graphile-bucket-provisioner-plugin 0.3.0 → 0.4.0

package/esm/plugin.js

@@ -33,12 +33,18 @@
 import { context as grafastContext, lambda, object } from 'grafast';
 import { extendSchema, gql } from 'graphile-utils';
 import { Logger } from '@pgpmjs/logger';
+import { QuoteUtils } from '@pgsql/quotes';
 import { BucketProvisioner, } from '@constructive-io/bucket-provisioner';
 const log = new Logger('graphile-bucket-provisioner:plugin');
-// --- Storage module query (same as presigned-url-plugin) ---
-const STORAGE_MODULE_QUERY = `
+// --- Storage module queries ---
+/**
+ * Resolve the app-level storage module (membership_type IS NULL).
+ */
+const APP_STORAGE_MODULE_QUERY = `
   SELECT
     sm.id,
+    sm.membership_type,
+    sm.entity_table_id,
     bs.schema_name AS buckets_schema,
     bt.name AS buckets_table,
     sm.endpoint,
@@ -49,8 +55,56 @@ const STORAGE_MODULE_QUERY = `
   JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
   JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
   WHERE sm.database_id = $1
+    AND sm.membership_type IS NULL
   LIMIT 1
 `;
+/**
+ * Resolve ALL storage modules for a database (for ownerId-based resolution).
+ */
+const ALL_STORAGE_MODULES_QUERY = `
+  SELECT
+    sm.id,
+    sm.membership_type,
+    sm.entity_table_id,
+    bs.schema_name AS buckets_schema,
+    bt.name AS buckets_table,
+    sm.endpoint,
+    sm.public_url_prefix,
+    sm.provider,
+    sm.allowed_origins,
+    es.schema_name AS entity_schema,
+    et.name AS entity_table
+  FROM metaschema_modules_public.storage_module sm
+  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
+  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
+  LEFT JOIN metaschema_public.table et ON et.id = sm.entity_table_id
+  LEFT JOIN metaschema_public.schema es ON es.id = et.schema_id
+  WHERE sm.database_id = $1
+`;
+/**
+ * Resolve the storage module for a given scope.
+ * If ownerId is provided, probes entity tables to find the matching module.
+ * Otherwise, returns the app-level module.
+ */
+async function resolveStorageModule(pgClient, databaseId, ownerId) {
+    if (!ownerId) {
+        // App-level resolution
+        const result = await pgClient.query(APP_STORAGE_MODULE_QUERY, [databaseId]);
+        return result.rows[0] ?? null;
+    }
+    // Entity-scoped: load all modules and probe entity tables
+    const result = await pgClient.query(ALL_STORAGE_MODULES_QUERY, [databaseId]);
+    const modules = result.rows;
+    const entityModules = modules.filter((m) => m.entity_schema && m.entity_table);
+    for (const mod of entityModules) {
+        const entityTable = QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
+        const probe = await pgClient.query(`SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
+        if (probe.rows.length > 0) {
+            return mod;
+        }
+    }
+    return null;
+}
 // --- Helpers ---
 /**
  * Resolve the connection config from the options. If the option is a lazy
@@ -124,8 +178,7 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
     const s3BucketName = resolveBucketName(bucketKey, databaseId, options);
     const accessType = bucketType;
     // Read storage module config to check for endpoint/provider/CORS overrides
-    const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-    const storageModule = smResult.rows[0] ?? null;
+    const storageModule = await resolveStorageModule(pgClient, databaseId);
     // Resolve CORS origins using the 3-tier hierarchy
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
@@ -148,8 +201,7 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
 async function updateBucketCors(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options) {
     const s3BucketName = resolveBucketName(bucketKey, databaseId, options);
     const accessType = bucketType;
-    const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-    const storageModule = smResult.rows[0] ?? null;
+    const storageModule = await resolveStorageModule(pgClient, databaseId);
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
     log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
@@ -185,6 +237,11 @@ export function createBucketProvisionerPlugin(options) {
       input ProvisionBucketInput {
         """The logical bucket key (e.g., "public", "private")"""
         bucketKey: String!
+        """
+        Owner entity ID for entity-scoped bucket provisioning.
+        Omit for app-level (database-wide) storage.
+        """
+        ownerId: UUID
       }
 
       type ProvisionBucketPayload {
@@ -226,7 +283,7 @@ export function createBucketProvisionerPlugin(options) {
                         pgSettings: $pgSettings,
                     });
                     return lambda($combined, async ({ input, withPgClient, pgSettings }) => {
-                        const { bucketKey } = input;
+                        const { bucketKey, ownerId } = input;
                         if (!bucketKey || typeof bucketKey !== 'string') {
                             throw new Error('INVALID_BUCKET_KEY');
                         }
@@ -236,17 +293,25 @@ export function createBucketProvisionerPlugin(options) {
                             if (!databaseId) {
                                 throw new Error('DATABASE_NOT_FOUND');
                             }
-                            // Read storage module config
-                            const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-                            if (smResult.rows.length === 0) {
-                                throw new Error('STORAGE_MODULE_NOT_PROVISIONED');
+                            // Resolve storage module (app-level or entity-scoped via ownerId)
+                            const storageModule = await resolveStorageModule(pgClient, databaseId, ownerId);
+                            if (!storageModule) {
+                                throw new Error(ownerId
+                                    ? 'STORAGE_MODULE_NOT_FOUND_FOR_OWNER: no storage module found for the given ownerId'
+                                    : 'STORAGE_MODULE_NOT_PROVISIONED');
                             }
-                            const storageModule = smResult.rows[0];
                             // Look up the bucket row (RLS enforced via pgSettings)
-                            const bucketResult = await pgClient.query(`SELECT id, key, type, is_public, allowed_origins
-                 FROM "${storageModule.buckets_schema}"."${storageModule.buckets_table}"
-                 WHERE key = $1
-                 LIMIT 1`, [bucketKey]);
+                            const hasOwner = ownerId && storageModule.membership_type !== null;
+                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
+                            const bucketResult = await pgClient.query(hasOwner
+                                ? `SELECT id, key, type, is_public, allowed_origins
+                     FROM ${bucketsTable}
+                     WHERE key = $1 AND owner_id = $2
+                     LIMIT 1`
+                                : `SELECT id, key, type, is_public, allowed_origins
+                     FROM ${bucketsTable}
+                     WHERE key = $1
+                     LIMIT 1`, hasOwner ? [bucketKey, ownerId] : [bucketKey]);
                             if (bucketResult.rows.length === 0) {
                                 throw new Error('BUCKET_NOT_FOUND');
                             }
@@ -369,13 +434,12 @@ export function createBucketProvisionerPlugin(options) {
                                             log.warn('CORS update skipped: could not resolve database_id');
                                             return;
                                         }
-                                        // Read the updated bucket row to get full state
-                                        const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-                                        if (smResult.rows.length === 0) {
+                                        // Read the storage module config (app-level; auto-hook doesn't have ownerId context)
+                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
+                                        if (!storageModule) {
                                             log.warn('CORS update skipped: storage module not provisioned');
                                             return;
                                         }
-                                        const storageModule = smResult.rows[0];
                                         // We need the bucket key — it may come from input or patch
                                         // For updates, PostGraphile uses nodeId or the row's PK, so
                                         // we read the bucket from the patch's key or from the nodeId
@@ -386,8 +450,9 @@ export function createBucketProvisionerPlugin(options) {
                                             return;
                                         }
                                         // Read the full bucket row (post-update) to get type + origins
+                                        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
                                         const bucketResult = await pgClient.query(`SELECT id, key, type, is_public, allowed_origins
-                       FROM "${storageModule.buckets_schema}"."${storageModule.buckets_table}"
+                       FROM ${bucketsTable}
                        WHERE key = $1
                        LIMIT 1`, [patchKey]);
                                         if (bucketResult.rows.length === 0) {

package/esm/types.d.ts

@@ -70,6 +70,11 @@ export interface BucketProvisionerPluginOptions {
 export interface ProvisionBucketInput {
     /** The logical bucket key (e.g., "public", "private") */
     bucketKey: string;
+    /**
+     * Owner entity ID for entity-scoped bucket provisioning.
+     * Omit for app-level (database-wide) storage.
+     */
+    ownerId?: string;
 }
 /**
  * Result of the provisionBucket mutation.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-bucket-provisioner-plugin",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Bucket provisioning plugin for PostGraphile v5 — auto-provisions S3 buckets on bucket table mutations",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -41,7 +41,8 @@
   },
   "dependencies": {
     "@constructive-io/bucket-provisioner": "^0.3.0",
-    "@pgpmjs/logger": "^2.6.0"
+    "@pgpmjs/logger": "^2.6.0",
+    "@pgsql/quotes": "^17.1.0"
   },
   "peerDependencies": {
     "grafast": "1.0.0",
@@ -56,5 +57,5 @@
     "@types/node": "^22.19.11",
     "makage": "^0.3.0"
   },
-  "gitHead": "1b3af3c5189b9ca2e765b9239a4b287099e64a03"
+  "gitHead": "28734dd71a973b2fe296e8240c8f86c568b4292f"
 }

package/plugin.js

@@ -37,12 +37,18 @@ exports.createBucketProvisionerPlugin = createBucketProvisionerPlugin;
 const grafast_1 = require("grafast");
 const graphile_utils_1 = require("graphile-utils");
 const logger_1 = require("@pgpmjs/logger");
+const quotes_1 = require("@pgsql/quotes");
 const bucket_provisioner_1 = require("@constructive-io/bucket-provisioner");
 const log = new logger_1.Logger('graphile-bucket-provisioner:plugin');
-// --- Storage module query (same as presigned-url-plugin) ---
-const STORAGE_MODULE_QUERY = `
+// --- Storage module queries ---
+/**
+ * Resolve the app-level storage module (membership_type IS NULL).
+ */
+const APP_STORAGE_MODULE_QUERY = `
   SELECT
     sm.id,
+    sm.membership_type,
+    sm.entity_table_id,
     bs.schema_name AS buckets_schema,
     bt.name AS buckets_table,
     sm.endpoint,
@@ -53,8 +59,56 @@ const STORAGE_MODULE_QUERY = `
   JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
   JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
   WHERE sm.database_id = $1
+    AND sm.membership_type IS NULL
   LIMIT 1
 `;
+/**
+ * Resolve ALL storage modules for a database (for ownerId-based resolution).
+ */
+const ALL_STORAGE_MODULES_QUERY = `
+  SELECT
+    sm.id,
+    sm.membership_type,
+    sm.entity_table_id,
+    bs.schema_name AS buckets_schema,
+    bt.name AS buckets_table,
+    sm.endpoint,
+    sm.public_url_prefix,
+    sm.provider,
+    sm.allowed_origins,
+    es.schema_name AS entity_schema,
+    et.name AS entity_table
+  FROM metaschema_modules_public.storage_module sm
+  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
+  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
+  LEFT JOIN metaschema_public.table et ON et.id = sm.entity_table_id
+  LEFT JOIN metaschema_public.schema es ON es.id = et.schema_id
+  WHERE sm.database_id = $1
+`;
+/**
+ * Resolve the storage module for a given scope.
+ * If ownerId is provided, probes entity tables to find the matching module.
+ * Otherwise, returns the app-level module.
+ */
+async function resolveStorageModule(pgClient, databaseId, ownerId) {
+    if (!ownerId) {
+        // App-level resolution
+        const result = await pgClient.query(APP_STORAGE_MODULE_QUERY, [databaseId]);
+        return result.rows[0] ?? null;
+    }
+    // Entity-scoped: load all modules and probe entity tables
+    const result = await pgClient.query(ALL_STORAGE_MODULES_QUERY, [databaseId]);
+    const modules = result.rows;
+    const entityModules = modules.filter((m) => m.entity_schema && m.entity_table);
+    for (const mod of entityModules) {
+        const entityTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
+        const probe = await pgClient.query(`SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
+        if (probe.rows.length > 0) {
+            return mod;
+        }
+    }
+    return null;
+}
 // --- Helpers ---
 /**
  * Resolve the connection config from the options. If the option is a lazy
@@ -128,8 +182,7 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
     const s3BucketName = resolveBucketName(bucketKey, databaseId, options);
     const accessType = bucketType;
     // Read storage module config to check for endpoint/provider/CORS overrides
-    const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-    const storageModule = smResult.rows[0] ?? null;
+    const storageModule = await resolveStorageModule(pgClient, databaseId);
     // Resolve CORS origins using the 3-tier hierarchy
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
@@ -152,8 +205,7 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
 async function updateBucketCors(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options) {
     const s3BucketName = resolveBucketName(bucketKey, databaseId, options);
     const accessType = bucketType;
-    const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-    const storageModule = smResult.rows[0] ?? null;
+    const storageModule = await resolveStorageModule(pgClient, databaseId);
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
     log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
@@ -189,6 +241,11 @@ function createBucketProvisionerPlugin(options) {
       input ProvisionBucketInput {
         """The logical bucket key (e.g., "public", "private")"""
         bucketKey: String!
+        """
+        Owner entity ID for entity-scoped bucket provisioning.
+        Omit for app-level (database-wide) storage.
+        """
+        ownerId: UUID
       }
 
       type ProvisionBucketPayload {
@@ -230,7 +287,7 @@ function createBucketProvisionerPlugin(options) {
                         pgSettings: $pgSettings,
                     });
                     return (0, grafast_1.lambda)($combined, async ({ input, withPgClient, pgSettings }) => {
-                        const { bucketKey } = input;
+                        const { bucketKey, ownerId } = input;
                         if (!bucketKey || typeof bucketKey !== 'string') {
                             throw new Error('INVALID_BUCKET_KEY');
                         }
@@ -240,17 +297,25 @@ function createBucketProvisionerPlugin(options) {
                             if (!databaseId) {
                                 throw new Error('DATABASE_NOT_FOUND');
                             }
-                            // Read storage module config
-                            const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-                            if (smResult.rows.length === 0) {
-                                throw new Error('STORAGE_MODULE_NOT_PROVISIONED');
+                            // Resolve storage module (app-level or entity-scoped via ownerId)
+                            const storageModule = await resolveStorageModule(pgClient, databaseId, ownerId);
+                            if (!storageModule) {
+                                throw new Error(ownerId
+                                    ? 'STORAGE_MODULE_NOT_FOUND_FOR_OWNER: no storage module found for the given ownerId'
+                                    : 'STORAGE_MODULE_NOT_PROVISIONED');
                             }
-                            const storageModule = smResult.rows[0];
                             // Look up the bucket row (RLS enforced via pgSettings)
-                            const bucketResult = await pgClient.query(`SELECT id, key, type, is_public, allowed_origins
-                 FROM "${storageModule.buckets_schema}"."${storageModule.buckets_table}"
-                 WHERE key = $1
-                 LIMIT 1`, [bucketKey]);
+                            const hasOwner = ownerId && storageModule.membership_type !== null;
+                            const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
+                            const bucketResult = await pgClient.query(hasOwner
+                                ? `SELECT id, key, type, is_public, allowed_origins
+                     FROM ${bucketsTable}
+                     WHERE key = $1 AND owner_id = $2
+                     LIMIT 1`
+                                : `SELECT id, key, type, is_public, allowed_origins
+                     FROM ${bucketsTable}
+                     WHERE key = $1
+                     LIMIT 1`, hasOwner ? [bucketKey, ownerId] : [bucketKey]);
                             if (bucketResult.rows.length === 0) {
                                 throw new Error('BUCKET_NOT_FOUND');
                             }
@@ -373,13 +438,12 @@ function createBucketProvisionerPlugin(options) {
                                             log.warn('CORS update skipped: could not resolve database_id');
                                             return;
                                         }
-                                        // Read the updated bucket row to get full state
-                                        const smResult = await pgClient.query(STORAGE_MODULE_QUERY, [databaseId]);
-                                        if (smResult.rows.length === 0) {
+                                        // Read the storage module config (app-level; auto-hook doesn't have ownerId context)
+                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
+                                        if (!storageModule) {
                                             log.warn('CORS update skipped: storage module not provisioned');
                                             return;
                                         }
-                                        const storageModule = smResult.rows[0];
                                         // We need the bucket key — it may come from input or patch
                                         // For updates, PostGraphile uses nodeId or the row's PK, so
                                         // we read the bucket from the patch's key or from the nodeId
@@ -390,8 +454,9 @@ function createBucketProvisionerPlugin(options) {
                                             return;
                                         }
                                         // Read the full bucket row (post-update) to get type + origins
+                                        const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
                                         const bucketResult = await pgClient.query(`SELECT id, key, type, is_public, allowed_origins
-                       FROM "${storageModule.buckets_schema}"."${storageModule.buckets_table}"
+                       FROM ${bucketsTable}
                        WHERE key = $1
                        LIMIT 1`, [patchKey]);
                                         if (bucketResult.rows.length === 0) {

package/types.d.ts

@@ -70,6 +70,11 @@ export interface BucketProvisionerPluginOptions {
 export interface ProvisionBucketInput {
     /** The logical bucket key (e.g., "public", "private") */
     bucketKey: string;
+    /**
+     * Owner entity ID for entity-scoped bucket provisioning.
+     * Omit for app-level (database-wide) storage.
+     */
+    ownerId?: string;
 }
 /**
  * Result of the provisionBucket mutation.