@rebasepro/common 0.8.0 → 0.9.1-canary.09aaf62

package/src/util/policy/policyToPostgres.ts

@@ -1,5 +1,38 @@
-import { EntityCollection, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
+import { getTableName } from "../relations";
+
+/**
+ * Options for {@link policyToPostgres}.
+ */
+export interface PolicyCompileOptions {
+    /**
+     * Resolve a collection by slug. Required to compile
+     * {@link ExistsInPolicyExpression} (`policy.existsIn`) — the compiler needs
+     * the joined collection to derive its table name / schema. When omitted, the
+     * join table falls back to a snake_cased slug.
+     */
+    resolveCollection?: (slug: string) => CollectionConfig | undefined;
+}
+
+/**
+ * The lexical scope threaded through compilation. It changes when we descend
+ * into an `existsIn` subquery: inside it, `field` refers to the joined table
+ * (aliased) while `outerField` refers to the outer RLS row (table-qualified).
+ */
+interface CompileScope {
+    /** Collection whose columns a bare `field` operand resolves against. */
+    fieldCollection?: CollectionConfig;
+    /** SQL prefix for `field` operands (`""` at top level, `"alias".` in a subquery). */
+    fieldPrefix: string;
+    /** The outer RLS collection, for `outerField` operands. */
+    outerCollection?: CollectionConfig;
+    /** SQL prefix for `outerField` operands (`""` at top level, `"schema"."table".` in a subquery). */
+    outerPrefix: string;
+    resolveCollection?: (slug: string) => CollectionConfig | undefined;
+    /** Monotonic counter for generating unique subquery aliases. */
+    alias: { n: number };
+}
 
 /**
  * Compiles a {@link PolicyExpression} to a PostgreSQL boolean SQL string,
@@ -9,7 +42,18 @@ import { toSnakeCase } from "@rebasepro/utils";
  * {@link evaluatePolicy}); the Postgres schema generators call it so that DDL
  * and the admin UI derive from the exact same expression.
  */
-export function policyToPostgres(expr: PolicyExpression, collection?: EntityCollection): string {
+export function policyToPostgres(expr: PolicyExpression, collection?: CollectionConfig, options?: PolicyCompileOptions): string {
+    return compile(expr, {
+        fieldCollection: collection,
+        fieldPrefix: "",
+        outerCollection: collection,
+        outerPrefix: "",
+        resolveCollection: options?.resolveCollection,
+        alias: { n: 0 }
+    });
+}
+
+function compile(expr: PolicyExpression, scope: CompileScope): string {
     switch (expr.kind) {
         case "true":
             return "true";
@@ -18,30 +62,76 @@ export function policyToPostgres(expr: PolicyExpression, collection?: EntityColl
         case "and":
             return expr.operands.length === 0
                 ? "true"
-                : expr.operands.map(o => `(${policyToPostgres(o, collection)})`).join(" AND ");
+                : expr.operands.map(o => `(${compile(o, scope)})`).join(" AND ");
         case "or":
             return expr.operands.length === 0
                 ? "false"
-                : expr.operands.map(o => `(${policyToPostgres(o, collection)})`).join(" OR ");
+                : expr.operands.map(o => `(${compile(o, scope)})`).join(" OR ");
         case "not":
-            // Render the common `auth.uid() IS NULL` (unauthenticated) form directly.
-            if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
-            return `NOT (${policyToPostgres(expr.operand, collection)})`;
-        case "compare":
-            return `${operandToSql(expr.left, collection)} ${COMPARE_SQL[expr.op]} ${operandToSql(expr.right, collection)}`;
+            return `NOT (${compile(expr.operand, scope)})`;
+        case "compare": {
+            // `auth.uid()` returns text; cast the column side so uuid / integer
+            // id columns compare cleanly instead of failing with
+            // "operator does not exist: uuid = text" at CREATE POLICY time.
+            const castForAuthUid = (operand: PolicyOperand, sqlText: string, other: PolicyOperand): string =>
+                other.kind === "authUid" && (operand.kind === "field" || operand.kind === "outerField")
+                    ? `(${sqlText})::text`
+                    : sqlText;
+            const leftSql = castForAuthUid(expr.left, operandToSql(expr.left, scope), expr.right);
+            const rightSql = castForAuthUid(expr.right, operandToSql(expr.right, scope), expr.left);
+            return `${leftSql} ${COMPARE_SQL[expr.op]} ${rightSql}`;
+        }
         case "rolesOverlap":
             return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
         case "rolesContain":
             return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
         case "authenticated":
-            return "auth.uid() IS NOT NULL";
+            // `IS NOT NULL` alone is a tautology on the user path: every
+            // user-context request sets `app.user_id`, and an anonymous one sets
+            // it to the sentinel. Excluding the sentinel is what makes this mean
+            // "signed in" rather than "anyone at all".
+            return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+        case "serverContext":
+            // Only the built-in server flows leave `app.user_id` unset.
+            return "auth.uid() IS NULL";
+        case "existsIn":
+            return compileExistsIn(expr, scope);
         case "raw":
-            // Full-power escape hatch: `{column}` references resolve to the bare
-            // column name (matching the previous raw-SQL behavior).
-            return expr.sql.replace(/\{(\w+)\}/g, (_, col) => col);
+            // Full-power escape hatch: `{column}` denotes a column of the outer
+            // RLS row. It must be table-qualified, not bare: raw SQL may open its
+            // own subquery over the same table, and there a bare name binds to the
+            // inner scope, collapsing `m.x = {x}` into the tautology `m.x = m.x`.
+            return expr.sql.replace(/\{(\w+)\}/g, (_, col) =>
+                `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
     }
 }
 
+/**
+ * Compiles `existsIn` to a correlated `EXISTS (SELECT 1 FROM <join> WHERE ...)`.
+ * Inside the subquery, `field` operands bind to the aliased join table and
+ * `outerField` operands bind to the (table-qualified) outer RLS row.
+ */
+function compileExistsIn(expr: ExistsInPolicyExpression, scope: CompileScope): string {
+    const join = scope.resolveCollection?.(expr.collection);
+    const joinTable = join ? getTableName(join) : toSnakeCase(expr.collection);
+    const joinSchema = schemaOf(join) ?? schemaOf(scope.outerCollection) ?? "public";
+    const alias = `_ex${scope.alias.n++}`;
+
+    // `outerField` inside the subquery must be qualified with the outer table,
+    // otherwise a bare column name would bind to the joined table instead.
+    const outerPrefix = outerQualifier(scope);
+
+    const innerScope: CompileScope = {
+        fieldCollection: join,
+        fieldPrefix: `"${alias}".`,
+        outerCollection: scope.outerCollection,
+        outerPrefix,
+        resolveCollection: scope.resolveCollection,
+        alias: scope.alias
+    };
+    return `EXISTS (SELECT 1 FROM "${joinSchema}"."${joinTable}" "${alias}" WHERE ${compile(expr.where, innerScope)})`;
+}
+
 const COMPARE_SQL: Record<PolicyCompareOperator, string> = {
     eq: "=",
     neq: "!=",
@@ -51,10 +141,12 @@ const COMPARE_SQL: Record<PolicyCompareOperator, string> = {
     gte: ">="
 };
 
-function operandToSql(operand: PolicyOperand, collection?: EntityCollection): string {
+function operandToSql(operand: PolicyOperand, scope: CompileScope): string {
     switch (operand.kind) {
         case "field":
-            return resolveColumnName(operand.name, collection);
+            return `${scope.fieldPrefix}${resolveColumnName(operand.name, scope.fieldCollection)}`;
+        case "outerField":
+            return `${scope.outerPrefix}${resolveColumnName(operand.name, scope.outerCollection)}`;
         case "literal":
             return quoteLiteral(operand.value);
         case "authUid":
@@ -64,7 +156,21 @@ function operandToSql(operand: PolicyOperand, collection?: EntityCollection): st
     }
 }
 
-function resolveColumnName(propName: string, collection?: EntityCollection): string {
+/**
+ * SQL prefix that qualifies a column of the outer RLS row (`"schema"."table".`),
+ * or `""` when the collection is unknown.
+ */
+function outerQualifier(scope: CompileScope): string {
+    const table = scope.outerCollection ? getTableName(scope.outerCollection) : undefined;
+    if (!table) return "";
+    return `"${schemaOf(scope.outerCollection) ?? "public"}"."${table}".`;
+}
+
+function schemaOf(collection?: CollectionConfig): string | undefined {
+    return (collection as { schema?: string } | undefined)?.schema || undefined;
+}
+
+function resolveColumnName(propName: string, collection?: CollectionConfig): string {
     const prop = collection?.properties?.[propName] as Property | undefined;
     if (prop && "columnName" in prop && typeof (prop as { columnName?: unknown }).columnName === "string") {
         return (prop as { columnName: string }).columnName;
@@ -80,6 +186,6 @@ function quoteLiteral(value: string | number | boolean | null): string {
 }
 
 /** Sorted, single-quoted `ARRAY['a','b']` — matches the generators' output. */
-function rolesArraySql(roles: string[]): string {
+function rolesArraySql(roles: readonly string[]): string {
     return `ARRAY[${[...roles].sort().map(r => `'${r}'`).join(",")}]`;
 }

package/src/util/policy/sqlToPolicy.ts

@@ -1,4 +1,4 @@
-import { PolicyExpression, policy } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, LiteralPolicyOperand, PolicyExpression, policy } from "@rebasepro/types";
 
 /**
  * A tiny, regex-based SQL "parser" for security rules.
@@ -11,15 +11,103 @@ import { PolicyExpression, policy } from "@rebasepro/types";
  * - `field = 'literal'`
  * - `field != 'literal'`
  * - `field = current_setting('app.user_id')`
- * - `A AND B`
+ * - `A AND B`, `A OR B` — only where the keyword is at the top level
  * - `true`
  * - `IN (...)` (as optimistic true)
  *
  * For anything it doesn't understand, it returns a `raw` expression, which
  * the evaluator treats as "unknown" (and usually optimistic true).
+ *
+ * **This output also round-trips back into DDL** via `policyToPostgres` (the
+ * schema/policy generators), so decomposing a clause the parser only partly
+ * understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
+ * prefer `raw`: it is reproduced verbatim.
  */
+/** True when `keyword` starts at `i` as a standalone word. */
+function isKeywordAt(upper: string, i: number, keyword: string): boolean {
+    if (!upper.startsWith(keyword, i)) return false;
+    const before = i === 0 ? " " : upper[i - 1];
+    const after = upper[i + keyword.length] ?? " ";
+    return /[\s()]/.test(before) && /[\s()]/.test(after);
+}
+
+/**
+ * Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
+ * outside a string literal. Returns null when it never does, so the caller
+ * leaves the clause alone.
+ *
+ * This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
+ * `AND` inside
+ *   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+ * split the expression, and re-emitting the halves produced
+ *   `(EXISTS (...) AND m.user_id = auth.uid())`
+ * where `m` is no longer in scope — SQL that Postgres rejects outright with
+ * "missing FROM-clause entry for table". Returning null instead keeps such a
+ * clause as a `raw` expression, which round-trips verbatim.
+ */
+function splitTopLevel(sql: string, keyword: "AND" | "OR"): string[] | null {
+    const upper = sql.toUpperCase();
+    const parts: string[] = [];
+    let depth = 0;
+    let inString = false;
+    let start = 0;
+
+    for (let i = 0; i < sql.length; i++) {
+        const ch = sql[i];
+        if (inString) {
+            if (ch === "'") {
+                if (sql[i + 1] === "'") i++; // '' escapes a quote inside a literal
+                else inString = false;
+            }
+            continue;
+        }
+        if (ch === "'") { inString = true; continue; }
+        if (ch === "(") { depth++; continue; }
+        if (ch === ")") { depth--; continue; }
+        if (depth === 0 && isKeywordAt(upper, i, keyword)) {
+            parts.push(sql.slice(start, i));
+            i += keyword.length - 1;
+            start = i + 1;
+        }
+    }
+
+    if (parts.length === 0) return null;
+    parts.push(sql.slice(start));
+    const trimmedParts = parts.map(p => p.trim()).filter(p => p.length > 0);
+    return trimmedParts.length > 1 ? trimmedParts : null;
+}
+
+/** Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`. */
+function stripOuterParens(sql: string): string {
+    let s = sql.trim();
+    for (;;) {
+        if (!s.startsWith("(") || !s.endsWith(")")) return s;
+        let depth = 0;
+        let inString = false;
+        let wraps = true;
+        for (let i = 0; i < s.length; i++) {
+            const ch = s[i];
+            if (inString) {
+                if (ch === "'") {
+                    if (s[i + 1] === "'") i++;
+                    else inString = false;
+                }
+                continue;
+            }
+            if (ch === "'") { inString = true; continue; }
+            if (ch === "(") depth++;
+            else if (ch === ")") {
+                depth--;
+                if (depth === 0 && i < s.length - 1) { wraps = false; break; }
+            }
+        }
+        if (!wraps) return s;
+        s = s.slice(1, -1).trim();
+    }
+}
+
 export function sqlToPolicy(sql: string): PolicyExpression {
-    const trimmed = sql.trim();
+    const trimmed = stripOuterParens(sql.trim());
 
     if (trimmed.toLowerCase() === "true") return policy.true();
     if (trimmed.toLowerCase() === "false") return policy.false();
@@ -40,17 +128,12 @@ export function sqlToPolicy(sql: string): PolicyExpression {
         return policy.rolesContain(roles);
     }
 
-    // Handle OR
-    if (trimmed.toUpperCase().includes(" OR ")) {
-        const parts = trimmed.split(/ OR /i);
-        return policy.or(...parts.map(sqlToPolicy));
-    }
+    // OR binds looser than AND, so it splits first.
+    const orParts = splitTopLevel(trimmed, "OR");
+    if (orParts) return policy.or(...orParts.map(sqlToPolicy));
 
-    // Handle AND (very basic split, doesn't handle nested parens properly)
-    if (trimmed.toUpperCase().includes(" AND ")) {
-        const parts = trimmed.split(/ AND /i);
-        return policy.and(...parts.map(sqlToPolicy));
-    }
+    const andParts = splitTopLevel(trimmed, "AND");
+    if (andParts) return policy.and(...andParts.map(sqlToPolicy));
 
     // Handle = and !=
     const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
@@ -67,6 +150,100 @@ export function sqlToPolicy(sql: string): PolicyExpression {
     return policy.raw(sql);
 }
 
+/**
+ * Literals from other BaaS platforms that people compare `auth.uid()` against
+ * out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
+ * `pgRoles`, one surface over: the same muscle memory inside a `using:` string
+ * is the more dangerous spelling, because it inverts a rule instead of
+ * emptying a table.
+ */
+const FOREIGN_CONVENTION_UIDS: Record<string, string> = {
+    anon: "Supabase",
+    authenticated: "Supabase",
+    service_role: "Supabase"
+};
+
+/** A clause that reads as a lockdown but admits anonymous callers. */
+export interface AnonymousGrantRisk {
+    /** Which spelling was found. */
+    pattern: "foreign-uid-literal" | "uid-not-null";
+    /** The offending fragment — the literal, or the SQL that is a tautology. */
+    detail: string;
+    /** Why it admits anonymous callers, and what to write instead. */
+    explanation: string;
+}
+
+/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
+const UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+
+/**
+ * Find clauses that read as "signed-in users only" but admit anonymous callers.
+ *
+ * Both spellings come from the same place — Supabase, where `auth.uid()` really
+ * is NULL for an anonymous request. Rebase substitutes
+ * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
+ * is how the trusted *server* context is recognised), so:
+ *
+ *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
+ *  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+ *
+ * Either one turns a lockdown into a full grant, and neither looks wrong. No
+ * real user id is ever one of these literals, and a user-context request is
+ * never NULL, so a match is always a mistake rather than a deliberate check.
+ *
+ * Structured expressions are checked too, not just parsed SQL: `policy.compare`
+ * can spell the same mistake.
+ */
+export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[] {
+    const found: AnonymousGrantRisk[] = [];
+
+    const visit = (e: PolicyExpression): void => {
+        switch (e.kind) {
+            case "and":
+            case "or":
+                e.operands.forEach(visit);
+                return;
+            case "not":
+                visit(e.operand);
+                return;
+            case "existsIn":
+                visit(e.where);
+                return;
+            case "raw":
+                if (UID_NOT_NULL.test(e.sql)) {
+                    found.push({
+                        pattern: "uid-not-null",
+                        detail: e.sql,
+                        explanation: "`auth.uid() IS NOT NULL` is true for every request that came from a client, " +
+                            `including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. ` +
+                            "Use `condition: policy.authenticated()` to mean \"signed in\"."
+                    });
+                }
+                return;
+            case "compare": {
+                const literal = [e.left, e.right].find(o => o.kind === "literal") as LiteralPolicyOperand | undefined;
+                const comparesUid = e.left.kind === "authUid" || e.right.kind === "authUid";
+                if (!comparesUid || typeof literal?.value !== "string") return;
+                const platform = FOREIGN_CONVENTION_UIDS[literal.value];
+                if (!platform) return;
+                found.push({
+                    pattern: "foreign-uid-literal",
+                    detail: literal.value,
+                    explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous ` +
+                        `request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for ` +
+                        "every caller. Use `condition: policy.authenticated()` to mean \"signed in\"."
+                });
+                return;
+            }
+            default:
+                return;
+        }
+    };
+
+    visit(expr);
+    return found;
+}
+
 function parseOperand(str: string) {
     // current_setting('app.user_id') or auth.uid()
     if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {

package/src/util/references.ts

@@ -1,6 +1,6 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
-export function getEntityImagePreviewPropertyKey<M extends Record<string, unknown>>(collection: EntityCollection<M>): string | undefined {
+export function getEntityImagePreviewPropertyKey<M extends Record<string, unknown>>(collection: CollectionConfig<M>): string | undefined {
 
     // find first storage property of type image
     for (const key in collection.properties) {

package/src/util/relations.ts

@@ -1,18 +1,18 @@
-import { EntityCollection, getDataSourceCapabilities, Property, Relation, RelationProperty } from "@rebasepro/types";
+import { CollectionConfig, getDataSourceCapabilities, Property, Relation, RelationProperty } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
 import { generateForeignKeyName } from "@rebasepro/utils";
 
 export function sanitizeRelation(
     relation: Partial<Relation>,
-    sourceCollection: EntityCollection,
-    resolveCollection?: (slugOrTable: string) => EntityCollection | undefined
+    sourceCollection: CollectionConfig,
+    resolveCollection?: (slugOrTable: string) => CollectionConfig | undefined
 ): Relation {
     if (!relation.target) {
         throw new Error("Relation is missing a `target` collection.");
     }
 
     const rawTarget = relation.target;
-    let targetCollection: EntityCollection | undefined;
+    let targetCollection: CollectionConfig | undefined;
 
     if (typeof rawTarget === "string") {
         if (resolveCollection) {
@@ -20,7 +20,7 @@ export function sanitizeRelation(
         }
         if (!targetCollection) {
             targetCollection = { slug: rawTarget,
-name: rawTarget } as EntityCollection;
+name: rawTarget } as CollectionConfig;
         }
     } else if (typeof rawTarget === "function") {
         const evaluated = rawTarget();
@@ -30,13 +30,13 @@ name: rawTarget } as EntityCollection;
             }
             if (!targetCollection) {
                 targetCollection = { slug: evaluated,
-name: evaluated } as EntityCollection;
+name: evaluated } as CollectionConfig;
             }
         } else {
             targetCollection = evaluated;
         }
     } else if (rawTarget && typeof rawTarget === "object") {
-        targetCollection = rawTarget as EntityCollection;
+        targetCollection = rawTarget as CollectionConfig;
     }
 
     if (!targetCollection) {
@@ -198,10 +198,10 @@ name: evaluated } as EntityCollection;
 }
 
 /** WeakMap cache — same collection instance always yields the same relation map. */
-const _resolvedRelationsCache = new WeakMap<EntityCollection, Record<string, Relation>>();
+const _resolvedRelationsCache = new WeakMap<CollectionConfig, Record<string, Relation>>();
 
 export function resolveCollectionRelations(
-    collection: EntityCollection
+    collection: CollectionConfig
 ): Record<string, Relation> {
     const cached = _resolvedRelationsCache.get(collection);
     if (cached) return cached;
@@ -251,7 +251,7 @@ export function resolveCollectionRelations(
 
                 // We previously skipped if the underlying relation was already registered under
                 // its canonical relationName in section 1. But we need to keep the property mapping
-                // for EntityFetchService to hydrate the relation back to the correct property key.
+                // for FetchService to hydrate the relation back to the correct property key.
                 // Deduplication for Drizzle schema generation is handled in generate-drizzle-schema-logic.ts.
 
                 if (!relation.relationName) {
@@ -275,7 +275,7 @@ export function resolvePropertyRelation({
 }: {
     propertyKey: string;
     property: Property;
-    sourceCollection: EntityCollection;
+    sourceCollection: CollectionConfig;
 }): Relation | undefined {
     if (property.type !== "relation") return undefined;
 
@@ -304,7 +304,7 @@ export function resolvePropertyRelation({
     return undefined;
 }
 
-export function getTableName(collection: EntityCollection): string {
+export function getTableName(collection: CollectionConfig): string {
     if (getDataSourceCapabilities(collection.engine).supportsRelations) {
         return collection.table ?? toSnakeCase(collection.slug) ?? toSnakeCase(collection.name);
     }

package/src/util/resolutions.ts

@@ -1,7 +1,7 @@
 import {
     ArrayProperty,
     AuthController,
-    EntityCollection,
+    CollectionConfig,
     EnumValueConfig,
     EnumValues,
     NumberProperty,
@@ -341,7 +341,7 @@ export function resolveEnumValues(input: EnumValues): EnumValueConfig[] | undefi
 }
 
 
-export function getSubcollections<M extends Record<string, unknown> = Record<string, unknown>>(collection: EntityCollection<M>): EntityCollection<Record<string, unknown>>[] {
+export function getSubcollections<M extends Record<string, unknown> = Record<string, unknown>>(collection: CollectionConfig<M>): CollectionConfig<Record<string, unknown>>[] {
     if (collection.childCollections) {
         return collection.childCollections() ?? [];
     }
@@ -371,7 +371,7 @@ export function getSubcollections<M extends Record<string, unknown> = Record<str
                 }
             }
 
-            const baseOverrides: Partial<EntityCollection> = { slug: relationKey };
+            const baseOverrides: Partial<CollectionConfig> = { slug: relationKey };
             if (customName) {
                 baseOverrides.name = customName;
                 baseOverrides.singularName = customName;
@@ -379,8 +379,8 @@ export function getSubcollections<M extends Record<string, unknown> = Record<str
 
             const targetWithOverrides = { ...target,
 ...baseOverrides };
-            return (r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides) as EntityCollection<Record<string, unknown>>;
-        }).filter((c: EntityCollection<Record<string, unknown>> | undefined): c is EntityCollection<Record<string, unknown>> => Boolean(c));
+            return (r.overrides ? mergeDeep(targetWithOverrides, r.overrides) : targetWithOverrides) as CollectionConfig<Record<string, unknown>>;
+        }).filter((c: CollectionConfig<Record<string, unknown>> | undefined): c is CollectionConfig<Record<string, unknown>> => Boolean(c));
     }
 
     return [];