Keep FumaDB query context off SDK surface

Author: RhysSullivan

apps/local/src/server/executor.ts

@@ -5,14 +5,8 @@ import * as fs from "node:fs";
 import { homedir } from "node:os";
 import { basename, join } from "node:path";
 
-import {
-  Scope,
-  ScopeId,
-  collectTables,
-  createExecutor,
-  type AnyPlugin,
-  withQueryContext,
-} from "@executor-js/sdk";
+import { Scope, ScopeId, collectTables, createExecutor, type AnyPlugin } from "@executor-js/sdk";
+import { withQueryContext } from "fumadb/query";
 import { loadPluginsFromJsonc } from "@executor-js/config";
 
 import executorConfig from "../../executor.config";

apps/local/src/server/sqlite-import.test.ts

@@ -4,7 +4,8 @@ import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { collectTables, withQueryContext } from "@executor-js/sdk";
+import { collectTables } from "@executor-js/sdk";
+import { withQueryContext } from "fumadb/query";
 
 import { importSqliteDataToFuma } from "./sqlite-import";
 import { createSqliteFumaDb, type SqliteFumaDb } from "./sqlite-fumadb";

packages/core/sdk/src/index.ts

@@ -20,7 +20,6 @@ export {
 // FumaDB integration.
 export { fumadb } from "fumadb";
 export type { FumaDB } from "fumadb";
-export { withQueryContext } from "fumadb/query";
 export type { AbstractQuery, Condition, ConditionBuilder } from "fumadb/query";
 export { column, idColumn, schema as fumaSchema, table } from "fumadb/schema";
 export type { AnyColumn, AnySchema, AnyTable, Column, Schema as FumaSchema } from "fumadb/schema";

packages/plugins/openapi/src/sdk/plugin.test.ts

@@ -24,7 +24,6 @@ import {
   SetSecretInput,
   type InvokeOptions,
   type SecretProvider,
-  withQueryContext,
 } from "@executor-js/sdk";
 import { memorySecretsPlugin } from "@executor-js/sdk/testing";
 import type { ConfigFileSink } from "@executor-js/config";
@@ -1178,9 +1177,7 @@ layer(TestLayer)("OpenAPI Plugin", (it) => {
             plugins: [openApiPlugin(), memorySecretsPlugin()] as const,
           });
           const executor = yield* createExecutor(config);
-          const db = withQueryContext(config.db, {
-            allowedScopeIds: new Set([String(USER_SCOPE), String(ORG_SCOPE)]),
-          });
+          const db = config.db;
 
           yield* executor.secrets.set(
             SetSecretInput.make({

packages/plugins/workos-vault/src/sdk/secret-store.test.ts

@@ -12,7 +12,6 @@ import {
   ScopeId,
   SecretId,
   SetSecretInput,
-  withQueryContext,
 } from "@executor-js/sdk";
 
 import {
@@ -328,7 +327,7 @@ const makeLayeredExecutors = (client: WorkOSVaultClient) =>
       createdAt: new Date(),
     });
 
-    const config = makeTestConfig({ scopes: [outerScope], plugins });
+    const config = makeTestConfig({ scopes: [innerScope, outerScope], plugins });
     const execOuter = yield* createExecutor({ ...config, scopes: [outerScope] });
     const execInner = yield* createExecutor({ ...config, scopes: [innerScope, outerScope] });
     return { execOuter, execInner, outerId, innerId, config };
@@ -413,9 +412,7 @@ describe("WorkOS Vault secret provider — multi-scope isolation", () => {
 
       const rows = toVaultMetadataRows(
         yield* Effect.promise(() =>
-          withQueryContext(config.db, {
-            allowedScopeIds: new Set([String(innerId), String(outerId)]),
-          }).findMany("workos_vault_metadata", {
+          config.db.findMany("workos_vault_metadata", {
             where: (b) => b("id", "=", "api-token"),
           }),
         ),