permdock 0.0.0 → 0.2.0

package/dist/rls-migrate-7wikfrVI.js

@@ -0,0 +1,367 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as sqlFiles } from "./files-DWUN9PzI.js";
+import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
+import "./sources-B0UvrJ21.js";
+import { n as HELPERS } from "./rls-shared-aOQ4hGTO.js";
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { relative, resolve } from "node:path";
+import { parse } from "pgsql-parser";
+//#region src/cli/rls-migrate.ts
+function migrateTarget(generated) {
+	const granted = /* @__PURE__ */ new Map();
+	for (const row of generated.seeds ?? []) {
+		if (row.effect !== "allow") continue;
+		let keys = granted.get(row.scope);
+		if (keys === void 0) {
+			keys = /* @__PURE__ */ new Set();
+			granted.set(row.scope, keys);
+		}
+		keys.add(row.grantKey);
+	}
+	return {
+		schema: generated.schema ?? "permdock",
+		sql: generated.text,
+		permissions: new Set(generated.keys?.permissions ?? []),
+		rowConditions: new Set(generated.keys?.rowConditions ?? []),
+		granted,
+		renamed: generated.keys?.renamed ?? {}
+	};
+}
+function isNode(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function child(node, key) {
+	return isNode(node) ? node[key] : void 0;
+}
+function list(value) {
+	return Array.isArray(value) ? value : [];
+}
+/** libpg_query reports byte offsets; this maps them onto string indices. */
+function charIndex(text) {
+	if (Buffer.byteLength(text) === text.length) return (byte) => byte;
+	const map = [];
+	for (let index = 0; index < text.length; index += 1) {
+		const code = text.codePointAt(index) ?? 0;
+		const size = Buffer.byteLength(String.fromCodePoint(code));
+		for (let byte = 0; byte < size; byte += 1) map.push(index);
+		if (code > 65535) index += 1;
+	}
+	return (byte) => map[byte] ?? text.length;
+}
+/** The index just past the `)` closing the call that starts at `start`. */
+function callEnd(text, start) {
+	let depth = 0;
+	for (let index = start; index < text.length; index += 1) {
+		const char = text[index];
+		if (char === "'" || char === "\"") {
+			const close = text.indexOf(char, index + 1);
+			if (close === -1) return -1;
+			index = close;
+			continue;
+		}
+		if (char === "-" && text[index + 1] === "-") {
+			const close = text.indexOf("\n", index);
+			index = close === -1 ? text.length : close;
+			continue;
+		}
+		if (char === "/" && text[index + 1] === "*") {
+			const close = text.indexOf("*/", index + 2);
+			index = close === -1 ? text.length : close + 1;
+			continue;
+		}
+		if (char === "(") depth += 1;
+		else if (char === ")") {
+			depth -= 1;
+			if (depth === 0) return index + 1;
+		}
+	}
+	return -1;
+}
+const IDENTIFIER = String.raw`(?:"(?:[^"]|"")+"|[A-Za-z_][\w$]*)`;
+const COLUMN = new RegExp(String.raw`${IDENTIFIER}(?:\s*\.\s*${IDENTIFIER})*`, "uy");
+function columnText(text, start) {
+	COLUMN.lastIndex = start;
+	return COLUMN.exec(text)?.[0];
+}
+function lineOf(text, index) {
+	let line = 1;
+	for (let at = text.indexOf("\n"); at !== -1 && at < index;) {
+		line += 1;
+		at = text.indexOf("\n", at + 1);
+	}
+	return line;
+}
+function stringConst(node) {
+	const value = child(child(child(node, "A_Const"), "sval"), "sval");
+	return typeof value === "string" ? value : void 0;
+}
+function isNullConst(node) {
+	return child(child(node, "A_Const"), "isnull") === true;
+}
+const literal = quoteSqlLiteral;
+/** The PermDock key for a legacy one: `keys` first, then `renamed`, then the longest matching prefix. */
+function mapKey(config, key, renamed = {}) {
+	const exact = config.keys?.[key];
+	if (exact !== void 0) return exact;
+	if (Object.hasOwn(renamed, key)) return renamed[key] ?? key;
+	const prefix = Object.keys(config.prefixes ?? {}).filter((candidate) => key.startsWith(candidate)).toSorted((a, b) => b.length - a.length)[0];
+	return prefix === void 0 ? key : `${config.prefixes?.[prefix] ?? ""}${key.slice(prefix.length)}`;
+}
+function skip(reason, detail) {
+	return {
+		reason,
+		detail
+	};
+}
+var Rewriter = class {
+	#config;
+	#target;
+	#text;
+	#at;
+	constructor(config, target, text) {
+		this.#config = config;
+		this.#target = target;
+		this.#text = text;
+		this.#at = charIndex(text);
+	}
+	#helper(name) {
+		const { schema, sql } = this.#target;
+		const quoted = escapeSqlIdent(schema);
+		if (!sql.includes(`function ${quoted}.${name}(`)) return;
+		return /^[a-z_][a-z0-9_$]*$/u.test(schema) ? `${schema}.${name}` : `${quoted}.${name}`;
+	}
+	#key(arg, scope) {
+		const legacy = stringConst(arg);
+		if (legacy === void 0) return skip("dynamic-key", "the key is not a string literal; map it by hand");
+		const key = mapKey(this.#config, legacy, this.#target.renamed);
+		if (!this.#target.permissions.has(key)) return skip("unknown-key", `${legacy} maps to ${key}, which the policy does not declare; add it to rls.migrate.keys or the vocabulary`);
+		if (this.#target.rowConditions.has(key)) return skip("row-conditions", `${key} has row conditions the helper cannot apply; let rls generate write this table's policy`);
+		if (this.#target.granted.get(scope)?.has(key) !== true) return skip("not-granted-on-scope", [...this.#target.granted.values()].some((keys) => keys.has(key)) ? `no role grants ${key} on ${scope}, so the helper would always deny` : `${key} has no unconditional allow row in role_permissions: a conditional, time-bounded or deny-mixed grant splits its grant key, so the helper would always deny`);
+		return { to: literal(key) };
+	}
+	#column(arg) {
+		const location = child(child(arg, "ColumnRef"), "location");
+		if (typeof location !== "number") return skip("not-a-column", "the id is an expression, not a plain column; rewrite it by hand");
+		const text = columnText(this.#text, this.#at(location));
+		return text === void 0 ? skip("not-a-column", "the id could not be read as a column") : { to: text };
+	}
+	#ids(scope, keyArg) {
+		const helper = this.#helper(`permitted_${scope}_ids`);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no permitted_${scope}_ids for this policy`);
+		const key = this.#key(keyArg, scope);
+		return "to" in key ? { to: `${helper}(${key.to})` } : key;
+	}
+	#row(scope, idArg, keyArg) {
+		const column = this.#column(idArg);
+		if (!("to" in column)) return column;
+		const ids = this.#ids(scope, keyArg);
+		return "to" in ids ? { to: `(${column.to} in (select ${ids.to}))` } : ids;
+	}
+	#global(keyArg, selected) {
+		const helper = this.#helper(HELPERS.has);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no ${HELPERS.has}`);
+		const key = this.#key(keyArg, "global");
+		if (!("to" in key)) return key;
+		const call = `${helper}(${key.to})`;
+		return { to: selected ? call : `(select ${call})` };
+	}
+	#membership(scope, idArg) {
+		const helper = this.#helper(`member_${scope}_ids`);
+		if (helper === void 0) return skip("missing-helper", `rls generate writes no member_${scope}_ids: ${scope} has no membership source`);
+		const column = this.#column(idArg);
+		return "to" in column ? { to: `(${column.to} in (select ${helper}()))` } : column;
+	}
+	#scoped(args, selected) {
+		const [scopeArg, idArg, keyArg] = args;
+		const named = stringConst(scopeArg);
+		if (named === void 0) return skip("unknown-scope", "the scope is not a string literal; rewrite it by hand");
+		if (this.#config.globalScopes?.includes(named) === true || isNullConst(idArg)) return this.#global(keyArg, selected);
+		return this.#row(this.#config.scopes?.[named] ?? named, idArg, keyArg);
+	}
+	/** `selected`: the call is already a `select` target, so `permdock_has` needs no wrapping subquery. */
+	rewrite(call, selected) {
+		const { helper, args } = call;
+		switch (helper.form) {
+			case "ids": return this.#ids(helper.scope, args[0]);
+			case "row": return this.#row(helper.scope, args[0], args[1]);
+			case "membership": return this.#membership(helper.scope, args[0]);
+			case "scoped": return this.#scoped(args, selected);
+			case "global": return this.#global(args[0], selected);
+			default: return helper;
+		}
+	}
+	call(node) {
+		const name = list(node["funcname"]).map((part) => child(child(part, "String"), "sval")).at(-1);
+		const location = node["location"];
+		if (typeof name !== "string" || typeof location !== "number") return;
+		const helper = this.#config.helpers[name];
+		if (helper === void 0) return;
+		const start = this.#at(location);
+		return {
+			name,
+			helper,
+			args: list(node["args"]),
+			start,
+			end: callEnd(this.#text, start)
+		};
+	}
+};
+const POLICY_STATEMENTS = /* @__PURE__ */ new Set(["CreatePolicyStmt", "AlterPolicyStmt"]);
+const BODY_STATEMENTS = /* @__PURE__ */ new Set(["CreateFunctionStmt", "DoStmt"]);
+function bodyStrings(statement) {
+	const options = [...list(child(statement, "options")), ...list(child(statement, "args"))];
+	const found = [];
+	for (const option of options) {
+		const element = child(option, "DefElem");
+		if (child(element, "defname") !== "as") continue;
+		const arg = child(element, "arg");
+		const items = [child(arg, "String"), ...list(child(child(arg, "List"), "items")).map((item) => child(item, "String"))];
+		for (const item of items) {
+			const value = child(item, "sval");
+			if (typeof value === "string") found.push(value);
+		}
+	}
+	return found;
+}
+/** Rewrites the configured helper calls in one file's policies; everything else is reported. */
+async function migrateSql(file, text, config, target) {
+	const rewrites = [];
+	const skipped = [];
+	const names = Object.keys(config.helpers);
+	if (!names.some((name) => text.includes(name))) return {
+		rewrites,
+		skipped,
+		text
+	};
+	let tree;
+	try {
+		tree = await parse(text);
+	} catch (cause) {
+		skipped.push({
+			file,
+			line: 1,
+			call: "",
+			reason: "unparsed",
+			detail: `the file does not parse: ${describeError(cause)}`
+		});
+		return {
+			rewrites,
+			skipped,
+			text
+		};
+	}
+	const rewriter = new Rewriter(config, target, text);
+	const at = charIndex(text);
+	const edits = [];
+	const called = new RegExp(String.raw`\b(${names.map((name) => name.replaceAll(/[$]/gu, String.raw`\$`)).join("|")})\s*\(`, "gu");
+	const visit = (node, inPolicy, selected = false) => {
+		if (Array.isArray(node)) {
+			for (const item of node) visit(item, inPolicy);
+			return;
+		}
+		if (!isNode(node)) return;
+		for (const [kind, value] of Object.entries(node)) {
+			if (kind === "FuncCall" && isNode(value)) {
+				const call = rewriter.call(value);
+				if (call !== void 0) {
+					const source = call.end === -1 ? call.name : text.slice(call.start, call.end);
+					const line = lineOf(text, call.start);
+					if (!inPolicy) {
+						skipped.push({
+							file,
+							line,
+							call: source,
+							reason: "not-in-policy",
+							detail: "the call is outside a create or alter policy; rewrite it by hand"
+						});
+						continue;
+					}
+					const outcome = call.end === -1 ? skip("not-a-column", "the call could not be delimited") : rewriter.rewrite(call, selected);
+					if ("to" in outcome) {
+						edits.push({
+							start: call.start,
+							end: call.end,
+							to: outcome.to
+						});
+						rewrites.push({
+							file,
+							line,
+							from: source,
+							to: outcome.to
+						});
+					} else skipped.push({
+						file,
+						line,
+						call: source,
+						...outcome
+					});
+					continue;
+				}
+			}
+			visit(value, inPolicy || POLICY_STATEMENTS.has(kind), kind === "ResTarget" || selected && kind === "val");
+		}
+	};
+	for (const raw of list(child(tree, "stmts"))) {
+		const statement = child(raw, "stmt");
+		const offset = child(raw, "stmt_location");
+		const statementStart = at(typeof offset === "number" ? offset : 0);
+		const kind = isNode(statement) ? Object.keys(statement)[0] : void 0;
+		if (kind !== void 0 && BODY_STATEMENTS.has(kind)) {
+			for (const body of bodyStrings(child(statement, kind))) {
+				const bodyStart = text.indexOf(body, statementStart);
+				for (const match of body.matchAll(called)) skipped.push({
+					file,
+					line: lineOf(text, (bodyStart === -1 ? statementStart : bodyStart) + (match.index ?? 0)),
+					call: match[1] ?? "",
+					reason: "function-body",
+					detail: "the call is inside a function body, which runs with its own privileges; rewrite it by hand"
+				});
+			}
+			continue;
+		}
+		visit(statement, false);
+	}
+	let out = text;
+	for (const edit of edits.toSorted((a, b) => b.start - a.start)) out = `${out.slice(0, edit.start)}${edit.to}${out.slice(edit.end)}`;
+	return {
+		rewrites,
+		skipped,
+		text: out
+	};
+}
+function describe(report, write) {
+	const lines = [...report.rewrites.map((item) => `${item.file}:${String(item.line)}  ${item.from}  ->  ${item.to}`), ...report.skipped.map((item) => `skipped ${item.file}:${String(item.line)}  ${item.call}: ${item.detail}`)];
+	const files = new Set(report.rewrites.map((item) => item.file)).size;
+	const unknown = report.skipped.filter((item) => item.reason === "unknown-key").length;
+	lines.push(`rls migrate: ${write ? "rewrote" : "would rewrite"} ${String(report.rewrites.length)} call(s) in ${String(files)} file(s), skipped ${String(report.skipped.length)}${unknown === 0 ? "" : `, ${String(unknown)} with an unknown key`}${write ? "" : "; --write applies them"}`);
+	return lines.join("\n");
+}
+/** `permdock rls migrate`: a dry run unless `write`; exits 1 while a key is unknown. */
+async function runRlsMigrate(input) {
+	const root = resolve(input.cwd, input.sql);
+	if (!existsSync(root)) return {
+		code: 2,
+		output: `rls migrate --sql: ${input.sql} does not exist`
+	};
+	const files = sqlFiles(root, ["."]);
+	const rewrites = [];
+	const skipped = [];
+	for (const path of files) {
+		const file = relative(input.cwd, path);
+		const text = readFileSync(path, "utf8");
+		const result = await migrateSql(file, text, input.config, input.target);
+		rewrites.push(...result.rewrites);
+		skipped.push(...result.skipped);
+		if (input.write && result.text !== text) writeFileSync(path, result.text);
+	}
+	const report = {
+		rewrites,
+		skipped
+	};
+	return {
+		code: skipped.some((item) => item.reason === "unknown-key") ? 1 : 0,
+		output: input.json ? JSON.stringify(report, void 0, 2) : describe(report, input.write)
+	};
+}
+//#endregion
+export { migrateTarget, runRlsMigrate };