@rebasepro/common 0.17.3 → 0.18.1

package/src/util/internal-tables.test.ts

@@ -1,188 +0,0 @@
-import {
-    REBASE_INTERNAL_TABLES,
-    REBASE_USER_ROLE,
-    revokeInternalTableAccess,
-    revokeInternalTableSql
-} from "./internal-tables";
-
-/**
- * The privilege boundary around Rebase's own tables.
- *
- * This module is the only thing keeping `rebase_user` away from refresh-token
- * hashes, TOTP secrets and API keys, and until now nothing tested it. Its
- * failure mode is the quiet kind: `revokeInternalTableAccess` swallows every
- * error into an `onError` callback, so a revoke that fails on all twenty tables
- * produces a boot that looks completely normal.
- *
- * The list membership assertions matter as much as the SQL ones. A table
- * revoked at creation but missing from `REBASE_INTERNAL_TABLES` is stranded on
- * every database provisioned before that revoke shipped — the boot-time sweep
- * in `ensureAppRole` iterates this list and nothing else can repair an
- * already-granted table.
- */
-describe("internal table access", () => {
-
-    // ─── The list itself ─────────────────────────────────────────────────────
-
-    describe("REBASE_INTERNAL_TABLES", () => {
-
-        it("covers every table a creator revokes at creation time", () => {
-            // Kept in sync by hand with the `revokeInternalTableSql` call sites.
-            // A creation-time revoke fires once, on the boot that first makes
-            // the table; only the sweep can fix a database that predates it.
-            const revokedAtCreation = [
-                "api_keys",
-                "branches",
-                "channel_cursors",
-                "channel_messages",
-                "channel_presence",
-                "cron_claims",
-                "cron_logs",
-                "entity_history",
-                "idempotency_keys",
-                "jobs",
-                "rate_limit_hits"
-            ];
-
-            const missing = revokedAtCreation.filter((table) => !REBASE_INTERNAL_TABLES.includes(table));
-            expect(missing).toEqual([]);
-        });
-
-        it("holds the auth tables whose rows no end user may ever address", () => {
-            for (const table of [
-                "refresh_tokens",
-                "password_reset_tokens",
-                "magic_link_tokens",
-                "mfa_factors",
-                "mfa_challenges",
-                "recovery_codes",
-                "user_identities"
-            ]) {
-                expect(REBASE_INTERNAL_TABLES).toContain(table);
-            }
-        });
-
-        it("leaves `users` out, because revoking there breaks sign-in", () => {
-            // The auth user table is also a collection: RLS enabled, policies
-            // applied, and users read their own row through it.
-            expect(REBASE_INTERNAL_TABLES).not.toContain("users");
-        });
-
-        it("has no duplicates", () => {
-            expect(new Set(REBASE_INTERNAL_TABLES).size).toBe(REBASE_INTERNAL_TABLES.length);
-        });
-    });
-
-    // ─── The statement ───────────────────────────────────────────────────────
-
-    describe("revokeInternalTableSql", () => {
-
-        it("revokes every privilege from the end-user role", () => {
-            const sql = revokeInternalTableSql("rebase", "refresh_tokens");
-
-            expect(sql).toContain(`REVOKE ALL ON "rebase"."refresh_tokens" FROM ${REBASE_USER_ROLE}`);
-        });
-
-        it("guards on the role existing, so an unprivileged install is a no-op", () => {
-            // A bare REVOKE naming a missing role is an error, not a no-op, and
-            // it would abort the boot it runs in.
-            const sql = revokeInternalTableSql("rebase", "api_keys");
-
-            expect(sql).toContain(`SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}'`);
-        });
-
-        it("tolerates a table that does not exist yet", () => {
-            // `cron_logs` never appears in a project with no cron jobs.
-            expect(revokeInternalTableSql("rebase", "cron_logs")).toContain("to_regclass");
-        });
-
-        it("skips a table with RLS enabled, because that is somebody's collection", () => {
-            // The names in the list are unqualified and the boot sweep applies
-            // them to every project schema, so `public.jobs` — a job board's
-            // vacancies — was being revoked on every boot by the entry meant for
-            // `rebase.jobs`, the background queue. RLS is what tells them apart:
-            // collections have it, framework tables do not.
-            const sql = revokeInternalTableSql("public", "jobs");
-
-            expect(sql).toContain("relrowsecurity");
-            expect(sql).toMatch(/NOT \(SELECT relrowsecurity FROM pg_class WHERE oid = to_regclass\('"public"\."jobs"'\)\)/);
-        });
-
-        it("is a single statement, for handles that reject multi-statement strings", () => {
-            // The semicolons inside the block are PL/pgSQL's, not the protocol's:
-            // what matters is that the whole string is one dollar-quoted DO,
-            // opened once and closed at the very end.
-            const sql = revokeInternalTableSql("rebase", "jobs");
-
-            expect(sql.startsWith("DO $rebase_revoke$")).toBe(true);
-            expect(sql.endsWith("$rebase_revoke$;")).toBe(true);
-            expect(sql.split("$rebase_revoke$")).toHaveLength(3);
-        });
-
-        it("refuses to interpolate an unsafe identifier", () => {
-            expect(() => revokeInternalTableSql("rebase", 'x"; DROP TABLE users; --')).toThrow(/unsafe table name/);
-            expect(() => revokeInternalTableSql('pub"lic', "api_keys")).toThrow(/unsafe schema name/);
-        });
-    });
-
-    // ─── The sweep ───────────────────────────────────────────────────────────
-
-    describe("revokeInternalTableAccess", () => {
-
-        it("issues one statement per internal table", async () => {
-            const executed: string[] = [];
-
-            await revokeInternalTableAccess(async (sql) => { executed.push(sql); }, "rebase");
-
-            expect(executed).toHaveLength(REBASE_INTERNAL_TABLES.length);
-            for (const table of REBASE_INTERNAL_TABLES) {
-                expect(executed.some((sql) => sql.includes(`"rebase"."${table}"`))).toBe(true);
-            }
-        });
-
-        it("reports a failure rather than swallowing it", async () => {
-            // The whole risk: an onError that no caller wires up turns twenty
-            // failed revokes into a silent, apparently-clean boot.
-            const seen: string[] = [];
-
-            await revokeInternalTableAccess(
-                async (sql) => {
-                    if (sql.includes("refresh_tokens")) throw new Error("permission denied");
-                },
-                "rebase",
-                { onError: (table) => seen.push(table) }
-            );
-
-            expect(seen).toEqual(["refresh_tokens"]);
-        });
-
-        it("keeps going after one table fails", async () => {
-            const executed: string[] = [];
-
-            await revokeInternalTableAccess(
-                async (sql) => {
-                    executed.push(sql);
-                    if (sql.includes("user_identities")) throw new Error("not the owner");
-                },
-                "rebase",
-                { onError: () => undefined }
-            );
-
-            // A connection that does not own one table must not strand the rest.
-            expect(executed).toHaveLength(REBASE_INTERNAL_TABLES.length);
-        });
-
-        it("honours an explicit table list", async () => {
-            const executed: string[] = [];
-
-            await revokeInternalTableAccess(
-                async (sql) => { executed.push(sql); },
-                "rebase",
-                { tables: ["api_keys"] }
-            );
-
-            expect(executed).toHaveLength(1);
-            expect(executed[0]).toContain('"rebase"."api_keys"');
-        });
-    });
-});

package/src/util/internal-tables.ts

@@ -1,197 +0,0 @@
-/**
- * The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
- * end-user role away from them.
- *
- * ## Why this exists
- *
- * Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
- * provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
- * in the schemas a project uses — including `rebase`, because a project's own
- * collections are allowed to live there (the scaffold puts `users` there). It
- * also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
- * migrating role inherits the same grant.
- *
- * Every framework-internal table is created later: auth's tables come up during
- * `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
- * job registers, `idempotency_keys` on the first request that carries a key. So
- * they all inherited full DML for the end-user role — and none of them enables
- * row-level security, because none of them is a collection with
- * `securityRules`. Measured on a freshly provisioned database, `SET ROLE
- * rebase_user` could read `rebase.refresh_tokens` (session token hashes),
- * `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
- * `rebase.api_keys` (including its `admin` flag), and insert into
- * `rebase.app_config`.
- *
- * Nothing routes a user-context query at those tables today, so this was not
- * reachable over the API. That is the wrong thing to depend on: the documented
- * model is that RLS is the authorization boundary, and these tables sat outside
- * it. The boundary is now a privilege boundary instead — the role simply cannot
- * address them.
- *
- * ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
- *
- * RLS with no policy denies every row, which is the same outcome, but it is the
- * *weaker* statement: it leaves the grant in place, so a later policy — or a
- * `FORCE` flag cleared by some future migration — reopens the table. There is no
- * row of `refresh_tokens` any end user should ever reach, so the honest encoding
- * is "this role has no privilege here at all". It also keeps the owner
- * connection (which auth actually runs on) completely unaffected.
- *
- * ## Keeping it true
- *
- * `packages/rls-check` scans the `rebase` schema — it used to skip it as a
- * "platform" schema — and its `rls-disabled` check fires on exactly the
- * condition this module removes: RLS off *and* a DML grant to a reachable role.
- * So a table added here without a revoke is caught by `pnpm rls:check`, not by
- * someone re-reading this file.
- */
-
-/**
- * The Postgres role authenticated requests run as.
- *
- * Defined here rather than in the Postgres driver because both the driver (which
- * provisions the role) and this module (which revokes on its behalf) need it,
- * and a second spelling of a role name is a silent no-op waiting to happen.
- */
-export const REBASE_USER_ROLE = "rebase_user";
-
-/**
- * Framework-internal table names, unqualified.
- *
- * Deliberately NOT including `users`: the auth user table is also a collection,
- * with `securityRules`, RLS enabled and policies applied. Users read their own
- * row through it — revoking there would break sign-in. `revokeInternalTableSql`
- * now skips any table with RLS enabled, so that exception is enforced rather
- * than merely remembered — and so is the same hazard for every other name here,
- * any of which a project may legitimately use for a collection of its own.
- *
- * `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
- * because `db migrate apply` passes `--revisions-schema rebase`.
- *
- * Every entry here must also be revoked by whatever creates it, and vice versa:
- * the creation-time revoke fires once, on the boot that first makes the table,
- * so it cannot help a database provisioned before that revoke existed. This
- * list is what the boot-time sweep in `ensureAppRole` iterates, and the sweep
- * is the only thing that can repair an already-granted table. A table revoked
- * at creation but missing here is therefore permanently stranded on any
- * database that predates its revoke.
- *
- * These names are unqualified, and the boot-time sweep applies them to every
- * schema a project uses — so an entry here is a claim on that name in `public`
- * as much as in `rebase`. `jobs` is Rebase's queue at `rebase.jobs` AND a
- * perfectly ordinary collection name, and revoking `public.jobs` from a project
- * that owns it leaves every read failing 42501 with correct policies applied
- * and nothing in the RLS logs to explain it. The `relrowsecurity` guard in
- * `revokeInternalTableSql` is what makes a common noun safe here — it is not a
- * licence to claim more of them.
- */
-export const REBASE_INTERNAL_TABLES: readonly string[] = [
-    // auth
-    "user_identities",
-    "refresh_tokens",
-    "password_reset_tokens",
-    "magic_link_tokens",
-    "mfa_factors",
-    "mfa_challenges",
-    "recovery_codes",
-    "app_config",
-    "schema_meta",
-    // platform services
-    "api_keys",
-    "cron_logs",
-    "cron_claims",
-    "jobs",
-    "rate_limit_hits",
-    "idempotency_keys",
-    "entity_history",
-    "branches",
-    "metric_samples",
-    // realtime channels — authorization for these lives in the channel rules the
-    // server evaluates before it reads or writes, never in a row policy
-    "channel_messages",
-    "channel_cursors",
-    "channel_presence",
-    // migration bookkeeping
-    "atlas_schema_revisions"
-];
-
-/** Postgres identifiers this module is willing to interpolate. */
-const SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
-
-/**
- * A single statement that takes every privilege on `schema.table` away from the
- * end-user role.
- *
- * Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
- * happen in practice:
- *
- *  - the role does not exist when the connection is unprivileged (Rebase then
- *    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
- *    missing role is an error, not a no-op;
- *  - the table may not exist yet — `cron_logs` never appears in a project with
- *    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
- *
- * The third guard is the one that decides whether the *right* table is being
- * revoked. The names in {@link REBASE_INTERNAL_TABLES} are unqualified, and the
- * boot-time sweep in `ensureAppRole` applies all of them to every schema a
- * project uses — including the schema its own collections live in. A project is
- * free to call a collection `jobs`, `branches` or `api_keys`, and when it does,
- * the sweep was revoking `rebase_user`'s DML on the project's table on every
- * single boot. That is not a subtle degradation: the collection's whole API
- * answers 500 `permission denied for table …` from then on, which is what
- * happened to a public job board whose vacancies live in `public.jobs`.
- *
- * `relrowsecurity` separates the two cleanly, and it is the same fact this
- * module already relies on. Framework-internal tables carry no RLS — that is the
- * premise stated at the top of this file, and the reason a revoke is needed at
- * all. Every collection table has it enabled, because that is how Rebase
- * enforces `securityRules`. So "RLS is off" is exactly "this is not somebody's
- * collection", and the guard also subsumes the hand-carved `users` exception:
- * the auth user table is a collection, has RLS, and would now be skipped on its
- * own merits rather than by being kept off a list.
- *
- * One command, so it is safe on handles that speak the extended query protocol
- * and reject multi-statement strings.
- */
-export function revokeInternalTableSql(schema: string, table: string): string {
-    if (!SAFE_IDENTIFIER.test(schema)) {
-        throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
-    }
-    if (!SAFE_IDENTIFIER.test(table)) {
-        throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
-    }
-    const qualified = `"${schema}"."${table}"`;
-    return `
-        DO $rebase_revoke$
-        BEGIN
-            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
-               AND to_regclass('${qualified}') IS NOT NULL
-               AND NOT (SELECT relrowsecurity FROM pg_class WHERE oid = to_regclass('${qualified}')) THEN
-                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
-            END IF;
-        END
-        $rebase_revoke$;
-    `.trim();
-}
-
-/**
- * Revoke on every internal table in `schema`, one statement at a time.
- *
- * Best-effort per table: a connection that does not own one of them (a
- * pre-provisioned database, a platform-managed ledger) cannot revoke on it, and
- * that must not take down a boot. The caller decides how loud to be — `onError`
- * exists so the driver can warn without this module importing a logger.
- */
-export async function revokeInternalTableAccess(
-    execute: (sql: string) => Promise<unknown>,
-    schema: string,
-    options?: { tables?: readonly string[]; onError?: (table: string, error: unknown) => void }
-): Promise<void> {
-    for (const table of options?.tables ?? REBASE_INTERNAL_TABLES) {
-        try {
-            await execute(revokeInternalTableSql(schema, table));
-        } catch (error) {
-            options?.onError?.(table, error);
-        }
-    }
-}