permdock 0.4.0 → 0.6.0

package/dist/rls-BAqP4q66.js

@@ -0,0 +1,336 @@
+import { c as missingInput } from "./errors-CWTY6uih.js";
+import { t as defineLeaf } from "./command-L8EstFNm.js";
+import { c as given, d as policyFlag, f as validatorFlag, i as dryRunFlag, l as outFlag, n as dbUrl, o as fileOut, r as dbUrlFlags, t as checkFlag } from "./flags-C3DktBDY.js";
+//#region src/cli/commands/rls.ts
+const membershipsFlag = { memberships: {
+	type: "string",
+	description: "Membership table as <table>:tenant,user,role",
+	valueHint: "table"
+} };
+/** The flags that shape the generated SQL; verify --introspect and migrate take them too. */
+const shapeFlags = {
+	target: {
+		type: "enum",
+		options: [
+			"sql",
+			"drizzle",
+			"prisma"
+		],
+		default: "sql",
+		description: "Output form"
+	},
+	dialect: {
+		type: "enum",
+		options: [
+			"supabase",
+			"neon",
+			"guc"
+		],
+		description: "How the database reads the subject (default rls.dialect, else supabase)"
+	},
+	...policyFlag,
+	...membershipsFlag,
+	rbac: {
+		type: "enum",
+		options: ["supabase"],
+		description: "Scaffold the role tables for this provider"
+	},
+	"rbac-schema": {
+		type: "string",
+		description: "Schema for the scaffolded role tables",
+		valueHint: "name"
+	},
+	authorize: {
+		type: "enum",
+		options: ["database", "jwt"],
+		description: "Where roles are read"
+	},
+	"skip-closures": {
+		type: "boolean",
+		description: "Skip grants with closures instead of failing"
+	},
+	"inline-functions": {
+		type: "boolean",
+		description: "Inline helper calls into the policies"
+	},
+	"force-rls": {
+		type: "boolean",
+		description: "Emit FORCE ROW LEVEL SECURITY so the table owner is held to the policies"
+	},
+	"guc-prefix": {
+		type: "string",
+		description: "guc dialect: setting prefix",
+		valueHint: "prefix"
+	},
+	"policy-per-role": {
+		type: "boolean",
+		description: "One policy per role instead of one per command"
+	},
+	"policy-name": {
+		type: "string",
+		description: "Policy name template",
+		valueHint: "template"
+	},
+	"tenant-type": {
+		type: "string",
+		description: "Postgres type of the tenant column",
+		valueHint: "type"
+	},
+	"custom-roles": {
+		type: "boolean",
+		description: "Emit the custom role tables and helpers"
+	},
+	capabilities: {
+		type: "boolean",
+		description: "Emit the link capability helpers"
+	},
+	fields: {
+		type: "enum",
+		options: ["views"],
+		description: "Field security"
+	},
+	"revoke-columns": {
+		type: "boolean",
+		description: "Revoke restricted columns on the table"
+	},
+	"helpers-only": {
+		type: "boolean",
+		description: "Write the helpers and keep the policies hand-written"
+	},
+	shims: {
+		type: "boolean",
+		description: "Wrap each rls.migrate helper under its legacy name"
+	},
+	schemas: {
+		type: "enum",
+		options: [
+			"pg-delta",
+			"migra",
+			"migrations"
+		],
+		description: "Schema workflow (default supabase.schemas, else pg-delta)"
+	},
+	...dbUrlFlags
+};
+const sqlFlag = { sql: {
+	type: "string",
+	description: "SQL file or folder to read",
+	valueHint: "path"
+} };
+const SHAPE_DEFAULTS = {
+	target: "sql",
+	dialect: void 0,
+	policy: void 0,
+	memberships: void 0,
+	rbac: void 0,
+	"rbac-schema": void 0,
+	authorize: void 0,
+	"skip-closures": false,
+	"inline-functions": false,
+	"force-rls": false,
+	"guc-prefix": void 0,
+	"policy-per-role": false,
+	"policy-name": void 0,
+	"tenant-type": void 0,
+	"custom-roles": false,
+	capabilities: false,
+	fields: void 0,
+	"revoke-columns": false,
+	"helpers-only": false,
+	shims: false,
+	schemas: void 0,
+	"db-url-stdin": false
+};
+/** Every RlsRunInput field at its "not given" value, with the shape flags applied. */
+async function rlsInput(ctx, verb, shape, options) {
+	return {
+		cwd: ctx.cwd,
+		config: ctx.config,
+		rest: [verb],
+		target: shape.target,
+		dialect: shape.dialect,
+		out: void 0,
+		from: given(shape.policy),
+		sql: void 0,
+		db: await dbUrl(ctx, shape, { required: options?.dbRequired === true }),
+		fixtures: void 0,
+		schema: void 0,
+		memberships: given(shape.memberships),
+		format: void 0,
+		rbac: shape.rbac === "supabase",
+		rbacSchema: given(shape["rbac-schema"]),
+		authorize: shape.authorize,
+		check: false,
+		skipClosures: shape["skip-closures"],
+		inlineFunctions: shape["inline-functions"],
+		force: shape["force-rls"],
+		gucPrefix: given(shape["guc-prefix"]),
+		policyPerRole: shape["policy-per-role"],
+		policyName: given(shape["policy-name"]),
+		tenantType: given(shape["tenant-type"]),
+		customRoles: shape["custom-roles"],
+		capabilities: shape.capabilities,
+		fields: shape.fields,
+		revokeColumns: shape["revoke-columns"],
+		tree: false,
+		introspect: false,
+		split: void 0,
+		schemas: shape.schemas,
+		grantsOut: void 0,
+		seedsOut: void 0,
+		helpersOnly: shape["helpers-only"],
+		shims: shape.shims,
+		write: false,
+		json: ctx.json,
+		io: ctx.io
+	};
+}
+async function runRls(input) {
+	return (await import("./rls-DTvYd-lI.js")).runRls(input);
+}
+const generate = defineLeaf({
+	flags: {
+		...shapeFlags,
+		...outFlag,
+		...checkFlag,
+		project: {
+			type: "string",
+			description: "Rebuild the policy from a PermDock Cloud project's pushed catalog and policy",
+			valueHint: "id"
+		},
+		url: {
+			type: "string",
+			description: "With --project: Cloud API base URL",
+			valueHint: "url"
+		},
+		split: {
+			type: "string",
+			description: "Write helpers, seeds, indexes, policies and hook as separate parts",
+			valueHint: "parts",
+			list: true,
+			async complete() {
+				return (await import("./output-files-B3IZJksC.js")).SPLIT_PARTS;
+			}
+		},
+		"grants-out": {
+			type: "string",
+			description: "migra: file for the privileges supabase db diff drops",
+			valueHint: "file"
+		},
+		"seeds-out": {
+			type: "string",
+			description: "File for the role_permissions seeds",
+			valueHint: "file"
+		},
+		"backfill-out": {
+			type: "string",
+			description: "File for the rls.customRoles.from copy",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const backfillOut = given(flags["backfill-out"]);
+		return runRls({
+			...await rlsInput(ctx, "generate", flags),
+			out: given(flags.out),
+			check: flags.check,
+			project: given(flags.project),
+			url: given(flags.url),
+			split: given(flags.split),
+			grantsOut: given(flags["grants-out"]),
+			seedsOut: given(flags["seeds-out"]),
+			...backfillOut === void 0 ? {} : { backfillOut }
+		});
+	}
+});
+const importPolicies = defineLeaf({
+	flags: {
+		...sqlFlag,
+		...dbUrlFlags,
+		...outFlag,
+		...validatorFlag,
+		...membershipsFlag
+	},
+	async run(ctx, { flags }) {
+		const sql = given(flags.sql);
+		const db = await dbUrl(ctx, flags, { required: sql === void 0 });
+		if (sql === void 0 && db === void 0) throw missingInput("rls import", ["--sql", "--db-url-stdin"], "pass one, or set DATABASE_URL or SUPABASE_DB_URL");
+		return runRls({
+			...await rlsInput(ctx, "import", {
+				...SHAPE_DEFAULTS,
+				memberships: flags.memberships
+			}),
+			sql,
+			db,
+			out: fileOut("rls import", flags.out),
+			schema: flags.validator
+		});
+	}
+});
+const verify = defineLeaf({
+	flags: {
+		...shapeFlags,
+		fixtures: {
+			type: "string",
+			description: "Fixtures file",
+			valueHint: "file"
+		},
+		kind: {
+			type: "enum",
+			options: ["node", "pgtap"],
+			description: "Run the fixtures in Node or emit a pgTAP file"
+		},
+		tree: {
+			type: "boolean",
+			description: "Check the relationship closure"
+		},
+		introspect: {
+			type: "boolean",
+			description: "Compare against the live database"
+		},
+		advisors: {
+			type: "boolean",
+			description: "Run the Supabase security advisors"
+		}
+	},
+	async run(ctx, { flags }) {
+		return runRls({
+			...await rlsInput(ctx, "verify", flags, { dbRequired: flags.introspect || flags.tree }),
+			fixtures: given(flags.fixtures),
+			format: flags.kind,
+			tree: flags.tree,
+			introspect: flags.introspect,
+			advisors: flags.advisors
+		});
+	}
+});
+const migrate = defineLeaf({
+	flags: {
+		...shapeFlags,
+		...sqlFlag,
+		...dryRunFlag,
+		force: {
+			type: "boolean",
+			description: "Rewrite files with uncommitted changes too"
+		},
+		"retire-out": {
+			type: "string",
+			description: "File dropping the rls.migrate.tables once nothing reads them",
+			valueHint: "file"
+		}
+	},
+	async run(ctx, { flags }) {
+		const sql = given(flags.sql);
+		if (sql === void 0) throw missingInput("rls migrate", ["--sql"], "the folder of SQL files to rewrite");
+		const retireOut = given(flags["retire-out"]);
+		return runRls({
+			...await rlsInput(ctx, "migrate", flags),
+			sql,
+			write: !flags["dry-run"],
+			forceRewrite: flags.force,
+			...retireOut === void 0 ? {} : { retireOut }
+		});
+	}
+});
+//#endregion
+export { generate, importPolicies, migrate, verify };