permdock 0.0.0 → 0.1.0

package/dist/sources-DVHM3Mwq.js

@@ -0,0 +1,284 @@
+import { t as compact } from "./compact-y6vfu2_f.js";
+import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-Bll1d7y0.js";
+//#region src/supabase/sources.ts
+const ident = (name) => quoteSqlIdent(name);
+const literal = quoteSqlLiteral;
+function qualifiedName(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+function qualified(name) {
+	return quoteSqlTable(qualifiedName(name));
+}
+function col(name) {
+	return `m.${ident(name)}`;
+}
+function activeRow(row, id) {
+	const parts = [`s.${ident(row.id)}::text = (${id})::text`];
+	if (row.disabledAt !== void 0) parts.push(`s.${ident(row.disabledAt)} is null`);
+	if (row.status !== void 0) {
+		const values = row.active ?? [];
+		if (values.length === 0) throw new TypeError("PermDock: a suspension status column needs its active values");
+		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
+	}
+	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
+	return `exists (select 1 from ${qualified(row.table)} s where ${parts.join(" and ")})`;
+}
+function filters(shape, owner) {
+	const lines = [owner];
+	if (shape.expiresAt !== void 0) {
+		const expires = col(shape.expiresAt);
+		lines.push(`(${expires} is null or ${expires} > now())`);
+	}
+	const users = shape.suspension?.users;
+	if (users !== void 0) lines.push(activeRow(users, col(shape.user)));
+	for (const [name, row] of Object.entries(shape.suspension?.scopes ?? {})) {
+		const id = shape.idOf(name);
+		if (id !== void 0) lines.push(`(${id} is null or ${activeRow(row, id)})`);
+	}
+	return lines;
+}
+function selectOf(shape, where, user) {
+	const fields = [
+		...user ? [`${col(shape.user)}::text as user_id`] : [],
+		`${shape.scope} as scope`,
+		`${shape.id} as id`,
+		`${shape.within} as within`,
+		`${shape.roles} as roles`,
+		`${shape.via} as via`,
+		`${shape.expiresAt === void 0 ? "null::bigint" : `floor(extract(epoch from ${col(shape.expiresAt)}))::bigint`} as expires_at`,
+		`${shape.grantedBy} as granted_by`,
+		`${shape.reason} as reason`,
+		`${shape.memberGroup} as member_group`,
+		`${shape.managed} as managed_by`,
+		`${shape.seats} as seats`
+	];
+	const group = [...user ? [col(shape.user)] : [], ...shape.groupBy];
+	return `select ${fields.join(", ")}
+from ${qualified(shape.table)} m
+where ${where.join("\n  and ")}
+group by ${group.join(", ")}`;
+}
+function sqlOf(shape) {
+	const suspension = shape.suspension;
+	return compact({
+		table: shape.table,
+		user: shape.user,
+		userType: `${qualified(shape.table)}.${ident(shape.user)}%type`,
+		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
+		managed: shape.managedColumn,
+		columns: [...new Set(shape.columns)],
+		manifest: {
+			table: qualifiedName(shape.table),
+			...shape.manifest,
+			columns: [...new Set(shape.columns)]
+		},
+		select: (user) => selectOf(shape, filters(shape, `${col(shape.user)} = ${user}`), false),
+		list: () => selectOf(shape, filters(shape, `${shape.scope} = $1::text and ${shape.id} = $2::text`), true)
+	});
+}
+function rowsOf(result) {
+	return Array.isArray(result) ? result : result.rows;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string" && item !== "") : [];
+}
+function membershipOf(row) {
+	const roles = strings(row["roles"]);
+	if (typeof row["scope"] !== "string" || typeof row["id"] !== "string") return;
+	if (roles.length === 0) return;
+	const within = row["within"] !== null && typeof row["within"] === "object" && !Array.isArray(row["within"]) ? Object.fromEntries(Object.entries(row["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const expires = typeof row["expires_at"] === "number" ? row["expires_at"] : typeof row["expires_at"] === "string" && row["expires_at"] !== "" ? Number(row["expires_at"]) : void 0;
+	const seats = strings(row["seats"]);
+	return compact({
+		scope: row["scope"],
+		id: row["id"],
+		within: within === void 0 || Object.keys(within).length === 0 ? void 0 : within,
+		roles: [...roles].toSorted(),
+		via: typeof row["via"] === "string" ? row["via"] : void 0,
+		expiresAt: Number.isFinite(expires) ? expires : void 0,
+		grantedBy: typeof row["granted_by"] === "string" && row["granted_by"] !== "" ? row["granted_by"] : void 0,
+		reason: typeof row["reason"] === "string" && row["reason"] !== "" ? row["reason"] : void 0,
+		member: typeof row["member_group"] === "string" && row["member_group"] !== "" ? { group: row["member_group"] } : void 0,
+		managedBy: row["managed_by"] === "idp" ? "idp" : void 0,
+		entitlements: seats.length === 0 ? void 0 : seats
+	});
+}
+function sourceOf(sql, query) {
+	const run = async (text, values) => {
+		if (query === void 0) throw new TypeError(`PermDock: the ${sql.table} membership source needs query to resolve memberships`);
+		return rowsOf(await query(text, values));
+	};
+	return {
+		sql,
+		async membershipsFor(principal) {
+			return (await run(sql.select("$1"), [principal.id])).flatMap((row) => {
+				const membership = membershipOf(row);
+				return membership === void 0 ? [] : [membership];
+			});
+		},
+		async list(scope) {
+			return (await run(sql.list(), [scope.scope, scope.id])).flatMap((row) => {
+				const membership = membershipOf(row);
+				return membership === void 0 || typeof row["user_id"] !== "string" ? [] : [{
+					principal: { id: row["user_id"] },
+					membership
+				}];
+			});
+		}
+	};
+}
+/**
+* Memberships from one table holding every scope: a row per user, scope,
+* instance and role (`user_id, scope, scope_id, role`), with optional
+* `within`, `via`, expiry, owner and seat columns. Rows of the same instance
+* merge into one membership.
+*/
+function fromTable(options) {
+	const c = options.columns ?? {};
+	const scope = `${col(c.scope ?? "scope")}::text`;
+	const id = `${col(c.id ?? "scope_id")}::text`;
+	const within = c.within === void 0 ? "null::jsonb" : col(c.within);
+	const optional = (name, cast) => name === void 0 ? `null::${cast}` : `${col(name)}::${cast}`;
+	return sourceOf(sqlOf({
+		table: options.table,
+		user: c.user ?? "user_id",
+		scope,
+		id,
+		within,
+		roles: `jsonb_agg(distinct ${col(c.role ?? "role")}::text order by ${col(c.role ?? "role")}::text)`,
+		via: optional(c.via, "text"),
+		expiresAt: c.expiresAt,
+		grantedBy: optional(c.grantedBy, "text"),
+		reason: optional(c.reason, "text"),
+		memberGroup: optional(c.group, "text"),
+		managed: optional(c.managedBy, "text"),
+		managedColumn: c.managedBy,
+		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
+		idOf: (name) => `coalesce(case when ${scope} = ${literal(name)} then ${id} end${c.within === void 0 ? "" : `, ${within} ->> ${literal(name)}`})`,
+		groupBy: [
+			scope,
+			id,
+			...c.within === void 0 ? [] : [within],
+			...[
+				c.via,
+				c.expiresAt,
+				c.grantedBy,
+				c.reason,
+				c.group,
+				c.managedBy,
+				c.seats
+			].filter((name) => name !== void 0).map(col)
+		],
+		suspension: options.suspension,
+		columns: [
+			c.user ?? "user_id",
+			c.scope ?? "scope",
+			c.id ?? "scope_id",
+			c.role ?? "role",
+			...[
+				c.within,
+				c.via,
+				c.expiresAt
+			].filter((name) => name !== void 0)
+		],
+		manifest: compact({
+			user: { column: c.user ?? "user_id" },
+			scope: { column: c.scope ?? "scope" },
+			id: { column: c.id ?? "scope_id" },
+			role: { column: c.role ?? "role" },
+			within: c.within === void 0 ? void 0 : { column: c.within },
+			via: c.via === void 0 ? void 0 : { column: c.via },
+			expiresAt: c.expiresAt === void 0 ? void 0 : { column: c.expiresAt }
+		})
+	}), options.query);
+}
+/**
+* Memberships from a table of one scope (`customer_contacts`): every row is a
+* membership of `scope`, with roles from a column or fixed (`['contact']`), a
+* fixed `via`, and ancestor ids from `within` columns.
+*/
+function fromJunction(options) {
+	if (!/^[a-z][a-z0-9_]*$/u.test(options.scope)) throw new TypeError(`PermDock: unsafe scope name '${options.scope}'`);
+	const idColumn = options.id ?? `${options.scope}_id`;
+	const withinEntries = Object.entries(options.within ?? {});
+	const fixed = typeof options.roles === "string" ? void 0 : options.roles;
+	if (fixed?.length === 0) throw new TypeError("PermDock: fromJunction needs at least one role");
+	const managedColumn = options.managedBy === void 0 ? void 0 : options.managedBy === "idp" ? "" : options.managedBy.column;
+	const groupColumn = options.group === void 0 || typeof options.group === "string" ? void 0 : options.group.column;
+	const shape = {
+		table: options.table,
+		user: options.user ?? "user_id",
+		scope: `${literal(options.scope)}::text`,
+		id: `${col(idColumn)}::text`,
+		within: withinEntries.length === 0 ? "null::jsonb" : `jsonb_build_object(${withinEntries.map(([name, column]) => `${literal(name)}, ${col(column)}::text`).join(", ")})`,
+		roles: fixed === void 0 ? `jsonb_agg(distinct ${col(options.roles)}::text order by ${col(options.roles)}::text)` : `jsonb_build_array(${fixed.map(literal).join(", ")})`,
+		via: options.via === void 0 ? "null::text" : `${literal(options.via)}::text`,
+		expiresAt: options.expiresAt,
+		grantedBy: options.grantedBy === void 0 ? "null::text" : `${col(options.grantedBy)}::text`,
+		reason: options.reason === void 0 ? "null::text" : `${col(options.reason)}::text`,
+		memberGroup: options.group === void 0 ? "null::text" : typeof options.group === "string" ? `${literal(options.group)}::text` : `${col(options.group.column)}::text`,
+		managed: managedColumn === void 0 ? "null::text" : managedColumn === "" ? `'idp'::text` : `${col(managedColumn)}::text`,
+		managedColumn,
+		seats: options.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(options.seats)})`,
+		idOf: (name) => {
+			if (name === options.scope) return `${col(idColumn)}::text`;
+			const column = options.within?.[name];
+			return column === void 0 ? void 0 : `${col(column)}::text`;
+		},
+		groupBy: [
+			col(idColumn),
+			...withinEntries.map(([, column]) => col(column)),
+			...[
+				options.expiresAt,
+				options.grantedBy,
+				options.reason,
+				groupColumn,
+				managedColumn === "" ? void 0 : managedColumn,
+				options.seats
+			].filter((name) => name !== void 0).map(col)
+		],
+		suspension: options.suspension,
+		columns: [
+			options.user ?? "user_id",
+			idColumn,
+			...withinEntries.map(([, column]) => column),
+			...[typeof options.roles === "string" ? options.roles : void 0, options.expiresAt].filter((name) => name !== void 0)
+		],
+		manifest: compact({
+			user: { column: options.user ?? "user_id" },
+			scope: { value: options.scope },
+			id: { column: idColumn },
+			role: typeof options.roles === "string" ? { column: options.roles } : { value: [...options.roles] },
+			within: withinEntries.length === 0 ? void 0 : { columns: Object.fromEntries(withinEntries) },
+			via: options.via === void 0 ? void 0 : { value: options.via },
+			expiresAt: options.expiresAt === void 0 ? void 0 : { column: options.expiresAt }
+		})
+	};
+	return sourceOf({
+		...sqlOf(shape),
+		scope: options.scope,
+		holds: [options.scope, ...withinEntries.map(([name]) => name)],
+		list: () => selectOf(shape, filters(shape, `$1::text = ${literal(options.scope)} and ${col(idColumn)}::text = $2::text`), true)
+	}, options.query);
+}
+const AUTHZ_VERSION_TABLE = "permdock_authz_version";
+/**
+* The default schema of everything PermDock generates: helpers, seeds, the
+* RBAC scaffold, the hook and the version table. Keep it out of the Data
+* API's exposed schemas, so the `security definer` functions are not RPCs.
+*/
+const PERMDOCK_SCHEMA = "permdock";
+/**
+* Reads the authorization version `permdock supabase hook generate` keeps in
+* `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
+*/
+function authzVersion(options) {
+	const table = qualified(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
+	return async (principal) => {
+		const value = rowsOf(await options.query(`select version from ${table} where user_id = $1`, [principal.id]))[0]?.["version"];
+		const version = typeof value === "number" ? value : value === void 0 ? 0 : Number(value);
+		return Number.isFinite(version) ? version : void 0;
+	};
+}
+//#endregion
+export { fromTable as a, fromJunction as i, PERMDOCK_SCHEMA as n, authzVersion as r, AUTHZ_VERSION_TABLE as t };

package/dist/sql-Bll1d7y0.js

@@ -0,0 +1,22 @@
+//#region src/core/sql.ts
+/** A bare Postgres identifier PermDock emits unquoted-safe: letters, digits and `_`, not starting with a digit. */
+const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
+/** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
+function quoteSqlIdent(name, prefix = "PermDock") {
+	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
+	return `"${name}"`;
+}
+/** A schema-qualified name, each part validated by `quoteSqlIdent`. */
+function quoteSqlTable(name, prefix = "PermDock") {
+	return name.split(".").map((part) => quoteSqlIdent(part, prefix)).join(".");
+}
+/** A single-quoted string literal with embedded quotes doubled. */
+function quoteSqlLiteral(value) {
+	return `'${value.replaceAll("'", "''")}'`;
+}
+/** A double-quoted identifier read back from a database, embedded quotes doubled rather than refused. */
+function escapeSqlIdent(name) {
+	return `"${name.replaceAll("\"", "\"\"")}"`;
+}
+//#endregion
+export { quoteSqlTable as a, quoteSqlLiteral as i, escapeSqlIdent as n, quoteSqlIdent as r, SQL_IDENT as t };