measurr 0.3.0 → 0.4.0

package/dist/{index-wrr67sxq.js → index-4rmjas9h.js}

@@ -437,6 +437,9 @@ function dimensionNodes(dataset, key, timezone) {
 function baseWhere(dataset, tenant, period) {
   const where = [];
   if (tenant !== allTenants2) {
+    if (!dataset.tenantColumn) {
+      throw new Error(`Dataset ${dataset.key} has no tenant column; only allTenants may query it`);
+    }
     const ids = typeof tenant === "object" ? [...new Set(tenant)] : [tenant];
     const [only] = ids;
     where.push(ids.length === 1 && only !== undefined ? {
@@ -734,6 +737,7 @@ function createAnalytics2(options) {
   const sourceNames = Object.keys(options.sources);
   const byKey = new Map;
   const sourceOf = new Map;
+  const restrictedOf = new Map;
   for (const dataset of datasets) {
     if (byKey.has(dataset.key))
       throw new Error(`Two datasets use the key ${dataset.key}`);
@@ -741,6 +745,11 @@ function createAnalytics2(options) {
     const source = resolveSource(dataset, options.sources, sourceNames);
     sourceOf.set(dataset.key, source);
     compileEverything(dataset, source.dialect);
+    const restricted = restrictedFields(dataset);
+    if (restricted.length > 0 && !options.authorizeField) {
+      throw new Error(`Dataset ${dataset.key} marks fields with access, but createAnalytics has no authorizeField`);
+    }
+    restrictedOf.set(dataset.key, restricted);
   }
   const now = options.now ?? (() => new Date);
   const querySchemas = new Map;
@@ -757,9 +766,17 @@ function createAnalytics2(options) {
       throw new Error(`No source for ${dataset.key}`);
     return source;
   };
-  const querySchemaFor = (keys) => {
-    const selected = keys ? keys.map(datasetOf) : datasets;
-    const selectionKey = selected.map((dataset) => dataset.key).sort().join(",");
+  const querySchemaFor = (selected) => {
+    const keyOf = (dataset) => {
+      if (byKey.get(dataset.key) === dataset)
+        return dataset.key;
+      const fields = [
+        ...Object.keys(dataset.measures),
+        ...Object.keys(dataset.dimensions)
+      ];
+      return `${dataset.key}(${fields.join(" ")})`;
+    };
+    const selectionKey = selected.map(keyOf).sort().join(",");
     let schema = querySchemas.get(selectionKey);
     if (!schema) {
       schema = buildQuerySchema(selected);
@@ -775,38 +792,68 @@ function createAnalytics2(options) {
     }
     return schema;
   };
+  const deniedFields = async (dataset, ctx) => {
+    const restricted = restrictedOf.get(dataset.key) ?? [];
+    const authorizeField = options.authorizeField;
+    if (restricted.length === 0 || !authorizeField)
+      return restricted;
+    const mayUse = async (field) => {
+      const answers = await Promise.all(field.access.map((access) => authorizeField(dataset, field.key, access, ctx)));
+      return answers.every(Boolean);
+    };
+    const allowed = await Promise.all(restricted.map(mayUse));
+    return restricted.filter((_, index) => !allowed[index]);
+  };
   const allowedDatasets = async (ctx) => {
-    const { authorize } = options;
-    if (!authorize)
-      return datasets;
-    const allowed = await Promise.all(datasets.map((dataset) => authorize(dataset, ctx)));
-    return datasets.filter((_, index) => allowed[index]);
+    const everyTenant = options.tenant(ctx) === allTenants2;
+    const views = await Promise.all(datasets.map(async (dataset) => {
+      if (!dataset.tenantColumn && !everyTenant)
+        return null;
+      if (options.authorize && !await options.authorize(dataset, ctx))
+        return null;
+      const view = withoutFields(dataset, await deniedFields(dataset, ctx));
+      return Object.keys(view.measures).length > 0 ? view : null;
+    }));
+    return views.filter((view) => view !== null);
   };
   const querySchemaForCtx = async (ctx) => {
     const allowed = await allowedDatasets(ctx);
     if (allowed.length === 0) {
       throw new AnalyticsError2("forbidden", "No dataset is allowed");
     }
-    return querySchemaFor(allowed.map((dataset) => dataset.key));
+    return querySchemaFor(allowed);
   };
   const prepare = async (input, ctx) => {
-    const parsed = querySchemaFor(undefined).safeParse(input);
+    const parsed = querySchemaFor(datasets).safeParse(input);
     if (!parsed.success) {
       throw new AnalyticsError2("invalid_query", `Invalid analytics query: ${z2.prettifyError(parsed.error)}`, parsed.error.issues);
     }
-    const dataset = datasetOf(parsed.data.dataset);
+    const parsedQuery = parsed.data;
+    const dataset = datasetOf(parsedQuery.dataset);
     if (options.authorize && !await options.authorize(dataset, ctx)) {
       throw new AnalyticsError2("forbidden", `Not allowed to query ${dataset.key}`);
     }
+    const dimensionsUsed = [
+      ...parsedQuery.groupBy ?? [],
+      ...(parsedQuery.filters ?? []).map((filter) => filter.dimension)
+    ];
+    const refused = (await deniedFields(dataset, ctx)).filter((field) => field.kind === "measure" ? parsedQuery.measures.includes(field.key) : dimensionsUsed.includes(field.key));
+    if (refused.length > 0) {
+      const names = refused.map((field) => `${field.kind} ${field.key}`);
+      throw new AnalyticsError2("forbidden", `Not allowed to use ${names.join(", ")} of ${dataset.key}`);
+    }
     const tenant = options.tenant(ctx);
     if (!isTenant(tenant)) {
       throw new AnalyticsError2("missing_tenant", "Refusing to query without a tenant");
     }
+    if (!dataset.tenantColumn && tenant !== allTenants2) {
+      throw new AnalyticsError2("forbidden", `${dataset.key} has no tenant column; only a caller allowed to see every tenant may query it`);
+    }
     const timezone = await options.timezone?.(ctx) || "UTC";
     if (!isValidTimezone(timezone)) {
       throw new AnalyticsError2("invalid_timezone", `Unknown timezone ${timezone}`);
     }
-    const query = normalizeQuery(dataset, parsed.data);
+    const query = normalizeQuery(dataset, parsedQuery);
     const at = now();
     let period;
     try {
@@ -912,7 +959,7 @@ function createAnalytics2(options) {
     datasets: options.datasets,
     query,
     explain,
-    querySchema: (schemaOptions) => schemaOptions && ("ctx" in schemaOptions) ? querySchemaForCtx(schemaOptions.ctx) : querySchemaFor(schemaOptions?.datasets),
+    querySchema: (schemaOptions) => schemaOptions && ("ctx" in schemaOptions) ? querySchemaForCtx(schemaOptions.ctx) : querySchemaFor(schemaOptions?.datasets?.map(datasetOf) ?? datasets),
     resultSchema: (key) => resultSchemaFor(key),
     listDatasets: async (ctx) => (await allowedDatasets(ctx)).map((dataset) => catalogEntry(dataset))
   };
@@ -943,7 +990,7 @@ function resolveSource(dataset, sources, sourceNames) {
 function compileEverything(dataset, dialect) {
   const now = new Date(0);
   const context = {
-    tenant: "tenant",
+    tenant: dataset.tenantColumn ? "tenant" : allTenants2,
     timezone: "UTC",
     period: resolvePeriod({ last: { days: 1 } }, "UTC", now),
     now,
@@ -1009,6 +1056,38 @@ function decodeKey2(value, dialect) {
     return value;
   return dialect.decodeNumber(value) ?? String(value);
 }
+function restrictedFields(dataset) {
+  const measures = dataset.measures;
+  const accessOf = (key) => {
+    const entry = measures[key];
+    if (!entry)
+      return [];
+    const own = entry.access === undefined ? [] : [entry.access];
+    return entry.kind === "ratio" ? [...own, ...accessOf(entry.numerator), ...accessOf(entry.denominator)] : own;
+  };
+  return [
+    ...Object.keys(measures).map((key) => ({
+      kind: "measure",
+      key,
+      access: [...new Set(accessOf(key))]
+    })),
+    ...Object.entries(dataset.dimensions).map(([key, entry]) => ({
+      kind: "dimension",
+      key,
+      access: entry.access === undefined ? [] : [entry.access]
+    }))
+  ].filter((field) => field.access.length > 0);
+}
+function withoutFields(dataset, fields) {
+  if (fields.length === 0)
+    return dataset;
+  const keep = (kind, entries) => Object.fromEntries(Object.entries(entries).filter(([key]) => !fields.some((field) => field.kind === kind && field.key === key)));
+  return {
+    ...dataset,
+    measures: keep("measure", dataset.measures),
+    dimensions: keep("dimension", dataset.dimensions)
+  };
+}
 function catalogEntry(dataset) {
   return {
     key: dataset.key,
@@ -1046,6 +1125,7 @@ function aggregate(result, fn, arg, options) {
     result,
     label: options.label,
     description: options.description,
+    access: options.access,
     node: {
       kind: "aggregate",
       fn,
@@ -1079,6 +1159,7 @@ var measure2 = {
       result: "ratio",
       label: options.label,
       description: options.description,
+      access: options.access,
       numerator: options.numerator.node,
       denominator: options.denominator?.node ?? null
     };
@@ -1089,6 +1170,7 @@ var measure2 = {
       result: "ratio",
       label: options.label,
       description: options.description,
+      access: options.access,
       numerator,
       denominator
     };
@@ -1098,6 +1180,7 @@ function base(options) {
   return {
     label: options.label,
     description: options.description,
+    access: options.access,
     groupable: options.filterOnly !== true,
     filterable: options.groupOnly !== true
   };
@@ -1196,6 +1279,9 @@ function defineDataset2(definition) {
   if (!firstTime) {
     throw new Error(`Dataset ${definition.key}: declare at least one time field`);
   }
+  if (definition.tenantColumn === undefined) {
+    throw new Error(`Dataset ${definition.key}: declare tenantColumn, or null for a dataset without tenants`);
+  }
   const time = Object.fromEntries(timeEntries.map(([key, field]) => [
     key,
     { column: field.column.node, label: field.label }
@@ -1206,7 +1292,7 @@ function defineDataset2(definition) {
     description: definition.description,
     from: definition.from.ref,
     source: definition.source,
-    tenantColumn: definition.tenantColumn.node,
+    tenantColumn: definition.tenantColumn?.node ?? null,
     scope: definition.scope?.node ?? null,
     time,
     defaultTime: definition.defaultTime ?? firstTime[0],
@@ -1230,7 +1316,8 @@ function validateDataset(dataset) {
       }
     });
   };
-  check(dataset.tenantColumn, "tenantColumn");
+  if (dataset.tenantColumn)
+    check(dataset.tenantColumn, "tenantColumn");
   if (dataset.scope)
     check(dataset.scope, "scope");
   for (const [key, field] of Object.entries(dataset.time)) {

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { type Analytics, AnalyticsError, type AnalyticsErrorCode, type AnalyticsErrorDetails, type AnalyticsErrorOf, type AnalyticsOptions, type AnalyticsQuery, type AnalyticsQueryEvent, type AnalyticsResult, type AnalyticsSource, createAnalytics, type DatasetCatalogEntry, isAnalyticsError } from './analytics.js';
+export { type AccessKey, type Analytics, AnalyticsError, type AnalyticsErrorCode, type AnalyticsErrorDetails, type AnalyticsErrorOf, type AnalyticsOptions, type AnalyticsQuery, type AnalyticsQueryEvent, type AnalyticsResult, type AnalyticsSource, createAnalytics, type DatasetCatalogEntry, type FieldKey, isAnalyticsError } from './analytics.js';
 export { CompileError, type CompiledStatement, type Dialect, type JoinClause, type SelectItem, type SelectStatement, type SqlRenderer, decodeNumber, renderStatement } from './compile.js';
 export { type AnyDataset, type AnyDimension, type AnyMeasure, type Dataset, type DimensionValue, defineDataset, dimension, type MeasureValue, measure, type Ratio } from './dataset.js';
 export { and, caseWhen, coalesce, type ColumnKey, eq, Expr, type ExprNode, exists, gt, gte, inList, isNotNull, isNull, literal, lt, lte, minutesAgo, ne, not, or, type SqlType, Table, type TableRef, table, toText } from './expr.js';

package/dist/index.js

@@ -7,7 +7,7 @@ import {
   measure2,
   dimension2,
   defineDataset2
-} from "./index-wrr67sxq.js";
+} from "./index-4rmjas9h.js";
 import {
   CompileError2,
   decodeNumber2,

package/dist/testing.d.ts

@@ -6,6 +6,7 @@
 import { type AnalyticsSource } from './analytics.js';
 import { type AnyDataset } from './dataset.js';
 import type { PeriodInput } from './period.js';
+import { type TenantId, allTenants } from './plan.js';
 export type ContractCheck = {
     name: string;
     ok: boolean;
@@ -18,8 +19,11 @@ export type ContractReport = {
 export type ContractOptions = {
     dataset: AnyDataset;
     source: AnalyticsSource;
-    /** A tenant with seeded rows in the period. */
-    tenant: string | number;
+    /**
+     * A tenant with seeded rows in the period. `allTenants` for a dataset without a tenant
+     * column, which no single tenant may query.
+     */
+    tenant: TenantId | typeof allTenants;
     /** A tenant with no rows; defaults to a sentinel that no real tenant uses. */
     emptyTenant?: string | number;
     /** A timezone far from UTC makes bucketing mistakes visible. Defaults to Pacific/Auckland. */
@@ -30,8 +34,9 @@ export type ContractOptions = {
 };
 /**
  * Checks that every measure, grouping and filter compiles and runs, that groups add up to the
- * total, that labels resolve, that another tenant's rows never count, and that day buckets
- * agree with periods in the timezone.
+ * total, that labels resolve, that another tenant's rows never count (or, for a dataset
+ * without a tenant column, that a scoped caller is refused), and that day buckets agree with
+ * periods in the timezone. Fields marked with `access` are checked like any other.
  */
 export declare function checkDatasetContract(options: ContractOptions): Promise<ContractReport>;
 /** Runs `checkDatasetContract` and throws with every failed check listed. */

package/dist/testing.js

@@ -1,9 +1,11 @@
 import {
   MAX_MEASURES,
+  allTenants2,
+  isAnalyticsError2,
   createAnalytics2,
   measure2,
   dimension2
-} from "./index-wrr67sxq.js";
+} from "./index-4rmjas9h.js";
 
 // src/testing.ts
 var COUNT = "__contractCount";
@@ -31,6 +33,7 @@ async function checkDatasetContract(options) {
     datasets: [probe],
     sources: { main: options.source },
     tenant: (ctx) => ctx.tenant,
+    authorizeField: () => true,
     timezone: () => timezone,
     ...options.now && { now: options.now }
   });
@@ -55,10 +58,11 @@ async function checkDatasetContract(options) {
   };
   const total = (await run({ measures: [COUNT] })).totals[COUNT] ?? 0;
   if (total === 0) {
+    const scope = options.tenant === allTenants2 ? "The dataset" : `Tenant ${options.tenant}`;
     checks.push({
       name: "seeded rows",
       ok: false,
-      message: `Tenant ${options.tenant} has no rows in the period; the checks below prove little`
+      message: `${scope} has no rows in the period; the checks below prove little`
     });
   }
   for (const key of Object.keys(dataset.measures)) {
@@ -133,6 +137,10 @@ async function checkDatasetContract(options) {
     ["an empty tenant list", []]
   ]) {
     await check(`tenant isolation: ${name}`, async () => {
+      if (!dataset.tenantColumn) {
+        const refused = await run({ measures: [COUNT] }, tenant).then(() => false, (error) => isAnalyticsError2(error, "forbidden"));
+        return refused ? undefined : `${name} may query a dataset without a tenant column`;
+      }
       const measures = Object.keys(probe.measures);
       const leaked = [];
       for (let start = 0;start < measures.length; start += MAX_MEASURES) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "measurr",
-	"version": "0.3.0",
+	"version": "0.4.0",
 	"description": "A small typed semantic layer: datasets of measures and dimensions compiled to one SQL statement per dialect.",
 	"type": "module",
 	"module": "./dist/index.js",