marc
05e5722a0e
prepack downloads the release whose version matches package.json, verifies the Ed25519 manifest against the pinned release key and the zip against its sha256, and only then extracts the control file and scripts into sql/. No SQL is committed here.
49 lines
1.7 KiB
Markdown
49 lines
1.7 KiB
Markdown
# @crudy/pgmorbac
|
|
|
|
The [pgmorbac](https://pgmorbac.crudy.fr) PostgreSQL extension (Multi-OrBAC access
|
|
control) for Node.js projects that apply SQL through a migration runner instead of
|
|
`CREATE EXTENSION`.
|
|
|
|
```bash
|
|
npm install @crudy/pgmorbac
|
|
```
|
|
|
|
```js
|
|
import { extensionSql, upgradeScripts, version } from '@crudy/pgmorbac';
|
|
|
|
await client.query(extensionSql()); // pgmorbac--<version>.sql
|
|
for (const u of upgradeScripts()) { // pgmorbac--<from>--<to>.sql, in order
|
|
await client.query(u.sql);
|
|
}
|
|
```
|
|
|
|
| Export | |
|
|
|---|---|
|
|
| `extensionSql()` | the install script, as `CREATE EXTENSION` would run it |
|
|
| `upgradeScripts()` | `{ from, to, filename, sql }` per upgrade script, in version order |
|
|
| `version` | the extension version |
|
|
| `sqlDir`, `controlFile` | paths to the shipped files, for tools that read them directly |
|
|
|
|
For Fastify applications, [`@crudy/pgmorbac-fastify`](https://www.npmjs.com/package/@crudy/pgmorbac-fastify)
|
|
adds permission checks, the RLS session context and management routes.
|
|
|
|
## Where the SQL comes from
|
|
|
|
The package version is the extension version. Building the package downloads
|
|
that version's release from
|
|
[crudy/pgmorbac](https://git.villains.fr/crudy/pgmorbac/releases), checks the
|
|
Ed25519-signed manifest against the pinned `release-key.pub.pem` and the zip
|
|
against the manifest's sha256, and only then extracts the SQL. The extension
|
|
source lives in [pgmorbac](https://github.com/crudylabs/pgmorbac); this repository
|
|
holds no SQL.
|
|
|
|
## Releasing
|
|
|
|
After pgmorbac `vX.Y.Z` is released on Gitea, set `version` to `X.Y.Z` here, then
|
|
`npm publish`. To build from a local release (the extension's `dist/`), set
|
|
`PGMORBAC_DIST_DIR`; it is verified the same way.
|
|
|
|
## License
|
|
|
|
MIT, like the extension. See [LICENSE](LICENSE).
|