@rebasepro/server-mongo 0.22.0 → 0.23.0

package/dist/auth/services.d.ts

@@ -20,6 +20,14 @@ export declare class MongoUserService implements UserRepository {
     getUserIdentities(uid: string): Promise<UserIdentityData[]>;
     linkUserIdentity(uid: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void>;
     updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null>;
+    /**
+     * Everything keyed by the user goes with them. Postgres does this by
+     * foreign-key cascade; Mongo has none, so it is spelled out — and the
+     * refresh tokens are the part that matters: left behind, a deleted user's
+     * session kept minting access tokens for a uid that no longer exists.
+     * Sessions first, so a failure part-way leaves an account that cannot sign
+     * in rather than a session with no account.
+     */
     deleteUser(id: string): Promise<void>;
     listUsers(): Promise<UserData[]>;
     listUsersPaginated(options?: ListUsersOptions): Promise<PaginatedUsersResult>;

package/dist/db/MongoConditionBuilder.d.ts

@@ -4,6 +4,7 @@
  * Translates Rebase filter conditions to MongoDB query operators.
  */
 import { CollectionConfig, FilterValues, LogicalCondition, OrderByTuple } from "@rebasepro/types";
+import { type FieldViewer } from "@rebasepro/common";
 import { Filter, Document } from "mongodb";
 /**
  * MongoDB Condition Builder
@@ -29,16 +30,32 @@ export declare class MongoConditionBuilder {
      *
      * Always returns a condition or throws: there is no operator this can be
      * given that legitimately means "no condition".
+     *
+     * `negated` asks for the documents where the condition is *false* — not
+     * merely not true. The two differ by the documents where it is unknown,
+     * which in SQL is a comparison against NULL: `NOT (status = 'draft')` does
+     * not return a row whose status is NULL, and the Postgres driver is the
+     * reference every caller of this API writes against. So a comparison is
+     * false only where the field holds a value and the comparison fails on it.
+     * The null tests are never unknown, and negate to each other.
      */
     private static buildCondition;
     /**
-     * Translate an `or(...)` / `and(...)` group, nesting included.
+     * Translate an `or(...)` / `and(...)` / `not(...)` group, nesting included.
+     *
+     * `not` negates the conjunction of its conditions — the rule stated on
+     * `LogicalCondition`. It used to fall through to the `and` branch, so
+     * `not(status = 'draft')` returned exactly the drafts. It is compiled by
+     * pushing the negation down to the leaves (De Morgan), each of which knows
+     * which documents make it false rather than merely not true — see
+     * {@link buildCondition}. A `$nor` around the group would be shorter and
+     * wrong: it also matches every document where the condition is unknown.
      *
      * Returns `undefined` for a group with nothing in it. `$or: []` is an error
      * in Mongo and `$and: []` matches every document, so neither is a
      * defensible reading of "no conditions".
      */
-    static buildLogicalConditions(logical: LogicalCondition | undefined): Filter<Document> | undefined;
+    static buildLogicalConditions(logical: LogicalCondition | undefined, negated?: boolean): Filter<Document> | undefined;
     /**
      * Build search conditions for text search.
      *
@@ -50,10 +67,16 @@ export declare class MongoConditionBuilder {
      *
      * @param searchString - Text to search for
      * @param properties - The collection's properties, searched for string fields
+     * @param viewer - Who the search is for. A field they cannot read is not
+     *   one they may search: the strip keeps its value out of the response, and
+     *   without this the value is still recoverable a substring at a time by
+     *   watching which searches return the row. Absent is the trusted server
+     *   plane, which still does not search an `excludeFromApi` field — the same
+     *   answer the Postgres builder gives.
      * @returns At most one MongoDB filter — callers OR what they get back, which
      *   is right across fields and wrong across terms, so the AND is built here
      */
-    static buildSearchConditions(searchString: string, properties: CollectionConfig["properties"]): Filter<Document>[];
+    static buildSearchConditions(searchString: string, properties: CollectionConfig["properties"], viewer?: FieldViewer): Filter<Document>[];
     /**
      * Combine multiple conditions with AND operator
      *
@@ -85,6 +108,8 @@ export declare class MongoConditionBuilder {
         logical?: LogicalCondition;
         searchString?: string;
         properties?: CollectionConfig["properties"];
+        /** Who the query is for — see {@link buildSearchConditions}. */
+        viewer?: FieldViewer;
     }): Filter<Document>;
     /**
      * The primary key's name in a stored document.

package/dist/db/MongoDataService.d.ts

@@ -96,8 +96,39 @@ export declare class MongoDataService implements DataRepository {
      * partial row everywhere it went: the REST response, `afterSave`, the
      * history entry a revert restores from, and the row pushed to realtime
      * subscribers. Postgres returns the whole row here (`RETURNING *`).
+     *
+     * `mode` is which write the caller means when it names an `id`:
+     *
+     * - `"create"` inserts under that id, and a taken id is a 409. The driver
+     *   authorizes a create as an insert, against the values sent — so a
+     *   create that could land on an existing row is an update no update rule
+     *   ever saw. It was one: an upsert with `$set`, which let a caller name
+     *   another user's id with `status: "new"` and rewrite their row.
+     * - `"update"` updates that row and nothing else, and a missing one is a
+     *   404 — never a row conjured under an id nobody created.
+     * - absent, the repository's own "create or update": an upsert. Only the
+     *   repository's direct callers reach it; the driver always says which.
+     *
+     * `values` may carry field operations (`{ views: { $inc: 1 } }`), which
+     * change the stored value in the same write rather than replace it — see
+     * {@link compileFieldOp}. They were written into the document as literal
+     * objects, so a counter became `{ "$inc": 1 }` behind a 200. Only an
+     * update can carry one: there is no stored value for an insert to act on,
+     * and an upsert may be an insert.
+     */
+    save<M extends Record<string, any>>(collectionPath: string, values: Partial<M>, id?: string | number, _databaseId?: string, mode?: "create" | "update"): Promise<Record<string, unknown>>;
+    /**
+     * The aggregation expression one field operation compiles to, in an update
+     * pipeline's `$set`.
+     *
+     * The same meaning the Postgres compiler gives each one, NULL-safety
+     * included: an unset or null counter increments from zero and an absent
+     * array is pushed onto as an empty one, rather than the write failing on
+     * the first use of a field. `$push` and `$pull` take a value or a list of
+     * values, `$pull` removes every occurrence, and `$merge` is shallow — a
+     * nested object replaces, it is not merged into.
      */
-    save<M extends Record<string, any>>(collectionPath: string, values: Partial<M>, id?: string | number, _databaseId?: string): Promise<Record<string, unknown>>;
+    private compileFieldOp;
     /**
      * Read the document back after a write, falling back to the caller's own
      * values if it has already been removed by a concurrent delete.
@@ -115,9 +146,21 @@ export declare class MongoDataService implements DataRepository {
      */
     delete(collectionPath: string, id: string | number, _databaseId?: string): Promise<void>;
     /**
-     * Check if a field value is unique in a collection
+     * Check if a field value is unique in a collection.
+     *
+     * An equality test on one field, and nothing else a query can express. The
+     * name and the value arrive from a socket frame, and this used to be
+     * `countDocuments({ [name]: value })`: a value of `{ $regex: "^123" }`
+     * answered, one prefix at a time, what a field of a row the caller cannot
+     * see begins with, and a name of `$expr` evaluated an aggregation
+     * expression. So an operator name is refused, the value must be a scalar,
+     * and it is compared with `$eq` — which reads an object as a literal even
+     * if one got this far.
+     *
+     * An absent value is unique, as it is on Postgres: an empty optional field
+     * is not "taken" by every row that also left it empty.
      */
-    checkUniqueField(collectionPath: string, fieldName: string, value: any, excludeEntityId?: string, _databaseId?: string): Promise<boolean>;
+    checkUniqueField(collectionPath: string, fieldName: string, value: unknown, excludeEntityId?: string, _databaseId?: string): Promise<boolean>;
     /**
      * Generate a new row ID
      */

package/dist/index.es.js

@@ -1,8 +1,8 @@
-import { MongoClient, ObjectId } from "mongodb";
+import { MongoClient, MongoServerError, ObjectId } from "mongodb";
 import { ANONYMOUS_USER_ID, EntityReference, ListLimitError, getCollectionDataPath, isAnonymousUid, resolveClientListLimit } from "@rebasepro/types";
-import { assertBeforeQueryIsPostgresOnly, buildPropertyCallbacks, buildSdkData, callbackRefusal, checkOperation, normalizeDriverOrderBy, normalizeEmail, requireCallbackClient, securityRuleToConditions, toCallbackError, toFilterTuples, updateDateAutoValues } from "@rebasepro/common";
+import { assertBeforeQueryIsPostgresOnly, buildPropertyCallbacks, buildSdkData, callbackRefusal, canReadField, checkOperation, normalizeDriverOrderBy, normalizeEmail, requireCallbackClient, restrictedFieldNames, securityRuleToConditions, toCallbackError, toFilterTuples, updateDateAutoValues } from "@rebasepro/common";
 import { mergeDeep, splitSearchTerms } from "@rebasepro/utils";
-import { ApiError, declaredErrorAnswer, logger } from "@rebasepro/server";
+import { ApiError, declaredErrorAnswer, logger, splitFieldOps } from "@rebasepro/server";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
 var __exportAll = (all, no_symbols) => {
@@ -134,10 +134,21 @@ var MongoConditionBuilder = class MongoConditionBuilder {
 	*
 	* Always returns a condition or throws: there is no operator this can be
 	* given that legitimately means "no condition".
-	*/
-	static buildCondition(field, op, value) {
-		if (op === "is-null") return { [field]: { $eq: null } };
-		if (op === "is-not-null") return { [field]: { $ne: null } };
+	*
+	* `negated` asks for the documents where the condition is *false* — not
+	* merely not true. The two differ by the documents where it is unknown,
+	* which in SQL is a comparison against NULL: `NOT (status = 'draft')` does
+	* not return a row whose status is NULL, and the Postgres driver is the
+	* reference every caller of this API writes against. So a comparison is
+	* false only where the field holds a value and the comparison fails on it.
+	* The null tests are never unknown, and negate to each other.
+	*/
+	static buildCondition(field, op, value, negated = false) {
+		if (op === "is-null" || op === "is-not-null") {
+			const isNull = op === "is-null" !== negated;
+			return { [field]: isNull ? { $eq: null } : { $ne: null } };
+		}
+		if (negated) return { $and: [{ [field]: { $ne: null } }, { $nor: [this.buildCondition(field, op, value)] }] };
 		if (op === "like" || op === "ilike" || op === "not-like" || op === "not-ilike") {
 			const regex = likePatternToRegExp(value, op === "ilike" || op === "not-ilike");
 			const negated = op === "not-like" || op === "not-ilike";
@@ -155,26 +166,35 @@ var MongoConditionBuilder = class MongoConditionBuilder {
 		return { [field]: { [mongoOp]: value } };
 	}
 	/**
-	* Translate an `or(...)` / `and(...)` group, nesting included.
+	* Translate an `or(...)` / `and(...)` / `not(...)` group, nesting included.
+	*
+	* `not` negates the conjunction of its conditions — the rule stated on
+	* `LogicalCondition`. It used to fall through to the `and` branch, so
+	* `not(status = 'draft')` returned exactly the drafts. It is compiled by
+	* pushing the negation down to the leaves (De Morgan), each of which knows
+	* which documents make it false rather than merely not true — see
+	* {@link buildCondition}. A `$nor` around the group would be shorter and
+	* wrong: it also matches every document where the condition is unknown.
 	*
 	* Returns `undefined` for a group with nothing in it. `$or: []` is an error
 	* in Mongo and `$and: []` matches every document, so neither is a
 	* defensible reading of "no conditions".
 	*/
-	static buildLogicalConditions(logical) {
+	static buildLogicalConditions(logical, negated = false) {
 		if (!logical || !Array.isArray(logical.conditions)) return void 0;
+		const negateParts = logical.type === "not" ? !negated : negated;
 		const parts = [];
 		for (const entry of logical.conditions) {
 			if (!entry) continue;
 			if ("type" in entry && "conditions" in entry) {
-				const nested = this.buildLogicalConditions(entry);
+				const nested = this.buildLogicalConditions(entry, negateParts);
 				if (nested) parts.push(nested);
 				continue;
 			}
 			const { column, operator, value } = entry;
-			parts.push(this.buildCondition(column, operator, value));
+			parts.push(this.buildCondition(column, operator, value, negateParts));
 		}
-		return logical.type === "or" ? this.combineConditionsWithOr(parts) : this.combineConditionsWithAnd(parts);
+		return logical.type === "or" !== negateParts ? this.combineConditionsWithOr(parts) : this.combineConditionsWithAnd(parts);
 	}
 	/**
 	* Build search conditions for text search.
@@ -187,13 +207,27 @@ var MongoConditionBuilder = class MongoConditionBuilder {
 	*
 	* @param searchString - Text to search for
 	* @param properties - The collection's properties, searched for string fields
+	* @param viewer - Who the search is for. A field they cannot read is not
+	*   one they may search: the strip keeps its value out of the response, and
+	*   without this the value is still recoverable a substring at a time by
+	*   watching which searches return the row. Absent is the trusted server
+	*   plane, which still does not search an `excludeFromApi` field — the same
+	*   answer the Postgres builder gives.
 	* @returns At most one MongoDB filter — callers OR what they get back, which
 	*   is right across fields and wrong across terms, so the AND is built here
 	*/
-	static buildSearchConditions(searchString, properties) {
+	static buildSearchConditions(searchString, properties, viewer) {
 		if (!searchString) return [];
 		const searchableFields = [];
-		for (const [key, prop] of Object.entries(properties)) if (prop?.type === "string" || typeof prop === "string") searchableFields.push(key);
+		let withheldStringFields = 0;
+		for (const [key, prop] of Object.entries(properties)) {
+			if (prop?.type === "string" && !canReadField(prop, viewer)) {
+				withheldStringFields++;
+				continue;
+			}
+			if (prop?.type === "string" || typeof prop === "string") searchableFields.push(key);
+		}
+		if (searchableFields.length === 0 && withheldStringFields > 0) return [{ _id: { $exists: false } }];
 		if (searchableFields.length === 0) return [{ $text: { $search: searchString } }];
 		const terms = splitSearchTerms(searchString);
 		const perTerm = (terms.length > 0 ? terms : [searchString]).map((term) => {
@@ -240,7 +274,7 @@ var MongoConditionBuilder = class MongoConditionBuilder {
 		const logicalCondition = this.buildLogicalConditions(options.logical);
 		if (logicalCondition) conditions.push(logicalCondition);
 		if (options.searchString && options.properties) {
-			const searchConditions = this.buildSearchConditions(options.searchString, options.properties);
+			const searchConditions = this.buildSearchConditions(options.searchString, options.properties, options.viewer);
 			if (searchConditions.length > 0) {
 				const searchFilter = this.combineConditionsWithOr(searchConditions);
 				if (searchFilter) conditions.push(searchFilter);
@@ -451,23 +485,56 @@ var MongoDataService = class {
 	* partial row everywhere it went: the REST response, `afterSave`, the
 	* history entry a revert restores from, and the row pushed to realtime
 	* subscribers. Postgres returns the whole row here (`RETURNING *`).
-	*/
-	async save(collectionPath, values, id, _databaseId) {
+	*
+	* `mode` is which write the caller means when it names an `id`:
+	*
+	* - `"create"` inserts under that id, and a taken id is a 409. The driver
+	*   authorizes a create as an insert, against the values sent — so a
+	*   create that could land on an existing row is an update no update rule
+	*   ever saw. It was one: an upsert with `$set`, which let a caller name
+	*   another user's id with `status: "new"` and rewrite their row.
+	* - `"update"` updates that row and nothing else, and a missing one is a
+	*   404 — never a row conjured under an id nobody created.
+	* - absent, the repository's own "create or update": an upsert. Only the
+	*   repository's direct callers reach it; the driver always says which.
+	*
+	* `values` may carry field operations (`{ views: { $inc: 1 } }`), which
+	* change the stored value in the same write rather than replace it — see
+	* {@link compileFieldOp}. They were written into the document as literal
+	* objects, so a counter became `{ "$inc": 1 }` behind a 200. Only an
+	* update can carry one: there is no stored value for an insert to act on,
+	* and an upsert may be an insert.
+	*/
+	async save(collectionPath, values, id, _databaseId, mode) {
 		const collection = this.getCollection(collectionPath);
-		const mongoValues = this.convertToMongoValues(values);
+		const { values: plainValues, fieldOps } = splitFieldOps(values);
+		const opFields = Object.keys(fieldOps);
+		if (opFields.length > 0 && !(id && mode === "update")) throw ApiError.badRequest(`Field operations (${opFields.map((k) => `'${k}'`).join(", ")}) need an existing row to act on, and this write to "${collectionPath}" ${id && mode === void 0 ? "may be" : "is"} an insert. Send the value itself instead.`, "INVALID_FIELD_OPERATION");
+		const mongoValues = this.convertToMongoValues(plainValues);
 		if (id) {
 			const objectId = this.toObjectId(id);
-			await collection.updateOne({ _id: objectId }, { $set: mongoValues }, { upsert: true });
+			if (mode === "create") await refuseDuplicateKey(collectionPath, id, () => collection.insertOne({
+				...mongoValues,
+				_id: objectId
+			}));
+			else {
+				const update = opFields.length > 0 ? [{ $set: {
+					...Object.fromEntries(Object.entries(mongoValues).map(([key, value]) => [key, { $literal: value }])),
+					...Object.fromEntries(opFields.map((key) => [key, this.compileFieldOp(key, fieldOps[key])]))
+				} }] : { $set: mongoValues };
+				const result = await refuseDuplicateKey(collectionPath, id, () => collection.updateOne({ _id: objectId }, update, { upsert: mode !== "update" }));
+				if (mode === "update" && result.matchedCount === 0) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to update.`);
+			}
 			return await this.readBack(collectionPath, objectId, {
 				...values,
 				id: id.toString()
 			});
 		} else {
 			const newId = new ObjectId();
-			await collection.insertOne({
+			await refuseDuplicateKey(collectionPath, void 0, () => collection.insertOne({
 				_id: newId,
 				...mongoValues
-			});
+			}));
 			return await this.readBack(collectionPath, newId, {
 				...values,
 				id: newId.toString()
@@ -475,6 +542,32 @@ var MongoDataService = class {
 		}
 	}
 	/**
+	* The aggregation expression one field operation compiles to, in an update
+	* pipeline's `$set`.
+	*
+	* The same meaning the Postgres compiler gives each one, NULL-safety
+	* included: an unset or null counter increments from zero and an absent
+	* array is pushed onto as an empty one, rather than the write failing on
+	* the first use of a field. `$push` and `$pull` take a value or a list of
+	* values, `$pull` removes every occurrence, and `$merge` is shallow — a
+	* nested object replaces, it is not merged into.
+	*/
+	compileFieldOp(field, op) {
+		const current = `$${field}`;
+		const operand = this.convertToMongoValue(op.operand);
+		const asList = (value) => Array.isArray(value) ? value : [value];
+		switch (op.operator) {
+			case "$inc": return { $add: [{ $ifNull: [current, 0] }, { $literal: operand }] };
+			case "$push": return { $concatArrays: [{ $ifNull: [current, []] }, { $literal: asList(operand) }] };
+			case "$pull": return { $filter: {
+				input: { $ifNull: [current, []] },
+				as: "element",
+				cond: { $not: [{ $in: ["$$element", { $literal: asList(operand) }] }] }
+			} };
+			case "$merge": return { $mergeObjects: [{ $ifNull: [current, {}] }, { $literal: operand }] };
+		}
+	}
+	/**
 	* Read the document back after a write, falling back to the caller's own
 	* values if it has already been removed by a concurrent delete.
 	*/
@@ -498,11 +591,27 @@ var MongoDataService = class {
 		if ((await collection.deleteOne({ _id: objectId })).deletedCount === 0) throw ApiError.notFound(`No row "${id}" in "${collectionPath}" to delete.`);
 	}
 	/**
-	* Check if a field value is unique in a collection
+	* Check if a field value is unique in a collection.
+	*
+	* An equality test on one field, and nothing else a query can express. The
+	* name and the value arrive from a socket frame, and this used to be
+	* `countDocuments({ [name]: value })`: a value of `{ $regex: "^123" }`
+	* answered, one prefix at a time, what a field of a row the caller cannot
+	* see begins with, and a name of `$expr` evaluated an aggregation
+	* expression. So an operator name is refused, the value must be a scalar,
+	* and it is compared with `$eq` — which reads an object as a literal even
+	* if one got this far.
+	*
+	* An absent value is unique, as it is on Postgres: an empty optional field
+	* is not "taken" by every row that also left it empty.
 	*/
 	async checkUniqueField(collectionPath, fieldName, value, excludeEntityId, _databaseId) {
+		if (typeof fieldName !== "string" || fieldName === "" || fieldName.startsWith("$")) throw ApiError.badRequest(`A uniqueness check names a field, and ${JSON.stringify(fieldName)} is not one.`, "INVALID_UNIQUE_CHECK");
+		if (excludeEntityId !== void 0 && typeof excludeEntityId !== "string" && typeof excludeEntityId !== "number") throw ApiError.badRequest("A uniqueness check excludes one row, named by its id.", "INVALID_UNIQUE_CHECK");
+		if (value === void 0 || value === null) return true;
+		if (!(typeof value === "string" || typeof value === "number" || typeof value === "boolean" || value instanceof Date)) throw ApiError.badRequest(`A uniqueness check on '${fieldName}' compares one value — a string, number, boolean or date — and was given something else.`, "INVALID_UNIQUE_CHECK", { field: fieldName });
 		const collection = this.getCollection(collectionPath);
-		const query = { [fieldName]: value };
+		const query = { [fieldName]: { $eq: value } };
 		if (excludeEntityId) query._id = { $ne: this.toObjectId(excludeEntityId) };
 		return await collection.countDocuments(query) === 0;
 	}
@@ -513,6 +622,25 @@ var MongoDataService = class {
 		return new ObjectId().toString();
 	}
 };
+/**
+* Run a write, answering a duplicate key (E11000) as the 409 it is.
+*
+* A unique index refusing a write is the request's fault, not the server's —
+* Postgres answers its `23505` the same way. On `_id` it means the row a
+* create named is already there; on any other index it names the fields that
+* collided, never the values.
+*/
+async function refuseDuplicateKey(collectionPath, id, write) {
+	try {
+		return await write();
+	} catch (error) {
+		if (!(error instanceof MongoServerError) || error.code !== 11e3) throw error;
+		const pattern = error.keyPattern;
+		const fields = pattern && typeof pattern === "object" ? Object.keys(pattern) : [];
+		if (id !== void 0 && (fields.length === 0 || fields.includes("_id"))) throw ApiError.conflict(`A row "${id}" already exists in "${collectionPath}".`);
+		throw ApiError.conflict(`This write to "${collectionPath}" would duplicate a value that must be unique` + (fields.length > 0 ? ` (${fields.join(", ")}).` : "."), "CONFLICT", fields.length > 0 ? { fields } : void 0);
+	}
+}
 //#endregion
 //#region src/services/MongoRealtimeService.ts
 /**
@@ -1591,7 +1719,7 @@ var MongoDriver = class {
 			timestampNowValue: /* @__PURE__ */ new Date()
 		});
 		try {
-			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId);
+			let savedRow = await this.dataService.save(path, updatedValues, id, resolvedCollection?.databaseId, status === "existing" ? "update" : "create");
 			if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
 				if (globalCallbacks?.afterRead) savedRow = await globalCallbacks.afterRead({
 					collection: resolvedCollection,
@@ -1829,13 +1957,16 @@ var AuthenticatedMongoDriver = class {
 	}
 	async fetchCollection(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.path);
+		const viewer = this.viewer();
+		assertQueryFieldsReadable(props, resolvedCollection, viewer);
 		const rlsFilter = buildMongoFilterFromSecurityRules(resolvedCollection, this.user, "select");
 		if (rlsFilter === null) return [];
 		const userQuery = MongoConditionBuilder.buildQuery({
 			filter: props.filter,
 			logical: props.logical,
 			searchString: props.searchString,
-			properties: resolvedCollection?.properties
+			properties: resolvedCollection?.properties,
+			viewer
 		});
 		const combinedQuery = Object.keys(rlsFilter).length > 0 ? { $and: [userQuery, rlsFilter] } : userQuery;
 		const rows = await this.delegate.getDataService().fetchCollection(props.path, {
@@ -1866,10 +1997,10 @@ var AuthenticatedMongoDriver = class {
 					row: fetched,
 					context: contextForCallback
 				}) ?? fetched;
-				return fetched;
+				return stripUnreadable(fetched, resolvedCollection, viewer);
 			}));
 		}
-		return rows;
+		return rows.map((row) => stripUnreadable(row, resolvedCollection, viewer));
 	}
 	listenCollection(props) {
 		return this.delegate.listenCollection(props, this.authContext());
@@ -1890,6 +2021,16 @@ var AuthenticatedMongoDriver = class {
 		};
 	}
 	/**
+	* The caller per-field `access` is judged against.
+	*
+	* Never `undefined`: that is the trusted server plane, which satisfies
+	* every non-empty role list, and every call through this driver is made
+	* for a user — an anonymous one included, as `roles: ["anon"]`.
+	*/
+	viewer() {
+		return { roles: this.user.roles ?? [] };
+	}
+	/**
 	* Evaluate the collection's rules for one row, fail-closed.
 	*
 	* A path with no resolvable collection has no declared rules — the same
@@ -1908,7 +2049,7 @@ var AuthenticatedMongoDriver = class {
 		assertSecurityRulesEnforceable(resolvedCollection, "select");
 		const row = await this.delegate.fetchOne(props);
 		if (row && !this.authorize(resolvedCollection, rowToEntityForCheck(row, props.path), "select")) return;
-		return row;
+		return row && stripUnreadable(row, resolvedCollection, this.viewer());
 	}
 	listenOne(props) {
 		return this.delegate.listenOne(props, this.authContext());
@@ -1947,10 +2088,10 @@ var AuthenticatedMongoDriver = class {
 			};
 			if (!this.authorize(resolvedCollection, tempEntity, "insert")) throw ApiError.forbidden("Forbidden");
 		}
-		return this.delegate.save({
+		return stripUnreadable(await this.delegate.save({
 			...props,
 			collection: resolvedCollection
-		});
+		}), resolvedCollection, this.viewer());
 	}
 	async delete(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.row.path);
@@ -1963,21 +2104,35 @@ var AuthenticatedMongoDriver = class {
 		if (!existing || !this.authorize(resolvedCollection, rowToEntityForCheck(existing, props.row.path), "delete")) throw ApiError.forbidden("Forbidden");
 		return this.delegate.delete(props);
 	}
+	/**
+	* Whether `value` is free in `name`, asked about a field this caller could
+	* have read — anything else is an oracle over a value the strip withholds,
+	* one guess at a time. A registered collection names its fields, so an
+	* undeclared name is refused rather than counted.
+	*/
 	async checkUniqueField(path, name, value, id, collection) {
-		return this.delegate.checkUniqueField(path, name, value, id, collection);
+		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(collection, path);
+		if (resolvedCollection?.properties) {
+			if (typeof name !== "string" || !Object.prototype.hasOwnProperty.call(resolvedCollection.properties, name)) throw ApiError.badRequest(`'${String(name)}' is not a declared property of '${resolvedCollection.slug}', so it has no uniqueness to check.`, "INVALID_UNIQUE_CHECK", { field: name });
+			assertQueryFieldsReadable({ filter: { [name]: ["==", value] } }, resolvedCollection, this.viewer());
+		}
+		return this.delegate.checkUniqueField(path, name, value, id, resolvedCollection);
 	}
 	generateId(path, collection) {
 		return this.delegate.generateId(path, collection);
 	}
 	async count(props) {
 		const { collection: resolvedCollection } = this.delegate.resolveCollectionCallbacks(props.collection, props.path);
+		const viewer = this.viewer();
+		assertQueryFieldsReadable(props, resolvedCollection, viewer);
 		const rlsFilter = buildMongoFilterFromSecurityRules(resolvedCollection, this.user, "select");
 		if (rlsFilter === null) return 0;
 		const userQuery = MongoConditionBuilder.buildQuery({
 			filter: props.filter,
 			logical: props.logical,
 			searchString: props.searchString,
-			properties: resolvedCollection?.properties
+			properties: resolvedCollection?.properties,
+			viewer
 		});
 		const combinedQuery = Object.keys(rlsFilter).length > 0 ? { $and: [userQuery, rlsFilter] } : userQuery;
 		return this.delegate.getDataService().count(props.path, {
@@ -1990,6 +2145,54 @@ var AuthenticatedMongoDriver = class {
 	}
 };
 /**
+* Drop every field `viewer` may not read — what the Postgres row pipeline's
+* `stripUnreadable` does, applied where rows leave this driver for a caller.
+*
+* `excludeFromApi` needs no branch of its own: `restrictedFieldNames` reads it
+* as `read: []`, which no caller satisfies. Deleted, never nulled — a withheld
+* value that arrives as `null` is indistinguishable from a stored one, and an
+* update that echoes the row back would overwrite the real value with it.
+*/
+function stripUnreadable(row, collection, viewer) {
+	if (!collection) return row;
+	const { refused } = restrictedFieldNames(collection, viewer, "read");
+	if (refused.size === 0) return row;
+	const visible = { ...row };
+	for (const name of refused) delete visible[name];
+	return visible;
+}
+/**
+* Refuse a read that filters or sorts on a field the caller cannot read.
+*
+* The strip keeps the value off the wire; this keeps it from being read a bit
+* at a time — `salary > 100000` returns exactly the rows whose withheld salary
+* is above it, and a sort on it returns them in its order. REST refuses the
+* same request before it reaches a driver; the socket and subscriptions reach
+* this driver directly, so the rule is applied here too, in the same words.
+*/
+function assertQueryFieldsReadable(props, collection, viewer) {
+	if (!collection) return;
+	const { refused } = restrictedFieldNames(collection, viewer, "read");
+	if (refused.size === 0) return;
+	const named = /* @__PURE__ */ new Set();
+	const consider = (field) => {
+		if (typeof field === "string" && refused.has(field)) named.add(field);
+	};
+	Object.keys(props.filter ?? {}).forEach(consider);
+	const walk = (logical) => {
+		for (const entry of logical?.conditions ?? []) if (entry && "conditions" in entry) walk(entry);
+		else consider(entry?.column);
+	};
+	walk(props.logical);
+	for (const key of normalizeDriverOrderBy(props.orderBy, props.order) ?? []) consider(Array.isArray(key) ? key[0] : key);
+	if (named.size === 0) return;
+	const fields = [...named];
+	throw ApiError.badRequest(`${fields.map((f) => `'${f}'`).join(", ")} ${fields.length > 1 ? "are" : "is"} not readable on '${collection.slug}' with your roles, so ${fields.length > 1 ? "they" : "it"} cannot be used to filter or sort.`, "FIELD_NOT_READABLE", {
+		collection: collection.slug,
+		fields
+	});
+}
+/**
 * Wrap a flat row into the Entity shape expected by `checkOperation`,
 * which evaluates security rules against `row.values`.
 */
@@ -2326,10 +2529,20 @@ function toUser(doc) {
 		emailVerified: doc.emailVerified ?? false,
 		emailVerificationToken: doc.emailVerificationToken ?? null,
 		emailVerificationSentAt: doc.emailVerificationSentAt ? new Date(doc.emailVerificationSentAt) : null,
+		isAnonymous: doc.isAnonymous === true,
+		metadata: doc.metadata ?? {},
 		createdAt: new Date(doc.createdAt),
 		updatedAt: new Date(doc.updatedAt)
 	};
 }
+/**
+* Mongo's duplicate-key error. The unique index on `email` in
+* `ensure-collections.ts` is what raises it, and the answer to it is the same
+* 409 Postgres gives for its 23505 — see `UserRepository.createUser`.
+*/
+function isDuplicateKey(error) {
+	return error?.code === 11e3;
+}
 var MongoUserService = class {
 	db;
 	constructor(db) {
@@ -2358,13 +2571,15 @@ var MongoUserService = class {
 			displayName: data.displayName ?? null,
 			photoUrl: data.photoUrl ?? null,
 			emailVerified: data.emailVerified ?? false,
+			isAnonymous: data.isAnonymous ?? false,
+			metadata: data.metadata ?? {},
 			createdAt: now,
 			updatedAt: now
 		};
 		try {
 			await this.collection.insertOne(doc);
 		} catch (error) {
-			if (error?.code === 11e3) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			if (isDuplicateKey(error)) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
 			throw error;
 		}
 		return toUser(doc);
@@ -2422,10 +2637,26 @@ var MongoUserService = class {
 			updatedAt: /* @__PURE__ */ new Date()
 		};
 		if (typeof updateData.email === "string") updateData.email = normalizeEmail(updateData.email);
-		await this.collection.updateOne({ id }, { $set: updateData });
+		try {
+			await this.collection.updateOne({ id }, { $set: updateData });
+		} catch (error) {
+			if (isDuplicateKey(error)) throw ApiError.conflict("Email already registered", "EMAIL_EXISTS");
+			throw error;
+		}
 		return this.getUserById(id);
 	}
+	/**
+	* Everything keyed by the user goes with them. Postgres does this by
+	* foreign-key cascade; Mongo has none, so it is spelled out — and the
+	* refresh tokens are the part that matters: left behind, a deleted user's
+	* session kept minting access tokens for a uid that no longer exists.
+	* Sessions first, so a failure part-way leaves an account that cannot sign
+	* in rather than a session with no account.
+	*/
 	async deleteUser(id) {
+		await this.db.collection("rebase_refresh_tokens").deleteMany({ uid: id });
+		await this.db.collection("rebase_password_reset_tokens").deleteMany({ uid: id });
+		await this.db.collection("magic_link_tokens").deleteMany({ uid: id });
 		await this.collection.deleteOne({ id });
 		await this.identitiesCollection.deleteMany({ uid: id });
 		await this.userRolesCollection.deleteMany({ uid: id });
@@ -3088,7 +3319,7 @@ function createMongoBootstrapper(mongoConfig) {
 		},
 		mountRoutes() {},
 		async initializeWebsockets(server, realtimeService, driver, config, authAdapter) {
-			const { createMongoWebSocket } = await import("./websocket-C3iT6srl.js");
+			const { createMongoWebSocket } = await import("./websocket-BtK4_9ZS.js");
 			createMongoWebSocket(server, realtimeService, driver, config, cachedAdmin, authAdapter);
 		}
 	};