graphile-presigned-url-plugin 1.10.0 → 1.11.0

package/download-url-field.js

@@ -24,6 +24,7 @@ exports.createDownloadUrlPlugin = createDownloadUrlPlugin;
 require("graphile-build");
 const logger_1 = require("@pgpmjs/logger");
 const grafast_1 = require("grafast");
+const request_pg_client_1 = require("./request-pg-client");
 const s3_signer_1 = require("./s3-signer");
 const storage_module_cache_1 = require("./storage-module-cache");
 const log = new logger_1.Logger('graphile-presigned-url:download-url');
@@ -115,7 +116,7 @@ function createDownloadUrlPlugin(options) {
                                     let downloadUrlExpirySeconds = 3600;
                                     try {
                                         if (withPgClient && pgSettings) {
-                                            const databaseId = await withPgClient(pgSettings, async (pgClient) => {
+                                            const databaseId = await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
                                                 const dbResult = await pgClient.query({
                                                     text: `SELECT jwt_private.current_database_id() AS id`,
                                                 });
@@ -127,7 +128,7 @@ function createDownloadUrlPlugin(options) {
                                                 ? (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedCodec, await withPgClient(null, (pgClient) => (0, storage_module_cache_1.loadAllStorageModules)(pgClient, databaseId)))
                                                 : null;
                                             const resolved = config && bucketId
-                                                ? await withPgClient(pgSettings, async (pgClient) => {
+                                                ? await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
                                                     // Look up the stored physical coordinate for scoped S3 resolution
                                                     const bucketResult = await pgClient.query({
                                                         text: `SELECT key, physical_name FROM ${config.bucketsQualifiedName} WHERE id = $1 LIMIT 1`,

package/esm/download-url-field.js

@@ -21,6 +21,7 @@
 import 'graphile-build';
 import { Logger } from '@pgpmjs/logger';
 import { context as grafastContext, lambda, object } from 'grafast';
+import { withRequestPgClient } from './request-pg-client';
 import { generatePresignedGetUrl } from './s3-signer';
 import { loadAllStorageModules, resolveStorageConfigFromCodec, storedPhysicalName } from './storage-module-cache';
 const log = new Logger('graphile-presigned-url:download-url');
@@ -112,7 +113,7 @@ export function createDownloadUrlPlugin(options) {
                                     let downloadUrlExpirySeconds = 3600;
                                     try {
                                         if (withPgClient && pgSettings) {
-                                            const databaseId = await withPgClient(pgSettings, async (pgClient) => {
+                                            const databaseId = await withRequestPgClient(withPgClient, pgSettings, async (pgClient) => {
                                                 const dbResult = await pgClient.query({
                                                     text: `SELECT jwt_private.current_database_id() AS id`,
                                                 });
@@ -124,7 +125,7 @@ export function createDownloadUrlPlugin(options) {
                                                 ? resolveStorageConfigFromCodec(capturedCodec, await withPgClient(null, (pgClient) => loadAllStorageModules(pgClient, databaseId)))
                                                 : null;
                                             const resolved = config && bucketId
-                                                ? await withPgClient(pgSettings, async (pgClient) => {
+                                                ? await withRequestPgClient(withPgClient, pgSettings, async (pgClient) => {
                                                     // Look up the stored physical coordinate for scoped S3 resolution
                                                     const bucketResult = await pgClient.query({
                                                         text: `SELECT key, physical_name FROM ${config.bucketsQualifiedName} WHERE id = $1 LIMIT 1`,

package/esm/plugin.js

@@ -19,6 +19,7 @@
 import 'graphile-build';
 import { Logger } from '@pgpmjs/logger';
 import { access, context as grafastContext, lambda, object } from 'grafast';
+import { withRequestPgClient } from './request-pg-client';
 import { deleteS3Object, generatePresignedPutUrl } from './s3-signer';
 import { getBucketConfig, isS3BucketProvisioned, loadAllStorageModules, markS3BucketProvisioned, resolveStorageConfigFromCodec, storedPhysicalName } from './storage-module-cache';
 const log = new Logger('graphile-presigned-url:plugin');
@@ -116,10 +117,15 @@ function resolveS3ForDatabase(options, storageConfig, physicalName) {
  * value is the durable coordinate: route resolution and every later read use
  * it verbatim; nothing is recomputed.
  *
- * The record write runs in the system lane (`withPgClient(null, ...)`) — it is
- * server bookkeeping, not request data, and anonymous request roles cannot
- * UPDATE bucket rows under RLS. `bucket` (the cached config) is mutated in place
- * so subsequent reads observe the recorded name without a DB round-trip.
+ * The record write runs in the system lane (privileged role, so it bypasses the
+ * RLS that stops request roles from UPDATE-ing bucket rows) — it is server
+ * bookkeeping, not request data. It still carries the tenant `database_id`
+ * claim, because the buckets table's catalog-sync trigger calls
+ * `jwt_private.current_database_id()` and would otherwise raise
+ * DATABASE_CLAIM_REQUIRED; `withRequestPgClient` applies that claim inside the
+ * write's transaction without switching off the privileged role.
+ * `bucket` (the cached config) is mutated in place so subsequent reads observe
+ * the recorded name without a DB round-trip.
  */
 async function provisionAndRecordPhysicalBucket(options, withPgClient, storageConfig, databaseId, bucket, allowedOrigins) {
     const s3BucketName = mintPhysicalBucketName(options, databaseId, bucket.key);
@@ -131,7 +137,9 @@ async function provisionAndRecordPhysicalBucket(options, withPgClient, storageCo
     }
     // Record the physical coordinate on the source row. The `physical_name IS NULL`
     // guard keeps this idempotent and race-safe across concurrent first uploads.
-    await withPgClient(null, (client) => client.query({
+    // The catalog-sync trigger on this UPDATE needs `jwt.claims.database_id`, so the
+    // write runs under the resolved database claim (privileged role preserved).
+    await withRequestPgClient(withPgClient, { 'jwt.claims.database_id': databaseId }, (client) => client.query({
         text: `UPDATE ${storageConfig.bucketsQualifiedName}
              SET physical_name = $1
              WHERE id = $2 AND physical_name IS NULL`,
@@ -244,7 +252,10 @@ export function createPresignedUrlPlugin(options) {
                                     pgSettings: $pgSettings,
                                 });
                                 return lambda($combined, async (vals) => {
-                                    const databaseId = await vals.withPgClient(vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                    // Request-lane reads/writes run under the request role's pgSettings
+                                    // inside an explicit transaction so the jwt claims stay applied
+                                    // across every statement (see withRequestPgClient).
+                                    const databaseId = await withRequestPgClient(vals.withPgClient, vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                     if (!databaseId)
                                         throw new Error('DATABASE_NOT_FOUND');
                                     // Module registration is server config, not user data:
@@ -254,7 +265,7 @@ export function createPresignedUrlPlugin(options) {
                                     if (!storageConfig)
                                         throw new Error('STORAGE_MODULE_NOT_FOUND');
                                     // Bucket config read under the request role (RLS-gated visibility).
-                                    const bucket = await vals.withPgClient(vals.pgSettings, (pgClient) => getBucketConfig(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
+                                    const bucket = await withRequestPgClient(vals.withPgClient, vals.pgSettings, (pgClient) => getBucketConfig(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
                                     if (!bucket)
                                         throw new Error('BUCKET_NOT_FOUND');
                                     // First provision mints + records the coordinate; afterwards the
@@ -264,13 +275,13 @@ export function createPresignedUrlPlugin(options) {
                                         : bucket.physical_name;
                                     const s3ForDb = resolveS3ForDatabase(options, storageConfig, physicalName);
                                     // File row INSERT under the request role (RLS enforced).
-                                    return vals.withPgClient(vals.pgSettings, (pgClient) => pgClient.withTransaction((txClient) => processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
+                                    return withRequestPgClient(vals.withPgClient, vals.pgSettings, (txClient) => processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
                                         contentHash: vals.contentHash,
                                         contentType: vals.contentType,
                                         size: vals.size,
                                         filename: vals.filename,
                                         key: vals.customKey,
-                                    })));
+                                    }));
                                 });
                             },
                         });
@@ -335,7 +346,10 @@ export function createPresignedUrlPlugin(options) {
                                     pgSettings: $pgSettings,
                                 });
                                 return lambda($combined, async (vals) => {
-                                    const databaseId = await vals.withPgClient(vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                    // Request-lane reads/writes run under the request role's pgSettings
+                                    // inside an explicit transaction so the jwt claims stay applied
+                                    // across every statement (see withRequestPgClient).
+                                    const databaseId = await withRequestPgClient(vals.withPgClient, vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                     if (!databaseId)
                                         throw new Error('DATABASE_NOT_FOUND');
                                     // Module registration is server config, not user data:
@@ -345,7 +359,7 @@ export function createPresignedUrlPlugin(options) {
                                     if (!storageConfig)
                                         throw new Error('STORAGE_MODULE_NOT_FOUND');
                                     // Bucket config read under the request role (RLS-gated visibility).
-                                    const bucket = await vals.withPgClient(vals.pgSettings, (pgClient) => getBucketConfig(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
+                                    const bucket = await withRequestPgClient(vals.withPgClient, vals.pgSettings, (pgClient) => getBucketConfig(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
                                     if (!bucket)
                                         throw new Error('BUCKET_NOT_FOUND');
                                     // Enforce bulk upload limits
@@ -364,7 +378,7 @@ export function createPresignedUrlPlugin(options) {
                                         : bucket.physical_name;
                                     const s3ForDb = resolveS3ForDatabase(options, storageConfig, physicalName);
                                     // File row INSERTs under the request role (RLS enforced).
-                                    return vals.withPgClient(vals.pgSettings, (pgClient) => pgClient.withTransaction(async (txClient) => {
+                                    return withRequestPgClient(vals.withPgClient, vals.pgSettings, async (txClient) => {
                                         const results = [];
                                         for (const file of filesArray) {
                                             results.push(await processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
@@ -376,7 +390,7 @@ export function createPresignedUrlPlugin(options) {
                                             }));
                                         }
                                         return { files: results };
-                                    }));
+                                    });
                                 });
                             },
                         });
@@ -421,7 +435,7 @@ export function createPresignedUrlPlugin(options) {
                                 const pgSettings = graphqlContext.pgSettings;
                                 if (withPgClient) {
                                     try {
-                                        const databaseId = await withPgClient(pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                        const databaseId = await withRequestPgClient(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                         // Module registration is server config, not user data:
                                         // resolve it without the request role's pgSettings.
                                         const allConfigs = databaseId
@@ -429,7 +443,7 @@ export function createPresignedUrlPlugin(options) {
                                             : [];
                                         const storageConfig = resolveStorageConfigFromCodec(capturedCodec, allConfigs);
                                         if (storageConfig) {
-                                            await withPgClient(pgSettings, async (pgClient) => {
+                                            await withRequestPgClient(withPgClient, pgSettings, async (pgClient) => {
                                                 // Read the file row (RLS enforced)
                                                 const result = await pgClient.query({
                                                     text: `SELECT key, bucket_id FROM ${storageConfig.filesQualifiedName} WHERE id = $1 LIMIT 1`,
@@ -454,7 +468,7 @@ export function createPresignedUrlPlugin(options) {
                                 const pgSettings = graphqlContext.pgSettings;
                                 if (withPgClient) {
                                     try {
-                                        const databaseId = await withPgClient(pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                        const databaseId = await withRequestPgClient(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                         // Module registration is server config, not user data:
                                         // resolve it without the request role's pgSettings.
                                         const allConfigs = databaseId
@@ -462,7 +476,7 @@ export function createPresignedUrlPlugin(options) {
                                             : [];
                                         const storageConfig = resolveStorageConfigFromCodec(capturedCodec, allConfigs);
                                         if (storageConfig)
-                                            await withPgClient(pgSettings, async (pgClient) => {
+                                            await withRequestPgClient(withPgClient, pgSettings, async (pgClient) => {
                                                 // Check refcount: any other file with the same key in this bucket?
                                                 const refResult = await pgClient.query({
                                                     text: `SELECT COUNT(*)::int AS ref_count FROM ${storageConfig.filesQualifiedName} WHERE key = $1 AND bucket_id = $2`,

package/esm/request-pg-client.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Run a callback under the request's pgSettings inside ONE explicit transaction.
+ *
+ * The grafast context's `withPgClient(pgSettings, cb)` applies pgSettings as
+ * transaction-LOCAL `set_config(key, value, is_local => true)`. When `cb` issues
+ * more than one statement WITHOUT an explicit surrounding transaction, each
+ * statement runs in its own implicit (autocommit) transaction, so a LOCAL
+ * setting applied for one statement is already gone by the next. The request
+ * role's jwt claims (notably `jwt.claims.database_id`) then vanish between
+ * statements, and `jwt_private.current_database_id()` raises
+ * DATABASE_CLAIM_REQUIRED even though the request carried the claim.
+ *
+ * This helper acquires the client without settings (`withPgClient(null, ...)`),
+ * opens a single explicit transaction, and applies the request settings inside
+ * it — so every statement in `cb` observes the same role and jwt claims. It
+ * mirrors the `pg-query-context` pattern used elsewhere in the codebase for
+ * manual, multi-statement RLS work.
+ */
+export interface RequestPgClient {
+    query(opts: {
+        text: string;
+        values?: unknown[];
+    }): Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+    withTransaction<T>(cb: (tx: RequestPgClient) => Promise<T>): Promise<T>;
+}
+export type WithPgClient = <T>(pgSettings: Record<string, string> | null, cb: (client: RequestPgClient) => Promise<T>) => Promise<T>;
+export declare function withRequestPgClient<T>(withPgClient: WithPgClient, pgSettings: Record<string, string> | null, cb: (tx: RequestPgClient) => Promise<T>): Promise<T>;

package/esm/request-pg-client.js

@@ -0,0 +1,37 @@
+/**
+ * Run a callback under the request's pgSettings inside ONE explicit transaction.
+ *
+ * The grafast context's `withPgClient(pgSettings, cb)` applies pgSettings as
+ * transaction-LOCAL `set_config(key, value, is_local => true)`. When `cb` issues
+ * more than one statement WITHOUT an explicit surrounding transaction, each
+ * statement runs in its own implicit (autocommit) transaction, so a LOCAL
+ * setting applied for one statement is already gone by the next. The request
+ * role's jwt claims (notably `jwt.claims.database_id`) then vanish between
+ * statements, and `jwt_private.current_database_id()` raises
+ * DATABASE_CLAIM_REQUIRED even though the request carried the claim.
+ *
+ * This helper acquires the client without settings (`withPgClient(null, ...)`),
+ * opens a single explicit transaction, and applies the request settings inside
+ * it — so every statement in `cb` observes the same role and jwt claims. It
+ * mirrors the `pg-query-context` pattern used elsewhere in the codebase for
+ * manual, multi-statement RLS work.
+ */
+async function applyRequestSettings(tx, pgSettings) {
+    if (!pgSettings)
+        return;
+    const entries = Object.entries(pgSettings)
+        .filter(([, value]) => value != null)
+        .map(([key, value]) => [key, String(value)]);
+    if (entries.length === 0)
+        return;
+    await tx.query({
+        text: 'SELECT set_config(el->>0, el->>1, true) FROM json_array_elements($1::json) el',
+        values: [JSON.stringify(entries)],
+    });
+}
+export function withRequestPgClient(withPgClient, pgSettings, cb) {
+    return withPgClient(null, (client) => client.withTransaction(async (tx) => {
+        await applyRequestSettings(tx, pgSettings);
+        return cb(tx);
+    }));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "graphile-presigned-url-plugin",
-  "version": "1.10.0",
+  "version": "1.11.0",
   "description": "Presigned URL upload plugin for PostGraphile v5 — requestUploadUrl mutation and downloadUrl computed field",
   "author": "Constructive <developers@constructive.io>",
   "homepage": "https://github.com/constructive-io/constructive",
@@ -42,7 +42,7 @@
   "dependencies": {
     "@aws-sdk/client-s3": "^3.1052.0",
     "@aws-sdk/s3-request-presigner": "^3.1052.0",
-    "@pgpmjs/logger": "^2.23.3",
+    "@pgpmjs/logger": "^2.24.0",
     "@pgsql/quotes": "^18.2.0",
     "lru-cache": "^11.2.7"
   },
@@ -56,9 +56,9 @@
     "postgraphile": "5.0.3"
   },
   "devDependencies": {
-    "@constructive-io/s3-utils": "^2.29.3",
+    "@constructive-io/s3-utils": "^2.30.0",
     "@types/node": "^22.19.11",
     "makage": "^0.3.0"
   },
-  "gitHead": "c438821362ceaf70b2a20d74ecf25ad4191c1748"
+  "gitHead": "d508453a32a2f1d70ff6916871046615226e6f33"
 }

package/plugin.js

@@ -23,6 +23,7 @@ exports.createPresignedUrlPlugin = createPresignedUrlPlugin;
 require("graphile-build");
 const logger_1 = require("@pgpmjs/logger");
 const grafast_1 = require("grafast");
+const request_pg_client_1 = require("./request-pg-client");
 const s3_signer_1 = require("./s3-signer");
 const storage_module_cache_1 = require("./storage-module-cache");
 const log = new logger_1.Logger('graphile-presigned-url:plugin');
@@ -120,10 +121,15 @@ function resolveS3ForDatabase(options, storageConfig, physicalName) {
  * value is the durable coordinate: route resolution and every later read use
  * it verbatim; nothing is recomputed.
  *
- * The record write runs in the system lane (`withPgClient(null, ...)`) — it is
- * server bookkeeping, not request data, and anonymous request roles cannot
- * UPDATE bucket rows under RLS. `bucket` (the cached config) is mutated in place
- * so subsequent reads observe the recorded name without a DB round-trip.
+ * The record write runs in the system lane (privileged role, so it bypasses the
+ * RLS that stops request roles from UPDATE-ing bucket rows) — it is server
+ * bookkeeping, not request data. It still carries the tenant `database_id`
+ * claim, because the buckets table's catalog-sync trigger calls
+ * `jwt_private.current_database_id()` and would otherwise raise
+ * DATABASE_CLAIM_REQUIRED; `withRequestPgClient` applies that claim inside the
+ * write's transaction without switching off the privileged role.
+ * `bucket` (the cached config) is mutated in place so subsequent reads observe
+ * the recorded name without a DB round-trip.
  */
 async function provisionAndRecordPhysicalBucket(options, withPgClient, storageConfig, databaseId, bucket, allowedOrigins) {
     const s3BucketName = mintPhysicalBucketName(options, databaseId, bucket.key);
@@ -135,7 +141,9 @@ async function provisionAndRecordPhysicalBucket(options, withPgClient, storageCo
     }
     // Record the physical coordinate on the source row. The `physical_name IS NULL`
     // guard keeps this idempotent and race-safe across concurrent first uploads.
-    await withPgClient(null, (client) => client.query({
+    // The catalog-sync trigger on this UPDATE needs `jwt.claims.database_id`, so the
+    // write runs under the resolved database claim (privileged role preserved).
+    await (0, request_pg_client_1.withRequestPgClient)(withPgClient, { 'jwt.claims.database_id': databaseId }, (client) => client.query({
         text: `UPDATE ${storageConfig.bucketsQualifiedName}
              SET physical_name = $1
              WHERE id = $2 AND physical_name IS NULL`,
@@ -248,7 +256,10 @@ function createPresignedUrlPlugin(options) {
                                     pgSettings: $pgSettings,
                                 });
                                 return (0, grafast_1.lambda)($combined, async (vals) => {
-                                    const databaseId = await vals.withPgClient(vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                    // Request-lane reads/writes run under the request role's pgSettings
+                                    // inside an explicit transaction so the jwt claims stay applied
+                                    // across every statement (see withRequestPgClient).
+                                    const databaseId = await (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                     if (!databaseId)
                                         throw new Error('DATABASE_NOT_FOUND');
                                     // Module registration is server config, not user data:
@@ -258,7 +269,7 @@ function createPresignedUrlPlugin(options) {
                                     if (!storageConfig)
                                         throw new Error('STORAGE_MODULE_NOT_FOUND');
                                     // Bucket config read under the request role (RLS-gated visibility).
-                                    const bucket = await vals.withPgClient(vals.pgSettings, (pgClient) => (0, storage_module_cache_1.getBucketConfig)(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
+                                    const bucket = await (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, (pgClient) => (0, storage_module_cache_1.getBucketConfig)(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
                                     if (!bucket)
                                         throw new Error('BUCKET_NOT_FOUND');
                                     // First provision mints + records the coordinate; afterwards the
@@ -268,13 +279,13 @@ function createPresignedUrlPlugin(options) {
                                         : bucket.physical_name;
                                     const s3ForDb = resolveS3ForDatabase(options, storageConfig, physicalName);
                                     // File row INSERT under the request role (RLS enforced).
-                                    return vals.withPgClient(vals.pgSettings, (pgClient) => pgClient.withTransaction((txClient) => processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
+                                    return (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, (txClient) => processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
                                         contentHash: vals.contentHash,
                                         contentType: vals.contentType,
                                         size: vals.size,
                                         filename: vals.filename,
                                         key: vals.customKey,
-                                    })));
+                                    }));
                                 });
                             },
                         });
@@ -339,7 +350,10 @@ function createPresignedUrlPlugin(options) {
                                     pgSettings: $pgSettings,
                                 });
                                 return (0, grafast_1.lambda)($combined, async (vals) => {
-                                    const databaseId = await vals.withPgClient(vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                    // Request-lane reads/writes run under the request role's pgSettings
+                                    // inside an explicit transaction so the jwt claims stay applied
+                                    // across every statement (see withRequestPgClient).
+                                    const databaseId = await (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                     if (!databaseId)
                                         throw new Error('DATABASE_NOT_FOUND');
                                     // Module registration is server config, not user data:
@@ -349,7 +363,7 @@ function createPresignedUrlPlugin(options) {
                                     if (!storageConfig)
                                         throw new Error('STORAGE_MODULE_NOT_FOUND');
                                     // Bucket config read under the request role (RLS-gated visibility).
-                                    const bucket = await vals.withPgClient(vals.pgSettings, (pgClient) => (0, storage_module_cache_1.getBucketConfig)(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
+                                    const bucket = await (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, (pgClient) => (0, storage_module_cache_1.getBucketConfig)(pgClient, storageConfig, databaseId, vals.bucketKey, vals.ownerId || undefined));
                                     if (!bucket)
                                         throw new Error('BUCKET_NOT_FOUND');
                                     // Enforce bulk upload limits
@@ -368,7 +382,7 @@ function createPresignedUrlPlugin(options) {
                                         : bucket.physical_name;
                                     const s3ForDb = resolveS3ForDatabase(options, storageConfig, physicalName);
                                     // File row INSERTs under the request role (RLS enforced).
-                                    return vals.withPgClient(vals.pgSettings, (pgClient) => pgClient.withTransaction(async (txClient) => {
+                                    return (0, request_pg_client_1.withRequestPgClient)(vals.withPgClient, vals.pgSettings, async (txClient) => {
                                         const results = [];
                                         for (const file of filesArray) {
                                             results.push(await processSingleFile(options, txClient, storageConfig, databaseId, bucket, s3ForDb, {
@@ -380,7 +394,7 @@ function createPresignedUrlPlugin(options) {
                                             }));
                                         }
                                         return { files: results };
-                                    }));
+                                    });
                                 });
                             },
                         });
@@ -425,7 +439,7 @@ function createPresignedUrlPlugin(options) {
                                 const pgSettings = graphqlContext.pgSettings;
                                 if (withPgClient) {
                                     try {
-                                        const databaseId = await withPgClient(pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                        const databaseId = await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                         // Module registration is server config, not user data:
                                         // resolve it without the request role's pgSettings.
                                         const allConfigs = databaseId
@@ -433,7 +447,7 @@ function createPresignedUrlPlugin(options) {
                                             : [];
                                         const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedCodec, allConfigs);
                                         if (storageConfig) {
-                                            await withPgClient(pgSettings, async (pgClient) => {
+                                            await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
                                                 // Read the file row (RLS enforced)
                                                 const result = await pgClient.query({
                                                     text: `SELECT key, bucket_id FROM ${storageConfig.filesQualifiedName} WHERE id = $1 LIMIT 1`,
@@ -458,7 +472,7 @@ function createPresignedUrlPlugin(options) {
                                 const pgSettings = graphqlContext.pgSettings;
                                 if (withPgClient) {
                                     try {
-                                        const databaseId = await withPgClient(pgSettings, (pgClient) => resolveDatabaseId(pgClient));
+                                        const databaseId = await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, (pgClient) => resolveDatabaseId(pgClient));
                                         // Module registration is server config, not user data:
                                         // resolve it without the request role's pgSettings.
                                         const allConfigs = databaseId
@@ -466,7 +480,7 @@ function createPresignedUrlPlugin(options) {
                                             : [];
                                         const storageConfig = (0, storage_module_cache_1.resolveStorageConfigFromCodec)(capturedCodec, allConfigs);
                                         if (storageConfig)
-                                            await withPgClient(pgSettings, async (pgClient) => {
+                                            await (0, request_pg_client_1.withRequestPgClient)(withPgClient, pgSettings, async (pgClient) => {
                                                 // Check refcount: any other file with the same key in this bucket?
                                                 const refResult = await pgClient.query({
                                                     text: `SELECT COUNT(*)::int AS ref_count FROM ${storageConfig.filesQualifiedName} WHERE key = $1 AND bucket_id = $2`,

package/request-pg-client.d.ts

@@ -0,0 +1,29 @@
+/**
+ * Run a callback under the request's pgSettings inside ONE explicit transaction.
+ *
+ * The grafast context's `withPgClient(pgSettings, cb)` applies pgSettings as
+ * transaction-LOCAL `set_config(key, value, is_local => true)`. When `cb` issues
+ * more than one statement WITHOUT an explicit surrounding transaction, each
+ * statement runs in its own implicit (autocommit) transaction, so a LOCAL
+ * setting applied for one statement is already gone by the next. The request
+ * role's jwt claims (notably `jwt.claims.database_id`) then vanish between
+ * statements, and `jwt_private.current_database_id()` raises
+ * DATABASE_CLAIM_REQUIRED even though the request carried the claim.
+ *
+ * This helper acquires the client without settings (`withPgClient(null, ...)`),
+ * opens a single explicit transaction, and applies the request settings inside
+ * it — so every statement in `cb` observes the same role and jwt claims. It
+ * mirrors the `pg-query-context` pattern used elsewhere in the codebase for
+ * manual, multi-statement RLS work.
+ */
+export interface RequestPgClient {
+    query(opts: {
+        text: string;
+        values?: unknown[];
+    }): Promise<{
+        rows: Array<Record<string, unknown>>;
+    }>;
+    withTransaction<T>(cb: (tx: RequestPgClient) => Promise<T>): Promise<T>;
+}
+export type WithPgClient = <T>(pgSettings: Record<string, string> | null, cb: (client: RequestPgClient) => Promise<T>) => Promise<T>;
+export declare function withRequestPgClient<T>(withPgClient: WithPgClient, pgSettings: Record<string, string> | null, cb: (tx: RequestPgClient) => Promise<T>): Promise<T>;

package/request-pg-client.js

@@ -0,0 +1,40 @@
+"use strict";
+/**
+ * Run a callback under the request's pgSettings inside ONE explicit transaction.
+ *
+ * The grafast context's `withPgClient(pgSettings, cb)` applies pgSettings as
+ * transaction-LOCAL `set_config(key, value, is_local => true)`. When `cb` issues
+ * more than one statement WITHOUT an explicit surrounding transaction, each
+ * statement runs in its own implicit (autocommit) transaction, so a LOCAL
+ * setting applied for one statement is already gone by the next. The request
+ * role's jwt claims (notably `jwt.claims.database_id`) then vanish between
+ * statements, and `jwt_private.current_database_id()` raises
+ * DATABASE_CLAIM_REQUIRED even though the request carried the claim.
+ *
+ * This helper acquires the client without settings (`withPgClient(null, ...)`),
+ * opens a single explicit transaction, and applies the request settings inside
+ * it — so every statement in `cb` observes the same role and jwt claims. It
+ * mirrors the `pg-query-context` pattern used elsewhere in the codebase for
+ * manual, multi-statement RLS work.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withRequestPgClient = withRequestPgClient;
+async function applyRequestSettings(tx, pgSettings) {
+    if (!pgSettings)
+        return;
+    const entries = Object.entries(pgSettings)
+        .filter(([, value]) => value != null)
+        .map(([key, value]) => [key, String(value)]);
+    if (entries.length === 0)
+        return;
+    await tx.query({
+        text: 'SELECT set_config(el->>0, el->>1, true) FROM json_array_elements($1::json) el',
+        values: [JSON.stringify(entries)],
+    });
+}
+function withRequestPgClient(withPgClient, pgSettings, cb) {
+    return withPgClient(null, (client) => client.withTransaction(async (tx) => {
+        await applyRequestSettings(tx, pgSettings);
+        return cb(tx);
+    }));
+}