@rebasepro/common 0.8.0 → 0.9.1-canary.09aaf62

package/src/util/junction-policies.ts

@@ -0,0 +1,353 @@
+import {
+    CollectionConfig,
+    PolicyExpression,
+    PolicyOperand,
+    Relation,
+    SecurityRule,
+    isPostgresCollectionConfig,
+    policy
+} from "@rebasepro/types";
+import { getPolicyOperations } from "@rebasepro/utils";
+import { getTableName } from "./relations";
+import { resolveCollectionRelations } from "./relations";
+import { securityRuleToConditions } from "./policy/securityRuleToConditions";
+
+/**
+ * RLS derivation for many-to-many junction tables.
+ *
+ * A `through` relation makes the generator create a table nobody declared as a
+ * collection — `posts_tags`, `user_roles`. Those tables used to be the one kind
+ * of generated table with **no** RLS at all: `rebase_user` holds full DML grants,
+ * so with the endpoints locked down, any signed-up user could still read or wipe
+ * every edge between them. There is also nowhere in the config to write rules
+ * for a junction, so the author could not even fix it by hand.
+ *
+ * The architecture here is that a junction's security is *derived*, never
+ * hand-written:
+ *
+ *  1. **Locked baseline.** The same server-or-admin `default_admin` grants every
+ *     collection gets, so the invariant holds again: every table the generator
+ *     creates is default-deny, and rules only broaden.
+ *
+ *  2. **Reads follow the endpoints.** An edge is visible iff *both* endpoint
+ *     rows are visible — two correlated `EXISTS` subqueries. The subqueries run
+ *     under the caller's role, so each endpoint's own RLS filters them: junction
+ *     visibility delegates to the endpoints' policies, whatever they become,
+ *     with nothing duplicated. A public blog keeps rendering its tags; a private
+ *     CRM's edges are exactly as hidden as its rows.
+ *
+ *  3. **Writes follow the owning side's update rules.** Linking or unlinking an
+ *     edge *is* an edit of the owning row — tagging a post is editing the post —
+ *     so edge writes inherit the declaring collection's explicit permissive
+ *     `update` rules, each wrapped in an `EXISTS` against the owning row. Where
+ *     a rule cannot be embedded faithfully (see below) it is dropped, so the
+ *     failure mode is always *too locked*, never open. Explicit **restrictive**
+ *     update rules are inherited as restrictive junction rules; if one of them
+ *     cannot be embedded, the whole derived write grant for that side is
+ *     suppressed — granting without the author's gate would be looser than the
+ *     parent itself.
+ *
+ * **Embeddability.** A parent rule is embedded by moving its condition inside
+ * `EXISTS (SELECT 1 FROM parent WHERE parent.pk = junction.fk AND <condition>)`.
+ * In that scope, `field` operands bind to the parent — which is what the author
+ * meant. But `outerField` operands and `{column}` placeholders in `raw` SQL bind
+ * to the RLS row, which is now the junction, not the parent the author wrote
+ * them against. So: `raw` anywhere disqualifies a rule; a top-level `outerField`
+ * (equivalent to `field` outside a subquery) is rewritten to `field`; an
+ * `outerField` inside a nested `existsIn` cannot be re-scoped and disqualifies
+ * the rule.
+ *
+ * Injected parent defaults are never inherited — the junction's own baseline
+ * already covers the server/admin plane, and an auth collection's restrictive
+ * `require_admin_write` gate exists to protect privileged parent *columns*,
+ * which an edge write cannot touch. Inheriting it would stop users managing
+ * e.g. their own interests through a `users_interests` junction for no gain.
+ *
+ * Everything flows through the shared naming machinery, so the Studio
+ * recognises these policies as generated instead of offering to "import" them.
+ */
+
+/** One side of a junction: the collection and the FK column pointing at it. */
+export interface JunctionEndpoint {
+    collection: CollectionConfig;
+    /** Junction column holding this endpoint's key. */
+    junctionColumn: string;
+}
+
+/** A collection that declares the `through` relation (owns the edge semantics). */
+export interface JunctionDeclaringSide extends JunctionEndpoint {
+    relation: Relation;
+}
+
+export interface JunctionSpec {
+    /** Bare table name (schema stripped). */
+    table: string;
+    /** Schema the junction is created in — mirrors the CREATE TABLE path. */
+    schema: string;
+    /** The two endpoints, in [source, target] order of the first declaring relation. */
+    endpoints: [JunctionEndpoint, JunctionEndpoint];
+    /** Every collection that declares a relation through this table. */
+    declaringSides: JunctionDeclaringSide[];
+}
+
+// Mirrors auth-default-policies: the server context or an admin.
+const SERVER_OR_ADMIN_EXPR: PolicyExpression = policy.or(
+    policy.serverContext(),
+    policy.rolesOverlap(["admin"])
+);
+
+/**
+ * Walk every collection's resolved relations and aggregate the junction tables
+ * they declare. Two collections may declare the same junction from opposite
+ * sides (posts→tags and tags→posts through `posts_tags`); both become
+ * `declaringSides` of one spec, so derived write grants consider both.
+ */
+export function resolveJunctionSpecs(collections: CollectionConfig[]): Map<string, JunctionSpec> {
+    const specs = new Map<string, JunctionSpec>();
+
+    for (const collection of collections) {
+        const resolved = resolveCollectionRelations(collection);
+        for (const relation of Object.values(resolved)) {
+            if (!relation.through) continue;
+
+            const targetCollection: CollectionConfig | undefined =
+                typeof relation.target === "function" ? relation.target() : undefined;
+            if (!targetCollection) continue;
+
+            const rawName = relation.through.table;
+            // The CREATE TABLE path strips a schema prefix from the name but
+            // still creates in "public"; the policies must target the same
+            // table, so mirror that behaviour exactly.
+            const table = rawName.includes(".") ? rawName.split(".").pop()! : rawName;
+            const schema = "public";
+
+            const source: JunctionDeclaringSide = {
+                collection,
+                junctionColumn: relation.through.sourceColumn,
+                relation
+            };
+            const target: JunctionEndpoint = {
+                collection: targetCollection,
+                junctionColumn: relation.through.targetColumn
+            };
+
+            const existing = specs.get(table);
+            if (!existing) {
+                specs.set(table, {
+                    table,
+                    schema,
+                    endpoints: [source, target],
+                    declaringSides: [source]
+                });
+            } else if (!existing.declaringSides.some(s => s.collection === collection)) {
+                existing.declaringSides.push(source);
+            }
+        }
+    }
+
+    return specs;
+}
+
+/**
+ * A synthetic CollectionConfig standing in for the junction during policy
+ * compilation and naming. Its two FK columns carry explicit `columnName`s so
+ * `outerField` operands resolve to the exact columns the CREATE TABLE emitted,
+ * whatever their casing.
+ */
+export function getJunctionCollectionConfig(spec: JunctionSpec): CollectionConfig {
+    const properties: Record<string, unknown> = {};
+    for (const endpoint of spec.endpoints) {
+        properties[endpoint.junctionColumn] = {
+            type: "string",
+            columnName: endpoint.junctionColumn
+        };
+    }
+    return {
+        slug: spec.table,
+        name: spec.table,
+        table: spec.table,
+        schema: spec.schema,
+        properties
+    } as unknown as CollectionConfig;
+}
+
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection: CollectionConfig): string {
+    for (const [name, prop] of Object.entries(collection.properties ?? {})) {
+        if (prop && typeof prop === "object" && "isId" in prop && (prop as { isId?: unknown }).isId) {
+            return name;
+        }
+    }
+    return "id";
+}
+
+/** `EXISTS (SELECT 1 FROM endpoint WHERE endpoint.pk = junction.fk [AND extra])`. */
+function existsEndpoint(endpoint: JunctionEndpoint, extra?: PolicyExpression): PolicyExpression {
+    const correlation = policy.compare(
+        policy.field(getIdPropertyName(endpoint.collection)),
+        "eq",
+        policy.outerField(endpoint.junctionColumn)
+    );
+    return policy.existsIn({
+        collection: endpoint.collection.slug,
+        where: extra ? policy.and(correlation, extra) : correlation
+    });
+}
+
+/**
+ * Whether a parent-rule expression keeps its meaning when moved inside the
+ * junction's `EXISTS` subquery — and the re-scoped copy if it does.
+ *
+ * Returns `null` when the rule cannot be embedded faithfully: `raw` SQL
+ * anywhere (its `{column}` placeholders would bind to the junction), or an
+ * `outerField` inside a nested `existsIn` (it would bind to the junction while
+ * the author meant the parent, and no operand can express "the middle scope").
+ * Top-level `outerField`s are rewritten to `field`, which is what they meant.
+ */
+export function embedParentExpression(expr: PolicyExpression, depth = 0): PolicyExpression | null {
+    switch (expr.kind) {
+        case "raw":
+            return null;
+        case "and":
+        case "or": {
+            const parts: PolicyExpression[] = [];
+            for (const child of expr.operands) {
+                const embedded = embedParentExpression(child, depth);
+                if (!embedded) return null;
+                parts.push(embedded);
+            }
+            return expr.kind === "and" ? policy.and(...parts) : policy.or(...parts);
+        }
+        case "not": {
+            const embedded = embedParentExpression(expr.operand, depth);
+            return embedded ? policy.not(embedded) : null;
+        }
+        case "existsIn": {
+            const where = embedParentExpression(expr.where, depth + 1);
+            return where ? policy.existsIn({ collection: expr.collection, where }) : null;
+        }
+        case "compare": {
+            const left = embedOperand(expr.left, depth);
+            const right = embedOperand(expr.right, depth);
+            if (!left || !right) return null;
+            return { ...expr, left, right };
+        }
+        default:
+            // Leaf expressions with no field references (true, false,
+            // serverContext, authenticated, rolesOverlap, rolesContain) are
+            // position-independent.
+            return expr;
+    }
+}
+
+/** Re-scope an operand, or return `null` if its binding cannot be preserved. */
+function embedOperand(operand: PolicyOperand, depth: number): PolicyOperand | null {
+    if (operand.kind === "outerField") {
+        // Outside a subquery, outerField ≡ field: the author meant their own
+        // row, which after embedding is the EXISTS's joined table → field.
+        if (depth === 0) return policy.field(operand.name);
+        // Inside the author's own existsIn it meant the parent row; after
+        // embedding it would bind to the junction. Not expressible.
+        return null;
+    }
+    return operand;
+}
+
+/** Does the rule cover the `update` operation? */
+function coversUpdate(rule: SecurityRule): boolean {
+    return getPolicyOperations(rule).some(op => op === "update" || op === "all");
+}
+
+/**
+ * The full derived policy set for a junction table: the locked server/admin
+ * baseline, the endpoint-visibility read grant, inherited write grants, and
+ * inherited restrictive gates. Returns `[]` when every declaring collection set
+ * `disableDefaultPolicies` — the junction is then the author's to police, and
+ * stays locked (RLS is still enabled) until they write policies for it.
+ */
+export function getJunctionSecurityRules(spec: JunctionSpec): SecurityRule[] {
+    if (spec.declaringSides.every(side => side.collection.disableDefaultPolicies)) {
+        return [];
+    }
+
+    const rules: SecurityRule[] = [];
+
+    // 1. Locked baseline — same shape and naming as every collection's.
+    rules.push({
+        name: `${spec.table}_default_admin_read`,
+        operations: ["select"],
+        condition: SERVER_OR_ADMIN_EXPR
+    });
+    rules.push({
+        name: `${spec.table}_default_admin_write`,
+        operations: ["insert", "update", "delete"],
+        condition: SERVER_OR_ADMIN_EXPR,
+        check: SERVER_OR_ADMIN_EXPR
+    });
+
+    // 2. Reads follow the endpoints: the edge is visible iff both rows are.
+    // The EXISTS subqueries run under the caller's role, so each endpoint's
+    // own RLS applies inside them — visibility is delegated, not copied.
+    rules.push({
+        name: `${spec.table}_default_edge_read`,
+        operations: ["select"],
+        condition: policy.and(
+            existsEndpoint(spec.endpoints[0]),
+            existsEndpoint(spec.endpoints[1])
+        )
+    });
+
+    // 3. Writes follow the owning side's explicit update rules.
+    const writeGrants: PolicyExpression[] = [];
+    for (const side of spec.declaringSides) {
+        const explicitRules = (isPostgresCollectionConfig(side.collection)
+            ? side.collection.securityRules
+            : undefined) ?? [];
+        const updateRules = explicitRules.filter(coversUpdate);
+
+        const permissive = updateRules.filter(r => r.mode !== "restrictive");
+        const restrictive = updateRules.filter(r => r.mode === "restrictive");
+
+        // Embed the restrictive gates first: if any of them cannot be carried
+        // over, granting writes from this side would be looser than the parent
+        // itself allows — so the whole side's grant is suppressed.
+        const embeddedGates: PolicyExpression[] = [];
+        let gatesEmbeddable = true;
+        for (const gate of restrictive) {
+            const using = securityRuleToConditions(gate).usingExpr;
+            const embedded = using ? embedParentExpression(using) : null;
+            if (!embedded) {
+                gatesEmbeddable = false;
+                break;
+            }
+            embeddedGates.push(embedded);
+        }
+        if (!gatesEmbeddable) continue;
+
+        const grants: PolicyExpression[] = [];
+        for (const rule of permissive) {
+            const using = securityRuleToConditions(rule).usingExpr;
+            const embedded = using ? embedParentExpression(using) : null;
+            if (embedded) grants.push(embedded);
+        }
+        if (grants.length === 0) continue;
+
+        // "May update the owning row": any permissive grant, AND every gate.
+        const condition = embeddedGates.length > 0
+            ? policy.and(policy.or(...grants), ...embeddedGates)
+            : policy.or(...grants);
+
+        writeGrants.push(existsEndpoint(side, condition));
+    }
+
+    if (writeGrants.length > 0) {
+        rules.push({
+            name: `${spec.table}_default_edge_write`,
+            operations: ["insert", "update", "delete"],
+            condition: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants),
+            check: writeGrants.length === 1 ? writeGrants[0] : policy.or(...writeGrants)
+        });
+    }
+
+    return rules;
+}

package/src/util/navigation_from_path.ts

@@ -1,4 +1,4 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 type EntityCustomView<M extends Record<string, unknown> = Record<string, unknown>> = { key: string; [key: string]: unknown };
 import { getCollectionPathsCombinations, removeInitialAndTrailingSlashes } from "./navigation_utils";
 import { getSubcollections } from "./resolutions";
@@ -13,7 +13,7 @@ export interface NavigationViewEntityInternal<M extends Record<string, unknown>>
     entityId: string | number;
     slug: string;
     path: string;
-    parentCollection: EntityCollection<M>;
+    parentCollection: CollectionConfig<M>;
 }
 
 export interface NavigationViewCollectionInternal<M extends Record<string, unknown>> {
@@ -21,7 +21,7 @@ export interface NavigationViewCollectionInternal<M extends Record<string, unkno
     id: string;
     slug: string;
     path: string;
-    collection: EntityCollection<M>;
+    collection: CollectionConfig<M>;
 }
 
 export interface NavigationViewEntityCustomInternal<M extends Record<string, unknown>> {
@@ -34,7 +34,7 @@ export interface NavigationViewEntityCustomInternal<M extends Record<string, unk
 
 export function getNavigationEntriesFromPath(props: {
     path: string,
-    collections: EntityCollection[] | undefined,
+    collections: CollectionConfig[] | undefined,
     currentFullPath?: string,
     contextEntityViews?: EntityCustomView[]
 }): NavigationViewInternal[] {

package/src/util/navigation_utils.ts

@@ -1,4 +1,4 @@
-import { EntityCollection } from "@rebasepro/types";
+import { CollectionConfig } from "@rebasepro/types";
 
 import { getSubcollections } from "./resolutions";
 
@@ -33,13 +33,13 @@ export function getLastSegment(path: string) {
     return cleanPath;
 }
 
-export function resolveCollectionPathIds(path: string, allCollections: EntityCollection[]): string {
+export function resolveCollectionPathIds(path: string, allCollections: CollectionConfig[]): string {
     let remainingPath = removeInitialAndTrailingSlashes(path);
     if (!remainingPath) {
         return "";
     }
 
-    let currentCollections: EntityCollection[] | undefined = allCollections;
+    let currentCollections: CollectionConfig[] | undefined = allCollections;
     const resolvedPathParts: string[] = [];
 
     while (remainingPath.length > 0) {
@@ -53,7 +53,7 @@ export function resolveCollectionPathIds(path: string, allCollections: EntityCol
 
         let foundMatch = false;
         // Sort potential matches by length descending to prioritize longer matches (e.g., "a/b" over "a")
-        const potentialMatches: { col: EntityCollection; match: string; }[] = currentCollections
+        const potentialMatches: { col: CollectionConfig; match: string; }[] = currentCollections
             .flatMap(col => [{
                 col,
                 match: col.slug
@@ -76,7 +76,7 @@ export function resolveCollectionPathIds(path: string, allCollections: EntityCol
                 break; // Path ends with a collection segment
             }
 
-            // The next segment must be an entity ID
+            // The next segment must be a entity ID
             const idSeparatorIndex = remainingPath.indexOf("/");
             let entityId: string | number;
             if (idSeparatorIndex > -1) {
@@ -87,7 +87,7 @@ export function resolveCollectionPathIds(path: string, allCollections: EntityCol
                 // but handle it defensively: assume the rest is the ID
                 entityId = remainingPath;
                 remainingPath = "";
-                console.warn(`resolveCollectionPathIds: Path seems to end with an entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
+                console.warn(`resolveCollectionPathIds: Path seems to end with a entity ID "${entityId}" instead of a collection segment in original path "${path}". This might indicate an invalid input path.`);
                 // Even if it ends here, we still need to push the ID
             }
 
@@ -123,7 +123,7 @@ export function resolveCollectionPathIds(path: string, allCollections: EntityCol
  * @param slugOrPath
  * @param collections
  */
-export function getCollectionBySlugWithin(slugOrPath: string, collections: EntityCollection[]): EntityCollection | undefined {
+export function getCollectionBySlugWithin(slugOrPath: string, collections: CollectionConfig[]): CollectionConfig | undefined {
 
     const subpaths = removeInitialAndTrailingSlashes(slugOrPath).split("/");
     if (subpaths.length % 2 === 0) {
@@ -131,7 +131,7 @@ export function getCollectionBySlugWithin(slugOrPath: string, collections: Entit
     }
 
     const subpathCombinations = getCollectionPathsCombinations(subpaths);
-    let result: EntityCollection | undefined;
+    let result: CollectionConfig | undefined;
     for (let i = 0; i < subpathCombinations.length; i++) {
         const subpathCombination = subpathCombinations[i];
         const navigationEntry = collections && collections

package/src/util/parent_references_from_path.ts

@@ -1,10 +1,10 @@
-import { EntityCollection, EntityReference } from "@rebasepro/types";
+import { CollectionConfig, EntityReference } from "@rebasepro/types";
 import { getCollectionPathsCombinations, removeInitialAndTrailingSlashes } from "./navigation_utils";
 import { getSubcollections } from "./resolutions";
 
 export function getParentReferencesFromPath(props: {
     path: string,
-    collections: EntityCollection[] | undefined,
+    collections: CollectionConfig[] | undefined,
     currentFullPath?: string,
 }): EntityReference[] {
 
@@ -21,7 +21,7 @@ export function getParentReferencesFromPath(props: {
     for (let i = 0; i < subpathCombinations.length; i++) {
         const subpathCombination = subpathCombinations[i];
 
-        const collection: EntityCollection | undefined = collections && collections.find((entry) => entry.slug === subpathCombination);
+        const collection: CollectionConfig | undefined = collections && collections.find((entry) => entry.slug === subpathCombination);
 
         // If we find a collection, we add the reference and continue
         if (collection) {

package/src/util/permissions.test.ts

@@ -1,5 +1,5 @@
 import { canCreateEntity, canEditEntity, canDeleteEntity, canReadCollection } from "./permissions";
-import { EntityCollection, AuthController, Entity, User, SecurityRule } from "@rebasepro/types";
+import { CollectionConfig, AuthController, Entity, User, SecurityRule } from "@rebasepro/types";
 
 describe("Permissions Evaluator", () => {
 
@@ -46,7 +46,7 @@ describe("Permissions Evaluator", () => {
         user: null
     };
 
-    const createMockCollection = (rules?: SecurityRule[]): EntityCollection => ({
+    const createMockCollection = (rules?: SecurityRule[]): CollectionConfig => ({
         slug: "test",
         name: "Test",
         table: "test",

package/src/util/permissions.ts

@@ -1,4 +1,4 @@
-import { Entity, EntityCollection, getDataSourceCapabilities, SecurityOperation, SecurityRule, User } from "@rebasepro/types";
+import { Entity, CollectionConfig, getDataSourceCapabilities, SecurityOperation, SecurityRule, User } from "@rebasepro/types";
 import { securityRuleToConditions } from "./policy/securityRuleToConditions";
 import { evaluatePolicy, PolicyEvalContext, TriState } from "./policy/evaluatePolicy";
 
@@ -35,7 +35,7 @@ function kleeneAnd(values: TriState[]): TriState {
 }
 
 /** The operations a rule covers, mirroring the Postgres generator's resolution. */
-function ruleOperations(rule: SecurityRule): SecurityOperation[] {
+function ruleOperations(rule: SecurityRule): readonly SecurityOperation[] {
     return rule.operations && rule.operations.length > 0
         ? rule.operations
         : [rule.operation ?? "all"];
@@ -83,7 +83,7 @@ function resolveTriState(value: TriState, onUnknown: UnknownResolution): boolean
  *   for optimistic UI gating; enforcement callers should pass `"deny"`.
  */
 export function checkOperation<M extends Record<string, unknown>, USER extends User>(
-    collection: EntityCollection<M>,
+    collection: CollectionConfig<M>,
     authContext: AuthContext<USER>,
     entity: Entity<M> | null,
     targetOperation: SecurityOperation,
@@ -129,7 +129,7 @@ export function checkOperation<M extends Record<string, unknown>, USER extends U
 
 export function canReadCollection<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>
     ): boolean {
     return checkOperation(collection, authContext, null, "select");
@@ -137,7 +137,7 @@ export function canReadCollection<M extends Record<string, unknown>, USER extend
 
 export function canEditEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
@@ -147,7 +147,7 @@ export function canEditEntity<M extends Record<string, unknown>, USER extends Us
 
 export function canCreateEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null
@@ -157,7 +157,7 @@ export function canCreateEntity<M extends Record<string, unknown>, USER extends
 
 export function canDeleteEntity<M extends Record<string, unknown>, USER extends User>
     (
-        collection: EntityCollection<M>,
+        collection: CollectionConfig<M>,
         authContext: AuthContext<USER>,
         path: string,
         entity: Entity<M> | null

package/src/util/policy/evaluatePolicy.ts

@@ -1,4 +1,4 @@
-import { Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
 
 /**
  * Result of evaluating a policy client-side. `"unknown"` means the expression
@@ -15,7 +15,14 @@ export type TriState = boolean | "unknown";
  * being evaluated (or none, for collection-level gating).
  */
 export interface PolicyEvalContext {
-    /** The current user's id, or null/undefined when unauthenticated. */
+    /**
+     * The current user's id, or null/undefined when no user is signed in.
+     *
+     * Null here means *anonymous visitor*, not "server context" — a client is
+     * never the server context. `authUid` operands therefore resolve to
+     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `auth.uid()`
+     * the database would see for the same request.
+     */
     uid?: string | null;
     /** The current user's application roles. */
     roles?: string[];
@@ -54,7 +61,15 @@ export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext):
             return expr.roles.every(r => r === "public" || userRoles.includes(r));
         }
         case "authenticated":
-            return ctx.uid != null;
+            return ctx.uid != null && ctx.uid !== ANONYMOUS_USER_ID;
+        case "serverContext":
+            // A client is never the server context. Postgres decides this by
+            // `auth.uid() IS NULL`, which a client request can never produce:
+            // the driver substitutes ANONYMOUS_USER_ID for a missing id.
+            return false;
+        case "existsIn":
+            // A membership subquery cannot be run client-side — server-authoritative.
+            return "unknown";
         case "raw":
             // Arbitrary SQL cannot be evaluated client-side — never guess.
             return "unknown";
@@ -89,13 +104,20 @@ function resolveOperand(operand: PolicyOperand, ctx: PolicyEvalContext): Resolve
         case "literal":
             return { known: true, value: operand.value };
         case "authUid":
-            return { known: true, value: ctx.uid ?? null };
+            // The sentinel, not null: `auth.uid()` is never NULL for a request
+            // that came from a client, so comparing against null here would
+            // disagree with the database on exactly the rules that test for it
+            // (e.g. `auth.uid() <> 'anonymous'`).
+            return { known: true, value: ctx.uid ?? ANONYMOUS_USER_ID };
         case "authRoles":
             return { known: true, value: ctx.roles ?? [] };
         case "field":
             // Can't resolve a row column without the row.
             if (!ctx.entity) return { known: false };
             return { known: true, value: ctx.entity.values[operand.name] };
+        case "outerField":
+            // Only meaningful inside an `existsIn` subquery (server-authoritative).
+            return { known: false };
     }
 }
 

package/src/util/policy/index.ts

@@ -1,3 +1,4 @@
 export * from "./securityRuleToConditions";
+export * from "./sqlToPolicy";
 export * from "./policyToPostgres";
 export * from "./evaluatePolicy";