permdock 0.3.1 → 0.5.0

package/dist/retire-CALjIQ7e.js

@@ -0,0 +1,240 @@
+import { r as escapeSqlIdent } from "./sql-B5T1IL83.js";
+import { a as RETIRE_MARKER } from "./markers-C6joDI3o.js";
+import { r as tableKey } from "./deciding-columns-Sq12mEA6.js";
+//#region src/cli/rls/retire.ts
+const IDENT = String.raw`(?:"[^"]+"|[A-Za-z_][\w$]*)`;
+const NAME = String.raw`(${IDENT}(?:\s*\.\s*${IDENT})?)`;
+const NAMES = String.raw`(${IDENT}(?:\s*\.\s*${IDENT})?(?:\s*,\s*${IDENT}(?:\s*\.\s*${IDENT})?)*)`;
+const CREATE_TABLE = new RegExp(String.raw`^create\s+(?:(?:global\s+|local\s+)?(?:temporary|temp|unlogged)\s+)?table\s+(?:if\s+not\s+exists\s+)?${NAME}`, "iu");
+const CREATE_MATVIEW = new RegExp(String.raw`^create\s+materialized\s+view\s+(?:if\s+not\s+exists\s+)?${NAME}`, "iu");
+const DROP_RELATION = new RegExp(String.raw`^drop\s+(table|materialized\s+view|view)\s+(?:if\s+exists\s+)?${NAMES}`, "iu");
+const CREATE_VIEW = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?(?:temp(?:orary)?\s+)?(?:recursive\s+)?view\s+${NAME}`, "iu");
+const CREATE_FUNCTION = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?(?:function|procedure)\s+${NAME}\s*\(`, "iu");
+const DROP_FUNCTION = new RegExp(String.raw`^drop\s+(?:function|procedure)\s+(?:if\s+exists\s+)?([\s\S]*)$`, "iu");
+const CREATE_TRIGGER = new RegExp(String.raw`^create\s+(?:or\s+replace\s+)?(?:constraint\s+)?trigger\s+(${IDENT})[\s\S]*?\bon\s+${NAME}[\s\S]*?\bexecute\s+(?:function|procedure)\s+${NAME}\s*\(`, "iu");
+const DROP_TRIGGER = new RegExp(String.raw`^drop\s+trigger\s+(?:if\s+exists\s+)?(${IDENT})\s+on\s+${NAME}`, "iu");
+const POLICY = new RegExp(String.raw`^(create|alter)\s+policy\s+(${IDENT})\s+on\s+${NAME}`, "iu");
+const DROP_POLICY = new RegExp(String.raw`^drop\s+policy\s+(?:if\s+exists\s+)?(${IDENT})\s+on\s+${NAME}`, "iu");
+/** A capture group the pattern always fills. */
+function group(match, index) {
+	return match[index] ?? "";
+}
+function bare(ident) {
+	return ident.replaceAll("\"", "");
+}
+function key(name) {
+	return tableKey(name.replaceAll(/\s+/gu, ""));
+}
+function escapeRegex(text) {
+	return text.replaceAll(/[.*+?^${}()|[\]\\]/gu, String.raw`\$&`);
+}
+/** A reference to `schema.name`, qualified or not, outside a longer identifier. */
+function refPattern(table) {
+	const [schema = "public", name = ""] = table.split(".");
+	return String.raw`(?<![\w$."])(?:"?${escapeRegex(schema)}"?\s*\.\s*)?"?${escapeRegex(name)}"?(?![\w$"])`;
+}
+function writesPattern(table) {
+	return new RegExp(String.raw`\b(?:insert\s+into|update|delete\s+from|truncate(?:\s+table)?|merge\s+into|refresh\s+materialized\s+view(?:\s+concurrently)?)\s+(?:only\s+)?${refPattern(table)}`, "iu");
+}
+function callsPattern(name) {
+	const [schema = "public", bareName = ""] = name.split(".");
+	return new RegExp(String.raw`(?<![\w$."])(?:"?${escapeRegex(schema)}"?\s*\.\s*)?"?${escapeRegex(bareName)}"?\s*\(`, "iu");
+}
+/** The names `drop function` lists: `a(int), b` gives `a` and `b`. */
+function droppedFunctions(list) {
+	const names = [];
+	let depth = 0;
+	let current = "";
+	for (const char of list) if (char === "(") depth += 1;
+	else if (char === ")") depth -= 1;
+	else if (depth === 0 && char === ",") {
+		names.push(current);
+		current = "";
+	} else if (depth === 0) current += char;
+	names.push(current);
+	return names.map((name) => name.replace(/\s+(?:cascade|restrict)\s*$/iu, "").trim()).filter((name) => name !== "").map(key);
+}
+function replay(statements) {
+	const schema = {
+		relations: /* @__PURE__ */ new Map(),
+		views: /* @__PURE__ */ new Map(),
+		functions: /* @__PURE__ */ new Map(),
+		triggers: /* @__PURE__ */ new Map(),
+		policies: /* @__PURE__ */ new Map()
+	};
+	for (const statement of statements) {
+		const { text } = statement;
+		const defined = {
+			file: statement.file,
+			line: statement.line,
+			text
+		};
+		let match = CREATE_TABLE.exec(text);
+		if (match !== null) {
+			schema.relations.set(key(group(match, 1)), "table");
+			continue;
+		}
+		match = CREATE_MATVIEW.exec(text);
+		if (match !== null) {
+			const name = key(group(match, 1));
+			schema.relations.set(name, "materialized view");
+			schema.views.set(name, defined);
+			continue;
+		}
+		match = DROP_RELATION.exec(text);
+		if (match !== null) {
+			for (const name of group(match, 2).split(",").map(key)) {
+				schema.relations.delete(name);
+				schema.views.delete(name);
+			}
+			continue;
+		}
+		match = CREATE_VIEW.exec(text);
+		if (match !== null) {
+			schema.views.set(key(group(match, 1)), defined);
+			continue;
+		}
+		match = CREATE_FUNCTION.exec(text);
+		if (match !== null) {
+			schema.functions.set(key(group(match, 1)), defined);
+			continue;
+		}
+		match = DROP_FUNCTION.exec(text);
+		if (match !== null) {
+			for (const name of droppedFunctions(group(match, 1))) schema.functions.delete(name);
+			continue;
+		}
+		match = CREATE_TRIGGER.exec(text);
+		if (match !== null) {
+			const name = bare(group(match, 1));
+			const table = key(group(match, 2));
+			schema.triggers.set(`${table}:${name}`, {
+				name,
+				table,
+				function: key(group(match, 3))
+			});
+			continue;
+		}
+		match = DROP_TRIGGER.exec(text);
+		if (match !== null) {
+			schema.triggers.delete(`${key(group(match, 2))}:${bare(group(match, 1))}`);
+			continue;
+		}
+		match = POLICY.exec(text);
+		if (match !== null) {
+			const name = bare(group(match, 2));
+			const table = key(group(match, 3));
+			const id = `${table}:${name}`;
+			const expressions = text.slice(match[0].length);
+			if (group(match, 1).toLowerCase() === "create" || /\b(?:using|with\s+check)\b/iu.test(expressions)) schema.policies.set(id, {
+				...defined,
+				text: expressions,
+				table,
+				name
+			});
+			continue;
+		}
+		match = DROP_POLICY.exec(text);
+		if (match !== null) schema.policies.delete(`${key(group(match, 2))}:${bare(group(match, 1))}`);
+	}
+	return schema;
+}
+/** Functions that write `table`, the configured `refresh` ones, and every function that calls one. */
+function refreshFunctions(schema, table, configured) {
+	const writes = writesPattern(table);
+	const found = new Set(configured.map(key));
+	for (const [name, defined] of schema.functions) if (writes.test(defined.text)) found.add(name);
+	let grew = true;
+	while (grew) {
+		grew = false;
+		const calls = [...found].map(callsPattern);
+		for (const [name, defined] of schema.functions) if (!found.has(name) && calls.some((call) => call.test(defined.text))) {
+			found.add(name);
+			grew = true;
+		}
+	}
+	return found;
+}
+/** Calls of a legacy helper outside its own definition, grants and drops (PD056). */
+function legacyHelperCalls(statements, name) {
+	const own = new RegExp(String.raw`^\s*(?:create\s+(?:or\s+replace\s+)?function|drop\s+function|revoke|grant|alter\s+function|comment\s+on\s+function)\b[^(]*?(?:^|[\s."])${name}"?\s*\(`, "iu");
+	const call = new RegExp(String.raw`(?<![\w$])(?:(?:"[^"]+"|\w+)\s*\.\s*)?"?${name}"?\s*\(`, "giu");
+	let count = 0;
+	const files = /* @__PURE__ */ new Set();
+	for (const statement of statements) {
+		const hits = own.test(statement.text) ? 0 : (statement.text.match(call) ?? []).length;
+		if (hits > 0) {
+			count += hits;
+			files.add(statement.file);
+		}
+	}
+	return {
+		count,
+		files: [...files].toSorted()
+	};
+}
+/** The `rls.migrate.helpers` names doctor and `rls migrate` count. */
+function legacyHelperNames(config) {
+	return Object.keys(config.helpers).filter((name) => /^[a-z_][a-z0-9_]*$/u.test(name));
+}
+/**
+* For each `rls.migrate.tables` table: whether the migrations still create it,
+* the triggers and functions that refresh it, and what still reads it.
+*/
+function retirePlan(statements, config) {
+	const schema = replay(statements);
+	const uncalled = new Set(legacyHelperNames(config).filter((name) => legacyHelperCalls(statements, name).count === 0));
+	const helpers = [...schema.functions.keys()].filter((fn) => uncalled.has(fn.slice(fn.lastIndexOf(".") + 1))).toSorted();
+	return {
+		tables: Object.entries(config.tables ?? {}).map(([name, table]) => {
+			const target = key(name);
+			const refresh = refreshFunctions(schema, target, table.refresh ?? []);
+			const reads = new RegExp(refPattern(target), "iu");
+			const readers = [];
+			for (const policy of schema.policies.values()) if (policy.table !== target && reads.test(policy.text)) readers.push({
+				kind: "policy",
+				name: `${policy.name} on ${policy.table}`,
+				file: policy.file,
+				line: policy.line
+			});
+			for (const [view, defined] of schema.views) if (view !== target && reads.test(defined.text)) readers.push({
+				kind: "view",
+				name: view,
+				file: defined.file,
+				line: defined.line
+			});
+			for (const [fn, defined] of schema.functions) if (!refresh.has(fn) && !helpers.includes(fn) && reads.test(defined.text)) readers.push({
+				kind: "function",
+				name: fn,
+				file: defined.file,
+				line: defined.line
+			});
+			return {
+				table: target,
+				present: schema.relations.has(target),
+				kind: schema.relations.get(target) ?? "table",
+				refreshTriggers: [...schema.triggers.values()].filter((trigger) => trigger.table !== target && refresh.has(trigger.function)),
+				refreshFunctions: [...refresh].filter((fn) => schema.functions.has(fn)).toSorted(),
+				readers
+			};
+		}),
+		helpers
+	};
+}
+function escapeQualifiedName(name) {
+	return name.split(".").map((part) => escapeSqlIdent(part)).join(".");
+}
+/** The retire migration: each present table without readers, its refresh triggers and functions, and the uncalled helpers. */
+function retireSql(plan) {
+	const tables = plan.tables.filter((table) => table.present && table.readers.length === 0);
+	if (tables.length === 0) return;
+	const lines = [`${RETIRE_MARKER} table=${tables.map((table) => table.table).join(",")}`, "-- rls.migrate.tables: the refresh triggers and functions, uncalled legacy helpers, then the table; no cascade, so a dependant left behind fails the migration"];
+	for (const table of tables) for (const trigger of table.refreshTriggers) lines.push(`drop trigger if exists ${escapeSqlIdent(trigger.name)} on ${escapeQualifiedName(trigger.table)};`);
+	const functions = new Set(tables.flatMap((table) => table.refreshFunctions));
+	for (const fn of [...functions].toSorted()) lines.push(`drop function if exists ${escapeQualifiedName(fn)};`);
+	for (const helper of plan.helpers) lines.push(`drop function if exists ${escapeQualifiedName(helper)};`);
+	for (const table of tables) lines.push(`drop ${table.kind} if exists ${escapeQualifiedName(table.table)};`);
+	return `${lines.join("\n")}\n`;
+}
+//#endregion
+export { retireSql as i, legacyHelperNames as n, retirePlan as r, legacyHelperCalls as t };

package/dist/{revocations-Cy06JNx2.d.ts → revocations-R07lFBnX.d.ts}

@@ -12,6 +12,8 @@ type RevocationListener = (event: RevocationEvent) => void;
  * revalidate a connection, never grant; a lost event falls back to expiry.
  */
 type RevocationFeed = {
+  /** Names the implementation in errors and events. */
+  readonly name?: string;
   subscribe(listener: RevocationListener): () => void;
   revoke(event: RevocationEvent): void | Promise<void>;
 };

package/dist/rls-BA8an5Ap.js

@@ -0,0 +1,336 @@
+import { c as missingInput } from "./errors-CWTY6uih.js";
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/rls.ts
+const membershipsFlag = { memberships: {
+	type: "string",
+	description: "Membership table as <table>:tenant,user,role",
+	valueHint: "table"
+} };
+/** The flags that shape the generated SQL; verify --introspect and migrate take them too. */
+const shapeFlags = {
+	target: {
+		type: "enum",
+		options: [
+			"sql",
+			"drizzle",
+			"prisma"
+		],
+		default: "sql",
+		description: "Output form"
+	},
+	dialect: {
+		type: "enum",
+		options: [
+			"supabase",
+			"neon",
+			"guc"
+		],
+		description: "How the database reads the subject (default rls.dialect, else supabase)"
+	},
+	...policyFlag,
+	...membershipsFlag,
+	rbac: {
+		type: "enum",
+		options: ["supabase"],
+		description: "Scaffold the role tables for this provider"
+	},
+	"rbac-schema": {
+		type: "string",
+		description: "Schema for the scaffolded role tables",
+		valueHint: "name"
+	},
+	authorize: {
+		type: "enum",
+		options: ["database", "jwt"],
+		description: "Where roles are read"
+	},
+	"skip-closures": {
+		type: "boolean",
+		description: "Skip grants with closures instead of failing"
+	},
+	"inline-functions": {
+		type: "boolean",
+		description: "Inline helper calls into the policies"
+	},
+	"force-rls": {
+		type: "boolean",
+		description: "Emit FORCE ROW LEVEL SECURITY so the table owner is held to the policies"
+	},
+	"guc-prefix": {
+		type: "string",
+		description: "guc dialect: setting prefix",
+		valueHint: "prefix"
+	},
+	"policy-per-role": {
+		type: "boolean",
+		description: "One policy per role instead of one per command"
+	},
+	"policy-name": {
+		type: "string",
+		description: "Policy name template",
+		valueHint: "template"
+	},
+	"tenant-type": {
+		type: "string",
+		description: "Postgres type of the tenant column",
+		valueHint: "type"
+	},
+	"custom-roles": {
+		type: "boolean",
+		description: "Emit the custom role tables and helpers"
+	},
+	capabilities: {
+		type: "boolean",
+		description: "Emit the link capability helpers"
+	},
+	fields: {
+		type: "enum",
+		options: ["views"],
+		description: "Field security"
+	},
+	"revoke-columns": {
+		type: "boolean",
+		description: "Revoke restricted columns on the table"
+	},
+	"helpers-only": {
+		type: "boolean",
+		description: "Write the helpers and keep the policies hand-written"
+	},
+	shims: {
+		type: "boolean",
+		description: "Wrap each rls.migrate helper under its legacy name"
+	},
+	schemas: {
+		type: "enum",
+		options: [
+			"pg-delta",
+			"migra",
+			"migrations"
+		],
+		description: "Schema workflow (default supabase.schemas, else pg-delta)"
+	},
+	...dbUrlFlags
+};
+const sqlFlag = { sql: {
+	type: "string",
+	description: "SQL file or folder to read",
+	valueHint: "path"
+} };
+const SHAPE_DEFAULTS = {
+	target: "sql",
+	dialect: void 0,
+	policy: void 0,
+	memberships: void 0,
+	rbac: void 0,
+	"rbac-schema": void 0,
+	authorize: void 0,
+	"skip-closures": false,
+	"inline-functions": false,
+	"force-rls": false,
+	"guc-prefix": void 0,
+	"policy-per-role": false,
+	"policy-name": void 0,
+	"tenant-type": void 0,
+	"custom-roles": false,
+	capabilities: false,
+	fields: void 0,
+	"revoke-columns": false,
+	"helpers-only": false,
+	shims: false,
+	schemas: void 0,
+	"db-url-stdin": false
+};
+/** Every RlsRunInput field at its "not given" value, with the shape flags applied. */
+async function rlsInput(ctx, verb, shape, options) {
+	return {
+		cwd: ctx.cwd,
+		config: ctx.config,
+		rest: [verb],
+		target: shape.target,
+		dialect: shape.dialect,
+		out: void 0,
+		from: given(shape.policy),
+		sql: void 0,
+		db: await dbUrl(ctx, shape, { required: options?.dbRequired === true }),
+		fixtures: void 0,
+		schema: void 0,
+		memberships: given(shape.memberships),
+		format: void 0,
+		rbac: shape.rbac === "supabase",
+		rbacSchema: given(shape["rbac-schema"]),
+		authorize: shape.authorize,
+		check: false,
+		skipClosures: shape["skip-closures"],
+		inlineFunctions: shape["inline-functions"],
+		force: shape["force-rls"],
+		gucPrefix: given(shape["guc-prefix"]),
+		policyPerRole: shape["policy-per-role"],
+		policyName: given(shape["policy-name"]),
+		tenantType: given(shape["tenant-type"]),
+		customRoles: shape["custom-roles"],
+		capabilities: shape.capabilities,
+		fields: shape.fields,
+		revokeColumns: shape["revoke-columns"],
+		tree: false,
+		introspect: false,
+		split: void 0,
+		schemas: shape.schemas,
+		grantsOut: void 0,
+		seedsOut: void 0,
+		helpersOnly: shape["helpers-only"],
+		shims: shape.shims,
+		write: false,
+		json: ctx.json,
+		io: ctx.io
+	};
+}
+async function runRls(input) {
+	return (await import("./rls-j6t43t7n.js")).runRls(input);
+}
+const generate = defineLeaf({
+	flags: {
+		...shapeFlags,
+		...outFlag,
+		...checkFlag,
+		project: {
+			type: "string",
+			description: "Rebuild the policy from a PermDock Cloud project's pushed catalog and policy",
+			valueHint: "id"
+		},
+		url: {
+			type: "string",
+			description: "With --project: Cloud API base URL",
+			valueHint: "url"
+		},
+		split: {
+			type: "string",
+			description: "Write helpers, seeds, indexes, policies and hook as separate parts",
+			valueHint: "parts",
+			list: true,
+			async complete() {
+				return (await import("./output-files-B3IZJksC.js")).SPLIT_PARTS;
+			}
+		},
+		"grants-out": {
+			type: "string",
+			description: "migra: file for the privileges supabase db diff drops",
+			valueHint: "file"
+		},
+		"seeds-out": {
+			type: "string",
+			description: "File for the role_permissions seeds",
+			valueHint: "file"
+		},
+		"backfill-out": {
+			type: "string",
+			description: "File for the rls.customRoles.from copy",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const backfillOut = given(flags["backfill-out"]);
+		return runRls({
+			...await rlsInput(ctx, "generate", flags),
+			out: given(flags.out),
+			check: flags.check,
+			project: given(flags.project),
+			url: given(flags.url),
+			split: given(flags.split),
+			grantsOut: given(flags["grants-out"]),
+			seedsOut: given(flags["seeds-out"]),
+			...backfillOut === void 0 ? {} : { backfillOut }
+		});
+	}
+});
+const importPolicies = defineLeaf({
+	flags: {
+		...sqlFlag,
+		...dbUrlFlags,
+		...outFlag,
+		...validatorFlag,
+		...membershipsFlag
+	},
+	async run(ctx, { flags }) {
+		const sql = given(flags.sql);
+		const db = await dbUrl(ctx, flags, { required: sql === void 0 });
+		if (sql === void 0 && db === void 0) throw missingInput("rls import", ["--sql", "--db-url-stdin"], "pass one, or set DATABASE_URL or SUPABASE_DB_URL");
+		return runRls({
+			...await rlsInput(ctx, "import", {
+				...SHAPE_DEFAULTS,
+				memberships: flags.memberships
+			}),
+			sql,
+			db,
+			out: fileOut("rls import", flags.out),
+			schema: flags.validator
+		});
+	}
+});
+const verify = defineLeaf({
+	flags: {
+		...shapeFlags,
+		fixtures: {
+			type: "string",
+			description: "Fixtures file",
+			valueHint: "file"
+		},
+		kind: {
+			type: "enum",
+			options: ["node", "pgtap"],
+			description: "Run the fixtures in Node or emit a pgTAP file"
+		},
+		tree: {
+			type: "boolean",
+			description: "Check the relationship closure"
+		},
+		introspect: {
+			type: "boolean",
+			description: "Compare against the live database"
+		},
+		advisors: {
+			type: "boolean",
+			description: "Run the Supabase security advisors"
+		}
+	},
+	async run(ctx, { flags }) {
+		return runRls({
+			...await rlsInput(ctx, "verify", flags, { dbRequired: flags.introspect || flags.tree }),
+			fixtures: given(flags.fixtures),
+			format: flags.kind,
+			tree: flags.tree,
+			introspect: flags.introspect,
+			advisors: flags.advisors
+		});
+	}
+});
+const migrate = defineLeaf({
+	flags: {
+		...shapeFlags,
+		...sqlFlag,
+		...dryRunFlag,
+		force: {
+			type: "boolean",
+			description: "Rewrite files with uncommitted changes too"
+		},
+		"retire-out": {
+			type: "string",
+			description: "File dropping the rls.migrate.tables once nothing reads them",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const sql = given(flags.sql);
+		if (sql === void 0) throw missingInput("rls migrate", ["--sql"], "the folder of SQL files to rewrite");
+		const retireOut = given(flags["retire-out"]);
+		return runRls({
+			...await rlsInput(ctx, "migrate", flags),
+			sql,
+			write: !flags["dry-run"],
+			forceRewrite: flags.force,
+			...retireOut === void 0 ? {} : { retireOut }
+		});
+	}
+});
+//#endregion
+export { generate, importPolicies, migrate, verify };