@rebasepro/common 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/util/policy/policyToPostgres.ts

@@ -1,4 +1,4 @@
-import { ANONYMOUS_USER_IDS, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
+import { ANONYMOUS_USER_IDS, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression, RLS_ROLES_SQL, RLS_UID_SQL, rewriteLegacyRlsFunctions } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
 import { getTableName } from "../relations";
 
@@ -70,7 +70,7 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
         case "not":
             return `NOT (${compile(expr.operand, scope)})`;
         case "compare": {
-            // `auth.uid()` returns text; cast the column side so uuid / integer
+            // `rebase.uid()` returns text; cast the column side so uuid / integer
             // id columns compare cleanly instead of failing with
             // "operator does not exist: uuid = text" at CREATE POLICY time.
             const castForAuthUid = (operand: PolicyOperand, sqlText: string, other: PolicyOperand): string =>
@@ -82,9 +82,9 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
             return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
         }
         case "rolesOverlap":
-            return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
+            return `string_to_array(${RLS_ROLES_SQL}, ',') && ${rolesArraySql(expr.roles)}`;
         case "rolesContain":
-            return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
+            return `string_to_array(${RLS_ROLES_SQL}, ',') @> ${rolesArraySql(expr.roles)}`;
         case "authenticated":
             // `IS NOT NULL` alone is a tautology on the user path: every
             // user-context request sets `app.uid`, and an anonymous one sets
@@ -96,19 +96,32 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
             // policy compiled here may be enforced against an older server that
             // still reports `'anon'`, which is exactly how excluding one
             // spelling turned this helper into a grant. See ANONYMOUS_USER_IDS.
-            return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
+            return `${RLS_UID_SQL} IS NOT NULL AND ${RLS_UID_SQL} NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
         case "serverContext":
             // Only the built-in server flows leave `app.uid` unset.
-            return "auth.uid() IS NULL";
+            return `${RLS_UID_SQL} IS NULL`;
         case "existsIn":
             return compileExistsIn(expr, scope);
-        case "raw":
+        case "raw": {
+            // A project written against a pre-1.0 release may still spell the
+            // helpers `auth.uid()`. Rewritten rather than rejected: the rule
+            // means exactly the same thing, the developer cannot be expected to
+            // have read a changelog mid-deploy, and the alternative is a policy
+            // that compiles cleanly and then denies every row at runtime because
+            // it calls a function that no longer exists.
+            //
+            // The counterpart is `warnOnLegacyRlsFunctions`, which says so once
+            // at boot with the file to edit — silence here would leave the old
+            // spelling working forever and make the migration permanent.
+            const sqlText = rewriteLegacyRlsFunctions(expr.sql);
+
             // Full-power escape hatch: `{column}` denotes a column of the outer
             // RLS row. It must be table-qualified, not bare: raw SQL may open its
             // own subquery over the same table, and there a bare name binds to the
             // inner scope, collapsing `m.x = {x}` into the tautology `m.x = m.x`.
-            return expr.sql.replace(/\{(\w+)\}/g, (_, col) =>
+            return sqlText.replace(/\{(\w+)\}/g, (_, col) =>
                 `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
+        }
     }
 }
 
@@ -156,9 +169,9 @@ function operandToSql(operand: PolicyOperand, scope: CompileScope): string {
         case "literal":
             return quoteLiteral(operand.value);
         case "authUid":
-            return "auth.uid()";
+            return RLS_UID_SQL;
         case "authRoles":
-            return "string_to_array(auth.roles(), ',')";
+            return `string_to_array(${RLS_ROLES_SQL}, ',')`;
     }
 }
 

package/src/util/policy/sqlToPolicy.ts

@@ -1,4 +1,5 @@
-import { ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, LiteralPolicyOperand, PolicyExpression, policy } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, ANONYMOUS_USER_IDS, LiteralPolicyOperand, PolicyExpression, policy, rewriteLegacyRlsFunctions } from "@rebasepro/types";
+import { toSnakeCase } from "@rebasepro/utils";
 
 /**
  * A tiny, regex-based SQL "parser" for security rules.
@@ -38,9 +39,9 @@ function isKeywordAt(upper: string, i: number, keyword: string): boolean {
  *
  * This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
  * `AND` inside
- *   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+ *   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = rebase.uid())`
  * split the expression, and re-emitting the halves produced
- *   `(EXISTS (...) AND m.user_id = auth.uid())`
+ *   `(EXISTS (...) AND m.user_id = rebase.uid())`
  * where `m` is no longer in scope — SQL that Postgres rejects outright with
  * "missing FROM-clause entry for table". Returning null instead keeps such a
  * clause as a `raw` expression, which round-trips verbatim.
@@ -107,22 +108,32 @@ function stripOuterParens(sql: string): string {
 }
 
 export function sqlToPolicy(sql: string): PolicyExpression {
-    const trimmed = stripOuterParens(sql.trim());
+    // Normalised before anything else looks at it, so every pattern below only
+    // has to know the current spelling. A database migrated by a pre-1.0 release
+    // still holds `auth.uid()` in its policy bodies until the next push or boot
+    // recompiles them — and until then the admin UI reads those bodies back
+    // through here. Without this they parse as opaque `raw`, and the framework's
+    // own policies get badged as hand-written drift.
+    //
+    // Normalising rather than accepting both spellings throughout is deliberate:
+    // it also means a legacy policy that falls through to `raw` is stored in the
+    // new spelling, so editing and saving one in the Studio migrates it.
+    const trimmed = stripOuterParens(rewriteLegacyRlsFunctions(sql).trim());
 
     if (trimmed.toLowerCase() === "true") return policy.true();
     if (trimmed.toLowerCase() === "false") return policy.false();
 
     // Handle roles overlap (&&)
-    // Matches: string_to_array(auth.roles(), ',') && ARRAY['admin', 'editor']
-    const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
+    // Matches: string_to_array(rebase.roles(), ',') && ARRAY['admin', 'editor']
+    const overlapMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\s*\[(.+)\]$/i);
     if (overlapMatch) {
         const roles = overlapMatch[1].split(",").map(s => s.trim().replace(/^'|'$/g, ""));
         return policy.rolesOverlap(roles);
     }
 
     // Handle roles containment (@>)
-    // Matches: string_to_array(auth.roles(), ',') @> ARRAY['admin']
-    const containMatch = trimmed.match(/^string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
+    // Matches: string_to_array(rebase.roles(), ',') @> ARRAY['admin']
+    const containMatch = trimmed.match(/^string_to_array\s*\(\s*rebase\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\s*\[(.+)\]$/i);
     if (containMatch) {
         const roles = containMatch[1].split(",").map(s => s.trim().replace(/^'|'$/g, ""));
         return policy.rolesContain(roles);
@@ -146,12 +157,15 @@ export function sqlToPolicy(sql: string): PolicyExpression {
         }
     }
 
-    // Fallback to raw
-    return policy.raw(sql);
+    // Fallback to raw — the NORMALISED text, not the input. Storing the input
+    // verbatim would mean a legacy policy read out of a database, edited in the
+    // Studio and saved, writes `auth.uid()` back into the project's config: a
+    // call to a function 1.0 no longer creates.
+    return policy.raw(trimmed);
 }
 
 /**
- * Literals from other BaaS platforms that people compare `auth.uid()` against
+ * Literals from other BaaS platforms that people compare `rebase.uid()` against
  * out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
  * `pgRoles`, one surface over: the same muscle memory inside a `using:` string
  * is the more dangerous spelling, because it inverts a rule instead of
@@ -173,19 +187,26 @@ export interface AnonymousGrantRisk {
     explanation: string;
 }
 
-/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
-const UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+/**
+ * `rebase.uid() IS NOT NULL` in raw SQL, the clause that is always true.
+ *
+ * Both schema spellings, because this runs over policy bodies read back from a
+ * database, and one migrated by a pre-1.0 release still holds `auth.uid()`.
+ * A security check that stops recognising a dangerous clause because the
+ * framework renamed a function is a check that silently turns off.
+ */
+const UID_NOT_NULL = /\b(?:rebase|auth)\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 
 /**
  * Find clauses that read as "signed-in users only" but admit anonymous callers.
  *
- * Both spellings come from the same place — Supabase, where `auth.uid()` really
- * is NULL for an anonymous request. Rebase substitutes
+ * Both spellings come from the same place — Supabase, where its own `auth.uid()`
+ * really is NULL for an anonymous request. Rebase substitutes
  * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
  * is how the trusted *server* context is recognised), so:
  *
- *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
- *  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+ *  - `rebase.uid() IS NOT NULL` is a tautology on the user path, and
+ *  - `rebase.uid() != 'anon'` excludes one spelling of anonymous and admits the
  *    other. This one is not hypothetical and was not only a foreign habit:
  *    rebase's own request path reported `'anon'` while everything that compiled
  *    or checked a policy used `'anonymous'`, so whichever literal an author
@@ -219,7 +240,7 @@ export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[
                     found.push({
                         pattern: "uid-not-null",
                         detail: e.sql,
-                        explanation: "`auth.uid() IS NOT NULL` is true for every request that came from a client, " +
+                        explanation: "`rebase.uid() IS NOT NULL` is true for every request that came from a client, " +
                             `including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. ` +
                             "Use `condition: policy.authenticated()` to mean \"signed in\"."
                     });
@@ -252,24 +273,104 @@ export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[
 }
 
 function parseOperand(str: string) {
-    // current_setting('app.uid') or auth.uid(). `app.user_id` is the
+    // current_setting('app.uid') or rebase.uid(). `app.user_id` is the
     // pre-rename spelling and stays parseable: policies are data, so a
     // database provisioned before the rename still holds rules written
     // against it, and round-tripping one must not silently drop the operand.
-    if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {
+    //
+    // ANCHORED, and that is the whole point. These tests used to be
+    // unanchored — `.test(str)` rather than `^…$` — so any operand text that
+    // merely *contained* a uid call was replaced wholesale by the call itself.
+    // Everything else in the expression was discarded with it, including a
+    // leading `NOT (`:
+    //
+    //   NOT (rebase.uid() = rebase.uid())   parsed as   rebase.uid() = rebase.uid()
+    //
+    // A deny became an unconditional grant. The realistic spelling is a
+    // hand-written defensive rule with a uid call on both sides —
+    //   COALESCE(rebase.uid(), '') = COALESCE(owner_id, rebase.uid())
+    // — which collapsed to the same tautology. This is not confined to the
+    // admin UI: `securityRuleToConditions` feeds a rule's raw `using:` string
+    // through here, and the Postgres DDL generators compile the result, so the
+    // tautology was written into the database as the policy body.
+    //
+    // An operand this cannot identify exactly must return null, which drops the
+    // whole clause to `raw` and reproduces it verbatim. That is the rule the
+    // rest of this file already follows: when in doubt, prefer `raw`.
+    if (/^current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)$/i.test(str) || /^rebase\.uid\(\)$/i.test(str)) {
         return policy.authUid();
     }
 
-    // Literal string: 'value'
-    const stringMatch = str.match(/^'(.+)'$/);
-    if (stringMatch) {
-        return policy.literal(stringMatch[1]);
+    // Literal string: 'value', with `''` decoded back to a single quote.
+    //
+    // `quoteLiteral` doubles every quote on the way out, and this did not undo
+    // it, so a literal containing an apostrophe grew on every trip: O'Brien →
+    // O''Brien → O''''Brien, doubling each time a policy was read back and
+    // recompiled. Past the first trip the emitted policy compares against a
+    // string no row holds.
+    const literal = parseSingleQuoted(str);
+    if (literal !== null) {
+        return policy.literal(literal);
     }
 
-    // Bare field name
-    if (/^\w+$/.test(str)) {
+    // Unquoted literals, which must be recognised BEFORE the bare-word branch
+    // below or they are read as column names.
+    //
+    // `quoteLiteral` emits booleans, numbers and null unquoted, so `a = false`
+    // came back as a comparison against a *field* called `false`, and `a = 42`
+    // against a field called `42`. The recompiled SQL is identical either way,
+    // which is why this survived a round-trip check on the SQL — but the
+    // expression is now wrong, and the expression is what the admin UI
+    // evaluates. Against a row with no `a`, Postgres denies (`NULL = false` is
+    // not true) while the JS evaluator compared two missing columns, found them
+    // equal, and allowed. That is precisely the client/database drift the
+    // shared PolicyExpression model exists to make impossible.
+    //
+    // Unambiguous in both directions: a SQL identifier cannot begin with a
+    // digit, and bare `true`/`false`/`null` are always the literals — a column
+    // so named would have to be double-quoted to be referenced at all.
+    if (/^-?\d+$/.test(str)) return policy.literal(Number(str));
+    if (/^-?\d*\.\d+$/.test(str)) return policy.literal(Number(str));
+    if (/^true$/i.test(str)) return policy.literal(true);
+    if (/^false$/i.test(str)) return policy.literal(false);
+    if (/^null$/i.test(str)) return policy.literal(null);
+
+    // Bare field name — but only one that survives the snake-casing the
+    // compiler will apply to it. `toSnakeCase("_")` is the empty string, and a
+    // field that compiles to an empty column reference emits `= 'x'`, which is
+    // a syntax error at CREATE POLICY time. Such a name is left to `raw`, where
+    // it round-trips verbatim instead. `toSnakeCase` itself is not touched:
+    // column names derived by it are already in shipped databases.
+    if (/^\w+$/.test(str) && toSnakeCase(str) !== "") {
         return policy.field(str);
     }
 
     return null;
 }
+
+/**
+ * Decode a single-quoted SQL literal, or null when `str` is not exactly one.
+ *
+ * Rejecting is as important as decoding: `'a' = 'b'` is two literals and an
+ * operator, not one literal whose body contains a quote, and a regex anchored
+ * on the outer quotes would happily read it as the latter. Every interior quote
+ * must therefore be part of a `''` pair.
+ */
+function parseSingleQuoted(str: string): string | null {
+    if (str.length < 2 || !str.startsWith("'") || !str.endsWith("'")) return null;
+    const body = str.slice(1, -1);
+    let out = "";
+    for (let i = 0; i < body.length; i++) {
+        if (body[i] !== "'") {
+            out += body[i];
+            continue;
+        }
+        if (body[i + 1] === "'") {
+            out += "'";
+            i++;
+            continue;
+        }
+        return null; // a bare quote — `str` is not a single literal
+    }
+    return out;
+}

package/src/util/relations.ts

@@ -66,6 +66,37 @@ export function resolveCollectionRelations(
     return relations;
 }
 
+/**
+ * The path of the collection a relation property points at, derived from the
+ * property alone.
+ *
+ * A preview holds a property and a value and no collection, so it cannot call
+ * `resolveRelationProperty`. It does not need to: both forms that carry a
+ * target — the stamped `resolvedRelation` and the inline `relation` — name it
+ * directly. Only the third form, a relation declared by name in the
+ * collection's `relations` array, is out of reach, and that one has no target
+ * to read without the collection anyway.
+ *
+ * This is what lets a preview render a relation column that arrived as a bare
+ * foreign key: the id says *which* row, the declared target says *which
+ * collection*, and `RelationPreview` fetches the rest. Without it a scalar id
+ * is indistinguishable from a value of the wrong type.
+ */
+export function getRelationTargetPath(property: RelationProperty): string | undefined {
+    const stamped = property.resolvedRelation?.targetSlug;
+    if (stamped) return stamped;
+
+    const target = property.relation?.target;
+    if (typeof target !== "function") return undefined;
+    try {
+        return target()?.slug;
+    } catch (_e) {
+        // A thunk reaching into a module that has not finished initialising:
+        // there is no target to name yet, and a preview is not worth throwing over.
+        return undefined;
+    }
+}
+
 export function getTableName(collection: CollectionConfig): string {
     if (isRelationalCollectionConfig(collection)) {
         return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);

package/src/util/resolutions.ts

@@ -261,11 +261,11 @@ export function resolveArrayProperties<M>({
                 ignoreMissingFields,
                 ...props
             });
-            const {
-                values,
-                previousValues,
-                ...rest
-            } = props;
+            // Destructured to be *excluded* from `...rest`, not to be used —
+            // see the comment below. Said explicitly so the discarded-value
+            // ratchet does not carry a finding that is working as intended.
+            // eslint-disable-next-line @typescript-eslint/no-unused-vars
+            const { values, previousValues, ...rest } = props;
             const ofProperty = resolveProperty({ // we don't want to pass the values of the parent entity
                 property: of,
                 ignoreMissingFields,
@@ -449,6 +449,78 @@ singularName: customName } : {})
     return views;
 }
 
+/**
+ * Each of `collection`'s tabs paired with the property that declared it, when a
+ * property declared it: child view key → property key.
+ *
+ * A many-relation can only be declared as a property — that is the documented
+ * and only mechanism — and {@link getEntityChildViews} promotes it to a tab. So
+ * one declaration reaches the panel twice, and neither surface knew about the
+ * other. The form rendered a relation picker beside the tab, and the collection
+ * table rendered *two* columns under one heading: the relation's own column,
+ * showing the child rows, and a jump-to-tab button carrying the same name.
+ *
+ * The pairing is what lets each surface decide which half is redundant, and it
+ * has to be a pairing rather than two sets because the two keys differ whenever
+ * a relation is named. The match is on the resolved `relationName` — the
+ * identity `getEntityChildViews` itself dedupes on — so a relation declared in
+ * `relations` and pointed at by a differently-named property is recognised too.
+ *
+ * A relation with no property of its own is absent here, which is the point: it
+ * has exactly one surface already, and nothing to weigh it against.
+ *
+ * Only top-level properties: a relation nested inside a `map` gets no tab.
+ */
+export function getChildViewDeclaringProperties<M extends Record<string, unknown> = Record<string, unknown>>(
+    collection: CollectionConfig<M>
+): Map<string, string> {
+    const pairs = new Map<string, string>();
+
+    const relationProperties = Object.entries((collection.properties ?? {}) as Record<string, Property>)
+        .filter(([, property]) => property?.type === "relation");
+    if (relationProperties.length === 0) return pairs;
+
+    const relationViews = getEntityChildViews(collection)
+        .filter(view => view.source.kind === "relation");
+    if (relationViews.length === 0) return pairs;
+
+    const resolvedRelations = resolveCollectionRelations(collection);
+    const identityOf = (relationKey: string): string =>
+        resolvedRelations[relationKey]?.relationName ?? relationKey;
+
+    const declaringPropertyByIdentity = new Map<string, string>();
+    for (const [propertyKey, property] of relationProperties) {
+        const relation = (property as RelationProperty).resolvedRelation ?? resolvedRelations[propertyKey];
+        // A to-one relation is a foreign key the author edits, never a tab. No
+        // view will match it — the views here are many-relations only — but
+        // reading the cardinality says so where someone is looking.
+        if (relation?.cardinality !== "many") continue;
+        const identity = relation.relationName ?? propertyKey;
+        if (!declaringPropertyByIdentity.has(identity)) declaringPropertyByIdentity.set(identity, propertyKey);
+    }
+
+    for (const view of relationViews) {
+        const propertyKey = declaringPropertyByIdentity.get(
+            identityOf((view.source as { relationKey: string }).relationKey));
+        if (propertyKey) pairs.set(view.key, propertyKey);
+    }
+
+    return pairs;
+}
+
+/**
+ * The property keys of `collection` whose relation is already one of its tabs.
+ *
+ * What a form asks: the tab is the treatment for a list of child rows, so the
+ * picker beside it is the redundant half. See
+ * {@link getChildViewDeclaringProperties}.
+ */
+export function getChildViewRelationPropertyKeys<M extends Record<string, unknown> = Record<string, unknown>>(
+    collection: CollectionConfig<M>
+): Set<string> {
+    return new Set(getChildViewDeclaringProperties(collection).values());
+}
+
 /**
  * The child views of `collection` as bare collections.
  *