dummy authorizer

Author: penberg

index.d.ts

@@ -17,7 +17,6 @@ export declare class SqliteError {
   code: string
   rawCode: number
 }
-export declare class AuthorizerArgs { }
 export declare class Database {
   constructor(path: string, opts?: Options | undefined | null)
   get memory(): boolean
@@ -28,6 +27,7 @@ export declare class Database {
   function(): void
   aggregate(): void
   table(): void
+  authorizer(): void
   loadExtension(path: string): void
   maxWriteReplicationIndex(): void
   exec(sql: string): void

index.js

@@ -310,10 +310,9 @@ if (!nativeBinding) {
   throw new Error(`Failed to load native binding`)
 }
 
-const { SqliteError, AuthorizerArgs, Database, databasePrepareSync, Statement, RowsIterator } = nativeBinding
+const { SqliteError, Database, databasePrepareSync, Statement, RowsIterator } = nativeBinding
 
 module.exports.SqliteError = SqliteError
-module.exports.AuthorizerArgs = AuthorizerArgs
 module.exports.Database = Database
 module.exports.databasePrepareSync = databasePrepareSync
 module.exports.Statement = Statement

promise.js

@@ -2,6 +2,7 @@
 
 const { Database: NativeDb } = require("./index.js");
 const SqliteError = require("./sqlite-error.js");
+const Authorization = require("./auth");
 
 function convertError(err) {
   // Handle errors from Rust with JSON-encoded message
@@ -138,6 +139,14 @@ class Database {
     throw new Error("not implemented");
   }
 
+  authorizer(rules) {
+    try {
+      this.db.authorizer(rules);
+    } catch (err) {
+      throw convertError(err);
+    }
+  }
+
   loadExtension(...args) {
     throw new Error("not implemented");
   }
@@ -304,4 +313,4 @@ class Statement {
 }
 
 module.exports = Database;
-module.exports.SqliteError = SqliteError;
+module.exports.SqliteError = SqliteError;

src/auth.rs

@@ -0,0 +1,97 @@
+use tracing::trace;
+
+use std::collections::HashSet;
+
+pub struct AuthorizerBuilder {
+    allow_list: HashSet<String>,
+    deny_list: HashSet<String>,
+}
+
+impl AuthorizerBuilder {
+    pub fn new() -> Self {
+        Self {
+            allow_list: HashSet::new(),
+            deny_list: HashSet::new(),
+        }
+    }
+
+    pub fn allow(&mut self, table: &str) -> &mut Self {
+        self.allow_list.insert(table.to_string());
+        self
+    }
+
+    pub fn deny(&mut self, table: &str) -> &mut Self {
+        self.deny_list.insert(table.to_string());
+        self
+    }
+
+    pub fn build(self) -> Authorizer {
+        Authorizer::new(self.allow_list, self.deny_list)
+    }
+}
+
+pub struct Authorizer {
+    allow_list: HashSet<String>,
+    deny_list: HashSet<String>,
+}
+
+impl Authorizer {
+    pub fn new(allow_list: HashSet<String>, deny_list: HashSet<String>) -> Self {
+        Self {
+            allow_list,
+            deny_list,
+        }
+    }
+
+    pub fn authorize(&self, ctx: &libsql::AuthContext) -> libsql::Authorization {
+        use libsql::AuthAction;
+        let ret = match ctx.action {
+            AuthAction::Unknown { .. } => libsql::Authorization::Deny,
+            AuthAction::CreateIndex { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateTable { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateTempIndex { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateTempTable { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateTempTrigger { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateTempView { .. } => libsql::Authorization::Deny,
+            AuthAction::CreateTrigger { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::CreateView { .. } => libsql::Authorization::Deny,
+            AuthAction::Delete { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropIndex { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropTable { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropTempIndex { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropTempTable { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropTempTrigger { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::DropTempView { .. } => libsql::Authorization::Deny,
+            AuthAction::DropTrigger { .. } => libsql::Authorization::Deny,
+            AuthAction::DropView { .. } => libsql::Authorization::Deny,
+            AuthAction::Insert { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::Pragma { .. } => libsql::Authorization::Deny,
+            AuthAction::Read { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::Select { .. } => libsql::Authorization::Allow,
+            AuthAction::Transaction { .. } => libsql::Authorization::Deny,
+            AuthAction::Update { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::Attach { .. } => libsql::Authorization::Deny,
+            AuthAction::Detach { .. } => libsql::Authorization::Deny,
+            AuthAction::AlterTable { table_name, .. } => self.authorize_table(table_name),
+            AuthAction::Reindex { .. } => libsql::Authorization::Deny,
+            AuthAction::Analyze { .. } => libsql::Authorization::Deny,
+            AuthAction::CreateVtable { .. } => libsql::Authorization::Deny,
+            AuthAction::DropVtable { .. } => libsql::Authorization::Deny,
+            AuthAction::Function { .. } => libsql::Authorization::Deny,
+            AuthAction::Savepoint { .. } => libsql::Authorization::Deny,
+            AuthAction::Recursive { .. } => libsql::Authorization::Deny,
+        };
+        trace!("authorize(ctx = {:?}) -> {:?}", ctx, ret);
+        ret
+    }
+
+    fn authorize_table(&self, table: &str) -> libsql::Authorization {
+        if self.deny_list.contains(table) {
+            return libsql::Authorization::Deny;
+        }
+        if self.allow_list.contains(table) {
+            return libsql::Authorization::Allow;
+        }
+        libsql::Authorization::Deny
+    }
+}

src/lib.rs

@@ -2,6 +2,8 @@
 #![allow(non_snake_case)]
 #![allow(deprecated)]
 
+mod auth;
+
 #[macro_use]
 extern crate napi_derive;
 
@@ -156,9 +158,6 @@ impl From<libsql::Error> for Error {
     }
 }
 
-#[napi]
-struct AuthorizerArgs;
-
 #[napi]
 pub struct Database {
     path: String,
@@ -281,6 +280,11 @@ impl Database {
         todo!();
     }
 
+    #[napi]
+    pub fn authorizer(&self) -> Result<()> {
+        return Ok(());
+    }
+
     #[napi]
     pub fn loadExtension(&self, _path: String) -> Result<()> {
         todo!();

wrapper.js

@@ -2,6 +2,7 @@
 
 const { Database: NativeDb, databasePrepareSync } = require("./index.js");
 const SqliteError = require("./sqlite-error.js");
+const Authorization = require("./auth");
 
 function convertError(err) {
   // Handle errors from Rust with JSON-encoded message
@@ -138,6 +139,14 @@ class Database {
     throw new Error("not implemented");
   }
 
+  authorizer(rules) {
+    try {
+      this.db.authorizer(rules);
+    } catch (err) {
+      throw convertError(err);
+    }
+  }
+
   loadExtension(...args) {
     throw new Error("not implemented");
   }