rowstile 0.1.0-alpha.3 → 0.1.0-alpha.5

package/README.md

@@ -1,7 +1,8 @@
 # rowstile
 
-Access rules for Postgres: a policy language that the `rowstile` command compiles into row-level security, and
-ships as migrations for your app's tool (Prisma, Drizzle Kit, Alembic, SQL files).
+Authorization for Postgres apps: access rules in a policy language that the `rowstile` command compiles into
+row-level security, and ships as migrations for your app's tool (Prisma, Drizzle Kit, Alembic, SQL files).
+Sharing, groups, nested folders and tenants, with no service to run beside the database.
 
     npx rowstile init        # a first policy from your tables, rowstile.toml, the SDK for your stack
     npx rowstile dev         # on each save: check, apply to the development database, test, write the types

package/bin/rowstile.js

@@ -64,7 +64,35 @@ function onPath() {
   return null;
 }
 
-const python = process.env.ROWSTILE_PYTHON || process.env.ROWFENCE_PYTHON || bundled() || onPath();   // ROWFENCE_PYTHON: the name before the rename
+/** On Windows, a file of the bundled Python whose path is longer than Windows loads (259 characters, unless long
+ *  paths are turned on): Python then stops with "DLL load failed ... The filename or extension is too long",
+ *  from inside node_modules. Null when every file is within the limit.
+ *  @param {string} exe @returns {string | null} */
+function tooLong(exe) {
+  if (process.platform !== "win32") return null;
+  try {
+    const dlls = path.join(path.dirname(fs.realpathSync.native(exe)), "DLLs");
+    const longest = fs.readdirSync(dlls).map((f) => path.join(dlls, f)).sort((a, b) => b.length - a.length)[0];
+    if (!longest || longest.length <= 259) return null;
+    // with long paths turned on, or when only files the command never loads are past the limit, it runs all
+    // the same: ask it for the compiled modules the command uses
+    const probe = "import unicodedata, ssl, hashlib, socket, select, zlib, decimal";
+    return spawnSync(exe, ["-E", "-s", "-c", probe]).status === 0 ? null : longest;
+  } catch {
+    return null;
+  }
+}
+
+const own = process.env.ROWSTILE_PYTHON || process.env.ROWFENCE_PYTHON ? null : bundled();   // ROWFENCE_PYTHON: the name before the rename
+const long = own && tooLong(own);
+if (long && !onPath()) {
+  console.error(`rowstile: this project's path is too long for Windows to load the Python that came with the package ` +
+    `(${long.length} characters to ${path.basename(long)}; Windows loads up to 259). Move the project to a shorter path, ` +
+    "or turn long paths on in Windows (LongPathsEnabled), or install Python 3.11 or later: rowstile then runs on that one");
+  process.exit(1);
+}
+// a Python on PATH, when the bundled one can't be loaded from here
+const python = process.env.ROWSTILE_PYTHON || process.env.ROWFENCE_PYTHON || (long ? null : own) || onPath();
 if (!python) {
   console.error(`rowstile: no Python to run on. The package for this platform (@rowstile/cli-${key}) isn't installed` +
     (PLATFORMS.includes(key) ? " (optional dependencies turned off?)" : `, and there is none for ${key}`) +

package/command/authzlib/__init__.py

@@ -1,5 +1,6 @@
 """authzlib: compile a .authz policy file into PostgreSQL (views, closure tables,
 triggers, row-level security policies and an API for app code)."""
+
 from .devtools import DevMixin
 from .output import OutputMixin
 from .parse import Loc, PolicyError, parse_policy
@@ -10,7 +11,8 @@ class Compiler(TestMixin, DevMixin, OutputMixin):
     """A policy compiled: each part of the output is one of its bases (OutputMixin assembles them)."""
 
 
-__version__ = "0.1.0-alpha.3"   # set with packaging/version.py (the packages copy it); authz.policy_versions records it on each apply
+# set with packaging/version.py (the packages copy it); authz.policy_versions records it on each apply
+__version__ = "0.1.0-alpha.5"
 
 
 def _build() -> str:
@@ -20,6 +22,7 @@ def _build() -> str:
         return __version__
     import hashlib
     import os
+
     here, h = os.path.dirname(os.path.abspath(__file__)), hashlib.sha256()
     for name in sorted(os.listdir(here)):
         if name.endswith(".py"):

package/command/authzlib/base.py

@@ -177,10 +177,49 @@ CREATE OR REPLACE FUNCTION authz.link_hashes() RETURNS text[] LANGUAGE sql STABL
   WHERE btrim(x) <> '' $$;"""
 
 # Functions each apply recreates (dropped first, whatever their old signature).
-GENERATED_FUNCTIONS = ("act_as", "can", "list", "perms", "perms_of", "share", "unshare", "verify", "create_link", "principal",
-                       "create_role", "set_role_permissions", "delete_role", "roles_of", "who", "explain", "list_shares", "shares",
-                       "create_api_key", "list_api_keys", "revoke_api_key", "login_key", "login_jwt", "view_as",
-                       "sync_members", "changes_since", "trim_changes", "trim_audit", "request_access", "pending_requests", "decide_request",
-                       "cancel_request", "break_glass", "start_review", "review_items", "review_decide",
-                       "close_review", "check_invariants", "lint", "connection_check", "explain_rule", "who_among",
-                       "list_links", "revoke_link")
+GENERATED_FUNCTIONS = (
+    "act_as",
+    "can",
+    "list",
+    "perms",
+    "perms_of",
+    "share",
+    "unshare",
+    "verify",
+    "create_link",
+    "principal",
+    "create_role",
+    "set_role_permissions",
+    "delete_role",
+    "roles_of",
+    "who",
+    "explain",
+    "list_shares",
+    "shares",
+    "create_api_key",
+    "list_api_keys",
+    "revoke_api_key",
+    "login_key",
+    "login_jwt",
+    "view_as",
+    "sync_members",
+    "changes_since",
+    "trim_changes",
+    "trim_audit",
+    "request_access",
+    "pending_requests",
+    "decide_request",
+    "cancel_request",
+    "break_glass",
+    "start_review",
+    "review_items",
+    "review_decide",
+    "close_review",
+    "check_invariants",
+    "lint",
+    "connection_check",
+    "explain_rule",
+    "who_among",
+    "list_links",
+    "revoke_link",
+)