@rebasepro/common 0.16.0 → 0.16.1-canary.g0d7af95

package/dist/util/index.d.ts

@@ -1,21 +1,21 @@
-export * from "./collections";
-export * from "./common";
-export * from "./entities";
-export * from "./identity";
-export * from "./email";
-export * from "./enums";
-export * from "./paths";
-export * from "./resolutions";
-export * from "./policy";
-export * from "./permissions";
-export * from "./builders";
-export * from "./storage";
-export * from "./callbacks";
-export * from "./relations";
-export * from "./resolve-relation";
-export * from "./auth-default-policies";
-export * from "./junction-policies";
-export * from "./conditions";
-export * from "./pg-column-to-property";
-export * from "./string-column-length";
-export * from "./internal-tables";
+export * from "./collections.js";
+export * from "./common.js";
+export * from "./entities.js";
+export * from "./identity.js";
+export * from "./email.js";
+export * from "./enums.js";
+export * from "./paths.js";
+export * from "./resolutions.js";
+export * from "./policy/index.js";
+export * from "./permissions.js";
+export * from "./builders.js";
+export * from "./storage.js";
+export * from "./callbacks.js";
+export * from "./relations.js";
+export * from "./resolve-relation.js";
+export * from "./auth-default-policies.js";
+export * from "./junction-policies.js";
+export * from "./conditions.js";
+export * from "./pg-column-to-property.js";
+export * from "./string-column-length.js";
+export * from "./internal-tables.js";

package/dist/util/internal-tables.d.ts

@@ -62,6 +62,15 @@ export declare const REBASE_USER_ROLE = "rebase_user";
  *
  * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
  * because `db migrate apply` passes `--revisions-schema rebase`.
+ *
+ * Every entry here must also be revoked by whatever creates it, and vice versa:
+ * the creation-time revoke fires once, on the boot that first makes the table,
+ * so it cannot help a database provisioned before that revoke existed. This
+ * list is what the boot-time sweep in `ensureAppRole` iterates, and the sweep
+ * is the only thing that can repair an already-granted table. A table revoked
+ * at creation but missing here is therefore permanently stranded on any
+ * database that predates its revoke — which is exactly what happened to
+ * `jobs`, added here after a scan of a pre-0.14 database found it.
  */
 export declare const REBASE_INTERNAL_TABLES: readonly string[];
 /**

package/dist/util/internal-tables.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/util/policy/index.d.ts

@@ -1,4 +1,4 @@
-export * from "./securityRuleToConditions";
-export * from "./sqlToPolicy";
-export * from "./policyToPostgres";
-export * from "./evaluatePolicy";
+export * from "./securityRuleToConditions.js";
+export * from "./sqlToPolicy.js";
+export * from "./policyToPostgres.js";
+export * from "./evaluatePolicy.js";

package/dist/util/relations.d.ts

@@ -45,6 +45,31 @@ export declare function resolveCollectionRelations(collection: CollectionConfig)
  */
 export declare function getRelationTargetPath(property: RelationProperty): string | undefined;
 export declare function getTableName(collection: CollectionConfig): string;
+/**
+ * The variable name a generated table is bound to.
+ *
+ * Camel-cases underscores, and then guarantees the result is a legal
+ * identifier. It did only the first, so a table name that is legal in Postgres
+ * and not in JavaScript produced a `schema.generated.ts` that does not parse:
+ *
+ *   `2024_archive`       → `export const 2024Archive = pgTable(…)`
+ *                          "An identifier or keyword cannot immediately follow
+ *                           a numeric literal"
+ *   `reporting.events`   → `export const reporting.events = pgTable(…)`
+ *                          "',' expected"
+ *
+ * That file is imported by the server, so the failure is not one broken
+ * collection — `rebase build` and `db push` fail at tsc for the whole
+ * directory. And it is reachable from a documented flow: `rebase init` against
+ * a database holding a table called `2024_archive` writes a collection file
+ * that parses and a schema file that does not.
+ *
+ * **A no-op for every name that already worked**, which is what makes changing
+ * a derived name safe here: the only inputs whose output changes are the ones
+ * that produced a syntax error, and nothing can be running against those.
+ * Separators become camel case rather than disappearing, so `reporting.events`
+ * and `reporting_events` do not collide into one variable.
+ */
 export declare function getTableVarName(tableName: string): string;
 export declare function getEnumVarName(tableName: string, propName: string): string;
 export declare function getColumnName(fullColumn: string): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.16.0",
+  "version": "0.16.1-canary.g0d7af95",
   "description": "Rebase shared core — collection registry, data driver adapter and fluent query builder. No React dependency.",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -40,8 +40,8 @@
   "dependencies": {
     "fast-equals": "6.0.2",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/utils": "0.16.0",
-    "@rebasepro/types": "0.16.0"
+    "@rebasepro/types": "0.16.1-canary.g0d7af95",
+    "@rebasepro/utils": "0.16.1-canary.g0d7af95"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",
@@ -98,7 +98,7 @@
   },
   "scripts": {
     "watch": "vite build --watch",
-    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../scripts/assert-build-output.mjs",
+    "build": "vite build && tsc --emitDeclarationOnly -p tsconfig.prod.json && node ../../tooling/scripts/add-dts-extensions.mjs dist && node ../../tooling/scripts/assert-build-output.mjs",
     "test:lint": "eslint \"src/**\" --quiet",
     "test": "jest --passWithNoTests",
     "clean": "rm -rf dist && find ./src -name '*.js' -type f | xargs rm -f",

package/src/data/buildRebaseData.ts

@@ -333,6 +333,15 @@ ids });
                     orderBy: normalizeOrderBy(params?.orderBy),
                     searchString: params?.searchString,
                     searchExplain: params?.searchExplain,
+                    // Forwarded so the SERVER can refuse it. `realtimeService`
+                    // rejects a subscription carrying `vectorSearch` — a
+                    // subscription is re-run on every matching write and
+                    // nothing there computes distances — and the docs promise
+                    // that refusal. Both producers hand-list their fields and
+                    // both omitted this one, so the guard could not fire and
+                    // `.vectorSearch(…).listen()` returned an ordinary
+                    // `id DESC` listing with no `_distance` and no error.
+                    vectorSearch: params?.vectorSearch,
                     onUpdate: (entities) => {
                         onUpdate({
                             data: entities.map((row: Record<string, unknown>) => rowToEntity<M>(normalize(row), slug, getPks())),

package/src/util/internal-tables.test.ts

@@ -0,0 +1,176 @@
+import {
+    REBASE_INTERNAL_TABLES,
+    REBASE_USER_ROLE,
+    revokeInternalTableAccess,
+    revokeInternalTableSql
+} from "./internal-tables";
+
+/**
+ * The privilege boundary around Rebase's own tables.
+ *
+ * This module is the only thing keeping `rebase_user` away from refresh-token
+ * hashes, TOTP secrets and API keys, and until now nothing tested it. Its
+ * failure mode is the quiet kind: `revokeInternalTableAccess` swallows every
+ * error into an `onError` callback, so a revoke that fails on all twenty tables
+ * produces a boot that looks completely normal.
+ *
+ * The list membership assertions matter as much as the SQL ones. A table
+ * revoked at creation but missing from `REBASE_INTERNAL_TABLES` is stranded on
+ * every database provisioned before that revoke shipped — the boot-time sweep
+ * in `ensureAppRole` iterates this list and nothing else can repair an
+ * already-granted table.
+ */
+describe("internal table access", () => {
+
+    // ─── The list itself ─────────────────────────────────────────────────────
+
+    describe("REBASE_INTERNAL_TABLES", () => {
+
+        it("covers every table a creator revokes at creation time", () => {
+            // Kept in sync by hand with the `revokeInternalTableSql` call sites.
+            // A creation-time revoke fires once, on the boot that first makes
+            // the table; only the sweep can fix a database that predates it.
+            const revokedAtCreation = [
+                "api_keys",
+                "branches",
+                "channel_cursors",
+                "channel_messages",
+                "channel_presence",
+                "cron_claims",
+                "cron_logs",
+                "entity_history",
+                "idempotency_keys",
+                "jobs",
+                "rate_limit_hits"
+            ];
+
+            const missing = revokedAtCreation.filter((table) => !REBASE_INTERNAL_TABLES.includes(table));
+            expect(missing).toEqual([]);
+        });
+
+        it("holds the auth tables whose rows no end user may ever address", () => {
+            for (const table of [
+                "refresh_tokens",
+                "password_reset_tokens",
+                "magic_link_tokens",
+                "mfa_factors",
+                "mfa_challenges",
+                "recovery_codes",
+                "user_identities"
+            ]) {
+                expect(REBASE_INTERNAL_TABLES).toContain(table);
+            }
+        });
+
+        it("leaves `users` out, because revoking there breaks sign-in", () => {
+            // The auth user table is also a collection: RLS enabled, policies
+            // applied, and users read their own row through it.
+            expect(REBASE_INTERNAL_TABLES).not.toContain("users");
+        });
+
+        it("has no duplicates", () => {
+            expect(new Set(REBASE_INTERNAL_TABLES).size).toBe(REBASE_INTERNAL_TABLES.length);
+        });
+    });
+
+    // ─── The statement ───────────────────────────────────────────────────────
+
+    describe("revokeInternalTableSql", () => {
+
+        it("revokes every privilege from the end-user role", () => {
+            const sql = revokeInternalTableSql("rebase", "refresh_tokens");
+
+            expect(sql).toContain(`REVOKE ALL ON "rebase"."refresh_tokens" FROM ${REBASE_USER_ROLE}`);
+        });
+
+        it("guards on the role existing, so an unprivileged install is a no-op", () => {
+            // A bare REVOKE naming a missing role is an error, not a no-op, and
+            // it would abort the boot it runs in.
+            const sql = revokeInternalTableSql("rebase", "api_keys");
+
+            expect(sql).toContain(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}'`);
+        });
+
+        it("tolerates a table that does not exist yet", () => {
+            // `cron_logs` never appears in a project with no cron jobs.
+            expect(revokeInternalTableSql("rebase", "cron_logs")).toContain("to_regclass");
+        });
+
+        it("is a single statement, for handles that reject multi-statement strings", () => {
+            // The semicolons inside the block are PL/pgSQL's, not the protocol's:
+            // what matters is that the whole string is one dollar-quoted DO,
+            // opened once and closed at the very end.
+            const sql = revokeInternalTableSql("rebase", "jobs");
+
+            expect(sql.startsWith("DO $rebase_revoke$")).toBe(true);
+            expect(sql.endsWith("$rebase_revoke$;")).toBe(true);
+            expect(sql.split("$rebase_revoke$")).toHaveLength(3);
+        });
+
+        it("refuses to interpolate an unsafe identifier", () => {
+            expect(() => revokeInternalTableSql("rebase", 'x"; DROP TABLE users; --')).toThrow(/unsafe table name/);
+            expect(() => revokeInternalTableSql('pub"lic', "api_keys")).toThrow(/unsafe schema name/);
+        });
+    });
+
+    // ─── The sweep ───────────────────────────────────────────────────────────
+
+    describe("revokeInternalTableAccess", () => {
+
+        it("issues one statement per internal table", async () => {
+            const executed: string[] = [];
+
+            await revokeInternalTableAccess(async (sql) => { executed.push(sql); }, "rebase");
+
+            expect(executed).toHaveLength(REBASE_INTERNAL_TABLES.length);
+            for (const table of REBASE_INTERNAL_TABLES) {
+                expect(executed.some((sql) => sql.includes(`"rebase"."${table}"`))).toBe(true);
+            }
+        });
+
+        it("reports a failure rather than swallowing it", async () => {
+            // The whole risk: an onError that no caller wires up turns twenty
+            // failed revokes into a silent, apparently-clean boot.
+            const seen: string[] = [];
+
+            await revokeInternalTableAccess(
+                async (sql) => {
+                    if (sql.includes("refresh_tokens")) throw new Error("permission denied");
+                },
+                "rebase",
+                { onError: (table) => seen.push(table) }
+            );
+
+            expect(seen).toEqual(["refresh_tokens"]);
+        });
+
+        it("keeps going after one table fails", async () => {
+            const executed: string[] = [];
+
+            await revokeInternalTableAccess(
+                async (sql) => {
+                    executed.push(sql);
+                    if (sql.includes("user_identities")) throw new Error("not the owner");
+                },
+                "rebase",
+                { onError: () => undefined }
+            );
+
+            // A connection that does not own one table must not strand the rest.
+            expect(executed).toHaveLength(REBASE_INTERNAL_TABLES.length);
+        });
+
+        it("honours an explicit table list", async () => {
+            const executed: string[] = [];
+
+            await revokeInternalTableAccess(
+                async (sql) => { executed.push(sql); },
+                "rebase",
+                { tables: ["api_keys"] }
+            );
+
+            expect(executed).toHaveLength(1);
+            expect(executed[0]).toContain('"rebase"."api_keys"');
+        });
+    });
+});

package/src/util/internal-tables.ts

@@ -64,6 +64,15 @@ export const REBASE_USER_ROLE = "rebase_user";
  *
  * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
  * because `db migrate apply` passes `--revisions-schema rebase`.
+ *
+ * Every entry here must also be revoked by whatever creates it, and vice versa:
+ * the creation-time revoke fires once, on the boot that first makes the table,
+ * so it cannot help a database provisioned before that revoke existed. This
+ * list is what the boot-time sweep in `ensureAppRole` iterates, and the sweep
+ * is the only thing that can repair an already-granted table. A table revoked
+ * at creation but missing here is therefore permanently stranded on any
+ * database that predates its revoke — which is exactly what happened to
+ * `jobs`, added here after a scan of a pre-0.14 database found it.
  */
 export const REBASE_INTERNAL_TABLES: readonly string[] = [
     // auth
@@ -80,10 +89,12 @@ export const REBASE_INTERNAL_TABLES: readonly string[] = [
     "api_keys",
     "cron_logs",
     "cron_claims",
+    "jobs",
     "rate_limit_hits",
     "idempotency_keys",
     "entity_history",
     "branches",
+    "metric_samples",
     // realtime channels — authorization for these lives in the channel rules the
     // server evaluates before it reads or writes, never in a row policy
     "channel_messages",

package/src/util/relations.ts

@@ -104,8 +104,55 @@ export function getTableName(collection: CollectionConfig): string {
     return toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
 }
 
+/**
+ * A JavaScript identifier: what a generated `export const <name> =` needs.
+ *
+ * Deliberately the same shape the two schema generators already define
+ * privately — this is the third place that needed it, and the first two guard
+ * property keys and member accesses while nothing guarded the variable name
+ * itself.
+ */
+const JS_IDENTIFIER = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+/**
+ * The variable name a generated table is bound to.
+ *
+ * Camel-cases underscores, and then guarantees the result is a legal
+ * identifier. It did only the first, so a table name that is legal in Postgres
+ * and not in JavaScript produced a `schema.generated.ts` that does not parse:
+ *
+ *   `2024_archive`       → `export const 2024Archive = pgTable(…)`
+ *                          "An identifier or keyword cannot immediately follow
+ *                           a numeric literal"
+ *   `reporting.events`   → `export const reporting.events = pgTable(…)`
+ *                          "',' expected"
+ *
+ * That file is imported by the server, so the failure is not one broken
+ * collection — `rebase build` and `db push` fail at tsc for the whole
+ * directory. And it is reachable from a documented flow: `rebase init` against
+ * a database holding a table called `2024_archive` writes a collection file
+ * that parses and a schema file that does not.
+ *
+ * **A no-op for every name that already worked**, which is what makes changing
+ * a derived name safe here: the only inputs whose output changes are the ones
+ * that produced a syntax error, and nothing can be running against those.
+ * Separators become camel case rather than disappearing, so `reporting.events`
+ * and `reporting_events` do not collide into one variable.
+ */
 export function getTableVarName(tableName: string): string {
-    return tableName.replace(/_([a-z])/g, (_, char) => char.toUpperCase());
+    const camel = tableName.replace(/_([a-z])/g, (_, char: string) => char.toUpperCase());
+    if (JS_IDENTIFIER.test(camel)) return camel;
+
+    const sanitised = camel
+        // Any other separator gets the same treatment `_` did, so two tables
+        // differing only by separator keep differing.
+        .replace(/[^A-Za-z0-9_$]+([A-Za-z0-9])?/g, (_, char?: string) =>
+            (char ? char.toUpperCase() : ""))
+        // A leading digit is legal in Postgres and not in JavaScript. Prefixed
+        // rather than stripped, so `2024_archive` and `archive` stay distinct.
+        .replace(/^([0-9])/, "t$1");
+
+    return JS_IDENTIFIER.test(sanitised) ? sanitised : `t${sanitised}`;
 }
 
 export function getEnumVarName(tableName: string, propName: string): string {