permdock 0.0.0 → 0.2.0

package/dist/rls-ownership-B5Lkq62W.js

@@ -0,0 +1,843 @@
+import { l as scopeChain, o as resolveScope } from "./scopes-CVdPrWN-.js";
+import { S as findRole } from "./grantee-Cv5Sogfv.js";
+import { s as roleColumn } from "./sources-B0UvrJ21.js";
+import { F as memberForSources, G as quoteLiteral, I as memberForTable, J as roleKindSql, K as quoteTable, R as memberRoleOf, U as qualifiedTable, W as quoteIdent, X as scopeTable, Y as scopeSources, a as qualified, it as tenantTypeOf, j as kindFilterSql, nt as subjectIdSql, s as signedIn, t as CUSTOM_ROLES, x as globalKindFilterSql, z as memberVia } from "./rls-shared-aOQ4hGTO.js";
+import { D as claimKeptLines, I as sourceFilters, L as sourcesKeep, M as membershipRows, N as membershipTable, O as disabledColumn, P as roleRows, R as hasCustomRoleChecksFor, j as memberColumn, k as globalRoleRows } from "./rls-fields-BMasREhR.js";
+//#region src/cli/rls-ownership.ts
+/** Objects the ownership rules add next to the helpers. Names are part of the SQL contract. */
+const OWNERSHIP = {
+	canAssign: "permdock_can_assign",
+	canAssignFor: "permdock_can_assign_for",
+	canAssignAny: "permdock_can_assign_any",
+	canAssignAnyFor: "permdock_can_assign_any_for",
+	holders: "permdock_holders",
+	transferOnly: "permdock_transfer_only"
+};
+function roleScope(policy, scopes, name) {
+	const on = policy.rolesByName.get(name)?.on ?? findRole(policy.vocabulary.roles, name)?.on;
+	return typeof on === "string" ? resolveScope(scopes, on) : void 0;
+}
+function isGlobalRole(policy, name) {
+	const binding = policy.rolesByName.get(name);
+	if (binding !== void 0) return binding.on === void 0;
+	const leaf = findRole(policy.vocabulary.roles, name);
+	return leaf !== void 0 && leaf.on === void 0;
+}
+/** The rules `rls generate` enforces; `undefined` when no role declares one. */
+function ownershipRules(policy, scopes) {
+	const kinds = {};
+	const assigns = [];
+	const counted = [];
+	for (const binding of policy.roles) {
+		const scope = roleScope(policy, scopes, binding.name);
+		if (binding.for !== void 0) kinds[binding.name] = binding.for;
+		const assigner = scope ?? (binding.on === void 0 ? "global" : void 0);
+		for (const target of binding.assigns ?? []) {
+			const at = roleScope(policy, scopes, target);
+			if (assigner !== void 0 && at !== void 0 && (assigner === "global" || scopeChain(scopes, at).includes(assigner))) assigns.push({
+				assigner: binding.name,
+				scope: assigner,
+				role: target,
+				at
+			});
+			else if (assigner === "global" && isGlobalRole(policy, target)) assigns.push({
+				assigner: binding.name,
+				scope: "global",
+				role: target,
+				at: "global"
+			});
+		}
+		const min = binding.min ?? 0;
+		const transferOnly = binding.transferOnly === true;
+		if (scope !== void 0 && (min > 0 || binding.max !== void 0 || transferOnly)) counted.push(binding.max === void 0 ? {
+			role: binding.name,
+			scope,
+			min,
+			transferOnly
+		} : {
+			role: binding.name,
+			scope,
+			min,
+			max: binding.max,
+			transferOnly
+		});
+	}
+	if (Object.keys(kinds).length === 0 && assigns.length === 0 && counted.length === 0) return;
+	return {
+		kinds,
+		assigns,
+		counted
+	};
+}
+function objectName(prefix, scope) {
+	return quoteIdent(`${prefix}_${scope}`);
+}
+/** Live holders of `roleExpr` in instance `idExpr`, with the same kind and expiry rules as the helpers. */
+function holdersSql(ctx, table, column, idExpr, role, into) {
+	const roleExpr = typeof role === "string" ? quoteLiteral(role) : role.expr;
+	const held = memberRoleOf(table, "m", "      ");
+	const filters = [`m.${quoteIdent(column)} = ${idExpr}`, `${held.sql} = ${roleExpr}`];
+	if (table.expiresAt !== void 0) {
+		const expires = memberColumn(table.expiresAt);
+		filters.push(`(${expires} is null or ${expires} > now())`);
+	}
+	const disabled = disabledColumn(table);
+	if (disabled !== void 0) filters.push(`${disabled} is null`);
+	const via = memberVia(table);
+	const kind = typeof role === "string" ? roleKindSql(ctx, role, via) : kindFilterSql(ctx, roleExpr, via);
+	if (kind !== void 0) filters.push(kind);
+	return `select count(distinct m.${quoteIdent(table.user)}) into ${into}
+      from ${membershipTable(table.table)} m${held.join}
+      where ${filters.join("\n        and ")}`;
+}
+/**
+* `min` and `max` as a deferred constraint trigger: checked at commit, so a
+* transfer (demote one holder, promote another) passes in one transaction. An
+* instance with no memberships left is being torn down and skips `min`.
+*/
+function holdersTriggerSql(ctx, scope, table, column, counted) {
+	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
+	const col = quoteIdent(column);
+	const checks = counted.map((rule) => {
+		const lines = [`    select count(*) into v_total from ${membershipTable(table.table)} m where m.${col} = v_key;`, `    ${holdersSql(ctx, table, column, "v_key", rule.role, "v_count")};`];
+		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
+      raise exception using
+        errcode = '23514',
+        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` keeps at least ${String(rule.min)} ${rule.role}`)},
+        hint = 'last-holder';
+    end if;`);
+		if (rule.max !== void 0) lines.push(`    if v_count > ${String(rule.max)} then
+      raise exception using
+        errcode = '23514',
+        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` has at most ${String(rule.max)} ${rule.role}`)},
+        hint = 'max-holders';
+    end if;`);
+		return lines.join("\n");
+	});
+	return `-- ${scope}: holder counts (min / max), checked at commit
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_ids text[] := '{}';
+  v_id text;
+  v_key ${membershipTable(table.table)}.${col}%type;
+  v_total bigint;
+  v_count bigint;
+begin
+  if tg_op in ('UPDATE', 'DELETE') then
+    v_ids := v_ids || old.${col}::text;
+  end if;
+  if tg_op in ('INSERT', 'UPDATE') then
+    v_ids := v_ids || new.${col}::text;
+  end if;
+  foreach v_id in array v_ids loop
+    continue when v_id is null;
+    v_key := v_id;
+${checks.join("\n")}
+  end loop;
+  return null;
+end;
+$$;
+drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${membershipTable(table.table)};
+create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
+  after insert or update or delete on ${membershipTable(table.table)}
+  deferrable initially deferred
+  for each row execute function ${fn}();`;
+}
+/**
+* `transferOnly` as statement triggers over transition tables: a statement
+* that changes a role's holder count in an instance that had holders before
+* and still has some after is refused. Creating the first holder and removing
+* the last (which `min` guards) are not transfers.
+*/
+function transferTriggerSql(ctx, scope, table, column, roles) {
+	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
+	const col = quoteIdent(column);
+	const list = `array[${roles.map(quoteLiteral).join(", ")}]::text[]`;
+	const rows = (alias, source, delta) => {
+		const role = memberRoleOf(table, alias);
+		return `select ${alias}.${col} as id, ${role.sql} as role, ${delta} as delta from ${source} ${alias}${role.join} where ${role.sql} = any(${list})`;
+	};
+	const loop = (source) => `    for v_change in
+      select c.id, c.role, sum(c.delta) as delta
+      from (${source}) c
+      group by c.id, c.role
+    loop
+      continue when v_change.delta = 0 or v_change.id is null;
+      ${holdersSql(ctx, table, column, "v_change.id", { expr: "v_change.role" }, "v_after")};
+      if v_after > 0 and v_after - v_change.delta > 0 then
+        raise exception using
+          errcode = '23514',
+          message = 'permdock: ' || v_change.role || ${quoteLiteral(` in ${scope} `)} || v_change.id || ' moves only by transfer',
+          hint = 'transfer-only';
+      end if;
+    end loop;`;
+	const inserted = rows("n", "permdock_new", "1");
+	const deleted = rows("o", "permdock_old", "-1");
+	const target = membershipTable(table.table);
+	const trigger = (op) => {
+		const name = quoteIdent(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
+		return `drop trigger if exists ${name} on ${target};
+create trigger ${name}
+  after ${op} on ${target}
+  referencing ${op === "insert" ? "new table as permdock_new" : op === "delete" ? "old table as permdock_old" : "old table as permdock_old new table as permdock_new"}
+  for each statement execute function ${fn}();`;
+	};
+	return `-- ${scope}: transfer-only roles (${roles.join(", ")}) keep their holder count per statement
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_change record;
+  v_after bigint;
+begin
+  if tg_op = 'INSERT' then
+${loop(inserted)}
+  elsif tg_op = 'DELETE' then
+${loop(deleted)}
+  else
+${loop(`${inserted} union all ${deleted}`)}
+  end if;
+  return null;
+end;
+$$;
+${trigger("insert")}
+${trigger("update")}
+${trigger("delete")}`;
+}
+/**
+* The membership sources holding scope `name`: `undefined` when there are
+* none, `'not-tables'` when one of them carries no table to put a trigger on.
+*/
+function holderSources(ctx, name) {
+	const sources = memberForSources(ctx, name);
+	if (sources.length === 0) return;
+	const held = [];
+	for (const source of sources) {
+		if (source.sql.holders === void 0) return "not-tables";
+		held.push({
+			table: source.sql.table,
+			holders: source.sql.holders
+		});
+	}
+	return held;
+}
+function indent(sql, by) {
+	return sql.replaceAll(/^/gmu, by);
+}
+/** Every source's rows of one instance, each compared with its own typed `v_key_<n>`. */
+function sourceRowsOf(scope, sources) {
+	return sources.map((source, index) => indent(source.holders.rows(scope, { id: `v_key_${String(index)}` }), "        ")).join("\n        union all\n");
+}
+function sourceKeys(sources) {
+	return {
+		declare: sources.map((source, index) => `  v_key_${String(index)} ${source.holders.idType};`).join("\n"),
+		assign: (value, by) => sources.map((_, index) => `${by}v_key_${String(index)} := ${value};`).join("\n")
+	};
+}
+function regclassOf(table) {
+	return `${quoteLiteral(membershipTable(table))}::regclass`;
+}
+function sourceTables(sources) {
+	return [...new Set(sources.map((source) => membershipTable(source.table)))];
+}
+/** `min` and `max` over membership sources: the same commit-time check as on a mapped table, counted over every source of the scope. */
+function sourceHoldersTriggerSql(ctx, scope, sources, counted) {
+	const fn = qualified(ctx, `${OWNERSHIP.holders}_${scope}`);
+	const keys = sourceKeys(sources);
+	const rows = sourceRowsOf(scope, sources);
+	const collect = sources.map((source) => `  if tg_relid = ${regclassOf(source.table)} then
+    if tg_op in ('UPDATE', 'DELETE') then
+      v_ids := v_ids || ${source.holders.id(scope, "old")};
+    end if;
+    if tg_op in ('INSERT', 'UPDATE') then
+      v_ids := v_ids || ${source.holders.id(scope, "new")};
+    end if;
+  end if;`);
+	const checks = counted.map((rule) => {
+		const filters = ["h.live", `h.role = ${quoteLiteral(rule.role)}`];
+		const kind = roleKindSql(ctx, rule.role, "h.via");
+		if (kind !== void 0) filters.push(kind);
+		const lines = [`    select count(distinct h.user_id) into v_count
+      from (
+${rows}
+      ) h
+      where ${filters.join("\n        and ")};`];
+		if (rule.min > 0) lines.push(`    if v_total > 0 and v_count < ${String(rule.min)} then
+      raise exception using
+        errcode = '23514',
+        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` keeps at least ${String(rule.min)} ${rule.role}`)},
+        hint = 'last-holder';
+    end if;`);
+		if (rule.max !== void 0) lines.push(`    if v_count > ${String(rule.max)} then
+      raise exception using
+        errcode = '23514',
+        message = ${quoteLiteral(`permdock: ${scope} `)} || v_id || ${quoteLiteral(` has at most ${String(rule.max)} ${rule.role}`)},
+        hint = 'max-holders';
+    end if;`);
+		return lines.join("\n");
+	});
+	const triggers = sourceTables(sources).map((table) => `drop trigger if exists ${objectName(OWNERSHIP.holders, scope)} on ${table};
+create constraint trigger ${objectName(OWNERSHIP.holders, scope)}
+  after insert or update or delete on ${table}
+  deferrable initially deferred
+  for each row execute function ${fn}();`);
+	return `-- ${scope}: holder counts (min / max) over the membership sources, checked at commit
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_ids text[] := '{}';
+  v_id text;
+${keys.declare}
+  v_total bigint;
+  v_count bigint;
+begin
+${collect.join("\n")}
+  foreach v_id in array v_ids loop
+    continue when v_id is null;
+${keys.assign("v_id", "    ")}
+    select count(*) into v_total
+      from (
+${rows}
+      ) h;
+${checks.join("\n")}
+  end loop;
+  return null;
+end;
+$$;
+${triggers.join("\n")}`;
+}
+function collectChangesSql(changed) {
+	return `      v_changes := v_changes || coalesce((select jsonb_agg(to_jsonb(c)) from (${changed}) c), '[]'::jsonb);`;
+}
+/** `transferOnly` over membership sources: each source table's statement triggers diff its transition tables, and the count after reads every source. */
+function sourceTransferTriggerSql(ctx, scope, sources, roles) {
+	const fn = qualified(ctx, `${OWNERSHIP.transferOnly}_${scope}`);
+	const keys = sourceKeys(sources);
+	const list = `array[${roles.map(quoteLiteral).join(", ")}]::text[]`;
+	const kind = kindFilterSql(ctx, "h.role", "h.via");
+	const changes = (source, from, delta) => `select h.id, h.role, ${delta} as delta from (${source.holders.rows(scope, { from }).replaceAll("\n", " ")}) h where h.role = any(${list})`;
+	const branches = sources.map((source) => `  if tg_relid = ${regclassOf(source.table)} then
+    if tg_op in ('INSERT', 'UPDATE') then
+${collectChangesSql(changes(source, "permdock_new", "1"))}
+    end if;
+    if tg_op in ('UPDATE', 'DELETE') then
+${collectChangesSql(changes(source, "permdock_old", "-1"))}
+    end if;
+  end if;`);
+	const triggers = sourceTables(sources).flatMap((table) => [
+		"insert",
+		"update",
+		"delete"
+	].map((op) => {
+		const name = quoteIdent(`${OWNERSHIP.transferOnly}_${scope}_${op}`);
+		return `drop trigger if exists ${name} on ${table};
+create trigger ${name}
+  after ${op} on ${table}
+  referencing ${op === "insert" ? "new table as permdock_new" : op === "delete" ? "old table as permdock_old" : "old table as permdock_old new table as permdock_new"}
+  for each statement execute function ${fn}();`;
+	}));
+	return `-- ${scope}: transfer-only roles (${roles.join(", ")}) keep their holder count per statement, over the membership sources
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+security definer
+set search_path = ''
+as $$
+declare
+  v_changes jsonb := '[]'::jsonb;
+  v_change record;
+  v_after bigint;
+${keys.declare}
+begin
+${branches.join("\n")}
+  for v_change in
+    select x.id, x.role, sum(x.delta) as delta
+    from jsonb_to_recordset(v_changes) x(id text, role text, delta bigint)
+    group by x.id, x.role
+  loop
+    continue when v_change.delta = 0 or v_change.id is null;
+${keys.assign("v_change.id", "    ")}
+    select count(distinct h.user_id) into v_after
+      from (
+${sourceRowsOf(scope, sources)}
+      ) h
+      where h.live
+        and h.role = v_change.role${kind === void 0 ? "" : `\n        and ${kind}`};
+    if v_after > 0 and v_after - v_change.delta > 0 then
+      raise exception using
+        errcode = '23514',
+        message = 'permdock: ' || v_change.role || ${quoteLiteral(` in ${scope} `)} || v_change.id || ' moves only by transfer',
+        hint = 'transfer-only';
+    end if;
+  end loop;
+  return null;
+end;
+$$;
+${triggers.join("\n")}`;
+}
+function pairsSql(pairs) {
+	return `values ${pairs.map((pair) => `(${quoteLiteral(pair.assigner)}, ${quoteLiteral(pair.role)})`).join(", ")}`;
+}
+/**
+* Membership rows of the membership sources for scope `name`, each source's
+* `select` comparing its user column with a variable `user` names.
+*/
+function sourceRowsSql(sources, user) {
+	const keep = sources.some((source) => source.sql.keeps);
+	return sources.map((source) => source.sql.select(user(source), keep).replaceAll(/^/gmu, "        ")).join("\n        union all\n");
+}
+/** Whether the signed-in user (or `p_user` in the `_for` form) holds, in instance `p_scope_id`, a role whose `assigns` lists `p_role`. */
+function canAssignSql(base, own, forUser = false) {
+	const ctx = forUser ? {
+		...base,
+		subjectId: "p_user",
+		tenants: "all"
+	} : base;
+	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
+	const parts = [];
+	const used = [];
+	const userOf = (source) => {
+		const index = used.includes(source) ? used.indexOf(source) : used.push(source) - 1;
+		return `v_user_${String(index)}`;
+	};
+	const global = own.assigns.filter((pair) => pair.scope === "global");
+	for (const [instance, pairs] of [["p_scope_id is not null", global.filter((pair) => pair.at !== "global")], ["p_scope_id is null", global.filter((pair) => pair.at === "global")]]) {
+		if (pairs.length === 0) continue;
+		if (ctx.authorize === "database") {
+			const ur = globalRoleRows(ctx);
+			const kind = globalKindFilterSql(ctx, ur.roleSql);
+			parts.push(`${instance} and exists (
+      select 1 from ${ur.from}
+      where ${ur.userSql} = ${subjectIdSql(ctx)}
+        and (${ur.roleSql}, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
+    )`);
+		} else {
+			const kind = globalKindFilterSql(ctx, "r.role");
+			parts.push(`${instance} and exists (
+      select 1 from ${roleRows(ctx)}
+      where (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}
+    )`);
+		}
+	}
+	for (const { name } of ctx.scopes) {
+		const pairs = own.assigns.filter((pair) => pair.scope === name);
+		if (pairs.length === 0) continue;
+		const sources = scopeSources(ctx, name);
+		if (sources.length > 0) {
+			const kind = kindFilterSql(ctx, "r.role", "ms.via");
+			parts.push(`exists (
+      select 1
+      from (
+${sourceRowsSql(sources, userOf)}
+      ) ms
+      cross join lateral jsonb_array_elements_text(
+        case jsonb_typeof(ms.roles) when 'array' then ms.roles else '[]'::jsonb end
+      ) r(role)
+      where ms.scope = ${quoteLiteral(name)}
+        and ms.id = p_scope_id
+        and (r.role, p_role) in (${pairsSql(pairs)})${kind === void 0 ? "" : `\n        and ${kind}`}${sourceFilters(ctx, name, void 0, void 0, sourcesKeep(sources)).replaceAll("\n    and ", "\n        and ")}
+    )`);
+			continue;
+		}
+		if (ctx.authorize === "database") {
+			const mapped = scopeTable(ctx, name);
+			if (mapped === void 0) continue;
+			const { table, column } = mapped;
+			const role = memberRoleOf(table, "m", "      ");
+			const filters = [
+				`${memberColumn(table.user)} = ${subjectIdSql(ctx)}`,
+				`${memberColumn(column)}::text = p_scope_id`,
+				`(${role.sql}, p_role) in (${pairsSql(pairs)})`
+			];
+			if (table.expiresAt !== void 0) {
+				const expires = memberColumn(table.expiresAt);
+				filters.push(`(${expires} is null or ${expires} > now())`);
+			}
+			const disabled = disabledColumn(table);
+			if (disabled !== void 0) filters.push(`${disabled} is null`);
+			const kind = kindFilterSql(ctx, role.sql, memberVia(table));
+			if (kind !== void 0) filters.push(kind);
+			parts.push(`exists (
+      select 1 from ${membershipTable(table.table)} m${role.join}
+      where ${filters.join("\n        and ")}
+    )`);
+		} else {
+			const kind = kindFilterSql(ctx, "r.role", "m ->> 'via'");
+			parts.push(`exists (
+      select 1 from ${membershipRows(ctx)}
+      where m ->> 'scope' = ${quoteLiteral(name)}
+        and m ->> 'id' = p_scope_id
+        and (r.role, p_role) in (${pairsSql(pairs)})
+        and case jsonb_typeof(m -> 'expiresAt')
+          when 'number' then (m ->> 'expiresAt')::numeric > extract(epoch from now())
+          else true
+        end${kind === void 0 ? "" : `\n        and ${kind}`}${claimKeptLines(ctx, "        ").map((line) => `\n${line}`).join("")}
+    )`);
+		}
+	}
+	const body = parts.length === 0 ? "false" : parts.join("\n    or ");
+	const language = used.length === 0 ? `language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select ${signedIn(ctx)} and (
+    ${body}
+  )
+$$;` : `language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+${used.map((source, index) => `  v_user_${String(index)} ${source.sql.userType} := ${subjectIdSql(ctx)};`).join("\n")}
+begin
+  return ${signedIn(ctx)} and (
+    ${body}
+  );
+end;
+$$;`;
+	if (forUser) {
+		const user = ctx.dialect === "supabase" ? "uuid" : "text";
+		return `-- who may assign, for a user the caller names: trusted SQL acting later for a stored user; no client role may execute it
+create or replace function ${fn}(p_user ${user}, p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(${user}, text, text) from public, anon, authenticated;`;
+	}
+	return `-- who may assign: a held role whose assigns lists p_role, in instance p_scope_id (its scope or an ancestor's); a null p_scope_id assigns a global role, which only global assigners may
+create or replace function ${fn}(p_role text, p_scope_id text)
+returns boolean
+${language}
+revoke execute on function ${fn}(text, text) from public, anon;
+grant execute on function ${fn}(text, text) to authenticated;`;
+}
+/**
+* The ownership objects: holder-count and transfer-only triggers on each
+* scope's membership table, and `permdock_can_assign` for the application's
+* own policies on those tables. Empty when no role declares a rule.
+*/
+function ownershipSql(ctx) {
+	const own = ctx.ownership;
+	if (own === void 0) return "";
+	const chunks = [];
+	const skipped = ctx.skipOwnershipTriggers;
+	for (const { name } of ctx.scopes) {
+		const counted = own.counted.filter((rule) => rule.scope === name);
+		if (counted.length === 0) continue;
+		if (skipped === "all" || skipped?.includes(name) === true) {
+			chunks.push(`-- ${name}: rls.ownershipTriggers leaves out the triggers, so min, max and transferOnly are checked only by decideRoleChange`);
+			continue;
+		}
+		const transfer = counted.filter((rule) => rule.transferOnly).map((rule) => rule.role);
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) {
+			const sources = holderSources(ctx, name);
+			if (sources === void 0) chunks.push(`-- ${name}: no memberships table configured, so min, max and transferOnly are checked only by decideRoleChange`);
+			else if (sources === "not-tables") chunks.push(`-- ${name}: a membership source is not a table, so min, max and transferOnly are checked only by decideRoleChange`);
+			else {
+				chunks.push(sourceHoldersTriggerSql(ctx, name, sources, counted));
+				if (transfer.length > 0) chunks.push(sourceTransferTriggerSql(ctx, name, sources, transfer));
+			}
+			continue;
+		}
+		chunks.push(holdersTriggerSql(ctx, name, mapped.table, mapped.column, counted));
+		if (transfer.length > 0) chunks.push(transferTriggerSql(ctx, name, mapped.table, mapped.column, transfer));
+	}
+	if (own.assigns.length > 0) {
+		chunks.push(canAssignSql(ctx, own));
+		if (ctx.authorize === "database") chunks.push(canAssignSql(ctx, own, true));
+		const custom = assignsCustomRoles(ctx);
+		if (custom) {
+			chunks.push(canAssignCustomSql(ctx));
+			if (hasCustomRoleChecksFor(ctx)) chunks.push(canAssignCustomSql(ctx, true));
+		}
+		chunks.push(canAssignAnySql(ctx, custom));
+		if (hasCanAssignAnyFor(ctx)) chunks.push(canAssignAnySql(ctx, custom, true));
+	}
+	return chunks.length === 0 ? "" : `${chunks.join("\n\n")}\n`;
+}
+/** Whether the helpers keep custom roles in tables, so assigning one is checked against its stored definition. */
+function assignsCustomRoles(ctx) {
+	return ctx.customRoles !== void 0 && ctx.authorize === "database";
+}
+/** Whether `permdock_can_assign_any_for` is written: every function it calls has a `_for` form. */
+function hasCanAssignAnyFor(ctx) {
+	return ctx.authorize === "database" && (!assignsCustomRoles(ctx) || hasCustomRoleChecksFor(ctx));
+}
+/**
+* `permdock_can_assign_any`: one check for a declared or a custom role, so
+* SQL that assigns roles calls one function: `permdock_can_assign` for a
+* declared role, `permdock_can_assign_custom_role` for a custom one. `p_scope`
+* `'global'` (no tenant, no instance) assigns a platform role.
+*/
+function canAssignAnySql(ctx, custom, forUser = false) {
+	const tenantType = tenantTypeOf(ctx);
+	const fn = qualified(ctx, forUser ? OWNERSHIP.canAssignAnyFor : OWNERSHIP.canAssignAny);
+	const declaredFn = qualified(ctx, forUser ? OWNERSHIP.canAssignFor : OWNERSHIP.canAssign);
+	const customFn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const userType = ctx.dialect === "supabase" ? "uuid" : "text";
+	const userParam = forUser ? `p_user ${userType}, ` : "";
+	const userArg = forUser ? `${userType}, ` : "";
+	const user = forUser ? "p_user, " : "";
+	const declared = `${declaredFn}(${user}p_role, case when p_scope = 'global' then null else p_scope_id end)`;
+	const body = custom && ctx.customRoles !== void 0 ? `case
+    when p_role = any(${declaredArray(ctx.customRoles.declared)}) then ${declared}
+    when p_scope = 'global' then ${customFn}(${user}null, 'global', null, p_role)
+    else ${customFn}(${user}p_tenant, p_scope, p_scope_id, p_role)
+  end` : declared;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}text, ${tenantType}, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(text, ${tenantType}, text, text) from public, anon;
+grant execute on function ${fn}(text, ${tenantType}, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign p_role at instance p_scope_id of p_scope in tenant p_tenant, declared or custom (p_scope 'global' for a platform role)${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_role text, p_tenant ${tenantType}, p_scope text, p_scope_id text)
+returns boolean
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  select coalesce(${body}, false)
+$$;
+${grants}`;
+}
+/** Objects `rls.assignments` adds. Names are part of the SQL contract. */
+const ASSIGNMENTS = {
+	custom: "permdock_can_assign_custom_role",
+	customFor: "permdock_can_assign_custom_role_for",
+	trigger: "permdock_assignment"
+};
+/** The client roles whose writes the assignment triggers check; any other role is a trusted path. */
+const CLIENT_ROLES = [
+	"anon",
+	"anonymous",
+	"authenticated"
+];
+/** The mapped membership tables, `rls.assignments.tables` and the global-roles table `rls.roles`. */
+function assignedTables(ctx) {
+	const out = [];
+	for (const { name } of ctx.scopes) {
+		const mapped = scopeTable(ctx, name);
+		if (mapped === void 0) continue;
+		out.push({
+			table: mapped.table.table,
+			scope: name,
+			id: mapped.column,
+			tenant: mapped.tenantColumn ?? mapped.column,
+			role: mapped.table.role,
+			user: mapped.table.user
+		});
+	}
+	if (ctx.roles !== void 0) out.push({
+		table: ctx.roles.table,
+		scope: "global",
+		role: ctx.roles.role ?? "role",
+		user: ctx.roles.user ?? "user_id"
+	});
+	for (const extra of ctx.assignments?.tables ?? []) {
+		const scope = resolveScope(ctx.scopes, extra.scope);
+		if (scope === void 0) throw new Error(`PermDock CLI: rls.assignments.tables names scope '${extra.scope}', which the policy does not declare`);
+		if (scope !== ctx.scopes[0]?.name && extra.tenant === void 0) throw new Error(`PermDock CLI: rls.assignments.tables entry ${extra.table} assigns at ${scope}, below the first scope: name its tenant column`);
+		out.push({
+			table: extra.table,
+			scope,
+			id: extra.id,
+			tenant: extra.tenant ?? extra.id,
+			role: extra.role,
+			...extra.user === void 0 ? {} : { user: extra.user }
+		});
+	}
+	return out;
+}
+/** The tables `rls.assignments.ownRole` refuses a caller's own rows on, by table key. */
+function ownRoleTables(ctx, tables) {
+	const own = ctx.assignments?.ownRole;
+	if (own === void 0) return /* @__PURE__ */ new Set();
+	if (own === "refuse") return new Set(tables.filter((entry) => entry.user !== void 0).map((entry) => qualifiedTable(entry.table)));
+	const out = /* @__PURE__ */ new Set();
+	for (const [name, value] of Object.entries(own)) {
+		const entry = tables.find((table) => qualifiedTable(table.table) === qualifiedTable(name));
+		if (entry === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which no assignment trigger guards`);
+		if (value !== "refuse") throw new Error(`PermDock CLI: rls.assignments.ownRole.${name} must be 'refuse'`);
+		if (entry.user === void 0) throw new Error(`PermDock CLI: rls.assignments.ownRole names ${name}, which has no user column: set its user in rls.assignments.tables`);
+		out.add(qualifiedTable(entry.table));
+	}
+	return out;
+}
+/**
+* The tables `rls.assignments` guards, schema-qualified: each scope's mapped
+* membership table, the global-roles table (`rls.roles`, else
+* `supabase.hook.roles`) and `rls.assignments.tables`. Empty without
+* `rls.assignments`.
+*/
+function guardedTables(config, scopes) {
+	const rls = config.rls;
+	if (rls?.assignments === void 0) return [];
+	const hook = config.supabase?.hook?.roles;
+	const roles = rls.roles ?? (hook === false ? void 0 : hook);
+	const tables = [
+		...scopes.flatMap((scope) => {
+			const mapped = memberForTable({
+				scopes,
+				...rls.memberships === void 0 ? {} : { memberships: rls.memberships }
+			}, scope.name);
+			return mapped === void 0 ? [] : [mapped.table];
+		}),
+		...roles === void 0 ? [] : [roles.table],
+		...(rls.assignments === true ? [] : rls.assignments.tables ?? []).map((entry) => entry.table)
+	];
+	return [...new Set(tables.map(qualifiedTable))];
+}
+function isRoleList(role) {
+	return Array.isArray(role);
+}
+/** The role keys a row variable holds, one scalar per role source. */
+function rowRoles(entry, row) {
+	return (isRoleList(entry.role) ? entry.role : [entry.role]).map((part) => roleColumn(part, qualifiedTable(entry.table), row, {
+		label: `rls.assignments ${entry.table} role`,
+		prefix: "PermDock CLI"
+	}).lookup);
+}
+/**
+* `permdock_can_assign_custom_role`: whether the signed-in caller may assign a
+* custom role of the tenant at the instance, by the checks the custom-role
+* write functions run on its stored definition.
+*/
+function canAssignCustomSql(ctx, forUser = false) {
+	const tenantType = tenantTypeOf(ctx);
+	const fn = qualified(ctx, forUser ? ASSIGNMENTS.customFor : ASSIGNMENTS.custom);
+	const perms = qualified(ctx, CUSTOM_ROLES.permissions);
+	const includes = qualified(ctx, CUSTOM_ROLES.includes);
+	const guard = qualified(ctx, forUser ? CUSTOM_ROLES.guardFor : CUSTOM_ROLES.guard);
+	const userParam = forUser ? "p_user uuid, " : "";
+	const userArg = forUser ? "uuid, " : "";
+	const stored = `c.tenant_id is not distinct from p_tenant and c.scope = p_scope and c.role = p_role and (c.scope_id is null or c.scope_id = p_scope_id)`;
+	const grants = forUser ? `revoke execute on function ${fn}(${userArg}${tenantType}, text, text, text) from public, anon, authenticated;` : `revoke execute on function ${fn}(${tenantType}, text, text, text) from public, anon;
+grant execute on function ${fn}(${tenantType}, text, text, text) to authenticated;`;
+	return `-- whether ${forUser ? "user p_user" : "the caller"} may assign custom role p_role at instance p_scope_id (a platform role: null tenant, scope global): the custom-role write checks on its stored definition${forUser ? "; no client role may execute it" : ""}
+create or replace function ${fn}(${userParam}p_tenant ${tenantType}, p_scope text, p_scope_id text, p_role text)
+returns boolean
+language plpgsql
+stable
+security definer
+set search_path = ''
+as $$
+declare
+  v_scope_id text;
+  v_found boolean := false;
+begin
+  select true, c.scope_id into v_found, v_scope_id
+  from (
+    select c.scope_id from ${perms} c where ${stored}
+    union all
+    select c.scope_id from ${includes} c where ${stored}
+  ) c
+  order by c.scope_id nulls first
+  limit 1;
+  if not coalesce(v_found, false) then
+    return false;
+  end if;
+  perform ${guard}(${forUser ? "p_user, " : ""}p_tenant, p_scope, v_scope_id, p_role);
+  return true;
+exception
+  when insufficient_privilege or invalid_parameter_value then
+    return false;
+end;
+$$;
+${grants}`;
+}
+/**
+* The assignment triggers (\`rls.assignments\`): before a client role inserts,
+* updates or deletes a row that assigns a role, every role the old and new
+* row hold must be one the caller may assign at that instance, by
+* \`permdock_can_assign\` for a declared role and
+* \`permdock_can_assign_custom_role\` for a custom one. The functions run as
+* the invoker, so \`current_user\` tells a client write from a trusted one.
+*/
+function assignmentSql(ctx) {
+	const own = ctx.ownership;
+	if (ctx.assignments === void 0 || own === void 0 || own.assigns.length === 0) return "";
+	const canAssign = qualified(ctx, OWNERSHIP.canAssign);
+	const custom = ctx.customRoles !== void 0 && ctx.authorize === "database";
+	const declared = ctx.customRoles?.declared;
+	const tenantType = tenantTypeOf(ctx);
+	const chunks = [];
+	const clients = `current_user::text = any(array[${CLIENT_ROLES.map(quoteLiteral).join(", ")}])`;
+	const tables = assignedTables(ctx);
+	const ownRole = ownRoleTables(ctx, tables);
+	for (const entry of tables) {
+		const table = quoteTable(qualifiedTable(entry.table));
+		const suffix = entry.table.replaceAll(/[^a-z0-9_]/gu, "_");
+		const fn = qualified(ctx, quoteIdent(`${ASSIGNMENTS.trigger}_${suffix}`));
+		const ownUser = entry.user !== void 0 && ownRole.has(qualifiedTable(entry.table)) ? entry.user : void 0;
+		const ownCheck = (row, reason) => ownUser === void 0 ? "" : `    if ${row}.${quoteIdent(ownUser)}::text = (${subjectIdSql(ctx)})::text then
+      raise exception using
+        errcode = '42501',
+        message = 'permdock: the caller may not change their own roles',
+        hint = '${reason}';
+    end if;
+`;
+		const check = (row) => {
+			const id = entry.id === void 0 ? "null::text" : `${row}.${quoteIdent(entry.id)}::text`;
+			const customFn = qualified(ctx, ASSIGNMENTS.custom);
+			let allowed = `${canAssign}(v_role, ${id})`;
+			if (custom && declared !== void 0) {
+				const platform = `${customFn}(null, 'global', null, v_role)`;
+				allowed = entry.id === void 0 || entry.tenant === void 0 ? `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) else ${platform} end` : `case when v_role = any(${declaredArray(declared)}) then ${canAssign}(v_role, ${id}) when ${id} is null then ${platform} else ${customFn}(${row}.${quoteIdent(entry.tenant)}::${tenantType}, ${quoteLiteral(entry.scope)}, ${id}, v_role) end`;
+			}
+			return `    foreach v_role in array array[${rowRoles(entry, row).join(", ")}]::text[] loop
+      if v_role is not null and not coalesce(${allowed}, false) then
+        raise exception using
+          errcode = '42501',
+          message = 'permdock: the caller may not assign ' || v_role || ' in ' || coalesce(${id}, 'null'),
+          hint = 'not-assignable-by';
+      end if;
+    end loop;`;
+		};
+		const what = entry.id === void 0 ? "global roles" : `${entry.scope} roles`;
+		chunks.push(`-- ${entry.table}: a client role may write only the ${what} it may assign${ownUser === void 0 ? "" : ", and none on its own rows"}
+create or replace function ${fn}()
+returns trigger
+language plpgsql
+volatile
+set search_path = ''
+as $$
+declare
+  v_role text;
+begin
+  if not (${clients}) then
+    return coalesce(new, old);
+  end if;
+  if tg_op in ('UPDATE', 'DELETE') then
+${ownCheck("old", "self-demotion")}${check("old")}
+  end if;
+  if tg_op in ('INSERT', 'UPDATE') then
+${ownCheck("new", "not-assignable-by")}${check("new")}
+  end if;
+  return coalesce(new, old);
+end;
+$$;
+revoke execute on function ${fn}() from public, anon, authenticated;
+drop trigger if exists "permdock_assignment" on ${table};
+create trigger "permdock_assignment"
+  before insert or update or delete on ${table}
+  for each row execute function ${fn}();`);
+	}
+	return `${chunks.join("\n\n")}\n`;
+}
+function declaredArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteLiteral).join(", ")}]::text[]`;
+}
+//#endregion
+export { ownershipRules as a, guardedTables as i, OWNERSHIP as n, ownershipSql as o, assignmentSql as r, ASSIGNMENTS as t };