okmodel 0.5.0 → 0.6.0

package/dist/shared/{g516zdsb.js → 8x72s86k.js}

@@ -1,9 +1,13 @@
 import {
   renderCatalog
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
+import {
+  viewGlobalReason,
+  viewMentions
+} from "./x3jc53kg.js";
 import {
   createClient
-} from "./bt9sfq0z.js";
+} from "./j60w0dvr.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -36,6 +40,41 @@ function readFacts(schema) {
   }
   return facts;
 }
+function readViews(schema) {
+  const tables = new Set;
+  const listed = new Map;
+  for (const object of schema.catalog.objects) {
+    if (object.kind === "table")
+      tables.add(object.identity.name);
+    if (object.kind !== "view" && object.kind !== "materializedView")
+      continue;
+    listed.set(object.identity.name, { kind: object.kind, query: object.definition.query });
+  }
+  const views = [];
+  for (const name of Object.keys(schema.model)) {
+    const model = schema.model[name];
+    if (model === undefined || tables.has(model.sql))
+      continue;
+    const meta = listed.get(model.sql);
+    if (meta === undefined)
+      continue;
+    const reason = viewGlobalReason(model);
+    views.push({
+      name,
+      sql: model.sql,
+      kind: meta.kind,
+      query: meta.query,
+      columns: model.columns.map((column) => ({
+        field: column.field,
+        dataType: column.dataType,
+        guarded: column.guarded
+      })),
+      tenant: reason === undefined && isTenant(schema.tenancy, model),
+      globalReason: reason
+    });
+  }
+  return views;
+}
 function isRequired(column) {
   if (!column.writable || column.guarded || column.fill)
     return false;
@@ -113,7 +152,7 @@ function isTenant(tenancy, model) {
   try {
     return tenancy.predicate({
       table: model.name,
-      fieldSql: (field) => field === tenancy.key ? key?.sql : undefined,
+      fieldSql: (field) => model.columns.find((column) => column.field === field)?.sql,
       encode: key?.encode,
       alias: "t",
       appended: false,
@@ -348,7 +387,7 @@ function paired(host, child, parent, childSql, parentSql, row) {
   return linked;
 }
 async function writeRow(host, facts, data, tenant) {
-  const client = facts.tenant && tenant !== undefined ? openScope(host.db, host.schema.tenancy?.key ?? "tenantId", tenant) : host.db;
+  const client = facts.tenant && tenant !== undefined ? openScope(host.db, host.schema.tenancy, tenant) : host.db;
   const handle = tableHandle(client, facts.name);
   const inserted = await handle.insert(data);
   if (!isRow(inserted)) {
@@ -463,19 +502,26 @@ function fieldOf(facts, sql) {
 function cacheKey(table, tenant) {
   return `${tenant ?? "*"}:${table}`;
 }
+function forgetCached(host, table, tenant) {
+  host.cache.delete(cacheKey(table, tenant));
+}
 function refOf(value) {
   if (typeof value !== "object" || value === null || !(REF in value))
     return;
   const table = value[REF];
   return typeof table === "string" ? table : undefined;
 }
-function openScope(db, key, tenant) {
+function openScope(db, tenancy, tenant) {
   if (!("for" in db) || typeof db.for !== "function") {
     throw new OkmError2("invalid", "This schema has no for().", {
       fix: { summary: "Pass columnTenancy() to schema({ tenancy })." }
     });
   }
-  const opened = db.for({ [key]: tenant });
+  const keys = tenancy?.keys ?? [tenancy?.key ?? "tenantId"];
+  const input = {};
+  for (const key of keys)
+    input[key] = tenant;
+  const opened = db.for(input);
   if (typeof opened !== "object" || opened === null) {
     throw new OkmError2("invalid", "for() did not return a client.", {
       fix: { summary: "The tenant key must be a uuid." }
@@ -502,14 +548,23 @@ function isRow(value) {
 }
 
 // src/tooling/testing/isolation.ts
-var TENANT_A = "00000000-0000-4000-8000-00000000000a";
-var TENANT_B = "00000000-0000-4000-8000-00000000000b";
 async function isolation(host) {
   const saved = host.cache;
   host.cache = new Map;
   try {
+    if (host.schema.tenancy?.strategy === "rls") {
+      const check = host.db["~rls"];
+      if (check === undefined) {
+        throw new OkmError2("invalid", "Row-level security has no policy check on this client.", {
+          fix: { summary: "Open the client from a schema that uses rlsTenancy()." }
+        });
+      }
+      await check();
+    }
     const checked = [];
     const skipped = [];
+    const tenantA = crypto.randomUUID();
+    const tenantB = crypto.randomUUID();
     for (const facts of host.facts.values()) {
       if (facts.globalReason !== undefined) {
         skipped.push({ table: facts.name, reason: facts.globalReason });
@@ -517,33 +572,86 @@ async function isolation(host) {
       }
       if (!facts.tenant)
         continue;
-      await checkTable(host, facts);
+      const hops = host.schema.tenancy?.pathOf?.(facts.name);
+      if (hops !== undefined && hops.length > 0) {
+        await checkPath(host, facts, hops, tenantA, tenantB);
+      } else {
+        await checkTable(host, facts, tenantA, tenantB);
+        const keys = tenantKeys(host);
+        if (keys.length > 1)
+          await checkFlips(host, facts, keys, tenantA, tenantB);
+      }
       checked.push(facts.name);
     }
-    return { checked, skipped };
+    const views = await checkViews(host, tenantA, tenantB, skipped);
+    return { checked, skipped, views };
   } finally {
     host.cache = saved;
   }
 }
-async function checkTable(host, facts) {
+async function checkTable(host, facts, tenantA, tenantB) {
   const key = host.schema.tenancy?.key;
   if (key === undefined)
     return;
-  const row = await insertRow(host, facts.name, { [key]: TENANT_B }, undefined, TENANT_B);
-  const where = primaryWhere(facts, row, key);
-  const client = openTenant(host, TENANT_A);
+  const keys = tenantKeys(host);
+  if (host.definitions.size > 0 && !host.definitions.has(facts.name)) {
+    throw new OkmError2("invalid", `Factory ${facts.name} is missing.`, {
+      fix: { summary: `Add ${facts.name} to factories().` }
+    });
+  }
+  const row = await insertRow(host, facts.name, { [key]: tenantB }, undefined, tenantB);
+  const where = primaryWhere(facts, row, keys);
+  const client = openTenant(host, tenantA);
   const handle = tableHandle2(client, facts.name);
-  const found = await handle.find({ where, limit: 1 });
-  const rows = asRows(found);
+  try {
+    await readTenant(facts, handle, where);
+    const set = updateSet(host, facts, row);
+    if (set !== undefined) {
+      const updated = asCount(await handle.update({ where, set }));
+      if (updated > 0)
+        leak(facts.name, "update", { count: updated });
+      if (typeof client.batch === "function") {
+        const batched = await client.batch([handle.update({ where, set })]);
+        if (Array.isArray(batched) && batched.some((item) => asCount(item) > 0)) {
+          leak(facts.name, "batch", batched);
+        }
+      }
+    }
+    const removed = asCount(await handle.delete({ where }));
+    if (removed > 0)
+      leak(facts.name, "delete", { count: removed });
+  } finally {
+    const owner = tableHandle2(openTenant(host, tenantB), facts.name);
+    await owner.delete({ where }).catch(() => {
+      return;
+    });
+    forgetCached(host, facts.name, tenantB);
+  }
+}
+async function readTenant(facts, handle, where) {
+  const query = handle.find({ where, limit: 1 });
+  const rows = asRows(await query);
   if (rows.length > 0)
     leak(facts.name, "find", rows[0]);
+  const streamed = handle.find({ where, limit: 1 });
+  if (typeof streamed.stream === "function") {
+    try {
+      for await (const item of streamed.stream()) {
+        if (isRow2(item))
+          leak(facts.name, "stream", item);
+      }
+    } catch (error) {
+      if (!(error instanceof OkmError2) || error.code !== "OKM1111")
+        throw error;
+    }
+  }
   const one = await handle.one({ where });
   if (isRow2(one))
     leak(facts.name, "one", one);
-  const counted = asCount(await handle.count());
+  const counted = asCount(await handle.count({ where }));
   if (counted > 0)
     leak(facts.name, "count", { count: counted });
-  const exists = await handle.exists();
+  const exists = await handle.exists({ where });
   if (exists === true)
     leak(facts.name, "exists", { exists: true });
   const relation = facts.relations[0];
@@ -552,15 +660,28 @@ async function checkTable(host, facts) {
     if (isRow2(included))
       leak(facts.name, "include", included);
   }
-  const set = updateSet(host, facts, row);
-  if (set !== undefined) {
-    const updated = asCount(await handle.update({ where, set }));
-    if (updated > 0)
-      leak(facts.name, "update", { count: updated });
+  if (typeof handle.aggregate === "function") {
+    const aggregated = await handle.aggregate({ where, count: true });
+    if (Array.isArray(aggregated)) {
+      for (const item of aggregated) {
+        if (isRow2(item) && asCount(item) > 0)
+          leak(facts.name, "aggregate", item);
+      }
+    }
+  }
+  if (typeof handle.page === "function") {
+    const orderField = Object.keys(where)[0];
+    if (orderField !== undefined) {
+      const paged = await handle.page({
+        where,
+        orderBy: { [orderField]: "asc" },
+        limit: 5
+      });
+      if (isRow2(paged) && Array.isArray(paged.items) && paged.items.length > 0) {
+        leak(facts.name, "page", paged.items[0]);
+      }
+    }
   }
-  const deleted = asCount(await handle.delete({ where }));
-  if (deleted > 0)
-    leak(facts.name, "delete", { count: deleted });
 }
 function includeOf(relation) {
   if (relation.kind === "many")
@@ -590,10 +711,10 @@ function valueFrom(host, facts, field, row) {
     return host.rng.uuid();
   }
 }
-function primaryWhere(facts, row, tenantKey) {
+function primaryWhere(facts, row, tenantKeys) {
   const where = {};
   for (const field of facts.primary) {
-    if (field === tenantKey)
+    if (tenantKeys.includes(field))
       continue;
     where[field] = row[field];
   }
@@ -610,15 +731,340 @@ ${JSON.stringify(row)}`, {
     fix: { summary: "A query under tenant A returned a row inserted for tenant B." }
   });
 }
+function tenantKeys(host) {
+  const tenancy = host.schema.tenancy;
+  if (tenancy === undefined)
+    return [];
+  if (tenancy.keys !== undefined && tenancy.keys.length > 0)
+    return tenancy.keys;
+  return [tenancy.key];
+}
+function scopeFor(keys, tenant) {
+  const input = {};
+  for (const key of keys)
+    input[key] = tenant;
+  return input;
+}
+async function checkFlips(host, facts, keys, tenantA, tenantB) {
+  const template = await insertRow(host, facts.name, undefined, undefined, tenantB);
+  const data = { ...template };
+  for (const key of keys)
+    delete data[key];
+  const clientA = openTenant(host, scopeFor(keys, tenantA));
+  try {
+    for (let index = 0;index < keys.length; index += 1) {
+      const values = scopeFor(keys, tenantA);
+      const flipped = keys[index];
+      if (flipped === undefined)
+        continue;
+      values[flipped] = tenantB;
+      const client = openTenant(host, values);
+      const stored = await tableHandle2(client, facts.name).insert(data);
+      if (!isRow2(stored))
+        continue;
+      const where = primaryWhere(facts, stored, keys);
+      await readTenant(facts, tableHandle2(clientA, facts.name), where);
+      await tableHandle2(client, facts.name).delete({ where }).catch(() => {
+        return;
+      });
+    }
+  } finally {
+    const where = primaryWhere(facts, template, keys);
+    await tableHandle2(openTenant(host, tenantB), facts.name).delete({ where }).catch(() => {
+      return;
+    });
+    forgetCached(host, facts.name, tenantB);
+  }
+}
+async function checkPath(host, facts, hops, tenantA, tenantB) {
+  const keys = tenantKeys(host);
+  const created = [];
+  const last = hops[hops.length - 1];
+  if (last === undefined)
+    return;
+  let parent = await insertRow(host, last.parent, undefined, undefined, tenantB);
+  created.push({
+    table: last.parent,
+    where: primaryWhere(requireFacts(host, last.parent), parent, keys)
+  });
+  for (let index = hops.length - 1;index >= 0; index -= 1) {
+    const hop = hops[index];
+    if (hop === undefined)
+      continue;
+    const row = await insertRow(host, hop.child, { [hop.localField]: parent[hop.remoteField] }, undefined, tenantB);
+    parent = row;
+    created.push({
+      table: hop.child,
+      where: primaryWhere(requireFacts(host, hop.child), row, keys)
+    });
+  }
+  const where = primaryWhere(facts, parent, keys);
+  const client = openTenant(host, tenantA);
+  try {
+    await readTenant(facts, tableHandle2(client, facts.name), where);
+    const set = updateSet(host, facts, parent);
+    if (set !== undefined) {
+      const updated = asCount(await tableHandle2(client, facts.name).update({ where, set }));
+      if (updated > 0)
+        leak(facts.name, "update", { count: updated });
+    }
+    const removed = asCount(await tableHandle2(client, facts.name).delete({ where }));
+    if (removed > 0)
+      leak(facts.name, "delete", { count: removed });
+  } finally {
+    for (let index = created.length - 1;index >= 0; index -= 1) {
+      const item = created[index];
+      if (item === undefined)
+        continue;
+      await tableHandle2(openTenant(host, tenantB), item.table).delete({ where: item.where }).catch(() => {
+        return;
+      });
+      forgetCached(host, item.table, tenantB);
+    }
+  }
+}
+var SCAN_LIMIT = 100;
+async function checkViews(host, tenantA, tenantB, skipped) {
+  const checked = [];
+  const keys = tenantKeys(host);
+  for (const view of readViews(host.schema)) {
+    if (view.globalReason !== undefined) {
+      skipped.push({ table: view.name, reason: view.globalReason });
+      continue;
+    }
+    if (!view.tenant)
+      continue;
+    await checkView(host, view, keys, tenantA, tenantB);
+    checked.push(view.name);
+  }
+  return checked;
+}
+async function checkView(host, view, keys, tenantA, tenantB) {
+  const sources = orderSources(host, sourceNames(host, view.query));
+  if (sources.length === 0) {
+    throw new OkmError2("invalid", `View ${view.name} names no table isolation can seed.`, {
+      fieldReason: "no-source",
+      fix: { summary: 'Point the view at a table in this schema, or mark it global("reason").' }
+    });
+  }
+  for (const name of sources) {
+    if (host.definitions.size > 0 && !host.definitions.has(name)) {
+      throw new OkmError2("invalid", `Factory ${name} is missing.`, {
+        fix: { summary: `Add ${name} to factories().` }
+      });
+    }
+  }
+  const before = new Map(host.cache);
+  const seeded = [];
+  try {
+    for (const tenant of [tenantA, tenantB]) {
+      for (const name of sources) {
+        const facts = requireFacts(host, name);
+        const key = keys[0];
+        const overrides = markerFor(view, facts, keys, tenant);
+        if (key !== undefined)
+          overrides[key] = tenant;
+        const row = await insertRow(host, name, overrides, undefined, tenant);
+        if (tenant === tenantB)
+          seeded.push(row);
+      }
+    }
+    const handle = viewHandle(openTenant(host, tenantA), view.name);
+    if (view.kind === "materializedView") {
+      if (handle.refresh === undefined) {
+        throw new OkmError2("invalid", `View ${view.name} has no refresh().`, {
+          fieldReason: "no-refresh",
+          fix: { summary: "A materialized view refreshes before the isolation read." }
+        });
+      }
+      await handle.refresh();
+    }
+    await readView(view, handle, keys, tenantB, seeded);
+  } finally {
+    await dropNewRows(host, before, keys);
+  }
+}
+function sourceNames(host, query) {
+  const names = [];
+  for (const facts of host.facts.values()) {
+    if (viewMentions(query, facts.sql) || viewMentions(query, facts.name))
+      names.push(facts.name);
+  }
+  return names;
+}
+function orderSources(host, names) {
+  const wanted = new Set(names);
+  const ordered = [];
+  const pending = [...names];
+  const guard = pending.length * pending.length + 1;
+  let spins = 0;
+  while (pending.length > 0 && spins < guard) {
+    spins += 1;
+    const name = pending.shift();
+    if (name === undefined)
+      break;
+    const facts = host.facts.get(name);
+    const waiting = facts?.foreignKeys.some((key) => {
+      let parent;
+      for (const item of host.facts.values()) {
+        if (item.sql === key.target)
+          parent = item.name;
+      }
+      return parent !== undefined && wanted.has(parent) && !ordered.includes(parent);
+    });
+    if (waiting)
+      pending.push(name);
+    else
+      ordered.push(name);
+  }
+  return ordered.length === names.length ? ordered : [...names];
+}
+function markerFor(view, facts, keys, tenant) {
+  const value = `isolation-${tenant}`;
+  const out = {};
+  for (const column of view.columns) {
+    if (column.guarded || keys.includes(column.field))
+      continue;
+    if (column.dataType.toLowerCase() !== "text")
+      continue;
+    const source = facts.columns.find((item) => item.field === column.field);
+    if (source === undefined || !source.writable || source.guarded)
+      continue;
+    if (keys.includes(source.field))
+      continue;
+    if (facts.foreignKeys.some((key) => key.columns.includes(source.sql)))
+      continue;
+    out[source.field] = value;
+  }
+  return out;
+}
+async function readView(view, handle, keys, tenantB, seeded) {
+  const exposed = view.columns.filter((column) => keys.includes(column.field));
+  const where = markerWhere(view, keys, seeded);
+  if (where === undefined && exposed.length === 0) {
+    throw new OkmError2("invalid", `View ${view.name} exposes no tenant key and no text column isolation can match.`, {
+      fieldReason: "no-marker",
+      fix: { summary: "Expose the tenant key, or a text column isolation can match." }
+    });
+  }
+  if (where !== undefined)
+    await readFiltered(view.name, handle, where);
+  if (exposed.length === 0)
+    return;
+  const rows = asRows(await handle.find({ limit: SCAN_LIMIT }));
+  const needle = tenantB.toLowerCase();
+  for (const row of rows) {
+    for (const column of exposed) {
+      const value = row[column.field];
+      if (typeof value === "string" && value.toLowerCase() === needle)
+        leak(view.name, "find", row);
+    }
+  }
+}
+function markerWhere(view, keys, rows) {
+  for (const column of view.columns) {
+    if (column.guarded || keys.includes(column.field))
+      continue;
+    if (column.dataType.toLowerCase() !== "text")
+      continue;
+    for (const row of rows) {
+      const value = row[column.field];
+      if (typeof value === "string")
+        return { [column.field]: value };
+    }
+  }
+  return;
+}
+async function readFiltered(name, handle, where) {
+  const query = handle.find({ where, limit: 1 });
+  const rows = asRows(await query);
+  if (rows.length > 0)
+    leak(name, "find", rows[0]);
+  const streamed = handle.find({ where, limit: 1 });
+  if (typeof streamed.stream === "function") {
+    try {
+      for await (const item of streamed.stream()) {
+        if (isRow2(item))
+          leak(name, "stream", item);
+      }
+    } catch (error) {
+      if (!(error instanceof OkmError2) || error.code !== "OKM1111")
+        throw error;
+    }
+  }
+  const one = await handle.one({ where });
+  if (isRow2(one))
+    leak(name, "one", one);
+  if (asCount(await handle.count({ where })) > 0)
+    leak(name, "count", { count: 1 });
+  if (await handle.exists({ where }) === true)
+    leak(name, "exists", { exists: true });
+}
+async function dropNewRows(host, before, keys) {
+  const added = [];
+  for (const [key, row] of host.cache) {
+    if (!before.has(key))
+      added.push({ key, row });
+  }
+  for (let index = added.length - 1;index >= 0; index -= 1) {
+    const item = added[index];
+    if (item === undefined)
+      continue;
+    const colon = item.key.indexOf(":");
+    const scope = item.key.slice(0, colon);
+    const table = item.key.slice(colon + 1);
+    const facts = host.facts.get(table);
+    const tenant = scope === "*" ? undefined : scope;
+    if (facts !== undefined) {
+      try {
+        const where = primaryWhere(facts, item.row, keys);
+        const client = tenant === undefined ? host.db : openTenant(host, tenant);
+        await tableHandle2(client, table).delete({ where });
+      } catch {}
+    }
+    forgetCached(host, table, tenant);
+  }
+}
+function viewHandle(client, name) {
+  const views = "views" in client ? client.views : undefined;
+  if (typeof views !== "object" || views === null) {
+    throw new OkmError2("invalid", "The client has no views.", {
+      fix: { summary: "Declare the view on schema({ views }) and connect with that schema." }
+    });
+  }
+  const handle = views[name];
+  if (!isViewQuery(handle)) {
+    throw new OkmError2("invalid", `View ${name} is not on this client.`, {
+      fix: { summary: "A tenant view is read through for().views." }
+    });
+  }
+  return handle;
+}
+function isViewQuery(value) {
+  if (typeof value !== "object" || value === null)
+    return false;
+  const record = value;
+  return typeof record.find === "function" && typeof record.one === "function";
+}
+function requireFacts(host, name) {
+  const facts = host.facts.get(name);
+  if (facts === undefined) {
+    throw new OkmError2("invalid", `Table ${name} is not in the schema.`, {
+      fix: { summary: "The path must name a table in this schema." }
+    });
+  }
+  return facts;
+}
 function openTenant(host, tenant) {
-  const key = host.schema.tenancy?.key ?? "tenantId";
+  const keys = tenantKeys(host);
+  const input = typeof tenant === "string" ? scopeFor(keys, tenant) : tenant;
   const db = host.db;
   if (!("for" in db) || typeof db.for !== "function") {
     throw new OkmError2("invalid", "This schema has no for().", {
       fix: { summary: "Pass columnTenancy() to schema({ tenancy })." }
     });
   }
-  const opened = db.for({ [key]: tenant });
+  const opened = db.for(input);
   if (typeof opened !== "object" || opened === null) {
     throw new OkmError2("invalid", "for() did not return a client.", {
       fix: { summary: "The tenant key must be a uuid." }