okengine 0.13.0 → 0.15.2

package/src/console/server/serve.ts

@@ -244,7 +244,12 @@ export async function serveConsole(
           new Response("WebSocket upgrade failed", { status: 400 }),
         );
       }
-      return fetchHandler(req);
+      return (async () => {
+        const res = await fetchHandler(req);
+        const ct = (res.headers.get("content-type") ?? "").split(";")[0]?.trim() ?? "";
+        if (/^text\/event-stream$/i.test(ct)) srv.timeout(req, 0);
+        return res;
+      })();
     },
     websocket: {
       open: live.open,
@@ -259,6 +264,15 @@ export async function serveConsole(
     boundHost.includes(":") && !boundHost.startsWith("[") ? `[${boundHost}]` : boundHost;
   const url = new URL(`http://${hostForUrl}:${boundPort}/`);
 
+  const closeIdle = (
+    server as typeof server & { closeIdleConnections(): void }
+  ).closeIdleConnections.bind(server);
+  const onPressure = (): void => {
+    closeIdle();
+  };
+  const proc = process as NodeJS.EventEmitter;
+  proc.on("memoryPressure", onPressure);
+
   return {
     console: handle,
     url,
@@ -266,9 +280,10 @@ export async function serveConsole(
     hostname: boundHost,
     fetch: fetchHandler,
     stop(closeActive = false) {
-      server.stop(closeActive);
+      proc.off("memoryPressure", onPressure);
       void handle.app.stop();
       void persistence?.close();
+      return server.stop(closeActive);
     },
   };
 }

package/src/console/server/spa-proxy.test.ts

@@ -61,6 +61,7 @@ describe("serveConsole spaProxy", () => {
     expect(html.status).toBe(200);
     expect(html.headers.get("content-security-policy")).toBe(CONSOLE_VITE_DEV_CSP);
     expect(html.headers.get("content-security-policy")).toContain("unsafe-inline");
+    expect(html.headers.get("content-security-policy")).toContain("frame-src 'self' blob:");
     expect(await html.text()).toContain("vite-spa");
 
     const client = await server.fetch(

package/src/console/server/sql-catalog.ts

@@ -31,6 +31,8 @@ import {
   parseSqlPolicySpec,
   quotePgIdent,
   sqlPolicyRowId,
+  emitStoreSchemaPolicySource,
+  installOkeRlsHelpers,
 } from "../../drivers/pg-rls.ts";
 import type { ConsoleStoreChild, ConsoleWillNotFire } from "./store.ts";
 
@@ -117,18 +119,52 @@ export async function listSqlTableRls(sql: SqlStoreHandle): Promise<ReadonlyMap<
 }
 
 /**
- * Copy RLS flags onto SQL table children. Catalog folders are unchanged.
+ * Live RLS policy counts (`pg_policies`) keyed by table name.
+ *
+ * Counts in process — memory SQL has no `GROUP BY` / `COUNT(*)::int`.
+ *
+ * @param sql - Open SQL handle
+ */
+export async function listSqlTablePolicyCounts(
+  sql: SqlStoreHandle,
+): Promise<ReadonlyMap<string, number>> {
+  try {
+    const rows = await sql.raw(`SELECT * FROM pg_policies`);
+    const out = new Map<string, number>();
+    for (const row of rows) {
+      if (!isAppCatalogSchema(row)) continue;
+      const name = stringOrNull(row.tablename ?? row.table);
+      if (name === null) continue;
+      out.set(name, (out.get(name) ?? 0) + 1);
+    }
+    return out;
+  } catch {
+    return new Map();
+  }
+}
+
+/**
+ * Copy RLS flags and policy counts onto SQL table children. Catalog folders
+ * are unchanged.
  *
  * @param children - Store list children
  * @param rlsByTable - Table name → RLS enabled
+ * @param declared - Manifest RLS when live catalog is empty
+ * @param policyCounts - Table name → live + declared policy count
  */
 export function applySqlTableRls(
   children: readonly ConsoleStoreChild[],
   rlsByTable: ReadonlyMap<string, boolean>,
+  declared?: ReadonlyMap<string, boolean>,
+  policyCounts?: ReadonlyMap<string, number>,
 ): ConsoleStoreChild[] {
   return children.map((child) => {
     if (child.kind !== "table") return child;
-    return { ...child, rls: rlsByTable.get(child.name) ?? child.rls === true };
+    return {
+      ...child,
+      rls: rlsByTable.get(child.name) ?? declared?.get(child.name) ?? child.rls === true,
+      rlsPolicyCount: policyCounts?.get(child.name) ?? child.rlsPolicyCount ?? 0,
+    };
   });
 }
 
@@ -156,6 +192,9 @@ export async function listSqlCatalog(
   limit: number,
 ): Promise<readonly Record<string, unknown>[]> {
   const live = await tryLiveCatalog(sql, kind, limit);
+  if (kind === "policy") {
+    return overlayDeclaredPolicies(live ?? [], manifest, storeName).slice(0, limit);
+  }
   if (live) return live;
   if (kind === "index") return manifestIndexes(manifest, storeName).slice(0, limit);
   if (kind === "extension") return fallbackExtensions().slice(0, limit);
@@ -172,6 +211,11 @@ export async function createSqlPolicy(
   sql: SqlStoreHandle,
   patch: Readonly<Record<string, unknown>>,
 ): Promise<void> {
+  try {
+    await installOkeRlsHelpers((stmt) => sql.raw(stmt));
+  } catch {
+    // Memory / engines without CREATE FUNCTION — CREATE POLICY may still run.
+  }
   const spec = parseSqlPolicySpec(patch);
   if (patch.enableRls === true) {
     await sql.raw(buildRowSecuritySql(spec.table, true));
@@ -393,11 +437,13 @@ function catalogColumnDescriptions(kind: SqlCatalogKind): Readonly<Record<string
     return {
       name: "Policy",
       table: "Table",
+      origin: "Declared or live-only",
       command: "Command",
       roles: "Roles",
       permissive: "Permissive or restrictive",
       using: "USING expression",
       with_check: "WITH CHECK expression",
+      code: "Copy as code",
     };
   }
   return {
@@ -459,19 +505,113 @@ function isAppCatalogSchema(row: Record<string, unknown>): boolean {
 function projectPolicyRow(row: Record<string, unknown>): Record<string, unknown> {
   const name = stringOrNull(row.name ?? row.policyname) ?? "";
   const table = stringOrNull(row.table ?? row.tablename) ?? "";
+  const command = stringOrNull(row.command ?? row.cmd) ?? "ALL";
+  const roles = rolesText(row.roles);
+  const using = stringOrNull(row.using ?? row.qual);
+  const withCheck = stringOrNull(row.with_check);
+  const permissive = stringOrNull(row.permissive) ?? "PERMISSIVE";
   return {
     id: sqlPolicyRowId(table, name),
     name,
     table,
     schema: stringOrNull(row.schema ?? row.schemaname) ?? "public",
-    command: stringOrNull(row.command ?? row.cmd) ?? "ALL",
-    roles: rolesText(row.roles),
-    permissive: stringOrNull(row.permissive) ?? "PERMISSIVE",
-    using: stringOrNull(row.using ?? row.qual),
-    with_check: stringOrNull(row.with_check),
+    command,
+    roles,
+    permissive,
+    using,
+    with_check: withCheck,
+    origin: stringOrNull(row.origin) ?? "live",
+    code: policyCopyAsCode({
+      name,
+      table,
+      command,
+      roles,
+      permissive,
+      using,
+      withCheck,
+    }),
   };
 }
 
+function overlayDeclaredPolicies(
+  live: readonly Record<string, unknown>[],
+  manifest: Manifest | null,
+  storeName: string,
+): Record<string, unknown>[] {
+  const byId = new Map<string, Record<string, unknown>>();
+  for (const row of live) {
+    byId.set(String(row.id), { ...row, origin: "live" });
+  }
+  for (const row of declaredPoliciesFromManifest(manifest, storeName)) {
+    const existing = byId.get(row.id);
+    byId.set(row.id, existing ? { ...existing, ...row, origin: "declared" } : row);
+  }
+  return [...byId.values()];
+}
+
+function declaredPoliciesFromManifest(
+  manifest: Manifest | null,
+  storeName: string,
+): Array<Record<string, unknown> & { readonly id: string }> {
+  const tables = manifest?.stores?.[storeName]?.tables ?? {};
+  const out: Array<Record<string, unknown> & { readonly id: string }> = [];
+  for (const [table, spec] of Object.entries(tables)) {
+    for (const [name, policy] of Object.entries(spec.policies ?? {})) {
+      const command = (policy.for ?? "all").toUpperCase();
+      const roles = Array.isArray(policy.to) ? policy.to.join(", ") : (policy.to ?? "public");
+      const permissive = (policy.as ?? "permissive").toUpperCase();
+      out.push({
+        id: sqlPolicyRowId(table, name),
+        name,
+        table,
+        schema: "public",
+        command,
+        roles,
+        permissive,
+        using: policy.using ?? null,
+        with_check: policy.withCheck ?? null,
+        origin: "declared",
+        code: policyCopyAsCode({
+          name,
+          table,
+          command,
+          roles,
+          permissive,
+          using: policy.using,
+          withCheck: policy.withCheck,
+        }),
+      });
+    }
+  }
+  return out;
+}
+
+function policyCopyAsCode(input: {
+  readonly name: string;
+  readonly table: string;
+  readonly command: string;
+  readonly roles: string;
+  readonly permissive: string;
+  readonly using?: string | null;
+  readonly withCheck?: string | null;
+}): string {
+  try {
+    return emitStoreSchemaPolicySource(
+      parseSqlPolicySpec({
+        name: input.name,
+        table: input.table,
+        command: input.command,
+        behavior: input.permissive,
+        roles: input.roles,
+        using: input.using ?? "",
+        withCheck: input.withCheck ?? "",
+      }),
+    );
+  } catch {
+    return "";
+  }
+}
+
 function projectTriggerRow(row: Record<string, unknown>): Record<string, unknown> {
   const enabled = row.enabled;
   return {

package/src/console/server/sql-rls.test.ts

@@ -41,4 +41,20 @@ describe("applySqlTableRls", () => {
     const rows = [{ ...child("comments"), rls: false }];
     expect(applySqlTableRls(rows, new Map())[0]?.rls).toBe(false);
   });
+
+  test("Manifest declared RLS wins when live catalog is empty", () => {
+    const out = applySqlTableRls([child("bookings")], new Map(), new Map([["bookings", true]]));
+    expect(out[0]?.rls).toBe(true);
+  });
+
+  test("stamps policy counts on tables and leaves catalog folders alone", () => {
+    const out = applySqlTableRls(
+      [child("comments"), child("policies", "policy")],
+      new Map([["comments", true]]),
+      undefined,
+      new Map([["comments", 2]]),
+    );
+    expect(out.find((row) => row.name === "comments")?.rlsPolicyCount).toBe(2);
+    expect(out.find((row) => row.name === "policies")?.rlsPolicyCount).toBeUndefined();
+  });
 });

package/src/console/server/state.ts

@@ -267,13 +267,21 @@ export interface ConsoleState {
       readonly revealPii?: boolean;
       readonly tenant?: string;
       readonly asGate?: string;
+      readonly asUserId?: string;
+      readonly rls?: import("../../drivers/pg-rls.ts").RlsIdentity;
     },
   ) => Promise<{
     readonly rows: readonly Record<string, unknown>[];
     readonly masked: boolean;
     readonly routedRole: "primary" | "replica";
     readonly asGate: string | null;
+    readonly asUserId: string | null;
     readonly gateApplied: boolean;
+    readonly rls: {
+      readonly gate: string | null;
+      readonly userId: string;
+      readonly applied: boolean;
+    };
   }>;
   /** Engine-native pg_stat_statements + KPIs. */
   queryStoreSqlStats: (ref: ResourceRef) => Promise<import("./store-stats.ts").StoreSqlStatsResult>;

package/src/console/server/store.test.ts

@@ -578,10 +578,11 @@ describe("queryStore SQL catalog", () => {
       declaredFingerprint: "x",
       appliedFingerprint: "x",
     });
-    expect(
-      listedOn.stores.find((s) => s.ref === "sql:db")?.children.find((c) => c.name === "bookings")
-        ?.rls,
-    ).toBe(true);
+    const listedBookings = listedOn.stores
+      .find((s) => s.ref === "sql:db")
+      ?.children.find((c) => c.name === "bookings");
+    expect(listedBookings?.rls).toBe(true);
+    expect(listedBookings?.rlsPolicyCount).toBe(1);
 
     await editStore(
       runtime,
@@ -1097,7 +1098,9 @@ describe("runStoreSql", () => {
       asGate: "public",
     });
     expect(result.asGate).toBe("public");
+    expect(result.asUserId).toBeNull();
     expect(result.gateApplied).toBe(false);
+    expect(result.rls.applied).toBe(false);
     expect(result.rows).toHaveLength(1);
     await runtime.close();
   });