okengine 0.11.1 → 0.12.0

package/src/console/ui-next/src/features/store/lib/replica-lag.test.ts

@@ -0,0 +1,101 @@
+/**
+ * Unit tests for live replica-lag projection.
+ */
+
+import { describe, expect, test } from "bun:test";
+import type { RunRow } from "@/client.ts";
+import { latestReplicaLagFromRuns } from "./replica-lag.ts";
+
+function run(partial: Partial<RunRow> & Pick<RunRow, "id" | "startedAt">): RunRow {
+  return {
+    parentId: null,
+    flow: "bookings.create",
+    unit: null,
+    trigger: "http",
+    plane: "user",
+    tenant: null,
+    principal: null,
+    gates: [],
+    cache: "none",
+    replica: "replica",
+    replicaLagMs: null,
+    cost: null,
+    inputTokens: null,
+    outputTokens: null,
+    promptVersion: null,
+    buildVersion: null,
+    endedAt: partial.startedAt + 1,
+    durationMs: 1,
+    error: null,
+    errorMessage: null,
+    sampled: "sample",
+    effects: [],
+    logs: [],
+    dimensions: {},
+    input: null,
+    output: null,
+    ...partial,
+  };
+}
+
+const refs = new Set(["sql:bookings"]);
+
+describe("latestReplicaLagFromRuns", () => {
+  test("empty buffer → null", () => {
+    expect(latestReplicaLagFromRuns([], refs)).toBeNull();
+  });
+
+  test("ignores runs that do not touch the resource", () => {
+    const rows = [
+      run({
+        id: "a",
+        startedAt: 10,
+        replicaLagMs: 400,
+        effects: [
+          {
+            kind: "read",
+            resource: "sql:other",
+            timestamp: 10,
+            duration: 1,
+            reversibility: "none",
+          },
+        ],
+      }),
+    ];
+    expect(latestReplicaLagFromRuns(rows, refs)).toBeNull();
+  });
+
+  test("uses the most recent touching run, not the max lag", () => {
+    const rows = [
+      run({
+        id: "old",
+        startedAt: 10,
+        replicaLagMs: 180,
+        effects: [
+          {
+            kind: "read",
+            resource: "sql:bookings",
+            timestamp: 10,
+            duration: 1,
+            reversibility: "none",
+          },
+        ],
+      }),
+      run({
+        id: "new",
+        startedAt: 50,
+        replicaLagMs: 12,
+        effects: [
+          {
+            kind: "write",
+            resource: "sql:bookings",
+            timestamp: 50,
+            duration: 1,
+            reversibility: "none",
+          },
+        ],
+      }),
+    ];
+    expect(latestReplicaLagFromRuns(rows, refs)).toBe(12);
+  });
+});

package/src/console/ui-next/src/features/store/lib/replica-lag.ts

@@ -0,0 +1,31 @@
+/**
+ * Live replica-lag projection from the Console runs buffer.
+ */
+
+import type { RunRow } from "@/client.ts";
+
+/**
+ * Replica lag of the most recent run that touches any of `effectRefs`.
+ * Returns `null` when the buffer has no matching lag — callers fall back
+ * to the store-list snapshot.
+ *
+ * @param runs - Runs buffer (live-merged)
+ * @param effectRefs - Store child effect refs (e.g. `sql:bookings`)
+ */
+export function latestReplicaLagFromRuns(
+  runs: readonly RunRow[],
+  effectRefs: ReadonlySet<string>,
+): number | null {
+  let bestStarted = Number.NEGATIVE_INFINITY;
+  let lag: number | null = null;
+  for (const run of runs) {
+    if (run.replicaLagMs == null) continue;
+    const touches = run.effects.some((effect) => effectRefs.has(effect.resource));
+    if (!touches) continue;
+    if (run.startedAt >= bestStarted) {
+      bestStarted = run.startedAt;
+      lag = run.replicaLagMs;
+    }
+  }
+  return lag;
+}

package/src/console/ui-next/src/features/store/lib/resource-effects.ts

@@ -0,0 +1,12 @@
+/**
+ * Reverse readers / writers helpers for Store detail.
+ */
+
+/**
+ * Dedupe + sort flow ids for a stable "touched by" list.
+ *
+ * @param ids - Reader or writer flow ids from the store list child
+ */
+export function sortedFlowIds(ids: readonly string[]): string[] {
+  return [...new Set(ids)].sort((a, b) => a.localeCompare(b));
+}

package/src/console/ui-next/src/features/store/lib/rls-gate-catalog.test.ts

@@ -0,0 +1,131 @@
+import { describe, expect, test } from "bun:test";
+import type { Manifest } from "../../../../../../manifest/types.ts";
+import {
+  filterRlsGateCatalog,
+  mergeRlsGateCatalog,
+  rlsCatalogPolicies,
+  rlsCatalogScopes,
+  rlsCommandFromActions,
+  rlsGateCatalog,
+  rlsGateSelectionExtraCount,
+  rlsGateSelectionIsCustom,
+  rlsGateSelectionSummary,
+  rlsGateVariant,
+  rlsSyncActionsForCommand,
+} from "./rls-gate-catalog.ts";
+
+const MANIFEST: Manifest = {
+  oke: "1.0",
+  app: "demo",
+  flows: {
+    "bookings.create": {
+      plane: "user",
+      gates: ["member", "booking:create"],
+    },
+  },
+  gates: {
+    member: {
+      kind: "policy",
+      description: "Signed-in member",
+      roles: ["role_member"],
+    },
+    "booking:create": {
+      kind: "policy",
+      scopes: ["booking:create"],
+    },
+    "rate:http": {
+      kind: "rate",
+      strategy: "sliding-window-counter",
+      max: 60,
+      per: "1m",
+    },
+  },
+};
+
+describe("rlsGateCatalog", () => {
+  test("lists public, policy, and scope — skips rate", () => {
+    const catalog = rlsGateCatalog(MANIFEST);
+    expect(catalog.gates.map((gate) => gate.name)).toEqual(["public", "member", "booking:create"]);
+    expect(catalog.gates.map((gate) => gate.variant)).toEqual(["public", "policy", "scope"]);
+    expect(rlsCatalogPolicies(catalog).map((gate) => gate.name)).toEqual(["public", "member"]);
+    expect(rlsCatalogScopes(catalog).map((gate) => gate.name)).toEqual(["booking:create"]);
+  });
+
+  test("skips rate gates and still works without a Manifest", () => {
+    const catalog = rlsGateCatalog(null);
+    expect(catalog.gates.map((gate) => gate.name)).toEqual(["public"]);
+    expect(catalog.gates[0]?.variant).toBe("public");
+  });
+});
+
+describe("rlsGateVariant", () => {
+  test("public by kind or name; scope when scopes are set", () => {
+    expect(rlsGateVariant({ name: "public", kind: "public", scopes: [] })).toBe("public");
+    expect(rlsGateVariant({ name: "member", kind: "policy", scopes: [] })).toBe("policy");
+    expect(rlsGateVariant({ name: "issue:write", kind: "policy", scopes: ["issue:write"] })).toBe(
+      "scope",
+    );
+  });
+});
+
+describe("mergeRlsGateCatalog", () => {
+  test("adds Access roles and extra Module:Action pairs without changing Gate variants", () => {
+    const merged = mergeRlsGateCatalog(rlsGateCatalog(MANIFEST), {
+      moduleActions: ["vault:read"],
+      principals: [
+        { kind: "role", name: "admin" },
+        { kind: "user", name: "ada" },
+      ],
+    });
+    expect(merged.roles).toEqual(["admin", "role_member"]);
+    expect(merged.actions).toContain("vault:read");
+    expect(rlsCatalogScopes(merged).map((gate) => gate.name)).toEqual(["booking:create"]);
+  });
+});
+
+describe("filterRlsGateCatalog", () => {
+  test("filters policy and scope by name", () => {
+    const catalog = filterRlsGateCatalog(rlsGateCatalog(MANIFEST), "book");
+    expect(catalog.gates.map((gate) => gate.name)).toEqual(["booking:create"]);
+    expect(rlsCatalogScopes(catalog).map((gate) => gate.name)).toEqual(["booking:create"]);
+    expect(rlsCatalogPolicies(catalog)).toEqual([]);
+  });
+});
+
+describe("rls command sync", () => {
+  test("maps selected store.sql pairs onto FOR", () => {
+    expect(rlsCommandFromActions(["store.sql:read"], "INSERT")).toBe("SELECT");
+    expect(rlsCommandFromActions(["store.sql:write"], "UPDATE")).toBe("UPDATE");
+    expect(rlsCommandFromActions(["store.sql:write"], "SELECT")).toBe("INSERT");
+    expect(rlsCommandFromActions(["store.sql:read", "store.sql:write"], "SELECT")).toBe("ALL");
+    expect(rlsCommandFromActions(["bookings:create"], "SELECT")).toBe("SELECT");
+  });
+
+  test("keeps custom pairs when the command changes", () => {
+    expect(rlsSyncActionsForCommand(["bookings:create", "store.sql:read"], "INSERT")).toEqual([
+      "bookings:create",
+      "store.sql:write",
+    ]);
+    expect(rlsSyncActionsForCommand(["member"], "ALL")).toEqual([
+      "member",
+      "store.sql:read",
+      "store.sql:write",
+    ]);
+  });
+});
+
+describe("rlsGateSelection", () => {
+  test("summarizes and counts selected Gates only", () => {
+    const selection = {
+      gates: ["member", "booking:create"],
+      actions: ["store.sql:read", "bookings:create"],
+      roles: ["role_member"],
+    };
+    expect(rlsGateSelectionSummary(selection)).toBe("booking:create · member");
+    expect(rlsGateSelectionExtraCount(selection)).toBe(2);
+    expect(rlsGateSelectionIsCustom(selection, "SELECT")).toBe(true);
+    expect(
+      rlsGateSelectionIsCustom({ gates: [], actions: ["store.sql:read"], roles: [] }, "SELECT"),
+    ).toBe(false);
+  });
+});

package/src/console/ui-next/src/features/store/lib/rls-gate-catalog.ts

@@ -0,0 +1,274 @@
+/**
+ * Create-policy Advanced Gate catalog — `gate.public`, `gate.policy`, `gate.scope`.
+ *
+ * Module:Action and Access roles are not Gate kinds. Picks stay on Gate —
+ * they are not Postgres `TO` roles.
+ */
+
+import { deriveModuleActions } from "../../../../../../elements/gate/permissions.ts";
+import type { Manifest } from "../../../../../../manifest/types.ts";
+import {
+  rlsGateActionsForMode,
+  rlsGateModeFromCommand,
+  type SqlPolicyCommand,
+} from "./rls-policy.ts";
+
+/** Empty Manifest so builtins still appear when the snapshot is missing. */
+const EMPTY_MANIFEST: Manifest = { oke: "1.0", app: "" };
+
+/** Reserved `gate.public` sentinel. */
+export const RLS_GATE_PUBLIC = "public";
+
+/** Store SQL read pair. */
+export const RLS_STORE_READ = "store.sql:read";
+
+/** Store SQL write pair. */
+export const RLS_STORE_WRITE = "store.sql:write";
+
+/** How a catalog Gate was declared. */
+export type RlsGateVariant = "public" | "policy" | "scope";
+
+/** One declared Gate in the Advanced picker (rate gates omitted). */
+export type RlsCatalogGate = {
+  readonly name: string;
+  readonly kind: "policy" | "public";
+  /** `gate.public` · `gate.policy` · `gate.scope`. */
+  readonly variant: RlsGateVariant;
+  readonly description?: string;
+  readonly scopes: readonly string[];
+  readonly roles: readonly string[];
+};
+
+/** Advanced Gate catalog for the create-policy sheet. */
+export type RlsGateCatalog = {
+  readonly gates: readonly RlsCatalogGate[];
+  readonly actions: readonly string[];
+  readonly roles: readonly string[];
+};
+
+/** Operator picks that pair this policy with Gate / Access. */
+export type RlsGateSelection = {
+  readonly gates: readonly string[];
+  readonly actions: readonly string[];
+  readonly roles: readonly string[];
+};
+
+/**
+ * Build the Advanced Gate catalog from a Manifest snapshot.
+ *
+ * @param manifest - Current Manifest, or null
+ */
+export function rlsGateCatalog(manifest: Manifest | null): RlsGateCatalog {
+  const source = manifest ?? EMPTY_MANIFEST;
+  const gates: RlsCatalogGate[] = [
+    {
+      name: RLS_GATE_PUBLIC,
+      kind: "public",
+      variant: "public",
+      description: "Intentionally unauthenticated",
+      scopes: [],
+      roles: [],
+    },
+  ];
+
+  for (const [name, gate] of Object.entries(source.gates ?? {})) {
+    if (gate.kind === "rate" || gate.kind === "all" || name.startsWith("rate:")) continue;
+    const scopes = gate.scopes ?? [];
+    const roles = gate.roles ?? [];
+    if (name === RLS_GATE_PUBLIC) {
+      const existing = gates[0];
+      if (existing) {
+        gates[0] = {
+          ...existing,
+          description: gate.description ?? existing.description,
+          scopes,
+          roles,
+        };
+      }
+      continue;
+    }
+    gates.push({
+      name,
+      kind: "policy",
+      variant: rlsGateVariant({ name, kind: "policy", scopes }),
+      ...(gate.description !== undefined ? { description: gate.description } : {}),
+      scopes,
+      roles,
+    });
+  }
+
+  const roles = uniqueSorted(gates.flatMap((gate) => [...gate.roles]));
+  return {
+    gates,
+    actions: deriveModuleActions(source),
+    roles,
+  };
+}
+
+/** Live Gates panel slice used to enrich the Manifest catalog. */
+export type RlsGatePanelSlice = {
+  readonly moduleActions?: readonly string[];
+  readonly principals?: readonly {
+    readonly kind: string;
+    readonly name: string;
+  }[];
+};
+
+/**
+ * Merge Access roles and Module:Action pairs from `GET /console/gates`.
+ *
+ * @param catalog - Manifest catalog
+ * @param panel - Gates panel slice, or null
+ */
+export function mergeRlsGateCatalog(
+  catalog: RlsGateCatalog,
+  panel: RlsGatePanelSlice | null,
+): RlsGateCatalog {
+  if (panel === null) return catalog;
+  const roles = uniqueSorted([
+    ...catalog.roles,
+    ...(panel.principals ?? [])
+      .filter((principal) => principal.kind === "role")
+      .map((principal) => principal.name),
+  ]);
+  return {
+    ...catalog,
+    actions: uniqueSorted([...(panel.moduleActions ?? []), ...catalog.actions]),
+    roles,
+  };
+}
+
+/**
+ * Filter catalog rows by a case-insensitive query.
+ *
+ * @param catalog - Full catalog
+ * @param query - Search text
+ */
+export function filterRlsGateCatalog(catalog: RlsGateCatalog, query: string): RlsGateCatalog {
+  const needle = query.trim().toLowerCase();
+  if (needle === "") return catalog;
+  return {
+    gates: catalog.gates.filter((gate) =>
+      matchesQuery(
+        needle,
+        gate.name,
+        gate.kind,
+        gate.variant,
+        gate.description,
+        ...gate.scopes,
+        ...gate.roles,
+      ),
+    ),
+    actions: catalog.actions.filter((action) => matchesQuery(needle, action)),
+    roles: catalog.roles.filter((role) => matchesQuery(needle, role)),
+  };
+}
+
+/**
+ * SQL command implied by selected Module:Action pairs.
+ *
+ * @param actions - Selected pairs
+ * @param previous - Current command
+ */
+export function rlsCommandFromActions(
+  actions: readonly string[],
+  previous: SqlPolicyCommand,
+): SqlPolicyCommand {
+  const read = actions.includes(RLS_STORE_READ);
+  const write = actions.includes(RLS_STORE_WRITE);
+  if (read && write) return "ALL";
+  if (read) return "SELECT";
+  if (write) {
+    if (previous === "INSERT" || previous === "UPDATE" || previous === "DELETE") return previous;
+    return "INSERT";
+  }
+  return previous;
+}
+
+/**
+ * Keep custom pairs and align `store.sql:*` with a SQL command.
+ *
+ * @param actions - Current pairs
+ * @param command - Policy `FOR` command
+ */
+export function rlsSyncActionsForCommand(
+  actions: readonly string[],
+  command: SqlPolicyCommand,
+): string[] {
+  const extras = actions.filter(
+    (action) => action !== RLS_STORE_READ && action !== RLS_STORE_WRITE,
+  );
+  return uniqueSorted([...rlsGateActionsForMode(rlsGateModeFromCommand(command)), ...extras]);
+}
+
+/**
+ * True when the selection is more than the simple Read / Write / Both posture.
+ *
+ * @param selection - Current picks
+ * @param command - Policy `FOR` command
+ */
+export function rlsGateSelectionIsCustom(
+  selection: RlsGateSelection,
+  _command: SqlPolicyCommand,
+): boolean {
+  return selection.gates.length > 0;
+}
+
+/**
+ * Compact pairing line for the Gate row.
+ *
+ * @param selection - Current picks
+ */
+export function rlsGateSelectionSummary(selection: RlsGateSelection): string {
+  return uniqueSorted(selection.gates).join(" · ");
+}
+
+/**
+ * Count of picks beyond the simple store.sql posture.
+ *
+ * @param selection - Current picks
+ */
+export function rlsGateSelectionExtraCount(selection: RlsGateSelection): number {
+  return selection.gates.length;
+}
+
+function matchesQuery(needle: string, ...fields: Array<string | undefined>): boolean {
+  return fields.some((field) => field !== undefined && field.toLowerCase().includes(needle));
+}
+
+/**
+ * `gate.public` · `gate.policy` · `gate.scope` from Manifest fields.
+ *
+ * @param gate - Catalog row (or a name/kind/scopes slice)
+ */
+export function rlsGateVariant(gate: {
+  readonly name: string;
+  readonly kind: "policy" | "public";
+  readonly scopes: readonly string[];
+}): RlsGateVariant {
+  if (gate.kind === "public" || gate.name === RLS_GATE_PUBLIC) return "public";
+  if (gate.scopes.length > 0) return "scope";
+  return "policy";
+}
+
+/**
+ * `gate.public` and `gate.policy` rows (ABAC).
+ *
+ * @param catalog - Full catalog
+ */
+export function rlsCatalogPolicies(catalog: RlsGateCatalog): readonly RlsCatalogGate[] {
+  return catalog.gates.filter((gate) => gate.variant !== "scope");
+}
+
+/**
+ * `gate.scope` rows (`auth.scopes.has(name)`).
+ *
+ * @param catalog - Full catalog
+ */
+export function rlsCatalogScopes(catalog: RlsGateCatalog): readonly RlsCatalogGate[] {
+  return catalog.gates.filter((gate) => gate.variant === "scope");
+}
+
+function uniqueSorted(values: readonly string[]): string[] {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}

package/src/console/ui-next/src/features/store/lib/rls-policy.test.ts

@@ -0,0 +1,95 @@
+import { describe, expect, test } from "bun:test";
+import {
+  filterRlsPolicyTemplates,
+  parseSqlPolicySpec,
+  RLS_POLICY_COMMANDS,
+  RLS_POLICY_TEMPLATES,
+  rlsCommandFromGateMode,
+  rlsGateActionsForMode,
+  rlsGateModeFromCommand,
+  rlsPolicyPredicates,
+  rlsPolicyPreviewSql,
+  rlsStoreGateActions,
+} from "./rls-policy.ts";
+
+describe("rlsPolicyPreviewSql", () => {
+  test("reviews ENABLE RLS then CREATE POLICY", () => {
+    const spec = parseSqlPolicySpec({
+      name: "read_all",
+      table: "bookings",
+      command: "SELECT",
+      using: "true",
+    });
+    expect(rlsPolicyPreviewSql(spec, true)).toBe(
+      [
+        'ALTER TABLE "bookings" ENABLE ROW LEVEL SECURITY;',
+        'CREATE POLICY "read_all"',
+        '  ON "bookings"',
+        "  AS PERMISSIVE",
+        "  FOR SELECT",
+        "  TO public",
+        "  USING (true);",
+      ].join("\n"),
+    );
+  });
+
+  test("omits ENABLE RLS when unchecked", () => {
+    const spec = parseSqlPolicySpec({
+      name: "read_all",
+      table: "bookings",
+      using: "true",
+    });
+    expect(rlsPolicyPreviewSql(spec, false)).toBe(
+      [
+        'CREATE POLICY "read_all"',
+        '  ON "bookings"',
+        "  AS PERMISSIVE",
+        "  FOR SELECT",
+        "  TO public",
+        "  USING (true);",
+      ].join("\n"),
+    );
+  });
+});
+
+describe("RLS_POLICY_TEMPLATES", () => {
+  test("covers every FOR command and is searchable", () => {
+    const commands = new Set(RLS_POLICY_TEMPLATES.map((tpl) => tpl.command));
+    for (const command of RLS_POLICY_COMMANDS) {
+      expect(commands.has(command)).toBe(true);
+    }
+    expect(RLS_POLICY_TEMPLATES.some((tpl) => tpl.behavior === "RESTRICTIVE")).toBe(true);
+    expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "oke.gate").length).toBeGreaterThan(0);
+    expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "owner").length).toBeGreaterThan(0);
+    expect(filterRlsPolicyTemplates(RLS_POLICY_TEMPLATES, "missing")).toEqual([]);
+  });
+});
+
+describe("rlsPolicyPredicates", () => {
+  test("shows only the clauses Postgres accepts", () => {
+    expect(rlsPolicyPredicates("SELECT")).toEqual({ using: true, withCheck: false });
+    expect(rlsPolicyPredicates("INSERT")).toEqual({ using: false, withCheck: true });
+    expect(rlsPolicyPredicates("UPDATE")).toEqual({ using: true, withCheck: true });
+    expect(rlsPolicyPredicates("DELETE")).toEqual({ using: true, withCheck: false });
+    expect(rlsPolicyPredicates("ALL")).toEqual({ using: true, withCheck: true });
+  });
+});
+
+describe("rls gate posture", () => {
+  test("maps commands to Module:Action pairs", () => {
+    expect(rlsStoreGateActions("SELECT")).toEqual(["store.sql:read"]);
+    expect(rlsStoreGateActions("INSERT")).toEqual(["store.sql:write"]);
+    expect(rlsStoreGateActions("ALL")).toEqual(["store.sql:read", "store.sql:write"]);
+  });
+
+  test("syncs Gate mode and SQL command", () => {
+    expect(rlsGateModeFromCommand("SELECT")).toBe("read");
+    expect(rlsGateModeFromCommand("UPDATE")).toBe("write");
+    expect(rlsGateModeFromCommand("ALL")).toBe("both");
+    expect(rlsCommandFromGateMode("read", "INSERT")).toBe("SELECT");
+    expect(rlsCommandFromGateMode("write", "UPDATE")).toBe("UPDATE");
+    expect(rlsCommandFromGateMode("write", "SELECT")).toBe("INSERT");
+    expect(rlsCommandFromGateMode("both", "SELECT")).toBe("ALL");
+    expect(rlsGateActionsForMode("both")).toEqual(["store.sql:read", "store.sql:write"]);
+  });
+});