graphile-bucket-provisioner-plugin 1.13.0 → 1.14.1

package/README.md

@@ -12,19 +12,16 @@
    <a href="https://www.npmjs.com/package/graphile-bucket-provisioner-plugin"><img height="20" src="https://img.shields.io/github/package-json/v/constructive-io/constructive?filename=graphile%2Fgraphile-bucket-provisioner-plugin%2Fpackage.json"/></a>
 </p>
 
-PostGraphile v5 plugin that automatically provisions S3-compatible buckets when bucket rows are created in the database. Wraps bucket creation mutations to call [`@constructive-io/bucket-provisioner`](../packages/bucket-provisioner) after the database row is inserted.
+PostGraphile v5 plugin that explicitly provisions S3-compatible buckets through a GraphQL mutation using [`@constructive-io/bucket-provisioner`](../packages/bucket-provisioner).
 
 ## Features
 
-- **Auto-provisioning hook** — Wraps `create*` mutations on tables tagged with `@storageBuckets` to automatically provision S3 buckets after row creation
-- **CORS update hook** — Wraps `update*` mutations to detect `allowed_origins` changes and re-apply CORS rules to the S3 bucket
+- **Explicit `provisionBucket` mutation** — GraphQL mutation for manual/retry provisioning of any bucket
 - **3-tier CORS resolution** — Bucket-level `allowed_origins` → storage module-level `allowed_origins` → plugin config `allowedOrigins`
 - **Wildcard CORS** — Set `allowed_origins = ['*']` on a bucket for fully open CDN/public deployments
-- **Explicit `provisionBucket` mutation** — GraphQL mutation for manual/retry provisioning of any bucket
 - **Per-database overrides** — Reads `endpoint`, `provider`, `public_url_prefix`, and `allowed_origins` from the `storage_module` table for multi-tenant setups
 - **Lazy S3 config** — Connection config can be a function (evaluated once, cached) to avoid eager env-var reads at import time
-- **Graceful error handling** — Provisioning and CORS update failures are logged but never fail the mutation (admin can retry via `provisionBucket`)
-- **Custom bucket naming** — Supports prefix-based naming or a fully custom `resolveBucketName` function
+- **Deployment-controlled naming** — Requires a `resolveBucketName` policy for tenant-aware physical bucket names
 
 ## Installation
 
@@ -120,10 +117,8 @@ Creates the plugin instance. Returns a `GraphileConfig.Plugin`.
 |--------|------|-------------|
 | `connection` | `StorageConnectionConfig \| () => StorageConnectionConfig` | S3 connection config (static or lazy getter) |
 | `allowedOrigins` | `string[]` | CORS allowed origins for bucket configuration |
-| `bucketNamePrefix` | `string?` | Prefix for S3 bucket names (e.g., `"myapp"` → `"myapp-public"`) |
-| `resolveBucketName` | `(bucketKey, databaseId) => string` | Custom bucket name resolver (takes precedence over prefix) |
+| `resolveBucketName` | `(databaseId, bucketKey) => string` | Deployment policy for deriving a tenant-aware physical bucket name |
 | `versioning` | `boolean?` | Enable S3 versioning on provisioned buckets (default: `false`) |
-| `autoProvision` | `boolean?` | Enable auto-provisioning hook on create mutations (default: `true`) |
 
 ### `BucketProvisionerPreset(options)`
 

package/esm/index.d.ts

@@ -1,13 +1,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -31,7 +25,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/index.js

@@ -1,13 +1,7 @@
 /**
  * Bucket Provisioner Plugin for PostGraphile v5
  *
- * Provides automatic S3 bucket provisioning for PostGraphile v5.
- * When bucket rows are created via GraphQL mutations, this plugin
- * automatically provisions the corresponding S3 bucket with the
- * correct privacy policies, CORS rules, and lifecycle settings.
- *
- * Also provides an explicit `provisionBucket` mutation for manual
- * provisioning or re-provisioning of S3 buckets.
+ * Provides an explicit `provisionBucket` mutation for PostGraphile v5.
  *
  * @example
  * ```typescript
@@ -31,7 +25,6 @@
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/plugin.d.ts

@@ -7,21 +7,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -35,16 +21,12 @@ import type { BucketProvisionerPluginOptions } from './types';
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 export declare function createBucketProvisionerPlugin(options: BucketProvisionerPluginOptions): GraphileConfig.Plugin;

package/esm/plugin.js

@@ -7,21 +7,7 @@
  *    logical bucket row in the database. Reads the bucket config via RLS,
  *    then calls BucketProvisioner to create and configure the S3 bucket.
  *
- * 2. Auto-provisioning hook — wraps `create*` mutations on tables tagged
- *    with `@storageBuckets` to automatically provision the S3 bucket after
- *    the database row is created.
- *
- * 3. CORS update hook — wraps `update*` mutations on `@storageBuckets` tables
- *    to detect changes to `allowed_origins` and re-apply CORS rules to the
- *    S3 bucket.
- *
- * CORS resolution hierarchy (most specific wins):
- *   1. Bucket-level `allowed_origins` column (per-bucket override)
- *   2. Storage-module-level `allowed_origins` column (per-database default)
- *   3. Plugin config `allowedOrigins` (global fallback)
- * Supports `['*']` for open/CDN mode (wildcard CORS).
- *
- * Both pathways use `@constructive-io/bucket-provisioner` for the actual
+ * This plugin uses `@constructive-io/bucket-provisioner` for the actual
  * S3 operations (bucket creation, Block Public Access, CORS, policies,
  * versioning, lifecycle rules).
  *
@@ -34,32 +20,13 @@ import { BucketProvisioner, } from '@constructive-io/bucket-provisioner';
 import { Logger } from '@pgpmjs/logger';
 import { QuoteUtils } from '@pgsql/quotes';
 import { context as grafastContext, lambda, object } from 'grafast';
+import { recordPhysicalName as recordPhysicalBucketName } from 'graphile-storage-registry';
 import { extendSchema, gql } from 'graphile-utils';
 const log = new Logger('graphile-bucket-provisioner:plugin');
 // --- Storage module queries ---
 /**
- * Resolve the app-level storage module (scope = 'app').
- */
-const APP_STORAGE_MODULE_QUERY = `
-  SELECT
-    sm.id,
-    sm.scope,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    sm.endpoint,
-    sm.public_url_prefix,
-    sm.provider,
-    sm.allowed_origins
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  WHERE sm.database_id = $1
-    AND sm.scope = 'app'
-  LIMIT 1
-`;
-/**
- * Resolve ALL storage modules for a database (for ownerId-based resolution).
+ * Resolve ALL storage modules for a database (for bucket-key and ownerId-based
+ * resolution in the explicit provisionBucket mutation).
  */
 const ALL_STORAGE_MODULES_QUERY = `
   SELECT
@@ -93,28 +60,58 @@ function runQuery(pgClient, text, values) {
     return pgClient.query(values === undefined ? { text } : { text, values });
 }
 /**
- * Resolve the storage module for a given scope.
- * If ownerId is provided, probes entity tables to find the matching module.
- * Otherwise, returns the app-level module.
+ * The explicit provisionBucket mutation's resolution: find the plane that
+ * actually holds the named bucket row.
+ *
+ * With an ownerId, the owning entity row names the plane (probed through each
+ * entity-keyed module's recorded entity table). Without one, every
+ * non-entity-keyed plane's buckets table is probed for the key under RLS —
+ * exactly one plane may hold it; several is ambiguous and throws rather than
+ * silently picking.
  */
-async function resolveStorageModule(pgClient, databaseId, ownerId) {
-    if (!ownerId) {
-        // App-level resolution
-        const result = await runQuery(pgClient, APP_STORAGE_MODULE_QUERY, [databaseId]);
-        return result.rows[0] ?? null;
-    }
-    // Entity-scoped: load all modules and probe entity tables
+async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
     const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY, [databaseId]);
     const modules = result.rows;
-    const entityModules = modules.filter((m) => m.entity_schema && m.entity_table);
-    for (const mod of entityModules) {
-        const entityTable = QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
-        const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
-        if (probe.rows.length > 0) {
-            return mod;
+    if (modules.length === 0) {
+        throw new Error(`STORAGE_MODULE_NOT_PROVISIONED: database ${databaseId} has no storage modules`);
+    }
+    if (ownerId) {
+        const entityModules = modules.filter((m) => m.entity_table_id !== null && m.entity_schema && m.entity_table);
+        for (const mod of entityModules) {
+            const entityTable = QuoteUtils.quoteQualifiedIdentifier(mod.entity_schema, mod.entity_table);
+            const probe = await runQuery(pgClient, `SELECT 1 FROM ${entityTable} WHERE id = $1 LIMIT 1`, [ownerId]);
+            if (probe.rows.length === 0)
+                continue;
+            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+            const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+         FROM ${bucketsTable}
+         WHERE key = $1 AND owner_id = $2
+         LIMIT 1`, [bucketKey, ownerId]);
+            if (bucketResult.rows.length === 0)
+                return null;
+            return { storageModule: mod, bucket: bucketResult.rows[0] };
+        }
+        return null;
+    }
+    const matches = [];
+    for (const mod of modules.filter((m) => m.entity_table_id === null)) {
+        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(mod.buckets_schema, mod.buckets_table);
+        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
+       FROM ${bucketsTable}
+       WHERE key = $1
+       LIMIT 1`, [bucketKey]);
+        if (bucketResult.rows.length > 0) {
+            matches.push({ storageModule: mod, bucket: bucketResult.rows[0] });
         }
     }
-    return null;
+    if (matches.length === 0)
+        return null;
+    if (matches.length > 1) {
+        const scopes = matches.map((m) => `'${m.storageModule.scope}'`).join(', ');
+        throw new Error(`BUCKET_KEY_AMBIGUOUS: bucket key "${bucketKey}" exists in ${matches.length} storage planes ` +
+            `(scopes ${scopes}); provide an ownerId or use a plane-unique key`);
+    }
+    return matches[0];
 }
 /**
  * Normalize the recorded physical coordinate at the DB boundary.
@@ -127,17 +124,6 @@ async function resolveStorageModule(pgClient, databaseId, ownerId) {
 function storedPhysicalName(row) {
     return row.physical_name == null ? null : row.physical_name;
 }
-/**
- * Record the physical S3 bucket name on the source bucket row.
- *
- * Runs in the system lane (`withPgClient(null, ...)`) — server bookkeeping,
- * RLS-independent. Idempotent via the `physical_name IS NULL` guard so a
- * re-provision never clobbers an already-recorded coordinate.
- */
-async function recordPhysicalName(withPgClient, bucketsTable, bucketId, physicalName) {
-    await withPgClient(null, (client) => runQuery(client, `UPDATE ${bucketsTable} SET physical_name = $1 WHERE id = $2 AND physical_name IS NULL`, [physicalName, bucketId]));
-    log.info(`Recorded physical_name="${physicalName}" on bucket ${bucketId}`);
-}
 // --- Helpers ---
 /**
  * Resolve the connection config from the options. If the option is a lazy
@@ -155,14 +141,14 @@ function resolveConnection(options) {
 /**
  * Resolve the S3 bucket name from a logical bucket key.
  */
-function resolveBucketName(bucketKey, databaseId, options) {
-    if (options.resolveBucketName) {
-        return options.resolveBucketName(bucketKey, databaseId);
+function resolveBucketName(databaseId, bucketKey, options) {
+    if (!options.resolveBucketName) {
+        throw new Error('STORAGE_BUCKET_NAME_POLICY_MISSING: no resolveBucketName was configured, so there is ' +
+            `no name to provision for bucket "${bucketKey}" of database ${databaseId}. ` +
+            'Physical bucket naming is a deployment policy; the configured s3.bucket is a ' +
+            'connection default and is never a tenant bucket.');
     }
-    if (options.bucketNamePrefix) {
-        return `${options.bucketNamePrefix}-${bucketKey}`;
-    }
-    return bucketKey;
+    return options.resolveBucketName(databaseId, bucketKey);
 }
 /**
  * Resolve the database_id from the JWT context.
@@ -204,13 +190,10 @@ function buildProvisioner(options, storageModule, effectiveOrigins) {
     });
 }
 /**
- * Core provisioning logic shared by both the explicit mutation and the
- * auto-provisioning hook.
+ * Core provisioning logic for the explicit mutation.
  */
-async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
+async function provisionBucketForRow(storageModule, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
     const accessType = bucketType;
-    // Read storage module config to check for endpoint/provider/CORS overrides
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
     // Resolve CORS origins using the 3-tier hierarchy
     const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
     const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
@@ -227,41 +210,19 @@ async function provisionBucketForRow(pgClient, databaseId, bucketKey, bucketType
         `(provider=${result.provider}, blockPublicAccess=${result.blockPublicAccess})`);
     return result;
 }
-/**
- * Update CORS on an existing S3 bucket when allowed_origins changes.
- */
-async function updateBucketCors(pgClient, databaseId, bucketKey, bucketType, bucketAllowedOrigins, options, s3BucketName) {
-    const accessType = bucketType;
-    const storageModule = await resolveStorageModule(pgClient, databaseId);
-    const effectiveOrigins = resolveAllowedOrigins(bucketAllowedOrigins, storageModule?.allowed_origins, options.allowedOrigins);
-    const provisioner = buildProvisioner(options, storageModule, effectiveOrigins);
-    log.info(`Updating CORS on S3 bucket "${s3BucketName}" ` +
-        `(origins=${JSON.stringify(effectiveOrigins)}) for database ${databaseId}`);
-    await provisioner.updateCors({
-        bucketName: s3BucketName,
-        accessType,
-        allowedOrigins: effectiveOrigins,
-    });
-    log.info(`Successfully updated CORS on S3 bucket "${s3BucketName}"`);
-}
 // --- Plugin factory ---
 /**
  * Creates the bucket provisioner plugin.
  *
- * This plugin provides two provisioning pathways:
+ * This plugin provides one provisioning pathway:
  *
  * 1. **Explicit `provisionBucket` mutation** — Call this mutation with a
  *    bucket key to provision (or re-provision) the S3 bucket. Protected
  *    by RLS on the buckets table.
  *
- * 2. **Auto-provisioning hook** — When `autoProvision` is true (default),
- *    wraps `create*` mutation resolvers on tables tagged with `@storageBuckets`
- *    to automatically provision the S3 bucket after the row is created.
- *
  * @param options - Plugin configuration (S3 credentials, CORS origins, naming)
  */
 export function createBucketProvisionerPlugin(options) {
-    const autoProvision = options.autoProvision ?? true;
     // The extendSchema plugin adds the explicit provisionBucket mutation
     const mutationPlugin = extendSchema(() => ({
         typeDefs: gql `
@@ -324,39 +285,25 @@ export function createBucketProvisionerPlugin(options) {
                             if (!databaseId) {
                                 throw new Error('DATABASE_NOT_FOUND');
                             }
-                            // Resolve storage module (app-level or entity-scoped via ownerId)
-                            const storageModule = await resolveStorageModule(pgClient, databaseId, ownerId);
-                            if (!storageModule) {
-                                throw new Error(ownerId
-                                    ? 'STORAGE_MODULE_NOT_FOUND_FOR_OWNER: no storage module found for the given ownerId'
-                                    : 'STORAGE_MODULE_NOT_PROVISIONED');
-                            }
-                            // Look up the bucket row (RLS enforced via pgSettings)
-                            const hasOwner = ownerId && storageModule.scope !== 'app';
-                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                            const bucketResult = await runQuery(pgClient, hasOwner
-                                ? `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1 AND owner_id = $2
-                     LIMIT 1`
-                                : `SELECT id, key, type, is_public, allowed_origins, physical_name
-                     FROM ${bucketsTable}
-                     WHERE key = $1
-                     LIMIT 1`, hasOwner ? [bucketKey, ownerId] : [bucketKey]);
-                            if (bucketResult.rows.length === 0) {
+                            // Resolve the plane that actually holds the named bucket row
+                            // (RLS enforced via pgSettings) — never a guessed scope.
+                            const resolution = await resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId);
+                            if (!resolution) {
                                 throw new Error('BUCKET_NOT_FOUND');
                             }
-                            const bucket = bucketResult.rows[0];
+                            const { storageModule, bucket } = resolution;
+                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
                             // First provision mints a name; afterwards the stored coordinate
                             // is authoritative and the naming hook is never consulted again.
                             const recorded = storedPhysicalName(bucket);
                             const s3BucketName = recorded === null
-                                ? resolveBucketName(bucket.key, databaseId, options)
+                                ? resolveBucketName(databaseId, bucket.key, options)
                                 : recorded;
                             try {
-                                const result = await provisionBucketForRow(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
+                                const result = await provisionBucketForRow(storageModule, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, s3BucketName);
                                 // Record the exact provisioned name on the source row.
-                                await recordPhysicalName(withPgClient, bucketsTable, bucket.id, result.bucketName);
+                                await withPgClient(null, (client) => recordPhysicalBucketName((query) => runQuery(client, query.text, query.values), bucketsTable, bucket.id, result.bucketName));
+                                log.info(`Recorded physical_name="${result.bucketName}" on bucket ${bucket.id}`);
                                 return {
                                     success: true,
                                     bucketName: result.bucketName,
@@ -383,155 +330,7 @@ export function createBucketProvisionerPlugin(options) {
             },
         },
     }));
-    // If autoProvision is disabled, return only the mutation plugin
-    if (!autoProvision) {
-        return mutationPlugin;
-    }
-    // Build a composite plugin that includes both the mutation and the hook
-    return {
-        ...mutationPlugin,
-        name: 'BucketProvisionerPlugin',
-        version: '0.1.0',
-        description: 'Auto-provisions S3 buckets when bucket rows are created, ' +
-            'updates CORS when allowed_origins changes on update, ' +
-            'and provides a provisionBucket mutation for explicit provisioning',
-        after: ['PgAttributesPlugin', 'PgMutationCreatePlugin', 'PgMutationUpdateDeletePlugin'],
-        schema: {
-            ...mutationPlugin.schema,
-            hooks: {
-                ...(mutationPlugin.schema?.hooks ?? {}),
-                /**
-                 * Wrap create and update mutation resolvers on tables tagged with @storageBuckets.
-                 *
-                 * - create*: After the row is created, provision the S3 bucket.
-                 * - update*: After the row is updated, re-apply CORS if allowed_origins changed.
-                 *
-                 * If provisioning/CORS update fails, the DB row still exists (the mutation
-                 * already committed), and the error is logged. Admin can retry via provisionBucket.
-                 */
-                GraphQLObjectType_fields_field(field, build, context) {
-                    const { scope: { isRootMutation, fieldName, pgCodec }, } = context;
-                    // Only wrap root mutation fields
-                    if (!isRootMutation || !pgCodec || !pgCodec.attributes) {
-                        return field;
-                    }
-                    // Check for @storageBuckets smart tag
-                    const tags = pgCodec.extensions?.tags;
-                    if (!tags?.storageBuckets) {
-                        return field;
-                    }
-                    const isCreate = fieldName.startsWith('create');
-                    const isUpdate = fieldName.startsWith('update');
-                    // Only wrap create and update mutations (not delete)
-                    if (!isCreate && !isUpdate) {
-                        return field;
-                    }
-                    log.debug(`Wrapping mutation "${fieldName}" for ${isCreate ? 'auto-provisioning' : 'CORS update'} (codec: ${pgCodec.name})`);
-                    const defaultResolver = (obj) => obj[fieldName];
-                    const { resolve: oldResolve = defaultResolver, ...rest } = field;
-                    return {
-                        ...rest,
-                        async resolve(source, args, graphqlContext, info) {
-                            // Call the original resolver first (creates/updates the DB row)
-                            const result = await oldResolve(source, args, graphqlContext, info);
-                            try {
-                                const inputKey = Object.keys(args.input || {}).find((k) => k !== 'clientMutationId');
-                                const bucketInput = inputKey ? args.input[inputKey] : null;
-                                const withPgClient = graphqlContext.withPgClient;
-                                const pgSettings = graphqlContext.pgSettings;
-                                if (!withPgClient) {
-                                    log.warn(`${isCreate ? 'Auto-provision' : 'CORS update'} skipped: withPgClient not available in context`);
-                                    return result;
-                                }
-                                if (isCreate) {
-                                    // --- CREATE: full provisioning ---
-                                    if (!bucketInput?.key || !bucketInput?.type) {
-                                        log.warn(`Auto-provision skipped for "${fieldName}": ` +
-                                            `could not extract key/type from mutation input`);
-                                        return result;
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('Auto-provision skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // Newly-created row has no stored coordinate yet — mint on first provision.
-                                        const result = await provisionBucketForRow(pgClient, databaseId, bucketInput.key, bucketInput.type, bucketInput.allowedOrigins ?? bucketInput.allowed_origins ?? null, options, resolveBucketName(bucketInput.key, databaseId, options));
-                                        // Record the provisioned name on the just-created row.
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (storageModule) {
-                                            const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                            const idResult = await runQuery(pgClient, `SELECT id FROM ${bucketsTable} WHERE key = $1 LIMIT 1`, [bucketInput.key]);
-                                            const bucketId = idResult.rows[0]?.id;
-                                            if (bucketId)
-                                                await recordPhysicalName(withPgClient, bucketsTable, bucketId, result.bucketName);
-                                        }
-                                    });
-                                }
-                                else {
-                                    // --- UPDATE: re-apply CORS if allowed_origins is in the patch ---
-                                    const hasOriginsUpdate = bucketInput &&
-                                        ('allowedOrigins' in bucketInput || 'allowed_origins' in bucketInput);
-                                    if (!hasOriginsUpdate) {
-                                        // allowed_origins not being changed, nothing to do
-                                        return result;
-                                    }
-                                    await withPgClient(pgSettings, async (pgClient) => {
-                                        const databaseId = await resolveDatabaseId(pgClient);
-                                        if (!databaseId) {
-                                            log.warn('CORS update skipped: could not resolve database_id');
-                                            return;
-                                        }
-                                        // Read the storage module config (app-level; auto-hook doesn't have ownerId context)
-                                        const storageModule = await resolveStorageModule(pgClient, databaseId);
-                                        if (!storageModule) {
-                                            log.warn('CORS update skipped: storage module not provisioned');
-                                            return;
-                                        }
-                                        // We need the bucket key — it may come from input or patch
-                                        // For updates, PostGraphile uses nodeId or the row's PK, so
-                                        // we read the bucket from the patch's key or from the nodeId
-                                        const patchKey = bucketInput?.key;
-                                        if (!patchKey) {
-                                            log.warn(`CORS update skipped for "${fieldName}": ` +
-                                                `could not determine bucket key from mutation input`);
-                                            return;
-                                        }
-                                        // Read the full bucket row (post-update) to get type + origins
-                                        const bucketsTable = QuoteUtils.quoteQualifiedIdentifier(storageModule.buckets_schema, storageModule.buckets_table);
-                                        const bucketResult = await runQuery(pgClient, `SELECT id, key, type, is_public, allowed_origins, physical_name
-                       FROM ${bucketsTable}
-                       WHERE key = $1
-                       LIMIT 1`, [patchKey]);
-                                        if (bucketResult.rows.length === 0) {
-                                            log.warn(`CORS update skipped: bucket "${patchKey}" not found`);
-                                            return;
-                                        }
-                                        const bucket = bucketResult.rows[0];
-                                        // CORS applies to the recorded physical bucket; if the row was
-                                        // never provisioned there is nothing to update yet, so mint the
-                                        // conventional name the first provision would use.
-                                        const recorded = storedPhysicalName(bucket);
-                                        await updateBucketCors(pgClient, databaseId, bucket.key, bucket.type, bucket.allowed_origins, options, recorded === null
-                                            ? resolveBucketName(bucket.key, databaseId, options)
-                                            : recorded);
-                                    });
-                                }
-                            }
-                            catch (err) {
-                                log.error(`${isCreate ? 'Auto-provision' : 'CORS update'} failed for "${fieldName}": ${err.message}. ` +
-                                    (isCreate
-                                        ? `The bucket row was created but the S3 bucket was not provisioned. Use the provisionBucket mutation to retry.`
-                                        : `The bucket row was updated but CORS was not applied to the S3 bucket. Use the provisionBucket mutation to retry.`));
-                            }
-                            return result;
-                        },
-                    };
-                },
-            },
-        },
-    };
+    return mutationPlugin;
 }
 export const BucketProvisionerPlugin = createBucketProvisionerPlugin;
 export default BucketProvisionerPlugin;

package/esm/preset.d.ts

@@ -31,7 +31,6 @@ import type { BucketProvisionerPluginOptions } from './types';
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/preset.js

@@ -30,7 +30,6 @@ import { createBucketProvisionerPlugin } from './plugin';
  *     BucketProvisionerPreset({
  *       connection: getConnection, // pass function ref, NOT getConnection()
  *       allowedOrigins: ['https://app.example.com'],
- *       bucketNamePrefix: 'myapp',
  *     }),
  *   ],
  * };

package/esm/types.d.ts

@@ -1,9 +1,5 @@
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 import type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider } from '@constructive-io/bucket-provisioner';
 export type { BucketAccessType, ProvisionResult, StorageConnectionConfig, StorageProvider };
@@ -18,11 +14,11 @@ export type ConnectionConfigOrGetter = StorageConnectionConfig | (() => StorageC
 /**
  * Function to derive the actual S3 bucket name from a logical bucket key.
  *
- * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @param databaseId - The metaschema database UUID
+ * @param bucketKey - The logical bucket key from the database (e.g., "public", "private")
  * @returns The S3 bucket name to create/configure
  */
-export type BucketNameResolver = (bucketKey: string, databaseId: string) => string;
+export type BucketNameResolver = (databaseId: string, bucketKey: string) => string;
 /**
  * Plugin options for the bucket provisioner plugin.
  */
@@ -38,15 +34,9 @@ export interface BucketProvisionerPluginOptions {
      * Required for browser-based presigned URL uploads.
      */
     allowedOrigins: string[];
-    /**
-     * Optional prefix for S3 bucket names.
-     * When set, the S3 bucket name becomes `{prefix}-{bucketKey}`.
-     * Example: prefix "myapp" + key "public" → S3 bucket "myapp-public"
-     */
-    bucketNamePrefix?: string;
     /**
      * Optional custom function to derive S3 bucket names from logical bucket keys.
-     * Takes precedence over `bucketNamePrefix` when provided.
+     * Naming is a deployment policy and must be supplied by the caller.
      */
     resolveBucketName?: BucketNameResolver;
     /**
@@ -54,15 +44,6 @@ export interface BucketProvisionerPluginOptions {
      * Default: false
      */
     versioning?: boolean;
-    /**
-     * Whether to auto-provision S3 buckets when bucket rows are created
-     * via GraphQL mutations. When true, the plugin wraps create mutations
-     * on tables tagged with `@storageBuckets` to trigger provisioning
-     * after the mutation succeeds.
-     *
-     * Default: true
-     */
-    autoProvision?: boolean;
 }
 /**
  * Input for the provisionBucket mutation.

package/esm/types.js

@@ -1,8 +1,4 @@
 /**
  * Types for the bucket provisioner plugin.
- *
- * Defines plugin options, connection configuration, and provisioning result
- * types used by the Graphile plugin to auto-provision S3 buckets when
- * bucket rows are created via GraphQL mutations.
  */
 export {};