permdock 0.0.0 → 0.2.0

package/dist/supabase-config-Bs44dare.js

@@ -0,0 +1,472 @@
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as sqlFiles, i as rel } from "./files-DWUN9PzI.js";
+import { t as FIELD_VIEWS } from "./rls-fields-BMasREhR.js";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
+import { dirname, join, posix, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { parse } from "smol-toml";
+//#region src/cli/deciding-columns.ts
+/** `schema.table`, unquoted and lower case; `public` when unqualified. */
+function tableKey(name) {
+	const parts = name.split(".").map((part) => part.replaceAll("\"", ""));
+	return (parts.length === 1 ? ["public", ...parts] : parts).join(".").toLowerCase();
+}
+/**
+* The columns of each membership source's table that decide who holds which
+* membership (user, scope, id, `within`, role, `via`, expiry), and the id and
+* value columns of a table a role or user column references, keyed by
+* {@link tableKey}. A client that can write one can give itself a membership.
+*/
+function membershipColumns(config) {
+	const sources = config.supabase?.hook?.memberships ?? config.rls?.membershipSources ?? [];
+	const byTable = /* @__PURE__ */ new Map();
+	for (const source of sources) {
+		const table = tableKey(source.sql.table);
+		const columns = byTable.get(table) ?? /* @__PURE__ */ new Set();
+		for (const column of source.sql.columns) columns.add(column);
+		byTable.set(table, columns);
+		for (const through of [...source.sql.throughs, ...source.sql.userThrough === void 0 ? [] : [source.sql.userThrough]]) {
+			const keys = tableKey(through.table);
+			byTable.set(keys, /* @__PURE__ */ new Set([
+				...byTable.get(keys) ?? [],
+				through.id,
+				through.key
+			]));
+		}
+	}
+	return byTable;
+}
+/**
+* Every `schema.table.column` a claim or a membership is computed from: the
+* membership columns and the `attrs` table columns. Sorted.
+*/
+function decidingColumns(config, attrs) {
+	const entries = /* @__PURE__ */ new Set();
+	for (const [table, columns] of membershipColumns(config)) for (const column of columns) entries.add(`${table}.${column}`);
+	if (attrs?.table !== void 0) {
+		const table = tableKey(attrs.table);
+		for (const column of attrs.columns) entries.add(`${table}.${column}`);
+	}
+	return [...entries].toSorted();
+}
+//#endregion
+//#region src/cli/sql-statements.ts
+function blankComments(sql) {
+	return sql.replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+}
+/** Split on `;` outside string literals and dollar-quoted bodies. */
+function sqlStatements(sql) {
+	const text = blankComments(sql);
+	const statements = [];
+	const push = (start, end) => {
+		const body = text.slice(start, end);
+		const lead = body.length - body.trimStart().length;
+		const trimmed = body.trim();
+		if (trimmed !== "") statements.push({
+			line: text.slice(0, start + lead).split("\n").length,
+			text: trimmed
+		});
+	};
+	let start = 0;
+	let index = 0;
+	while (index < text.length) {
+		const char = text[index];
+		if (char === "'") {
+			const end = text.indexOf("'", index + 1);
+			index = end === -1 ? text.length : end + 1;
+			continue;
+		}
+		if (char === "$") {
+			const tag = /^\$[A-Za-z_]*\$/u.exec(text.slice(index, index + 64));
+			if (tag !== null) {
+				const end = text.indexOf(tag[0], index + tag[0].length);
+				index = end === -1 ? text.length : end + tag[0].length;
+				continue;
+			}
+		}
+		if (char === ";") {
+			push(start, index);
+			start = index + 1;
+		}
+		index += 1;
+	}
+	push(start, text.length);
+	return statements;
+}
+/** Capture group `index` of a match, or '' when an optional group took no part. */
+function group(match, index) {
+	return match[index] ?? "";
+}
+const VIEW = /^create\s+(?:or\s+replace\s+)?view\s+(?<name>\S+?)(?:\s+with\s*\((?<options>[^)]*)\))?\s+as\b/iu;
+const PRIVILEGE = /^(?:grant|revoke)\s[\s\S]*?\son\s+(?<target>[\s\S]+?)\s+(?:to|from)\s/iu;
+const UNDIFFED_TARGET = /^(?:schema|function|procedure|routine|all\s+(?:functions|procedures|routines)\s+in\s+schema)\s/iu;
+function privilegeTable(target) {
+	return target.replace(/^table\s+/iu, "").trim();
+}
+function splitUndiffed(sql) {
+	const statements = sqlStatements(sql);
+	const views = /* @__PURE__ */ new Set();
+	const moved = [];
+	let kept = sql;
+	for (const { text } of statements) {
+		const view = VIEW.exec(text)?.groups;
+		if (view !== void 0) {
+			views.add(view["name"] ?? "");
+			if (view["options"] !== void 0) moved.push(`alter view ${view["name"] ?? ""} set (${view["options"]});`);
+			continue;
+		}
+		const target = PRIVILEGE.exec(text)?.groups?.["target"];
+		if (target !== void 0 && (UNDIFFED_TARGET.test(target) || views.has(privilegeTable(target)))) {
+			moved.push(`${text};`);
+			kept = kept.replace(`${text};\n`, "");
+		}
+	}
+	return {
+		kept,
+		moved
+	};
+}
+//#endregion
+//#region src/cli/doctor-project.ts
+/**
+* The directories from `cwd` up to the workspace root: the first one with a
+* `pnpm-workspace.yaml`, a `package.json` that declares `workspaces`, or a
+* `.git`. Skills are often installed once at a monorepo's root.
+*/
+function workspaceDirs(cwd) {
+	const dirs = [];
+	let dir = resolve(cwd);
+	for (;;) {
+		dirs.push(dir);
+		if (isWorkspaceRoot(dir)) return dirs;
+		const parent = dirname(dir);
+		if (parent === dir) return [resolve(cwd)];
+		dir = parent;
+	}
+}
+function isWorkspaceRoot(dir) {
+	if (existsSync(join(dir, "pnpm-workspace.yaml")) || existsSync(join(dir, ".git"))) return true;
+	const manifest = join(dir, "package.json");
+	if (!existsSync(manifest)) return false;
+	try {
+		const parsed = JSON.parse(readFileSync(manifest, "utf8"));
+		return parsed !== null && typeof parsed === "object" && Object.hasOwn(parsed, "workspaces");
+	} catch {
+		return false;
+	}
+}
+/** Whether `dir` holds a skills lock: PermDock's own, or the `skills` CLI's naming the `permdock` skill. */
+function hasSkillsLock(dir) {
+	if (existsSync(join(dir, ".permdock/skills-lock.json"))) return true;
+	const shared = join(dir, "skills-lock.json");
+	if (!existsSync(shared)) return false;
+	try {
+		const parsed = JSON.parse(readFileSync(shared, "utf8"));
+		const skills = parsed !== null && typeof parsed === "object" ? Reflect.get(parsed, "skills") : void 0;
+		return skills !== null && typeof skills === "object" && Object.hasOwn(skills, "permdock");
+	} catch {
+		return false;
+	}
+}
+function pd005(cwd) {
+	const dirs = workspaceDirs(cwd);
+	if (!dirs.some((dir) => [
+		".agents/skills",
+		".claude/skills",
+		".cursor/skills"
+	].some((folder) => existsSync(join(dir, folder, "permdock/SKILL.md"))))) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "Agent Skills are not installed",
+		fix: "pnpm exec permdock skills install"
+	}];
+	if (!dirs.some(hasSkillsLock)) return [{
+		code: "PD005",
+		severity: "warning",
+		message: "skills lock is missing",
+		fix: "pnpm exec permdock skills install"
+	}];
+	return [];
+}
+function pd006(cwd) {
+	try {
+		const pkg = createRequire(resolve(cwd, "package.json"))("typescript/package.json");
+		const major = Number(pkg.version.split(".")[0]);
+		if (major < 5 || major === 5 && Number(pkg.version.split(".")[1]) < 9) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is below the supported matrix (5.9, 6, 7)`,
+			fix: "upgrade typescript to 5.9 or later"
+		}];
+		if (major > 7) return [{
+			code: "PD006",
+			severity: "error",
+			message: `TypeScript ${pkg.version} is not in the supported matrix (5.9, 6, 7)`,
+			fix: "use TypeScript 5.9, 6 or 7"
+		}];
+		return [];
+	} catch {
+		return [{
+			code: "PD006",
+			severity: "error",
+			message: "typescript is not installed",
+			fix: "add typescript 5.9, 6 or 7"
+		}];
+	}
+}
+function pd009(cwd) {
+	const copies = [];
+	function walk(dir, depth) {
+		if (depth > 6 || !existsSync(dir)) return;
+		const pkg = join(dir, "node_modules/permdock/package.json");
+		if (existsSync(pkg)) copies.push(pkg);
+		if (!existsSync(join(dir, "node_modules"))) return;
+		for (const name of readdirSync(join(dir, "node_modules"))) {
+			if (name.startsWith(".")) continue;
+			const nested = join(dir, "node_modules", name);
+			try {
+				if (statSync(nested).isDirectory()) walk(nested, depth + 1);
+			} catch {}
+		}
+	}
+	walk(cwd, 0);
+	if (copies.length > 1) return [{
+		code: "PD009",
+		severity: "error",
+		message: `duplicate permdock copies: ${copies.map((item) => rel(cwd, dirname(item))).join(", ")}`,
+		fix: "dedupe so only one permdock version is installed"
+	}];
+	return [];
+}
+function pd012(cwd, config) {
+	const docs = config.openapi?.doc ?? [];
+	const findings = [];
+	for (const doc of docs) {
+		const abs = resolve(cwd, doc);
+		if (!existsSync(abs)) continue;
+		const text = readFileSync(abs, "utf8");
+		if (text.includes("\"drafts\"") && !text.includes("overlay")) findings.push({
+			code: "PD012",
+			severity: "warning",
+			message: `${doc} carries a draft pin the CLI no longer emits`,
+			fix: "regenerate with permdock openapi"
+		});
+	}
+	return findings;
+}
+const MIGRATION_DIRS = [
+	"supabase/migrations",
+	"supabase/schemas",
+	"migrations",
+	"drizzle",
+	"prisma/migrations",
+	"db/migrations"
+];
+const VIEW_NAME = String.raw`((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)`;
+const CREATE_VIEW = new RegExp(String.raw`\bcreate\s+(?:or\s+replace\s+)?(?:temp(?:orary)?\s+)?(?:recursive\s+)?view\s+${VIEW_NAME}([\s\S]*?)\bas\b`, "giu");
+const ALTER_VIEW = new RegExp(String.raw`\balter\s+view\s+(?:if\s+exists\s+)?${VIEW_NAME}\s+set\s*\(([^)]*)\)`, "giu");
+const INVOKER = /\bsecurity_invoker\s*(?:=\s*(?:true|on|'true'|'on'|1)\b|[,)]|$)/iu;
+const COMPANION = new RegExp(String.raw`\bcomment\s+on\s+view\s+${VIEW_NAME}\s+is\s+'${FIELD_VIEWS.comment}\b`, "giu");
+/**
+* Views run as their owner unless `security_invoker` is set, so they read
+* past RLS on the tables beneath them. The `<table>_visible_fields`
+* companion `rls generate --revoke-columns` writes reads as its owner on
+* purpose and carries a comment that says so.
+*/
+function pd022(cwd, config) {
+	if (config.rls === void 0 && config.doctor?.migrations === void 0) return [];
+	const created = /* @__PURE__ */ new Map();
+	const invoker = /* @__PURE__ */ new Set();
+	const companions = /* @__PURE__ */ new Set();
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const raw = readFileSync(file, "utf8");
+		const text = raw.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
+		for (const [, name = "", options = ""] of text.matchAll(CREATE_VIEW)) {
+			const key = tableKey(name);
+			created.set(key, rel(cwd, file));
+			if (INVOKER.test(options)) invoker.add(key);
+			else invoker.delete(key);
+		}
+		for (const [, name = "", options = ""] of text.matchAll(ALTER_VIEW)) if (INVOKER.test(options)) invoker.add(tableKey(name));
+		for (const [, name = ""] of raw.matchAll(COMPANION)) companions.add(tableKey(name));
+	}
+	return [...created].filter(([key]) => !invoker.has(key) && !companions.has(key)).map(([key, file]) => ({
+		code: "PD022",
+		severity: "warning",
+		message: `view ${key} in ${file} is not security_invoker, so it reads past row level security`,
+		fix: `create the view with (security_invoker = true), or alter view ${key} set (security_invoker = true); Postgres 15 or later. For column-level reads, generate field views with permdock rls generate --fields views`
+	}));
+}
+const AUTH_ROLE = /\bauth\.role\s*\(\s*\)/giu;
+/**
+* PD040: `auth.role()` in a migration. Supabase deprecated it; a policy
+* names its Postgres roles with `to authenticated` instead, and the role
+* claim it reads is the one PostgREST already switched to.
+*/
+function pd040(cwd, config) {
+	const findings = [];
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) {
+		const text = readFileSync(file, "utf8").replaceAll(/--[^\n]*/gu, (comment) => " ".repeat(comment.length)).replaceAll(/\/\*[\s\S]*?\*\//gu, (comment) => comment.replaceAll(/[^\n]/gu, " "));
+		for (const match of text.matchAll(AUTH_ROLE)) {
+			const line = text.slice(0, match.index).split("\n").length;
+			findings.push({
+				code: "PD040",
+				severity: "warning",
+				message: `${rel(cwd, file)}:${String(line)} calls auth.role(), which Supabase deprecated`,
+				fix: "name the roles on the policy (create policy ... to authenticated) and drop the auth.role() = 'authenticated' test; call permdock_has or permitted_<scope>_ids for permissions"
+			});
+		}
+	}
+	return findings;
+}
+const GRANT = /\b(grant|revoke)\s+([\s\S]+?)\s+on\s+(?:table\s+)?([\w."]+)\s+(?:to|from)\s+([\w\s,"]+?)(?:\s+with\s+grant\s+option|\s+cascade|\s+restrict)?\s*;/giu;
+const CLIENT_ROLES = /* @__PURE__ */ new Set([
+	"anon",
+	"authenticated",
+	"public"
+]);
+function applyPrivilege(writable, verb, part) {
+	const match = /^\s*(all(?:\s+privileges)?|insert|update)\s*(?:\(([^)]*)\))?\s*$/iu.exec(part);
+	if (match === null) return;
+	const kind = (match[1] ?? "").toLowerCase();
+	const sets = kind === "insert" ? [writable.insert] : kind === "update" ? [writable.update] : [writable.insert, writable.update];
+	const columns = match[2] === void 0 ? ["*"] : match[2].split(",").map((column) => column.trim().replaceAll("\"", ""));
+	for (const set of sets) for (const column of columns) if (verb.toLowerCase() === "grant") set.add(column);
+	else if (column === "*") set.clear();
+	else set.delete(column);
+}
+const CREATE_TABLE = /^create\s+(?:(?:global|local)\s+)?(?:(?:temp|temporary|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?((?:"[^"]+"|\w+)(?:\.(?:"[^"]+"|\w+))?)\s*\(/iu;
+const REVOKE_DEFAULT_TABLES = /^alter\s+default\s+privileges\s+(?:for\s+(?:role|user)\s+[\w\s,"]+?\s+)?in\s+schema\s+"?public"?\s+revoke\s+[\s\S]+?\s+on\s+tables\s+from\s+[\s\S]*\b(?:anon|authenticated)\b/iu;
+/**
+* Columns of `table` a client role may insert or update, per the migrations
+* in order; `*` for every column. On Supabase a table created in `public`
+* starts writable: the default privileges grant `anon` and `authenticated`
+* everything, until a migration revokes them.
+*/
+function clientWritable(cwd, config, target) {
+	const writable = {
+		insert: /* @__PURE__ */ new Set(),
+		update: /* @__PURE__ */ new Set()
+	};
+	let defaults = config.supabase !== void 0 && target.startsWith("public.");
+	for (const file of sqlFiles(cwd, config.doctor?.migrations ?? MIGRATION_DIRS)) for (const { text } of sqlStatements(readFileSync(file, "utf8"))) {
+		if (REVOKE_DEFAULT_TABLES.test(text)) {
+			defaults = false;
+			continue;
+		}
+		const created = CREATE_TABLE.exec(text);
+		if (created !== null) {
+			if (defaults && tableKey(created[1] ?? "") === target) {
+				writable.insert.add("*");
+				writable.update.add("*");
+			}
+			continue;
+		}
+		for (const [, verb = "", privileges = "", name = "", roles = ""] of `${text};`.matchAll(GRANT)) {
+			if (tableKey(name) !== target) continue;
+			if (!roles.split(",").map((role) => role.trim().replaceAll("\"", "").toLowerCase()).some((role) => CLIENT_ROLES.has(role))) continue;
+			for (const part of privileges.split(/,(?![^(]*\))/u)) applyPrivilege(writable, verb, part);
+		}
+	}
+	return /* @__PURE__ */ new Set([...writable.insert, ...writable.update]);
+}
+/** Membership columns a client can write: a user who sets `user_id` or `role` grants themselves access. */
+function membershipFindings(cwd, config) {
+	const findings = [];
+	for (const [table, columns] of membershipColumns(config)) {
+		const writable = clientWritable(cwd, config, table);
+		const exposed = [...columns].filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `${table}.${exposed.join(", ")} decide${exposed.length === 1 ? "s" : ""} memberships, and the migrations let anon or authenticated insert or update ${exposed.length === 1 ? "it" : "them"}: a user could give themselves a membership`,
+			fix: `revoke insert, update on ${table} from anon, authenticated, then grant update (<columns clients edit>) on ${table} to authenticated; a column-level revoke alone leaves a table-level grant in place`
+		});
+	}
+	return findings;
+}
+/**
+* `attrs` claims must come from server-owned columns: never `user_metadata`,
+* never a column clients can write. Membership sources' deciding columns are
+* held to the same rule.
+*/
+function pd028(cwd, config, plan) {
+	const memberships = membershipFindings(cwd, config);
+	const attrs = config.supabase?.hook?.attrs;
+	if (attrs === void 0) return memberships;
+	const planned = plan(attrs);
+	const findings = planned.errors.map((message) => ({
+		code: "PD028",
+		severity: "error",
+		message,
+		fix: "list server-owned columns or app_metadata.<key> entries; user_metadata is user-editable"
+	}));
+	if (planned.table !== void 0 && planned.columns.length > 0) {
+		const writable = clientWritable(cwd, config, tableKey(planned.table));
+		const exposed = planned.columns.filter((column) => writable.has("*") || writable.has(column));
+		if (exposed.length > 0) findings.push({
+			code: "PD028",
+			severity: "warning",
+			message: `attrs reads ${exposed.join(", ")} from ${tableKey(planned.table)}, which the migrations let anon or authenticated insert or update: a user could set their own attribute`,
+			fix: `revoke insert, update on ${tableKey(planned.table)} from anon, authenticated, and grant column-level update only on columns that are not attributes; the generated hook migration refuses to install otherwise`
+		});
+	}
+	return [...findings, ...memberships];
+}
+//#endregion
+//#region src/cli/supabase-config.ts
+const SUPABASE_CONFIG = "supabase/config.toml";
+function table(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return;
+	return value;
+}
+function strings(value) {
+	return Array.isArray(value) ? value.filter((item) => typeof item === "string") : void 0;
+}
+/** `supabase/config.toml`, parsed; `undefined` when the project has none. */
+function readSupabaseConfig(cwd) {
+	const file = join(cwd, SUPABASE_CONFIG);
+	if (!existsSync(file)) return;
+	let root;
+	try {
+		root = parse(readFileSync(file, "utf8"));
+	} catch (error) {
+		return {
+			ok: false,
+			error: describeError(error)
+		};
+	}
+	const expiry = table(root["auth"])?.["jwt_expiry"];
+	const paths = table(table(root["db"])?.["migrations"])?.["schema_paths"];
+	const schemaPaths = strings(paths);
+	const apiSchemas = strings(table(root["api"])?.["schemas"]);
+	const pgDelta = table(table(root["experimental"])?.["pgdelta"]);
+	const schemaPath = pgDelta?.["declarative_schema_path"];
+	return {
+		ok: true,
+		config: {
+			...typeof expiry === "number" ? { jwtExpiry: expiry } : {},
+			...schemaPaths === void 0 ? {} : { schemaPaths },
+			...apiSchemas === void 0 ? {} : { apiSchemas },
+			...pgDelta?.["enabled"] === true ? { pgDelta: { schemaDir: posix.join("supabase", typeof schemaPath === "string" ? schemaPath : "schemas").replace(/\/$/u, "") } } : {}
+		}
+	};
+}
+/** The parsed config, or `{}` when it is missing or does not parse (PD045 reports that). */
+function supabaseConfig(cwd) {
+	const read = readSupabaseConfig(cwd);
+	return read?.ok === true ? read.config : {};
+}
+/** PD045: a `supabase/config.toml` the CLI cannot parse, so every check that reads it falls back to defaults. */
+function pd045(cwd) {
+	const read = readSupabaseConfig(cwd);
+	if (read === void 0 || read.ok) return [];
+	return [{
+		code: "PD045",
+		severity: "warning",
+		message: `${SUPABASE_CONFIG} does not parse: ${read.error.replace(/\n[\s\S]*/u, "")}`,
+		fix: `fix the TOML syntax in ${SUPABASE_CONFIG}; until then doctor assumes Supabase's defaults for jwt_expiry and schema_paths`
+	}];
+}
+//#endregion
+export { pd006 as a, pd022 as c, group as d, splitUndiffed as f, tableKey as h, pd005 as i, pd028 as l, decidingColumns as m, supabaseConfig as n, pd009 as o, sqlStatements as p, MIGRATION_DIRS as r, pd012 as s, pd045 as t, pd040 as u };