@rebasepro/server-mongo 0.13.0 → 0.13.1-canary.g1822133

package/dist/index.es.js

@@ -1,7 +1,7 @@
 import { MongoClient, ObjectId } from "mongodb";
-import { EntityReference } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, EntityReference, ListLimitError, getCollectionDataPath, isAnonymousUid, resolveClientListLimit } from "@rebasepro/types";
+import { buildPropertyCallbacks, buildSdkData, checkOperation, normalizeEmail, securityRuleToConditions, toFilterTuples, updateDateAutoValues } from "@rebasepro/common";
 import { ApiError, logger } from "@rebasepro/server";
-import { buildPropertyCallbacks, buildSdkData, checkOperation, normalizeEmail, updateDateAutoValues } from "@rebasepro/common";
 import { mergeDeep } from "@rebasepro/utils";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -90,9 +90,16 @@ function escapeRegExp$1(str) {
 */
 function likePatternToRegExp(pattern, caseInsensitive) {
 	let body = "";
-	for (const ch of String(pattern)) if (ch === "%") body += ".*";
-	else if (ch === "_") body += ".";
-	else body += escapeRegExp$1(ch);
+	let lastWasWildcard = false;
+	for (const ch of String(pattern)) {
+		if (ch === "%") {
+			if (!lastWasWildcard) body += ".*";
+			lastWasWildcard = true;
+			continue;
+		}
+		body += ch === "_" ? "." : escapeRegExp$1(ch);
+		lastWasWildcard = false;
+	}
 	return new RegExp(`^${body}$`, caseInsensitive ? "i" : "");
 }
 /**
@@ -113,30 +120,61 @@ var MongoConditionBuilder = class {
 		const conditions = [];
 		for (const [field, filterParam] of Object.entries(filter)) {
 			if (!filterParam) continue;
-			const [op, value] = filterParam;
-			if (op === "is-null") {
-				conditions.push({ [field]: { $eq: null } });
-				continue;
-			}
-			if (op === "is-not-null") {
-				conditions.push({ [field]: { $ne: null } });
-				continue;
-			}
-			if (op === "like" || op === "ilike" || op === "not-like" || op === "not-ilike") {
-				const regex = likePatternToRegExp(value, op === "ilike" || op === "not-ilike");
-				const negated = op === "not-like" || op === "not-ilike";
-				conditions.push({ [field]: negated ? { $not: regex } : { $regex: regex } });
-				continue;
-			}
-			const mongoOp = REBASE_TO_MONGO_OP[op];
-			if (!mongoOp) {
-				logger.warn(`Unsupported filter operator: ${op}`);
+			for (const [op, value] of toFilterTuples(filterParam)) conditions.push(this.buildCondition(field, op, value));
+		}
+		return conditions;
+	}
+	/**
+	* One field, one operator, one value.
+	*
+	* Extracted so that `logical` groups translate through exactly this code.
+	* A group written as a second dialect is a group where `array-contains` or
+	* `ilike` quietly means something else than it does in `filter`, which is
+	* the kind of difference nobody finds until a query returns the wrong rows.
+	*
+	* Always returns a condition or throws: there is no operator this can be
+	* given that legitimately means "no condition".
+	*/
+	static buildCondition(field, op, value) {
+		if (op === "is-null") return { [field]: { $eq: null } };
+		if (op === "is-not-null") return { [field]: { $ne: null } };
+		if (op === "like" || op === "ilike" || op === "not-like" || op === "not-ilike") {
+			const regex = likePatternToRegExp(value, op === "ilike" || op === "not-ilike");
+			const negated = op === "not-like" || op === "not-ilike";
+			return { [field]: negated ? { $not: regex } : { $regex: regex } };
+		}
+		const mongoOp = REBASE_TO_MONGO_OP[op];
+		if (!mongoOp) {
+			logger.warn(`Unsupported filter operator '${op}' on field '${field}'`);
+			throw ApiError.badRequest(`Operator '${op}' is not supported on field '${field}' by the MongoDB driver.`, "UNSUPPORTED_FILTER_OPERATOR", {
+				field,
+				operator: op
+			});
+		}
+		if (op === "array-contains") return { [field]: { $elemMatch: { $eq: value } } };
+		return { [field]: { [mongoOp]: value } };
+	}
+	/**
+	* Translate an `or(...)` / `and(...)` group, nesting included.
+	*
+	* Returns `undefined` for a group with nothing in it. `$or: []` is an error
+	* in Mongo and `$and: []` matches every document, so neither is a
+	* defensible reading of "no conditions".
+	*/
+	static buildLogicalConditions(logical) {
+		if (!logical || !Array.isArray(logical.conditions)) return void 0;
+		const parts = [];
+		for (const entry of logical.conditions) {
+			if (!entry) continue;
+			if ("type" in entry && "conditions" in entry) {
+				const nested = this.buildLogicalConditions(entry);
+				if (nested) parts.push(nested);
 				continue;
 			}
-			if (op === "array-contains") conditions.push({ [field]: { $elemMatch: { $eq: value } } });
-			else conditions.push({ [field]: { [mongoOp]: value } });
+			const { column, operator, value } = entry;
+			parts.push(this.buildCondition(column, operator, value));
 		}
-		return conditions;
+		return logical.type === "or" ? this.combineConditionsWithOr(parts) : this.combineConditionsWithAnd(parts);
 	}
 	/**
 	* Build search conditions for text search
@@ -188,6 +226,8 @@ var MongoConditionBuilder = class {
 			const filterConditions = this.buildFilterConditions(options.filter);
 			conditions.push(...filterConditions);
 		}
+		const logicalCondition = this.buildLogicalConditions(options.logical);
+		if (logicalCondition) conditions.push(logicalCondition);
 		if (options.searchString && options.properties) {
 			const searchConditions = this.buildSearchConditions(options.searchString, options.properties);
 			if (searchConditions.length > 0) {
@@ -327,6 +367,7 @@ var MongoDataService = class {
 		const collection = this.getCollection(collectionPath);
 		const query = options.rawQuery ?? MongoConditionBuilder.buildQuery({
 			filter: options.filter,
+			logical: options.logical,
 			searchString: options.searchString,
 			properties: options.collection?.properties ?? {}
 		});
@@ -335,6 +376,7 @@ var MongoDataService = class {
 		if (sort) findOptions.sort = sort;
 		if (options.limit) findOptions.limit = options.limit;
 		if (options.startAfter !== void 0) findOptions.skip = Number(options.startAfter);
+		else if (options.offset) findOptions.skip = options.offset;
 		return (await collection.find(query, findOptions).toArray()).map((doc) => this.documentToRow(doc));
 	}
 	/**
@@ -351,11 +393,22 @@ var MongoDataService = class {
 	*/
 	async count(collectionPath, options = {}) {
 		const collection = this.getCollection(collectionPath);
-		const query = options.rawQuery ?? (options.filter ? MongoConditionBuilder.buildQuery({ filter: options.filter }) : {});
+		const query = options.rawQuery ?? MongoConditionBuilder.buildQuery({
+			filter: options.filter,
+			logical: options.logical,
+			searchString: options.searchString,
+			properties: options.collection?.properties ?? {}
+		});
 		return collection.countDocuments(query);
 	}
 	/**
 	* Save an row (create or update)
+	*
+	* Returns the **stored** document, not the values that were sent. A partial
+	* update sends only the fields that changed, and returning those was a
+	* partial row everywhere it went: the REST response, `afterSave`, the
+	* history entry a revert restores from, and the row pushed to realtime
+	* subscribers. Postgres returns the whole row here (`RETURNING *`).
 	*/
 	async save(collectionPath, values, id, _databaseId) {
 		const collection = this.getCollection(collectionPath);
@@ -363,29 +416,44 @@ var MongoDataService = class {
 		if (id) {
 			const objectId = this.toObjectId(id);
 			await collection.updateOne({ _id: objectId }, { $set: mongoValues }, { upsert: true });
-			return {
+			return await this.readBack(collectionPath, objectId, {
 				...values,
 				id: id.toString()
-			};
+			});
 		} else {
 			const newId = new ObjectId();
 			await collection.insertOne({
 				_id: newId,
 				...mongoValues
 			});
-			return {
+			return await this.readBack(collectionPath, newId, {
 				...values,
 				id: newId.toString()
-			};
+			});
 		}
 	}
 	/**
-	* Delete an row by ID
+	* Read the document back after a write, falling back to the caller's own
+	* values if it has already been removed by a concurrent delete.
+	*/
+	async readBack(collectionPath, objectId, fallback) {
+		const doc = await this.getCollection(collectionPath).findOne({ _id: objectId });
+		return doc ? this.documentToRow(doc) : fallback;
+	}
+	/**
+	* Delete a row by ID.
+	*
+	* Rejects when nothing matched, which is the `DataDriver.delete` contract:
+	* resolving means the row is gone because this call removed it. This used
+	* to log a warning and resolve, so a caller could not tell a delete from a
+	* no-op — and the same call on the Postgres driver threw. The wording is
+	* the Postgres driver's, verbatim, because two spellings of one answer is
+	* how the two came apart in the first place.
 	*/
 	async delete(collectionPath, id, _databaseId) {
 		const collection = this.getCollection(collectionPath);
 		const objectId = this.toObjectId(id);
-		if ((await collection.deleteOne({ _id: objectId })).deletedCount === 0) logger.warn(`Row ${id} not found in collection ${collectionPath}`);
+		if ((await collection.deleteOne({ _id: objectId })).deletedCount === 0) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
 	}
 	/**
 	* Check if a field value is unique in a collection
@@ -421,11 +489,9 @@ var MongoRealtimeService = class {
 	db;
 	subscriptions = /* @__PURE__ */ new Map();
 	clients = /* @__PURE__ */ new Map();
-	dataService;
 	driver;
 	constructor(db) {
 		this.db = db;
-		this.dataService = new MongoDataService(db);
 	}
 	setDataDriver(driver) {
 		this.driver = driver;
@@ -456,8 +522,7 @@ var MongoRealtimeService = class {
 				type: "collection",
 				config,
 				changeStream,
-				callback,
-				authContext: config.authContext
+				callback
 			};
 			this.subscriptions.set(subscriptionId, subscription);
 			this.fetchAndNotifyCollection(subscriptionId, config, callback);
@@ -472,8 +537,7 @@ var MongoRealtimeService = class {
 			const subscription = {
 				type: "collection",
 				config,
-				callback,
-				authContext: config.authContext
+				callback
 			};
 			this.subscriptions.set(subscriptionId, subscription);
 			this.fetchAndNotifyCollection(subscriptionId, config, callback);
@@ -484,31 +548,16 @@ var MongoRealtimeService = class {
 	*/
 	async fetchAndNotifyCollection(subscriptionId, config, callback) {
 		try {
-			let rows;
 			const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
-			if (config.authContext && this.driver) {
-				const mockUser = {
-					uid: config.authContext.uid,
-					roles: config.authContext.roles
-				};
-				rows = await (await this.driver.withAuth(mockUser)).fetchCollection({
-					path: config.path,
-					collection: registryCollection,
-					filter: config.filter,
-					orderBy: config.orderBy,
-					order: config.order,
-					limit: config.limit,
-					startAfter: config.startAfter,
-					searchString: config.searchString
-				});
-			} else rows = await this.dataService.fetchCollection(config.path, {
+			const rows = await (await this.scopedDriver(config.authContext)).fetchCollection({
+				path: config.path,
+				collection: registryCollection,
 				filter: config.filter,
 				orderBy: config.orderBy,
 				order: config.order,
 				limit: config.limit,
 				startAfter: config.startAfter,
-				searchString: config.searchString,
-				collection: registryCollection
+				searchString: config.searchString
 			});
 			if (callback) callback(rows);
 		} catch (error) {
@@ -516,6 +565,20 @@ var MongoRealtimeService = class {
 		}
 	}
 	/**
+	* The driver scoped to a subscriber.
+	*
+	* Never the bare repository: everything a subscription delivers has to pass
+	* the same row authorization an HTTP read does.
+	*/
+	async scopedDriver(authContext) {
+		if (!this.driver) throw new Error("MongoRealtimeService has no data driver — subscriptions cannot be authorized");
+		const user = {
+			uid: authContext?.uid ?? ANONYMOUS_USER_ID,
+			roles: authContext?.roles ?? []
+		};
+		return this.driver.withAuth(user);
+	}
+	/**
 	* Subscribe to single row changes
 	*/
 	subscribeToOne(subscriptionId, config, callback) {
@@ -537,8 +600,7 @@ var MongoRealtimeService = class {
 				type: "single",
 				config,
 				changeStream,
-				callback,
-				authContext: config.authContext
+				callback
 			};
 			this.subscriptions.set(subscriptionId, subscription);
 			this.fetchAndNotifyOne(subscriptionId, config, callback);
@@ -555,8 +617,7 @@ var MongoRealtimeService = class {
 			const subscription = {
 				type: "single",
 				config,
-				callback,
-				authContext: config.authContext
+				callback
 			};
 			this.subscriptions.set(subscriptionId, subscription);
 			this.fetchAndNotifyOne(subscriptionId, config, callback);
@@ -567,19 +628,12 @@ var MongoRealtimeService = class {
 	*/
 	async fetchAndNotifyOne(subscriptionId, config, callback) {
 		try {
-			let row;
 			const registryCollection = this.driver?.registry?.getCollectionByPath(config.path);
-			if (config.authContext && this.driver) {
-				const mockUser = {
-					uid: config.authContext.uid,
-					roles: config.authContext.roles
-				};
-				row = await (await this.driver.withAuth(mockUser)).fetchOne({
-					path: config.path,
-					id: config.id,
-					collection: registryCollection
-				});
-			} else row = await this.dataService.fetchOne(config.path, config.id);
+			const row = await (await this.scopedDriver(config.authContext)).fetchOne({
+				path: config.path,
+				id: config.id,
+				collection: registryCollection
+			});
 			if (callback) callback(row || null);
 		} catch (error) {
 			logger.error(`Error fetching row for subscription ${subscriptionId}`, { error });
@@ -602,9 +656,8 @@ var MongoRealtimeService = class {
 	async notifyUpdate(path, id, row, _databaseId) {
 		for (const [subscriptionId, subscription] of this.subscriptions) if (subscription.type === "single") {
 			const config = subscription.config;
-			if (config.path === path && config.id.toString() === id) {
-				if (subscription.callback) subscription.callback(row);
-			}
+			if (config.path === path && config.id.toString() === id) if (row === null) subscription.callback?.(null);
+			else await this.fetchAndNotifyOne(subscriptionId, config, subscription.callback);
 		} else if (subscription.type === "collection") {
 			const config = subscription.config;
 			if (config.path === path) await this.fetchAndNotifyCollection(subscriptionId, config, subscription.callback);
@@ -658,13 +711,30 @@ var MongoRealtimeService = class {
 			case "subscribe_collection": {
 				const subscriptionId = message.payload?.subscriptionId ?? message.subscriptionId;
 				if (!subscriptionId) return;
+				let boundedLimit;
+				try {
+					boundedLimit = resolveClientListLimit(message.payload?.limit);
+				} catch (e) {
+					if (!(e instanceof ListLimitError)) throw e;
+					logger.warn(`⚠️ [MongoRealtime] Refused subscription to '${message.payload?.path}': ${e.message}`);
+					ws.send(JSON.stringify({
+						type: "ERROR",
+						subscriptionId,
+						payload: { error: {
+							message: e.message,
+							code: "INVALID_LIMIT"
+						} },
+						error: e.message
+					}));
+					return;
+				}
 				this.subscribeToCollection(subscriptionId, {
 					clientId,
 					path: message.payload?.path,
 					filter: message.payload?.filter,
 					orderBy: message.payload?.orderBy,
 					order: message.payload?.order,
-					limit: message.payload?.limit,
+					limit: boundedLimit,
 					startAfter: message.payload?.startAfter,
 					searchString: message.payload?.searchString,
 					authContext
@@ -699,6 +769,18 @@ var MongoRealtimeService = class {
 				if (subscriptionId) this.unsubscribe(subscriptionId);
 				break;
 			}
+			default:
+				logger.warn(`⚠️ [MongoRealtime] Unhandled realtime message type "${message.type}" — channels, presence and broadcast are not implemented by the Mongo driver.`);
+				ws.send(JSON.stringify({
+					type: "ERROR",
+					subscriptionId: message.subscriptionId,
+					payload: { error: {
+						message: `Realtime message type "${message.type}" is not supported by the Mongo driver`,
+						code: "REALTIME_UNSUPPORTED"
+					} },
+					error: `Realtime message type "${message.type}" is not supported by the Mongo driver`
+				}));
+				break;
 		}
 	}
 };
@@ -811,6 +893,251 @@ var MongoHistoryService = class {
 	}
 };
 //#endregion
+//#region src/db/securityRuleFilter.ts
+/** Matches every document. */
+var MATCH_ALL = {};
+/**
+* Matches no document. A distinct object rather than a `false` sentinel so it
+* can be nested inside `$and`/`$or` like any other filter; identity is what
+* {@link isMatchNone} tests, so never mutate or copy it.
+*/
+var MATCH_NONE = { _id: { $exists: false } };
+/** The expression has no MongoDB equivalent — the caller must refuse. */
+var UNTRANSLATABLE = "untranslatable";
+function isMatchAll(f) {
+	return f !== UNTRANSLATABLE && f !== MATCH_NONE && Object.keys(f).length === 0;
+}
+function isMatchNone(f) {
+	return f === MATCH_NONE;
+}
+/** The error code a caller sees when a rule cannot be honoured. */
+var SECURITY_RULE_UNSUPPORTED = "SECURITY_RULE_UNSUPPORTED";
+/**
+* The refusal. Names the collection, the clause and the expression, because the
+* only useful thing an operator can do with this is rewrite that rule — or move
+* the collection to an engine that can enforce it.
+*/
+function securityRuleUnsupported(collectionSlug, clause, detail) {
+	return ApiError.internal(`This collection's data source (MongoDB) cannot enforce a security rule on "${collectionSlug}": the \`${clause}\` expression ${detail} has no MongoDB equivalent. The request was refused rather than served without row authorization. Express the rule with \`access\`, \`ownerField\`, \`roles\`, or a structured \`condition\`/\`check\`, or move this collection to a Postgres data source.`, SECURITY_RULE_UNSUPPORTED);
+}
+/** Describe an expression well enough for the refusal message to be actionable. */
+function describe(expr) {
+	switch (expr.kind) {
+		case "raw": return `\`${expr.sql}\``;
+		case "existsIn": return `a membership subquery over \`${expr.collection}\``;
+		case "not": return "a negated row predicate";
+		default: return `a \`${expr.kind}\` node`;
+	}
+}
+/** The first node of an expression tree this driver cannot translate, if any. */
+function findUntranslatable(expr, hasRow) {
+	switch (expr.kind) {
+		case "and":
+		case "or":
+			for (const operand of expr.operands) {
+				const found = findUntranslatable(operand, hasRow);
+				if (found) return found;
+			}
+			return;
+		case "not": return hasRow ? findUntranslatable(expr.operand, hasRow) : referencesField(expr.operand) ? expr : void 0;
+		case "compare": return operandUntranslatable(expr.left) || operandUntranslatable(expr.right) ? expr : void 0;
+		case "existsIn":
+		case "raw": return expr;
+		default: return;
+	}
+}
+function operandUntranslatable(operand) {
+	return operand.kind === "outerField";
+}
+function referencesField(expr) {
+	switch (expr.kind) {
+		case "and":
+		case "or": return expr.operands.some(referencesField);
+		case "not": return referencesField(expr.operand);
+		case "compare": return expr.left.kind === "field" || expr.right.kind === "field" || expr.left.kind === "outerField" || expr.right.kind === "outerField";
+		default: return false;
+	}
+}
+function userContext(user) {
+	return {
+		uid: user?.uid || ANONYMOUS_USER_ID,
+		roles: user?.roles ?? []
+	};
+}
+var COMPARE_TO_MONGO = {
+	eq: "$eq",
+	neq: "$ne",
+	lt: "$lt",
+	lte: "$lte",
+	gt: "$gt",
+	gte: "$gte"
+};
+var INVERTED_COMPARE = {
+	eq: "eq",
+	neq: "neq",
+	lt: "gt",
+	lte: "gte",
+	gt: "lt",
+	gte: "lte"
+};
+function resolveOperand(operand, ctx) {
+	switch (operand.kind) {
+		case "literal": return {
+			kind: "value",
+			value: operand.value
+		};
+		case "authUid": return {
+			kind: "value",
+			value: ctx.uid
+		};
+		case "authRoles": return {
+			kind: "value",
+			value: ctx.roles
+		};
+		case "field": return {
+			kind: "field",
+			name: operand.name
+		};
+		case "outerField": return { kind: "unknown" };
+	}
+}
+/**
+* Translate one {@link PolicyExpression} into a MongoDB filter, or
+* {@link UNTRANSLATABLE}.
+*
+* The JavaScript twin of `evaluatePolicy`, one level up: where that decides a
+* single row, this narrows a query. `"unknown"` there and `UNTRANSLATABLE` here
+* are the same condition, and both are resolved fail-closed by their callers.
+*/
+function policyToMongoFilter(expr, user) {
+	const ctx = userContext(user);
+	switch (expr.kind) {
+		case "true": return MATCH_ALL;
+		case "false": return MATCH_NONE;
+		case "and": {
+			const parts = expr.operands.map((o) => policyToMongoFilter(o, user));
+			if (parts.some(isMatchNone)) return MATCH_NONE;
+			if (parts.some((p) => p === UNTRANSLATABLE)) return UNTRANSLATABLE;
+			const clauses = parts.filter((p) => !isMatchAll(p));
+			if (clauses.length === 0) return MATCH_ALL;
+			if (clauses.length === 1) return clauses[0];
+			return { $and: clauses };
+		}
+		case "or": {
+			const parts = expr.operands.map((o) => policyToMongoFilter(o, user));
+			if (parts.some(isMatchAll)) return MATCH_ALL;
+			if (parts.some((p) => p === UNTRANSLATABLE)) return UNTRANSLATABLE;
+			const clauses = parts.filter((p) => !isMatchNone(p));
+			if (clauses.length === 0) return MATCH_NONE;
+			if (clauses.length === 1) return clauses[0];
+			return { $or: clauses };
+		}
+		case "not": {
+			const inner = policyToMongoFilter(expr.operand, user);
+			if (isMatchAll(inner)) return MATCH_NONE;
+			if (isMatchNone(inner)) return MATCH_ALL;
+			return UNTRANSLATABLE;
+		}
+		case "compare": {
+			const left = resolveOperand(expr.left, ctx);
+			const right = resolveOperand(expr.right, ctx);
+			if (left.kind === "unknown" || right.kind === "unknown") return UNTRANSLATABLE;
+			if (left.kind === "field" && right.kind === "value") return { [left.name]: { [COMPARE_TO_MONGO[expr.op]]: right.value } };
+			if (left.kind === "value" && right.kind === "field") return { [right.name]: { [COMPARE_TO_MONGO[INVERTED_COMPARE[expr.op]]]: left.value } };
+			if (left.kind === "field" && right.kind === "field") return { $expr: { [COMPARE_TO_MONGO[expr.op]]: [`$${left.name}`, `$${right.name}`] } };
+			if (left.kind === "value" && right.kind === "value") return compareValues(expr.op, left.value, right.value);
+			return UNTRANSLATABLE;
+		}
+		case "rolesOverlap": return expr.roles.some((r) => r === "public" || ctx.roles.includes(r)) ? MATCH_ALL : MATCH_NONE;
+		case "rolesContain": return expr.roles.every((r) => r === "public" || ctx.roles.includes(r)) ? MATCH_ALL : MATCH_NONE;
+		case "authenticated": return !isAnonymousUid(ctx.uid) ? MATCH_ALL : MATCH_NONE;
+		case "serverContext": return MATCH_NONE;
+		case "existsIn":
+		case "raw": return UNTRANSLATABLE;
+	}
+}
+function compareValues(op, a, b) {
+	if (op === "eq") return a === b ? MATCH_ALL : MATCH_NONE;
+	if (op === "neq") return a !== b ? MATCH_ALL : MATCH_NONE;
+	if (typeof a === "string" && typeof b === "string" || typeof a === "number" && typeof b === "number") return (op === "lt" ? a < b : op === "lte" ? a <= b : op === "gt" ? a > b : a >= b) ? MATCH_ALL : MATCH_NONE;
+	return UNTRANSLATABLE;
+}
+/** The rules that apply to `targetOperation`, mirroring `checkOperation`. */
+function applicableRules(collection, targetOperation) {
+	const rules = collection?.securityRules;
+	if (!rules || rules.length === 0) return [];
+	return rules.filter((rule) => {
+		const ops = rule.operations && rule.operations.length > 0 ? rule.operations : [rule.operation ?? "all"];
+		return ops.includes(targetOperation) || ops.includes("all");
+	});
+}
+/** Which clause of a rule constrains `targetOperation` — Postgres's own split. */
+function clauseFor(targetOperation) {
+	return targetOperation === "insert" ? "withCheck" : "using";
+}
+/**
+* Refuse up front when this collection's rules cannot be enforced for
+* `targetOperation`.
+*
+* The row-in-hand paths (`fetchOne`, `save`, `delete`) resolve an undecidable
+* rule through `checkOperation`'s `onUnknown: "deny"`, which is safe but
+* indistinguishable from a plain "you may not do that". Calling this first
+* turns the same condition into the refusal an operator can act on.
+*/
+function assertSecurityRulesEnforceable(collection, targetOperation) {
+	for (const rule of applicableRules(collection, targetOperation)) {
+		const conditions = securityRuleToConditions(rule);
+		const clauses = targetOperation === "insert" ? ["withCheck"] : targetOperation === "update" ? ["using", "withCheck"] : ["using"];
+		for (const clause of clauses) {
+			const expr = clause === "using" ? conditions.usingExpr : conditions.withCheckExpr;
+			if (!expr) continue;
+			const offending = findUntranslatable(expr, true);
+			if (offending) throw securityRuleUnsupported(collection?.slug ?? "unknown", clause, describe(offending));
+		}
+	}
+}
+/**
+* Build the MongoDB filter that narrows a query to the rows `user` may see
+* under `collection`'s security rules.
+*
+* Returns `null` when no row can qualify (the caller answers with an empty
+* result), `{}` when the rules impose no narrowing, and throws
+* {@link SECURITY_RULE_UNSUPPORTED} when a rule cannot be translated.
+*/
+function buildMongoFilterFromSecurityRules(collection, user, targetOperation) {
+	const rules = applicableRules(collection, targetOperation);
+	if (!collection?.securityRules || collection.securityRules.length === 0) return MATCH_ALL;
+	if (rules.length === 0) return null;
+	const clause = clauseFor(targetOperation);
+	const permissive = [];
+	const restrictive = [];
+	for (const rule of rules) {
+		const conditions = securityRuleToConditions(rule);
+		const expr = clause === "using" ? conditions.usingExpr : conditions.withCheckExpr;
+		const filter = expr === null ? MATCH_NONE : policyToMongoFilter(expr, user);
+		if (filter === UNTRANSLATABLE) {
+			const offending = expr === null ? void 0 : findUntranslatable(expr, false);
+			throw securityRuleUnsupported(collection.slug, clause, offending ? describe(offending) : "this rule");
+		}
+		if ((rule.mode || "permissive") === "restrictive") restrictive.push(filter);
+		else permissive.push(filter);
+	}
+	if (permissive.length === 0) return null;
+	const parts = [];
+	if (!permissive.some(isMatchAll)) {
+		const granting = permissive.filter((p) => !isMatchNone(p));
+		if (granting.length === 0) return null;
+		parts.push(granting.length === 1 ? granting[0] : { $or: granting });
+	}
+	for (const rf of restrictive) {
+		if (isMatchNone(rf)) return null;
+		if (!isMatchAll(rf)) parts.push(rf);
+	}
+	if (parts.length === 0) return MATCH_ALL;
+	if (parts.length === 1) return parts[0];
+	return { $and: parts };
+}
+//#endregion
 //#region src/services/MongoDriver.ts
 /**
 * MongoDB DataDriver Delegate
@@ -876,14 +1203,10 @@ var MongoDriver = class {
 	/**
 	* Fetch a collection of rows
 	*/
-	async fetchCollection({ path, collection, filter, limit, startAfter, orderBy, searchString, order }) {
+	async fetchCollection(props) {
+		const { path, collection, ...query } = props;
 		const rows = await this.dataService.fetchCollection(path, {
-			filter,
-			limit,
-			startAfter,
-			orderBy,
-			order,
-			searchString,
+			...query,
 			collection
 		});
 		const { collection: resolvedCollection, callbacks, globalCallbacks, propertyCallbacks } = this.resolveCollectionCallbacks(collection, path);
@@ -921,9 +1244,15 @@ var MongoDriver = class {
 		return rows;
 	}
 	/**
-	* Listen to collection changes
+	* Listen to collection changes.
+	*
+	* `authContext` is not part of `ListenCollectionProps`; it is supplied by
+	* {@link AuthenticatedMongoDriver}, which is the only caller that has one.
+	* It has to travel *into* the subscription config, because that config is
+	* what every re-fetch reads — the wrapper used to stamp the field on the
+	* `Subscription` object instead, and nothing has ever read that one.
 	*/
-	listenCollection({ path, collection, filter, limit, startAfter, orderBy, searchString, order, onUpdate, onError }) {
+	listenCollection({ path, collection, filter, limit, startAfter, orderBy, searchString, order, onUpdate, onError }, authContext) {
 		const subscriptionId = this.generateSubscriptionId();
 		const callback = (rows) => {
 			try {
@@ -941,7 +1270,8 @@ var MongoDriver = class {
 			order,
 			limit,
 			startAfter,
-			searchString
+			searchString,
+			authContext
 		}, callback);
 		return () => {
 			this.realtimeService.unsubscribe(subscriptionId);
@@ -987,7 +1317,7 @@ var MongoDriver = class {
 	/**
 	* Listen to row changes
 	*/
-	listenOne({ path, id, collection, onUpdate, onError }) {
+	listenOne({ path, id, collection, onUpdate, onError }, authContext) {
 		const subscriptionId = this.generateSubscriptionId();
 		const callback = (row) => {
 			try {
@@ -1000,7 +1330,8 @@ var MongoDriver = class {
 		this.realtimeService.subscribeToOne(subscriptionId, {
 			clientId: "driver",
 			path,
-			id
+			id,
+			authContext
 		}, callback);
 		return () => {
 			this.realtimeService.unsubscribe(subscriptionId);
@@ -1257,8 +1588,13 @@ var MongoDriver = class {
 	/**
 	* Count rows in a collection
 	*/
-	async count({ path, collection, filter }) {
-		return this.dataService.count(path, { filter });
+	async count({ path, collection, filter, logical, searchString }) {
+		return this.dataService.count(path, {
+			filter,
+			logical,
+			searchString,
+			collection
+		});
 	}
 	/**
 	* Generate a unique subscription ID
@@ -1311,6 +1647,7 @@ var AuthenticatedMongoDriver = class {
 		if (rlsFilter === null) return [];
 		const userQuery = MongoConditionBuilder.buildQuery({
 			filter: props.filter,
+			logical: props.logical,
 			searchString: props.searchString,
 			properties: resolvedCollection?.properties
 		});
@@ -1355,67 +1692,87 @@ var AuthenticatedMongoDriver = class {
 		return rows;
 	}
 	listenCollection(props) {
-		const unsubscribe = this.delegate.listenCollection(props);
-		const authContext = {
+		return this.delegate.listenCollection(props, this.authContext());
+	}
+	/** The acting user, in the shape the realtime subscriptions carry. */
+	authContext() {
+		return {
 			uid: this.user.uid,
 			roles: this.user.roles ?? []
 		};
-		const subscriptions = this.delegate.getRealtimeService().getSubscriptions();
-		const lastSub = Array.from(subscriptions.entries()).pop()?.[1];
-		if (lastSub && lastSub.config.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
+	}
+	/**
+	* Evaluate the collection's rules for one row, fail-closed.
+	*
+	* A path with no resolvable collection has no declared rules — the same
+	* answer `buildMongoFilterFromSecurityRules` gives a listing on such a path,
+	* so the two never disagree about whether this engine has row security.
+	*/
+	authorize(collection, entity, operation, clauses) {
+		if (!collection) return true;
+		return checkOperation(collection, { user: this.user }, entity, operation, {
+			onUnknown: "deny",
+			clauses
+		});
 	}
 	async fetchOne(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.path);
+		assertSecurityRulesEnforceable(resolvedCollection, "select");
 		const row = await this.delegate.fetchOne(props);
-		if (row) {
-			if (!checkOperation(resolvedCollection, { user: this.user }, rowToEntityForCheck(row, props.path), "select", { onUnknown: "deny" })) return;
-		}
+		if (row && !this.authorize(resolvedCollection, rowToEntityForCheck(row, props.path), "select")) return;
 		return row;
 	}
 	listenOne(props) {
-		const unsubscribe = this.delegate.listenOne(props);
-		const authContext = {
-			uid: this.user.uid,
-			roles: this.user.roles ?? []
-		};
-		const subscriptions = this.delegate.getRealtimeService().getSubscriptions();
-		const lastSub = Array.from(subscriptions.entries()).pop()?.[1];
-		if (lastSub && lastSub.config.clientId === "driver") lastSub.authContext = authContext;
-		return unsubscribe;
+		return this.delegate.listenOne(props, this.authContext());
 	}
+	/**
+	* Save, with both halves of the rule checked *before* the write.
+	*
+	* There is no transaction here, so a check that runs after
+	* `delegate.save` cannot undo anything: the document is written, history is
+	* recorded and subscribers have been notified by then, and a 403 at that
+	* point only misleads the caller about what happened. Postgres evaluates
+	* `WITH CHECK` inside the transaction; the closest this driver can get is to
+	* evaluate it against the row as it *will* be, and refuse before writing.
+	*/
 	async save(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.path);
 		if (props.status === "existing" && props.id) {
+			assertSecurityRulesEnforceable(resolvedCollection, "update");
 			const existing = await this.delegate.fetchOne({
 				path: props.path,
 				id: props.id,
 				collection: resolvedCollection
 			});
-			if (!existing || !checkOperation(resolvedCollection, { user: this.user }, rowToEntityForCheck(existing, props.path), "update", { onUnknown: "deny" })) throw ApiError.forbidden("Forbidden");
+			const projected = rowToEntityForCheck({
+				...existing,
+				...props.values,
+				id: props.id
+			}, props.path);
+			if (!existing || !this.authorize(resolvedCollection, rowToEntityForCheck(existing, props.path), "update", "using") || !this.authorize(resolvedCollection, projected, "update", "withCheck")) throw ApiError.forbidden("Forbidden");
 		} else {
+			assertSecurityRulesEnforceable(resolvedCollection, "insert");
 			const tempEntity = {
 				id: props.id || "new",
 				path: props.path,
 				values: props.values
 			};
-			if (!checkOperation(resolvedCollection, { user: this.user }, tempEntity, "insert", { onUnknown: "deny" })) throw ApiError.forbidden("Forbidden");
+			if (!this.authorize(resolvedCollection, tempEntity, "insert")) throw ApiError.forbidden("Forbidden");
 		}
-		const saved = await this.delegate.save({
+		return this.delegate.save({
 			...props,
 			collection: resolvedCollection
 		});
-		if (!checkOperation(resolvedCollection, { user: this.user }, rowToEntityForCheck(saved, props.path), props.status === "existing" ? "update" : "insert", { onUnknown: "deny" })) throw ApiError.forbidden("Forbidden");
-		return saved;
 	}
 	async delete(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.row.path);
+		assertSecurityRulesEnforceable(resolvedCollection, "delete");
 		const existing = await this.delegate.fetchOne({
 			path: props.row.path,
 			id: props.row.id,
 			collection: resolvedCollection
 		});
-		if (!existing || !checkOperation(resolvedCollection, { user: this.user }, rowToEntityForCheck(existing, props.row.path), "delete", { onUnknown: "deny" })) throw ApiError.forbidden("Forbidden");
+		if (!existing || !this.authorize(resolvedCollection, rowToEntityForCheck(existing, props.row.path), "delete")) throw ApiError.forbidden("Forbidden");
 		return this.delegate.delete(props);
 	}
 	async checkUniqueField(path, name, value, id, collection) {
@@ -1430,6 +1787,7 @@ var AuthenticatedMongoDriver = class {
 		if (rlsFilter === null) return 0;
 		const userQuery = MongoConditionBuilder.buildQuery({
 			filter: props.filter,
+			logical: props.logical,
 			searchString: props.searchString,
 			properties: resolvedCollection?.properties
 		});
@@ -1454,147 +1812,34 @@ function rowToEntityForCheck(row, path) {
 		values: row
 	};
 }
-function getMongoFilterForSQL(sqlString, user) {
-	let cleanedSQL = sqlString.trim();
-	while (cleanedSQL.startsWith("(") && cleanedSQL.endsWith(")")) {
-		let openCount = 0;
-		let isEnclosing = true;
-		for (let i = 0; i < cleanedSQL.length - 1; i++) {
-			if (cleanedSQL[i] === "(") openCount++;
-			else if (cleanedSQL[i] === ")") openCount--;
-			if (openCount === 0) {
-				isEnclosing = false;
-				break;
-			}
-		}
-		if (isEnclosing) cleanedSQL = cleanedSQL.substring(1, cleanedSQL.length - 1).trim();
-		else break;
-	}
-	const splitByTopLevel = (str, delimiter) => {
-		const parts = [];
-		let current = "";
-		let openCount = 0;
-		let i = 0;
-		while (i < str.length) {
-			if (str[i] === "(") openCount++;
-			else if (str[i] === ")") openCount--;
-			if (openCount === 0 && str.substring(i).toUpperCase().startsWith(delimiter)) {
-				parts.push(current);
-				current = "";
-				i += delimiter.length;
-			} else {
-				current += str[i];
-				i++;
-			}
-		}
-		parts.push(current);
-		return parts;
-	};
-	const orParts = splitByTopLevel(cleanedSQL, " OR ");
-	if (orParts.length > 1) {
-		const subFilters = orParts.map((part) => getMongoFilterForSQL(part, user)).filter((f) => f !== null);
-		if (subFilters.length === 0) return null;
-		if (subFilters.length === 1) return subFilters[0];
-		return { $or: subFilters };
-	}
-	const andParts = splitByTopLevel(cleanedSQL, " AND ");
-	if (andParts.length > 1) {
-		const subFilters = andParts.map((part) => getMongoFilterForSQL(part, user)).filter((f) => f !== null);
-		if (subFilters.length === 0) return null;
-		if (subFilters.length === 1) return subFilters[0];
-		return { $and: subFilters };
-	}
-	const roleIntersectMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*&&\s*ARRAY\[(.*?)\]/i);
-	if (roleIntersectMatch && roleIntersectMatch[1]) {
-		const requiredRoles = roleIntersectMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = user.roles || [];
-		return requiredRoles.some((r) => userRoles.includes(r)) ? {} : { _id: { $exists: false } };
-	}
-	const roleContainMatch = cleanedSQL.match(/string_to_array\s*\(\s*auth\.roles\(\)\s*,\s*','\s*\)\s*@>\s*ARRAY\[(.*?)\]/i);
-	if (roleContainMatch && roleContainMatch[1]) {
-		const requiredRoles = roleContainMatch[1].split(",").map((r) => r.trim().replace(/'/g, ""));
-		const userRoles = user.roles || [];
-		return requiredRoles.every((r) => userRoles.includes(r)) ? {} : { _id: { $exists: false } };
-	}
-	const pattern1 = /* @__PURE__ */ new RegExp("^\\{?([a-zA-Z0-9_]+)\\}?\\s*=\\s*(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))");
-	const pattern2 = /* @__PURE__ */ new RegExp("^(?:current_setting\\s*\\(\\s*'app\\.user_id'\\s*\\)|auth\\.uid\\(\\))\\s*=\\s*\\{?([a-zA-Z0-9_]+)\\}?");
-	const match1 = cleanedSQL.match(pattern1);
-	if (match1 && match1[1]) return { [match1[1]]: user.uid };
-	const match2 = cleanedSQL.match(pattern2);
-	if (match2 && match2[1]) return { [match2[1]]: user.uid };
-	const simpleEqualityMatch = cleanedSQL.match(/^\{?([\w_]+)\}?\s*(=|!=)\s*'([^']+)'$/i);
-	if (simpleEqualityMatch) {
-		const field = simpleEqualityMatch[1];
-		const operator = simpleEqualityMatch[2];
-		const value = simpleEqualityMatch[3];
-		if (operator === "=") return { [field]: value };
-		if (operator === "!=") return { [field]: { $ne: value } };
-	}
-	return {};
-}
-function getMongoFilterForRule(rule, user) {
-	if (rule.access === "public") return {};
-	const filters = [];
-	if (rule.ownerField) filters.push({ [rule.ownerField]: user.uid });
-	if (rule.using) {
-		const f = getMongoFilterForSQL(rule.using, user);
-		if (f) filters.push(f);
-	}
-	if (rule.withCheck) {
-		const f = getMongoFilterForSQL(rule.withCheck, user);
-		if (f) filters.push(f);
-	}
-	if (filters.length === 0) return {};
-	if (filters.length === 1) return filters[0];
-	return { $and: filters };
-}
-function buildMongoFilterFromSecurityRules(collection, user, targetOperation) {
-	if (!collection || !collection.securityRules || collection.securityRules.length === 0) return {};
-	const applicableRules = collection.securityRules.filter((r) => r.operation === targetOperation || r.operation === "all" || r.operations?.includes(targetOperation) || r.operations?.includes("all"));
-	if (applicableRules.length === 0) return null;
-	const userRoles = [...user.roles ?? [], "public"];
-	const roleApplicableRules = applicableRules.filter((rule) => {
-		if (!rule.roles || rule.roles.length === 0) return true;
-		return rule.roles.some((r) => userRoles.includes(r));
-	});
-	if (roleApplicableRules.length === 0) return null;
-	const permissiveFilters = [];
-	const restrictiveFilters = [];
-	for (const rule of roleApplicableRules) {
-		const mode = rule.mode || "permissive";
-		const filter = getMongoFilterForRule(rule, user);
-		if (filter === null) {
-			if (mode === "restrictive") return null;
-			continue;
-		}
-		if (mode === "restrictive") restrictiveFilters.push(filter);
-		else permissiveFilters.push(filter);
-	}
-	const finalAnds = [];
-	if (permissiveFilters.length > 0) {
-		if (!permissiveFilters.some((f) => Object.keys(f).length === 0)) if (permissiveFilters.length === 1) finalAnds.push(permissiveFilters[0]);
-		else finalAnds.push({ $or: permissiveFilters });
-	} else return null;
-	if (restrictiveFilters.length > 0) {
-		for (const rf of restrictiveFilters) if (Object.keys(rf).length > 0) finalAnds.push(rf);
-	}
-	if (finalAnds.length === 0) return {};
-	if (finalAnds.length === 1) return finalAnds[0];
-	return { $and: finalAnds };
-}
 //#endregion
 //#region src/factory.ts
 /**
 * Simple in-memory collection registry for MongoDB.
 */
 var MongoCollectionRegistry = class {
+	/** Every addressable key → collection. See {@link register}. */
 	collections = /* @__PURE__ */ new Map();
+	/** Registration order, so `getCollections()` returns each collection once. */
+	registered = [];
 	_globalCallbacks;
 	/**
-	* Register a collection
+	* Register a collection under every name it can be addressed by.
+	*
+	* A Mongo collection has up to three: `slug` (the routing key), `path` (the
+	* MongoDB collection-name override, which is what `getCollectionDataPath`
+	* hands the driver) and `name` (the human label). Registering only `name`
+	* meant every `getCollectionByPath` lookup missed — and the realtime path,
+	* whose only source of the collection is this registry, ran with no
+	* `securityRules`, no `properties` and no callbacks.
 	*/
 	register(collection) {
-		this.collections.set(collection.name, collection);
+		this.registered.push(collection);
+		for (const key of [
+			getCollectionDataPath(collection),
+			collection.slug,
+			collection.name
+		]) if (key) this.collections.set(key, collection);
 	}
 	/**
 	* Get a collection by its path
@@ -1606,7 +1851,7 @@ var MongoCollectionRegistry = class {
 	* Get all registered collections
 	*/
 	getCollections() {
-		return Array.from(this.collections.values());
+		return [...this.registered];
 	}
 	/**
 	* Get the currently registered global callbacks, if any.
@@ -2481,7 +2726,7 @@ function createMongoBootstrapper(mongoConfig) {
 		},
 		async initializeAuth(config, driverResult) {
 			const db = driverResult.internals.db;
-			const { ensureAuthCollectionsExist } = await import("./ensure-collections-Bkx_O5CQ.js");
+			const { ensureAuthCollectionsExist } = await import("./ensure-collections-Bl12bSwO.js");
 			await ensureAuthCollectionsExist(db);
 			const { createEmailService } = await import("@rebasepro/server");
 			const authConfig = config;
@@ -2553,9 +2798,9 @@ function createMongoBootstrapper(mongoConfig) {
 			return admin;
 		},
 		mountRoutes() {},
-		async initializeWebsockets(server, realtimeService, driver, config) {
-			const { createMongoWebSocket } = await import("./websocket-74DDOdK0.js");
-			createMongoWebSocket(server, realtimeService, driver, config, cachedAdmin);
+		async initializeWebsockets(server, realtimeService, driver, config, authAdapter) {
+			const { createMongoWebSocket } = await import("./websocket-Bs54-gR-.js");
+			createMongoWebSocket(server, realtimeService, driver, config, cachedAdmin, authAdapter);
 		}
 	};
 }