@rebasepro/common 0.20.0 → 0.21.0

package/dist/index.es.js

@@ -1735,7 +1735,7 @@ function propertyClaimCastType(name, collection, resolveCollection, depth = 0) {
 			return "numeric";
 		}
 		case "reference": return primaryKeyClaimCastType(resolveTargetCollection(prop.path, resolveCollection), resolveCollection, depth);
-		case "relation": return primaryKeyClaimCastType(resolveTargetCollection(relationTargetSlug(prop.relation), resolveCollection), resolveCollection, depth);
+		case "relation": return primaryKeyClaimCastType(relationTarget(name, prop, collection, resolveCollection), resolveCollection, depth);
 		default: return "text";
 	}
 }
@@ -1822,9 +1822,65 @@ function schemaOf(collection) {
 function resolveColumnName(propName, collection) {
 	const prop = collection?.properties?.[propName];
 	if (prop && "columnName" in prop && typeof prop.columnName === "string") return quoteColumnIdentifier(prop.columnName);
+	const relationColumn = belongsToColumn(propName, prop, collection);
+	if (relationColumn) return quoteColumnIdentifier(relationColumn);
 	return quoteColumnIdentifier(toSnakeCase(propName));
 }
 /**
+* The foreign key column a `relation` property addresses, when it has one.
+*
+* A `belongsTo` property is a *link*, and its column is the relation's
+* `localKey` — `org` addresses `org_id`. `toSnakeCase` cannot know that, so a
+* rule naming a relation (`ownerField: "org"`, a tenancy declaration over a
+* `belongsTo`) compiled to a comparison against a column called `org`, which
+* does not exist. `CREATE POLICY` then fails, and a table with RLS enabled and
+* no policy denies every row — the loudest possible symptom for the quietest
+* possible cause, since the rule reads exactly right.
+*
+* Only `belongsTo`. Every other kind puts its column on the target table, in a
+* junction row, or nowhere at all, and there is no column here to name.
+*/
+function belongsToColumn(propName, prop, collection) {
+	if (prop?.type !== "relation") return void 0;
+	const relation = resolvePropertyRelation(propName, collection);
+	return relation?.kind === "belongsTo" ? relation.localKey : void 0;
+}
+/**
+* The resolved relation a `relation` property stands for, by the only name
+* both declarations share: the property's own key.
+*
+* A property may carry the link inline (`relation: { kind, target }`) or name
+* an entry in the collection's `relations` array — and the second form is
+* matched by the property key, so there is nothing on the property to read.
+* `resolveCollectionRelations` normalises both under that key, which is why
+* this asks it rather than reading the property.
+*/
+function resolvePropertyRelation(propName, collection) {
+	if (!collection) return void 0;
+	try {
+		return findRelation(resolveCollectionRelations(collection), propName);
+	} catch {
+		return;
+	}
+}
+/**
+* The collection a `relation` property points at.
+*
+* Preferred over the property's raw `target` because only the resolved
+* relation covers both declarations, and because a resolved `target()` hands
+* back the collection itself — no registry needed. The slug path stays as the
+* fallback for a `target` written as a plain string, which cannot become a
+* collection without one.
+*/
+function relationTarget(propName, prop, collection, resolveCollection) {
+	const relation = resolvePropertyRelation(propName, collection);
+	if (relation) try {
+		const target = relation.target();
+		if (target) return target;
+	} catch {}
+	return resolveTargetCollection(relationTargetSlug(prop.relation), resolveCollection);
+}
+/**
 * Every PostgreSQL keyword that cannot stand as a bare column reference.
 * Appendix C's two reserved categories — plain "reserved", and "reserved (can
 * be function or type name)" — since neither may name a column unquoted.
@@ -2440,6 +2496,65 @@ function callbackRefusal(stage, path) {
 		}
 	});
 }
+/**
+* The collection a callback tier is about to be handed — or a refusal.
+*
+* Every callback props type declares `collection: CollectionConfig`,
+* non-optional, and the documented global-callback examples dereference it
+* (`if (collection.slug === "audit_log") return;`). The driver resolves that
+* value from the registry, which answers `undefined` for a path it does not
+* know, so the tiers used to receive it through a cast that quietly dropped the
+* `| undefined`. A global `beforeSave` reading `collection.slug` then threw a
+* `TypeError` that `toCallbackError` reported as a 400 `CALLBACK_REJECTED` —
+* the author's own rule blamed for a value the framework failed to supply.
+*
+* Skipping the tier instead is not available. `afterRead` is documented as the
+* place for "security-critical redaction (PII masking, row filtering) — no read
+* path bypasses it", and a tier that silently does not run on the paths the
+* registry cannot resolve is precisely such a bypass.
+*
+* So the contract is the third option: **a callback tier never runs without a
+* collection**, because a path that has none is refused before one can. That
+* costs nothing, because it is already true — every read and every write
+* reaches the database through `getCollectionByPath` in the driver's collection
+* helpers, which raises this same "not found" for the same paths. Asking here
+* only asks earlier, while the answer is still a 404 about the request instead
+* of a `TypeError` attributed to the application's hook.
+*
+* @param collection The collection the driver resolved, if it resolved one.
+* @param path       The collection path, for the message and `details`.
+*/
+function requireCallbackCollection(collection, path) {
+	if (!collection) throw new RebaseApiError(`Collection not found: ${path}`, {
+		status: 404,
+		code: "NOT_FOUND",
+		details: { path }
+	});
+	return collection;
+}
+/**
+* The client a callback reads as `context.client` — or a refusal naming why
+* there is none.
+*
+* A driver is constructed before the server client exists, and
+* `initializeRebaseBackend` hands it the client afterwards. So a driver can
+* run callbacks without one: constructed on its own, or missed by that
+* injection, which is how a second database's callbacks once ran with
+* `context.client === undefined` while the type said it was there.
+*
+* Called from a getter on the context rather than when the context is built,
+* because most callbacks never touch `client` and must not fail for its
+* absence. The one that does gets this sentence instead of "Cannot read
+* properties of undefined". A 500, not the 400 `toCallbackError` makes of a
+* plain throw: the callback is not at fault, the server's wiring is.
+*/
+function requireCallbackClient(client) {
+	if (!client) throw new RebaseApiError("`context.client` is not available to this callback: the driver running it was never given the server client. `initializeRebaseBackend` attaches it to every data source's driver at boot, so this driver was constructed outside it or missed. Queries do not need it — they go through `context.data`.", {
+		status: 500,
+		code: "INTERNAL_ERROR"
+	});
+	return client;
+}
 //#endregion
 //#region src/util/tenant.ts
 /**
@@ -2894,20 +3009,47 @@ function mergeJunctionPayload(into, incoming, table, collection) {
 * payload column anywhere is a second description that can disagree.
 */
 function getJunctionCollectionConfig(spec) {
+	return buildJunctionCollectionConfig({
+		table: spec.table,
+		schema: spec.schema,
+		keyColumns: spec.endpoints.map((endpoint) => endpoint.junctionColumn),
+		properties: spec.properties
+	});
+}
+/**
+* The same synthetic collection, reached from a resolved relation rather than
+* from a spec.
+*
+* The spec is built by walking every collection, which the schema planner does
+* once at boot and no request path can afford. A read or a write already holds
+* the relation, and a relation's `through` carries the table, both key columns
+* and the payload — everything the config is made of. One builder underneath
+* both, so the shape the planner emitted columns from is the shape the write
+* path validates a `_pivot` against and the read path strips it with.
+*/
+function getJunctionConfigForRelation(through) {
+	return buildJunctionCollectionConfig({
+		table: through.table.includes(".") ? through.table.split(".").pop() : through.table,
+		schema: "public",
+		keyColumns: [through.sourceColumn, through.targetColumn],
+		properties: through.properties
+	});
+}
+function buildJunctionCollectionConfig(args) {
 	const properties = {};
-	for (const endpoint of spec.endpoints) properties[endpoint.junctionColumn] = {
+	for (const column of args.keyColumns) properties[column] = {
 		type: "string",
-		columnName: endpoint.junctionColumn
+		columnName: column
 	};
-	for (const [key, property] of Object.entries(spec.properties)) {
+	for (const [key, property] of Object.entries(args.properties)) {
 		if (key === JUNCTION_PIVOT_KEY || key in properties) continue;
 		properties[key] = property;
 	}
 	return {
-		slug: spec.table,
-		name: spec.table,
-		table: spec.table,
-		schema: spec.schema,
+		slug: args.table,
+		name: args.table,
+		table: args.table,
+		schema: args.schema,
 		properties
 	};
 }
@@ -3599,6 +3741,44 @@ async function revokeInternalTableAccess(execute, schema, options) {
 	}
 }
 //#endregion
+//#region src/util/sql-rows.ts
+/**
+* Read the rows out of whatever a SQL driver actually returned.
+*
+* Two shapes reach this repository's stores through the same call, and which
+* one arrives is a property of the driver rather than of the query:
+* node-postgres hands back a `{ rows }` envelope, and the other paths — a bare
+* `executeSql`, Drizzle's `db.execute()` on some builds — hand back an array.
+* `@rebasepro/server`'s `SqlExec` type declares the array, so the envelope is
+* off-contract every time it turns up, and it still turns up.
+*
+* Reading one shape only is how a store silently sees nothing: the rate limiter
+* that did it counted every caller as being on their first request — a limiter
+* that never limits, with no error anywhere to say so.
+*
+* Written inline it came to `result as unknown as { rows?: T[] } | T[]`, five
+* times across three packages. That is the problem restated as an assertion: a
+* union the caller has to re-test at runtime anyway, with `unknown` in the
+* middle only because neither half overlaps what the signature promised. The
+* `Array.isArray` below is that same test done once, and it *narrows* — so
+* these branches are checked rather than claimed.
+*
+* The element type is the one claim that stays a claim: these are rows from
+* hand-written SQL, and nothing at this layer can check a column list.
+*/
+function sqlRows(result) {
+	if (Array.isArray(result)) return result;
+	if (result !== null && typeof result === "object") {
+		const rows = result.rows;
+		if (Array.isArray(rows)) return rows;
+	}
+	return [];
+}
+/** The first row of {@link sqlRows}, or `undefined` when there were none. */
+function firstSqlRow(result) {
+	return sqlRows(result)[0];
+}
+//#endregion
 //#region src/data/resolveDataSource.ts
 /**
 * Build a keyed registry from a list of {@link DataSourceDefinition}s.
@@ -6668,6 +6848,12 @@ function toFilterTuples(filterParam) {
 }
 //#endregion
 //#region src/table-classification.ts
+/**
+* Table Classification
+*
+* Shared constants and pure functions for classifying database tables.
+* Used by both the server-side PostgresBackendDriver and the Studio RLS editor.
+*/
 /** Schemas that are always considered Rebase-internal. */
 var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
 /** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
@@ -6689,8 +6875,29 @@ var REBASE_INTERNAL_PREFIXES = [
 * **not** handled by this function. Use {@link detectJunctionTables} to obtain
 * the set of junction tables, then reclassify as needed.
 */
+/** The schema Rebase puts both its own tables and the tenant's collections in. */
+var REBASE_SCHEMA = "rebase";
+/**
+* Rebase's own tables, by unqualified name.
+*
+* Reused from `util/internal-tables`, which maintains it for the privilege
+* revoke — rather than a second list here, which would be a second thing to
+* keep true. It already excludes `users` for the reason that matters to this
+* function too: the auth user table is also a collection, with RLS and
+* policies, and hiding it would hide the one table almost every policy
+* references.
+*
+* That list is deliberately willing to claim common nouns — `jobs`, `branches`,
+* `api_keys` — because its own caller re-checks each against `relrowsecurity`.
+* This function has no such signal, so the layer above supplies it: a table the
+* project MAPS to a collection is classified as the customer's before this is
+* consulted at all.
+*/
+var INTERNAL_TABLE_NAMES = new Set(REBASE_INTERNAL_TABLES);
 function classifyTable(tableName, schemaName) {
-	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
+	if (REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
+	if (schemaName === REBASE_SCHEMA) return INTERNAL_TABLE_NAMES.has(tableName) ? "rebase-internal" : "user";
+	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName)) return "rebase-internal";
 	return "user";
 }
 /**
@@ -6743,6 +6950,6 @@ async function detectJunctionTables(executeSql) {
 	return junctionTables;
 }
 //#endregion
-export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
+export { ADMIN_ROLE, CALLBACK_REJECTED, COLLECTION_PATH_SEPARATOR, COMPOSITE_ID_SEPARATOR, CollectionRegistry, CursorError, CursorMismatchError, DEFAULT_FIND_ALL_MAX_ROWS, DEFAULT_MAX_PAGES, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE, DEFAULT_PAGE_SIZE, DEFAULT_STRING_COLUMN_LENGTH, IncludeSpecError, JUNCTION_TABLES_SQL, MAX_LOGICAL_NESTING_DEPTH, OrderBySpecError, QueryBuilder, REBASE_INTERNAL_PREFIXES, REBASE_INTERNAL_SCHEMAS, REBASE_INTERNAL_TABLES, REBASE_USER_ROLE, RebasePaginationError, TENANT_INDEX_REASON, UnknownFilterOperatorError, aggregateAlias, and, applyDefaultValuesOnCreate, buildCollectionFromTableMetadata, buildCompositeId, buildConditionContext, buildPropertyCallbacks, buildRebaseData, buildRoutedRebaseData, buildSdkData, buildTenantSecurityRule, callbackRefusal, canCreateEntity, canDeleteEntity, canEditEntity, canReadCollection, canReadField, canWriteField, checkOperation, classifyTable, collectAllPages, cond, createDataSourceRegistry, createPaginationHelpers, createRelationRef, createRelationRefWithData, cursorToStartAfter, decodeCursor, defaultUsersCollection, defineCollection, denormalizeInclude, deserializeFilter, deserializeInclude, deserializeLogicalCondition, deserializeOrderBy, deserializeOrderByList, detectJunctionTables, effectiveAccess, embedParentExpression, encodeCursor, enumToObjectEntries, evaluateCondition, evaluatePolicy, fieldKeyForColumn, findAnonymousGrants, findRelation, firstSqlRow, fullPathToCollectionSegments, getArrayResolvedProperties, getChildViewDeclaringProperties, getChildViewRelationPropertyKeys, getColumnName, getDeclaredPrimaryKeys, getDefaultValueFor, getDefaultValueFortype, getDefaultValuesFor, getEffectiveSecurityRules, getEntityChildViews, getEnumVarName, getGeneratedPolicyNames, getInjectedSecurityRules, getJunctionCollectionConfig, getJunctionConfigForRelation, getJunctionSecurityRules, getLabelOrConfigFrom, getPrimaryKeys, getReferenceFrom, getRelationFrom, getRelationTargetPath, getSubcollections, getTableName, getTableVarName, getTenantConfig, hasFieldAccessRules, includePaths, isAddressableId, isJunctionBackedRelation, isPropertyBuilder, isRebaseInternalTable, isRelationRequired, isRelationalCollection, mergeIncludeSpecs, normalizeDriverOrderBy, normalizeEmail, normalizeInclude, normalizeOrderBy, normalizeToEntityRelation, not, or, paginateFind, parseIdValues, parseOrderBySpecStrict, policyToPostgres, primaryOrderBy, reconcileCursorOrder, registerConditionOperations, relationDeclaringProperty, relationalCollections, requireCallbackClient, requireCallbackCollection, resolveArrayProperties, resolveCollectionRelations, resolveDataSource, resolveEnumValues, resolveFindWindow, resolveJunctionSpecs, resolvePrimaryKeys, resolveProperties, resolveProperty, resolvePropertyEnum, resolveRelation, resolveRelationProperty, resolveStorageFilenameString, resolveStoragePathString, resolveStorageSource, resolveStringColumnLength, resolveTenantWrite, restrictedFieldNames, revokeInternalTableAccess, revokeInternalTableSql, sanitizeData, securityRuleToConditions, segmentsToStrippedPath, serializeFilter, serializeInclude, serializeLogicalCondition, serializeOrderBy, sortCollectionsBySlug, sortProperties, sqlRows, sqlToPolicy, stripCollectionPath, tenantBypassRoles, tenantPolicyName, tenantScopeExpression, toCallbackError, toFilterTuples, topLevelIncludeNames, traverseValueProperty, traverseValuesProperties, updateDateAutoValues, updateUserAutoValues, wrapAsEntityData, wrapAsSdkData };
 
 //# sourceMappingURL=index.es.js.map