permdock 0.1.0 → 0.2.0

package/dist/{sources-DOpW5Ila.d.ts → types-yF5LmQVD.d.ts}

@@ -1,5 +1,5 @@
-import { J as AuthEvent, ct as MembershipSource, mr as Principal } from "./policy-CInmNGkM.js";
-import { a as SupabaseManifestMembership } from "./manifest-DDQbC6K0.js";
+import { Nr as Principal, et as AuthEvent } from "./policy-CFZAr_Al.js";
+import { t as ClientNames } from "./clients-C7zLFuWT.js";
 import { StandardSchemaV1 } from "@standard-schema/spec";
 //#region src/supabase/claims.d.ts
 /** One entry of the `memberships` claim, as `schemas/supabase-claims-v1.json` defines it. */
@@ -27,6 +27,8 @@ type SupabaseMembershipClaim = {
   };
   readonly managedBy?: "idp";
   readonly entitlements?: readonly string[];
+  /** The instance or an ancestor is suspended: the permission keys the membership still grants. */
+  readonly keep?: readonly string[];
   /** Custom roles in compact form, read by the RLS helpers in `jwt` mode. */
   readonly grants?: Readonly<Record<string, unknown>>;
 };
@@ -96,16 +98,36 @@ type SupabasePrincipal = Principal & {
   readonly is_anonymous?: boolean;
 };
 type SupabaseInclude = "email" | "phone" | "is_anonymous";
+/**
+ * A column that holds a foreign key: the value is `column` of `through`,
+ * joined on `on`. A role reads its key from a roles table
+ * (`{ through: 'roles', on: { role_id: 'id' }, column: 'key' }`); a
+ * membership source's user can read its user id from a profile table
+ * (`{ through: 'contact_profiles', on: { contact_profile_id: 'id' }, column: 'user_id' }`).
+ */
+type RoleThrough = {
+  /** The referenced table; unqualified, it is in the schema of the table that references it. */
+  readonly through: string;
+  /** One entry: the referencing column to the column of `through` it references. */
+  readonly on: Readonly<Record<string, string>>;
+  /** The column of `through` that holds the value: the role key, or the user id. */
+  readonly column: string;
+};
 type SupabaseMembershipTable = {
   readonly table: string;
   readonly user: string;
-  readonly role: string;
+  /**
+   * The role key column, a reference to a roles table that holds the key, or
+   * several of them: the row holds every non-null key.
+   */
+  readonly role: string | RoleThrough | readonly (string | RoleThrough)[];
   /** Per scope name, the column holding that scope's id: the table's own scope and its ancestors. */
   readonly columns?: Readonly<Record<string, string>>;
   readonly tenant?: string;
   readonly team?: string;
   readonly id?: string;
   readonly expiresAt?: string;
+  readonly disabledAt?: string;
 };
 /** A table whose row says whether a user or a scope instance is active. A missing row counts as suspended. */
 type SupabaseActiveRow = {
@@ -118,11 +140,28 @@ type SupabaseActiveRow = {
   readonly status?: string;
   readonly active?: readonly string[];
 };
+/** A scope's active-row table, with the permissions its suspended instances keep. */
+type SupabaseSuspendedScope = SupabaseActiveRow & {
+  /**
+   * Permissions (references or keys) members of a suspended instance, and of
+   * every instance nested in it, still hold; such a membership carries them
+   * as `keep`.
+   */
+  readonly keep?: readonly (string | {
+    readonly key: string;
+  })[];
+};
+type SupabaseSuspendedMembership = {
+  readonly keep?: readonly (string | {
+    readonly key: string;
+  })[];
+};
 type SupabaseSuspension = {
   /** A suspended user holds no role and no membership. */
   readonly users?: SupabaseActiveRow;
-  /** Per scope name: a suspended instance voids its memberships and every membership nested under it. */
-  readonly scopes?: Readonly<Record<string, SupabaseActiveRow>>;
+  /** Per scope name: a suspended instance voids its memberships and every membership nested under it, except for `keep`. */
+  readonly scopes?: Readonly<Record<string, SupabaseSuspendedScope>>;
+  readonly memberships?: SupabaseSuspendedMembership;
 };
 type SupabaseMemberships = {
   /** The membership table of each named scope. */
@@ -147,10 +186,38 @@ type AuthorizeSqlOptions = {
    */
   readonly customRoles?: {
     readonly declared: readonly string[];
+    /** Stored allows may carry a level (`custom_role_permissions.level`). */
+    readonly levels?: true;
   };
   /** A suspended user, or a suspended instance of `scope` for a tenant request, answers `false`. */
   readonly suspension?: SupabaseSuspension;
 };
+/** A permission reference; `rls generate` reads only its `key`. */
+type SupabasePermissionRef = {
+  readonly key: string;
+};
+/**
+ * Private Realtime channels: topic patterns such as `org:{organization}:chat`,
+ * with one `{<scope>}` segment that holds a scope instance id.
+ */
+type SupabaseRealtime = {
+  readonly topics: Readonly<Record<string, {
+    /** Receive broadcast and presence: `select` on `realtime.messages`. */
+    readonly read: SupabasePermissionRef;
+    /** Send broadcast and track presence: `insert`. */
+    readonly write?: SupabasePermissionRef;
+  }>>;
+};
+/** Storage buckets whose object paths hold a scope instance id in folder `folder` (default 1). */
+type SupabaseStorage = {
+  readonly buckets: Readonly<Record<string, {
+    readonly scope: string;
+    readonly folder?: number;
+    readonly read?: SupabasePermissionRef;
+    readonly write?: SupabasePermissionRef;
+    readonly delete?: SupabasePermissionRef;
+  }>>;
+};
 type SupabaseRlsOptions = {
   readonly roleClaim?: string;
   readonly tenantClaim?: string;
@@ -158,6 +225,8 @@ type SupabaseRlsOptions = {
   readonly tenantType?: string;
   readonly memberships?: SupabaseMembershipTable | SupabaseMemberships;
   readonly suspension?: SupabaseSuspension;
+  readonly realtime?: SupabaseRealtime;
+  readonly storage?: SupabaseStorage;
 };
 type SupabaseRlsConfig = {
   readonly dialect: "supabase";
@@ -166,10 +235,12 @@ type SupabaseRlsConfig = {
   readonly tenantType?: string;
   readonly memberships?: SupabaseMemberships;
   readonly suspension?: SupabaseSuspension;
+  readonly realtime?: SupabaseRealtime;
+  readonly storage?: SupabaseStorage;
 };
 /**
  * The structural shape `subjectFromSupabaseSession` reads: a discriminant and the verified JWT claims.
- * Matches better-supabase's `AuthSession` and similar session objects without importing them.
+ * Matches any session object of that shape without importing its library.
  */
 type SupabaseSessionLike = {
   readonly kind: string;
@@ -184,8 +255,16 @@ type SupabaseSubjectOptions = {
   readonly declared?: readonly string[];
   /** Claim holding plan names per tenant id; the active tenant's entry becomes `principal.plans`. */
   readonly plans?: string;
+  /** Names for OAuth client ids: an `oauth-client` actor gets `client` set to the name of its id, which a policy delegation matches with `to: { kind: 'oauth-client', client }`. */
+  readonly clients?: ClientNames;
   /** `'deny'` maps a token with `is_anonymous: true` (`signInAnonymously()`) to the anonymous subject, as `rls.anonymousSignIns: 'deny'` does in RLS. */
   readonly anonymousSignIns?: "deny";
+  /**
+   * `true` once the caller checked the session against the Auth server for this request
+   * (`auth.getUser()` or an equivalent session check): a token with a `session_id` gets
+   * `subject.liveSession`, which `{ subject: { session: { live: true } } }` requires. Never read from claims.
+   */
+  readonly liveSession?: boolean;
   /** Audit hook: `membership-dropped` for a `memberships` entry that could not be read, `invalid-chain` for a malformed `act`. */
   readonly onAuth?: (event: AuthEvent) => void;
 };
@@ -224,124 +303,4 @@ type SupabaseDelegation = {
   readonly scopes: readonly string[];
 };
 //#endregion
-//#region src/supabase/sources.d.ts
-/**
- * Runs one parameterised statement: `pg`'s `client.query` (which resolves
- * `{ rows }`) and `postgres`'s `sql.unsafe` (which resolves the rows) both fit.
- */
-type SqlQuery = (text: string, values: readonly unknown[]) => Promise<readonly Record<string, unknown>[] | {
-  readonly rows: readonly Record<string, unknown>[];
-}>;
-type Common = {
-  readonly table: string;
-  /** Runs the lookups; without it the source only describes SQL (for `permdock supabase hook generate`). */
-  readonly query?: SqlQuery;
-  /** Drop suspended users and memberships under suspended instances, like `rls.suspension`. */
-  readonly suspension?: SupabaseSuspension;
-};
-type MembershipTableOptions = Common & {
-  /** Column names; `user`, `scope`, `id` and `role` default to `user_id`, `scope`, `scope_id`, `role`. */
-  readonly columns?: {
-    readonly user?: string;
-    readonly scope?: string;
-    readonly id?: string;
-    /** A `jsonb` column of ancestor ids keyed by scope name. */
-    readonly within?: string;
-    readonly role?: string;
-    readonly via?: string;
-    readonly expiresAt?: string;
-    /** The principal id that wrote the membership (`grantedBy`). */
-    readonly grantedBy?: string;
-    /** Free-text justification recorded on the membership (`reason`). */
-    readonly reason?: string;
-    /** A subgroup column filling `member.group`. */
-    readonly group?: string;
-    /** A text column; the value `idp` marks the row as owned by the identity provider. */
-    readonly managedBy?: string;
-    /** A `text[]` column of seats. */
-    readonly seats?: string;
-  };
-};
-type MembershipJunctionOptions = Common & {
-  /** The declared scope every row is a membership of. */
-  readonly scope: string;
-  /** Default `user_id`. */
-  readonly user?: string;
-  /** The column holding the scope instance id. Default `<scope>_id`. */
-  readonly id?: string;
-  /** Ancestor id columns keyed by scope name. */
-  readonly within?: Readonly<Record<string, string>>;
-  /** A role column, or fixed roles every row holds (a contact table with no role column). */
-  readonly roles: string | readonly string[];
-  /** The membership kind every row has (`contact`, `staff`, `partner`). */
-  readonly via?: string;
-  readonly expiresAt?: string;
-  /** The principal id that wrote the membership (`grantedBy`). */
-  readonly grantedBy?: string;
-  /** Free-text justification recorded on the membership (`reason`). */
-  readonly reason?: string;
-  /** A subgroup filling `member.group`: a fixed name every row has, or a column. */
-  readonly group?: string | {
-    readonly column: string;
-  };
-  /** `idp` when the identity provider owns every row, or a text column holding `idp` per row. */
-  readonly managedBy?: "idp" | {
-    readonly column: string;
-  };
-  /** A `text[]` column of seats. */
-  readonly seats?: string;
-};
-/** What `permdock supabase hook generate` compiles; the same SQL the source runs. */
-type MembershipSql = {
-  readonly table: string;
-  /** Columns of the table that decide a membership; triggers bump the authorization version on them. */
-  readonly user: string;
-  /** `<table>.<user>%type`: the PL/pgSQL type of the user column, for a variable `select` compares with. */
-  readonly userType: string;
-  /**
-   * The `select` of claim rows for one user, with every filter applied.
-   * `user` must have the column's type (a `userType` variable, or an untyped
-   * `$1` Postgres infers): the column is compared uncast so its index applies.
-   */
-  select(user: string): string;
-  /** The `select` of member rows for one scope instance (`$1` scope, `$2` id). */
-  list(): string;
-  /** A text column holding `idp` for rows the identity provider owns; `''` when every row is owned. */
-  readonly managed?: string;
-  /** Other tables the `select` reads (suspension tables). */
-  readonly reads: readonly string[];
-  /** Every column that decides who holds which membership: user, scope, id, `within`, role, `via` and expiry. */
-  readonly columns: readonly string[];
-  /** For a single-scope source: its scope and the scopes whose ids each row carries. */
-  readonly scope?: string;
-  readonly holds?: readonly string[];
-  /** The source's entry in the hook manifest's `memberships`. */
-  readonly manifest: SupabaseManifestMembership;
-};
-type SqlMembershipSource = MembershipSource & {
-  readonly sql: MembershipSql;
-};
-/**
- * Memberships from one table holding every scope: a row per user, scope,
- * instance and role (`user_id, scope, scope_id, role`), with optional
- * `within`, `via`, expiry, owner and seat columns. Rows of the same instance
- * merge into one membership.
- */
-declare function fromTable(options: MembershipTableOptions): SqlMembershipSource;
-/**
- * Memberships from a table of one scope (`customer_contacts`): every row is a
- * membership of `scope`, with roles from a column or fixed (`['contact']`), a
- * fixed `via`, and ancestor ids from `within` columns.
- */
-declare function fromJunction(options: MembershipJunctionOptions): SqlMembershipSource;
-declare const AUTHZ_VERSION_TABLE = "permdock_authz_version";
-/**
- * Reads the authorization version `permdock supabase hook generate` keeps in
- * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
- */
-declare function authzVersion(options: {
-  readonly query: SqlQuery;
-  readonly schema?: string;
-}): NonNullable<MembershipSource["version"]>;
-//#endregion
-export { SupabaseActClaim as C, SupabaseMembershipClaim as D, SupabaseClaimsSchema as E, SupabasePermDockClaims as O, SupabaseSuspension as S, SupabaseClaimsOptions as T, SupabasePrincipal as _, SqlMembershipSource as a, SupabaseSessionLike as b, fromJunction as c, SupabaseActiveRow as d, SupabaseActor as f, SupabaseMembershipTable as g, SupabaseInclude as h, MembershipTableOptions as i, supabaseClaims as k, fromTable as l, SupabaseDelegation as m, MembershipJunctionOptions as n, SqlQuery as o, SupabaseActorResult as p, MembershipSql as r, authzVersion as s, AUTHZ_VERSION_TABLE as t, AuthorizeSqlOptions as u, SupabaseRlsConfig as v, SupabaseClaims as w, SupabaseSubjectOptions as x, SupabaseRlsOptions as y };
+export { SupabaseClaimsSchema as C, supabaseClaims as E, SupabaseClaimsOptions as S, SupabasePermDockClaims as T, SupabaseSuspendedMembership as _, SupabaseActorResult as a, SupabaseActClaim as b, SupabaseMembershipTable as c, SupabaseRealtime as d, SupabaseRlsConfig as f, SupabaseSubjectOptions as g, SupabaseStorage as h, SupabaseActor as i, SupabasePermissionRef as l, SupabaseSessionLike as m, RoleThrough as n, SupabaseDelegation as o, SupabaseRlsOptions as p, SupabaseActiveRow as r, SupabaseInclude as s, AuthorizeSqlOptions as t, SupabasePrincipal as u, SupabaseSuspendedScope as v, SupabaseMembershipClaim as w, SupabaseClaims as x, SupabaseSuspension as y };

package/dist/unplugin/index.d.ts

@@ -1,4 +1,4 @@
-import { a as PermDockPluginOptions } from "../types-D6Z6-rKJ.js";
+import { a as PermDockPluginOptions } from "../types-BPxgszlT.js";
 import { createUnplugin } from "unplugin";
 //#region src/unplugin/index.d.ts
 type CreateUnplugin = typeof createUnplugin<PermDockPluginOptions | undefined>;

package/dist/unplugin/index.js

@@ -1,4 +1,4 @@
-import { n as runPluginCollect } from "../plugin-4gr7IxFJ.js";
+import { n as createCollectScheduler, r as report } from "../watch-UihESpsJ.js";
 import { t as peerHint } from "../peer-BOr_kJE1.js";
 import { createRequire } from "node:module";
 //#region src/unplugin/index.ts
@@ -9,19 +9,20 @@ function loadCreateUnplugin() {
 		throw new Error(peerHint("unplugin", "permdock/unplugin"));
 	}
 }
-function report(message) {
-	if (message !== void 0) process.stderr.write(`permdock: ${message}\n`);
-}
 function collectPlugin(options) {
+	const schedulers = /* @__PURE__ */ new Map();
+	function schedulerFor(cwd) {
+		const scheduler = schedulers.get(cwd) ?? createCollectScheduler(cwd, options);
+		schedulers.set(cwd, scheduler);
+		return scheduler;
+	}
 	return {
 		name: "permdock-collect",
 		async buildStart() {
-			report(await runPluginCollect(process.cwd(), options, options?.check === true));
+			report(await schedulerFor(process.cwd()).run(options?.check === true));
 		},
-		watchChange() {
-			runPluginCollect(process.cwd(), options, false).then(report, (error) => {
-				report(error instanceof Error ? error.message : String(error));
-			});
+		watchChange(id) {
+			schedulerFor(process.cwd()).changed(id);
 		}
 	};
 }

package/dist/{usage-1ozMubLY.js → usage-D07N9QJ3.js}

@@ -1,4 +1,4 @@
-import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-BMh_Etm2.js";
+import { a as listArg, i as globalArgs, t as COMMAND_DESCRIPTIONS } from "./commands-DWOrSQic.js";
 import { defineCommand } from "citty";
 //#region src/cli/commands/usage.ts
 function usage(ctx) {
@@ -24,7 +24,7 @@ function usage(ctx) {
 			}
 		},
 		async run({ args: parsed, rawArgs }) {
-			const result = await (await import("./usage-PyEor6GA.js")).runUsage({
+			const result = await (await import("./usage-D82l1CwK.js")).runUsage({
 				cwd: ctx.cwd,
 				config: ctx.config,
 				ignore: listArg(rawArgs, "ignore"),

package/dist/usage-D82l1CwK.js

@@ -0,0 +1,2 @@
+import { t as runUsage } from "./usage-DG1oeCca.js";
+export { runUsage };