permdock 0.1.0 → 0.3.0

package/dist/{rls-graph-DxQ39PJj.js → rls-graph-CHwx0V8q.js}

@@ -1,25 +1,35 @@
-import { d as isFieldRelation, h as isSelfParented, p as isPrincipalRelation, r as expandRelation, u as isEdgeRelation } from "./permissions-DC7GROPA.js";
-import { u as scopeList } from "./scopes-cKVp_WTw.js";
-import { f as relationCondition, s as flattenGrantee } from "./grantee-Bv04_Vzf.js";
-import { c as relationArmSql } from "./compile-D22iwvuV.js";
-import "./sources-DVHM3Mwq.js";
-import { F as qualifiedTable, I as quoteIdent, L as quoteLiteral, O as linkHelper, R as quoteTable, T as graphSqlText, g as activeUserSql, m as CLOSURE, t as HELPERS, w as graphHelper } from "./rls-helpers-BxRuif0l.js";
+import { S as restrictedFor, d as isEdgeRelation, f as isFieldRelation, g as isSelfParented, l as groupEntries, m as isPrincipalRelation, r as expandRelation } from "./permissions-DVoF6dMt.js";
+import { d as scopeList } from "./scopes-CVdPrWN-.js";
+import { l as inheritCondition, m as relationCondition, s as flattenGrantee } from "./grantee-Cv5Sogfv.js";
+import { c as relationArmSql, u as restrictedRowsSql } from "./compile-Ba4blROR.js";
+import "./sources-4p0-4xQm.js";
+import { E as graphSqlText, G as quoteIdent, J as restrictedHelper, K as quoteLiteral, N as linkHelper, T as graphSqlName, W as qualifiedTable, _ as activeUserSql, d as CLOSURE, q as quoteTable, r as HELPERS, w as graphHelper } from "./rls-shared-Cewd_-zI.js";
 //#region src/cli/helper-calls.ts
 /**
-* Tables whose policies other packages write (better-supabase `defineBucket`
-* and `defineTopic` in `permdock` mode) by calling the SQL helpers directly.
+* Tables whose policies other packages write by calling the SQL helpers
+* directly (storage buckets and realtime topics).
 */
 const HELPER_TABLES = ["storage.objects", "realtime.messages"];
-const HELPER_CALL = new RegExp(String.raw`\b(?:${HELPERS.has}|permitted_[a-z][a-z0-9_]*_ids)\s*\(\s*'((?:[^']|'')+)'`, "giu");
-const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}|permitted_[a-z][a-z0-9_]*_ids|member_[a-z][a-z0-9_]*_ids)\s*\(`, "iu");
+const HELPER_CALL = new RegExp(String.raw`\b(${HELPERS.has}(?:_permission)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?)\s*\(\s*'((?:[^']|'')+)'(\s*,\s*(false\b)?)?`, "giu");
+const ANY_HELPER = new RegExp(String.raw`\b(?:${HELPERS.has}(?:_permission)?(?:_for)?|permitted_[a-z][a-z0-9_]*_ids(?:_by_permission)?(?:_for)?|member_[a-z][a-z0-9_]*_ids(?:_for)?)\s*\(`, "iu");
 /** Whether a policy expression calls any generated helper, the key-less `member_<scope>_ids` included. */
 function callsHelper(sql) {
 	return ANY_HELPER.test(sql);
 }
-/** The permission keys a policy expression passes to `permdock_has` or `permitted_<scope>_ids`, `#n` stripped. */
-function helperCallKeys(sql) {
+/**
+* The permission keys a policy expression passes to `permdock_has`,
+* `permitted_<scope>_ids` or their permission-key forms, `#n` stripped. With
+* `blind`, only the calls that ignore row conditions: the grant-key forms,
+* and a permission-key form asked for conditioned allows. A plain
+* `permdock_has_permission(key)` or `permitted_<scope>_ids_by_permission(key)`
+* counts only allows without a row condition, so it never grants more than
+* the application does.
+*/
+function helperCallKeys(sql, blind = false) {
 	const keys = /* @__PURE__ */ new Set();
-	for (const [, literal = ""] of sql.matchAll(HELPER_CALL)) {
+	for (const [, name = "", literal = "", extra, falsy] of sql.matchAll(HELPER_CALL)) {
+		const byPermission = /_permission$/iu.test(name);
+		if (blind && byPermission && (extra === void 0 || falsy !== void 0)) continue;
 		const key = literal.replaceAll("''", "'").split("#")[0] ?? "";
 		if (key !== "") keys.add(key);
 	}
@@ -33,13 +43,13 @@ function helperTable(name) {
 	const table = tableName(name);
 	return HELPER_TABLES.find((candidate) => candidate === table);
 }
-/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their helper calls pass. */
+/** `create policy` statements on {@link HELPER_TABLES} in migration SQL, with the keys their condition-blind helper calls pass. */
 function helperTablePolicies(sql) {
 	const text = sql.replaceAll(/--[^\n]*/gu, "").replaceAll(/\/\*[\s\S]*?\*\//gu, "");
 	const found = [];
 	for (const [, name = "", target = "", body = ""] of text.matchAll(CREATE_POLICY)) {
 		const table = helperTable(target);
-		const keys = helperCallKeys(body);
+		const keys = helperCallKeys(body, true);
 		if (table !== void 0 && keys.length > 0) found.push({
 			table,
 			name: name.replaceAll("\"", ""),
@@ -57,7 +67,7 @@ function helperTablePoliciesFromRows(rows) {
 	const found = [];
 	for (const row of rows) {
 		const table = helperTable(String(row["target"] ?? ""));
-		const keys = helperCallKeys(String(row["body"] ?? ""));
+		const keys = helperCallKeys(String(row["body"] ?? ""), true);
 		if (table !== void 0 && keys.length > 0) found.push({
 			table,
 			name: String(row["policyname"] ?? ""),
@@ -70,7 +80,7 @@ function helperTablePoliciesFromRows(rows) {
 function rowConditionMessage(policy, keys) {
 	return `${policy.table} policy '${policy.name}' calls the SQL helpers with ${keys.join(", ")}, whose grants carry row conditions the helpers do not check: the policy grants more than the application does`;
 }
-const ROW_CONDITION_FIX = "use permissions whose catalog entry has rowConditions: false for storage and realtime policies, or write the condition into the policy yourself";
+const ROW_CONDITION_FIX = "call permitted_<scope>_ids_by_permission('<key>') or permdock_has_permission('<key>'), which count only the allows without a row condition (a relationship grant never reaches a topic or a folder), or use a permission whose catalog entry has rowConditions: false";
 //#endregion
 //#region src/cli/rls-graph.ts
 function qualified(ctx, name) {
@@ -99,15 +109,35 @@ function graphPlan(policy) {
 		for (const name of expandRelation(node, relation)) {
 			const spec = node.relations[name];
 			if (!isEdgeRelation(spec) || spec.groups === void 0) continue;
-			for (const [resource, groupRelation] of Object.entries(spec.groups.resources)) {
+			for (const { resource, relation: groupRelation } of groupEntries(spec)) {
 				const target = policy.resources.get(resource);
 				if (target !== void 0 && target.name !== node.name) addRelation(target, groupRelation);
 			}
 		}
 	};
+	const addLinks = (hops) => {
+		for (let index = 1; index < hops.length; index += 1) {
+			const from = policy.resources.get(hops[index - 1]?.resource ?? "");
+			const hop = hops[index];
+			if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
+		}
+	};
+	const addAbove = (above) => {
+		const node = above === void 0 ? void 0 : policy.resources.get(above.resource);
+		if (above === void 0 || node === void 0) return;
+		const entry = entryFor(node);
+		entry.closure = Math.max(entry.closure ?? 0, above.depth);
+		entry.restrictedAncestors = above;
+	};
 	for (const grant of policy.grants) {
 		const row = policy.resources.get(grant.permission.resource);
 		for (const item of flattenGrantee(grant.to)) {
+			if (item.kind === "inherit") {
+				const inherited = inheritCondition(item, row, policy.resources);
+				addLinks(inherited?.hops ?? []);
+				addAbove(inherited?.restrictedAncestors);
+				continue;
+			}
 			if (item.kind !== "relation") continue;
 			const condition = relationCondition(item, row, scopes, { resources: policy.resources });
 			if (condition?.op !== "related") continue;
@@ -116,12 +146,8 @@ function graphPlan(policy) {
 			addRelation(node, condition.relation);
 			const entry = entryFor(node);
 			if (condition.depth > 0 && isSelfParented(node)) entry.closure = Math.max(entry.closure ?? 0, condition.depth);
-			const hops = condition.hops ?? [];
-			for (let index = 1; index < hops.length; index += 1) {
-				const from = policy.resources.get(hops[index - 1]?.resource ?? "");
-				const hop = hops[index];
-				if (from !== void 0 && hop !== void 0) entryFor(from).links.add(hop.link);
-			}
+			addLinks(condition.hops ?? []);
+			addAbove(condition.restrictedAncestors);
 		}
 	}
 	return plan;
@@ -210,20 +236,22 @@ function closureObjectsSql(ctx, entry, depth, tables) {
 	const parent = node.parent;
 	if (parent === void 0) return "";
 	const name = node.name;
+	const sqlName = graphSqlName(name) ?? name;
 	const closure = qualified(ctx, CLOSURE.table);
 	const table = tableSql(tableFor(name, tables));
 	const id = quoteIdent(node.id);
 	const up = quoteIdent(parent.field);
-	const stop = node.restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(node.restricted)}, false)`;
-	const stopParent = node.restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(node.restricted)}, false)`;
-	const refresh = qualified(ctx, `${CLOSURE.table}_${name}`);
-	const changed = qualified(ctx, `${CLOSURE.table}_${name}_changed`);
+	const restricted = restrictedFor(node, "parent");
+	const stop = restricted === void 0 ? "false" : `coalesce(t.${quoteIdent(restricted)}, false)`;
+	const stopParent = restricted === void 0 ? "false" : `coalesce(p.${quoteIdent(restricted)}, false)`;
+	const refresh = qualified(ctx, `${CLOSURE.table}_${sqlName}`);
+	const changed = qualified(ctx, `${CLOSURE.table}_${sqlName}_changed`);
 	const literal = quoteLiteral(name);
-	const restrictedChanged = node.restricted === void 0 ? "" : ` or n.${quoteIdent(node.restricted)} is distinct from o.${quoteIdent(node.restricted)}`;
-	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${name}_${suffix}`);
-	return `-- ${name}: rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row
-drop policy if exists ${quoteIdent(`${CLOSURE.table}_${name}`)} on ${closure};
-create policy ${quoteIdent(`${CLOSURE.table}_${name}`)} on ${closure}
+	const restrictedChanged = restricted === void 0 ? "" : ` or n.${quoteIdent(restricted)} is distinct from o.${quoteIdent(restricted)}`;
+	const trigger = (suffix) => quoteIdent(`${CLOSURE.table}_${sqlName}_${suffix}`);
+	return `-- ${name}: ${restricted === void 0 ? `rows reach their ancestors up to depth ${String(depth)}` : `rows reach their ancestors up to depth ${String(depth)}, stopping at a restricted row`}
+drop policy if exists ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure};
+create policy ${quoteIdent(`${CLOSURE.table}_${sqlName}`)} on ${closure}
   for select to authenticated
   using (resource = ${literal} and ancestor in (select ${qualified(ctx, graphHelper(name))}(null)));
 create or replace function ${refresh}(p_ids text[])
@@ -326,12 +354,36 @@ create trigger ${trigger("truncate")} after truncate on ${table}
   for each statement execute function ${changed}();
 select ${refresh}(array(select t.${id}::text from ${table} t));`;
 }
+function restrictedRowsHelperSql(ctx, plan, entry, tables) {
+	const above = entry.restrictedAncestors;
+	if (above === void 0) return "";
+	const fn = qualified(ctx, restrictedHelper(entry.node.name));
+	const body = graphSqlText(restrictedRowsSql(above, {
+		resources: new Map([...plan].map(([name, item]) => [name, item.node])),
+		...tables === void 0 ? {} : { tables },
+		qualify: qualifiedTable,
+		closure: `${ctx.schema ?? "permdock"}.${CLOSURE.table}`,
+		closureDepths: closureDepths(plan)
+	}), ctx);
+	return `-- ${entry.node.name}: rows a stopped link does not reach below: restricted, under a restricted row within ${String(above.depth - 1)} levels, or deeper
+create or replace function ${fn}()
+returns setof text
+language sql
+stable
+security definer
+set search_path = ''
+as $$
+  ${body}
+$$;
+revoke execute on function ${fn}() from public, anon;
+grant execute on function ${fn}() to authenticated;`;
+}
 /** Group resources a resource's asked relations name, other than itself. */
 function groupTargets(entry) {
 	const out = /* @__PURE__ */ new Set();
 	for (const asked of entry.relations) for (const name of expandRelation(entry.node, asked)) {
 		const spec = entry.node.relations[name];
-		const resources = isEdgeRelation(spec) ? Object.keys(spec.groups?.resources ?? {}) : [];
+		const resources = isEdgeRelation(spec) ? groupEntries(spec).map((group) => group.resource) : [];
 		for (const resource of resources) if (resource !== entry.node.name) out.add(resource);
 	}
 	return [...out].toSorted();
@@ -357,13 +409,25 @@ function dependencyOrder(plan) {
 */
 function graphSql(ctx, plan, tables) {
 	if (plan.size === 0) return "";
-	for (const name of plan.keys()) if (ctx.scopes.some((scope) => scope.name === name)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its name with the ${name} scope, so ${graphHelper(name)} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+	const sqlNames = /* @__PURE__ */ new Map();
+	for (const name of plan.keys()) {
+		const helper = graphHelper(name);
+		const sql = graphSqlName(name) ?? name;
+		if (ctx.scopes.some((scope) => scope.name === sql)) throw new Error(`PermDock CLI: resource '${name}' has graph relations and shares its SQL name with the ${sql} scope, so ${helper} would replace the scope helper; rename the resource (permdock doctor PD032)`);
+		const other = sqlNames.get(sql);
+		if (other !== void 0) throw new Error(`PermDock CLI: resources '${other}' and '${name}' both name the SQL helper ${helper}; rename one (permdock doctor PD032)`);
+		sqlNames.set(sql, name);
+	}
 	const entries = dependencyOrder(plan);
-	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
+	const chunks = entries.flatMap((entry) => [...entry.relations.size === 0 && entry.closure === void 0 ? [] : [permittedSql(ctx, plan, entry, tables)], ...[...entry.links].toSorted().map((link) => linkSql(ctx, entry.node, link, tables))]);
 	const walked = entries.filter((entry) => entry.closure !== void 0);
 	if (walked.length > 0) {
 		chunks.push(closureTableSql(ctx));
 		for (const entry of walked) chunks.push(closureObjectsSql(ctx, entry, entry.closure ?? 0, tables));
+		for (const entry of walked) {
+			const helper = restrictedRowsHelperSql(ctx, plan, entry, tables);
+			if (helper !== "") chunks.push(helper);
+		}
 	}
 	return `${chunks.join("\n\n")}\n`;
 }

package/dist/{rls-import-CXV6LBlS.js → rls-import-BTFVk3jH.js}

@@ -1,7 +1,7 @@
-import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-Bll1d7y0.js";
-import { a as usageResult } from "./errors-DSMnAVNa.js";
-import { N as parseMembershipsFlag, t as HELPERS } from "./rls-helpers-BxRuif0l.js";
-import { r as FIELD_VIEWS, t as connectPg } from "./pg-4GJWDUxG.js";
+import { o as usageResult } from "./errors-CWfoNg9N.js";
+import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
+import { V as parseMembershipsFlag, r as HELPERS } from "./rls-shared-Cewd_-zI.js";
+import { t as FIELD_VIEWS, w as connectPg } from "./rls-fields-74oZPXWL.js";
 import { n as emptySchema, r as isSchemaKind, t as emitPermissionsModule } from "./generate-CH7ThJ14.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, resolve } from "node:path";
@@ -49,7 +49,7 @@ function isAuthUid(value) {
 	const inner = scalarSubselect(value);
 	if (inner !== void 0) return isAuthUid(inner);
 	const name = funcName(value);
-	return name === "auth.uid" || name === "auth.user_id" || name === "uid" || name === "user_id";
+	return name === "auth.uid" || name === "auth.user_id" || name === "uid" || name === "user_id" || name?.split(".").at(-1) === "permdock_user_id";
 }
 function isCurrentSettingUserId(value) {
 	const inner = scalarSubselect(value);
@@ -326,7 +326,7 @@ async function helperGrants(sql, memberships, functions, seeds) {
 			conditions: rest
 		};
 		for (const call of calls) {
-			const permission = seeds.find((seed) => seed.grantKey === call.key)?.permission ?? call.key.replace(/#\d+$/u, "");
+			const permission = seeds.find((seed) => seed.grantKey === call.key)?.permission ?? call.key.replace(/#[a-z0-9][a-z0-9_-]*$/u, "");
 			grants.push({
 				key: call.key,
 				permission,
@@ -404,6 +404,7 @@ function mapNode(value, ctx) {
 	};
 	const helper = helperCall(node);
 	if (helper !== void 0) return helperCondition(helper, ctx.seeds);
+	if (funcName(scalarSubselect(node) ?? node)?.split(".").at(-1) === "permdock_session_live") return { op: "liveSession" };
 	const nullTest = asNode$1(node["NullTest"]);
 	if (nullTest !== void 0) {
 		const field = columnName(nullTest["arg"]);

package/dist/{rls-migrate-DrFPbf8p.js → rls-migrate-CN4TlJTO.js}

@@ -1,7 +1,8 @@
-import { i as sqlFiles } from "./files-B_wAGYmt.js";
-import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-Bll1d7y0.js";
-import "./sources-DVHM3Mwq.js";
-import { t as HELPERS } from "./rls-helpers-BxRuif0l.js";
+import { i as describeError } from "./errors-CWfoNg9N.js";
+import { a as sqlFiles } from "./files-DWUN9PzI.js";
+import { i as quoteSqlLiteral, n as escapeSqlIdent } from "./sql-xdg5f4Fi.js";
+import "./sources-4p0-4xQm.js";
+import { r as HELPERS } from "./rls-shared-Cewd_-zI.js";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import { relative, resolve } from "node:path";
 import { parse } from "pgsql-parser";
@@ -241,7 +242,7 @@ async function migrateSql(file, text, config, target) {
 			line: 1,
 			call: "",
 			reason: "unparsed",
-			detail: `the file does not parse: ${cause instanceof Error ? cause.message : String(cause)}`
+			detail: `the file does not parse: ${describeError(cause)}`
 		});
 		return {
 			rewrites,