@rebasepro/common 0.4.0 → 0.6.0

package/dist/util/entities.d.ts

@@ -29,9 +29,13 @@ export declare function getRelationFrom<M extends Record<string, unknown>>(entit
  * Handles EntityRelation class instances, and plain objects
  * with `__type === "relation"` or an `isEntityRelation()` method.
  *
+ * When `propertyType` is `"relation"`, also accepts plain objects that
+ * have `id` and `path` fields — these are relation-shaped objects from
+ * edge cases in the data pipeline (REST fallback, stale cache, custom data source).
+ *
  * Returns null if the value cannot be coerced.
  */
-export declare function normalizeToEntityRelation(value: unknown): EntityRelation | null;
+export declare function normalizeToEntityRelation(value: unknown, propertyType?: string): EntityRelation | null;
 export declare function traverseValuesProperties<M extends Record<string, unknown>>(inputValues: Partial<EntityValues<M>>, properties: Properties, operation: (value: unknown, property: Property) => unknown): EntityValues<M> | undefined;
 export declare function traverseValueProperty(inputValue: unknown, property: Property, operation: (value: unknown, property: Property) => unknown): unknown;
 /**

package/dist/util/permissions.d.ts

@@ -1,6 +1,14 @@
-import { AuthController, Entity, EntityCollection, User } from "@rebasepro/types";
-export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, entity: Entity<M> | null, targetOperation: "select" | "insert" | "update" | "delete"): boolean;
-export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>): boolean;
-export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
-export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authController: AuthController<USER>, path: string, entity: Entity<M> | null): boolean;
+import { Entity, EntityCollection, User } from "@rebasepro/types";
+/**
+ * Minimal auth context for permission checking.
+ * Only requires the user object — avoids forcing callers to construct
+ * a full AuthController just to check permissions.
+ */
+export interface AuthContext<USER extends User = User> {
+    user: USER | null;
+}
+export declare function checkOperation<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, entity: Entity<M> | null, targetOperation: "select" | "insert" | "update" | "delete"): boolean;
+export declare function canReadCollection<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>): boolean;
+export declare function canEditEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canCreateEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;
+export declare function canDeleteEntity<M extends Record<string, unknown>, USER extends User>(collection: EntityCollection<M>, authContext: AuthContext<USER>, path: string, entity: Entity<M> | null): boolean;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "description": "Awesome Firebase/Firestore-based headless open-source CMS",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -41,27 +41,27 @@
   "dependencies": {
     "fast-equals": "6.0.0",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/types": "0.4.0",
-    "@rebasepro/utils": "0.4.0"
+    "@rebasepro/types": "0.6.0",
+    "@rebasepro/utils": "0.6.0"
   },
   "devDependencies": {
-    "@jest/globals": "^29.7.0",
+    "@jest/globals": "^30.4.1",
     "@testing-library/react": "^16.3.2",
     "@testing-library/user-event": "^14.6.1",
-    "@types/jest": "^29.5.14",
-    "@types/node": "^20.19.41",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^25.9.3",
     "@types/object-hash": "^3.0.6",
-    "@types/react": "^19.2.15",
+    "@types/react": "^19.2.17",
     "@types/react-dom": "^19.2.3",
     "@types/react-measure": "^2.0.12",
-    "@vitejs/plugin-react": "^4.7.0",
+    "@vitejs/plugin-react": "^6.0.2",
     "babel-plugin-react-compiler": "beta",
-    "cross-env": "^7.0.3",
-    "jest": "^29.7.0",
-    "ts-jest": "^29.4.10",
-    "tsd": "^0.31.2",
-    "typescript": "^5.9.3",
-    "vite": "^5.4.21"
+    "cross-env": "^10.1.0",
+    "jest": "^30.4.2",
+    "ts-jest": "^29.4.11",
+    "tsd": "^0.33.0",
+    "typescript": "^6.0.3",
+    "vite": "^8.0.16"
   },
   "files": [
     "dist",

package/src/collections/CollectionRegistry.ts

@@ -258,7 +258,7 @@ export class CollectionRegistry {
                         joinPath: relProp.joinPath ?? relProp.relation?.joinPath,
                         onUpdate: relProp.onUpdate ?? relProp.relation?.onUpdate,
                         onDelete: relProp.onDelete ?? relProp.relation?.onDelete,
-                        overrides: relProp.overrides ?? relProp.relation?.overrides,
+                        overrides: relProp.overrides ?? relProp.relation?.overrides
                     });
                 }
             } else if (property.type === "map" && property.properties) {
@@ -305,7 +305,7 @@ export class CollectionRegistry {
             const relation = relations.find(r => r.relationName === name);
             if (relation) {
                 // we attach the resolved relation to the property
-                (relationProperty as RelationProperty & { relation?: Relation }).relation = relation;
+                relationProperty.relation = relation;
             } else {
                 console.warn(`Could not find relation for property '${key}' with relationName: ${name}`);
             }

package/src/collections/default-collections.ts

@@ -11,6 +11,7 @@ export const defaultUsersCollection: PostgresCollection = {
     name: "Users",
     singularName: "User",
     slug: "users",
+    auth: true,
     table: "users",
     schema: "rebase",
     icon: "Users",
@@ -18,8 +19,10 @@ export const defaultUsersCollection: PostgresCollection = {
     openEntityMode: "dialog",
     disableDefaultActions: ["copy"],
     securityRules: [
-        { operation: "select", roles: ["admin"] },
-        { operations: ["insert", "update", "delete"], roles: ["admin"] }
+        { operation: "select",
+roles: ["admin"] },
+        { operations: ["insert", "update", "delete"],
+roles: ["admin"] }
     ],
     sort: ["createdAt", "desc"],
     properties: {
@@ -32,7 +35,8 @@ export const defaultUsersCollection: PostgresCollection = {
         email: {
             name: "Email",
             type: "string",
-            validation: { required: true, unique: true }
+            validation: { required: true,
+unique: true }
         },
         displayName: {
             name: "Name",
@@ -64,32 +68,39 @@ export const defaultUsersCollection: PostgresCollection = {
             name: "Password Hash",
             type: "string",
             columnName: "password_hash",
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         },
         emailVerified: {
             name: "Email Verified",
             type: "boolean",
             columnName: "email_verified",
             defaultValue: false,
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         },
         emailVerificationToken: {
             name: "Email Verification Token",
             type: "string",
             columnName: "email_verification_token",
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         },
         emailVerificationSentAt: {
             name: "Email Verification Sent At",
             type: "date",
             columnName: "email_verification_sent_at",
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         },
         metadata: {
             name: "Metadata",
             type: "map",
+            keyValue: true,
+            properties: {},
             defaultValue: {},
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         },
         createdAt: {
             name: "Created At",
@@ -103,7 +114,8 @@ export const defaultUsersCollection: PostgresCollection = {
             type: "date",
             columnName: "updated_at",
             autoValue: "on_update",
-            ui: { hideFromCollection: true, disabled: { hidden: true } }
+            ui: { hideFromCollection: true,
+disabled: { hidden: true } }
         }
     },
     listProperties: ["displayName", "email", "roles", "createdAt"],

package/src/data/query_builder.ts

@@ -1,15 +1,19 @@
 import { FindParams, Entity, FindResponse, CollectionAccessor, QueryBuilderInterface, FilterOperator, LogicalCondition, WhereValue, FilterCondition } from "@rebasepro/types";
 
 export function or(...conditions: (FilterCondition | LogicalCondition)[]): LogicalCondition {
-    return { type: "or", conditions };
+    return { type: "or",
+conditions };
 }
 
 export function and(...conditions: (FilterCondition | LogicalCondition)[]): LogicalCondition {
-    return { type: "and", conditions };
+    return { type: "and",
+conditions };
 }
 
 export function cond(column: string, operator: FilterOperator, value: unknown): FilterCondition {
-    return { column, operator, value };
+    return { column,
+operator,
+value };
 }
 
 export class QueryBuilder<M extends Record<string, unknown> = Record<string, unknown>> implements QueryBuilderInterface<M> {

package/src/util/entities.ts

@@ -156,9 +156,13 @@ export function getRelationFrom<M extends Record<string, unknown>>(entity: Entit
  * Handles EntityRelation class instances, and plain objects
  * with `__type === "relation"` or an `isEntityRelation()` method.
  *
+ * When `propertyType` is `"relation"`, also accepts plain objects that
+ * have `id` and `path` fields — these are relation-shaped objects from
+ * edge cases in the data pipeline (REST fallback, stale cache, custom data source).
+ *
  * Returns null if the value cannot be coerced.
  */
-export function normalizeToEntityRelation(value: unknown): EntityRelation | null {
+export function normalizeToEntityRelation(value: unknown, propertyType?: string): EntityRelation | null {
     if (value instanceof EntityRelation) return value;
     if (!value || typeof value !== "object" || Array.isArray(value)) return null;
 
@@ -167,7 +171,8 @@ export function normalizeToEntityRelation(value: unknown): EntityRelation | null
         obj.__type === "relation" ||
         obj.__type === "reference" ||
         (typeof obj.isEntityRelation === "function" && (obj.isEntityRelation as () => boolean)()) ||
-        (typeof obj.isEntityReference === "function" && (obj.isEntityReference as () => boolean)());
+        (typeof obj.isEntityReference === "function" && (obj.isEntityReference as () => boolean)()) ||
+        (propertyType === "relation" && typeof obj.id !== "undefined" && typeof obj.path === "string");
 
     if (!isRelationLike) return null;
 
@@ -263,7 +268,9 @@ export interface RelationRefWithData extends RelationRef {
  * Replaces inline `{ id, path, __type: "relation" }` object literals.
  */
 export function createRelationRef(id: string | number, path: string): RelationRef {
-    return { id, path, __type: "relation" };
+    return { id,
+path,
+__type: "relation" };
 }
 
 /**
@@ -271,5 +278,8 @@ export function createRelationRef(id: string | number, path: string): RelationRe
  * Used when entity data has been pre-fetched (e.g., via batch loading or JOINs).
  */
 export function createRelationRefWithData(id: string | number, path: string, data: Entity): RelationRefWithData {
-    return { id, path, __type: "relation", data };
+    return { id,
+path,
+__type: "relation",
+data };
 }

package/src/util/permissions.ts

@@ -1,6 +1,15 @@
-import { AuthController, CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+import { CollectionWithRelations, Entity, EntityCollection, getDataSourceCapabilities, SecurityRule, User } from "@rebasepro/types";
+
+/**
+ * Minimal auth context for permission checking.
+ * Only requires the user object — avoids forcing callers to construct
+ * a full AuthController just to check permissions.
+ */
+export interface AuthContext<USER extends User = User> {
+    user: USER | null;
+}
 
-function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthController<USER>, entity: Entity<M> | null): boolean {
+function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlString: string, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
     // This is a client-side SQL evaluator used *only* for optimistic UI updates.
     // It parses basic AND / OR statements to evaluate RLS without backend roundtrips.
     if (!entity) return true;
@@ -111,7 +120,7 @@ function evaluateAST<USER extends User, M extends Record<string, unknown>>(sqlSt
     return true; // Optimistic fallback for anything else
 }
 
-function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthController<USER>, entity: Entity<M> | null): boolean {
+function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule: SecurityRule, auth: AuthContext<USER>, entity: Entity<M> | null): boolean {
 
     if (rule.access === "public") return true;
 
@@ -137,15 +146,12 @@ function evaluateRule<USER extends User, M extends Record<string, unknown>>(rule
 
 export function checkOperation<M extends Record<string, unknown>, USER extends User>(
     collection: EntityCollection<M>,
-    authController: AuthController<USER>,
+    authContext: AuthContext<USER>,
     entity: Entity<M> | null,
     targetOperation: "select" | "insert" | "update" | "delete"
 ): boolean {
     const securityRules = getDataSourceCapabilities(collection.driver).supportsRLS ? (collection as CollectionWithRelations).securityRules : undefined;
     if (!securityRules || securityRules.length === 0) {
-        // According to our plan: Postgres RLS implicitly denies if enabled without rules.
-        // But for Rebase we default to true if securityRules is undefined,
-        // so as not to break everything without rules. Let's assume true for now.
         return true;
     }
 
@@ -158,15 +164,13 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 
     if (applicableRules.length === 0) return false;
 
-    // In Postgres, policies ONLY apply if the user matching the targeted roles.
-    const userRoleIds = authController.user?.roles ?? [];
+    const userRoleIds = authContext.user?.roles ?? [];
     const userRoles = [...userRoleIds, "public"];
     const roleApplicableRules = applicableRules.filter((rule: SecurityRule) => {
-        if (!rule.roles || rule.roles.length === 0) return true; // APPLIES TO PUBLIC
+        if (!rule.roles || rule.roles.length === 0) return true;
         return rule.roles.some((r: string) => userRoles.includes(r));
     });
 
-    // If no rules apply to this user's roles, the operation is implicitly denied.
     if (roleApplicableRules.length === 0) return false;
 
     let grantedByPermissive = false;
@@ -174,11 +178,11 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 
     for (const rule of roleApplicableRules) {
         const mode = rule.mode || "permissive";
-        const passed = evaluateRule(rule, authController, entity);
+        const passed = evaluateRule(rule, authContext, entity);
 
         if (mode === "restrictive" && !passed) {
             deniedByRestrictive = true;
-            break; // Immediate deny
+            break;
         }
 
         if (mode === "permissive" && passed) {
@@ -199,37 +203,37 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 export function canReadCollection<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>
+        authContext: AuthContext<USER>
     ): boolean {
-    return checkOperation(collection, authController, null, "select");
+    return checkOperation(collection, authContext, null, "select");
 }
 
 export function canEditEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "update");
+    return checkOperation(collection, authContext, entity, "update");
 }
 
 export function canCreateEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "insert");
+    return checkOperation(collection, authContext, entity, "insert");
 }
 
 export function canDeleteEntity<M extends Record<string, unknown>, USER extends User>
     (
         collection: EntityCollection<M>,
-        authController: AuthController<USER>,
+        authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
     ): boolean {
-    return checkOperation(collection, authController, entity, "delete");
+    return checkOperation(collection, authContext, entity, "delete");
 }

package/src/util/relations.ts

@@ -19,7 +19,8 @@ export function sanitizeRelation(
             targetCollection = resolveCollection(rawTarget);
         }
         if (!targetCollection) {
-            targetCollection = { slug: rawTarget, name: rawTarget } as EntityCollection;
+            targetCollection = { slug: rawTarget,
+name: rawTarget } as EntityCollection;
         }
     } else if (typeof rawTarget === "function") {
         const evaluated = rawTarget();
@@ -28,7 +29,8 @@ export function sanitizeRelation(
                 targetCollection = resolveCollection(evaluated);
             }
             if (!targetCollection) {
-                targetCollection = { slug: evaluated, name: evaluated } as EntityCollection;
+                targetCollection = { slug: evaluated,
+name: evaluated } as EntityCollection;
             }
         } else {
             targetCollection = evaluated;
@@ -295,7 +297,7 @@ export function resolvePropertyRelation({
             joinPath: relProp.joinPath,
             onUpdate: relProp.onUpdate,
             onDelete: relProp.onDelete,
-            overrides: relProp.overrides,
+            overrides: relProp.overrides
         } as Relation;
     }
 

package/src/util/resolutions.ts

@@ -354,7 +354,7 @@ export function getSubcollections<M extends Record<string, unknown> = Record<str
     if (getDataSourceCapabilities(collection.driver).supportsRelations) {
         const resolvedRelations = resolveCollectionRelations(collection);
         const manyRelations = Object.values(resolvedRelations).filter((r: Relation) => r.cardinality === "many");
-        
+
         return manyRelations.map((r: Relation) => {
             const target = r.target();
             if (!target) return undefined;
@@ -377,7 +377,8 @@ export function getSubcollections<M extends Record<string, unknown> = Record<str
                 baseOverrides.singularName = customName;
             }
 
-            const targetWithOverrides = { ...target, ...baseOverrides };
+            const targetWithOverrides = { ...target,
+...baseOverrides };
             return (r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides) as EntityCollection<Record<string, unknown>>;
         }).filter((c: EntityCollection<Record<string, unknown>> | undefined): c is EntityCollection<Record<string, unknown>> => Boolean(c));
     }