Add FumaDB table policy interceptors

apps/local/src/server/sqlite-import.test.ts

@@ -4,7 +4,7 @@ import { existsSync, mkdtempSync, rmSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 
-import { collectTables } from "@executor-js/sdk";
+import { collectTables, withQueryContext } from "@executor-js/sdk";
 
 import { importSqliteDataToFuma } from "./sqlite-import";
 import { createSqliteFumaDb, type SqliteFumaDb } from "./sqlite-fumadb";
@@ -96,7 +96,9 @@ describe("importSqliteDataToFuma", () => {
     expect(existsSync(sqlitePath)).toBe(false);
     expect(result.backupPath && existsSync(result.backupPath)).toBe(true);
 
-    const source = (await sqlite.db.findFirst("source", {
+    const db = withQueryContext(sqlite.db, { allowedScopeIds: new Set(["scope_a"]) });
+
+    const source = (await db.findFirst("source", {
       where: (b) => b("id", "=", "src_1"),
     })) as Record<string, unknown>;
     expect(source.scope_id).toBe("scope_a");
@@ -105,7 +107,7 @@ describe("importSqliteDataToFuma", () => {
     expect(source.can_edit).toBe(true);
     expect(source.created_at).toBeInstanceOf(Date);
 
-    const blob = (await sqlite.db.findFirst("blob", {
+    const blob = (await db.findFirst("blob", {
       where: (b) => b("id", "=", JSON.stringify(["scope_a/plugin", "spec"])),
     })) as Record<string, unknown>;
     expect(blob.value).toBe("{}");

apps/local/src/server/sqlite-import.ts

@@ -6,7 +6,13 @@ import { dirname } from "node:path";
 
 /* oxlint-disable executor/no-json-parse, executor/no-switch-statement, executor/no-try-catch-or-throw -- boundary: one-shot legacy SQLite importer normalizes unknown rows and wraps native sqlite failures */
 
-import type { AnyColumn, AnyTable, FumaDb, FumaTables } from "@executor-js/sdk";
+import {
+  withQueryContext,
+  type AnyColumn,
+  type AnyTable,
+  type FumaDb,
+  type FumaTables,
+} from "@executor-js/sdk";
 
 type SqliteRow = Record<string, unknown>;
 
@@ -180,8 +186,11 @@ export const importSqliteDataToFuma = async (
     sqlite = new Database(options.sqlitePath, { readonly: true });
     const importedTables: string[] = [];
     let importedRows = 0;
+    const dbWithScopeContext = withQueryContext(options.db, {
+      allowedScopeIds: new Set([options.scopeId]),
+    });
 
-    await (options.db as ImportFumaDb).transaction(async (db) => {
+    await (dbWithScopeContext as ImportFumaDb).transaction(async (db) => {
       for (const [tableKey, table] of Object.entries(options.tables)) {
         const tableName = table.names.sql;
         if (!tableExists(sqlite!, tableName)) continue;

packages/core/api/src/scoped-targets.test.ts

@@ -15,6 +15,7 @@ import {
   definePlugin,
   makeTestConfig,
   type Executor,
+  withQueryContext,
 } from "@executor-js/sdk";
 import { memorySecretsPlugin } from "@executor-js/sdk/testing";
 
@@ -175,7 +176,9 @@ describe("core API explicit target scopes", () => {
       expect(response.status).toBe(200);
       const rows = toScopeRows(
         yield* Effect.promise(() =>
-          config.db.findMany("connection", {
+          withQueryContext(config.db, {
+            allowedScopeIds: new Set([String(userScope), String(orgScope)]),
+          }).findMany("connection", {
             where: (b) => b("id", "=", connectionId),
           }),
         ),
@@ -222,7 +225,11 @@ describe("core API explicit target scopes", () => {
       );
 
       expect(response.status).toBe(400);
-      const sessions = yield* Effect.promise(() => config.db.findMany("oauth2_session"));
+      const sessions = yield* Effect.promise(() =>
+        withQueryContext(config.db, {
+          allowedScopeIds: new Set([String(userScope), String(orgScope)]),
+        }).findMany("oauth2_session"),
+      );
       expect(sessions).toEqual([]);
     }),
   );

packages/core/fumadb/src/query/index.ts

@@ -1,46 +1,34 @@
 import type {
   AnySchema,
   AnyTable,
-  IdColumn,
   Relation,
+  TableColumnValues,
+  TableInsertValues,
+  TableUpdateValues,
 } from "../schema/create";
 import type { Condition, ConditionBuilder } from "./condition-builder";
 import type { ORMAdapter } from "./orm";
 
 export type { Condition, ConditionBuilder } from "./condition-builder";
+export { withQueryContext } from "./orm";
+export type {
+  CompiledJoin,
+  ORMAdapter,
+  SimplifiedCountOptions,
+  SimplifyFindOptions,
+} from "./orm";
 
 export type AnySelectClause = SelectClause<AnyTable>;
 
 export type SelectClause<T extends AnyTable> = true | (keyof T["columns"])[];
 
-type TableToColumnValues<T extends AnyTable> = {
-  [K in keyof T["columns"]]: T["columns"][K]["$out"];
-};
+export type TableToColumnValues<T extends AnyTable> = TableColumnValues<T>;
 
-type PickNullable<T> = {
-  [P in keyof T as null extends T[P] ? P : never]: T[P];
-};
+export type TableToInsertValues<T extends AnyTable> = TableInsertValues<T>;
 
-type PickNotNullable<T> = {
-  [P in keyof T as null extends T[P] ? never : P]: T[P];
-};
-
-type TableToInsertValues<T extends AnyTable> = Partial<
-  PickNullable<{
-    [K in keyof T["columns"]]: T["columns"][K]["$in"];
-  }>
-> &
-  PickNotNullable<{
-    [K in keyof T["columns"]]: T["columns"][K]["$in"];
-  }>;
-
-type TableToUpdateValues<T extends AnyTable> = {
-  [K in keyof T["columns"]]?: T["columns"][K] extends IdColumn
-    ? never
-    : T["columns"][K]["$in"];
-};
+export type TableToUpdateValues<T extends AnyTable> = TableUpdateValues<T>;
 
-type MainSelectResult<
+export type MainSelectResult<
   S extends SelectClause<T>,
   T extends AnyTable,
 > = S extends true
@@ -70,7 +58,7 @@ export type JoinBuilder<T extends AnyTable, Out = {}> = {
     : never;
 };
 
-type SelectResult<
+export type SelectResult<
   T extends AnyTable,
   JoinOut,
   Select extends SelectClause<T>,
@@ -113,7 +101,7 @@ export type FindManyOptions<
   : {});
 
 export interface AbstractQuery<S extends AnySchema> {
-  internal: ORMAdapter;
+  internal: ORMAdapter<S>;
 
   /**
    * The code in the transaction will receive a transaction query instance.