@rebasepro/common 0.9.1-canary.fd3754b → 0.10.0

package/src/util/policy/evaluatePolicy.ts

@@ -1,4 +1,4 @@
-import { Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, Entity, PolicyCompareOperator, PolicyExpression, PolicyOperand } from "@rebasepro/types";
 
 /**
  * Result of evaluating a policy client-side. `"unknown"` means the expression
@@ -15,7 +15,14 @@ export type TriState = boolean | "unknown";
  * being evaluated (or none, for collection-level gating).
  */
 export interface PolicyEvalContext {
-    /** The current user's id, or null/undefined when unauthenticated. */
+    /**
+     * The current user's id, or null/undefined when no user is signed in.
+     *
+     * Null here means *anonymous visitor*, not "server context" — a client is
+     * never the server context. `authUid` operands therefore resolve to
+     * {@link ANONYMOUS_USER_ID} rather than `null`, matching the `auth.uid()`
+     * the database would see for the same request.
+     */
     uid?: string | null;
     /** The current user's application roles. */
     roles?: string[];
@@ -54,7 +61,12 @@ export function evaluatePolicy(expr: PolicyExpression, ctx: PolicyEvalContext):
             return expr.roles.every(r => r === "public" || userRoles.includes(r));
         }
         case "authenticated":
-            return ctx.uid != null;
+            return ctx.uid != null && ctx.uid !== ANONYMOUS_USER_ID;
+        case "serverContext":
+            // A client is never the server context. Postgres decides this by
+            // `auth.uid() IS NULL`, which a client request can never produce:
+            // the driver substitutes ANONYMOUS_USER_ID for a missing id.
+            return false;
         case "existsIn":
             // A membership subquery cannot be run client-side — server-authoritative.
             return "unknown";
@@ -92,7 +104,11 @@ function resolveOperand(operand: PolicyOperand, ctx: PolicyEvalContext): Resolve
         case "literal":
             return { known: true, value: operand.value };
         case "authUid":
-            return { known: true, value: ctx.uid ?? null };
+            // The sentinel, not null: `auth.uid()` is never NULL for a request
+            // that came from a client, so comparing against null here would
+            // disagree with the database on exactly the rules that test for it
+            // (e.g. `auth.uid() <> 'anonymous'`).
+            return { known: true, value: ctx.uid ?? ANONYMOUS_USER_ID };
         case "authRoles":
             return { known: true, value: ctx.roles ?? [] };
         case "field":

package/src/util/policy/index.ts

@@ -1,3 +1,4 @@
 export * from "./securityRuleToConditions";
+export * from "./sqlToPolicy";
 export * from "./policyToPostgres";
 export * from "./evaluatePolicy";

package/src/util/policy/policyToPostgres.ts

@@ -1,4 +1,4 @@
-import { CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, CollectionConfig, PolicyExpression, PolicyOperand, PolicyCompareOperator, Property, ExistsInPolicyExpression } from "@rebasepro/types";
 import { toSnakeCase } from "@rebasepro/utils";
 import { getTableName } from "../relations";
 
@@ -68,8 +68,6 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
                 ? "false"
                 : expr.operands.map(o => `(${compile(o, scope)})`).join(" OR ");
         case "not":
-            // Render the common `auth.uid() IS NULL` (unauthenticated) form directly.
-            if (expr.operand.kind === "authenticated") return "auth.uid() IS NULL";
             return `NOT (${compile(expr.operand, scope)})`;
         case "compare": {
             // `auth.uid()` returns text; cast the column side so uuid / integer
@@ -88,7 +86,14 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
         case "rolesContain":
             return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
         case "authenticated":
-            return "auth.uid() IS NOT NULL";
+            // `IS NOT NULL` alone is a tautology on the user path: every
+            // user-context request sets `app.uid`, and an anonymous one sets
+            // it to the sentinel. Excluding the sentinel is what makes this mean
+            // "signed in" rather than "anyone at all".
+            return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+        case "serverContext":
+            // Only the built-in server flows leave `app.uid` unset.
+            return "auth.uid() IS NULL";
         case "existsIn":
             return compileExistsIn(expr, scope);
         case "raw":

package/src/util/policy/sqlToPolicy.ts

@@ -1,4 +1,4 @@
-import { PolicyExpression, policy } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, LiteralPolicyOperand, PolicyExpression, policy } from "@rebasepro/types";
 
 /**
  * A tiny, regex-based SQL "parser" for security rules.
@@ -10,16 +10,104 @@ import { PolicyExpression, policy } from "@rebasepro/types";
  * It handles:
  * - `field = 'literal'`
  * - `field != 'literal'`
- * - `field = current_setting('app.user_id')`
- * - `A AND B`
+ * - `field = current_setting('app.uid')` (or the legacy `app.user_id`)
+ * - `A AND B`, `A OR B` — only where the keyword is at the top level
  * - `true`
  * - `IN (...)` (as optimistic true)
  *
  * For anything it doesn't understand, it returns a `raw` expression, which
  * the evaluator treats as "unknown" (and usually optimistic true).
+ *
+ * **This output also round-trips back into DDL** via `policyToPostgres` (the
+ * schema/policy generators), so decomposing a clause the parser only partly
+ * understands is not a cosmetic mistake — it emits invalid SQL. When in doubt,
+ * prefer `raw`: it is reproduced verbatim.
  */
+/** True when `keyword` starts at `i` as a standalone word. */
+function isKeywordAt(upper: string, i: number, keyword: string): boolean {
+    if (!upper.startsWith(keyword, i)) return false;
+    const before = i === 0 ? " " : upper[i - 1];
+    const after = upper[i + keyword.length] ?? " ";
+    return /[\s()]/.test(before) && /[\s()]/.test(after);
+}
+
+/**
+ * Split `sql` on a boolean keyword, but only where it sits at paren depth 0 and
+ * outside a string literal. Returns null when it never does, so the caller
+ * leaves the clause alone.
+ *
+ * This used to be `sql.split(/ AND /i)`, which tore subqueries in half: the
+ * `AND` inside
+ *   `EXISTS (SELECT 1 FROM organization_members m WHERE m.org = t.org AND m.user_id = auth.uid())`
+ * split the expression, and re-emitting the halves produced
+ *   `(EXISTS (...) AND m.user_id = auth.uid())`
+ * where `m` is no longer in scope — SQL that Postgres rejects outright with
+ * "missing FROM-clause entry for table". Returning null instead keeps such a
+ * clause as a `raw` expression, which round-trips verbatim.
+ */
+function splitTopLevel(sql: string, keyword: "AND" | "OR"): string[] | null {
+    const upper = sql.toUpperCase();
+    const parts: string[] = [];
+    let depth = 0;
+    let inString = false;
+    let start = 0;
+
+    for (let i = 0; i < sql.length; i++) {
+        const ch = sql[i];
+        if (inString) {
+            if (ch === "'") {
+                if (sql[i + 1] === "'") i++; // '' escapes a quote inside a literal
+                else inString = false;
+            }
+            continue;
+        }
+        if (ch === "'") { inString = true; continue; }
+        if (ch === "(") { depth++; continue; }
+        if (ch === ")") { depth--; continue; }
+        if (depth === 0 && isKeywordAt(upper, i, keyword)) {
+            parts.push(sql.slice(start, i));
+            i += keyword.length - 1;
+            start = i + 1;
+        }
+    }
+
+    if (parts.length === 0) return null;
+    parts.push(sql.slice(start));
+    const trimmedParts = parts.map(p => p.trim()).filter(p => p.length > 0);
+    return trimmedParts.length > 1 ? trimmedParts : null;
+}
+
+/** Drop redundant wrapping parens (`(a AND b)` → `a AND b`), never `(a) AND (b)`. */
+function stripOuterParens(sql: string): string {
+    let s = sql.trim();
+    for (;;) {
+        if (!s.startsWith("(") || !s.endsWith(")")) return s;
+        let depth = 0;
+        let inString = false;
+        let wraps = true;
+        for (let i = 0; i < s.length; i++) {
+            const ch = s[i];
+            if (inString) {
+                if (ch === "'") {
+                    if (s[i + 1] === "'") i++;
+                    else inString = false;
+                }
+                continue;
+            }
+            if (ch === "'") { inString = true; continue; }
+            if (ch === "(") depth++;
+            else if (ch === ")") {
+                depth--;
+                if (depth === 0 && i < s.length - 1) { wraps = false; break; }
+            }
+        }
+        if (!wraps) return s;
+        s = s.slice(1, -1).trim();
+    }
+}
+
 export function sqlToPolicy(sql: string): PolicyExpression {
-    const trimmed = sql.trim();
+    const trimmed = stripOuterParens(sql.trim());
 
     if (trimmed.toLowerCase() === "true") return policy.true();
     if (trimmed.toLowerCase() === "false") return policy.false();
@@ -40,17 +128,12 @@ export function sqlToPolicy(sql: string): PolicyExpression {
         return policy.rolesContain(roles);
     }
 
-    // Handle OR
-    if (trimmed.toUpperCase().includes(" OR ")) {
-        const parts = trimmed.split(/ OR /i);
-        return policy.or(...parts.map(sqlToPolicy));
-    }
+    // OR binds looser than AND, so it splits first.
+    const orParts = splitTopLevel(trimmed, "OR");
+    if (orParts) return policy.or(...orParts.map(sqlToPolicy));
 
-    // Handle AND (very basic split, doesn't handle nested parens properly)
-    if (trimmed.toUpperCase().includes(" AND ")) {
-        const parts = trimmed.split(/ AND /i);
-        return policy.and(...parts.map(sqlToPolicy));
-    }
+    const andParts = splitTopLevel(trimmed, "AND");
+    if (andParts) return policy.and(...andParts.map(sqlToPolicy));
 
     // Handle = and !=
     const match = trimmed.match(/^(.+?)\s*(!?=)\s*(.+)$/);
@@ -67,9 +150,106 @@ export function sqlToPolicy(sql: string): PolicyExpression {
     return policy.raw(sql);
 }
 
+/**
+ * Literals from other BaaS platforms that people compare `auth.uid()` against
+ * out of habit. Mirrors the driver's `FOREIGN_CONVENTION_ROLES` guard on
+ * `pgRoles`, one surface over: the same muscle memory inside a `using:` string
+ * is the more dangerous spelling, because it inverts a rule instead of
+ * emptying a table.
+ */
+const FOREIGN_CONVENTION_UIDS: Record<string, string> = {
+    anon: "Supabase",
+    authenticated: "Supabase",
+    service_role: "Supabase"
+};
+
+/** A clause that reads as a lockdown but admits anonymous callers. */
+export interface AnonymousGrantRisk {
+    /** Which spelling was found. */
+    pattern: "foreign-uid-literal" | "uid-not-null";
+    /** The offending fragment — the literal, or the SQL that is a tautology. */
+    detail: string;
+    /** Why it admits anonymous callers, and what to write instead. */
+    explanation: string;
+}
+
+/** `auth.uid() IS NOT NULL` in raw SQL, the clause that is always true. */
+const UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
+
+/**
+ * Find clauses that read as "signed-in users only" but admit anonymous callers.
+ *
+ * Both spellings come from the same place — Supabase, where `auth.uid()` really
+ * is NULL for an anonymous request. Rebase substitutes
+ * {@link ANONYMOUS_USER_ID} instead (a blank id would read back as NULL, which
+ * is how the trusted *server* context is recognised), so:
+ *
+ *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
+ *  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+ *
+ * Either one turns a lockdown into a full grant, and neither looks wrong. No
+ * real user id is ever one of these literals, and a user-context request is
+ * never NULL, so a match is always a mistake rather than a deliberate check.
+ *
+ * Structured expressions are checked too, not just parsed SQL: `policy.compare`
+ * can spell the same mistake.
+ */
+export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[] {
+    const found: AnonymousGrantRisk[] = [];
+
+    const visit = (e: PolicyExpression): void => {
+        switch (e.kind) {
+            case "and":
+            case "or":
+                e.operands.forEach(visit);
+                return;
+            case "not":
+                visit(e.operand);
+                return;
+            case "existsIn":
+                visit(e.where);
+                return;
+            case "raw":
+                if (UID_NOT_NULL.test(e.sql)) {
+                    found.push({
+                        pattern: "uid-not-null",
+                        detail: e.sql,
+                        explanation: "`auth.uid() IS NOT NULL` is true for every request that came from a client, " +
+                            `including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. ` +
+                            "Use `condition: policy.authenticated()` to mean \"signed in\"."
+                    });
+                }
+                return;
+            case "compare": {
+                const literal = [e.left, e.right].find(o => o.kind === "literal") as LiteralPolicyOperand | undefined;
+                const comparesUid = e.left.kind === "authUid" || e.right.kind === "authUid";
+                if (!comparesUid || typeof literal?.value !== "string") return;
+                const platform = FOREIGN_CONVENTION_UIDS[literal.value];
+                if (!platform) return;
+                found.push({
+                    pattern: "foreign-uid-literal",
+                    detail: literal.value,
+                    explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous ` +
+                        `request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for ` +
+                        "every caller. Use `condition: policy.authenticated()` to mean \"signed in\"."
+                });
+                return;
+            }
+            default:
+                return;
+        }
+    };
+
+    visit(expr);
+    return found;
+}
+
 function parseOperand(str: string) {
-    // current_setting('app.user_id') or auth.uid()
-    if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {
+    // current_setting('app.uid') or auth.uid(). `app.user_id` is the
+    // pre-rename spelling and stays parseable: policies are data, so a
+    // database provisioned before the rename still holds rules written
+    // against it, and round-tripping one must not silently drop the operand.
+    if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {
         return policy.authUid();
     }