rastack 0.0.51 → 0.0.52

package/dist/define/markers.js

@@ -0,0 +1,37 @@
+"use strict";
+/**
+ * Entity-level authorization markers — auth as *TypeScript types*.
+ *
+ * Class and interface entities have no options bag, so their access policy is
+ * expressed the same way their columns are: in the type system. Attach a
+ * marker with `implements` (classes) or `extends` (interfaces) and the
+ * compiler reads the policy straight off the heritage clause:
+ *
+ * ```ts
+ * import { AdminGroups, IsAuthenticated, Owner, Group } from "rastack/auth";
+ *
+ * // Per-user rows: RLS on `owner`, staff sees everything.
+ * export class Itinerary implements IsAuthenticated, AdminGroups<"staff"> {
+ *   owner!: string & Owner;
+ *   notes!: string;
+ * }
+ *
+ * // Group-owned dataset: rows belong to a team and are *physically stored*
+ * // under that team's own storage prefix (groups/{team}/…).
+ * export class Report implements IsAuthenticated, AdminGroups<"staff"> {
+ *   team!: string & Group;
+ *   title!: string;
+ * }
+ * ```
+ *
+ * The markers are phantom types: every property is optional and never exists
+ * at runtime, so `implements` needs no members and instances stay plain data.
+ * Each marker family uses its own phantom key, so markers combine freely —
+ * while two *permission* markers on one entity conflict in the type checker,
+ * which is exactly right.
+ *
+ * JSDoc equivalents exist for every marker (`@rastackPermission`,
+ * `@rastackAdminGroups staff, ops`, `@rastackScope owner|group|shared`, and
+ * field-level `@owner` / `@group`), mirroring the column-constraint tags.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/define/types.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The `rastack/types` compatibility surface — one module aliasing the two
+ * split authoring subpaths: `rastack/db` (the `DbConfig` column brands) and
+ * `rastack/auth` (the entity-level auth markers + `Owner`/`Group` brands).
+ * Prefer those; everything stays re-exported here so existing imports keep
+ * working. The compiler maps all three specifiers (see `compile/program.ts`);
+ * the published package re-exports the same modules from `tools/types.ts`.
+ */
+export * from "./db";
+export * from "./markers";

package/dist/define/types.js

@@ -0,0 +1,26 @@
+"use strict";
+/**
+ * The `rastack/types` compatibility surface — one module aliasing the two
+ * split authoring subpaths: `rastack/db` (the `DbConfig` column brands) and
+ * `rastack/auth` (the entity-level auth markers + `Owner`/`Group` brands).
+ * Prefer those; everything stays re-exported here so existing imports keep
+ * working. The compiler maps all three specifiers (see `compile/program.ts`);
+ * the published package re-exports the same modules from `tools/types.ts`.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./db"), exports);
+__exportStar(require("./markers"), exports);

package/dist/wasm/rastack_wasm.js

@@ -375,7 +375,7 @@ function __wbg_get_imports() {
             return ret;
         },
         __wbindgen_cast_0000000000000001: function(arg0, arg1) {
-            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 85, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
+            // Cast intrinsic for `Closure(Closure { owned: true, function: Function { arguments: [Externref], shim_idx: 83, ret: Result(Unit), inner_ret: Some(Result(Unit)) }, mutable: true }) -> Externref`.
             const ret = makeMutClosure(arg0, arg1, wasm_bindgen_1a7aa9db5392c486___convert__closures_____invoke___wasm_bindgen_1a7aa9db5392c486___JsValue__core_7d5f0a2ba6a62c33___result__Result_____wasm_bindgen_1a7aa9db5392c486___JsError___true_);
             return ret;
         },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rastack",
-  "version": "0.0.51",
+  "version": "0.0.52",
   "description": "",
   "main": "runtime.ts",
   "types": "runtime.ts",

package/provider/index.ts

@@ -1,10 +1,6 @@
 export * from "./types";
 export * from "./provider";
-export {
-  createWasmAdapter,
-  createEngine,
-  defaultEngineLoader,
-} from "./wasm";
+export { createWasmAdapter, createEngine, defaultEngineLoader } from "./wasm";
 export {
   WarehousePersistence,
   seedFromIceberg,

package/provider/provider.tsx

@@ -33,6 +33,12 @@ import {
   isAccessRevoked,
   purgeIdentityCache,
 } from "../cache";
+import {
+  RastackAuthProvider,
+  userAuth,
+  type ManifestLike,
+  type RastackAuth,
+} from "../auth";
 import { toManifest } from "../src/define/manifest";
 import { getGlobalManifest } from "../hooks/manifest";
 
@@ -74,17 +80,29 @@ export function RAStackProvider({
     config.onStatusChange?.(next);
   };
 
+  // One resolved identity, whichever way it was supplied: the typed `auth`
+  // object, or the raw `identity` / `groups` strings (which win when both are
+  // given). This is what the engine runs as, what namespaces local bytes, and
+  // what the component tree gates its affordances with.
+  const auth: RastackAuth | undefined =
+    config.auth ??
+    (config.identity != null
+      ? userAuth(config.identity, config.groups ?? [])
+      : undefined);
+  const identity = config.identity ?? auth?.sub;
+  const groups = config.groups ?? auth?.groups ?? [];
+
   // Locally persisted state is namespaced per identity, so two accounts on
   // one device never share bytes.
   const warehouseDb = withIdentity(
     config.databaseName || "rastack-warehouse",
-    config.identity,
+    identity,
   );
 
   /** Delete everything this identity persisted locally. */
   const purgeLocal = async () => {
     if (cacheStorageRef.current) {
-      await purgeIdentityCache(cacheStorageRef.current, config.identity);
+      await purgeIdentityCache(cacheStorageRef.current, identity);
     }
     await deleteIndexedDb(warehouseDb);
     // Replicated rows in the sync engine's store are derived from the same
@@ -136,8 +154,8 @@ export function RAStackProvider({
 
       // Run the in-browser engine as the signed-in identity so owner stamping
       // and row-level security match the server exactly.
-      if (config.identity) {
-        engine.setAuth?.(config.identity, config.groups ?? []);
+      if (identity) {
+        engine.setAuth?.(identity, groups);
       }
 
       // Warehouse persistence: IndexedDB for `local`, an S3 sink for `s3`.
@@ -166,7 +184,7 @@ export function RAStackProvider({
             const cache = new IcebergFileCache({
               storage,
               source: config.fileSource ?? httpFileSource(base),
-              identity: config.identity,
+              identity,
               maxOfflineMs: config.maxOfflineMs,
             });
             await cache.seed(engine, resources);
@@ -191,7 +209,10 @@ export function RAStackProvider({
       persistRef.current = persist;
 
       engineRef.current = engine;
-      configureApi({ baseURL: "", adapter: createWasmAdapter(engine, persist) });
+      configureApi({
+        baseURL: "",
+        adapter: createWasmAdapter(engine, persist),
+      });
       setStatusSafe("ready");
     }
 
@@ -209,18 +230,21 @@ export function RAStackProvider({
       engineRef.current = null;
     };
     // eslint-disable-next-line react-hooks/exhaustive-deps
-  }, [config.mode, config.baseURL, config.warehouseBaseUrl, config.identity]);
+  }, [config.mode, config.baseURL, config.warehouseBaseUrl, identity]);
 
   const client = useMemo<RastackClient>(
     () => ({
       mode: config.mode,
       status,
+      auth,
       get engine() {
         return engineRef.current;
       },
       async exportWarehouse() {
         if (!engineRef.current) {
-          throw new Error("exportWarehouse is only available in local/s3 mode.");
+          throw new Error(
+            "exportWarehouse is only available in local/s3 mode.",
+          );
         }
         return engineRef.current.exportWarehouse();
       },
@@ -239,13 +263,18 @@ export function RAStackProvider({
       },
     }),
     // eslint-disable-next-line react-hooks/exhaustive-deps
-    [config.mode, status, config.identity],
+    [config.mode, status, identity],
   );
 
   return (
     <RastackContext.Provider value={client}>
       <RastackManifestProvider manifest={manifest}>
-        {children}
+        <RastackAuthProvider
+          auth={auth}
+          manifest={manifest as ManifestLike | undefined}
+        >
+          {children}
+        </RastackAuthProvider>
       </RastackManifestProvider>
     </RastackContext.Provider>
   );
@@ -279,7 +308,9 @@ function withIdentity(name: string, identity?: string): string {
 export function useRastackClient(): RastackClient {
   const client = useContext(RastackContext);
   if (!client) {
-    throw new Error("useRastackClient must be used within a <RAStackProvider>.");
+    throw new Error(
+      "useRastackClient must be used within a <RAStackProvider>.",
+    );
   }
   return client;
 }

package/provider/types.ts

@@ -68,14 +68,24 @@ export interface RAStackProviderConfig {
   getToken?: () => string | Promise<string>;
 
   // -- identity & local-data security (all modes) --
+  /**
+   * The signed-in identity as a typed {@link import("../auth").RastackAuth} —
+   * the one auth object the whole stack shares. Supplies `identity`/`groups`
+   * when those aren't set, runs the WASM engine as this identity, and is
+   * provided to the component tree (via `rastack/auth`'s context) so
+   * `<AutoForm>` / `<DataTable>` gate their affordances against each
+   * resource's `permission` + `access` policy automatically.
+   */
+  auth?: import("../auth").RastackAuth;
   /**
    * The signed-in identity — the verified Cognito `sub`. It namespaces every
    * locally persisted byte (Iceberg file cache, warehouse snapshot DB), so
    * accounts sharing a device can't read each other's data, and it is the
-   * subject the WASM engine stamps/filters owner rows with.
+   * subject the WASM engine stamps/filters owner rows with. Defaults to
+   * `auth.sub`.
    */
   identity?: string;
-  /** Verified group claims (`cognito:groups`) for the WASM engine's auth. */
+  /** Verified group claims (`cognito:groups`). Defaults to `auth.groups`. */
   groups?: string[];
   /**
    * Fired when the data source reports this identity's access has been
@@ -166,6 +176,8 @@ export type RadStatus =
 export interface RastackClient {
   mode: RadMode;
   status: RadStatus;
+  /** The resolved identity this client runs as (from `auth` or `identity`). */
+  auth?: import("../auth").RastackAuth;
   /** The live WASM engine (null in `remote` mode). */
   engine: RastackEngine | null;
   /** Snapshot the local warehouse to a portable blob (WASM modes only). */

package/provider/warehouse.ts

@@ -26,8 +26,7 @@ export class WarehousePersistence {
   private db: Promise<IDBDatabase> | null;
 
   constructor(private databaseName: string) {
-    this.db =
-      typeof indexedDB !== "undefined" ? openDb(databaseName) : null;
+    this.db = typeof indexedDB !== "undefined" ? openDb(databaseName) : null;
   }
 
   get enabled(): boolean {
@@ -109,7 +108,9 @@ export async function seedFromIceberg(
     if (!metaBytes) continue;
     await engine.seedFile(metaKey, metaBytes);
 
-    const meta = JSON.parse(decoder.decode(metaBytes)) as { data_files?: string[] };
+    const meta = JSON.parse(decoder.decode(metaBytes)) as {
+      data_files?: string[];
+    };
     for (const rel of meta.data_files || []) {
       const key = `${prefix}/${rel}`;
       const bytes = await fetchBytes(base + key);

package/provider/wasm.ts

@@ -13,7 +13,9 @@ const runtimeImport: (specifier: string) => Promise<any> =
   new Function("s", "return import(s)") as any;
 
 export const defaultEngineLoader: RastackEngineLoader = async () => {
-  const mod: RastackWasmModule = await runtimeImport("rastack/wasm/rastack_wasm.js");
+  const mod: RastackWasmModule = await runtimeImport(
+    "rastack/wasm/rastack_wasm.js",
+  );
   const init = mod.default || mod.init;
   if (typeof init === "function") {
     await init();

package/runtime.ts

@@ -2,3 +2,4 @@ export * from "./hooks";
 export * from "./types";
 export * from "./provider";
 export * from "./cache";
+export * from "./auth";

package/src/compile/analyze.ts

@@ -69,7 +69,9 @@ export function analyzeDsl(
 
   // Deterministic order: app, then model.
   resources.sort((a, b) =>
-    a.app === b.app ? a.model.localeCompare(b.model) : a.app.localeCompare(b.app),
+    a.app === b.app
+      ? a.model.localeCompare(b.model)
+      : a.app.localeCompare(b.app),
   );
   types.sort((a, b) => a.key.localeCompare(b.key));
   return { resources, types };
@@ -114,7 +116,12 @@ function analyzeResourceCall(
   const app = stringLiteralArg(call.arguments[0]);
   const model = stringLiteralArg(call.arguments[1]);
   const fieldsArg = call.arguments[2];
-  if (!app || !model || !fieldsArg || !ts.isObjectLiteralExpression(fieldsArg)) {
+  if (
+    !app ||
+    !model ||
+    !fieldsArg ||
+    !ts.isObjectLiteralExpression(fieldsArg)
+  ) {
     return undefined;
   }
 
@@ -178,7 +185,12 @@ function analyzeField(
   }
 
   // Scalar: the field type carries a `__rastackScalar` string-literal discriminant.
-  const scalar = literalTypeProp(fieldType, "__rastackScalar", checker, initializer);
+  const scalar = literalTypeProp(
+    fieldType,
+    "__rastackScalar",
+    checker,
+    initializer,
+  );
   if (!scalar) return undefined;
 
   const field: FieldModel = { name, type: scalar as ScalarType };