{"version":3,"file":"rls.cjs","names":["PgRole"],"sources":["../../src/neon/rls.ts"],"sourcesContent":["import { is } from '~/entity.ts';\nimport { type AnyPgColumn, pgPolicy, type PgPolicyToOption } from '~/pg-core/index.ts';\nimport { PgRole, pgRole } from '~/pg-core/roles.ts';\nimport { type SQL, sql } from '~/sql/sql.ts';\n\n/**\n * Generates a set of PostgreSQL row-level security (RLS) policies for CRUD operations based on the provided options.\n *\n * @param options - An object containing the policy configuration.\n * @param options.role - The PostgreSQL role(s) to apply the policy to. Can be a single `PgRole` instance or an array of `PgRole` instances or role names.\n * @param options.read - The SQL expression or boolean value that defines the read policy. Set to `true` to allow all reads, `false` to deny all reads, or provide a custom SQL expression. Set to `null` to prevent the policy from being generated.\n * @param options.modify - The SQL expression or boolean value that defines the modify (insert, update, delete) policies. Set to `true` to allow all modifications, `false` to deny all modifications, or provide a custom SQL expression. Set to `null` to prevent policies from being generated.\n * @returns An array of PostgreSQL policy definitions, one for each CRUD operation.\n */\nexport const crudPolicy = (options: {\n\trole: PgPolicyToOption;\n\tread: SQL | boolean | null;\n\tmodify: SQL | boolean | null;\n}) => {\n\tif (options.read === undefined) {\n\t\tthrow new Error('crudPolicy requires a read policy');\n\t}\n\n\tif (options.modify === undefined) {\n\t\tthrow new Error('crudPolicy requires a modify policy');\n\t}\n\n\tlet read: SQL | undefined;\n\tif (options.read === true) {\n\t\tread = sql`true`;\n\t} else if (options.read === false) {\n\t\tread = sql`false`;\n\t} else if (options.read !== null) {\n\t\tread = options.read;\n\t}\n\n\tlet modify: SQL | undefined;\n\tif (options.modify === true) {\n\t\tmodify = sql`true`;\n\t} else if (options.modify === false) {\n\t\tmodify = sql`false`;\n\t} else if (options.modify !== null) {\n\t\tmodify = options.modify;\n\t}\n\n\tlet rolesName = '';\n\tif (Array.isArray(options.role)) {\n\t\trolesName = options.role\n\t\t\t.map((it) => {\n\t\t\t\treturn is(it, PgRole) ? it.name : (it as string);\n\t\t\t})\n\t\t\t.join('-');\n\t} else {\n\t\trolesName = is(options.role, PgRole)\n\t\t\t? options.role.name\n\t\t\t: (options.role as string);\n\t}\n\n\treturn [\n\t\tread\n\t\t&& pgPolicy(`crud-${rolesName}-policy-select`, {\n\t\t\tfor: 'select',\n\t\t\tto: options.role,\n\t\t\tusing: read,\n\t\t}),\n\n\t\tmodify\n\t\t&& pgPolicy(`crud-${rolesName}-policy-insert`, {\n\t\t\tfor: 'insert',\n\t\t\tto: options.role,\n\t\t\twithCheck: modify,\n\t\t}),\n\t\tmodify\n\t\t&& pgPolicy(`crud-${rolesName}-policy-update`, {\n\t\t\tfor: 'update',\n\t\t\tto: options.role,\n\t\t\tusing: modify,\n\t\t\twithCheck: modify,\n\t\t}),\n\t\tmodify\n\t\t&& pgPolicy(`crud-${rolesName}-policy-delete`, {\n\t\t\tfor: 'delete',\n\t\t\tto: options.role,\n\t\t\tusing: modify,\n\t\t}),\n\t].filter(Boolean);\n};\n\n// These are default roles that Neon will set up.\nexport const authenticatedRole = pgRole('authenticated').existing();\nexport const anonymousRole = pgRole('anonymous').existing();\n\nexport const authUid = (userIdColumn: AnyPgColumn) => sql`(select auth.user_id() = ${userIdColumn})`;\n"],"mappings":";;;;;;;;;;;;;;;;;AAcA,MAAa,cAAc,YAIrB;AACL,KAAI,QAAQ,SAAS,OACpB,OAAM,IAAI,MAAM,oCAAoC;AAGrD,KAAI,QAAQ,WAAW,OACtB,OAAM,IAAI,MAAM,sCAAsC;CAGvD,IAAI;AACJ,KAAI,QAAQ,SAAS,KACpB,QAAO,gBAAG;UACA,QAAQ,SAAS,MAC3B,QAAO,gBAAG;UACA,QAAQ,SAAS,KAC3B,QAAO,QAAQ;CAGhB,IAAI;AACJ,KAAI,QAAQ,WAAW,KACtB,UAAS,gBAAG;UACF,QAAQ,WAAW,MAC7B,UAAS,gBAAG;UACF,QAAQ,WAAW,KAC7B,UAAS,QAAQ;CAGlB,IAAI,YAAY;AAChB,KAAI,MAAM,QAAQ,QAAQ,KAAK,CAC9B,aAAY,QAAQ,KAClB,KAAK,OAAO;AACZ,6BAAU,IAAIA,0BAAO,GAAG,GAAG,OAAQ;GAClC,CACD,KAAK,IAAI;KAEX,iCAAe,QAAQ,MAAMA,0BAAO,GACjC,QAAQ,KAAK,OACZ,QAAQ;AAGb,QAAO;EACN,yCACY,QAAQ,UAAU,iBAAiB;GAC9C,KAAK;GACL,IAAI,QAAQ;GACZ,OAAO;GACP,CAAC;EAEF,2CACY,QAAQ,UAAU,iBAAiB;GAC9C,KAAK;GACL,IAAI,QAAQ;GACZ,WAAW;GACX,CAAC;EACF,2CACY,QAAQ,UAAU,iBAAiB;GAC9C,KAAK;GACL,IAAI,QAAQ;GACZ,OAAO;GACP,WAAW;GACX,CAAC;EACF,2CACY,QAAQ,UAAU,iBAAiB;GAC9C,KAAK;GACL,IAAI,QAAQ;GACZ,OAAO;GACP,CAAC;EACF,CAAC,OAAO,QAAQ;;AAIlB,MAAa,mDAA2B,gBAAgB,CAAC,UAAU;AACnE,MAAa,+CAAuB,YAAY,CAAC,UAAU;AAE3D,MAAa,WAAW,iBAA8B,gBAAG,4BAA4B,aAAa"}