Add FumaDB table policy interceptors

apps/local/src/server/executor.ts

@@ -6,6 +6,7 @@ import { homedir } from "node:os";
 import { basename, join } from "node:path";
 
 import { Scope, ScopeId, collectTables, createExecutor, type AnyPlugin } from "@executor-js/sdk";
+import { withQueryContext } from "fumadb/query";
 import { loadPluginsFromJsonc } from "@executor-js/config";
 
 import executorConfig from "../../executor.config";
@@ -189,7 +190,9 @@ const importLegacySqliteIfNeeded = async (options: {
     const result = await importSqliteDataToFuma({
       sqlitePath: storage.sqlitePath,
       markerPath: storage.importMarkerPath,
-      db: target.db,
+      target: withQueryContext(target.db, {
+        allowedScopeIds: new Set([scopeId]),
+      }),
       tables,
       scopeId,
     });

apps/local/src/server/sqlite-import.test.ts

@@ -5,6 +5,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { collectTables } from "@executor-js/sdk";
+import { withQueryContext } from "fumadb/query";
 
 import { importSqliteDataToFuma } from "./sqlite-import";
 import { createSqliteFumaDb, type SqliteFumaDb } from "./sqlite-fumadb";
@@ -81,10 +82,11 @@ describe("importSqliteDataToFuma", () => {
       path: join(workDir, "target.db"),
     });
 
+    const scopedDb = withQueryContext(sqlite.db, { allowedScopeIds: new Set(["scope_a"]) });
     const result = await importSqliteDataToFuma({
       sqlitePath,
       markerPath,
-      db: sqlite.db,
+      target: scopedDb,
       tables,
       scopeId: "scope_a",
     });
@@ -96,7 +98,7 @@ describe("importSqliteDataToFuma", () => {
     expect(existsSync(sqlitePath)).toBe(false);
     expect(result.backupPath && existsSync(result.backupPath)).toBe(true);
 
-    const source = (await sqlite.db.findFirst("source", {
+    const source = (await scopedDb.findFirst("source", {
       where: (b) => b("id", "=", "src_1"),
     })) as Record<string, unknown>;
     expect(source.scope_id).toBe("scope_a");
@@ -105,7 +107,7 @@ describe("importSqliteDataToFuma", () => {
     expect(source.can_edit).toBe(true);
     expect(source.created_at).toBeInstanceOf(Date);
 
-    const blob = (await sqlite.db.findFirst("blob", {
+    const blob = (await scopedDb.findFirst("blob", {
       where: (b) => b("id", "=", JSON.stringify(["scope_a/plugin", "spec"])),
     })) as Record<string, unknown>;
     expect(blob.value).toBe("{}");

apps/local/src/server/sqlite-import.ts

@@ -6,7 +6,7 @@ import { dirname } from "node:path";
 
 /* oxlint-disable executor/no-json-parse, executor/no-switch-statement, executor/no-try-catch-or-throw -- boundary: one-shot legacy SQLite importer normalizes unknown rows and wraps native sqlite failures */
 
-import type { AnyColumn, AnyTable, FumaDb, FumaTables } from "@executor-js/sdk";
+import { type AnyColumn, type AnyTable, type FumaTables } from "@executor-js/sdk";
 
 type SqliteRow = Record<string, unknown>;
 
@@ -25,7 +25,7 @@ export class LocalSqliteImportError extends Data.TaggedError("LocalSqliteImportE
 export interface LocalSqliteImportOptions {
   readonly sqlitePath: string;
   readonly markerPath: string;
-  readonly db: FumaDb;
+  readonly target: ImportFumaDb;
   readonly tables: FumaTables;
   readonly scopeId: string;
 }
@@ -181,7 +181,7 @@ export const importSqliteDataToFuma = async (
     const importedTables: string[] = [];
     let importedRows = 0;
 
-    await (options.db as ImportFumaDb).transaction(async (db) => {
+    await options.target.transaction(async (db) => {
       for (const [tableKey, table] of Object.entries(options.tables)) {
         const tableName = table.names.sql;
         if (!tableExists(sqlite!, tableName)) continue;

packages/core/fumadb/package.json

@@ -86,9 +86,11 @@
   },
   "devDependencies": {
     "@effect/vitest": "catalog:",
+    "@types/better-sqlite3": "^7.6.13",
     "@types/node": "catalog:",
     "@types/pg": "^8.20.0",
     "@types/semver": "^7.7.1",
+    "better-sqlite3": "^12.9.0",
     "tsup": "catalog:",
     "typescript": "catalog:",
     "vitest": "catalog:"

packages/core/fumadb/src/query/index.ts

@@ -1,46 +1,34 @@
 import type {
   AnySchema,
   AnyTable,
-  IdColumn,
   Relation,
+  TableColumnValues,
+  TableInsertValues,
+  TableUpdateValues,
 } from "../schema/create";
 import type { Condition, ConditionBuilder } from "./condition-builder";
 import type { ORMAdapter } from "./orm";
 
 export type { Condition, ConditionBuilder } from "./condition-builder";
+export { withQueryContext } from "./orm";
+export type {
+  CompiledJoin,
+  ORMAdapter,
+  SimplifiedCountOptions,
+  SimplifyFindOptions,
+} from "./orm";
 
 export type AnySelectClause = SelectClause<AnyTable>;
 
 export type SelectClause<T extends AnyTable> = true | (keyof T["columns"])[];
 
-type TableToColumnValues<T extends AnyTable> = {
-  [K in keyof T["columns"]]: T["columns"][K]["$out"];
-};
+export type TableToColumnValues<T extends AnyTable> = TableColumnValues<T>;
 
-type PickNullable<T> = {
-  [P in keyof T as null extends T[P] ? P : never]: T[P];
-};
+export type TableToInsertValues<T extends AnyTable> = TableInsertValues<T>;
 
-type PickNotNullable<T> = {
-  [P in keyof T as null extends T[P] ? never : P]: T[P];
-};
-
-type TableToInsertValues<T extends AnyTable> = Partial<
-  PickNullable<{
-    [K in keyof T["columns"]]: T["columns"][K]["$in"];
-  }>
-> &
-  PickNotNullable<{
-    [K in keyof T["columns"]]: T["columns"][K]["$in"];
-  }>;
-
-type TableToUpdateValues<T extends AnyTable> = {
-  [K in keyof T["columns"]]?: T["columns"][K] extends IdColumn
-    ? never
-    : T["columns"][K]["$in"];
-};
+export type TableToUpdateValues<T extends AnyTable> = TableUpdateValues<T>;
 
-type MainSelectResult<
+export type MainSelectResult<
   S extends SelectClause<T>,
   T extends AnyTable,
 > = S extends true
@@ -70,7 +58,7 @@ export type JoinBuilder<T extends AnyTable, Out = {}> = {
     : never;
 };
 
-type SelectResult<
+export type SelectResult<
   T extends AnyTable,
   JoinOut,
   Select extends SelectClause<T>,
@@ -113,7 +101,7 @@ export type FindManyOptions<
   : {});
 
 export interface AbstractQuery<S extends AnySchema> {
-  internal: ORMAdapter;
+  internal: ORMAdapter<S>;
 
   /**
    * The code in the transaction will receive a transaction query instance.