graphile-bucket-provisioner-plugin 1.17.1 → 1.18.1

package/esm/plugin.js

@@ -21,24 +21,7 @@ import { extendSchema, gql } from 'graphile-utils';
  * resolution in the explicit provisionBucket mutation).
  */
 const ALL_STORAGE_MODULES_QUERY = `
-  SELECT
-    sm.id,
-    sm.database_id,
-    sm.buckets_table_id,
-    sm.scope,
-    sm.entity_field,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    sm.allowed_origins,
-    es.schema_name AS entity_schema,
-    et.name AS entity_table
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  LEFT JOIN metaschema_public.table et ON et.id = sm.entity_table_id
-  LEFT JOIN metaschema_public.schema es ON es.id = et.schema_id
-  WHERE sm.database_id = $1
+  SELECT * FROM function_resolution.storage_modules()
 `;
 /**
  * Run a query against a grafast `withPgClient` client.
@@ -73,7 +56,7 @@ function scopeKeyColumn(storageModule) {
  * silently picking.
  */
 async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
-    const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY, [databaseId]);
+    const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY);
     const modules = result.rows;
     if (modules.length === 0) {
         throw new Error(`STORAGE_MODULE_NOT_PROVISIONED: database ${databaseId} has no storage modules`);
@@ -124,81 +107,15 @@ async function resolveDatabaseId(pgClient) {
     const result = await runQuery(pgClient, `SELECT jwt_private.current_database_id() AS id`);
     return result.rows[0]?.id ?? null;
 }
-async function resolveEntityContext(pgClient, storageModule) {
-    const result = await runQuery(pgClient, `SELECT r.entity_type, r.get_org_fn_schema, r.get_org_fn
-     FROM metaschema.resolve_entity_context_by_field($1::uuid, $2::uuid, $3::text) r`, [storageModule.database_id, storageModule.buckets_table_id, storageModule.entity_field]);
-    return result.rows[0] ?? {
-        entity_type: null,
-        get_org_fn_schema: null,
-        get_org_fn: null,
-    };
-}
 /**
- * Mirror the storage module generator's data_job_trigger shape from
- * `packages/metaschema-generators/deploy/schemas/metaschema_generators/procedures/storage_module.sql`
- * and the add_job argument assembly in
- * `packages/ast-plpgsql/deploy/schemas/ast_plpgsql_helpers/procedures/triggers/job_trigger.sql`.
- * A callable enqueue function beside the trigger would be the durable fix for
- * this deliberate mirroring, but is out of scope here.
- *
- * The three scope shapes differ only in the payload entries and the identity
- * arguments, so those are the only parts a caller supplies — the identifier,
- * queue, retry, and priority policy exist exactly once.
+ * Enqueue reconciliation through the storage module's generated
+ * `<private>.<buckets>_provision(bucket_id)`. It runs as the request role: it
+ * locks the bucket row FOR UPDATE under the buckets table's own RLS, then
+ * enqueues exactly the job the buckets INSERT trigger does.
  */
-function addJobStatement(payloadEntries, identityArgs) {
-    return `SELECT (app_jobs.add_job(
-      identifier => 'storage:provision_bucket',
-      payload => json_build_object(${payloadEntries}),
-      queue_name => 'bucket:' || $1::text,
-      max_attempts => 25,
-      priority => 0${identityArgs}
-    )).id AS id`;
-}
 async function enqueueReconciliationJob(pgClient, storageModule, bucket) {
-    const scope = storageModule.scope;
-    const entityField = storageModule.entity_field;
-    let text;
-    let values;
-    if (entityField === null) {
-        text = addJobStatement(`'id', $1::uuid,
-        'scope', $2::text`, '');
-        values = [bucket.id, scope];
-    }
-    else if (entityField === 'database_id') {
-        const databaseId = bucket.scope_key;
-        if (!databaseId) {
-            throw new Error(`STORAGE_BUCKET_SCOPE_KEY_MISSING: bucket ${bucket.id} has no database_id`);
-        }
-        text = addJobStatement(`'database_id', $2::uuid,
-        'id', $1::uuid,
-        'scope', $3::text`, `,
-      db_id => $2,
-      entity_id => $2,
-      organization_id => NULL,
-      entity_type => $3`);
-        values = [bucket.id, databaseId, scope];
-    }
-    else if (entityField === 'owner_id') {
-        const ownerId = bucket.scope_key;
-        if (!ownerId) {
-            throw new Error(`STORAGE_BUCKET_SCOPE_KEY_MISSING: bucket ${bucket.id} has no owner_id`);
-        }
-        const context = await resolveEntityContext(pgClient, storageModule);
-        const orgFunction = context.get_org_fn_schema && context.get_org_fn
-            ? `${QuoteUtils.quoteQualifiedIdentifier(context.get_org_fn_schema, context.get_org_fn)}($3::text, $2::uuid)`
-            : 'NULL';
-        text = addJobStatement(`'id', $1::uuid,
-        'owner_id', $2::uuid,
-        'scope', $3::text`, `,
-      entity_id => $2,
-      organization_id => ${orgFunction},
-      entity_type => $3`);
-        values = [bucket.id, ownerId, scope];
-    }
-    else {
-        throw new Error(`STORAGE_BUCKET_ENTITY_FIELD_UNSUPPORTED: ${entityField}`);
-    }
-    const result = await runQuery(pgClient, text, values);
+    const provisionFunction = QuoteUtils.quoteQualifiedIdentifier(storageModule.private_schema, `${storageModule.buckets_table}_provision`);
+    const result = await runQuery(pgClient, `SELECT ${provisionFunction}($1::uuid) AS id`, [bucket.id]);
     const jobId = result.rows[0]?.id;
     if (!jobId) {
         throw new Error(`STORAGE_BUCKET_JOB_ID_MISSING: bucket ${bucket.id}`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-bucket-provisioner-plugin",
-  "version": "1.17.1",
+  "version": "1.18.1",
   "description": "Bucket provisioning plugin for PostGraphile v5 — explicitly provisions S3 buckets via a GraphQL mutation",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -40,10 +40,10 @@
     "url": "https://github.com/constructive-io/constructive/issues"
   },
   "dependencies": {
-    "@constructive-io/bucket-provisioner": "^0.30.1",
-    "@pgpmjs/logger": "^2.26.0",
+    "@constructive-io/bucket-provisioner": "^0.31.0",
+    "@pgpmjs/logger": "^2.27.0",
     "@pgsql/quotes": "^18.2.4",
-    "graphile-storage-registry": "^0.2.0"
+    "graphile-storage-registry": "^0.3.0"
   },
   "peerDependencies": {
     "grafast": "^1.1.1",
@@ -58,5 +58,5 @@
     "@types/node": "^22.19.11",
     "makage": "^0.8.0"
   },
-  "gitHead": "8227c782c98281f7185d257a7f716fbffdcc45c2"
+  "gitHead": "0b4ffa11a6d7958ba1068ce8e19616d4b018c0d6"
 }

package/plugin.js

@@ -25,24 +25,7 @@ const graphile_utils_1 = require("graphile-utils");
  * resolution in the explicit provisionBucket mutation).
  */
 const ALL_STORAGE_MODULES_QUERY = `
-  SELECT
-    sm.id,
-    sm.database_id,
-    sm.buckets_table_id,
-    sm.scope,
-    sm.entity_field,
-    sm.entity_table_id,
-    bs.schema_name AS buckets_schema,
-    bt.name AS buckets_table,
-    sm.allowed_origins,
-    es.schema_name AS entity_schema,
-    et.name AS entity_table
-  FROM metaschema_modules_public.storage_module sm
-  JOIN metaschema_public.table bt ON bt.id = sm.buckets_table_id
-  JOIN metaschema_public.schema bs ON bs.id = bt.schema_id
-  LEFT JOIN metaschema_public.table et ON et.id = sm.entity_table_id
-  LEFT JOIN metaschema_public.schema es ON es.id = et.schema_id
-  WHERE sm.database_id = $1
+  SELECT * FROM function_resolution.storage_modules()
 `;
 /**
  * Run a query against a grafast `withPgClient` client.
@@ -77,7 +60,7 @@ function scopeKeyColumn(storageModule) {
  * silently picking.
  */
 async function resolveBucketByKey(pgClient, databaseId, bucketKey, ownerId) {
-    const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY, [databaseId]);
+    const result = await runQuery(pgClient, ALL_STORAGE_MODULES_QUERY);
     const modules = result.rows;
     if (modules.length === 0) {
         throw new Error(`STORAGE_MODULE_NOT_PROVISIONED: database ${databaseId} has no storage modules`);
@@ -128,81 +111,15 @@ async function resolveDatabaseId(pgClient) {
     const result = await runQuery(pgClient, `SELECT jwt_private.current_database_id() AS id`);
     return result.rows[0]?.id ?? null;
 }
-async function resolveEntityContext(pgClient, storageModule) {
-    const result = await runQuery(pgClient, `SELECT r.entity_type, r.get_org_fn_schema, r.get_org_fn
-     FROM metaschema.resolve_entity_context_by_field($1::uuid, $2::uuid, $3::text) r`, [storageModule.database_id, storageModule.buckets_table_id, storageModule.entity_field]);
-    return result.rows[0] ?? {
-        entity_type: null,
-        get_org_fn_schema: null,
-        get_org_fn: null,
-    };
-}
 /**
- * Mirror the storage module generator's data_job_trigger shape from
- * `packages/metaschema-generators/deploy/schemas/metaschema_generators/procedures/storage_module.sql`
- * and the add_job argument assembly in
- * `packages/ast-plpgsql/deploy/schemas/ast_plpgsql_helpers/procedures/triggers/job_trigger.sql`.
- * A callable enqueue function beside the trigger would be the durable fix for
- * this deliberate mirroring, but is out of scope here.
- *
- * The three scope shapes differ only in the payload entries and the identity
- * arguments, so those are the only parts a caller supplies — the identifier,
- * queue, retry, and priority policy exist exactly once.
+ * Enqueue reconciliation through the storage module's generated
+ * `<private>.<buckets>_provision(bucket_id)`. It runs as the request role: it
+ * locks the bucket row FOR UPDATE under the buckets table's own RLS, then
+ * enqueues exactly the job the buckets INSERT trigger does.
  */
-function addJobStatement(payloadEntries, identityArgs) {
-    return `SELECT (app_jobs.add_job(
-      identifier => 'storage:provision_bucket',
-      payload => json_build_object(${payloadEntries}),
-      queue_name => 'bucket:' || $1::text,
-      max_attempts => 25,
-      priority => 0${identityArgs}
-    )).id AS id`;
-}
 async function enqueueReconciliationJob(pgClient, storageModule, bucket) {
-    const scope = storageModule.scope;
-    const entityField = storageModule.entity_field;
-    let text;
-    let values;
-    if (entityField === null) {
-        text = addJobStatement(`'id', $1::uuid,
-        'scope', $2::text`, '');
-        values = [bucket.id, scope];
-    }
-    else if (entityField === 'database_id') {
-        const databaseId = bucket.scope_key;
-        if (!databaseId) {
-            throw new Error(`STORAGE_BUCKET_SCOPE_KEY_MISSING: bucket ${bucket.id} has no database_id`);
-        }
-        text = addJobStatement(`'database_id', $2::uuid,
-        'id', $1::uuid,
-        'scope', $3::text`, `,
-      db_id => $2,
-      entity_id => $2,
-      organization_id => NULL,
-      entity_type => $3`);
-        values = [bucket.id, databaseId, scope];
-    }
-    else if (entityField === 'owner_id') {
-        const ownerId = bucket.scope_key;
-        if (!ownerId) {
-            throw new Error(`STORAGE_BUCKET_SCOPE_KEY_MISSING: bucket ${bucket.id} has no owner_id`);
-        }
-        const context = await resolveEntityContext(pgClient, storageModule);
-        const orgFunction = context.get_org_fn_schema && context.get_org_fn
-            ? `${quotes_1.QuoteUtils.quoteQualifiedIdentifier(context.get_org_fn_schema, context.get_org_fn)}($3::text, $2::uuid)`
-            : 'NULL';
-        text = addJobStatement(`'id', $1::uuid,
-        'owner_id', $2::uuid,
-        'scope', $3::text`, `,
-      entity_id => $2,
-      organization_id => ${orgFunction},
-      entity_type => $3`);
-        values = [bucket.id, ownerId, scope];
-    }
-    else {
-        throw new Error(`STORAGE_BUCKET_ENTITY_FIELD_UNSUPPORTED: ${entityField}`);
-    }
-    const result = await runQuery(pgClient, text, values);
+    const provisionFunction = quotes_1.QuoteUtils.quoteQualifiedIdentifier(storageModule.private_schema, `${storageModule.buckets_table}_provision`);
+    const result = await runQuery(pgClient, `SELECT ${provisionFunction}($1::uuid) AS id`, [bucket.id]);
     const jobId = result.rows[0]?.id;
     if (!jobId) {
         throw new Error(`STORAGE_BUCKET_JOB_ID_MISSING: bucket ${bucket.id}`);