okmodel 0.5.1 → 0.7.0

package/dist/shared/{sycnx8gt.js → ax7qv55k.js}

@@ -4,24 +4,26 @@ import {
   viewDependencyEdges,
   PUBLIC,
   introspectSchema
-} from "./fancm5pt.js";
+} from "./b5pftnn2.js";
 import {
   planMigration,
+  sessionFailure,
+  finishQuiet,
   assertDirectConnection,
   assertStableBackend
-} from "./ga3sfy93.js";
+} from "./tsvww22q.js";
 import {
   quoteIdent,
   createObjectSql
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
 import {
   normaliseViewQuery,
   viewObject,
   materializedViewObject
-} from "./y005b761.js";
+} from "./zy8r7qvz.js";
 import {
   catalog
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   OkmError2
 } from "./52szzakm.js";
@@ -88,7 +90,8 @@ async function sealViews(runner, source) {
           query,
           owner: object.owner,
           provenance: object.provenance,
-          dependencies
+          dependencies,
+          ...object.definition.securityInvoker === true ? { securityInvoker: true } : {}
         });
       }
       return materializedViewObject({
@@ -256,8 +259,10 @@ ${plan.steps.map((step) => step.sql).join(`
         summary: "Change the schema or the database so okm check reports no difference."
       }
     });
+  } catch (error) {
+    throw sessionFailure(error) ?? error;
   } finally {
-    await sql.end({ timeout: 5 });
+    await finishQuiet(() => sql.end({ timeout: 5 }));
   }
 }
 function catalogQuery2(sql) {
@@ -275,12 +280,17 @@ function catalogQuery2(sql) {
 }
 function managedRoleOptions2(roles) {
   const names = managedRoleNames(roles);
-  return names === undefined ? undefined : { managedRoles: names };
+  return names === undefined ? undefined : {
+    managedRoles: names,
+    ...roles?.reporting !== undefined ? { reportingRole: roles.reporting } : {}
+  };
 }
 function managedRoleNames(roles) {
   if (roles === undefined)
     return;
   const names = new Set([roles.migration, roles.app]);
+  if (roles.reporting !== undefined)
+    names.add(roles.reporting);
   for (const role of roles.managed ?? [])
     names.add(role.name);
   return [...names];

package/dist/shared/{f5cw5q5r.js → aytqh5y2.js}

@@ -1,14 +1,16 @@
 import {
-  open3
-} from "./87jvvhnt.js";
+  open3,
+  seal2
+} from "./81ebdx9p.js";
 import {
   PGLITE_CAPABILITIES,
   readCapability2,
   hasCapability2
-} from "./cgbamx3e.js";
+} from "./kb2sdhfb.js";
 export {
   PGLITE_CAPABILITIES as capabilities,
   hasCapability2 as hasCapability,
   open3 as open,
-  readCapability2 as readCapability
+  readCapability2 as readCapability,
+  seal2 as seal
 };

package/dist/shared/{fancm5pt.js → b5pftnn2.js}

@@ -2,28 +2,34 @@ import {
   roleObject,
   grantObject,
   defaultPrivilegeObject
-} from "./8bwbwy8h.js";
+} from "./qq3899ht.js";
+import {
+  columnPrivilege
+} from "./tsvww22q.js";
 import {
   quoteIdent
-} from "./8xsbagad.js";
+} from "./9s0ypp87.js";
+import {
+  policyObject
+} from "./bdk4sty6.js";
 import {
   functionObject,
   triggerObject
-} from "./9x25fxhc.js";
+} from "./y34a8714.js";
 import {
   normaliseViewQuery,
   viewObject,
   materializedViewObject,
   materializedViewIndex
-} from "./y005b761.js";
+} from "./zy8r7qvz.js";
 import {
   extensionObject
-} from "./8ktwd3rh.js";
+} from "./r3j8s5y0.js";
 import {
   catalog,
   enumType,
   domainType
-} from "./g7ez901n.js";
+} from "./ywspezzx.js";
 import {
   staticNamespace2,
   identityKey2,
@@ -32,7 +38,7 @@ import {
   index3,
   constraint2,
   sequence2
-} from "./t4tbsy9h.js";
+} from "./358zsv4r.js";
 import {
   referentialAction
 } from "./4e4c6vq2.js";
@@ -123,7 +129,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     triggers,
     functionDeps,
     views,
-    viewDeps
+    viewDeps,
+    policies
   ] = await Promise.all([
     runner.query(TABLES, params),
     runner.query(COLUMNS, params),
@@ -137,7 +144,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     runner.query(TRIGGERS, params),
     runner.query(FUNCTION_DEPS, params),
     runner.query(VIEWS, params),
-    runner.query(VIEW_DEPENDENCIES, params)
+    runner.query(VIEW_DEPENDENCIES, params),
+    runner.query(POLICIES, params)
   ]);
   const objects = [];
   const parents = new Map;
@@ -380,12 +388,38 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     const columns = printedColumns(text(row, "columns"));
     const query = normaliseViewQuery(text(row, "query"));
     const name = text(row, "name");
+    const invoker = kind === "view" && securityInvokerOption(text(row, "options"));
     if (kind === "materializedView") {
       objects.push(materializedViewObject({ namespace, name, columns, query, provenance }));
     } else {
-      objects.push(viewObject({ namespace, name, columns, query, provenance }));
+      objects.push(viewObject({
+        namespace,
+        name,
+        columns,
+        query,
+        provenance,
+        ...invoker ? { securityInvoker: true } : {}
+      }));
     }
   }
+  for (const row of policies) {
+    const parentName = text(row, "table_name");
+    const parent = parents.get(parentName);
+    if (parent === undefined)
+      continue;
+    const command = policyCommand(text(row, "command"));
+    if (command === undefined || text(row, "enabled") !== "true")
+      continue;
+    objects.push(policyObject({
+      parent,
+      name: text(row, "name"),
+      command,
+      expression: text(row, "using_expr"),
+      force: text(row, "force") === "true",
+      provenance,
+      dependencies: [{ kind: "table", namespace, name: parentName }]
+    }));
+  }
   const viewEdges = viewDependencyEdges(viewDeps, namespace, objects);
   for (let index = 0;index < objects.length; index += 1) {
     const object = objects[index];
@@ -402,7 +436,8 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
       columns: object.definition.columns,
       query: object.definition.query,
       provenance,
-      dependencies
+      dependencies,
+      ...object.definition.securityInvoker === true ? { securityInvoker: true } : {}
     }) : materializedViewObject({
       namespace,
       name: object.identity.name,
@@ -413,7 +448,7 @@ async function introspectSchema(runner, concrete, logical = "public", options) {
     });
   }
   if (options?.managedRoles !== undefined) {
-    objects.push(...await readPrivileges(runner, concrete, namespace, provenance, objects, options.managedRoles));
+    objects.push(...await readPrivileges(runner, concrete, logical, namespace, provenance, objects, options.managedRoles, options.reportingRole));
   }
   return catalog(objects);
 }
@@ -452,6 +487,30 @@ var FUNCTION_GRANTS = `select p.proname as name,
       select 1 from pg_depend d
       where d.classid = 'pg_proc'::regclass and d.objid = p.oid and d.deptype = 'e'
     )`;
+var COLUMN_GRANTS = `select c.relname as name,
+  case c.relkind when 'v' then 'view' when 'm' then 'materializedView' else 'table' end as kind,
+  a.attname as column_name,
+  r.rolname as role, x.privilege_type as privilege
+  from pg_class c
+  join pg_namespace n on n.oid = c.relnamespace
+  join pg_attribute a on a.attrelid = c.oid and a.attnum > 0 and not a.attisdropped
+  cross join lateral aclexplode(a.attacl) as x
+  join pg_roles r on r.oid = x.grantee
+  where n.nspname = $1
+    and c.relkind in ('r', 'p', 'v', 'm')
+    and a.attacl is not null
+    and x.grantee <> 0
+    and x.grantee <> c.relowner`;
+var SCHEMA_USAGE = `select 1 as ok
+  from pg_namespace n
+  cross join lateral aclexplode(n.nspacl) as a
+  where n.nspname = $1
+    and a.privilege_type = 'USAGE'
+    and (
+      a.grantee = 0
+      or a.grantee = (select oid from pg_roles where rolname = $2)
+    )
+  limit 1`;
 var DEFAULT_PRIVILEGES = `select owner_role.rolname as for_role, grantee.rolname as grantee,
   case d.defaclobjtype when 'S' then 'sequence' when 'f' then 'function' else 'table' end as object_kind,
   a.privilege_type as privilege
@@ -463,13 +522,15 @@ var DEFAULT_PRIVILEGES = `select owner_role.rolname as for_role, grantee.rolname
   where n.nspname = $1
     and d.defaclobjtype in ('r', 'S', 'f')
     and a.grantee <> 0`;
-async function readPrivileges(runner, concrete, namespace, provenance, built, managedRoles) {
+async function readPrivileges(runner, concrete, logical, namespace, provenance, built, managedRoles, reportingRole) {
   const managed = new Set(managedRoles);
-  const [roles, relations, functions, defaults] = await Promise.all([
+  const [roles, relations, functions, defaults, columns, usage] = await Promise.all([
     runner.query(ROLES, []),
     runner.query(RELATION_GRANTS, [concrete]),
     runner.query(FUNCTION_GRANTS, [concrete]),
-    runner.query(DEFAULT_PRIVILEGES, [concrete])
+    runner.query(DEFAULT_PRIVILEGES, [concrete]),
+    runner.query(COLUMN_GRANTS, [concrete]),
+    reportingRole === undefined ? Promise.resolve([]) : runner.query(SCHEMA_USAGE, [concrete, reportingRole])
   ]);
   const objects = [];
   for (const row of roles) {
@@ -530,6 +591,42 @@ async function readPrivileges(runner, concrete, namespace, provenance, built, ma
       ]
     }));
   }
+  const grouped = new Map;
+  for (const row of columns) {
+    const privilege = text(row, "privilege").toUpperCase();
+    if (privilege !== "SELECT" && privilege !== "UPDATE")
+      continue;
+    const kind = grantKind(text(row, "kind"));
+    if (kind !== "table" && kind !== "view" && kind !== "materializedView")
+      continue;
+    const name = text(row, "name");
+    const role = text(row, "role");
+    const key = `${role}\x00${kind}\x00${name}\x00${privilege}`;
+    const current = grouped.get(key) ?? { role, kind, name, privilege, columns: [] };
+    current.columns.push(text(row, "column_name"));
+    grouped.set(key, current);
+  }
+  for (const group of grouped.values()) {
+    const target = built.find((object) => privilegeTarget(object) === `${group.kind}:${group.name}`);
+    if (target === undefined)
+      continue;
+    objects.push(grantObject({
+      role: group.role,
+      object: { kind: group.kind, namespace, name: group.name },
+      privilege: columnPrivilege(group.privilege, group.columns),
+      provenance,
+      dependencies: [{ kind: "role", name: group.role }, target.identity]
+    }));
+  }
+  if (usage.length > 0 && reportingRole !== undefined) {
+    objects.push(grantObject({
+      role: reportingRole,
+      object: { kind: "namespace", namespace, name: logical },
+      privilege: "USAGE",
+      provenance,
+      dependencies: [{ kind: "role", name: reportingRole }]
+    }));
+  }
   return objects;
 }
 function privilegeTarget(object) {
@@ -788,6 +885,7 @@ var TRIGGERS = `
 `;
 var VIEWS = `
   select c.relname as name, c.relkind as kind, pg_get_viewdef(c.oid, true) as query,
+    coalesce(array_to_string(c.reloptions, ','), '') as options,
     (
       select coalesce(string_agg(
         a.attname || '|' || format_type(a.atttypid, a.atttypmod),
@@ -821,6 +919,31 @@ var FUNCTION_DEPS = `
     and p.prokind = 'f'
     and p.prosrc = ''
 `;
+var POLICIES = `
+  select c.relname as table_name,
+    p.polname as name,
+    p.polcmd as command,
+    coalesce(pg_get_expr(p.polqual, p.polrelid), '') as using_expr,
+    c.relforcerowsecurity::text as force,
+    c.relrowsecurity::text as enabled
+  from pg_policy p
+  join pg_class c on c.oid = p.polrelid
+  join pg_namespace n on n.oid = c.relnamespace
+  where n.nspname = $1
+    and c.relkind = 'r'
+    and ${CHILD}
+    and ${member("c.oid", "pg_class")}
+`;
+function securityInvokerOption(options) {
+  return options.split(",").some((item) => item === "security_invoker=true" || item === "security_invoker=on");
+}
+function policyCommand(command) {
+  if (command === "*")
+    return "all";
+  if (command === "r")
+    return "select";
+  return;
+}
 function member(oid, classid) {
   return `not exists (
     select 1 from pg_depend member

package/dist/shared/{efmy2gcg.js → b76b8d95.js}

@@ -2,10 +2,10 @@ import {
   DriverError2,
   outcomeUnknown2,
   mapDriverError2
-} from "./31vm914h.js";
+} from "./cm3w0ywp.js";
 import {
   isConnectionLost
-} from "./pf0d8f77.js";
+} from "./cnkky55j.js";
 
 // src/adapters/pg/batch.ts
 var savepointIds = 0;

package/dist/shared/bdk4sty6.js

@@ -0,0 +1,58 @@
+import {
+  assertNamespace2,
+  normaliseEdges,
+  assertProvenance
+} from "./358zsv4r.js";
+import {
+  isReservedIdentifier2,
+  assertIdentifier2,
+  fitIdentifier2,
+  assertStoredText
+} from "./nfzc5z0w.js";
+import {
+  catalogError2
+} from "./52szzakm.js";
+
+// src/contracts/catalog/policy.ts
+var BARE_IDENT = /^[a-z_][a-z0-9_$]*$/;
+function policyIdent(name) {
+  if (BARE_IDENT.test(name) && !isReservedIdentifier2(name))
+    return name;
+  return `"${name.replaceAll('"', '""')}"`;
+}
+function tenantPolicyExpression(column, dataType) {
+  return `(${policyIdent(column)} = (NULLIF(current_setting('app.tenant'::text, true), ''::text))::${dataType})`;
+}
+function unscopedPolicyExpression() {
+  return `(current_setting('app.unscoped'::text, true) = 'on'::text)`;
+}
+function policyObject(input) {
+  assertNamespace2(input.parent.namespace);
+  assertIdentifier2(input.parent.name, "policy parent");
+  assertIdentifier2(input.name, "policy");
+  assertStoredText(input.expression, "policy expression");
+  if (input.command !== "all" && input.command !== "select") {
+    catalogError2("OKM1020", `Policy ${input.name} command is not supported.`);
+  }
+  assertProvenance(input.provenance);
+  const parent = {
+    kind: "table",
+    namespace: input.parent.namespace,
+    name: input.parent.name
+  };
+  const definition = {
+    command: input.command,
+    expression: input.expression,
+    force: input.force
+  };
+  return {
+    kind: "policy",
+    identity: { kind: "policy", parent: input.parent, name: fitIdentifier2(input.name) },
+    owner: input.owner ?? "managed",
+    definition,
+    dependencies: normaliseEdges([parent, ...input.dependencies ?? []]),
+    provenance: input.provenance
+  };
+}
+
+export { tenantPolicyExpression, unscopedPolicyExpression, policyObject };

package/dist/shared/{32zqc1dw.js → bg3rym3g.js}

@@ -1,15 +1,15 @@
 import {
   touchFields,
   fieldSealed
-} from "./7m88x3e9.js";
+} from "./1w508jbr.js";
 import {
   projectExpr,
   quote,
   list,
   isRecord,
   registerFailFix,
-  fail
-} from "./gbtcc2d7.js";
+  fail2
+} from "./67txcrcw.js";
 import {
   throwNamed2
 } from "./52szzakm.js";
@@ -24,13 +24,13 @@ function readConflict(table, value, allow = NO_ALLOW, tenantKey) {
   if (value === "ignore")
     return { kind: "ignore", columns: [], update: [] };
   if (!isRecord(value)) {
-    fail("OKM1120", 'onConflict must be "error", "ignore", { on, update }, or { on, return: true }.');
+    fail2("OKM1120", 'onConflict must be "error", "ignore", { on, update }, or { on, return: true }.');
   }
   const keys = Object.keys(value);
   const update = value.update;
   const ret = value.return;
   if (update !== undefined && ret !== undefined) {
-    fail("OKM1120", "onConflict takes update or return, not both.");
+    fail2("OKM1120", "onConflict takes update or return, not both.");
   }
   if (ret === true) {
     rejectConflictKeys(keys, ["on", "return"]);
@@ -44,9 +44,9 @@ function readConflict(table, value, allow = NO_ALLOW, tenantKey) {
       update: updateColumns(table, update, allow)
     };
   }
-  fail("OKM1120", 'onConflict must be "error", "ignore", { on, update }, or { on, return: true }.');
+  fail2("OKM1120", 'onConflict must be "error", "ignore", { on, update }, or { on, return: true }.');
 }
-function finishInsert(head, returning, params, plan, table, returningColumns, keys) {
+function finishInsert(head, returning, params, plan, table) {
   if (plan.kind === "ignore") {
     return { text: `${head} on conflict do nothing${returning}`, params: [...params] };
   }
@@ -66,10 +66,13 @@ function finishInsert(head, returning, params, plan, table, returningColumns, ke
       params: [...params]
     };
   }
-  return firstOrCreate(head, returning, params, plan.columns, table, returningColumns, keys);
+  return {
+    text: `${head} on conflict (${target})${conflictWhere(table, plan.columns)} do nothing${returning}`,
+    params: [...params]
+  };
 }
-function firstOrCreate(head, returning, params, keys, table, returningColumns, keyRows) {
-  const next = [...params];
+function lookupExisting(table, keys, returningColumns, keyRows) {
+  const params = [];
   const tuples = [];
   for (const row of keyRows) {
     const slots = [];
@@ -77,18 +80,21 @@ function firstOrCreate(head, returning, params, keys, table, returningColumns, k
       const column = keys[index];
       if (column === undefined)
         continue;
-      next.push(row[index] ?? null);
-      slots.push(`$${String(next.length)}::${column.dataType}`);
+      params.push(row[index] ?? null);
+      slots.push(`$${String(params.length)}::${column.dataType}`);
     }
     tuples.push(keys.length === 1 ? slots[0] ?? "null" : `(${slots.join(", ")})`);
   }
-  const keyList = keys.map((column) => quote(column.sql)).join(", ");
   const left = keys.length === 1 ? `t.${quote(keys[0]?.sql ?? "")}` : `(${keys.map((column) => `t.${quote(column.sql)}`).join(", ")})`;
-  const names = returningColumns.map((column) => quote(column.field)).join(", ");
-  const fromTable = returningColumns.map((column) => projectExpr(`t.${quote(column.sql)}`, column.dataType)).join(", ");
-  const match = keys.map((column) => `ins.${quote(column.field)} = t.${quote(column.sql)}`).join(" and ");
-  const text = `with ins(${names}) as (${head} on conflict (${keyList})${conflictWhere(table, keys)} do nothing${returning}) select ${names} from ins union all select ${fromTable} from ${quote(table.model.sql)} t where ${left} in (${tuples.join(", ")}) and not exists (select 1 from ins where ${match})`;
-  return { text, params: next };
+  const projected = returningColumns.map((column) => projectExpr(`t.${quote(column.sql)}`, column.dataType)).join(", ");
+  const text = `select ${projected} from ${quote(table.model.sql)} t where ${left} in (${tuples.join(", ")})${activeAnd(table, keys)}`;
+  return { text, params };
+}
+function activeAnd(table, columns) {
+  const clause = conflictWhere(table, columns);
+  if (clause === "")
+    return "";
+  return ` and t.${clause.replace(/^ where /, "")}`;
 }
 function conflictWhere(table, columns) {
   const archive = table.model.archive;
@@ -112,27 +118,29 @@ function samePrimary(table, columns) {
 }
 function uniqueColumns(table, on, tenantKey) {
   const names = conflictNames(on);
+  const keys = keyList(tenantKey);
   for (const unique of table.model.uniques) {
-    if (!same(unique, names))
+    const fields = fieldsOf(unique, names, keys);
+    if (fields === undefined)
       continue;
     const columns = [];
-    for (const name of names) {
+    for (const name of fields) {
       const column = table.columns.get(name);
       if (column === undefined) {
-        fail("OKM1104", `onConflict column ${name} is not on ${table.model.name}.`);
+        fail2("OKM1104", `onConflict column ${name} is not on ${table.model.name}.`);
       }
       columns.push(column);
     }
     return columns;
   }
-  const accepted = acceptedConstraints(table.model, tenantKey);
-  const implicit = tenantKey === undefined ? "" : ` The tenant key ${tenantKey} is part of each one and is not named here.`;
+  const accepted = acceptedConstraints(table.model, keys);
+  const implicit = keys.length === 0 ? "" : ` The tenant key ${keys.join(", ")} is part of each one and is not named here.`;
   throwNamed2("OKM1104", names.join(", "), accepted, `onConflict on ${table.model.name} names ${names.join(", ")}, which is not a unique constraint. Accepted: ${list(accepted)}.${implicit}`);
 }
-function acceptedConstraints(model, key) {
+function acceptedConstraints(model, keys) {
   const shown = new Set;
   for (const fields of model.uniques) {
-    const named = key === undefined ? fields : fields.filter((field) => field !== key);
+    const named = keys.length === 0 ? fields : fields.filter((field) => !keys.includes(field));
     if (named.length === 0)
       continue;
     shown.add(named.length > 1 ? `(${named.join(", ")})` : named.join(""));
@@ -141,12 +149,12 @@ function acceptedConstraints(model, key) {
 }
 function updateColumns(table, value, allow) {
   if (!Array.isArray(value) || value.length === 0) {
-    fail("OKM1120", "onConflict update must name at least one column.");
+    fail2("OKM1120", "onConflict update must name at least one column.");
   }
   const columns = [];
   for (const name of value) {
     if (typeof name !== "string")
-      fail("OKM1120", "onConflict update must name columns.");
+      fail2("OKM1120", "onConflict update must name columns.");
     const column = table.columns.get(name);
     if (column === undefined) {
       throwNamed2("OKM1120", name, table.names, `Field ${name} is not on ${table.model.name}. Accepted names: ${list(table.names)}.`);
@@ -164,7 +172,29 @@ function conflictNames(on) {
   if (Array.isArray(on) && on.length > 0 && on.every((name) => typeof name === "string")) {
     return on;
   }
-  fail("OKM1104", "onConflict on must name a unique constraint's columns.");
+  fail2("OKM1104", "onConflict on must name a unique constraint's columns.");
+}
+function fieldsOf(unique, names, tenantKeys) {
+  if (tenantKeys.some((key) => unique.includes(key))) {
+    const rest = [];
+    for (const field of unique) {
+      if (!tenantKeys.includes(field))
+        rest.push(field);
+    }
+    if (!same(rest, names))
+      return;
+    return unique;
+  }
+  if (!same(unique, names))
+    return;
+  return names;
+}
+function keyList(tenantKey) {
+  if (tenantKey === undefined)
+    return [];
+  if (typeof tenantKey === "string")
+    return [tenantKey];
+  return tenantKey;
 }
 function same(unique, names) {
   if (unique.length !== names.length)
@@ -186,17 +216,18 @@ function rejectConflictKeys(keys, accepted) {
 }
 function refuseWrite(table, column) {
   if (fieldSealed(table.model, column.field)) {
-    fail("OKM1190", `Field ${table.model.name}.${column.field} is set by a trait. Input cannot set it.`);
+    fail2("OKM1190", `Field ${table.model.name}.${column.field} is set by a trait. Input cannot set it.`);
   }
   if (column.guardUpdate) {
-    fail("OKM1190", `Field ${table.model.name}.${column.field} is a primary key. Input cannot change it.`);
+    fail2("OKM1190", `Field ${table.model.name}.${column.field} is a primary key. Input cannot change it.`);
   }
   if (column.guarded) {
-    fail("OKM1190", `Field ${table.model.name}.${column.field} is guarded. Input cannot set it.`);
+    fail2("OKM1190", `Field ${table.model.name}.${column.field} is guarded. Input cannot set it.`);
   }
-  fail("OKM1120", `Field ${table.model.name}.${column.field} cannot be written.`);
+  fail2("OKM1120", `Field ${table.model.name}.${column.field} cannot be written.`);
 }
 export {
   finishInsert,
+  lookupExisting,
   readConflict
 };