@rebasepro/common 0.15.0 → 0.16.0

package/dist/util/policy/evaluatePolicy.d.ts

@@ -18,7 +18,7 @@ export interface PolicyEvalContext {
      *
      * Null here means *anonymous visitor*, not "server context" — a client is
      * never the server context. `authUid` operands therefore resolve to
-     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `auth.uid()`
+     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `rebase.uid()`
      * the database would see for the same request.
      */
     uid?: string | null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Rebase shared core — collection registry, data driver adapter and fluent query builder. No React dependency.",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -40,8 +40,8 @@
   "dependencies": {
     "fast-equals": "6.0.2",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/types": "0.15.0",
-    "@rebasepro/utils": "0.15.0"
+    "@rebasepro/utils": "0.16.0",
+    "@rebasepro/types": "0.16.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",

package/src/util/auth-default-policies.ts

@@ -30,7 +30,7 @@ import { getPolicyNamesForRules } from "@rebasepro/utils";
  * rows").
  *
  * **For auth collections additionally**
- *  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+ *  3. A permissive **self SELECT** grant (`id = rebase.uid()`), so users can read
  *     their own row (profile, session bootstrap) without every app re-declaring
  *     it.
  *  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
@@ -39,7 +39,7 @@ import { getPolicyNamesForRules } from "@rebasepro/utils";
  *     such as "a user may edit their own row". Without this, a permissive owner
  *     rule would let a user change their own `roles`.
  *
- * The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+ * The server context is recognised as `rebase.uid() IS NULL` (`policy.serverContext()`)
  * — the built-in flows that run without a user (signup, migrations) set no user
  * GUC — which also lets the owner connection satisfy these policies even under
  * FORCE RLS. A *user* request never reaches that state: an anonymous one carries
@@ -51,7 +51,7 @@ import { getPolicyNamesForRules } from "@rebasepro/utils";
 // Expressed structurally (not as raw SQL) so the admin UI can evaluate it
 // exactly — the framework's most security-critical policies must be reflected
 // precisely, not left as un-evaluable raw clauses. Compiles to
-// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+// `rebase.uid() IS NULL OR (string_to_array(rebase.roles(), ',') && ARRAY['admin'])`.
 //
 // `serverContext()`, emphatically not `not(authenticated())`: the server arm of
 // this grant must match the server context and nothing else. Anonymous visitors

package/src/util/pg-column-to-property.ts

@@ -1,3 +1,4 @@
+import { rewriteLegacyRlsFunctions } from "@rebasepro/types";
 import type {
     ArrayProperty,
     NumberProperty,
@@ -337,8 +338,14 @@ export function buildCollectionFromTableMetadata(
                 case "UPDATE": operations = ["update"]; break;
                 case "DELETE": operations = ["delete"]; break;
             }
-            const qual = policy.qual ?? undefined;
-            const withCheck = policy.with_check ?? undefined;
+            // Normalised on the way in, the same way `sqlToPolicy` normalises
+            // what the admin UI reads back. Without it, importing a table from a
+            // database provisioned before 1.0 copies `auth.uid()` straight into
+            // the project's config — a call to a function the framework no
+            // longer creates, which then boots with a legacy-helper warning
+            // forever and holds the `auth` schema open.
+            const qual = policy.qual ? rewriteLegacyRlsFunctions(policy.qual) : undefined;
+            const withCheck = policy.with_check ? rewriteLegacyRlsFunctions(policy.with_check) : undefined;
             if (qual) {
                 securityRules.push({
                     name: policy.policy_name,

package/src/util/policy/evaluatePolicy.ts

@@ -20,7 +20,7 @@ export interface PolicyEvalContext {
      *
      * Null here means *anonymous visitor*, not "server context" — a client is
      * never the server context. `authUid` operands therefore resolve to
-     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `auth.uid()`
+     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `rebase.uid()`
      * the database would see for the same request.
      */
     uid?: string | null;
@@ -68,7 +68,7 @@ export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext):
             return ctx.uid != null && !isAnonymousUid(ctx.uid);
         case "serverContext":
             // A client is never the server context. Postgres decides this by
-            // `auth.uid() IS NULL`, which a client request can never produce:
+            // `rebase.uid() IS NULL`, which a client request can never produce:
             // the driver substitutes ANONYMOUS_USER_ID for a missing id.
             return false;
         case "existsIn":
@@ -108,10 +108,10 @@ function resolveOperand(operand: PolicyOperand, ctx: PolicyEvalContext): Resolve
         case "literal":
             return { known: true, value: operand.value };
         case "authUid":
-            // The sentinel, not null: `auth.uid()` is never NULL for a request
+            // The sentinel, not null: `rebase.uid()` is never NULL for a request
             // that came from a client, so comparing against null here would
             // disagree with the database on exactly the rules that test for it
-            // (e.g. `auth.uid() <> 'anonymous'`).
+            // (e.g. `rebase.uid() <> 'anonymous'`).
             return { known: true, value: ctx.uid ?? ANONYMOUS_USER_ID };
         case "authRoles":
             return { known: true, value: ctx.roles ?? [] };