) log(auditMsg);
                         }
@@ -2037,12 +2086,57 @@ ${BOLD}Examples:${RESET}
                 if (existsSync(resolve(backendRoot, "package-lock.json"))) backendFiles.push("package-lock.json");
                 if (existsSync(resolve(backendRoot, "tsconfig.json"))) backendFiles.push("tsconfig.json");
 
+                // Generate filtered package.json with only backend runtime deps
+                let useFilteredPkg = false;
+                const filteredPkgPath = resolve(backendRoot, ".gencow", "deploy-package.json");
+                if (auditResult?.runtimeDeps?.length >= 0) {
+                    try {
+                        const projectPkg = JSON.parse(readFileSync(resolve(backendRoot, "package.json"), "utf8"));
+                        const allDeps = { ...projectPkg.dependencies, ...projectPkg.devDependencies };
+                        const runtimeDeps = {};
+                        for (const dep of auditResult.runtimeDeps) {
+                            if (allDeps[dep]) runtimeDeps[dep] = allDeps[dep];
+                        }
+                        const filteredPkg = { name: projectPkg.name || "gencow-app", dependencies: runtimeDeps };
+                        writeFileSync(filteredPkgPath, JSON.stringify(filteredPkg, null, 2));
+                        useFilteredPkg = true;
+
+                        const totalDeps = Object.keys(allDeps).length;
+                        const runtimeCount = Object.keys(runtimeDeps).length;
+                        if (totalDeps > runtimeCount) {
+                            info(`${DIM}package.json 필터링: ${runtimeCount}/${totalDeps} 패키지만 서버에 설치됩니다.${RESET}`);
+                        }
+                    } catch {
+                        useFilteredPkg = false;
+                    }
+                }
+
                 try {
-                    exec(`tar -czf "${tmpBackendBundle}" ${backendFiles.join(" ")}`, { cwd: backendRoot });
+                    if (useFilteredPkg) {
+                        const otherFiles = backendFiles.filter(f => f !== "package.json");
+                        // macOS-safe: stage files in temp dir
+                        const tmpDir = resolve(backendRoot, ".gencow", "deploy-staging");
+                        mkdirSync(tmpDir, { recursive: true });
+                        writeFileSync(resolve(tmpDir, "package.json"), readFileSync(filteredPkgPath, "utf8"));
+                        for (const f of otherFiles) {
+                            const src = resolve(backendRoot, f);
+                            const dst = resolve(tmpDir, f);
+                            if (f.endsWith("/")) {
+                                exec(`cp -r "${src}" "${dst}"`, { cwd: backendRoot });
+                            } else if (existsSync(src)) {
+                                exec(`cp "${src}" "${dst}"`, { cwd: backendRoot });
+                            }
+                        }
+                        exec(`tar -czf "${tmpBackendBundle}" .`, { cwd: tmpDir });
+                        exec(`rm -rf "${tmpDir}"`, { cwd: backendRoot });
+                    } else {
+                        exec(`tar -czf "${tmpBackendBundle}" ${backendFiles.join(" ")}`, { cwd: backendRoot });
+                    }
                 } catch (e) {
                     error(`백엔드 패키징 실패: ${e.message}`);
                     process.exit(1);
                 }
+                try { if (useFilteredPkg) unlinkSync(filteredPkgPath); } catch {}
 
                 const backendBundleSize = statSync(tmpBackendBundle).size;
                 success(`백엔드 번들 생성: ${(backendBundleSize / 1024).toFixed(1)} KB`);
@@ -2837,7 +2931,7 @@ process.exit(0);
                 // Save current app to creds
                 saveCreds({ ...creds, currentApp: name });
 
-                // ── Scaffold local project files (Convex-like) ──────────
+                // ── Scaffold local project files ────────────────────
                 const cwd = process.cwd();
                 const config = loadConfig();
 

package/core/index.js

@@ -1822,23 +1822,348 @@ function intervalToPattern(options) {
 function defineAuth(config) {
   return config;
 }
+
+// ../core/src/table.ts
+import { pgTable } from "drizzle-orm/pg-core";
+import { eq } from "drizzle-orm";
+function isOwnerFilter(opts) {
+  return "_ownerColumn" in opts;
+}
+if (!globalThis.__gencow_tableAccessRegistry) {
+  globalThis.__gencow_tableAccessRegistry = /* @__PURE__ */ new Map();
+}
+var tableAccessRegistry = globalThis.__gencow_tableAccessRegistry;
+function gencowTable(name, columns, options) {
+  if (!options || typeof options.filter !== "function" && !isOwnerFilter(options)) {
+    throw new Error(
+      `[gencow] gencowTable("${name}") requires a filter option. Use ownerFilter("userId") for simple user isolation, or { filter: () => true } for public tables.`
+    );
+  }
+  const table = pgTable(name, columns);
+  let filter;
+  if (isOwnerFilter(options)) {
+    const columnName = options._ownerColumn;
+    const col = table[columnName];
+    if (!col) {
+      throw new Error(
+        `[gencow] ownerFilter("${columnName}"): column "${columnName}" not found on table "${name}". Available columns: ${Object.keys(table).filter((k) => !k.startsWith("_") && !k.startsWith("$")).join(", ")}`
+      );
+    }
+    filter = (ctx) => {
+      const user = ctx.auth.requireAuth();
+      return eq(col, user.id);
+    };
+  } else {
+    filter = options.filter;
+  }
+  tableAccessRegistry.set(table, {
+    filter,
+    fieldAccess: options.fieldAccess,
+    tableName: name
+  });
+  return table;
+}
+function ownerFilter(columnName = "userId") {
+  return {
+    _ownerColumn: columnName,
+    // Placeholder filter — replaced by gencowTable()
+    filter: () => {
+      throw new Error("[gencow] ownerFilter placeholder should not be called directly");
+    }
+  };
+}
+function getTableAccessMeta(table) {
+  return tableAccessRegistry.get(table);
+}
+function isGencowTable(table) {
+  return tableAccessRegistry.has(table);
+}
+function getAllGencowTables() {
+  return new Map(tableAccessRegistry);
+}
+
+// ../core/src/scoped-db.ts
+import { and } from "drizzle-orm";
+function createScopedDb(db, ctx) {
+  return new Proxy(db, {
+    get(target, prop) {
+      const propStr = typeof prop === "string" ? prop : "";
+      if (propStr === "execute") {
+        return () => {
+          throw new Error(
+            "[gencow] ctx.db.execute() is not allowed. Use ctx.db.select().from(table) for type-safe queries with automatic access control. If you need raw SQL, use ctx.unsafeDb.execute()."
+          );
+        };
+      }
+      if (propStr === "$client" || propStr === "_") {
+        throw new Error(
+          `[gencow] ctx.db.${propStr} is not allowed. Direct database client access bypasses access control. Use ctx.unsafeDb if you need direct access.`
+        );
+      }
+      if (propStr === "select") {
+        return (...selectArgs) => {
+          const selectResult = target.select(...selectArgs);
+          return wrapSelectChain(selectResult, ctx);
+        };
+      }
+      if (propStr === "update") {
+        return (table) => {
+          const updateResult = target.update(table);
+          return wrapWriteChain(updateResult, table, ctx);
+        };
+      }
+      if (propStr === "delete") {
+        return (table) => {
+          const deleteResult = target.delete(table);
+          return wrapWriteChain(deleteResult, table, ctx);
+        };
+      }
+      if (propStr === "query") {
+        return wrapRelationalQuery(target.query, ctx);
+      }
+      const value = target[prop];
+      if (typeof value === "function") {
+        return value.bind(target);
+      }
+      return value;
+    }
+  });
+}
+function wrapSelectChain(selectResult, ctx) {
+  return new Proxy(selectResult, {
+    get(target, prop) {
+      const propStr = typeof prop === "string" ? prop : "";
+      if (propStr === "from") {
+        return (table, ...restArgs) => {
+          const fromResult = target.from(table, ...restArgs);
+          const meta = getTableAccessMeta(table);
+          if (meta) {
+            return wrapFromChain(fromResult, ctx, [{ table, meta }]);
+          }
+          return wrapFromChain(fromResult, ctx, []);
+        };
+      }
+      const value = target[prop];
+      if (typeof value === "function") {
+        return value.bind(target);
+      }
+      return value;
+    }
+  });
+}
+function wrapFromChain(chain, ctx, pendingFilters) {
+  return new Proxy(chain, {
+    get(target, prop) {
+      const propStr = typeof prop === "string" ? prop : "";
+      if (["leftJoin", "rightJoin", "innerJoin", "fullJoin"].includes(propStr)) {
+        return (joinTable, ...joinArgs) => {
+          const joinResult = target[propStr](joinTable, ...joinArgs);
+          const joinMeta = getTableAccessMeta(joinTable);
+          const newFilters = joinMeta ? [...pendingFilters, { table: joinTable, meta: joinMeta }] : pendingFilters;
+          return wrapFromChain(joinResult, ctx, newFilters);
+        };
+      }
+      if (propStr === "where") {
+        return (...whereArgs) => {
+          const combinedFilter = buildCombinedFilter(pendingFilters, ctx);
+          if (combinedFilter) {
+            const userWhere = whereArgs[0];
+            const merged = userWhere ? and(userWhere, combinedFilter) : combinedFilter;
+            const result = target.where(merged);
+            return wrapFromChain(result, ctx, []);
+          }
+          return wrapFromChain(target.where(...whereArgs), ctx, []);
+        };
+      }
+      if (propStr === "then" || propStr === "execute") {
+        if (pendingFilters.length > 0) {
+          const combinedFilter = buildCombinedFilter(pendingFilters, ctx);
+          if (combinedFilter) {
+            const filtered = target.where(combinedFilter);
+            return filtered[prop].bind(filtered);
+          }
+        }
+        const value2 = target[prop];
+        return typeof value2 === "function" ? value2.bind(target) : value2;
+      }
+      const value = target[prop];
+      if (typeof value === "function") {
+        return (...args) => {
+          const result = value.apply(target, args);
+          if (result && typeof result === "object" && typeof result.then === "function") {
+            return wrapFromChain(result, ctx, pendingFilters);
+          }
+          if (result && typeof result === "object" && "where" in result) {
+            return wrapFromChain(result, ctx, pendingFilters);
+          }
+          return result;
+        };
+      }
+      return value;
+    }
+  });
+}
+function wrapWriteChain(chain, table, ctx) {
+  const meta = getTableAccessMeta(table);
+  if (!meta) {
+    return chain;
+  }
+  return new Proxy(chain, {
+    get(target, prop) {
+      const propStr = typeof prop === "string" ? prop : "";
+      if (propStr === "where") {
+        return (...whereArgs) => {
+          const filterResult = evaluateFilterSync(meta, ctx);
+          if (typeof filterResult === "boolean") {
+            if (!filterResult) {
+              return target.where(whereArgs[0]);
+            }
+            return target.where(...whereArgs);
+          }
+          const userWhere = whereArgs[0];
+          const merged = userWhere ? and(userWhere, filterResult) : filterResult;
+          return target.where(merged);
+        };
+      }
+      if (propStr === "then" || propStr === "execute" || propStr === "returning") {
+        const filterResult = evaluateFilterSync(meta, ctx);
+        if (filterResult && typeof filterResult !== "boolean") {
+          const filtered = target.where(filterResult);
+          const value3 = filtered[prop];
+          return typeof value3 === "function" ? value3.bind(filtered) : value3;
+        }
+        const value2 = target[prop];
+        return typeof value2 === "function" ? value2.bind(target) : value2;
+      }
+      const value = target[prop];
+      if (typeof value === "function") {
+        return value.bind(target);
+      }
+      return value;
+    }
+  });
+}
+function wrapRelationalQuery(queryObj, ctx) {
+  if (!queryObj) return queryObj;
+  return new Proxy(queryObj, {
+    get(target, tableName) {
+      const tableProxy = target[tableName];
+      if (!tableProxy || typeof tableProxy !== "object") return tableProxy;
+      return new Proxy(tableProxy, {
+        get(tableTarget, method) {
+          const methodStr = typeof method === "string" ? method : "";
+          if (methodStr === "findMany" || methodStr === "findFirst") {
+            return (args = {}) => {
+              const meta = findMetaByTableName(String(tableName));
+              if (meta) {
+                const filterResult = evaluateFilterSync(meta, ctx);
+                if (filterResult && typeof filterResult !== "boolean") {
+                  args.where = args.where ? and(args.where, filterResult) : filterResult;
+                } else if (filterResult === false) {
+                  args.where = args.where;
+                }
+              }
+              return tableTarget[method](args);
+            };
+          }
+          const value = tableTarget[method];
+          if (typeof value === "function") {
+            return value.bind(tableTarget);
+          }
+          return value;
+        }
+      });
+    }
+  });
+}
+function buildCombinedFilter(pendingFilters, ctx) {
+  const sqlConditions = [];
+  for (const { meta } of pendingFilters) {
+    const result = evaluateFilterSync(meta, ctx);
+    if (result === false) {
+      const { sql: sqlTag } = __require("drizzle-orm");
+      return sqlTag`1 = 0`;
+    }
+    if (result === true) {
+      continue;
+    }
+    if (result) {
+      sqlConditions.push(result);
+    }
+  }
+  if (sqlConditions.length === 0) return null;
+  if (sqlConditions.length === 1) return sqlConditions[0];
+  return and(...sqlConditions) ?? null;
+}
+function evaluateFilterSync(meta, ctx) {
+  const result = meta.filter(ctx);
+  if (result instanceof Promise) {
+    throw new Error(
+      `[gencow] Async filter on table "${meta.tableName}" is not supported in synchronous context. Use synchronous filters for schema-level access control.`
+    );
+  }
+  return result;
+}
+function findMetaByTableName(name) {
+  for (const [, meta] of globalThis.__gencow_tableAccessRegistry || []) {
+    if (meta.tableName === name) return meta;
+  }
+  return void 0;
+}
+function applyFieldAccess(result, table, ctx) {
+  const meta = getTableAccessMeta(table);
+  if (!meta?.fieldAccess) return result;
+  const fieldAccess = meta.fieldAccess;
+  const maskedFields = [];
+  for (const [field, rule] of Object.entries(fieldAccess)) {
+    try {
+      if (!rule.read(ctx)) {
+        maskedFields.push(field);
+      }
+    } catch {
+      maskedFields.push(field);
+    }
+  }
+  if (maskedFields.length === 0) return result;
+  const maskRow = (row) => {
+    if (!row || typeof row !== "object") return row;
+    const masked = { ...row };
+    for (const field of maskedFields) {
+      if (field in masked) {
+        masked[field] = null;
+      }
+    }
+    return masked;
+  };
+  if (Array.isArray(result)) {
+    return result.map(maskRow);
+  }
+  return maskRow(result);
+}
 export {
   GencowValidationError,
+  applyFieldAccess,
   buildRealtimeCtx,
   createScheduler,
+  createScopedDb,
   cronJobs,
   defineAuth,
   deregisterClient,
+  gencowTable,
+  getAllGencowTables,
   getQueryDef,
   getQueryHandler,
   getRegisteredHttpActions,
   getRegisteredMutations,
   getRegisteredQueries,
   getSchedulerInfo,
+  getTableAccessMeta,
   handleWsMessage,
   httpAction,
   invalidateQueries,
+  isGencowTable,
   mutation,
+  ownerFilter,
   parseArgs,
   query,
   registerClient,