okengine 0.11.2 → 0.13.0

package/src/console/ui-next/src/features/store/lib/rls-policy.ts

@@ -0,0 +1,290 @@
+/**
+ * Console helpers for RLS policy create (SQL preview + templates).
+ */
+
+import {
+  buildCreatePolicySql,
+  buildRowSecuritySql,
+  parseSqlPolicySpec,
+  quotePgIdent,
+  type SqlPolicyBehavior,
+  type SqlPolicyCommand,
+  type SqlPolicySpec,
+} from "../../../../../../drivers/pg-rls.ts";
+
+export type { SqlPolicyBehavior, SqlPolicyCommand, SqlPolicySpec };
+export { buildCreatePolicySql, buildRowSecuritySql, parseSqlPolicySpec };
+
+/** One starter template for the create-policy sheet. */
+export type RlsPolicyTemplate = {
+  readonly id: string;
+  /** SQL policy name applied when the card is picked. */
+  readonly name: string;
+  readonly title: string;
+  readonly detail: string;
+  readonly command: SqlPolicyCommand;
+  readonly behavior?: SqlPolicyBehavior;
+  readonly using?: string;
+  readonly withCheck?: string;
+};
+
+const OKE_GATE = "current_setting('oke.gate', true)";
+
+/** Common Postgres RLS starters — OKE Gate / owner / join, no vendor auth helpers. */
+export const RLS_POLICY_TEMPLATES: readonly RlsPolicyTemplate[] = [
+  {
+    id: "read-all",
+    name: "read_all",
+    title: "Enable read access for everyone",
+    detail: "SELECT using true. Any role that reaches the table can read.",
+    command: "SELECT",
+    using: "true",
+  },
+  {
+    id: "deny-read",
+    name: "deny_read",
+    title: "Deny all reads",
+    detail: "SELECT using false. Rows stay hidden until another policy allows them.",
+    command: "SELECT",
+    using: "false",
+  },
+  {
+    id: "owner-read",
+    name: "owner_read",
+    title: "Enable read for owners",
+    detail: "SELECT when a text owner column matches current_user.",
+    command: "SELECT",
+    using: "owner = current_user",
+  },
+  {
+    id: "gate-read",
+    name: "gate_read",
+    title: "Enable read when oke.gate matches",
+    detail: `SELECT when ${OKE_GATE} equals a Gate name (pair Policy & scope).`,
+    command: "SELECT",
+    using: `${OKE_GATE} = 'member'`,
+  },
+  {
+    id: "join-read",
+    name: "join_read",
+    title: "Enable read via a related table",
+    detail: "SELECT with EXISTS against members — membership joins, not a column on this table.",
+    command: "SELECT",
+    using:
+      "exists (select 1 from members m where m.user_id = current_user and m.team_id = team_id)",
+  },
+  {
+    id: "insert-all",
+    name: "insert_all",
+    title: "Enable insert for everyone",
+    detail: "INSERT WITH CHECK true. New rows are accepted without a row predicate.",
+    command: "INSERT",
+    withCheck: "true",
+  },
+  {
+    id: "insert-owner",
+    name: "insert_owner",
+    title: "Enable insert for owners",
+    detail: "INSERT WITH CHECK so new rows set owner to current_user.",
+    command: "INSERT",
+    withCheck: "owner = current_user",
+  },
+  {
+    id: "insert-gate",
+    name: "insert_gate",
+    title: "Enable insert when oke.gate matches",
+    detail: `INSERT WITH CHECK when ${OKE_GATE} equals a Gate name.`,
+    command: "INSERT",
+    withCheck: `${OKE_GATE} = 'member'`,
+  },
+  {
+    id: "update-owner",
+    name: "update_owner",
+    title: "Enable update for owners",
+    detail: "UPDATE own rows. USING and WITH CHECK both require owner = current_user.",
+    command: "UPDATE",
+    using: "owner = current_user",
+    withCheck: "owner = current_user",
+  },
+  {
+    id: "update-gate",
+    name: "update_gate",
+    title: "Enable update when oke.gate matches",
+    detail: `UPDATE when ${OKE_GATE} equals a Gate name.`,
+    command: "UPDATE",
+    using: `${OKE_GATE} = 'member'`,
+    withCheck: `${OKE_GATE} = 'member'`,
+  },
+  {
+    id: "delete-owner",
+    name: "delete_owner",
+    title: "Enable delete for owners",
+    detail: "DELETE when a text owner column matches current_user.",
+    command: "DELETE",
+    using: "owner = current_user",
+  },
+  {
+    id: "deny-delete",
+    name: "deny_delete",
+    title: "Deny all deletes",
+    detail: "DELETE using false. Rows cannot be removed until another policy allows it.",
+    command: "DELETE",
+    using: "false",
+  },
+  {
+    id: "all-owner",
+    name: "owner_all",
+    title: "Enable all commands for owners",
+    detail: "ALL commands when owner = current_user (USING and WITH CHECK).",
+    command: "ALL",
+    using: "owner = current_user",
+    withCheck: "owner = current_user",
+  },
+  {
+    id: "all-gate",
+    name: "gate_all",
+    title: "Enable all commands when oke.gate matches",
+    detail: `ALL commands when ${OKE_GATE} equals a Gate name.`,
+    command: "ALL",
+    using: `${OKE_GATE} = 'member'`,
+    withCheck: `${OKE_GATE} = 'member'`,
+  },
+  {
+    id: "restrictive-gate",
+    name: "restrictive_gate",
+    title: "Restrictive extra Gate check",
+    detail: "RESTRICTIVE policy ANDs with permissive ones. Requires oke.gate to be set.",
+    command: "ALL",
+    behavior: "RESTRICTIVE",
+    using: `${OKE_GATE} is not null`,
+    withCheck: `${OKE_GATE} is not null`,
+  },
+];
+
+/**
+ * Filter templates by title, detail, command, or policy name.
+ *
+ * @param templates - Full library
+ * @param query - Search text
+ */
+export function filterRlsPolicyTemplates(
+  templates: readonly RlsPolicyTemplate[],
+  query: string,
+): readonly RlsPolicyTemplate[] {
+  const needle = query.trim().toLowerCase();
+  if (needle === "") return templates;
+  return templates.filter((tpl) =>
+    [tpl.id, tpl.name, tpl.title, tpl.detail, tpl.command, tpl.behavior ?? ""].some((field) =>
+      field.toLowerCase().includes(needle),
+    ),
+  );
+}
+
+/** Every `FOR` command the Advanced Gate picker can set. */
+export const RLS_POLICY_COMMANDS: readonly SqlPolicyCommand[] = [
+  "SELECT",
+  "INSERT",
+  "UPDATE",
+  "DELETE",
+  "ALL",
+];
+
+/** Which `CREATE POLICY` predicates a command accepts. */
+export type RlsPolicyPredicates = {
+  readonly using: boolean;
+  readonly withCheck: boolean;
+};
+
+/**
+ * `USING` / `WITH CHECK` visibility for a `FOR` command.
+ *
+ * @param command - Policy `FOR` command
+ */
+export function rlsPolicyPredicates(command: SqlPolicyCommand): RlsPolicyPredicates {
+  if (command === "INSERT") return { using: false, withCheck: true };
+  if (command === "UPDATE" || command === "ALL") return { using: true, withCheck: true };
+  return { using: true, withCheck: false };
+}
+
+/** Gate posture that maps onto this policy's SQL command. */
+export type RlsGateMode = "read" | "write" | "both";
+
+/**
+ * Gate Module:Action pairs for a command (`store.sql:read` / `store.sql:write`).
+ *
+ * @param command - Policy `FOR` command
+ */
+export function rlsStoreGateActions(command: SqlPolicyCommand): readonly string[] {
+  return rlsGateActionsForMode(rlsGateModeFromCommand(command));
+}
+
+/**
+ * Read / write / both from a SQL command.
+ *
+ * @param command - Policy `FOR` command
+ */
+export function rlsGateModeFromCommand(command: SqlPolicyCommand): RlsGateMode {
+  if (command === "SELECT") return "read";
+  if (command === "ALL") return "both";
+  return "write";
+}
+
+/**
+ * SQL command from a Gate posture. Write keeps INSERT / UPDATE / DELETE.
+ *
+ * @param mode - Selected Gate posture
+ * @param previous - Current command
+ */
+export function rlsCommandFromGateMode(
+  mode: RlsGateMode,
+  previous: SqlPolicyCommand,
+): SqlPolicyCommand {
+  if (mode === "read") return "SELECT";
+  if (mode === "both") return "ALL";
+  if (previous === "INSERT" || previous === "UPDATE" || previous === "DELETE") return previous;
+  return "INSERT";
+}
+
+/**
+ * Module:Action pairs for a Gate posture.
+ *
+ * @param mode - Selected Gate posture
+ */
+export function rlsGateActionsForMode(mode: RlsGateMode): readonly string[] {
+  if (mode === "read") return ["store.sql:read"];
+  if (mode === "write") return ["store.sql:write"];
+  return ["store.sql:read", "store.sql:write"];
+}
+
+/**
+ * Build CREATE POLICY (+ optional ENABLE RLS) for the review pane.
+ *
+ * @param spec - Policy fields
+ * @param enableRls - Also enable RLS on the table
+ */
+export function rlsPolicyPreviewSql(spec: SqlPolicySpec, enableRls: boolean): string {
+  const create = formatCreatePolicyPreview(spec);
+  if (!enableRls) return `${create};`;
+  return `${buildRowSecuritySql(spec.table, true)};\n${create};`;
+}
+
+function formatCreatePolicyPreview(spec: SqlPolicySpec): string {
+  const roles =
+    spec.roles.length === 0
+      ? "public"
+      : spec.roles.map((role) => (role === "public" ? "public" : quotePgIdent(role))).join(", ");
+  const lines = [
+    `CREATE POLICY ${quotePgIdent(spec.name)}`,
+    `  ON ${quotePgIdent(spec.table)}`,
+    `  AS ${spec.behavior}`,
+    `  FOR ${spec.command}`,
+    `  TO ${roles}`,
+  ];
+  if (spec.using !== undefined && spec.using.trim() !== "") {
+    lines.push(`  USING (${spec.using.trim()})`);
+  }
+  if (spec.withCheck !== undefined && spec.withCheck.trim() !== "") {
+    lines.push(`  WITH CHECK (${spec.withCheck.trim()})`);
+  }
+  return lines.join("\n");
+}

package/src/console/ui-next/src/features/store/lib/rtl.test.ts

@@ -0,0 +1,17 @@
+import { describe, expect, test } from "bun:test";
+import { isRtlText } from "./rtl.ts";
+
+describe("isRtlText", () => {
+  test("detects Arabic script as RTL", () => {
+    expect(isRtlText("ملاحظة الراكب")).toBe(true);
+    expect(isRtlText("حجز رقم bk_8f2a")).toBe(true);
+  });
+
+  test("latin / non-strings are not RTL", () => {
+    expect(isRtlText("mara@skyport.dev")).toBe(false);
+    expect(isRtlText("SK-441")).toBe(false);
+    expect(isRtlText(42)).toBe(false);
+    expect(isRtlText(null)).toBe(false);
+    expect(isRtlText({ a: 1 })).toBe(false);
+  });
+});

package/src/console/ui-next/src/features/store/lib/rtl.ts

@@ -0,0 +1,15 @@
+/**
+ * Bidi helpers for mixed RTL/LTR grid cells (e.g. Arabic text next to Latin ids).
+ */
+
+const RTL_RE = /[؀-ۿݐ-ݿࢠ-ࣿﭐ-﷿ﹰ-]/;
+
+/**
+ * True when the first strong directional character is RTL.
+ *
+ * @param value - Cell value
+ */
+export function isRtlText(value: unknown): boolean {
+  if (typeof value !== "string") return false;
+  return RTL_RE.test(value);
+}

package/src/console/ui-next/src/features/store/lib/schema-color.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "bun:test";
+import type { SchemaGraphTable } from "./schema-graph.ts";
+import {
+  SCHEMA_MONO_HEX,
+  colorizeSchemaGraph,
+  schemaClusterLegend,
+  schemaTableClusters,
+} from "./schema-color.ts";
+import { buildSchemaGraph } from "./schema-graph.ts";
+
+function table(
+  name: string,
+  refs: ReadonlyArray<{ readonly column: string; readonly table: string }> = [],
+): SchemaGraphTable {
+  return {
+    id: `sql:${name}`,
+    name,
+    storeName: "db",
+    storeRef: "sql:db",
+    columns: [
+      { name: "id", type: "text", primaryKey: true, nullable: false },
+      ...refs.map((ref) => ({
+        name: ref.column,
+        type: "text",
+        references: { table: ref.table, column: "id" },
+        inferredRef: true,
+      })),
+    ],
+  };
+}
+
+const SEED: readonly SchemaGraphTable[] = [
+  table("teams", [{ column: "parent_id", table: "teams" }]),
+  table("members", [{ column: "team_id", table: "teams" }]),
+  table("cycles", [{ column: "team_id", table: "teams" }]),
+  table("issues", [
+    { column: "team_id", table: "teams" },
+    { column: "project_id", table: "projects" },
+  ]),
+  table("issue_labels", [
+    { column: "issue_id", table: "issues" },
+    { column: "label_id", table: "labels" },
+  ]),
+  table("comments", [{ column: "issue_id", table: "issues" }]),
+  table("customer_requests", [{ column: "issue_id", table: "issues" }]),
+  table("projects", [{ column: "initiative_id", table: "initiatives" }]),
+  table("project_milestones", [{ column: "project_id", table: "projects" }]),
+  table("initiatives"),
+  table("labels", [{ column: "team_id", table: "teams" }]),
+  table("documents"),
+];
+
+describe("schemaTableClusters", () => {
+  test("groups prefix children and single-FK satellites", () => {
+    const clusters = schemaTableClusters(SEED);
+    expect(clusters.get("issue_labels")).toBe("issue");
+    expect(clusters.get("comments")).toBe("issue");
+    expect(clusters.get("customer_requests")).toBe("issue");
+    expect(clusters.get("issues")).toBe("issue");
+    expect(clusters.get("project_milestones")).toBe("project");
+    expect(clusters.get("projects")).toBe("project");
+    expect(clusters.get("members")).toBe("team");
+    expect(clusters.get("cycles")).toBe("team");
+    expect(clusters.get("labels")).toBe("team");
+    expect(clusters.get("teams")).toBe("team");
+    expect(clusters.get("initiatives")).toBe("initiative");
+    expect(clusters.get("documents")).toBe("document");
+  });
+});
+
+describe("colorizeSchemaGraph", () => {
+  test("paints related tables the same hex and edges as the target", () => {
+    const graph = colorizeSchemaGraph(buildSchemaGraph(SEED), true);
+    const comments = graph.nodes.find((n) => n.id === "sql:comments");
+    const issues = graph.nodes.find((n) => n.id === "sql:issues");
+    const projects = graph.nodes.find((n) => n.id === "sql:projects");
+    expect(comments?.data.color?.cluster).toBe("issue");
+    expect(comments?.data.color?.hex).toBe(issues?.data.color?.hex);
+    expect(projects?.data.color?.cluster).toBe("project");
+    expect(projects?.data.color?.hex).not.toBe(issues?.data.color?.hex);
+    const edge = graph.edges.find((e) => e.id.includes("comments.issue_id"));
+    expect(edge?.data?.hex).toBe(issues?.data.color?.hex);
+    expect(comments?.data.refHex?.issue_id).toBe(issues?.data.color?.hex);
+  });
+
+  test("mono flattens every swatch", () => {
+    const graph = colorizeSchemaGraph(buildSchemaGraph(SEED), false);
+    expect(new Set(graph.nodes.map((n) => n.data.color?.hex))).toEqual(new Set([SCHEMA_MONO_HEX]));
+    expect(schemaClusterLegend(SEED).length).toBeGreaterThan(3);
+  });
+});

package/src/console/ui-next/src/features/store/lib/schema-color.ts

@@ -0,0 +1,216 @@
+/**
+ * Smart colorize for the schema visualizer — cluster tables, then paint.
+ *
+ * Clusters: name prefix (`issue_labels` → issues) first, then a single
+ * outgoing FK (comments → issues). Hubs keep their own color.
+ */
+
+import { MarkerType } from "@xyflow/react";
+import type {
+  SchemaGraph,
+  SchemaGraphEdge,
+  SchemaGraphNode,
+  SchemaGraphTable,
+} from "./schema-graph.ts";
+
+/** Header / edge swatch for one table. */
+export type SchemaSwatch = {
+  readonly hex: string;
+  readonly cluster: string;
+};
+
+/** Mono fallback when colorize is off. */
+export const SCHEMA_MONO_HEX = "#38BDF8";
+
+/** Distinct hues that stay readable on the dark canvas. */
+export const SCHEMA_PALETTE = [
+  "#38BDF8",
+  "#34D399",
+  "#FBBF24",
+  "#A78BFA",
+  "#FB7185",
+  "#22D3EE",
+  "#F472B6",
+  "#4ADE80",
+  "#F59E0B",
+  "#818CF8",
+] as const;
+
+/**
+ * Cluster key per table name (stable, singular).
+ *
+ * @param tables - Visualizer tables
+ */
+export function schemaTableClusters(
+  tables: readonly SchemaGraphTable[],
+): ReadonlyMap<string, string> {
+  const names = new Set(tables.map((t) => t.name));
+  const out = new Map<string, string>();
+  for (const table of tables) {
+    out.set(table.name, clusterKey(table, names));
+  }
+  return out;
+}
+
+/**
+ * Swatch per table id.
+ *
+ * @param tables - Visualizer tables
+ */
+export function schemaTableSwatches(
+  tables: readonly SchemaGraphTable[],
+): ReadonlyMap<string, SchemaSwatch> {
+  const clusters = schemaTableClusters(tables);
+  const keys = [...new Set(clusters.values())].sort();
+  const hexByCluster = new Map<string, string>();
+  for (const [index, key] of keys.entries()) {
+    hexByCluster.set(key, SCHEMA_PALETTE[index] ?? hashSwatch(key));
+  }
+  const out = new Map<string, SchemaSwatch>();
+  for (const table of tables) {
+    const cluster = clusters.get(table.name) ?? singularize(table.name);
+    out.set(table.id, { cluster, hex: hexByCluster.get(cluster) ?? SCHEMA_MONO_HEX });
+  }
+  return out;
+}
+
+/**
+ * Unique cluster swatches for the legend (sorted).
+ *
+ * @param tables - Visualizer tables
+ */
+export function schemaClusterLegend(tables: readonly SchemaGraphTable[]): readonly SchemaSwatch[] {
+  const seen = new Set<string>();
+  const out: SchemaSwatch[] = [];
+  for (const swatch of schemaTableSwatches(tables).values()) {
+    if (seen.has(swatch.cluster)) continue;
+    seen.add(swatch.cluster);
+    out.push(swatch);
+  }
+  return out.sort((a, b) => a.cluster.localeCompare(b.cluster));
+}
+
+/**
+ * Paint nodes + edges, or flatten to mono.
+ *
+ * @param graph - Laid-out graph
+ * @param enabled - When false, every table uses {@link SCHEMA_MONO_HEX}
+ */
+export function colorizeSchemaGraph(graph: SchemaGraph, enabled: boolean): SchemaGraph {
+  const swatches = enabled
+    ? schemaTableSwatches(graph.tables)
+    : new Map(graph.tables.map((table) => [table.id, { cluster: "schema", hex: SCHEMA_MONO_HEX }]));
+  const hexByName = new Map<string, string>();
+  for (const table of graph.tables) {
+    const hex = swatches.get(table.id)?.hex;
+    if (hex) hexByName.set(table.name, hex);
+  }
+  return {
+    ...graph,
+    nodes: graph.nodes.map((node) => applyNodeSwatch(node, swatches.get(node.id), hexByName)),
+    edges: graph.edges.map((edge) => applyEdgeSwatch(edge, swatches.get(edge.target))),
+  };
+}
+
+function applyNodeSwatch(
+  node: SchemaGraphNode,
+  swatch: SchemaSwatch | undefined,
+  hexByName: ReadonlyMap<string, string>,
+): SchemaGraphNode {
+  const color = swatch ?? { cluster: "schema", hex: SCHEMA_MONO_HEX };
+  const refHex: Record<string, string> = {};
+  for (const col of node.data.table.columns) {
+    const target = col.references?.table;
+    const hex = target ? hexByName.get(target) : undefined;
+    if (hex) refHex[col.name] = hex;
+  }
+  return {
+    ...node,
+    data: {
+      ...node.data,
+      color,
+      ...(Object.keys(refHex).length > 0 ? { refHex } : {}),
+    },
+  };
+}
+
+function applyEdgeSwatch(edge: SchemaGraphEdge, swatch: SchemaSwatch | undefined): SchemaGraphEdge {
+  const hex = swatch?.hex ?? SCHEMA_MONO_HEX;
+  const inferred = edge.data?.inferred === true;
+  return {
+    ...edge,
+    markerEnd: {
+      type: MarkerType.ArrowClosed,
+      width: 16,
+      height: 16,
+      color: hex,
+    },
+    style: {
+      stroke: hex,
+      strokeWidth: 1.5,
+      ...(inferred ? { strokeDasharray: "5 4" } : {}),
+    },
+    data: {
+      kind: "references",
+      inferred,
+      relation: edge.data?.relation ?? "many-to-one",
+      column: edge.data?.column ?? "",
+      hex,
+    },
+  };
+}
+
+function clusterKey(table: SchemaGraphTable, names: ReadonlySet<string>): string {
+  const prefix = prefixHub(table.name, names);
+  if (prefix) return prefix;
+  if (isPrefixHub(table.name, names)) return singularize(table.name);
+  const fks = table.columns.filter(
+    (col) => col.references?.table && col.references.table !== table.name,
+  );
+  if (fks.length === 1) {
+    const target = fks[0]?.references?.table;
+    if (target) {
+      return prefixHub(target, names) ?? singularize(target);
+    }
+  }
+  return singularize(table.name);
+}
+
+function prefixHub(name: string, names: ReadonlySet<string>): string | null {
+  const prefix = name.split("_")[0];
+  if (!prefix || prefix === name) return null;
+  for (const hub of [prefix, `${prefix}s`, pluralize(prefix)]) {
+    if (names.has(hub) && hub !== name) return singularize(hub);
+  }
+  return null;
+}
+
+function isPrefixHub(name: string, names: ReadonlySet<string>): boolean {
+  const key = singularize(name);
+  for (const other of names) {
+    if (other === name) continue;
+    if (prefixHub(other, names) === key) return true;
+  }
+  return false;
+}
+
+function pluralize(stem: string): string {
+  if (stem.endsWith("y") && !/[aeiou]y$/i.test(stem)) return `${stem.slice(0, -1)}ies`;
+  if (/(?:s|x|z|ch|sh)$/i.test(stem)) return `${stem}es`;
+  return `${stem}s`;
+}
+
+function singularize(name: string): string {
+  if (name.endsWith("ies") && name.length > 3) return `${name.slice(0, -3)}y`;
+  if (/(?:ses|xes|zes|ches|shes)$/i.test(name)) return name.slice(0, -2);
+  if (name.endsWith("s") && !name.endsWith("ss") && name.length > 1) return name.slice(0, -1);
+  return name;
+}
+
+function hashSwatch(key: string): string {
+  let hash = 0;
+  for (let i = 0; i < key.length; i += 1) {
+    hash = (hash * 31 + (key.codePointAt(i) ?? 0)) >>> 0;
+  }
+  return `hsl(${hash % 360} 70% 62%)`;
+}