graphile-bucket-provisioner-plugin 1.13.0 → 1.14.0

package/esm/plugin.js

@@ -38,9 +38,12 @@ import { extendSchema, gql } from 'graphile-utils';
 const log = new Logger('graphile-bucket-provisioner:plugin');
 // --- Storage module queries ---
 /**
- * Resolve the app-level storage module (scope = 'app').
+ * Resolve the storage module whose buckets table is the one being addressed.
+ *
+ * The buckets table's identity (schema + table, from the codec being mutated or
+ * the module row) is the fact that names the plane — never a scope literal.
  */
-const APP_STORAGE_MODULE_QUERY = `
+const STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY = `
   SELECT
     sm.id,
     sm.scope,
@@ -55,11 +58,12 @@ const APP_STORAGE_MODULE_QUERY = `
   JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
   JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
   WHERE sm.database_id = $1
-    AND sm.scope = 'app'
-  LIMIT 1
+    AND bs.schema_name = $2
+    AND bt.name = $3
 `;
 /**
- * Resolve ALL storage modules for a database (for ownerId-based resolution).
+ * Resolve ALL storage modules for a database (for bucket-key and ownerId-based
+ * resolution in the explicit provisionBucket mutation).
  */
 const ALL_STORAGE_MODULES_QUERY = `
   SELECT
@@ -93,28 +97,82 @@ function runQuery(pgClient, text, values) {
     return pgClient.query(values === undefined ? { text } : { text, values });
 }
 /**
- * Resolve the storage module for a given scope.
- * If ownerId is provided, probes entity tables to find the matching module.
- * Otherwise, returns the app-level module.
+ * Resolve the storage module whose buckets table is the one being addressed.
+ *
+ * This is the resolution the auto-provision/CORS hooks use: the codec being
+ * mutated names its table, and the table names its module. A `@storageBuckets`
+ * table with no module row (or with several) is a provisioning bug and throws.
  */
-async function resolveStorageModule(pgClient, databaseId, ownerId) {
-    if (!ownerId) {
-        // App-level resolution
-        const result = await runQuery(pgClient, APP_STORAGE_MODULE_QUERY, [databaseId]);
-        return result.rows[0] ?? null;
+async function resolveStorageModuleByBucketsTable(pgClient, databaseId, schemaName, tableName) {
+    const result = await runQuery(pgClient, STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY, [
+        databaseId,
+        schemaName,
+        tableName,
+    ]);
+    const rows = result.rows;
+    if (rows.length === 0) {
+        throw new Error(`STORAGE_MODULE_NOT_FOUND: no storage module in database ${databaseId} records ` +
+            `${schemaName}.${tableName} as its buckets table`);
+    }
+    if (rows.length > 1) {
+        throw new Error(`STORAGE_MODULE_AMBIGUOUS: ${rows.length} storage modules in database ${databaseId} record ` +
+            `${schemaName}.${tableName} as their buckets table`);
     }
-    // Entity-scoped: load all modules and probe entity tables
+    return rows[0];
+}
+/**
+ * The explicit provisionBucket mutation's resolution: find the plane that
+ * actually holds the named bucket row.
+ *
+ * With an ownerId, the owning entity row names the plane (probed through each
+ * entity-keyed module's recorded entity table). Without one, every
+ * non-entity-keyed plane's buckets table is probed for the key under RLS —
+ * exactly one plane may hold it; several is ambiguous and throws rather than
+ * silently picking.
+ */
+async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
     const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY, [databaseId]);
     const modules = result.rows;
-    const entityModules = modules.filter((m) => m.entity_schema && m.entity_table);
-    for (const mod of entityModules) {
-        const entityTable = QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
-        const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
-        if (probe.rows.length > 0) {
-            return mod;
+    if (modules.length === 0) {
+        throw new Error(`STORAGE_MODULE_NOT_PROVISIONED: database ${databaseId} has no storage modules`);
+    }
+    if (ownerId) {
+        const entityModules = modules.filter((m) => m.entity_table_id !== null && m.entity_schema && m.entity_table);
+        for (const mod of entityModules) {
+            const entityTable = QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
+            const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
+            if (probe.rows.length === 0)
+                continue;
+            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+            const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+         FROM ${bucketsTable}
+         WHERE key = $1 AND owner_id = $2
+         LIMIT 1`, [bucketKey, ownerId]);
+            if (bucketResult.rows.length === 0)
+                return null;
+            return { storageModule: mod, bucket: bucketResult.rows[0] };
+        }
+        return null;
+    }
+    const matches = [];
+    for (const mod of modules.filter((m) => m.entity_table_id === null)) {
+        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+       FROM ${bucketsTable}
+       WHERE key = $1
+       LIMIT 1`, [bucketKey]);
+        if (bucketResult.rows.length > 0) {
+            matches.push({ storageModule: mod, bucket: bucketResult.rows[0] });
         }
     }
-    return null;
+    if (matches.length === 0)
+        return null;
+    if (matches.length > 1) {
+        const scopes = matches.map((m) => `'${m.storageModule.scope}'`).join(', ');
+        throw new Error(`BUCKET_KEY_AMBIGUOUS: bucket key "${bucketKey}" exists in ${matches.length} storage planes ` +
+            `(scopes ${scopes}); provide an ownerId or use a plane-unique key`);
+    }
+    return matches[0];
 }
 /**
  * Normalize the recorded physical coordinate at the DB boundary.
@@ -207,10 +265,8 @@ function buildProvisioner(options, storageModule, effectiveOrigins) {
  * Core provisioning logic shared by both the explicit mutation and the
  * auto-provisioning hook.
  */
-async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
+async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
-    // Read storage module config to check for endpoint/provider/CORS overrides
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
     // Resolve CORS origins using the 3-tier hierarchy
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
@@ -230,9 +286,8 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
 /**
  * Update CORS on an existing S3 bucket when allowed_origins changes.
  */
-async function updateBucketCors(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
+async function updateBucketCors(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
     log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
@@ -324,29 +379,14 @@ export function createBucketProvisionerPlugin(options) {
                             if (!databaseId) {
                                 throw new Error('DATABASE_NOT_FOUND');
                             }
-                            // Resolve storage module (app-level or entity-scoped via ownerId)
-                            const storageModule = await resolveStorageModule(pgClient, databaseId, ownerId);
-                            if (!storageModule) {
-                                throw new Error(ownerId
-                                    ? 'STORAGE_MODULE_NOT_FOUND_FOR_OWNER: no storage module found for the given ownerId'
-                                    : 'STORAGE_MODULE_NOT_PROVISIONED');
-                            }
-                            // Look up the bucket row (RLS enforced via pgSettings)
-                            const hasOwner = ownerId && storageModule.scope !== 'app';
-                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                            const bucketResult = await runQuery(pgClient, hasOwner
-                                ? `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1 AND owner_id = $2
-                     LIMIT 1`
-                                : `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1
-                     LIMIT 1`, hasOwner ? [bucketKey, ownerId] : [bucketKey]);
-                            if (bucketResult.rows.length === 0) {
+                            // Resolve the plane that actually holds the named bucket row
+                            // (RLS enforced via pgSettings) — never a guessed scope.
+                            const resolution = await resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId);
+                            if (!resolution) {
                                 throw new Error('BUCKET_NOT_FOUND');
                             }
-                            const bucket = bucketResult.rows[0];
+                            const { storageModule, bucket } = resolution;
+                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
                             // First provision mints a name; afterwards the stored coordinate
                             // is authoritative and the naming hook is never consulted again.
                             const recorded = storedPhysicalName(bucket);
@@ -354,7 +394,7 @@ export function createBucketProvisionerPlugin(options) {
                                 ? resolveBucketName(bucket.key, databaseId, options)
                                 : recorded;
                             try {
-                                const result = await provisionBucketForRow(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
+                                const result = await provisionBucketForRow(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
                                 // Record the exact provisioned name on the source row.
                                 await recordPhysicalName(withPgClient, bucketsTable, bucket.id, result.bucketName);
                                 return {
@@ -427,6 +467,10 @@ export function createBucketProvisionerPlugin(options) {
                         return field;
                     }
                     log.debug(`Wrapping mutation "${fieldName}" for ${isCreate ? 'auto-provisioning' : 'CORS update'} (codec: ${pgCodec.name})`);
+                    // The codec being mutated names the buckets table — the hook always
+                    // operates on the plane that table belongs to, never a guessed scope.
+                    const codecSchemaName = pgCodec.extensions?.pg?.schemaName;
+                    const codecTableName = pgCodec.extensions?.pg?.name;
                     const defaultResolver = (obj) => obj[fieldName];
                     const { resolve: oldResolve = defaultResolver, ...rest } = field;
                     return {
@@ -450,23 +494,29 @@ export function createBucketProvisionerPlugin(options) {
                                             `could not extract key/type from mutation input`);
                                         return result;
                                     }
+                                    if (!codecSchemaName || !codecTableName) {
+                                        throw new Error(`Auto-provision failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
+                                    }
                                     await withPgClient(pgSettings, async (pgClient) => {
                                         const databaseId = await resolveDatabaseId(pgClient);
                                         if (!databaseId) {
                                             log.warn('Auto-provision skipped: could not resolve database_id');
                                             return;
                                         }
+                                        // The mutated table names its module — the plane being written
+                                        // is the plane that gets provisioned.
+                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
                                         // Newly-created row has no stored coordinate yet — mint on first provision.
-                                        const result = await provisionBucketForRow(pgClient, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
+                                        const result = await provisionBucketForRow(storageModule, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
                                         // Record the provisioned name on the just-created row.
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (storageModule) {
-                                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                            const idResult = await runQuery(pgClient, `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, [bucketInput.key]);
-                                            const bucketId = idResult.rows[0]?.id;
-                                            if (bucketId)
-                                                await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
-                                        }
+                                        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
+                                        const ownerId = bucketInput.ownerId ?? bucketInput.owner_id ?? null;
+                                        const idResult = await runQuery(pgClient, ownerId
+                                            ? `SELECT id FROM ${bucketsTable} WHERE key = $1 AND owner_id = $2 LIMIT 1`
+                                            : `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, ownerId ? [bucketInput.key, ownerId] : [bucketInput.key]);
+                                        const bucketId = idResult.rows[0]?.id;
+                                        if (bucketId)
+                                            await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
                                     });
                                 }
                                 else {
@@ -477,18 +527,18 @@ export function createBucketProvisionerPlugin(options) {
                                         // allowed_origins not being changed, nothing to do
                                         return result;
                                     }
+                                    if (!codecSchemaName || !codecTableName) {
+                                        throw new Error(`CORS update failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
+                                    }
                                     await withPgClient(pgSettings, async (pgClient) => {
                                         const databaseId = await resolveDatabaseId(pgClient);
                                         if (!databaseId) {
                                             log.warn('CORS update skipped: could not resolve database_id');
                                             return;
                                         }
-                                        // Read the storage module config (app-level; auto-hook doesn't have ownerId context)
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (!storageModule) {
-                                            log.warn('CORS update skipped: storage module not provisioned');
-                                            return;
-                                        }
+                                        // The mutated table names its module — CORS applies to the
+                                        // plane whose row was updated.
+                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
                                         // We need the bucket key — it may come from input or patch
                                         // For updates, PostGraphile uses nodeId or the row's PK, so
                                         // we read the bucket from the patch's key or from the nodeId
@@ -513,7 +563,7 @@ export function createBucketProvisionerPlugin(options) {
                                         // never provisioned there is nothing to update yet, so mint the
                                         // conventional name the first provision would use.
                                         const recorded = storedPhysicalName(bucket);
-                                        await updateBucketCors(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
+                                        await updateBucketCors(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
                                             ? resolveBucketName(bucket.key, databaseId, options)
                                             : recorded);
                                     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-bucket-provisioner-plugin",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "description": "Bucket provisioning plugin for PostGraphile v5 — auto-provisions S3 buckets on bucket table mutations",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -57,5 +57,5 @@
     "@types/node": "^22.19.11",
     "makage": "^0.3.0"
   },
-  "gitHead": "b5b6b9f05276b7e9cbd3d1f4acd31dd315c353ea"
+  "gitHead": "d10fe91ede80a4c2dfe2c1c6dcf6fe7193784eba"
 }

package/plugin.js

@@ -42,9 +42,12 @@ const graphile_utils_1 = require("graphile-utils");
 const log = new logger_1.Logger('graphile-bucket-provisioner:plugin');
 // --- Storage module queries ---
 /**
- * Resolve the app-level storage module (scope = 'app').
+ * Resolve the storage module whose buckets table is the one being addressed.
+ *
+ * The buckets table's identity (schema + table, from the codec being mutated or
+ * the module row) is the fact that names the plane — never a scope literal.
  */
-const APP_STORAGE_MODULE_QUERY = `
+const STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY = `
   SELECT
     sm.id,
     sm.scope,
@@ -59,11 +62,12 @@ const APP_STORAGE_MODULE_QUERY = `
   JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
   JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
   WHERE sm.database_id = $1
-    AND sm.scope = 'app'
-  LIMIT 1
+    AND bs.schema_name = $2
+    AND bt.name = $3
 `;
 /**
- * Resolve ALL storage modules for a database (for ownerId-based resolution).
+ * Resolve ALL storage modules for a database (for bucket-key and ownerId-based
+ * resolution in the explicit provisionBucket mutation).
  */
 const ALL_STORAGE_MODULES_QUERY = `
   SELECT
@@ -97,28 +101,82 @@ function runQuery(pgClient, text, values) {
     return pgClient.query(values === undefined ? { text } : { text, values });
 }
 /**
- * Resolve the storage module for a given scope.
- * If ownerId is provided, probes entity tables to find the matching module.
- * Otherwise, returns the app-level module.
+ * Resolve the storage module whose buckets table is the one being addressed.
+ *
+ * This is the resolution the auto-provision/CORS hooks use: the codec being
+ * mutated names its table, and the table names its module. A `@storageBuckets`
+ * table with no module row (or with several) is a provisioning bug and throws.
  */
-async function resolveStorageModule(pgClient, databaseId, ownerId) {
-    if (!ownerId) {
-        // App-level resolution
-        const result = await runQuery(pgClient, APP_STORAGE_MODULE_QUERY, [databaseId]);
-        return result.rows[0] ?? null;
+async function resolveStorageModuleByBucketsTable(pgClient, databaseId, schemaName, tableName) {
+    const result = await runQuery(pgClient, STORAGE_MODULE_BY_BUCKETS_TABLE_QUERY, [
+        databaseId,
+        schemaName,
+        tableName,
+    ]);
+    const rows = result.rows;
+    if (rows.length === 0) {
+        throw new Error(`STORAGE_MODULE_NOT_FOUND: no storage module in database ${databaseId} records ` +
+            `${schemaName}.${tableName} as its buckets table`);
+    }
+    if (rows.length > 1) {
+        throw new Error(`STORAGE_MODULE_AMBIGUOUS: ${rows.length} storage modules in database ${databaseId} record ` +
+            `${schemaName}.${tableName} as their buckets table`);
     }
-    // Entity-scoped: load all modules and probe entity tables
+    return rows[0];
+}
+/**
+ * The explicit provisionBucket mutation's resolution: find the plane that
+ * actually holds the named bucket row.
+ *
+ * With an ownerId, the owning entity row names the plane (probed through each
+ * entity-keyed module's recorded entity table). Without one, every
+ * non-entity-keyed plane's buckets table is probed for the key under RLS —
+ * exactly one plane may hold it; several is ambiguous and throws rather than
+ * silently picking.
+ */
+async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
     const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY, [databaseId]);
     const modules = result.rows;
-    const entityModules = modules.filter((m) => m.entity_schema && m.entity_table);
-    for (const mod of entityModules) {
-        const entityTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
-        const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
-        if (probe.rows.length > 0) {
-            return mod;
+    if (modules.length === 0) {
+        throw new Error(`STORAGE_MODULE_NOT_PROVISIONED: database ${databaseId} has no storage modules`);
+    }
+    if (ownerId) {
+        const entityModules = modules.filter((m) => m.entity_table_id !== null && m.entity_schema && m.entity_table);
+        for (const mod of entityModules) {
+            const entityTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
+            const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
+            if (probe.rows.length === 0)
+                continue;
+            const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+            const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+         FROM ${bucketsTable}
+         WHERE key = $1 AND owner_id = $2
+         LIMIT 1`, [bucketKey, ownerId]);
+            if (bucketResult.rows.length === 0)
+                return null;
+            return { storageModule: mod, bucket: bucketResult.rows[0] };
+        }
+        return null;
+    }
+    const matches = [];
+    for (const mod of modules.filter((m) => m.entity_table_id === null)) {
+        const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+       FROM ${bucketsTable}
+       WHERE key = $1
+       LIMIT 1`, [bucketKey]);
+        if (bucketResult.rows.length > 0) {
+            matches.push({ storageModule: mod, bucket: bucketResult.rows[0] });
         }
     }
-    return null;
+    if (matches.length === 0)
+        return null;
+    if (matches.length > 1) {
+        const scopes = matches.map((m) => `'${m.storageModule.scope}'`).join(', ');
+        throw new Error(`BUCKET_KEY_AMBIGUOUS: bucket key "${bucketKey}" exists in ${matches.length} storage planes ` +
+            `(scopes ${scopes}); provide an ownerId or use a plane-unique key`);
+    }
+    return matches[0];
 }
 /**
  * Normalize the recorded physical coordinate at the DB boundary.
@@ -211,10 +269,8 @@ function buildProvisioner(options, storageModule, effectiveOrigins) {
  * Core provisioning logic shared by both the explicit mutation and the
  * auto-provisioning hook.
  */
-async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
+async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
-    // Read storage module config to check for endpoint/provider/CORS overrides
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
     // Resolve CORS origins using the 3-tier hierarchy
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
@@ -234,9 +290,8 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
 /**
  * Update CORS on an existing S3 bucket when allowed_origins changes.
  */
-async function updateBucketCors(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
+async function updateBucketCors(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
     log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
@@ -328,29 +383,14 @@ function createBucketProvisionerPlugin(options) {
                             if (!databaseId) {
                                 throw new Error('DATABASE_NOT_FOUND');
                             }
-                            // Resolve storage module (app-level or entity-scoped via ownerId)
-                            const storageModule = await resolveStorageModule(pgClient, databaseId, ownerId);
-                            if (!storageModule) {
-                                throw new Error(ownerId
-                                    ? 'STORAGE_MODULE_NOT_FOUND_FOR_OWNER: no storage module found for the given ownerId'
-                                    : 'STORAGE_MODULE_NOT_PROVISIONED');
-                            }
-                            // Look up the bucket row (RLS enforced via pgSettings)
-                            const hasOwner = ownerId && storageModule.scope !== 'app';
-                            const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                            const bucketResult = await runQuery(pgClient, hasOwner
-                                ? `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1 AND owner_id = $2
-                     LIMIT 1`
-                                : `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1
-                     LIMIT 1`, hasOwner ? [bucketKey, ownerId] : [bucketKey]);
-                            if (bucketResult.rows.length === 0) {
+                            // Resolve the plane that actually holds the named bucket row
+                            // (RLS enforced via pgSettings) — never a guessed scope.
+                            const resolution = await resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId);
+                            if (!resolution) {
                                 throw new Error('BUCKET_NOT_FOUND');
                             }
-                            const bucket = bucketResult.rows[0];
+                            const { storageModule, bucket } = resolution;
+                            const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
                             // First provision mints a name; afterwards the stored coordinate
                             // is authoritative and the naming hook is never consulted again.
                             const recorded = storedPhysicalName(bucket);
@@ -358,7 +398,7 @@ function createBucketProvisionerPlugin(options) {
                                 ? resolveBucketName(bucket.key, databaseId, options)
                                 : recorded;
                             try {
-                                const result = await provisionBucketForRow(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
+                                const result = await provisionBucketForRow(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
                                 // Record the exact provisioned name on the source row.
                                 await recordPhysicalName(withPgClient, bucketsTable, bucket.id, result.bucketName);
                                 return {
@@ -431,6 +471,10 @@ function createBucketProvisionerPlugin(options) {
                         return field;
                     }
                     log.debug(`Wrapping mutation "${fieldName}" for ${isCreate ? 'auto-provisioning' : 'CORS update'} (codec: ${pgCodec.name})`);
+                    // The codec being mutated names the buckets table — the hook always
+                    // operates on the plane that table belongs to, never a guessed scope.
+                    const codecSchemaName = pgCodec.extensions?.pg?.schemaName;
+                    const codecTableName = pgCodec.extensions?.pg?.name;
                     const defaultResolver = (obj) => obj[fieldName];
                     const { resolve: oldResolve = defaultResolver, ...rest } = field;
                     return {
@@ -454,23 +498,29 @@ function createBucketProvisionerPlugin(options) {
                                             `could not extract key/type from mutation input`);
                                         return result;
                                     }
+                                    if (!codecSchemaName || !codecTableName) {
+                                        throw new Error(`Auto-provision failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
+                                    }
                                     await withPgClient(pgSettings, async (pgClient) => {
                                         const databaseId = await resolveDatabaseId(pgClient);
                                         if (!databaseId) {
                                             log.warn('Auto-provision skipped: could not resolve database_id');
                                             return;
                                         }
+                                        // The mutated table names its module — the plane being written
+                                        // is the plane that gets provisioned.
+                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
                                         // Newly-created row has no stored coordinate yet — mint on first provision.
-                                        const result = await provisionBucketForRow(pgClient, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
+                                        const result = await provisionBucketForRow(storageModule, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
                                         // Record the provisioned name on the just-created row.
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (storageModule) {
-                                            const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                            const idResult = await runQuery(pgClient, `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, [bucketInput.key]);
-                                            const bucketId = idResult.rows[0]?.id;
-                                            if (bucketId)
-                                                await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
-                                        }
+                                        const bucketsTable = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
+                                        const ownerId = bucketInput.ownerId ?? bucketInput.owner_id ?? null;
+                                        const idResult = await runQuery(pgClient, ownerId
+                                            ? `SELECT id FROM ${bucketsTable} WHERE key = $1 AND owner_id = $2 LIMIT 1`
+                                            : `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, ownerId ? [bucketInput.key, ownerId] : [bucketInput.key]);
+                                        const bucketId = idResult.rows[0]?.id;
+                                        if (bucketId)
+                                            await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
                                     });
                                 }
                                 else {
@@ -481,18 +531,18 @@ function createBucketProvisionerPlugin(options) {
                                         // allowed_origins not being changed, nothing to do
                                         return result;
                                     }
+                                    if (!codecSchemaName || !codecTableName) {
+                                        throw new Error(`CORS update failed for "${fieldName}": codec ${pgCodec.name} carries no pg schema/table identity`);
+                                    }
                                     await withPgClient(pgSettings, async (pgClient) => {
                                         const databaseId = await resolveDatabaseId(pgClient);
                                         if (!databaseId) {
                                             log.warn('CORS update skipped: could not resolve database_id');
                                             return;
                                         }
-                                        // Read the storage module config (app-level; auto-hook doesn't have ownerId context)
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (!storageModule) {
-                                            log.warn('CORS update skipped: storage module not provisioned');
-                                            return;
-                                        }
+                                        // The mutated table names its module — CORS applies to the
+                                        // plane whose row was updated.
+                                        const storageModule = await resolveStorageModuleByBucketsTable(pgClient, databaseId, codecSchemaName, codecTableName);
                                         // We need the bucket key — it may come from input or patch
                                         // For updates, PostGraphile uses nodeId or the row's PK, so
                                         // we read the bucket from the patch's key or from the nodeId
@@ -517,7 +567,7 @@ function createBucketProvisionerPlugin(options) {
                                         // never provisioned there is nothing to update yet, so mint the
                                         // conventional name the first provision would use.
                                         const recorded = storedPhysicalName(bucket);
-                                        await updateBucketCors(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
+                                        await updateBucketCors(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
                                             ? resolveBucketName(bucket.key, databaseId, options)
                                             : recorded);
                                     });