permdock 0.0.0 → 0.1.0

package/dist/rls-graph-DxQ39PJj.js

@@ -0,0 +1,371 @@
+import { d as isFieldRelation, h as isSelfParented, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation } from "./permissions-DC7GROPA.js";
+import { u as scopeList } from "./scopes-cKVp_WTw.js";
+import { f as relationCondition, s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
+import { c as relationArmSql } from "./compile-D22iwvuV.js";
+import "./sources-DVHM3Mwq.js";
+import { F as qualifiedTable, I as quoteIdent, L as quoteLiteral, O as linkHelper, R as quoteTable, T as graphSqlText, g as activeUserSql, m as CLOSURE, t as HELPERS, w as graphHelper } from "./rls-helpers-BxRuif0l.js";
+//#region src/cli/helper-calls.ts
+/**
+* Tables whose policies other packages write (better-supabase `defineBucket`
+* and `defineTopic` in `permdock` mode) by calling the SQL helpers directly.
+*/
+const HELPER_TABLES = ["storage.objects", "realtime.messages"];
+const HELPER_CALL = new RegExp(String.raw`\b(?:${HELPERS.has}|permitted_[a-z][a-z0-9_]*_ids)\s*\(\s*'((?:[^']|'')+)'`, "giu");
+const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids)\s*\(`, "iu");
+/** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
+function callsHelper(sql) {
+	return ANY_HELPER.test(sql);
+}
+/** The permission keys a policy expression passes to `permdock_has` or `permitted_<scope>_ids`, `#n` stripped. */
+function helperCallKeys(sql) {
+	const keys = /* @__PURE__ */ new Set();
+	for (const [, literal = ""] of sql.matchAll(HELPER_CALL)) {
+		const key = literal.replaceAll("''", "'").split("#")[0] ?? "";
+		if (key !== "") keys.add(key);
+	}
+	return [...keys];
+}
+const CREATE_POLICY = /\bcreate\s+policy\s+("(?:[^"]|"")+"|\w+)\s+on\s+((?:"[^"]+"|\w+)\.(?:"[^"]+"|\w+))([\s\S]*?);/giu;
+function tableName(name) {
+	return name.replaceAll("\"", "").toLowerCase();
+}
+function helperTable(name) {
+	const table = tableName(name);
+	return HELPER_TABLES.find((candidate) => candidate === table);
+}
+/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their helper calls pass. */
+function helperTablePolicies(sql) {
+	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+	const found = [];
+	for (const [, name = "", target = "", body = ""] of text.matchAll(CREATE_POLICY)) {
+		const table = helperTable(target);
+		const keys = helperCallKeys(body);
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: name.replaceAll("\"", ""),
+			keys
+		});
+	}
+	return found;
+}
+/** `pg_policies` rows on {@link HELPER_TABLES}, read by `rls verify --db`. */
+const HELPER_TABLE_POLICIES_SQL = `select schemaname || '.' || tablename as target, policyname, coalesce(qual, '') || ' ' || coalesce(with_check, '') as body
+from pg_policies
+where (schemaname, tablename) in (('storage', 'objects'), ('realtime', 'messages'))`;
+/** The same rows as {@link helperTablePolicies}, from `pg_policies`. */
+function helperTablePoliciesFromRows(rows) {
+	const found = [];
+	for (const row of rows) {
+		const table = helperTable(String(row["target"] ?? ""));
+		const keys = helperCallKeys(String(row["body"] ?? ""));
+		if (table !== void 0 && keys.length > 0) found.push({
+			table,
+			name: String(row["policyname"] ?? ""),
+			keys
+		});
+	}
+	return found;
+}
+/** The message PD037 and `rls verify --db` report for one policy. */
+function rowConditionMessage(policy, keys) {
+	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
+}
+const ROW_CONDITION_FIX = "use permissions whose catalog entry has rowConditions: false for storage and realtime policies, or write the condition into the policy yourself";
+//#endregion
+//#region src/cli/rls-graph.ts
+function qualified(ctx, name) {
+	return `${quoteIdent(ctx.schema ?? "permdock")}.${name}`;
+}
+function tableFor(resource, tables) {
+	return tables?.[resource] ?? resource;
+}
+/** Every `related` condition the policy's grants compile to, with the resource graph they need, groups included. */
+function graphPlan(policy) {
+	const scopes = scopeList(policy.scopes);
+	const plan = /* @__PURE__ */ new Map();
+	const entryFor = (node) => {
+		const entry = plan.get(node.name) ?? {
+			node,
+			relations: /* @__PURE__ */ new Set(),
+			links: /* @__PURE__ */ new Set()
+		};
+		plan.set(node.name, entry);
+		return entry;
+	};
+	const addRelation = (node, relation) => {
+		const entry = entryFor(node);
+		if (entry.relations.has(relation)) return;
+		entry.relations.add(relation);
+		for (const name of expandRelation(node, relation)) {
+			const spec = node.relations[name];
+			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
+			for (const [resource, groupRelation] of Object.entries(spec.groups.resources)) {
+				const target = policy.resources.get(resource);
+				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
+			}
+		}
+	};
+	for (const grant of policy.grants) {
+		const row = policy.resources.get(grant.permission.resource);
+		for (const item of flattenGrantee(grant.to)) {
+			if (item.kind !== "relation") continue;
+			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
+			if (condition?.op !== "related") continue;
+			const node = policy.resources.get(condition.resource);
+			if (node === void 0) continue;
+			addRelation(node, condition.relation);
+			const entry = entryFor(node);
+			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
+			const hops = condition.hops ?? [];
+			for (let index = 1; index < hops.length; index += 1) {
+				const from = policy.resources.get(hops[index - 1]?.resource ?? "");
+				const hop = hops[index];
+				if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
+			}
+		}
+	}
+	return plan;
+}
+/** The closure depth per walked resource, as `RlsSqlContext.graph` carries it. */
+function closureDepths(plan) {
+	const out = {};
+	for (const [name, entry] of plan) if (entry.closure !== void 0) out[name] = entry.closure;
+	return out;
+}
+function tableSql(name) {
+	return quoteTable(qualifiedTable(name));
+}
+/**
+* The `permitted_<resource>_ids(relation)` arm for one concrete relation:
+* ids of `resource` the subject holds it on, directly or through a group.
+* `asked` are the relation names that include it, so a call for any of them
+* (or for all, with null) reads this arm.
+*/
+function relationArm(ctx, plan, node, relation, asked, tables) {
+	const spec = node.relations[relation];
+	if (!isEdgeRelation(spec) && !isPrincipalRelation(spec) && (!isFieldRelation(spec) || spec.memberOf !== void 0)) throw new Error(`PermDock CLI: relation '${relation}' on ${node.name} is not a graph relation RLS can compile`);
+	const guard = asked.length === 1 ? `(p_relation is null or p_relation = ${quoteLiteral(asked[0] ?? relation)})` : `(p_relation is null or p_relation in (${asked.map(quoteLiteral).join(", ")}))`;
+	return `  select a.id from (${graphSqlText(relationArmSql(node.name, relation, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifiedTable,
+		holders: (resource, groupRelation) => [{ text: `select ${qualified(ctx, graphHelper(resource))}(${quoteLiteral(groupRelation)})` }]
+	}), ctx)}) a\n  where ${guard}${activeUserSql(ctx).map((part) => ` and ${part}`).join("")}`;
+}
+function permittedSql(ctx, plan, entry, tables) {
+	const fn = qualified(ctx, graphHelper(entry.node.name));
+	const asked = [...entry.relations].toSorted();
+	const arms = [...new Set(asked.flatMap((name) => expandRelation(entry.node, name)))].toSorted().map((relation) => relationArm(ctx, plan, entry.node, relation, asked.filter((name) => expandRelation(entry.node, name).includes(relation)), tables));
+	if (arms.length === 0) arms.push("  select null::text where false");
+	return `-- ${entry.node.name}: ids the subject holds a relation on (all relations when p_relation is null)
+create or replace function ${fn}(p_relation text)
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+${arms.join("\n  union\n")}
+$$;
+revoke execute on function ${fn}(text) from public, anon;
+grant execute on function ${fn}(text) to authenticated;`;
+}
+/** `permdock_link_<resource>_<link>(ids)`: ids of `resource` whose link points into `ids`, read past the table's own policies. */
+function linkSql(ctx, node, link, tables) {
+	const spec = Object.hasOwn(node.links, link) ? node.links[link] : void 0;
+	if (spec === void 0) throw new Error(`PermDock CLI: ${node.name} has no link '${link}'`);
+	const fn = qualified(ctx, linkHelper(node.name, link));
+	return `-- ${node.name}.${link}: rows whose ${spec.field} points at one of the given ${spec.resource} ids
+create or replace function ${fn}(p_ids text[])
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select t.${quoteIdent(node.id)}::text from ${tableSql(tableFor(node.name, tables))} t
+  where t.${quoteIdent(spec.field)}::text = any(p_ids)
+$$;
+revoke execute on function ${fn}(text[]) from public, anon;
+grant execute on function ${fn}(text[]) to authenticated;`;
+}
+function closureTableSql(ctx) {
+	const table = qualified(ctx, CLOSURE.table);
+	return `-- the object graph: one row per (ancestor, descendant) within each walked resource's depth,
+-- never crossing a restricted row; kept current by statement triggers on each self-parented table
+create table if not exists ${table} (
+  resource text not null,
+  ancestor text not null,
+  descendant text not null,
+  depth integer not null check (depth >= 0),
+  primary key (resource, descendant, ancestor)
+);
+create index if not exists ${quoteIdent(`${CLOSURE.table}_ancestor`)} on ${table} (resource, ancestor);
+alter table ${table} enable row level security;
+revoke all on table ${table} from anon, authenticated, public;
+grant select on table ${table} to authenticated;`;
+}
+function closureObjectsSql(ctx, entry, depth, tables) {
+	const { node } = entry;
+	const parent = node.parent;
+	if (parent === void 0) return "";
+	const name = node.name;
+	const closure = qualified(ctx, CLOSURE.table);
+	const table = tableSql(tableFor(name, tables));
+	const id = quoteIdent(node.id);
+	const up = quoteIdent(parent.field);
+	const stop = node.restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(node.restricted)}, false)`;
+	const stopParent = node.restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(node.restricted)}, false)`;
+	const refresh = qualified(ctx, `${CLOSURE.table}_${name}`);
+	const changed = qualified(ctx, `${CLOSURE.table}_${name}_changed`);
+	const literal = quoteLiteral(name);
+	const restrictedChanged = node.restricted === void 0 ? "" : ` or n.${quoteIdent(node.restricted)} is distinct from o.${quoteIdent(node.restricted)}`;
+	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${name}_${suffix}`);
+	return `-- ${name}: rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row
+drop policy if exists ${quoteIdent(`${CLOSURE.table}_${name}`)} on ${closure};
+create policy ${quoteIdent(`${CLOSURE.table}_${name}`)} on ${closure}
+  for select to authenticated
+  using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
+create or replace function ${refresh}(p_ids text[])
+returns void
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_cycle text;
+  v_affected text[];
+begin
+  with recursive walk(start, next, path) as (
+    select t.${id}, t.${up}, array[t.${id}::text]
+    from ${table} t
+    where t.${id}::text = any(p_ids)
+    union all
+    select walk.start, t.${up}, walk.path || t.${id}::text
+    from walk join ${table} t on t.${id} = walk.next
+    where not (walk.next::text = any(walk.path))
+  )
+  select walk.start::text into v_cycle
+  from walk
+  where walk.next::text = any(walk.path)
+  limit 1;
+  if v_cycle is not null then
+    raise exception 'permdock: % % is its own ancestor', ${literal}, v_cycle
+      using errcode = 'check_violation';
+  end if;
+  with recursive down(id, level) as (
+    select t.${id}, 0
+    from ${table} t
+    where t.${id}::text = any(p_ids) or t.${up}::text = any(p_ids)
+    union
+    select t.${id}, down.level + 1
+    from down join ${table} t on t.${up} = down.id
+    where down.level < ${String(depth)}
+  )
+  select coalesce(array_agg(distinct down.id::text), '{}') into v_affected from down;
+  delete from ${closure} c
+  where c.resource = ${literal}
+    and (c.descendant = any(p_ids) or c.descendant = any(v_affected));
+  insert into ${closure} (resource, ancestor, descendant, depth)
+  with recursive walk(descendant, ancestor, parent, depth, stop) as (
+    select t.${id}::text, t.${id}, t.${up}, 0, ${stop}
+    from ${table} t
+    where t.${id}::text = any(v_affected)
+    union all
+    select walk.descendant, p.${id}, p.${up}, walk.depth + 1, ${stopParent}
+    from walk join ${table} p on p.${id} = walk.parent
+    where not walk.stop and walk.depth < ${String(depth)}
+  )
+  select ${literal}, walk.ancestor::text, walk.descendant, walk.depth from walk
+  on conflict do nothing;
+end
+$$;
+revoke execute on function ${refresh}(text[]) from public, anon, authenticated;
+create or replace function ${changed}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+begin
+  if tg_op = 'TRUNCATE' then
+    delete from ${closure} where resource = ${literal};
+  elsif tg_op = 'INSERT' then
+    perform ${refresh}(array(select n.${id}::text from new_rows n));
+  elsif tg_op = 'DELETE' then
+    perform ${refresh}(array(select o.${id}::text from old_rows o));
+  else
+    perform ${refresh}(array(
+      select n.${id}::text
+      from new_rows n left join old_rows o on o.${id} = n.${id}
+      where o.${id} is null or n.${up} is distinct from o.${up}${restrictedChanged}
+      union
+      select o.${id}::text
+      from old_rows o left join new_rows n on n.${id} = o.${id}
+      where n.${id} is null
+    ));
+  end if;
+  return null;
+end
+$$;
+revoke execute on function ${changed}() from public, anon, authenticated;
+drop trigger if exists ${trigger("insert")} on ${table};
+create trigger ${trigger("insert")} after insert on ${table}
+  referencing new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("update")} on ${table};
+create trigger ${trigger("update")} after update on ${table}
+  referencing old table as old_rows new table as new_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("delete")} on ${table};
+create trigger ${trigger("delete")} after delete on ${table}
+  referencing old table as old_rows
+  for each statement execute function ${changed}();
+drop trigger if exists ${trigger("truncate")} on ${table};
+create trigger ${trigger("truncate")} after truncate on ${table}
+  for each statement execute function ${changed}();
+select ${refresh}(array(select t.${id}::text from ${table} t));`;
+}
+/** Group resources a resource's asked relations name, other than itself. */
+function groupTargets(entry) {
+	const out = /* @__PURE__ */ new Set();
+	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
+		const spec = entry.node.relations[name];
+		const resources = isEdgeRelation(spec) ? Object.keys(spec.groups?.resources ?? {}) : [];
+		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
+	}
+	return [...out].toSorted();
+}
+/** Plan entries by name, each after the group resources its helper calls (SQL function bodies are checked on create). */
+function dependencyOrder(plan) {
+	const out = [];
+	const done = /* @__PURE__ */ new Set();
+	const visit = (name) => {
+		const entry = plan.get(name);
+		if (entry === void 0 || done.has(name)) return;
+		done.add(name);
+		for (const target of groupTargets(entry)) visit(target);
+		out.push(entry);
+	};
+	for (const name of [...plan.keys()].toSorted()) visit(name);
+	return out;
+}
+/**
+* The graph preamble: `permitted_<resource>_ids` for every resource a graph
+* grant reads, and the closure table with its triggers for every
+* self-parented resource a grant walks. Empty when no grant is a graph grant.
+*/
+function graphSql(ctx, plan, tables) {
+	if (plan.size === 0) return "";
+	for (const name of plan.keys()) if (ctx.scopes.some((scope) => scope.name === name)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its name with the ${name} scope, so ${graphHelper(name)} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+	const entries = dependencyOrder(plan);
+	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
+	const walked = entries.filter((entry) => entry.closure !== void 0);
+	if (walked.length > 0) {
+		chunks.push(closureTableSql(ctx));
+		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+//#endregion
+export { HELPER_TABLE_POLICIES_SQL as a, helperCallKeys as c, rowConditionMessage as d, HELPER_TABLES as i, helperTablePolicies as l, graphPlan as n, ROW_CONDITION_FIX as o, graphSql as r, callsHelper as s, closureDepths as t, helperTablePoliciesFromRows as u };