permdock 0.3.1 → 0.4.0

package/dist/solid/index.js

@@ -1,14 +1,15 @@
-import { t as compact } from "../compact-y6vfu2_f.js";
-import { r as requiredPlans } from "../problem-details-_AMOYz-w.js";
-import { t as describe } from "../describe-B_gVZEVi.js";
+import { t as compact } from "../compact-CAf557ZB.js";
+import { r as requiredPlans } from "../problem-details-DECUnXAn.js";
+import { t as describe } from "../describe-Cgkp7eP0.js";
 import { t as approvalHeaders } from "../headers-BZSDieNT.js";
-import { i as isPromiseLike } from "../store-options-ByhZq1jV.js";
-import { a as protectedView, c as subjectView, i as permissionSet, l as tenantView, n as filterResult, o as rolesView, r as livePermDock, s as scopedTenant, t as approvalHandle } from "../views-Soe7bGSC.js";
+import { i as isPromiseLike } from "../store-options-CbUHDoSe.js";
+import { a as permissionSet, c as scopedTenant, d as tenantView, i as livePermDock, l as slotContent, n as describeWith, o as protectedView, r as filterResult, s as rolesView, t as approvalHandle, u as subjectView } from "../views-CJsrBS1f.js";
 import { n as boundaryFallback, t as boundaryDigest } from "../boundary-BM8a_P6E.js";
-import { n as switchTenant, t as providerStore } from "../provider-store-Cfbvo4DE.js";
+import { n as switchTenant, t as providerStore } from "../provider-store-Ctt-81Ni.js";
 import { ErrorBoundary, createComponent, createComputed, createContext, createMemo, createSignal, getOwner, on, onCleanup, useContext } from "solid-js";
 //#region src/solid/context.ts
 const PermDockContext = createContext(void 0);
+const PermDockUiContext = createContext({});
 function useStore() {
 	const store = useContext(PermDockContext);
 	if (store === void 0) throw new Error("PermDock: hooks require <PermDockProvider>.");
@@ -85,6 +86,11 @@ function useApproval(decision) {
 		return approvalHandle(store, decision());
 	});
 }
+/** `describe` with the provider's `messages`; a call's own `messages` win. */
+function useDescribe() {
+	const ui = useContext(PermDockUiContext);
+	return (decision, options) => describeWith(ui.messages)(decision, options);
+}
 //#endregion
 //#region src/solid/boundary.ts
 const BoundaryContext = createContext(null);
@@ -124,20 +130,25 @@ function usePermissionBoundary() {
 //#region src/solid/protected.ts
 function Protected(props) {
 	const root = usePermDock();
+	const ui = useContext(PermDockUiContext);
 	const local = usePermission(() => props.permission, () => props.data);
 	const scoped = createMemo(() => scopedTenant(root, props.tenant));
 	const view = createMemo(() => protectedView(local(), root, props.permission, props.data, scoped()));
 	const render = () => {
 		const current = view();
 		switch (current.slot) {
-			case "pending": return props.pending ?? null;
-			case "fallback": return typeof props.fallback === "function" ? props.fallback(current.decision) : props.fallback ?? null;
+			case "pending": return slotContent("pending", props, ui.defaults) ?? null;
+			case "fallback": return content(slotContent("fallback", props, ui.defaults), current.decision);
+			case "approval": return content(slotContent("approval", props, ui.defaults), current.decision);
 			case "default": return typeof props.children === "function" ? props.children(current.decision) : props.children;
 			default: return current;
 		}
 	};
 	return render;
 }
+function content(slot, decision) {
+	return typeof slot === "function" ? slot(decision) : slot ?? null;
+}
 //#endregion
 //#region src/solid/provider.ts
 function PermDockProvider(props) {
@@ -150,7 +161,10 @@ function PermDockProvider(props) {
 		snapshotUrl: props.snapshotUrl,
 		approvals: props.approvals,
 		tenant: props.tenant,
-		maxAge: props.maxAge
+		maxAge: props.maxAge,
+		onSnapshot: props.onSnapshot,
+		onClear: props.onClear,
+		approvalInterval: props.approvalInterval
 	}), () => ({
 		headers: props.headers,
 		fetch: props.fetch,
@@ -177,12 +191,28 @@ function PermDockProvider(props) {
 			arrive = void 0;
 		}, { defer: initial !== void 0 }));
 	}
+	const ui = {
+		get defaults() {
+			return props.defaults;
+		},
+		get messages() {
+			return props.messages;
+		}
+	};
 	return createComponent(PermDockContext.Provider, {
 		value: store,
+		get children() {
+			return uiProvider(ui, props);
+		}
+	});
+}
+function uiProvider(ui, props) {
+	return createComponent(PermDockUiContext.Provider, {
+		value: ui,
 		get children() {
 			return props.children;
 		}
 	});
 }
 //#endregion
-export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };
+export { PermDockProvider, PermissionBoundary, Protected, approvalHeaders, describe, requiredPlans, useApproval, useAssignablePermissions, useAssignableRoles, useDescribe, useFilter, useMemberships, usePermDock, usePermission, usePermissionBoundary, usePermissions, useRoles, useSubject, useTenant };

package/dist/{sources-4p0-4xQm.js → sources-B1-b-R0t.js}

@@ -1,5 +1,6 @@
-import { t as compact } from "./compact-y6vfu2_f.js";
-import { a as quoteSqlTable, i as quoteSqlLiteral, r as quoteSqlIdent } from "./sql-xdg5f4Fi.js";
+import { r as isRecord, t as compact } from "./compact-CAf557ZB.js";
+import { i as readAppData } from "./app-data-CV8pqqMi.js";
+import { a as quoteSqlIdent, i as quoteQualifiedTable, l as sqlTextArray, o as quoteSqlLiteral, r as qualifySqlTable, s as quoteSqlTable } from "./sql-t8teWOfo.js";
 //#region src/supabase/keep.ts
 /** The permission keys of a suspended scope's `keep`, references read by `key`, sorted and unique. */
 function keptKeys(row) {
@@ -106,12 +107,6 @@ function roleManifest(role) {
 //#region src/supabase/sources.ts
 const ident = (name) => quoteSqlIdent(name);
 const literal = quoteSqlLiteral;
-function qualifiedName(name) {
-	return name.includes(".") ? name : `public.${name}`;
-}
-function qualified(name) {
-	return quoteSqlTable(qualifiedName(name));
-}
 function col(name) {
 	return `m.${ident(name)}`;
 }
@@ -124,10 +119,7 @@ function activeRow(row, id) {
 		parts.push(`s.${ident(row.status)}::text = any(array[${values.map(literal).join(", ")}]::text[])`);
 	}
 	if (row.disabledAt === void 0 && row.status === void 0) throw new TypeError("PermDock: a suspension table needs disabledAt or status");
-	return `exists (select 1 from ${qualified(row.table)} s where ${parts.join(" and ")})`;
-}
-function textArray(values) {
-	return `array[${values.map(literal).join(", ")}]::text[]`;
+	return `exists (select 1 from ${quoteQualifiedTable(row.table)} s where ${parts.join(" and ")})`;
 }
 /**
 * The suspendable instances on the row's chain whose scope keeps
@@ -163,8 +155,8 @@ function keptSql(shape) {
 	const list = keeping(shape);
 	if (list.length === 0) return;
 	const keys = [...new Set(list.flatMap((item) => item.keep))].toSorted();
-	const each = list.map((item) => `(${item.active} or k = any(${textArray(item.keep)}))`).join(" and ");
-	return `(select jsonb_agg(k order by k) from unnest(${textArray(keys)}) k where ${each})`;
+	const each = list.map((item) => `(${item.active} or k = any(${sqlTextArray(item.keep)}))`).join(" and ");
+	return `(select jsonb_agg(k order by k) from unnest(${sqlTextArray(keys)}) k where ${each})`;
 }
 function allActive(shape) {
 	return keeping(shape).map((item) => item.active).join(" and ");
@@ -204,6 +196,7 @@ function selectOf(shape, where, user, keep) {
 		`${shape.memberGroup} as member_group`,
 		`${shape.managed} as managed_by`,
 		`${shape.seats} as seats`,
+		...shape.x === void 0 ? [] : [`${col(shape.x)} as x`],
 		...keep ? [`${keepColumn(shape)} as keep`] : []
 	];
 	const group = [
@@ -212,14 +205,14 @@ function selectOf(shape, where, user, keep) {
 		...keepsDisabled(shape) && shape.disabledAt !== void 0 ? [`(${enabled(shape.disabledAt)})`] : []
 	];
 	return `select ${fields.join(", ")}
-from ${qualified(shape.table)} m${shape.join}
+from ${quoteQualifiedTable(shape.table)} m${shape.join}
 where ${where.join("\n  and ")}
 group by ${group.join(", ")}`;
 }
 function holdersOf(shape) {
 	const id = ident(shape.idColumn);
 	return {
-		idType: `${qualified(shape.table)}.${id}%type`,
+		idType: `${quoteQualifiedTable(shape.table)}.${id}%type`,
 		id: (scope, row) => {
 			const filter = shape.holds(scope, row);
 			return filter === void 0 ? "null::text" : filter === "true" ? `${row}.${id}::text` : `case when ${filter} then ${row}.${id}::text end`;
@@ -231,7 +224,7 @@ function holdersOf(shape) {
 			const live = conditions.length === 0 ? "true" : conditions.length === 1 ? conditions.join("") : `(${conditions.join(" and ")})`;
 			const kept = where.filter((part) => part !== "true");
 			return `select m.${id}::text as id, ${shape.userSql}::text as user_id, ${shape.roleKey} as role, ${shape.via} as via, ${live} as live
-from ${options.from ?? qualified(shape.table)} m${shape.join}${shape.roleJoin}${kept.length === 0 ? "" : `\nwhere ${kept.join(" and ")}`}`;
+from ${options.from ?? quoteQualifiedTable(shape.table)} m${shape.join}${shape.roleJoin}${kept.length === 0 ? "" : `\nwhere ${kept.join(" and ")}`}`;
 		}
 	};
 }
@@ -242,14 +235,14 @@ function sqlOf(shape) {
 		table: shape.table,
 		user: shape.user,
 		userThrough: shape.userThrough,
-		userType: shape.userThrough === void 0 ? `${qualified(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
+		userType: shape.userThrough === void 0 ? `${quoteQualifiedTable(shape.table)}.${ident(shape.user)}%type` : `${quoteSqlTable(shape.userThrough.table)}.${ident(shape.userThrough.key)}%type`,
 		reads: [...new Set([suspension?.users, ...Object.values(suspension?.scopes ?? {})].flatMap((row) => row === void 0 ? [] : [row.table]))],
 		managed: shape.managedColumn,
 		through: shape.through,
 		throughs: shape.throughs,
 		columns: [...new Set(shape.columns)],
 		manifest: {
-			table: qualifiedName(shape.table),
+			table: qualifySqlTable(shape.table),
 			...shape.manifest,
 			columns: [...new Set(shape.columns)]
 		},
@@ -263,14 +256,14 @@ function isFixed(roles) {
 }
 /** A role column of the membership table, aliased `m`; a `through` column joins its roles table as `mk`. */
 function memberRole(role, table, label) {
-	return roleColumn(role, qualifiedName(table), "m", {
+	return roleColumn(role, qualifySqlTable(table), "m", {
 		label,
 		indent: ""
 	});
 }
 /** The user of the membership table, aliased `m`; a `through` user joins its table as `mu`. */
 function memberUser(user, table, label) {
-	const column = roleColumn(user, qualifiedName(table), "m", {
+	const column = roleColumn(user, qualifySqlTable(table), "m", {
 		label,
 		indent: "",
 		joined: "mu",
@@ -294,7 +287,8 @@ function membershipOf(row) {
 	const roles = strings(row["roles"]);
 	if (typeof row["scope"] !== "string" || typeof row["id"] !== "string") return;
 	if (roles.length === 0) return;
-	const within = row["within"] !== null && typeof row["within"] === "object" && !Array.isArray(row["within"]) ? Object.fromEntries(Object.entries(row["within"]).filter((entry) => typeof entry[1] === "string")) : void 0;
+	const rawWithin = row["within"];
+	const within = isRecord(rawWithin) ? Object.fromEntries(Object.entries(rawWithin).filter((entry) => typeof entry[1] === "string")) : void 0;
 	const expires = typeof row["expires_at"] === "number" ? row["expires_at"] : typeof row["expires_at"] === "string" && row["expires_at"] !== "" ? Number(row["expires_at"]) : void 0;
 	const seats = strings(row["seats"]);
 	const keep = row["keep"];
@@ -311,7 +305,8 @@ function membershipOf(row) {
 		member: typeof row["member_group"] === "string" && row["member_group"] !== "" ? { group: row["member_group"] } : void 0,
 		managedBy: row["managed_by"] === "idp" ? "idp" : void 0,
 		entitlements: seats.length === 0 ? void 0 : seats,
-		keep: keep === null || keep === void 0 ? void 0 : strings(keep)
+		keep: keep === null || keep === void 0 ? void 0 : strings(keep),
+		x: row["x"] === null ? void 0 : readAppData(void 0, row["x"])
 	});
 }
 function sourceOf(sql, query) {
@@ -382,6 +377,7 @@ function fromTable(options) {
 		managed: optional(c.managedBy, "text"),
 		managedColumn: c.managedBy,
 		seats: c.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(c.seats)})`,
+		x: c.x,
 		idOf: (name) => `coalesce(case when ${scope} = ${literal(name)} then ${id} end${c.within === void 0 ? "" : `, ${within} ->> ${literal(name)}`})`,
 		idColumn: c.id ?? "scope_id",
 		holds: (name, alias) => `${alias}.${ident(c.scope ?? "scope")}::text = ${literal(name)}`,
@@ -398,7 +394,8 @@ function fromTable(options) {
 				c.reason,
 				c.group,
 				c.managedBy,
-				c.seats
+				c.seats,
+				c.x
 			].filter((name) => name !== void 0).map(col)
 		],
 		suspension: options.suspension,
@@ -463,6 +460,7 @@ function fromJunction(options) {
 		managed: managedColumn === void 0 ? "null::text" : managedColumn === "" ? `'idp'::text` : `${col(managedColumn)}::text`,
 		managedColumn,
 		seats: options.seats === void 0 ? "null::jsonb" : `to_jsonb(${col(options.seats)})`,
+		x: options.x,
 		idColumn,
 		holds: (name) => name === options.scope ? "true" : void 0,
 		roleKey: role === void 0 ? "mf.role" : role.sql,
@@ -481,7 +479,8 @@ function fromJunction(options) {
 				options.reason,
 				groupColumn,
 				managedColumn === "" ? void 0 : managedColumn,
-				options.seats
+				options.seats,
+				options.x
 			].filter((name) => name !== void 0).map(col)
 		],
 		suspension: options.suspension,
@@ -534,7 +533,7 @@ function hookApiNames(prefix = HOOK_API_PREFIX) {
 * `<schema>.permdock_authz_version`: pass it to `claimsFirst(sources, { version })`.
 */
 function authzVersion(options) {
-	const table = qualified(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
+	const table = quoteQualifiedTable(`${options.schema ?? "permdock"}.${AUTHZ_VERSION_TABLE}`);
 	return async (principal) => {
 		const value = rowsOf(await options.query(`select version from ${table} where user_id = $1`, [principal.id]))[0]?.["version"];
 		const version = typeof value === "number" ? value : value === void 0 ? 0 : Number(value);

package/dist/{sources-BdOYLw9j.d.ts → sources-Dljy06zL.d.ts}

@@ -1,5 +1,5 @@
-import { gt as MembershipSource } from "./policy-IB6yxpC3.js";
-import { n as RoleThrough, y as SupabaseSuspension } from "./types-C97IskBw.js";
+import { Z as MembershipSource } from "./policy-types-sp9P1iIV.js";
+import { n as RoleThrough, y as SupabaseSuspension } from "./types-CqrjB9o6.js";
 import { o as SupabaseManifestMembership } from "./manifest-uDS9y5de.js";
 //#region src/supabase/roles.d.ts
 /** A roles table a role column references, by `schema.table`. */
@@ -55,6 +55,8 @@ type MembershipTableOptions = Common & {
     readonly managedBy?: string;
     /** A `text[]` column of seats. */
     readonly seats?: string;
+    /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
+    readonly x?: string;
   };
 };
 type MembershipJunctionOptions = Common & {
@@ -92,6 +94,8 @@ type MembershipJunctionOptions = Common & {
   };
   /** A `text[]` column of seats. */
   readonly seats?: string;
+  /** A `jsonb` column of app data (`Membership.x`); never written into claims. */
+  readonly x?: string;
 };
 /** What `permdock supabase hook generate` compiles; the same SQL the source runs. */
 type MembershipSql = {

package/dist/{sql-xdg5f4Fi.js → sql-t8teWOfo.js}

@@ -3,8 +3,7 @@
 const SQL_IDENT = /^[A-Za-z_][A-Za-z0-9_]*$/u;
 /** A validated, double-quoted identifier; anything outside `SQL_IDENT` throws. */
 function quoteSqlIdent(name, prefix = "PermDock") {
-	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
-	return `"${name}"`;
+	return `"${assertSqlIdent(name, prefix)}"`;
 }
 /** A schema-qualified name, each part validated by `quoteSqlIdent`. */
 function quoteSqlTable(name, prefix = "PermDock") {
@@ -23,5 +22,22 @@ const PLAIN_IDENT = /^[a-z_][a-z0-9_]*$/u;
 function sqlIdent(name) {
 	return PLAIN_IDENT.test(name) ? name : escapeSqlIdent(name);
 }
+/** The plain-identifier check behind `quoteSqlIdent`, returning the name unquoted. */
+function assertSqlIdent(name, prefix = "PermDock") {
+	if (!SQL_IDENT.test(name)) throw new TypeError(`${prefix}: unsafe SQL identifier '${name}'`);
+	return name;
+}
+/** `name` with `public.` added when it names no schema; generated functions run with `search_path = ''`. */
+function qualifySqlTable(name) {
+	return name.includes(".") ? name : `public.${name}`;
+}
+/** `qualifySqlTable`, then each part quoted by `quoteSqlIdent`. */
+function quoteQualifiedTable(name, prefix = "PermDock") {
+	return quoteSqlTable(qualifySqlTable(name), prefix);
+}
+/** A `text[]` literal of `values`, each quoted by `quoteSqlLiteral`. */
+function sqlTextArray(values) {
+	return values.length === 0 ? `'{}'::text[]` : `array[${values.map(quoteSqlLiteral).join(", ")}]::text[]`;
+}
 //#endregion
-export { quoteSqlTable as a, quoteSqlLiteral as i, escapeSqlIdent as n, sqlIdent as o, quoteSqlIdent as r, SQL_IDENT as t };
+export { quoteSqlIdent as a, sqlIdent as c, quoteQualifiedTable as i, sqlTextArray as l, escapeSqlIdent as n, quoteSqlLiteral as o, qualifySqlTable as r, quoteSqlTable as s, SQL_IDENT as t };