orcaq 1.0.26 → 1.0.28

package/.output/server/chunks/_/database-roles.factory.mjs

@@ -0,0 +1,737 @@
+import { c as createError } from '../nitro/nitro.mjs';
+import { D as DatabaseClientType } from './db-connection.mjs';
+import { B as BaseDomainAdapter, c as createDomainAdapter } from './create-adapter.mjs';
+
+class PostgresRoleManagementAdapter {
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  async createRole(params) {
+    const options = [];
+    if (params.canLogin) {
+      options.push("LOGIN");
+      if (params.password) {
+        options.push(`PASSWORD '${params.password.replace(/'/g, "''")}'`);
+      }
+    } else {
+      options.push("NOLOGIN");
+    }
+    if (params.canCreateDb) options.push("CREATEDB");
+    if (params.canCreateRole) options.push("CREATEROLE");
+    if (params.isReplication) options.push("REPLICATION");
+    if (params.connectionLimit !== void 0) {
+      options.push(`CONNECTION LIMIT ${params.connectionLimit}`);
+    }
+    if (params.validUntil) {
+      options.push(`VALID UNTIL '${params.validUntil}'`);
+    }
+    const sql = `CREATE ROLE "${params.roleName}" WITH ${options.join(" ")}`;
+    try {
+      await this.adapter.rawQuery(sql);
+      if (params.memberOf && params.memberOf.length > 0) {
+        for (const parentRole of params.memberOf) {
+          await this.adapter.rawQuery(
+            `GRANT "${parentRole}" TO "${params.roleName}"`
+          );
+        }
+      }
+      if (params.comment) {
+        await this.adapter.rawQuery(
+          `COMMENT ON ROLE "${params.roleName}" IS ?`,
+          [params.comment]
+        );
+      }
+      return {
+        success: true,
+        message: `Successfully created role ${params.roleName}`,
+        sql
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to create role: ${errorMessage}`,
+        data: { sql }
+      });
+    }
+  }
+  async deleteRole(roleName) {
+    const sql = `DROP ROLE IF EXISTS "${roleName}"`;
+    try {
+      await this.adapter.rawQuery(sql);
+      return {
+        success: true,
+        message: `Successfully deleted role ${roleName}`,
+        sql
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to delete role: ${errorMessage}`,
+        data: { sql }
+      });
+    }
+  }
+}
+
+class PostgresRolePermissionsAdapter {
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  async getRolePermissions(roleName) {
+    const tablePermissionsQuery = `
+    SELECT
+      r.rolname        AS grantee,
+      t.schemaname     AS schema_name,
+      t.tablename      AS object_name,
+      COALESCE(
+        JSONB_AGG(
+          DISTINCT g.privilege_type
+          ORDER BY g.privilege_type
+        ) FILTER (WHERE g.privilege_type IS NOT NULL),
+        '[]'::jsonb
+      )                AS privileges,
+      BOOL_OR(g.is_grantable = 'YES') AS is_grantable
+    FROM
+      pg_tables t
+    CROSS JOIN
+      pg_roles r
+    LEFT JOIN
+      information_schema.role_table_grants g
+        ON g.table_schema = t.schemaname
+       AND g.table_name   = t.tablename
+       AND g.grantee      = r.rolname
+    WHERE
+      r.rolname = ?
+      AND t.schemaname NOT IN ('pg_catalog', 'information_schema')
+    GROUP BY
+      r.rolname,
+      t.schemaname,
+      t.tablename
+    ORDER BY
+      t.schemaname,
+      t.tablename;
+  `;
+    const viewPermissionsQuery = `
+    WITH view_like AS (
+      SELECT schemaname, viewname AS object_name
+      FROM pg_views
+      WHERE schemaname NOT IN ('pg_catalog', 'information_schema')
+      UNION ALL
+      SELECT schemaname, matviewname AS object_name
+      FROM pg_matviews
+      WHERE schemaname NOT IN ('pg_catalog', 'information_schema')
+    )
+    SELECT
+      r.rolname        AS grantee,
+      v.schemaname     AS schema_name,
+      v.object_name    AS object_name,
+      COALESCE(
+        JSONB_AGG(
+          DISTINCT g.privilege_type
+          ORDER BY g.privilege_type
+        ) FILTER (WHERE g.privilege_type IS NOT NULL),
+        '[]'::jsonb
+      )                AS privileges,
+      BOOL_OR(g.is_grantable = 'YES') AS is_grantable
+    FROM
+      view_like v
+    CROSS JOIN
+      pg_roles r
+    LEFT JOIN
+      information_schema.role_table_grants g
+        ON g.table_schema = v.schemaname
+       AND g.table_name   = v.object_name
+       AND g.grantee      = r.rolname
+    WHERE
+      r.rolname = ?
+    GROUP BY
+      r.rolname,
+      v.schemaname,
+      v.object_name
+    ORDER BY
+      v.schemaname,
+      v.object_name;
+  `;
+    const schemaPermissionsQuery = `
+    SELECT
+      n.nspname AS schema_name,
+      has_schema_privilege(?, n.nspname, 'USAGE')  AS has_usage,
+      has_schema_privilege(?, n.nspname, 'CREATE') AS has_create
+    FROM
+      pg_namespace n
+    WHERE
+      n.nspname NOT IN ('pg_catalog', 'information_schema', 'pg_toast')
+      AND n.nspname NOT LIKE 'pg_temp_%'
+      AND n.nspname NOT LIKE 'pg_toast_temp_%'
+    ORDER BY
+      n.nspname;
+  `;
+    const functionPermissionsQuery = `
+    SELECT
+      n.nspname AS schema_name,
+      p.proname AS function_name,
+      pg_get_function_identity_arguments(p.oid) AS arguments,
+      has_function_privilege(?, p.oid, 'EXECUTE') AS has_execute
+    FROM
+      pg_proc p
+    JOIN
+      pg_namespace n ON n.oid = p.pronamespace
+    WHERE
+      n.nspname NOT IN ('pg_catalog', 'information_schema')
+    ORDER BY
+      n.nspname,
+      p.proname;
+  `;
+    const [tableResults, viewResults, schemaResults, functionResults] = await Promise.all([
+      this.adapter.rawQuery(tablePermissionsQuery, [roleName]),
+      this.adapter.rawQuery(viewPermissionsQuery, [roleName]),
+      this.adapter.rawQuery(schemaPermissionsQuery, [roleName, roleName]),
+      this.adapter.rawQuery(functionPermissionsQuery, [roleName])
+    ]);
+    const tablePermissions = tableResults.map(
+      (row) => ({
+        objectType: "table",
+        schemaName: row.schema_name,
+        objectName: row.object_name,
+        privileges: row.privileges,
+        grantedBy: "",
+        isGrantable: row.is_grantable
+      })
+    );
+    const viewPermissions = viewResults.map((row) => ({
+      objectType: "view",
+      schemaName: row.schema_name,
+      objectName: row.object_name,
+      privileges: row.privileges,
+      grantedBy: "",
+      isGrantable: row.is_grantable
+    }));
+    const schemaPermissions = schemaResults.map(
+      (row) => {
+        const privileges = [];
+        if (row.has_usage) privileges.push("USAGE");
+        if (row.has_create) privileges.push("CREATE");
+        return {
+          objectType: "schema",
+          schemaName: row.schema_name,
+          objectName: row.schema_name,
+          privileges,
+          grantedBy: "",
+          isGrantable: false
+        };
+      }
+    );
+    const functionPermissions = functionResults.map(
+      (row) => ({
+        objectType: "function",
+        schemaName: row.schema_name,
+        objectName: `${row.function_name}(${row.arguments})`,
+        privileges: row.has_execute ? ["EXECUTE"] : [],
+        grantedBy: "",
+        isGrantable: false
+      })
+    );
+    return {
+      roleName,
+      tablePermissions,
+      viewPermissions,
+      schemaPermissions,
+      functionPermissions
+    };
+  }
+  async grantPermission(params) {
+    const privileges = params.privileges.join(", ");
+    const objectReference = this.buildObjectReference(
+      params.objectType,
+      params.schemaName,
+      params.objectName
+    );
+    const sql = `GRANT ${privileges} ON ${objectReference} TO "${params.roleName}"`;
+    try {
+      await this.adapter.rawQuery(sql);
+      return {
+        success: true,
+        message: `Successfully granted ${privileges} on ${params.objectType} ${params.schemaName}.${params.objectName} to ${params.roleName}`,
+        sql
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to grant permission: ${errorMessage}`,
+        data: { sql }
+      });
+    }
+  }
+  async revokePermission(params) {
+    const privileges = params.privileges.join(", ");
+    const objectReference = this.buildObjectReference(
+      params.objectType,
+      params.schemaName,
+      params.objectName
+    );
+    const sql = `REVOKE ${privileges} ON ${objectReference} FROM "${params.roleName}"`;
+    try {
+      await this.adapter.rawQuery(sql);
+      return {
+        success: true,
+        message: `Successfully revoked ${privileges} on ${params.objectType} ${params.schemaName}.${params.objectName} from ${params.roleName}`,
+        sql
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : "Unknown error occurred";
+      throw createError({
+        statusCode: 500,
+        statusMessage: `Failed to revoke permission: ${errorMessage}`,
+        data: { sql }
+      });
+    }
+  }
+  async grantBulkPermissions(params) {
+    const results = [];
+    for (const dbGrant of params.databaseGrants) {
+      if (dbGrant.privileges.length === 0) continue;
+      const privileges = dbGrant.privileges.join(", ");
+      const sql = `GRANT ${privileges} ON DATABASE "${dbGrant.databaseName}" TO "${params.roleName}"`;
+      try {
+        await this.adapter.rawQuery(sql);
+        results.push({ success: true, sql });
+      } catch (error) {
+        results.push({
+          success: false,
+          sql,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+    }
+    for (const schemaGrant of params.schemaGrants) {
+      if (schemaGrant.privileges.length === 0) continue;
+      const privileges = schemaGrant.privileges.join(", ");
+      const sql = `GRANT ${privileges} ON SCHEMA "${schemaGrant.schemaName}" TO "${params.roleName}"`;
+      try {
+        await this.adapter.rawQuery(sql);
+        results.push({ success: true, sql });
+      } catch (error) {
+        results.push({
+          success: false,
+          sql,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+    }
+    for (const objGrant of params.objectGrants) {
+      if (objGrant.privileges.length === 0) continue;
+      const privileges = objGrant.privileges.join(", ");
+      let objectRef;
+      if (objGrant.objectName) {
+        objectRef = this.buildObjectReference(
+          objGrant.objectType,
+          objGrant.schemaName,
+          objGrant.objectName
+        );
+      } else {
+        const typeWord = this.getObjectTypeWord(objGrant.objectType);
+        objectRef = `ALL ${typeWord} IN SCHEMA "${objGrant.schemaName}"`;
+      }
+      const sql = `GRANT ${privileges} ON ${objectRef} TO "${params.roleName}"`;
+      try {
+        await this.adapter.rawQuery(sql);
+        results.push({ success: true, sql });
+      } catch (error) {
+        results.push({
+          success: false,
+          sql,
+          error: error instanceof Error ? error.message : "Unknown error"
+        });
+      }
+      if (objGrant.applyToFuture && !objGrant.objectName) {
+        const typeWord = this.getObjectTypeWord(objGrant.objectType);
+        const defaultSql = `ALTER DEFAULT PRIVILEGES IN SCHEMA "${objGrant.schemaName}" GRANT ${privileges} ON ${typeWord} TO "${params.roleName}"`;
+        try {
+          await this.adapter.rawQuery(defaultSql);
+          results.push({ success: true, sql: defaultSql });
+        } catch (error) {
+          results.push({
+            success: false,
+            sql: defaultSql,
+            error: error instanceof Error ? error.message : "Unknown error"
+          });
+        }
+      }
+    }
+    const succeeded = results.filter((r) => r.success).length;
+    const failed = results.filter((r) => !r.success).length;
+    return {
+      success: failed === 0,
+      results,
+      totalSucceeded: succeeded,
+      totalFailed: failed
+    };
+  }
+  buildObjectReference(objectType, schemaName, objectName) {
+    switch (objectType) {
+      case "table":
+        return `TABLE "${schemaName}"."${objectName}"`;
+      case "schema":
+        return `SCHEMA "${objectName}"`;
+      case "function":
+        return `FUNCTION "${schemaName}".${objectName}`;
+      case "sequence":
+        return `SEQUENCE "${schemaName}"."${objectName}"`;
+      default:
+        throw createError({
+          statusCode: 400,
+          statusMessage: `Invalid object type: ${objectType}`
+        });
+    }
+  }
+  getObjectTypeWord(objectType) {
+    switch (objectType) {
+      case "table":
+        return "TABLES";
+      case "function":
+        return "FUNCTIONS";
+      case "sequence":
+        return "SEQUENCES";
+      case "schema":
+        return "SCHEMAS";
+      default:
+        return "TABLES";
+    }
+  }
+}
+
+class PostgresRoleQueryAdapter {
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  async getRole(roleName) {
+    const query = `
+      SELECT
+        r.rolname AS role_name,
+        r.oid AS role_oid,
+        r.rolsuper AS is_superuser,
+        r.rolcanlogin AS can_login,
+        r.rolcreatedb AS can_create_db,
+        r.rolcreaterole AS can_create_role,
+        r.rolreplication AS is_replication,
+        r.rolconnlimit AS connection_limit,
+        r.rolvaliduntil AS valid_until,
+        COALESCE(members.member_of, '[]'::jsonb) AS member_of,
+        COALESCE(OBJ_DESCRIPTION(r.oid, 'pg_authid'), '') AS comment
+      FROM
+        pg_roles r
+        LEFT JOIN (
+          SELECT
+            am.member,
+            JSONB_AGG(
+              pr.rolname
+              ORDER BY
+                pr.rolname
+            ) AS member_of
+          FROM
+            pg_auth_members am
+            JOIN pg_roles pr ON pr.oid = am.roleid
+          GROUP BY
+            am.member
+        ) members ON members.member = r.oid
+      WHERE
+        r.rolname = ?
+      ORDER BY
+        r.rolcanlogin DESC,
+        r.rolsuper DESC,
+        r.rolname ASC
+      ;
+    `;
+    const result = await this.adapter.rawQuery(query, [roleName]);
+    return result.map(
+      (row) => ({
+        roleName: row.role_name,
+        roleOid: row.role_oid,
+        isSuperuser: row.is_superuser,
+        canLogin: row.can_login,
+        canCreateDb: row.can_create_db,
+        canCreateRole: row.can_create_role,
+        isReplication: row.is_replication,
+        connectionLimit: row.connection_limit,
+        validUntil: row.valid_until,
+        memberOf: row.member_of || [],
+        comment: row.comment || null
+      })
+    )[0];
+  }
+  async getRoles() {
+    const query = `
+      SELECT
+        r.rolname AS role_name,
+        r.oid AS role_oid,
+        r.rolsuper AS is_superuser,
+        r.rolcanlogin AS can_login,
+        r.rolcreatedb AS can_create_db,
+        r.rolcreaterole AS can_create_role,
+        r.rolreplication AS is_replication,
+        r.rolconnlimit AS connection_limit,
+        r.rolvaliduntil AS valid_until,
+        COALESCE(members.member_of, '[]'::jsonb) AS member_of,
+        COALESCE(OBJ_DESCRIPTION(r.oid, 'pg_authid'), '') AS comment
+      FROM
+        pg_roles r
+        LEFT JOIN (
+          SELECT
+            am.member,
+            JSONB_AGG(
+              pr.rolname
+              ORDER BY
+                pr.rolname
+            ) AS member_of
+          FROM
+            pg_auth_members am
+            JOIN pg_roles pr ON pr.oid = am.roleid
+          GROUP BY
+            am.member
+        ) members ON members.member = r.oid
+      ORDER BY
+        r.rolcanlogin DESC,
+        r.rolsuper DESC,
+        r.rolname ASC
+      ;
+    `;
+    const result = await this.adapter.rawQuery(query);
+    return result.map(
+      (row) => ({
+        roleName: row.role_name,
+        roleOid: row.role_oid,
+        isSuperuser: row.is_superuser,
+        canLogin: row.can_login,
+        canCreateDb: row.can_create_db,
+        canCreateRole: row.can_create_role,
+        isReplication: row.is_replication,
+        connectionLimit: row.connection_limit,
+        validUntil: row.valid_until,
+        memberOf: row.member_of || [],
+        comment: row.comment || null
+      })
+    );
+  }
+  async getDatabasePermissions(roleName) {
+    const query = `
+      SELECT
+        d.datname AS database_name,
+        d.oid AS database_oid,
+        has_database_privilege(?, d.datname, 'CONNECT') AS can_connect,
+        has_database_privilege(?, d.datname, 'CREATE') AS can_create,
+        has_database_privilege(?, d.datname, 'TEMPORARY') AS can_temp
+      FROM pg_database d
+      WHERE d.datistemplate = false
+        AND d.datallowconn = true
+      ORDER BY d.datname;
+    `;
+    const result = await this.adapter.rawQuery(query, [
+      roleName,
+      roleName,
+      roleName
+    ]);
+    return result.map(
+      (row) => ({
+        databaseName: row.database_name,
+        databaseOid: row.database_oid,
+        canConnect: row.can_connect,
+        canCreate: row.can_create,
+        canTemp: row.can_temp
+      })
+    );
+  }
+  async getRoleInheritance(roleName) {
+    const query = `
+      WITH RECURSIVE role_tree AS (
+        SELECT r.oid, r.rolname, 0 AS depth
+        FROM pg_roles r
+        WHERE r.rolname = ?
+        UNION ALL
+        SELECT p.oid, p.rolname, rt.depth + 1
+        FROM pg_auth_members m
+        JOIN pg_roles p ON p.oid = m.roleid
+        JOIN role_tree rt ON rt.oid = m.member
+      )
+      SELECT rolname, depth
+      FROM role_tree
+      WHERE depth > 0
+      ORDER BY depth, rolname;
+    `;
+    const result = await this.adapter.rawQuery(query, [roleName]);
+    return result.map((row) => ({
+      roleName: row.rolname,
+      depth: Number(row.depth) || 0
+    }));
+  }
+  async getDatabases() {
+    const query = `
+      SELECT
+        d.datname AS database_name,
+        d.oid AS database_oid
+      FROM pg_database d
+      WHERE d.datistemplate = false
+        AND d.datallowconn = true
+      ORDER BY d.datname;
+    `;
+    const result = await this.adapter.rawQuery(query);
+    return result.map(
+      (row) => ({
+        databaseName: row.database_name,
+        databaseOid: row.database_oid
+      })
+    );
+  }
+  async getSchemas() {
+    const query = `
+      SELECT
+        nspname AS schema_name,
+        has_schema_privilege(current_user, nspname, 'USAGE') AS has_usage,
+        has_schema_privilege(current_user, nspname, 'CREATE') AS has_create
+      FROM pg_namespace
+      WHERE nspname NOT LIKE 'pg_%'
+        AND nspname NOT LIKE 'pg_toast%'
+        AND nspname != 'information_schema'
+      ORDER BY nspname;
+    `;
+    const result = await this.adapter.rawQuery(query);
+    return result.map(
+      (row) => ({
+        schemaName: row.schema_name,
+        hasUsage: row.has_usage,
+        hasCreate: row.has_create
+      })
+    );
+  }
+  async getSchemaObjects(schemaName) {
+    const tablesQuery = `
+      SELECT table_name
+      FROM information_schema.tables
+      WHERE table_schema = ? AND table_type = 'BASE TABLE'
+      ORDER BY table_name;
+    `;
+    const viewsQuery = `
+      SELECT table_name
+      FROM information_schema.views
+      WHERE table_schema = ?
+      ORDER BY table_name;
+    `;
+    const functionsQuery = `
+      SELECT
+        p.proname AS name,
+        pg_get_function_identity_arguments(p.oid) AS signature
+      FROM pg_proc p
+      JOIN pg_namespace n ON p.pronamespace = n.oid
+      WHERE n.nspname = ?
+      ORDER BY p.proname;
+    `;
+    const sequencesQuery = `
+      SELECT sequence_name
+      FROM information_schema.sequences
+      WHERE sequence_schema = ?
+      ORDER BY sequence_name;
+    `;
+    const [tables, views, functions, sequences] = await Promise.all([
+      this.adapter.rawQuery(tablesQuery, [schemaName]),
+      this.adapter.rawQuery(viewsQuery, [schemaName]),
+      this.adapter.rawQuery(functionsQuery, [schemaName]),
+      this.adapter.rawQuery(sequencesQuery, [schemaName])
+    ]);
+    return {
+      tables: tables.map((r) => r.table_name),
+      views: views.map((r) => r.table_name),
+      functions: functions.map((r) => ({
+        name: r.name,
+        signature: r.signature
+      })),
+      sequences: sequences.map(
+        (r) => r.sequence_name
+      )
+    };
+  }
+}
+
+var __defProp = Object.defineProperty;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __publicField = (obj, key, value) => __defNormalProp(obj, typeof key !== "symbol" ? key + "" : key, value);
+class PostgresRoleAdapter extends BaseDomainAdapter {
+  constructor(adapter) {
+    super(adapter);
+    __publicField(this, "dbType", DatabaseClientType.POSTGRES);
+    __publicField(this, "queryAdapter");
+    __publicField(this, "permissionsAdapter");
+    __publicField(this, "managementAdapter");
+    this.queryAdapter = new PostgresRoleQueryAdapter(this.adapter);
+    this.permissionsAdapter = new PostgresRolePermissionsAdapter(this.adapter);
+    this.managementAdapter = new PostgresRoleManagementAdapter(this.adapter);
+  }
+  static async create(params) {
+    const adapter = await PostgresRoleAdapter.resolveAdapter(
+      params,
+      DatabaseClientType.POSTGRES
+    );
+    return new PostgresRoleAdapter(adapter);
+  }
+  async getRole(roleName) {
+    return this.queryAdapter.getRole(roleName);
+  }
+  async getRoles() {
+    return this.queryAdapter.getRoles();
+  }
+  async getRolePermissions(roleName) {
+    return this.permissionsAdapter.getRolePermissions(roleName);
+  }
+  async grantPermission(params) {
+    return this.permissionsAdapter.grantPermission(params);
+  }
+  async revokePermission(params) {
+    return this.permissionsAdapter.revokePermission(params);
+  }
+  async getDatabasePermissions(roleName) {
+    return this.queryAdapter.getDatabasePermissions(roleName);
+  }
+  async getRoleInheritance(roleName) {
+    return this.queryAdapter.getRoleInheritance(roleName);
+  }
+  async getDatabases() {
+    return this.queryAdapter.getDatabases();
+  }
+  async createRole(params) {
+    return this.managementAdapter.createRole(params);
+  }
+  async deleteRole(roleName) {
+    return this.managementAdapter.deleteRole(roleName);
+  }
+  async getSchemas() {
+    return this.queryAdapter.getSchemas();
+  }
+  async getSchemaObjects(schemaName) {
+    return this.queryAdapter.getSchemaObjects(schemaName);
+  }
+  async grantBulkPermissions(params) {
+    return this.permissionsAdapter.grantBulkPermissions(params);
+  }
+}
+
+async function createRoleAdapter(dbType, params) {
+  if (dbType === DatabaseClientType.MYSQL) {
+    throw createError({
+      statusCode: 501,
+      statusMessage: "MySQL role adapter not yet implemented"
+    });
+  }
+  if (dbType === DatabaseClientType.SQLITE3) {
+    throw createError({
+      statusCode: 501,
+      statusMessage: "SQLite role adapter not yet implemented"
+    });
+  }
+  return createDomainAdapter(dbType, params, "role", {
+    postgres: PostgresRoleAdapter.create
+  });
+}
+
+export { createRoleAdapter as c };
+//# sourceMappingURL=database-roles.factory.mjs.map