permdock 0.0.0 → 0.1.0

package/dist/rls-migrate-DrFPbf8p.js

@@ -0,0 +1,366 @@
+import { i as sqlFiles } from "./files-B_wAGYmt.js";
+import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-Bll1d7y0.js";
+import "./sources-DVHM3Mwq.js";
+import { t as HELPERS } from "./rls-helpers-BxRuif0l.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { parse } from "pgsql-parser";
+//#region src/cli/rls-migrate.ts
+function migrateTarget(generated) {
+	const granted = /* @__PURE__ */ new Map();
+	for (const row of generated.seeds ?? []) {
+		if (row.effect !== "allow") continue;
+		let keys = granted.get(row.scope);
+		if (keys === void 0) {
+			keys = /* @__PURE__ */ new Set();
+			granted.set(row.scope, keys);
+		}
+		keys.add(row.grantKey);
+	}
+	return {
+		schema: generated.schema ?? "permdock",
+		sql: generated.text,
+		permissions: new Set(generated.keys?.permissions ?? []),
+		rowConditions: new Set(generated.keys?.rowConditions ?? []),
+		granted,
+		renamed: generated.keys?.renamed ?? {}
+	};
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function child(node, key) {
+	return isNode(node) ? node[key] : void 0;
+}
+function list(value) {
+	return Array.isArray(value) ? value : [];
+}
+/** libpg_query reports byte offsets; this maps them onto string indices. */
+function charIndex(text) {
+	if (Buffer.byteLength(text) === text.length) return (byte) => byte;
+	const map = [];
+	for (let index = 0; index < text.length; index += 1) {
+		const code = text.codePointAt(index) ?? 0;
+		const size = Buffer.byteLength(String.fromCodePoint(code));
+		for (let byte = 0; byte < size; byte += 1) map.push(index);
+		if (code > 65535) index += 1;
+	}
+	return (byte) => map[byte] ?? text.length;
+}
+/** The index just past the `)` closing the call that starts at `start`. */
+function callEnd(text, start) {
+	let depth = 0;
+	for (let index = start; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "'" || char === "\"") {
+			const close = text.indexOf(char, index + 1);
+			if (close === -1) return -1;
+			index = close;
+			continue;
+		}
+		if (char === "-" && text[index + 1] === "-") {
+			const close = text.indexOf("\n", index);
+			index = close === -1 ? text.length : close;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			const close = text.indexOf("*/", index + 2);
+			index = close === -1 ? text.length : close + 1;
+			continue;
+		}
+		if (char === "(") depth += 1;
+		else if (char === ")") {
+			depth -= 1;
+			if (depth === 0) return index + 1;
+		}
+	}
+	return -1;
+}
+const IDENTIFIER = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const COLUMN = new RegExp(String.raw`${IDENTIFIER}(?:\s*\.\s*${IDENTIFIER})*`, "uy");
+function columnText(text, start) {
+	COLUMN.lastIndex = start;
+	return COLUMN.exec(text)?.[0];
+}
+function lineOf(text, index) {
+	let line = 1;
+	for (let at = text.indexOf("\n"); at !== -1 && at < index;) {
+		line += 1;
+		at = text.indexOf("\n", at + 1);
+	}
+	return line;
+}
+function stringConst(node) {
+	const value = child(child(child(node, "A_Const"), "sval"), "sval");
+	return typeof value === "string" ? value : void 0;
+}
+function isNullConst(node) {
+	return child(child(node, "A_Const"), "isnull") === true;
+}
+const literal = quoteSqlLiteral;
+/** The PermDock key for a legacy one: `keys` first, then `renamed`, then the longest matching prefix. */
+function mapKey(config, key, renamed = {}) {
+	const exact = config.keys?.[key];
+	if (exact !== void 0) return exact;
+	if (Object.hasOwn(renamed, key)) return renamed[key] ?? key;
+	const prefix = Object.keys(config.prefixes ?? {}).filter((candidate) => key.startsWith(candidate)).toSorted((a, b) => b.length - a.length)[0];
+	return prefix === void 0 ? key : `${config.prefixes?.[prefix] ?? ""}${key.slice(prefix.length)}`;
+}
+function skip(reason, detail) {
+	return {
+		reason,
+		detail
+	};
+}
+var Rewriter = class {
+	#config;
+	#target;
+	#text;
+	#at;
+	constructor(config, target, text) {
+		this.#config = config;
+		this.#target = target;
+		this.#text = text;
+		this.#at = charIndex(text);
+	}
+	#helper(name) {
+		const { schema, sql } = this.#target;
+		const quoted = escapeSqlIdent(schema);
+		if (!sql.includes(`function ${quoted}.${name}(`)) return;
+		return /^[a-z_][a-z0-9_$]*$/u.test(schema) ? `${schema}.${name}` : `${quoted}.${name}`;
+	}
+	#key(arg, scope) {
+		const legacy = stringConst(arg);
+		if (legacy === void 0) return skip("dynamic-key", "the key is not a string literal; map it by hand");
+		const key = mapKey(this.#config, legacy, this.#target.renamed);
+		if (!this.#target.permissions.has(key)) return skip("unknown-key", `${legacy} maps to ${key}, which the policy does not declare; add it to rls.migrate.keys or the vocabulary`);
+		if (this.#target.rowConditions.has(key)) return skip("row-conditions", `${key} has row conditions the helper cannot apply; let rls generate write this table's policy`);
+		if (this.#target.granted.get(scope)?.has(key) !== true) return skip("not-granted-on-scope", [...this.#target.granted.values()].some((keys) => keys.has(key)) ? `no role grants ${key} on ${scope}, so the helper would always deny` : `${key} has no unconditional allow row in role_permissions: a conditional, time-bounded or deny-mixed grant splits its grant key, so the helper would always deny`);
+		return { to: literal(key) };
+	}
+	#column(arg) {
+		const location = child(child(arg, "ColumnRef"), "location");
+		if (typeof location !== "number") return skip("not-a-column", "the id is an expression, not a plain column; rewrite it by hand");
+		const text = columnText(this.#text, this.#at(location));
+		return text === void 0 ? skip("not-a-column", "the id could not be read as a column") : { to: text };
+	}
+	#ids(scope, keyArg) {
+		const helper = this.#helper(`permitted_${scope}_ids`);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no permitted_${scope}_ids for this policy`);
+		const key = this.#key(keyArg, scope);
+		return "to" in key ? { to: `${helper}(${key.to})` } : key;
+	}
+	#row(scope, idArg, keyArg) {
+		const column = this.#column(idArg);
+		if (!("to" in column)) return column;
+		const ids = this.#ids(scope, keyArg);
+		return "to" in ids ? { to: `(${column.to} in (select ${ids.to}))` } : ids;
+	}
+	#global(keyArg, selected) {
+		const helper = this.#helper(HELPERS.has);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no ${HELPERS.has}`);
+		const key = this.#key(keyArg, "global");
+		if (!("to" in key)) return key;
+		const call = `${helper}(${key.to})`;
+		return { to: selected ? call : `(select ${call})` };
+	}
+	#membership(scope, idArg) {
+		const helper = this.#helper(`member_${scope}_ids`);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no member_${scope}_ids: ${scope} has no membership source`);
+		const column = this.#column(idArg);
+		return "to" in column ? { to: `(${column.to} in (select ${helper}()))` } : column;
+	}
+	#scoped(args, selected) {
+		const [scopeArg, idArg, keyArg] = args;
+		const named = stringConst(scopeArg);
+		if (named === void 0) return skip("unknown-scope", "the scope is not a string literal; rewrite it by hand");
+		if (this.#config.globalScopes?.includes(named) === true || isNullConst(idArg)) return this.#global(keyArg, selected);
+		return this.#row(this.#config.scopes?.[named] ?? named, idArg, keyArg);
+	}
+	/** `selected`: the call is already a `select` target, so `permdock_has` needs no wrapping subquery. */
+	rewrite(call, selected) {
+		const { helper, args } = call;
+		switch (helper.form) {
+			case "ids": return this.#ids(helper.scope, args[0]);
+			case "row": return this.#row(helper.scope, args[0], args[1]);
+			case "membership": return this.#membership(helper.scope, args[0]);
+			case "scoped": return this.#scoped(args, selected);
+			case "global": return this.#global(args[0], selected);
+			default: return helper;
+		}
+	}
+	call(node) {
+		const name = list(node["funcname"]).map((part) => child(child(part, "String"), "sval")).at(-1);
+		const location = node["location"];
+		if (typeof name !== "string" || typeof location !== "number") return;
+		const helper = this.#config.helpers[name];
+		if (helper === void 0) return;
+		const start = this.#at(location);
+		return {
+			name,
+			helper,
+			args: list(node["args"]),
+			start,
+			end: callEnd(this.#text, start)
+		};
+	}
+};
+const POLICY_STATEMENTS = /* @__PURE__ */ new Set(["CreatePolicyStmt", "AlterPolicyStmt"]);
+const BODY_STATEMENTS = /* @__PURE__ */ new Set(["CreateFunctionStmt", "DoStmt"]);
+function bodyStrings(statement) {
+	const options = [...list(child(statement, "options")), ...list(child(statement, "args"))];
+	const found = [];
+	for (const option of options) {
+		const element = child(option, "DefElem");
+		if (child(element, "defname") !== "as") continue;
+		const arg = child(element, "arg");
+		const items = [child(arg, "String"), ...list(child(child(arg, "List"), "items")).map((item) => child(item, "String"))];
+		for (const item of items) {
+			const value = child(item, "sval");
+			if (typeof value === "string") found.push(value);
+		}
+	}
+	return found;
+}
+/** Rewrites the configured helper calls in one file's policies; everything else is reported. */
+async function migrateSql(file, text, config, target) {
+	const rewrites = [];
+	const skipped = [];
+	const names = Object.keys(config.helpers);
+	if (!names.some((name) => text.includes(name))) return {
+		rewrites,
+		skipped,
+		text
+	};
+	let tree;
+	try {
+		tree = await parse(text);
+	} catch (cause) {
+		skipped.push({
+			file,
+			line: 1,
+			call: "",
+			reason: "unparsed",
+			detail: `the file does not parse: ${cause instanceof Error ? cause.message : String(cause)}`
+		});
+		return {
+			rewrites,
+			skipped,
+			text
+		};
+	}
+	const rewriter = new Rewriter(config, target, text);
+	const at = charIndex(text);
+	const edits = [];
+	const called = new RegExp(String.raw`\b(${names.map((name) => name.replaceAll(/[$]/gu, String.raw`\$`)).join("|")})\s*\(`, "gu");
+	const visit = (node, inPolicy, selected = false) => {
+		if (Array.isArray(node)) {
+			for (const item of node) visit(item, inPolicy);
+			return;
+		}
+		if (!isNode(node)) return;
+		for (const [kind, value] of Object.entries(node)) {
+			if (kind === "FuncCall" && isNode(value)) {
+				const call = rewriter.call(value);
+				if (call !== void 0) {
+					const source = call.end === -1 ? call.name : text.slice(call.start, call.end);
+					const line = lineOf(text, call.start);
+					if (!inPolicy) {
+						skipped.push({
+							file,
+							line,
+							call: source,
+							reason: "not-in-policy",
+							detail: "the call is outside a create or alter policy; rewrite it by hand"
+						});
+						continue;
+					}
+					const outcome = call.end === -1 ? skip("not-a-column", "the call could not be delimited") : rewriter.rewrite(call, selected);
+					if ("to" in outcome) {
+						edits.push({
+							start: call.start,
+							end: call.end,
+							to: outcome.to
+						});
+						rewrites.push({
+							file,
+							line,
+							from: source,
+							to: outcome.to
+						});
+					} else skipped.push({
+						file,
+						line,
+						call: source,
+						...outcome
+					});
+					continue;
+				}
+			}
+			visit(value, inPolicy || POLICY_STATEMENTS.has(kind), kind === "ResTarget" || selected && kind === "val");
+		}
+	};
+	for (const raw of list(child(tree, "stmts"))) {
+		const statement = child(raw, "stmt");
+		const offset = child(raw, "stmt_location");
+		const statementStart = at(typeof offset === "number" ? offset : 0);
+		const kind = isNode(statement) ? Object.keys(statement)[0] : void 0;
+		if (kind !== void 0 && BODY_STATEMENTS.has(kind)) {
+			for (const body of bodyStrings(child(statement, kind))) {
+				const bodyStart = text.indexOf(body, statementStart);
+				for (const match of body.matchAll(called)) skipped.push({
+					file,
+					line: lineOf(text, (bodyStart === -1 ? statementStart : bodyStart) + (match.index ?? 0)),
+					call: match[1] ?? "",
+					reason: "function-body",
+					detail: "the call is inside a function body, which runs with its own privileges; rewrite it by hand"
+				});
+			}
+			continue;
+		}
+		visit(statement, false);
+	}
+	let out = text;
+	for (const edit of edits.toSorted((a, b) => b.start - a.start)) out = `${out.slice(0, edit.start)}${edit.to}${out.slice(edit.end)}`;
+	return {
+		rewrites,
+		skipped,
+		text: out
+	};
+}
+function describe(report, write) {
+	const lines = [...report.rewrites.map((item) => `${item.file}:${String(item.line)}  ${item.from}  ->  ${item.to}`), ...report.skipped.map((item) => `skipped ${item.file}:${String(item.line)}  ${item.call}: ${item.detail}`)];
+	const files = new Set(report.rewrites.map((item) => item.file)).size;
+	const unknown = report.skipped.filter((item) => item.reason === "unknown-key").length;
+	lines.push(`rls migrate: ${write ? "rewrote" : "would rewrite"} ${String(report.rewrites.length)} call(s) in ${String(files)} file(s), skipped ${String(report.skipped.length)}${unknown === 0 ? "" : `, ${String(unknown)} with an unknown key`}${write ? "" : "; --write applies them"}`);
+	return lines.join("\n");
+}
+/** `permdock rls migrate`: a dry run unless `write`; exits 1 while a key is unknown. */
+async function runRlsMigrate(input) {
+	const root = resolve(input.cwd, input.sql);
+	if (!existsSync(root)) return {
+		code: 2,
+		output: `rls migrate --sql: ${input.sql} does not exist`
+	};
+	const files = sqlFiles(root, ["."]);
+	const rewrites = [];
+	const skipped = [];
+	for (const path of files) {
+		const file = relative(input.cwd, path);
+		const text = readFileSync(path, "utf8");
+		const result = await migrateSql(file, text, input.config, input.target);
+		rewrites.push(...result.rewrites);
+		skipped.push(...result.skipped);
+		if (input.write && result.text !== text) writeFileSync(path, result.text);
+	}
+	const report = {
+		rewrites,
+		skipped
+	};
+	return {
+		code: skipped.some((item) => item.reason === "unknown-key") ? 1 : 0,
+		output: input.json ? JSON.stringify(report, void 0, 2) : describe(report, input.write)
+	};
+}
+//#endregion
+export { migrateTarget, runRlsMigrate };

package/dist/row-check-BajTgQZ-.d.ts

@@ -0,0 +1,43 @@
+//#region src/conditions/graph-sql.d.ts
+/** Where the graph lives in the database, as the `toWhere` compilers take it. */
+type RelationsMapping = {
+  /** The table of each resource the graph reads; default the resource name. */
+  readonly tables?: Readonly<Record<string, string>>;
+  /**
+   * A closure table (`resource`, `ancestor`, `descendant`, `depth`) such as
+   * the one `permdock rls` keeps. Without it, parent walks are a bounded
+   * recursive query over the resource's own table.
+   */
+  readonly closure?: string;
+};
+//#endregion
+//#region src/conditions/subject-settings.d.ts
+type WithSubjectOptions = {
+  /** Which settings the generated policies read; match `rls.dialect`. Default `supabase`. */
+  readonly dialect?: "supabase" | "guc" | "neon";
+  /**
+   * `set local role` before the settings: `authenticated` with a principal, `anon` without.
+   * `false` keeps the connection's role, for a login role that RLS already applies to.
+   */
+  readonly role?: "authenticated" | "anon" | false;
+  /** Prefix of the `guc` dialect's settings (`rls.gucPrefix`). Default `app`. */
+  readonly gucPrefix?: string;
+  /** Claim holding the principal's tenant (`rls.tenantClaim`). Default `tenant_id`. */
+  readonly tenantClaim?: string;
+  /**
+   * Further claims from the verified token, such as `user_role` or `memberships` for `jwt`-mode
+   * helpers. `sub`, `role` and the tenant claim always come from the subject.
+   */
+  readonly claims?: Readonly<Record<string, unknown>>;
+};
+//#endregion
+//#region src/conditions/row-check.d.ts
+/** Whether the row a unique key names exists, and if so whether the filter keeps it. */
+type RowCheck = {
+  readonly found: false;
+} | {
+  readonly found: true;
+  readonly granted: boolean;
+};
+//#endregion
+export { WithSubjectOptions as n, RelationsMapping as r, RowCheck as t };

package/dist/run-CJ6UvS3a.js

@@ -0,0 +1,155 @@
+import { a as cliVersion } from "./version-CnSh33Fj.js";
+import { n as loadConfig, r as resolveCwd } from "./config-BPYmjTOp.js";
+import { i as globalArgs, n as commands, o as resolveArgs, r as isCommand, s as stringArg, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { i as exitCodeOf, n as cliErrorKind, r as cliProblem } from "./errors-DSMnAVNa.js";
+import { defineCommand, parseArgs, renderUsage, runCommand } from "citty";
+import { stripVTControlCharacters } from "node:util";
+//#region src/cli/run.ts
+const NAMES = Object.keys(commands).filter(isCommand);
+async function run(argv, options) {
+	const stdoutChunks = [];
+	const stderrChunks = [];
+	const io = options?.io ?? {
+		stdout: (text) => {
+			stdoutChunks.push(text);
+		},
+		stderr: (text) => {
+			stderrChunks.push(text);
+		}
+	};
+	const writeOut = (text) => {
+		const line = lined(text);
+		io.stdout(line);
+		if (options?.io !== void 0) stdoutChunks.push(line);
+	};
+	const writeErr = (text) => {
+		const line = lined(text);
+		io.stderr(line);
+		if (options?.io !== void 0) stderrChunks.push(line);
+	};
+	const done = (code) => ({
+		code,
+		stdout: stdoutChunks.join(""),
+		stderr: stderrChunks.join("")
+	});
+	const flags = beforeSeparator(argv);
+	const globals = parseArgs([...flags], globalArgs);
+	const json = globals.json === true;
+	const color = io.color === true && globals.color !== false;
+	const plain = (text) => color ? text : stripVTControlCharacters(text);
+	const askedHelp = flags.includes("--help") || flags.includes("-h");
+	const first = globals._[0];
+	const name = first === "help" ? globals._[1] : first;
+	let result;
+	const contextFor = (cwd, config) => ({
+		cwd,
+		config,
+		io,
+		now: io.now?.() ?? /* @__PURE__ */ new Date(),
+		json,
+		color,
+		interactive: io.interactive === true && !json && globals.yes !== true,
+		report: (outcome) => {
+			result = outcome;
+		}
+	});
+	/** A failed run: text on stderr, or Problem Details on stdout under `--json`. */
+	const fail = (kind, message, command) => {
+		if (json) writeOut(JSON.stringify(cliProblem(kind, message, command), null, 2));
+		else writeErr(message);
+		return done(exitCodeOf(kind));
+	};
+	if (name !== void 0 && !isCommand(name)) return fail("usage", `unknown command '${name}'. Use ${new Intl.ListFormat("en-GB", { type: "disjunction" }).format(NAMES)}.`);
+	if (name === void 0 && (flags.includes("--version") || flags.includes("-v"))) {
+		writeOut(cliVersion());
+		return done(0);
+	}
+	if (askedHelp || first === "help" || name === void 0) {
+		const root = rootCommand();
+		const usage = name === void 0 ? await renderUsage(root) : await renderUsage(await load(name, contextFor(options?.cwd ?? process.cwd(), {})), root);
+		if (name === void 0 && !askedHelp && first !== "help") {
+			writeErr(plain(usage));
+			return done(2);
+		}
+		writeOut(plain(usage));
+		return done(0);
+	}
+	const cwd = resolveCwd(stringArg(globals.cwd), options?.cwd ?? process.cwd());
+	let config;
+	try {
+		config = await loadConfig(cwd, stringArg(globals.config));
+	} catch (error) {
+		return fail(cliErrorKind(error), error instanceof Error ? error.message : String(error));
+	}
+	try {
+		const command = await load(name, contextFor(cwd, config));
+		const rawArgs = withoutCommand(argv, name);
+		await runCommand(command, { rawArgs: normaliseValues(rawArgs, await resolveArgs(command)) });
+	} catch (error) {
+		if (!(error instanceof Error)) return fail("usage", String(error), name);
+		if (error.name === "CLIError") return fail("usage", `${name}: ${stripVTControlCharacters(error.message)}`, name);
+		return fail(cliErrorKind(error), error.message, name);
+	}
+	if (result === void 0) return done(0);
+	writeOut(result.output);
+	return done(result.code);
+}
+/** The root help lists commands from a static table, so it loads none of them. */
+function rootCommand() {
+	return defineCommand({
+		meta: {
+			name: "permdock",
+			description: "Collect, export, diff and check the permissions a PermDock policy declares"
+		},
+		args: {
+			...globalArgs,
+			version: {
+				type: "boolean",
+				alias: "v",
+				description: "Print the permdock version"
+			}
+		},
+		subCommands: Object.fromEntries(NAMES.map((name) => [name, defineCommand({ meta: {
+			name,
+			description: COMMAND_DESCRIPTIONS[name]
+		} })]))
+	});
+}
+async function load(name, ctx) {
+	return (await commands[name]())(ctx);
+}
+function lined(text) {
+	return text.endsWith("\n") ? text : `${text}\n`;
+}
+function beforeSeparator(argv) {
+	const end = argv.indexOf("--");
+	return end === -1 ? argv : argv.slice(0, end);
+}
+/** argv with the command name removed, wherever the global flags put it. */
+function withoutCommand(argv, name) {
+	const index = argv.findIndex((token, i) => token === name && argv[i - 1] !== "--cwd" && argv[i - 1] !== "--config");
+	return argv.filter((_, i) => i !== index);
+}
+/**
+* A value never starts with `-` (bar `-` itself): `--out --check` is a bare
+* `--out` and `--check`, as it was before citty, which would take `--check`
+* as the value. A bare string flag reads as `''`; a bare enum flag keeps its
+* default.
+*/
+function normaliseValues(rawArgs, def) {
+	const out = [];
+	for (const [i, token] of rawArgs.entries()) {
+		if (token === "--") {
+			out.push(...rawArgs.slice(i));
+			break;
+		}
+		const arg = token.startsWith("--") ? def[token.slice(2)] : void 0;
+		const next = rawArgs[i + 1];
+		const bare = next === void 0 || next !== "-" && next.startsWith("-");
+		if (arg?.type === "enum" && bare) continue;
+		out.push(arg?.type === "string" && bare ? `${token}=` : token);
+	}
+	return out;
+}
+//#endregion
+export { run as t };

package/dist/runtime-DP9ttFh1.js

@@ -0,0 +1,27 @@
+//#region src/svelte/protected.ts
+function protectedView(store, reference, data, tenant, _generation) {
+	const local = store.permissionState(reference, data);
+	return tenant === void 0 ? {
+		allowed: local.allowed,
+		status: local.status,
+		decision: local.decision,
+		slot: slotOf(local.allowed, local.status, local.decision)
+	} : tenantView(store.get().tenant(tenant), reference, data);
+}
+function tenantView(permdock, reference, data) {
+	const decision = permdock.decide(reference, data);
+	const allowed = decision.outcome === "granted";
+	return {
+		allowed,
+		status: "ready",
+		decision,
+		slot: slotOf(allowed, "ready", decision)
+	};
+}
+function slotOf(allowed, status, decision) {
+	if (status === "pending") return "pending";
+	if (!allowed || decision.outcome !== "granted") return "fallback";
+	return "default";
+}
+//#endregion
+export { protectedView as t };