@rebasepro/common 0.9.1-canary.ff338b5 → 0.10.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/common",
   "type": "module",
-  "version": "0.9.1-canary.ff338b5",
+  "version": "0.10.0",
   "description": "Awesome Firebase/Firestore-based headless open-source CMS",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -40,8 +40,8 @@
   "dependencies": {
     "fast-equals": "6.0.0",
     "json-logic-js": "^2.0.5",
-    "@rebasepro/utils": "0.9.1-canary.ff338b5",
-    "@rebasepro/types": "0.9.1-canary.ff338b5"
+    "@rebasepro/types": "0.10.0",
+    "@rebasepro/utils": "0.10.0"
   },
   "devDependencies": {
     "@jest/globals": "^30.4.1",

package/src/util/policy/policyToPostgres.ts

@@ -87,12 +87,12 @@ function compile(expr: PolicyExpression, scope: CompileScope): string {
             return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
         case "authenticated":
             // `IS NOT NULL` alone is a tautology on the user path: every
-            // user-context request sets `app.user_id`, and an anonymous one sets
+            // user-context request sets `app.uid`, and an anonymous one sets
             // it to the sentinel. Excluding the sentinel is what makes this mean
             // "signed in" rather than "anyone at all".
             return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
         case "serverContext":
-            // Only the built-in server flows leave `app.user_id` unset.
+            // Only the built-in server flows leave `app.uid` unset.
             return "auth.uid() IS NULL";
         case "existsIn":
             return compileExistsIn(expr, scope);

package/src/util/policy/sqlToPolicy.ts

@@ -10,7 +10,7 @@ import { ANONYMOUS_USER_ID, LiteralPolicyOperand, PolicyExpression, policy } fro
  * It handles:
  * - `field = 'literal'`
  * - `field != 'literal'`
- * - `field = current_setting('app.user_id')`
+ * - `field = current_setting('app.uid')` (or the legacy `app.user_id`)
  * - `A AND B`, `A OR B` — only where the keyword is at the top level
  * - `true`
  * - `IN (...)` (as optimistic true)
@@ -245,8 +245,11 @@ export function findAnonymousGrants(expr: PolicyExpression): AnonymousGrantRisk[
 }
 
 function parseOperand(str: string) {
-    // current_setting('app.user_id') or auth.uid()
-    if (/current_setting\s*\(\s*'app\.user_id'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {
+    // current_setting('app.uid') or auth.uid(). `app.user_id` is the
+    // pre-rename spelling and stays parseable: policies are data, so a
+    // database provisioned before the rename still holds rules written
+    // against it, and round-tripping one must not silently drop the operand.
+    if (/current_setting\s*\(\s*'app\.(uid|user_id)'\s*\)/i.test(str) || /auth\.uid\(\)/i.test(str)) {
         return policy.authUid();
     }