import { type Condition, type ConditionBuilder } from "@executor-js/fumadb/query";import type { AnyColumn, AnyTable } from "@executor-js/fumadb/schema"; import { StorageError } from "./fuma-runtime"; /* The v2 owner policy — successor to v1's `executor.scope` policy. Every owned * row carries `tenant` + `owner`('org'|'user') + `subject`; org rows use the * empty-string sentinel for `subject` (NOT null, so unique indexes stay portable). * * An executor binds to `{ tenant, subject }`. The policy guards storage so it can * only read/write rows it owns: *   - read/update/delete → tenant matches AND (owner='org' OR subject matches) *   - create → the written (tenant, owner, subject) must match the binding * No scope stack, no innermost-wins shadowing: a tool address names its owner * segment, so org and user rows are distinct, both visible to the acting subject. */ export const executorOwnerPolicyName = "executor.owner";/** Tenant-shared tables (the integration catalog) — partitioned by `tenant` only. */export const executorTenantPolicyName = "executor.tenant";/** Truly global tables (the blob store) — isolation carried in the row namespace. */export const executorUnscopedPolicyName = "executor.unscoped"; /** Sentinel `subject` value for org-owned rows. */export const ORG_SUBJECT = ""; const unscopedExecutorTables = new Set(["blob"]); /** How far a context's READS reach. Writes ignore this entirely — see *  `assertOwnerWritable`. */export type ExecutorReach =  /** The product view: this subject's rows plus the tenant's org rows. */  | "bound"  /** The platform view: every row in the tenant, whatever subject owns it.   *  READ-ONLY by construction — it widens `ownerVisibilityCondition` and   *  nothing else. */  | "tenant"; /** Whether a context may mutate at all. Orthogonal to `reach`: reach says how *  far reads SEE, this says whether writes are permitted. */export type ExecutorWrites =  /** The default: writes are allowed, bounded by `assertOwnerWritable`. */  | "allowed"  /** Every create/update/delete is rejected outright, at every reach. */  | "denied"; export interface ExecutorOwnerPolicyContext {  readonly tenant: string;  /** The acting member, or null for a pure-org executor (no `owner:"user"`   *  reads/writes are allowed when null). */  readonly subject: string | null;  /** Read reach; defaults to `"bound"`. A `"tenant"`-reach context is the   *  platform view: it sees the whole tenant but writes exactly as a bound   *  context does, so it can never mutate another subject's rows. */  readonly reach?: ExecutorReach;  /**   * Write permission; defaults to `"allowed"`. `"denied"` makes the context   * read-only at the STORAGE boundary, independently of reach.   *   * WHY THIS IS SEPARATE FROM `reach`. A tenant-reach context is always   * write-denied (a widened write would hit every subject in the tenant), so   * `reach: "tenant"` implies this. But the converse does not hold: the   * platform executor needs its ORDINARY, bound-reach surfaces to be read-only   * too, and it must NOT get tenant reach on them — widening those reads would   * hand every subject's `connection` row, credential item ids included, to a   * surface that only ever needed the admin projection. So read-only-ness is   * its own axis rather than a side effect of reach.   */  readonly writes?: ExecutorWrites;} type AnyConditionBuilder = ConditionBuilder<Record<string, AnyColumn>>; const policyViolation = (message: string): never => {  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: FumaDB table policy callbacks are promise callbacks, not Effect effects  throw new StorageError({ message, cause: undefined });}; const requireContext = (  tableName: string,  access: string,  context: ExecutorOwnerPolicyContext | undefined,): ExecutorOwnerPolicyContext => {  if (context) return context;  return policyViolation(    `Storage ${access} on table "${tableName}" is missing executor owner context.`,  );}; /** The rows the bound `{ tenant, subject }` may see/mutate: org rows in the *  tenant, plus this subject's own user rows. * *  Under `reach: "tenant"` (the platform view) this widens to the whole tenant: *  every subject's rows, not just the bound one. That is a READ widening only — *  the policy uses this condition for `onRead`/`onUpdate`/`onDelete` filtering, *  but the write assertions below reject a tenant-reach context outright, so a *  widened context can never be the one doing the mutating. */export const ownerVisibilityCondition = (  builder: AnyConditionBuilder,  context: ExecutorOwnerPolicyContext,): Condition | boolean => {  // The platform view: partition by tenant alone. Still never cross-tenant —  // `tenant` is the one clause that is NEVER relaxed, at any reach.  if (context.reach === "tenant") return builder("tenant", "=", context.tenant);  const orgClause = builder.and(    builder("tenant", "=", context.tenant),    builder("owner", "=", "org"),  );  if (context.subject == null) return orgClause;  const userClause = builder.and(    builder("tenant", "=", context.tenant),    builder("owner", "=", "user"),    builder("subject", "=", context.subject),  );  return builder.or(orgClause, userClause);}; /** * THE security property of the platform view: it never mutates. Two contexts * are read-only, for two different reasons, and this one guard covers both: * *   - `reach: "tenant"` — `ownerVisibilityCondition` is also what filters *     `onUpdate`/`onDelete`, so a widened context reaching any mutation would *     silently mutate EVERY subject in the tenant. *   - `writes: "denied"` — an explicitly read-only context. The platform *     executor's ordinary (bound-reach) surfaces carry this: they are not *     widened, so the reach clause above would not catch them, yet a *     subject-less platform executor still binds to the tenant's org partition *     and could otherwise create, update and delete every `owner: "org"` row *     in it through `connections` / `policies` / `integrations` / `oauth`. * * Every write path calls this first and fails loudly — a write arriving on a * read-only handle is a programmer error, not something to quietly demote to * bound behavior. */export const assertReachReadOnly = (  tableName: string,  access: string,  context: ExecutorOwnerPolicyContext | undefined,): void => {  if (context === undefined) return;  if (context.reach !== "tenant" && context.writes !== "denied") return;  policyViolation(    `Storage ${access} on table "${tableName}" is not allowed: the platform view is read-only.`,  );}; /** Assert a create/upsert writes a row inside the bound partition. */export const assertOwnerWritable = (  tableName: string,  values: Record<string, unknown>,  context: ExecutorOwnerPolicyContext | undefined,): void => {  const ctx = requireContext(tableName, "write", context);  assertReachReadOnly(tableName, "write", ctx);  if (values.tenant !== ctx.tenant) {    policyViolation(`Storage write on table "${tableName}" is outside the executor tenant.`);  }  if (values.owner === "org") {    if (values.subject !== ORG_SUBJECT) {      policyViolation(`Storage write on table "${tableName}" set a subject on an org row.`);    }    return;  }  if (values.owner === "user") {    if (ctx.subject == null || values.subject !== ctx.subject) {      policyViolation(        `Storage write on table "${tableName}" targets a user row outside the bound subject.`,      );    }    return;  }  policyViolation(    `Storage write on table "${tableName}" has an invalid owner "${String(values.owner)}".`,  );}; /** Assert a patch (`set`) doesn't move a row out of the bound partition. Only *  validates the partition columns that are actually being written. */export const assertOwnerPatch = (  tableName: string,  patch: Record<string, unknown> | undefined,  context: ExecutorOwnerPolicyContext | undefined,): void => {  const ctx = requireContext(tableName, "write", context);  assertReachReadOnly(tableName, "write", ctx);  if (!patch) return;  if (patch.tenant !== undefined && patch.tenant !== ctx.tenant) {    policyViolation(`Storage write on table "${tableName}" cannot move a row across tenants.`);  }  if (patch.owner === "user" && (ctx.subject == null || patch.subject !== ctx.subject)) {    policyViolation(      `Storage write on table "${tableName}" cannot move a row outside the bound subject.`,    );  }}; export const hasExecutorOwnerPolicy = (table: AnyTable): boolean =>  table.policies.some((policy) => policy.name === executorOwnerPolicyName); export function assertExecutorOwnerPolicyTable(table: AnyTable, tableKey?: string): void {  const tableName = table.ormName || tableKey || table.names.sql;  const owned = table.policies.find((policy) => policy.name === executorOwnerPolicyName);  if (owned?.onRead && owned.onCreate && owned.onUpdate && owned.onDelete) return;   const tenant = table.policies.find((policy) => policy.name === executorTenantPolicyName);  if (tenant?.onRead && tenant.onCreate && tenant.onUpdate && tenant.onDelete) return;   const unscoped = table.policies.find((policy) => policy.name === executorUnscopedPolicyName);  if (unscoped && unscopedExecutorTables.has(tableName)) return;   policyViolation(`Storage table "${tableName}" is missing an executor owner policy.`);}