@rebasepro/common 0.12.1-canary.gf5f1d39 → 0.13.0

package/dist/index.es.js

@@ -1,5 +1,5 @@
-import { ANONYMOUS_USER_ID, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, isManyToMany, isPostgresCollectionConfig, isRelationalCollectionConfig, policy, toCanonicalOp } from "@rebasepro/types";
-import { deepClone, generateForeignKeyName, getIn, getPolicyOperations, isDefaultFieldConfigId, mergeDeep, prettifyIdentifier, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
+import { ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, CANONICAL_TO_REST, DEFAULT_DATA_SOURCE_KEY, EntityReference, EntityRelation, NULL_OPS, REST_TO_CANONICAL, getDataSourceCapabilities, getDeclaredSubcollections, isAnonymousUid, isManyToMany, isPostgresCollectionConfig, isRelationalCollectionConfig, policy, toCanonicalOp } from "@rebasepro/types";
+import { deepClone, generateForeignKeyName, getIn, getPolicyNamesForRules, getPolicyOperations, isDefaultFieldConfigId, mergeDeep, prettifyIdentifier, randomString, removeFunctions, toSnakeCase } from "@rebasepro/utils";
 import jsonLogic from "json-logic-js";
 import { deepEqual } from "fast-equals";
 //#region src/util/common.ts
@@ -226,6 +226,34 @@ function getPrimaryKeys(collection) {
 //#region src/util/identity.ts
 /** Separator between the parts of a composite address. */
 var COMPOSITE_ID_SEPARATOR = ":::";
+/** The eight-four-four-four-twelve shape of a UUID, any version. */
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Whether one address part can be a value of the column it addresses. */
+function partIsAddressable(part, pk) {
+	if (pk.isUUID) return UUID_PATTERN.test(String(part));
+	if (pk.type === "number") return typeof part === "number" ? Number.isFinite(part) : !isNaN(parseInt(String(part), 10));
+	return true;
+}
+/**
+* Whether an address could name a row at all, before asking the database.
+*
+* A `uuid` column cannot hold `"new"`, and an `integer` column cannot hold
+* `"abc"` — so the answer to "which row is this" is "none", and that is a 404,
+* not a failure. Postgres cannot say so politely: the comparison never runs, it
+* raises `22P02` and aborts the enclosing transaction, after which every
+* further statement returns the far less helpful `25P02`.
+*
+* `isUUID` must come from the column, not from `isId: "uuid"` in a config: the
+* config is a claim about a key, and a `text` column that holds ids of some
+* other shape is a working app this must not start rejecting.
+*/
+function isAddressableId(idValue, primaryKeys) {
+	if (primaryKeys.length === 0) return false;
+	if (primaryKeys.length === 1) return partIsAddressable(idValue, primaryKeys[0]);
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) return false;
+	return parts.every((part, i) => partIsAddressable(part, primaryKeys[i]));
+}
 /**
 * Derive a row's address from its key columns.
 *
@@ -330,6 +358,39 @@ function resolvePrimaryKeys(collection) {
 	return [];
 }
 //#endregion
+//#region src/util/email.ts
+/**
+* Email normalization — one implementation, because the database enforces it.
+*
+* `ensureAuthTablesExist` puts a `UNIQUE INDEX ON users (lower(email))` on the
+* auth table. That index decides what "the same address" means, and it does not
+* trim: to Postgres, `' foo@bar.com'` and `'foo@bar.com'` are two addresses and
+* both may exist. So every write that reaches the column has to agree with
+* every read, exactly, or the two disagree in the one direction that matters —
+* a row that exists and cannot be found.
+*
+* That is not hypothetical. The lookup path trimmed and the admin create paths
+* did not, so a user created through `POST /api/data/users` or
+* `POST /api/auth/admin/users` with a stray space was stored untrimmed,
+* survived the unique index alongside the real address, and was unreachable by
+* login forever after. The HTTP auth routes were unaffected only because Zod's
+* `.email()` happens to reject surrounding whitespace — a guard on a different
+* layer, for a different reason, that the admin paths do not sit behind.
+*
+* It lives in `common` because `server`, `server-postgres` and `server-mongo`
+* all write this column and must agree exactly, and `common` is the only
+* package all three already depend on.
+*/
+/**
+* Canonical form of an email address: trimmed, lower-cased.
+*
+* Non-strings pass through untouched, so this is safe to apply to a value out
+* of a partial update payload whose type is not known yet.
+*/
+function normalizeEmail(email) {
+	return typeof email === "string" ? email.trim().toLowerCase() : email;
+}
+//#endregion
 //#region src/util/enums.ts
 function enumToObjectEntries(enumValues) {
 	if (Array.isArray(enumValues)) return enumValues;
@@ -393,8 +454,7 @@ function fullPathToCollectionSegments(path) {
 function resolveRelation(relation, sourceCollection, propertyKey) {
 	const target = relation.target;
 	if (typeof target !== "function") throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has no \`target\`. Give it a thunk: \`target: () => otherCollection\`.`);
-	const targetCollection = target();
-	if (!targetCollection?.slug) throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has a \`target\` that did not resolve to a collection.`);
+	const targetCollection = callTarget(relation, sourceCollection, propertyKey, target);
 	const relationName = relation.relationName ?? propertyKey ?? toSnakeCase(targetCollection.slug);
 	const shared = {
 		relationName,
@@ -421,7 +481,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "one",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "hasMany": return {
 			...shared,
@@ -429,7 +490,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "many",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "manyToMany": {
 			const sourceTable = getTableName(sourceCollection);
@@ -458,6 +520,43 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 		default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 	}
 }
+/** How this relation is addressed in an error message, before it has a resolved name. */
+function describe(relation, sourceCollection, propertyKey) {
+	const name = relation.relationName ?? propertyKey;
+	return `Relation${name ? ` '${name}'` : ""} on '${sourceCollection.slug}'`;
+}
+/**
+* Call the `target` thunk, and translate the two ways an import cycle breaks it
+* into an error that names the cause.
+*
+* The thunk exists to defer the reference until every module has finished
+* evaluating, and for a cycle that closes at import time it does. What it cannot
+* defer is a cycle that leaves the binding permanently unusable, and there are
+* two shapes of that:
+*
+*  - **ESM/TDZ.** `const` and `class` bindings in a not-yet-evaluated module are
+*    in the temporal dead zone, so reading one throws `ReferenceError: x is not
+*    defined`. The stack points at the thunk — a one-line arrow function that is
+*    obviously fine — and says nothing about the cycle that made it throw.
+*  - **CJS interop.** The half-initialised module object has no `default` yet,
+*    the import resolves to `undefined`, and the thunk returns it without
+*    complaint. That one used to surface here as "did not resolve to a
+*    collection", which is true and unhelpful.
+*
+* Both mean the same thing, and the fix for both is the same: break the cycle,
+* or move the relation into the collection that does not close it.
+*/
+function callTarget(relation, sourceCollection, propertyKey, target) {
+	let targetCollection;
+	try {
+		targetCollection = target();
+	} catch (error) {
+		if (error instanceof ReferenceError) throw new Error(`${describe(relation, sourceCollection, propertyKey)} targets a collection that is not initialized yet — almost always an import cycle between the two collection files. Break the cycle (move the shared piece into a third module, or import the target lazily) so the target's module finishes evaluating before the registry is built.`, { cause: error });
+		throw error;
+	}
+	if (!targetCollection?.slug) throw new Error(`${describe(relation, sourceCollection, propertyKey)} has a \`target\` that resolved to ${targetCollection === void 0 ? "`undefined`" : "something that is not a collection"}. ` + (targetCollection === void 0 ? "Under CommonJS interop an import cycle resolves the default import to `undefined`, so check whether this collection and its target import each other. Otherwise the thunk is returning the wrong value — it must return the collection itself, not a promise or a module." : "The thunk must return a collection config with a `slug`."));
+	return targetCollection;
+}
 //#endregion
 //#region src/util/relations.ts
 /**
@@ -957,7 +1056,12 @@ var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 * is how the trusted *server* context is recognised), so:
 *
 *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
-*  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+*  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+*    other. This one is not hypothetical and was not only a foreign habit:
+*    rebase's own request path reported `'anon'` while everything that compiled
+*    or checked a policy used `'anonymous'`, so whichever literal an author
+*    picked, half the anonymous callers walked through. See
+*    {@link ANONYMOUS_USER_IDS}.
 *
 * Either one turns a lockdown into a full grant, and neither looks wrong. No
 * real user id is ever one of these literals, and a user-context request is
@@ -995,7 +1099,7 @@ function findAnonymousGrants(expr) {
 				found.push({
 					pattern: "foreign-uid-literal",
 					detail: literal.value,
-					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in" — it compiles to NOT IN (${ANONYMOUS_USER_IDS.map((v) => `'${v}'`).join(", ")}), covering every spelling rebase has reported rather than whichever one you remember.`
 				});
 				return;
 			}
@@ -1090,7 +1194,7 @@ function compile(expr, scope) {
 		}
 		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
 		case "serverContext": return "auth.uid() IS NULL";
 		case "existsIn": return compileExistsIn(expr, scope);
 		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
@@ -1187,7 +1291,7 @@ function evaluatePolicy(expr, ctx) {
 			const userRoles = ctx.roles ?? [];
 			return expr.roles.every((r) => r === "public" || userRoles.includes(r));
 		}
-		case "authenticated": return ctx.uid != null && ctx.uid !== ANONYMOUS_USER_ID;
+		case "authenticated": return ctx.uid != null && !isAnonymousUid(ctx.uid);
 		case "serverContext": return false;
 		case "existsIn": return "unknown";
 		case "raw": return "unknown";
@@ -1356,35 +1460,12 @@ function canDeleteEntity(collection, authContext, path, entity) {
 //#endregion
 //#region src/util/builders.ts
 /**
-* @deprecated Use {@link defineCollection} instead — it infers property
-* types automatically (autocomplete on `titleProperty`, `sort`,
-* `propertiesOrder`, callbacks) without manual generics.
-* `buildCollection` is kept for FireCMS migration compatibility and will
-* be removed before 1.0.
-*
-* @group Builder
-*/
-function buildCollection(collection) {
-	return collection;
-}
-/**
 * Implementation — delegates to the correct overload at the type level.
 * At runtime this is a plain identity function.
 */
 function defineCollection(collection) {
 	return collection;
 }
-/**
-* @deprecated Use plain typed property objects with {@link defineCollection}
-* instead — `defineCollection` infers property types automatically, making
-* this wrapper unnecessary. `buildProperty` is kept for FireCMS migration
-* compatibility and will be removed before 1.0.
-*
-* @group Builder
-*/
-function buildProperty(property) {
-	return property;
-}
 //#endregion
 //#region src/util/storage.ts
 /**
@@ -1653,6 +1734,26 @@ function getInjectedSecurityRules(collection) {
 	const explicitCount = (collection.securityRules ?? []).length;
 	return getEffectiveSecurityRules(collection).slice(explicitCount);
 }
+/**
+* Every policy name `rebase db push` would write for a collection.
+*
+* This is the answer to "did the codebase produce this live policy?", and it is
+* more than `securityRules.map(r => r.name)` for two reasons:
+*
+*  - a rule without an explicit `name` compiles to `<table>_<op>_<hash>`, one
+*    per operation, so comparing `rule.name` to `policyname` never matches it;
+*  - the generator also injects the safe-by-default baseline
+*    (`<table>_default_admin_*`), which is in no collection's `securityRules`.
+*
+* Every UI that flags drift has to get both right, and each one that derived it
+* by hand got a different subset — which is how four policies *Rebase itself
+* wrote* came to be badged as hand-written drift on every table in a project,
+* with a button offering to import them back into the codebase that produced
+* them. There is one derivation now, and this is it.
+*/
+function getGeneratedPolicyNames(collection) {
+	return getPolicyNamesForRules(getEffectiveSecurityRules(collection), getTableName(collection));
+}
 //#endregion
 //#region src/util/junction-policies.ts
 var SERVER_OR_ADMIN_EXPR = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
@@ -1952,7 +2053,7 @@ function buildConditionContext(params) {
 * Maps a PostgreSQL column data type to a Rebase property type.
 */
 function pgTypeToRebaseProperty(column) {
-	const { column_name, data_type, udt_name, is_nullable, column_default, enum_values } = column;
+	const { column_name, data_type, udt_name, is_nullable, column_default, character_maximum_length, enum_values } = column;
 	const required = is_nullable === "NO";
 	const prettifiedName = prettifyIdentifier(column_name);
 	const isAutoId = column_default != null && (column_default.includes("nextval") || column_default.includes("gen_random_uuid") || column_default.includes("uuid_generate") || column_default.includes("identity"));
@@ -1976,11 +2077,15 @@ function pgTypeToRebaseProperty(column) {
 			let colType = "varchar";
 			if (dt === "text" || dt === "citext") colType = "text";
 			if (dt === "char" || dt === "character") colType = "char";
+			const declaredLength = colType === "text" ? null : character_maximum_length;
 			const prop = {
 				type: "string",
 				name: prettifiedName,
 				columnType: colType,
-				validation: required ? { required: true } : void 0
+				validation: required || declaredLength ? {
+					...required ? { required: true } : {},
+					...declaredLength ? { max: declaredLength } : {}
+				} : void 0
 			};
 			if (isAutoId) prop.isId = "manual";
 			return prop;
@@ -2184,6 +2289,34 @@ function buildCollectionFromTableMetadata(tableName, metadata) {
 	};
 }
 //#endregion
+//#region src/util/string-column-length.ts
+/**
+* The length a bounded string column is declared with when the property does
+* not say. Historical: it is what the DDL generator hardcoded, kept so that
+* regenerating an existing schema does not silently redefine its columns.
+*/
+var DEFAULT_STRING_COLUMN_LENGTH = 255;
+/**
+* How wide a `varchar`/`char` column should be for a given property.
+*
+* One definition, three call sites, because they used to disagree. For the same
+* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+* reads as *unbounded* — so which of the two you ran decided whether the column
+* had a limit at all. Introspection then dropped the length entirely, so reading
+* an existing `character varying(500)` column back and regenerating it produced
+* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+*
+* `validation.max` is the property's own statement about how long the value may
+* be, so it is the only sensible source for the column's width — and it keeps
+* the constraint the database enforces in step with the one the app enforces,
+* rather than inventing a second, different limit underneath it.
+*/
+function resolveStringColumnLength(prop) {
+	const max = prop.validation?.max;
+	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
+}
+//#endregion
 //#region src/data/resolveDataSource.ts
 /**
 * Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -3150,7 +3283,7 @@ function rowToEntity(row, slug, primaryKeys = []) {
 	};
 }
 /**
-* The relation envelope `toCmsRow` writes where a relation was:
+* The relation envelope `toFlatRow` writes where a relation was:
 * `{ id, path, __type: "relation", data: { id, path, values } }`. It is the
 * admin's view-model, and the only pipeline that produces one is postgres'.
 */
@@ -3773,6 +3906,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, RebasePaginationError, and, buildCollection, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildProperty, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, normalizeToEntityRelation, or, paginateFind, parseIdValues, policyToPostgres, registerConditionOperations, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, sqlToPolicy, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, JUNCTION_TABLES_SQL, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, RebasePaginationError, and, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, defaultUsersCollection, defineCollection, deserializeFilter, deserializeLogicalCondition, deserializeOrderBy, detectJunctionTables, embedParentExpression, enumToObjectEntries, evaluateCondition, evaluatePolicy, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getSubcollections, getTableName, getTableVarName, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, normalizeEmail, normalizeToEntityRelation, or, paginateFind, parseIdValues, policyToPostgres, registerConditionOperations, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeLogicalCondition, serializeOrderBy, sortProperties, sqlToPolicy, stripCollectionPath, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map