permdock 0.0.0 → 0.1.0

package/dist/policy-Cq2fB8Q5.d.ts

@@ -0,0 +1,20 @@
+import { C as Policy, hr as Subject, mr as Principal } from "./policy-CInmNGkM.js";
+import { c as saasPlans, l as saasRoles, s as saasPermissions } from "./permissions-B8vCg_bI.js";
+//#region src/testing/saas/policy.d.ts
+/** Daily API-key quota per subject; the bucket should be per tenant too. */
+declare const SAAS_API_KEY_LIMIT = 5;
+/**
+ * The shared multi-tenant SaaS policy: four tenant roles, a team role, a
+ * resource-scoped role, plan-gated features, a closure deny, a quota, an
+ * approval and a folder tree shared through edges. Row conditions and
+ * relations are portable; the closure is not, and the folder grants need
+ * a `RelationSource` (`saasRelations()`).
+ */
+type SaasVocabulary = {
+  readonly permissions: typeof saasPermissions;
+  readonly roles: typeof saasRoles;
+  readonly plans: typeof saasPlans;
+};
+declare const saasPolicy: Policy<Principal | Subject | null, Principal, SaasVocabulary>;
+//#endregion
+export { saasPolicy as n, SAAS_API_KEY_LIMIT as t };

package/dist/prisma/index.d.ts

@@ -0,0 +1,135 @@
+import { _r as Condition, hr as Subject, tn as WhereResult } from "../policy-CInmNGkM.js";
+import { n as WithSubjectOptions, r as RelationsMapping, t as RowCheck } from "../row-check-BajTgQZ-.js";
+//#region src/prisma/model-fields.d.ts
+/** A model's non-nullable scalar fields and its scalar list fields, by Prisma field name. */
+type PrismaModelFields = {
+  readonly required: readonly string[];
+  readonly lists: readonly string[];
+};
+/** The `datamodel` of Prisma's DMMF (`getDMMF`, or a generator's `options.dmmf.datamodel`). */
+type PrismaDatamodel = {
+  readonly models: readonly {
+    readonly name: string;
+    readonly fields: readonly {
+      readonly name: string;
+      readonly kind: string;
+      readonly isRequired: boolean;
+      readonly isList: boolean;
+    }[];
+  }[];
+};
+/**
+ * Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
+ * the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+ */
+export declare function prismaModelFields(datamodel: string | PrismaDatamodel, model: string): PrismaModelFields;
+//#endregion
+//#region src/prisma/to-where.d.ts
+type PrismaWhereOptions = {
+  readonly fields?: Readonly<Record<string, string>>;
+  readonly subject?: Subject;
+  readonly now?: number;
+  readonly listFields?: readonly string[];
+  readonly requiredFields?: readonly string[];
+  /** Required and list fields read from the schema by `prismaModelFields`; adds to `requiredFields` and `listFields`. */
+  readonly model?: PrismaModelFields;
+};
+export declare function toWhere<T extends Record<string, unknown> = Record<string, unknown>>(input: Condition | WhereResult, options?: PrismaWhereOptions): T;
+export declare function permdockExtension(): {
+  readonly name: "permdock";
+  readonly query: {
+    readonly $allModels: Record<string, (args: {
+      readonly args: Record<string, unknown>;
+      readonly query: (next: Record<string, unknown>) => Promise<unknown>;
+    }) => Promise<unknown>>;
+  };
+};
+type PrismaTransactionClient = {
+  $executeRawUnsafe(query: string, ...values: unknown[]): Promise<number>;
+};
+type PrismaLike<Tx> = {
+  $transaction<T>(fn: (tx: Tx) => Promise<T>): Promise<T>;
+};
+/**
+ * Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
+ * the generated RLS policies decide for the same subject as the in-process checks.
+ */
+export declare function withSubject<Tx extends PrismaTransactionClient, T>(prisma: PrismaLike<Tx>, permdock: {
+  readonly subject: Subject;
+}, fn: (tx: Tx) => Promise<T>, options?: WithSubjectOptions): Promise<T>;
+type PrismaDelegate = {
+  findFirst(args: {
+    readonly where: Record<string, unknown>;
+  }): Promise<unknown>;
+};
+/**
+ * Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
+ * filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
+ * filter keeps the row. One query when granted, two otherwise.
+ */
+export declare function checkRow(delegate: PrismaDelegate, input: Condition | WhereResult, unique: Record<string, unknown>, options?: PrismaWhereOptions): Promise<RowCheck>;
+//#endregion
+//#region src/prisma/predicate.d.ts
+/** A Prisma 8 ORM field proxy: `u.email` inside `.where((u) => ...)`. */
+type PrismaFieldProxy = {
+  eq(value: unknown): unknown;
+  neq(value: unknown): unknown;
+  gt(value: unknown): unknown;
+  gte(value: unknown): unknown;
+  lt(value: unknown): unknown;
+  lte(value: unknown): unknown;
+  like(pattern: string): unknown;
+  in(values: readonly unknown[]): unknown;
+  isNull(): unknown;
+  isNotNull(): unknown;
+};
+/** `import { and, or, not } from '@prisma/orm-postgres/orm-client'`. */
+type PrismaCombinators = {
+  readonly and: (...predicates: unknown[]) => unknown;
+  readonly or: (...predicates: unknown[]) => unknown;
+  readonly not: (predicate: unknown) => unknown;
+};
+type PrismaPredicateOptions = {
+  readonly fields?: Readonly<Record<string, string>>;
+  readonly subject?: Subject;
+  readonly now?: number;
+  /** Required and list fields from `prismaModelFields`; `contains` on a list field is refused. */
+  readonly model?: PrismaModelFields;
+  readonly listFields?: readonly string[];
+  /** A non-null column (the primary key) that spells constant true and false. Default `id`. */
+  readonly key?: string;
+  /** Loaded from `@prisma/orm-postgres/orm-client` by default. */
+  readonly combinators?: PrismaCombinators;
+};
+type Model = Readonly<Record<string, PrismaFieldProxy>>;
+/**
+ * Compiles a condition into a Prisma 8 ORM predicate: pass the result to
+ * `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+ */
+export declare function toPredicate<M = Model>(input: Condition | WhereResult, options?: PrismaPredicateOptions): (model: M) => unknown;
+//#endregion
+//#region src/conditions/resolve-related.d.ts
+type ResolveRelatedOptions = {
+  /**
+   * Runs one Postgres query with `$1`-style placeholders and returns its
+   * rows; each row's `id` is an id the filtered field may hold. With Prisma:
+   * `({ sql, values }) => prisma.$queryRawUnsafe(sql, ...values)`.
+   */
+  readonly run: (query: {
+    readonly sql: string;
+    readonly values: readonly unknown[];
+  }) => Promise<readonly Readonly<Record<string, unknown>>[]>;
+  /** Where the relation graph lives. */
+  readonly relations?: RelationsMapping;
+  /** Turns an id (always text) into the field's type, e.g. `Number` for an integer key. */
+  readonly parse?: (id: string, field: string) => unknown;
+};
+/**
+ * `where` with every `related` node replaced by the ids it reaches, read in
+ * one query per node, so an ORM without raw subqueries (Prisma) filters the
+ * graph with a plain `in`. The ids are read now: run the filtered query right
+ * after, in the same transaction when the graph may change in between.
+ */
+export declare function resolveRelated(where: WhereResult, options: ResolveRelatedOptions): Promise<WhereResult>;
+//#endregion
+export type { PrismaCombinators, PrismaDatamodel, PrismaFieldProxy, PrismaModelFields, PrismaPredicateOptions, PrismaWhereOptions, ResolveRelatedOptions, RowCheck, WithSubjectOptions };

package/dist/prisma/index.js

@@ -0,0 +1,430 @@
+import { t as compact } from "../compact-y6vfu2_f.js";
+import { n as freezeDeep } from "../freeze-y1_jQL4v.js";
+import { x as assertSafeKey } from "../permissions-DC7GROPA.js";
+import { i as PermDockValidationError } from "../errors-Iy71s7Oj.js";
+import { a as relatedRowGuard, l as renderGraphSql, n as escapeLike, s as relatedTargetsSql, t as compileWhere } from "../compile-D22iwvuV.js";
+import { a as rowCheckOf, n as statementText, r as subjectStatements } from "../subject-settings-xt7V845g.js";
+//#region src/prisma/to-where.ts
+function fieldTests(options) {
+	const mapped = (field) => fieldName(field, options.fields);
+	return {
+		required: (field) => options.requiredFields?.includes(field) === true || options.model?.required.includes(mapped(field)) === true,
+		list: (field) => options.listFields?.includes(field) === true || options.model?.lists.includes(mapped(field)) === true
+	};
+}
+const EMPTY_OR = { OR: [] };
+function fieldName(field, fields) {
+	assertSafeKey(field, "condition field");
+	return fields?.[field] ?? field;
+}
+const NEVER = { kind: "never" };
+const ALWAYS = { kind: "always" };
+function foldRequired(node, required) {
+	switch (node.kind) {
+		case "isNull":
+			if (!required(node.field)) return node;
+			return node.negated ? ALWAYS : NEVER;
+		case "and": {
+			const items = node.items.map((item) => foldRequired(item, required)).filter((item) => item.kind !== "always");
+			if (items.some((item) => item.kind === "never")) return NEVER;
+			return items.length === 0 ? ALWAYS : items.length === 1 ? items[0] : {
+				kind: "and",
+				items
+			};
+		}
+		case "or": {
+			const items = node.items.map((item) => foldRequired(item, required)).filter((item) => item.kind !== "never");
+			if (items.some((item) => item.kind === "always")) return ALWAYS;
+			return items.length === 0 ? NEVER : items.length === 1 ? items[0] : {
+				kind: "or",
+				items
+			};
+		}
+		case "not": {
+			const item = foldRequired(node.item, required);
+			return item.kind === "never" ? ALWAYS : item.kind === "always" ? NEVER : {
+				kind: "not",
+				item
+			};
+		}
+		case "never":
+		case "always":
+		case "exists":
+		case "compare":
+		case "sql": return node;
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+function render$1(node, options, tests) {
+	switch (node.kind) {
+		case "never": return { ...EMPTY_OR };
+		case "always": return {};
+		case "isNull": {
+			const name = fieldName(node.field, options.fields);
+			return node.negated ? { [name]: { not: null } } : { [name]: { equals: null } };
+		}
+		case "and": return { AND: node.items.map((item) => render$1(item, options, tests)) };
+		case "or": return { OR: node.items.map((item) => render$1(item, options, tests)) };
+		case "not": return { NOT: render$1(node.item, options, tests) };
+		/* v8 ignore next 6 */
+		case "exists": return { [fieldName(node.rowField, options.fields)]: { in: [] } };
+		/* v8 ignore next 2 */
+		case "sql": return { ...EMPTY_OR };
+		case "compare": {
+			const name = fieldName(node.field, options.fields);
+			switch (node.op) {
+				case "eq": return { [name]: { equals: node.value } };
+				case "ne": return { [name]: { not: node.value } };
+				case "gt": return { [name]: { gt: node.value } };
+				case "gte": return { [name]: { gte: node.value } };
+				case "lt": return { [name]: { lt: node.value } };
+				case "lte": return { [name]: { lte: node.value } };
+				case "in": return { [name]: { in: node.value } };
+				case "notIn": return { [name]: { notIn: node.value } };
+				case "contains": return tests.list(node.field) ? { [name]: { has: node.value } } : { [name]: { contains: typeof node.value === "string" ? escapeLike(node.value) : node.value } };
+				/* v8 ignore next 4 */
+				default: {
+					const exhaustive = node.op;
+					throw new Error(`PermDock: unknown compare '${String(exhaustive)}'`);
+				}
+			}
+		}
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+function containsEmptyOr(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some((item) => containsEmptyOr(item));
+	const record = value;
+	if (Array.isArray(record["OR"]) && record["OR"].length === 0) return true;
+	return Object.values(record).some((item) => containsEmptyOr(item));
+}
+function rewriteEmptyOr(args) {
+	const where = args["where"];
+	if (where === void 0 || !containsEmptyOr(where)) return args;
+	return {
+		...args,
+		where: {
+			AND: [where, EMPTY_OR],
+			OR: []
+		}
+	};
+}
+function toWhere(input, options = {}) {
+	const compiled = compileWhere(input, compact({
+		subject: options.subject,
+		now: options.now
+	}));
+	const tests = fieldTests(options);
+	return render$1(foldRequired(compiled, tests.required), options, tests);
+}
+function wrap({ args, query }) {
+	return query(rewriteEmptyOr(args));
+}
+function permdockExtension() {
+	return {
+		name: "permdock",
+		query: { $allModels: {
+			findMany: wrap,
+			findFirst: wrap,
+			count: wrap,
+			aggregate: wrap,
+			updateMany: wrap,
+			deleteMany: wrap
+		} }
+	};
+}
+/**
+* Runs `fn` in an interactive transaction whose role and claims are `permdock.subject`'s, so
+* the generated RLS policies decide for the same subject as the in-process checks.
+*/
+function withSubject(prisma, permdock, fn, options = {}) {
+	const statements = subjectStatements(permdock, options);
+	return prisma.$transaction(async (tx) => {
+		for (const statement of statements) await tx.$executeRawUnsafe(statementText(statement), ...statement.values);
+		return fn(tx);
+	});
+}
+/**
+* Checks one row by its unique key, for `findUnique`, `update` and `delete`, which take no
+* filter: `{ found: false }` when `unique` matches nothing, otherwise whether the permission
+* filter keeps the row. One query when granted, two otherwise.
+*/
+async function checkRow(delegate, input, unique, options = {}) {
+	const filter = toWhere(input, options);
+	const kept = await delegate.findFirst(rewriteEmptyOr({ where: { AND: [unique, filter] } }));
+	if (kept !== null && kept !== void 0) return rowCheckOf(true, true);
+	const row = await delegate.findFirst({ where: unique });
+	return rowCheckOf(row !== null && row !== void 0, false);
+}
+//#endregion
+//#region src/prisma/predicate.ts
+function loadCombinators(injected) {
+	if (injected !== void 0) return injected;
+	const loader = globalThis.process?.getBuiltinModule?.("node:module");
+	try {
+		if (loader === void 0) throw new Error("no module loader");
+		return loader.createRequire(import.meta.url)("@prisma/orm-postgres/orm-client");
+	} catch {
+		throw new Error("PermDock: toPredicate needs @prisma/orm-postgres; pass `combinators` on runtimes without require");
+	}
+}
+function refused$1(detail) {
+	return new PermDockValidationError({
+		code: "non-portable-condition",
+		permission: "",
+		resource: "",
+		boundary: "where",
+		message: `PermDock: non-portable-condition: ${detail}`
+	});
+}
+function render(node, model, options, ops) {
+	const proxy = (field) => {
+		assertSafeKey(field, "condition field");
+		const name = options.fields?.[field] ?? field;
+		assertSafeKey(name, "Prisma field");
+		const value = model[name];
+		if (value === void 0) throw refused$1(`no field '${name}' on the Prisma model`);
+		return value;
+	};
+	const key = () => proxy(options.key ?? "id");
+	switch (node.kind) {
+		case "never": return key().isNull();
+		case "always": return key().isNotNull();
+		case "isNull": return node.negated ? proxy(node.field).isNotNull() : proxy(node.field).isNull();
+		case "and": return ops.and(...node.items.map((item) => render(item, model, options, ops)));
+		case "or": return ops.or(...node.items.map((item) => render(item, model, options, ops)));
+		case "not": return ops.not(render(node.item, model, options, ops));
+		/* v8 ignore start */
+		case "exists": throw refused$1("memberOf with a memberships table");
+		case "sql": throw refused$1("relationship grant; resolve it first with resolveRelated");
+		/* v8 ignore stop */
+		case "compare": {
+			const field = proxy(node.field);
+			switch (node.op) {
+				case "eq": return field.eq(node.value);
+				case "ne": return field.neq(node.value);
+				case "gt": return field.gt(node.value);
+				case "gte": return field.gte(node.value);
+				case "lt": return field.lt(node.value);
+				case "lte": return field.lte(node.value);
+				case "in": {
+					const values = node.value;
+					return values.length === 0 ? key().isNull() : field.in(values);
+				}
+				case "notIn": {
+					const values = node.value;
+					return values.length === 0 ? key().isNotNull() : ops.not(field.in(values));
+				}
+				case "contains": {
+					const name = options.fields?.[node.field] ?? node.field;
+					if (options.listFields?.includes(node.field) === true || options.model?.lists.includes(name) === true) throw refused$1(`contains on the list field '${name}'`);
+					if (typeof node.value !== "string") throw refused$1(`contains with a non-string value on '${name}'`);
+					return field.like(`%${escapeLike(node.value)}%`);
+				}
+				/* v8 ignore next 4 */
+				default: {
+					const exhaustive = node.op;
+					throw new Error(`PermDock: unknown compare '${String(exhaustive)}'`);
+				}
+			}
+		}
+		/* v8 ignore next 6 */
+		default: throw new Error(`PermDock: unknown compiled node '${String(node)}'`);
+	}
+}
+/**
+* Compiles a condition into a Prisma 8 ORM predicate: pass the result to
+* `db.orm.<ns>.<Model>.where(...)`. No grant compiles to a predicate that matches no row.
+*/
+function toPredicate(input, options = {}) {
+	const compiled = compileWhere(input, compact({
+		subject: options.subject,
+		now: options.now
+	}));
+	const ops = loadCombinators(options.combinators);
+	return (model) => render(compiled, model, options, ops);
+}
+//#endregion
+//#region src/prisma/model-fields.ts
+const BLOCK = /^\s*(model|type|view)\s+([A-Za-z_]\w*)\s*\{/u;
+const FIELD = /^\s*([A-Za-z_]\w*)\s+([A-Za-z_][\w.:]*)(\([^)]*\))?(\[\])?(\?)?/u;
+function fromSchema(schema, model) {
+	const lines = schema.split(/\r?\n/u);
+	const composite = /* @__PURE__ */ new Set();
+	for (const line of lines) {
+		const block = BLOCK.exec(line);
+		if (block !== null) composite.add(block[2] ?? "");
+	}
+	const required = [];
+	const lists = [];
+	let inside = false;
+	let found = false;
+	for (const line of lines) {
+		const code = line.replace(/\/\/.*$/u, "").trim();
+		if (!inside) {
+			const block = BLOCK.exec(code);
+			if (block?.[1] === "model" && block[2] === model) {
+				inside = true;
+				found = true;
+			}
+			continue;
+		}
+		if (code === "}") break;
+		if (code === "" || code.startsWith("@@")) continue;
+		const field = FIELD.exec(code);
+		if (field === null) continue;
+		const [, name = "", type = "", , list, optional] = field;
+		if (type.includes(":") || composite.has(type)) continue;
+		if (list !== void 0) lists.push(name);
+		else if (optional === void 0) required.push(name);
+	}
+	return found ? {
+		required,
+		lists
+	} : void 0;
+}
+function fromDatamodel(datamodel, model) {
+	const found = datamodel.models.find((item) => item.name === model);
+	if (found === void 0) return;
+	const scalars = found.fields.filter((field) => field.kind === "scalar" || field.kind === "enum");
+	return {
+		required: scalars.filter((field) => field.isRequired && !field.isList).map((field) => field.name),
+		lists: scalars.filter((field) => field.isList).map((field) => field.name)
+	};
+}
+/**
+* Reads a model's required and list fields from `schema.prisma` text or a DMMF datamodel, for
+* the `model` option of `toWhere` and `toPredicate`. Relation fields are skipped.
+*/
+function prismaModelFields(datamodel, model) {
+	assertSafeKey(model, "Prisma model");
+	const fields = typeof datamodel === "string" ? fromSchema(datamodel, model) : fromDatamodel(datamodel, model);
+	if (fields === void 0) throw new Error(`PermDock: Prisma model '${model}' is not in the datamodel`);
+	return Object.freeze({
+		required: Object.freeze(fields.required),
+		lists: Object.freeze(fields.lists)
+	});
+}
+//#endregion
+//#region src/conditions/resolve-related.ts
+const NOTHING = {
+	op: "or",
+	conditions: []
+};
+function notRestricted(column) {
+	return {
+		op: "or",
+		conditions: [{
+			op: "eq",
+			field: column,
+			value: false
+		}, {
+			op: "isNull",
+			field: column,
+			value: true
+		}]
+	};
+}
+function refused(detail) {
+	return new PermDockValidationError({
+		code: "non-portable-condition",
+		permission: "",
+		resource: "",
+		boundary: "where",
+		message: `PermDock: non-portable-condition: ${detail}`
+	});
+}
+/**
+* `where` with every `related` node replaced by the ids it reaches, read in
+* one query per node, so an ORM without raw subqueries (Prisma) filters the
+* graph with a plain `in`. The ids are read now: run the filtered query right
+* after, in the same transaction when the graph may change in between.
+*/
+async function resolveRelated(where, options) {
+	const resources = where.resources;
+	const subject = where.subject?.principal?.id;
+	async function resolveNode(node) {
+		if (resources === void 0) throw refused("related: the where() result carries no resource graph");
+		if (node.ids === void 0 && (subject === void 0 || subject === "")) return NOTHING;
+		const query = renderGraphSql(relatedTargetsSql(node, {
+			...options.relations,
+			resources
+		}), {
+			subject: subject ?? "",
+			placeholder: (index) => `$${String(index)}`,
+			/* v8 ignore next 3 */
+			column: (name) => {
+				throw refused(`related: no row column '${name}' in an id query`);
+			}
+		});
+		const ids = (await options.run({
+			sql: `select distinct r.id from (${query.sql}) r where r.id is not null`,
+			values: query.values
+		})).flatMap((row) => {
+			const id = row["id"];
+			if (typeof id !== "string" && typeof id !== "number") return [];
+			const text = String(id);
+			const parsed = options.parse === void 0 ? text : options.parse(text, node.field);
+			return typeof parsed === "string" || typeof parsed === "number" || typeof parsed === "boolean" ? [parsed] : [];
+		});
+		const reach = ids.length === 0 ? NOTHING : {
+			op: "in",
+			field: node.field,
+			value: ids
+		};
+		const guard = relatedRowGuard(node);
+		return guard === void 0 || ids.length === 0 ? reach : {
+			op: "and",
+			conditions: [reach, notRestricted(guard)]
+		};
+	}
+	async function resolve(node) {
+		switch (node.op) {
+			case "related": return resolveNode(node);
+			case "and":
+			case "or": return {
+				op: node.op,
+				conditions: await Promise.all(node.conditions.map(resolve))
+			};
+			case "not": return {
+				op: "not",
+				condition: await resolve(node.condition)
+			};
+			case "sqlFunction": return {
+				...node,
+				twin: await resolve(node.twin)
+			};
+			case "eq":
+			case "ne":
+			case "gt":
+			case "gte":
+			case "lt":
+			case "lte":
+			case "contains":
+			case "in":
+			case "notIn":
+			case "isNull":
+			case "memberOf":
+			case "opaque": return node;
+			default: return node;
+		}
+	}
+	const out = {
+		condition: await resolve(where.condition),
+		partial: where.partial
+	};
+	for (const key of [
+		"subject",
+		"scopes",
+		"resources"
+	]) if (where[key] !== void 0) Object.defineProperty(out, key, {
+		value: where[key],
+		enumerable: false
+	});
+	return freezeDeep(out);
+}
+//#endregion
+export { checkRow, permdockExtension, prismaModelFields, resolveRelated, toPredicate, toWhere, withSubject };