@rebasepro/common 0.12.0 → 0.12.1-canary.g06f263c

package/dist/util/auth-default-policies.d.ts

@@ -20,3 +20,21 @@ export declare function getEffectiveSecurityRules(collection: CollectionConfig):
  * DDL, which policies are injected and how to take them off.
  */
 export declare function getInjectedSecurityRules(collection: CollectionConfig): SecurityRule[];
+/**
+ * Every policy name `rebase db push` would write for a collection.
+ *
+ * This is the answer to "did the codebase produce this live policy?", and it is
+ * more than `securityRules.map(r => r.name)` for two reasons:
+ *
+ *  - a rule without an explicit `name` compiles to `<table>_<op>_<hash>`, one
+ *    per operation, so comparing `rule.name` to `policyname` never matches it;
+ *  - the generator also injects the safe-by-default baseline
+ *    (`<table>_default_admin_*`), which is in no collection's `securityRules`.
+ *
+ * Every UI that flags drift has to get both right, and each one that derived it
+ * by hand got a different subset — which is how four policies *Rebase itself
+ * wrote* came to be badged as hand-written drift on every table in a project,
+ * with a button offering to import them back into the codebase that produced
+ * them. There is one derivation now, and this is it.
+ */
+export declare function getGeneratedPolicyNames(collection: CollectionConfig): Set<string>;

package/dist/util/index.d.ts

@@ -16,3 +16,4 @@ export * from "./auth-default-policies";
 export * from "./junction-policies";
 export * from "./conditions";
 export * from "./pg-column-to-property";
+export * from "./string-column-length";

package/dist/util/policy/sqlToPolicy.d.ts

@@ -18,7 +18,12 @@ export interface AnonymousGrantRisk {
  * is how the trusted *server* context is recognised), so:
  *
  *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
- *  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+ *  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+ *    other. This one is not hypothetical and was not only a foreign habit:
+ *    rebase's own request path reported `'anon'` while everything that compiled
+ *    or checked a policy used `'anonymous'`, so whichever literal an author
+ *    picked, half the anonymous callers walked through. See
+ *    {@link ANONYMOUS_USER_IDS}.
  *
  * Either one turns a lockdown into a full grant, and neither looks wrong. No
  * real user id is ever one of these literals, and a user-context request is

package/dist/util/string-column-length.d.ts

@@ -0,0 +1,24 @@
+import type { StringProperty } from "@rebasepro/types";
+/**
+ * The length a bounded string column is declared with when the property does
+ * not say. Historical: it is what the DDL generator hardcoded, kept so that
+ * regenerating an existing schema does not silently redefine its columns.
+ */
+export declare const DEFAULT_STRING_COLUMN_LENGTH = 255;
+/**
+ * How wide a `varchar`/`char` column should be for a given property.
+ *
+ * One definition, three call sites, because they used to disagree. For the same
+ * `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+ * while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+ * reads as *unbounded* — so which of the two you ran decided whether the column
+ * had a limit at all. Introspection then dropped the length entirely, so reading
+ * an existing `character varying(500)` column back and regenerating it produced
+ * a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+ *
+ * `validation.max` is the property's own statement about how long the value may
+ * be, so it is the only sensible source for the column's width — and it keeps
+ * the constraint the database enforces in step with the one the app enforces,
+ * rather than inventing a second, different limit underneath it.
+ */
+export declare function resolveStringColumnLength(prop: Pick<StringProperty, "validation">): number;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.12.0",
+  "version": "0.12.1-canary.g06f263c",
   "description": "Awesome Firebase/Firestore-based headless open-source CMS",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -38,26 +38,26 @@
     "./package.json": "./package.json"
   },
   "dependencies": {
-    "fast-equals": "6.0.0",
+    "fast-equals": "6.0.2",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/types": "0.12.0",
-    "@rebasepro/utils": "0.12.0"
+    "@rebasepro/types": "0.12.1-canary.g06f263c",
+    "@rebasepro/utils": "0.12.1-canary.g06f263c"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
     "@types/jest": "^30.0.0",
-    "@types/node": "^25.9.3",
+    "@types/node": "^26.1.2",
     "@types/object-hash": "^3.0.6",
     "@types/react-measure": "^2.0.12",
     "babel-plugin-react-compiler": "beta",
     "cross-env": "^10.1.0",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
     "tsd": "^0.33.0",
     "typescript": "^6.0.3",
-    "vite": "^8.0.16"
+    "vite": "^8.1.5"
   },
   "files": [
     "dist",

package/src/util/auth-default-policies.ts

@@ -1,5 +1,6 @@
 import { CollectionConfig, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollectionConfig, policy } from "@rebasepro/types";
 import { getTableName } from "./relations";
+import { getPolicyNamesForRules } from "@rebasepro/utils";
 
 /**
  * Default RLS policies injected by the schema generator.
@@ -150,3 +151,24 @@ export function getInjectedSecurityRules(collection: CollectionConfig): Security
     // so everything past the author's count is injected.
     return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
+
+/**
+ * Every policy name `rebase db push` would write for a collection.
+ *
+ * This is the answer to "did the codebase produce this live policy?", and it is
+ * more than `securityRules.map(r => r.name)` for two reasons:
+ *
+ *  - a rule without an explicit `name` compiles to `<table>_<op>_<hash>`, one
+ *    per operation, so comparing `rule.name` to `policyname` never matches it;
+ *  - the generator also injects the safe-by-default baseline
+ *    (`<table>_default_admin_*`), which is in no collection's `securityRules`.
+ *
+ * Every UI that flags drift has to get both right, and each one that derived it
+ * by hand got a different subset — which is how four policies *Rebase itself
+ * wrote* came to be badged as hand-written drift on every table in a project,
+ * with a button offering to import them back into the codebase that produced
+ * them. There is one derivation now, and this is it.
+ */
+export function getGeneratedPolicyNames(collection: CollectionConfig): Set<string> {
+    return getPolicyNamesForRules(getEffectiveSecurityRules(collection), getTableName(collection));
+}

package/src/util/index.ts

@@ -16,3 +16,4 @@ export * from "./auth-default-policies";
 export * from "./junction-policies";
 export * from "./conditions";
 export * from "./pg-column-to-property";
+export * from "./string-column-length";

package/src/util/pg-column-to-property.ts

@@ -42,6 +42,7 @@ function pgTypeToRebaseProperty(column: TableColumnInfo): Property | null {
         udt_name,
         is_nullable,
         column_default,
+        character_maximum_length,
         enum_values
     } = column;
 
@@ -78,11 +79,23 @@ label: prettifyIdentifier(v) })),
             let colType: "varchar" | "text" | "char" = "varchar";
             if (dt === "text" || dt === "citext") colType = "text";
             if (dt === "char" || dt === "character") colType = "char";
+            // Carry the declared width across. Dropping it made introspection
+            // lossy in the one direction that costs data: a `character
+            // varying(500)` column read back as a bare `varchar` regenerates as
+            // `VARCHAR(255)`, narrowing a column that already holds longer
+            // values. TEXT has no width, and reporting one would invent a limit
+            // the database does not have.
+            const declaredLength = colType === "text" ? null : character_maximum_length;
             const prop: StringProperty = {
                 type: "string",
                 name: prettifiedName,
                 columnType: colType,
-                validation: required ? { required: true } : undefined
+                validation: required || declaredLength
+                    ? {
+                        ...(required ? { required: true } : {}),
+                        ...(declaredLength ? { max: declaredLength } : {})
+                    }
+                    : undefined
             };
             if (isAutoId) {
                 prop.isId = "manual";

package/src/util/policy/evaluatePolicy.ts

@@ -1,4 +1,4 @@
-import { ANONYMOUS_USER_ID, Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, isAnonymousUid, Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
 
 /**
  * Result of evaluating a policy client-side. `"unknown"` means the expression
@@ -61,7 +61,11 @@ export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext):
             return expr.roles.every(r => r === "public" || userRoles.includes(r));
         }
         case "authenticated":
-            return ctx.uid != null && ctx.uid !== ANONYMOUS_USER_ID;
+            // Every anonymous spelling, matching what this node compiles to in
+            // Postgres — the two evaluators disagreeing about who is signed in
+            // is the client optimistically rendering a row the database will
+            // refuse, or hiding one it would have allowed.
+            return ctx.uid != null && !isAnonymousUid(ctx.uid);
         case "serverContext":
             // A client is never the server context. Postgres decides this by
             // `auth.uid() IS NULL`, which a client request can never produce:

package/src/util/policy/policyToPostgres.ts

@@ -1,4 +1,4 @@
-import { ANONYMOUS_USER_ID, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
+import { ANONYMOUS_USER_IDS, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
 import { getTableName } from "../relations";
 
@@ -88,9 +88,15 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
         case "authenticated":
             // `IS NOT NULL` alone is a tautology on the user path: every
             // user-context request sets `app.uid`, and an anonymous one sets
-            // it to the sentinel. Excluding the sentinel is what makes this mean
+            // it to a sentinel. Excluding the sentinels is what makes this mean
             // "signed in" rather than "anyone at all".
-            return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+            //
+            // Every sentinel, not just the current one. This clause is written
+            // into the database and outlives the server that generated it: a
+            // policy compiled here may be enforced against an older server that
+            // still reports `'anon'`, which is exactly how excluding one
+            // spelling turned this helper into a grant. See ANONYMOUS_USER_IDS.
+            return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
         case "serverContext":
             // Only the built-in server flows leave `app.uid` unset.
             return "auth.uid() IS NULL";

package/src/util/policy/sqlToPolicy.ts

@@ -1,4 +1,4 @@
-import { ANONYMOUS_USER_ID, LiteralPolicyOperand, PolicyExpression, policy } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, LiteralPolicyOperand, PolicyExpression, policy } from "@rebasepro/types";
 
 /**
  * A tiny, regex-based SQL "parser" for security rules.
@@ -185,7 +185,12 @@ const UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
  * is how the trusted *server* context is recognised), so:
  *
  *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
- *  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+ *  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+ *    other. This one is not hypothetical and was not only a foreign habit:
+ *    rebase's own request path reported `'anon'` while everything that compiled
+ *    or checked a policy used `'anonymous'`, so whichever literal an author
+ *    picked, half the anonymous callers walked through. See
+ *    {@link ANONYMOUS_USER_IDS}.
  *
  * Either one turns a lockdown into a full grant, and neither looks wrong. No
  * real user id is ever one of these literals, and a user-context request is
@@ -231,7 +236,9 @@ export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[
                     detail: literal.value,
                     explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous ` +
                         `request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for ` +
-                        "every caller. Use `condition: policy.authenticated()` to mean \"signed in\"."
+                        "every caller. Use `condition: policy.authenticated()` to mean \"signed in\" — it " +
+                        `compiles to NOT IN (${ANONYMOUS_USER_IDS.map(v => `'${v}'`).join(", ")}), covering ` +
+                        "every spelling rebase has reported rather than whichever one you remember."
                 });
                 return;
             }

package/src/util/string-column-length.ts

@@ -0,0 +1,31 @@
+import type { StringProperty } from "@rebasepro/types";
+
+/**
+ * The length a bounded string column is declared with when the property does
+ * not say. Historical: it is what the DDL generator hardcoded, kept so that
+ * regenerating an existing schema does not silently redefine its columns.
+ */
+export const DEFAULT_STRING_COLUMN_LENGTH = 255;
+
+/**
+ * How wide a `varchar`/`char` column should be for a given property.
+ *
+ * One definition, three call sites, because they used to disagree. For the same
+ * `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+ * while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+ * reads as *unbounded* — so which of the two you ran decided whether the column
+ * had a limit at all. Introspection then dropped the length entirely, so reading
+ * an existing `character varying(500)` column back and regenerating it produced
+ * a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+ *
+ * `validation.max` is the property's own statement about how long the value may
+ * be, so it is the only sensible source for the column's width — and it keeps
+ * the constraint the database enforces in step with the one the app enforces,
+ * rather than inventing a second, different limit underneath it.
+ */
+export function resolveStringColumnLength(prop: Pick<StringProperty, "validation">): number {
+    const max = prop.validation?.max;
+    return typeof max === "number" && Number.isInteger(max) && max > 0
+        ? max
+        : DEFAULT_STRING_COLUMN_LENGTH;
+}