@rebasepro/server-postgres 0.0.1-canary.4829d6e

package/src/cli-errors.ts

@@ -0,0 +1,265 @@
+import chalk from "chalk";
+import { logger } from "@rebasepro/server";
+
+/**
+ * Detect whether an error (or AggregateError wrapping multiple attempts)
+ * represents an ECONNREFUSED — i.e. the database is simply not running.
+ *
+ * Handles:
+ * - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
+ * - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
+ * - Drizzle's `cause`-wrapped pg errors
+ */
+export function isEconnrefused(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { code?: string; cause?: unknown; errors?: unknown[] };
+    if (e.code === "ECONNREFUSED") return true;
+    // AggregateError from Node net (dual-stack IPv4 + IPv6)
+    if (Array.isArray(e.errors)) {
+        return e.errors.some(inner =>
+            inner && typeof inner === "object" && (inner as { code?: string }).code === "ECONNREFUSED"
+        );
+    }
+    // Drizzle wraps the pg error in `cause`
+    if (e.cause && typeof e.cause === "object") {
+        return isEconnrefused(e.cause);
+    }
+    return false;
+}
+
+/**
+ * Detect PostgreSQL authentication failures.
+ * PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)
+ */
+export function isAuthFailure(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { code?: string; cause?: unknown };
+    if (e.code === "28P01" || e.code === "28000") return true;
+    if (e.cause && typeof e.cause === "object") {
+        return isAuthFailure(e.cause);
+    }
+    // Also check the message for common pg auth failure text
+    if ("message" in e && typeof (e as { message?: string }).message === "string") {
+        const msg = (e as { message: string }).message.toLowerCase();
+        if (msg.includes("password authentication failed") || msg.includes("no pg_hba.conf entry")) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Detect the "SSL is not enabled on the server" failure — the client attempted
+ * an SSL handshake against a Postgres server that doesn't support it (common
+ * with a plain local dev database). The fix is `?sslmode=disable` on the URL.
+ */
+export function isSslNotEnabled(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { message?: string; cause?: unknown };
+    if (typeof e.message === "string" && e.message.toLowerCase().includes("ssl is not enabled on the server")) {
+        return true;
+    }
+    if (e.cause && typeof e.cause === "object") {
+        return isSslNotEnabled(e.cause);
+    }
+    return false;
+}
+
+/**
+ * Detect PostgreSQL "cannot drop ... because other objects depend on it"
+ * (error code 2BP01, dependent_objects_still_exist). This is the failure that
+ * strands a declarative `db push` half-applied when a collection is removed but
+ * an enum type it defined is still referenced by another object.
+ */
+export function isDependencyDropError(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { code?: string; message?: string; cause?: unknown };
+    if (e.code === "2BP01") return true;
+    if (typeof e.message === "string") {
+        const msg = e.message.toLowerCase();
+        if (msg.includes("other objects depend on it") || msg.includes("cannot drop type")) {
+            return true;
+        }
+    }
+    if (e.cause && typeof e.cause === "object") {
+        return isDependencyDropError(e.cause);
+    }
+    return false;
+}
+
+/**
+ * Parse host:port from a DATABASE_URL for display purposes.
+ */
+function parseHostInfo(databaseUrl: string): string {
+    try {
+        const parsed = new URL(databaseUrl);
+        return `${parsed.hostname}:${parsed.port || 5432}`;
+    } catch {
+        return "unknown";
+    }
+}
+
+/**
+ * Format a diagnostic banner for ECONNREFUSED errors.
+ */
+function formatConnectionRefusedBanner(databaseUrl: string): string {
+    const hostInfo = parseHostInfo(databaseUrl);
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  The database server is not running or is not accepting\n` +
+        `  connections. Common fixes:\n` +
+        `\n` +
+        `    • brew services start postgresql@18\n` +
+        `    • docker compose up -d postgres\n` +
+        `    • Verify DATABASE_URL in your .env file\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Format a diagnostic banner for authentication failures.
+ */
+function formatAuthFailureBanner(databaseUrl: string): string {
+    const hostInfo = parseHostInfo(databaseUrl);
+    let username = "unknown";
+    try {
+        username = new URL(databaseUrl).username || "unknown";
+    } catch { /* ignore */ }
+
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  Authentication failed for user "${username}" at ${hostInfo}\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  PostgreSQL rejected the credentials. Common fixes:\n` +
+        `\n` +
+        `    • Check the username and password in DATABASE_URL\n` +
+        `    • Verify the user exists:  psql -c "\\du"\n` +
+        `    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Format a diagnostic banner for "SSL is not enabled on the server".
+ */
+function formatSslNotEnabledBanner(databaseUrl: string): string {
+    const hostInfo = parseHostInfo(databaseUrl);
+    const suggestion = databaseUrl.includes("?") ? "&sslmode=disable" : "?sslmode=disable";
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  SSL is not enabled on the PostgreSQL server at ${hostInfo}\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  The client tried to connect over SSL, but the server does not\n` +
+        `  support it. This is normal for a plain local dev database.\n` +
+        `\n` +
+        `  Fix: append ${chalk.bold("sslmode=disable")} to DATABASE_URL, e.g.\n` +
+        `\n` +
+        `    DATABASE_URL=...${suggestion}\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Format a diagnostic banner for a dependency-drop failure during `db push`.
+ * Explains that the database may be left partially migrated and how to recover.
+ */
+function formatDependencyDropBanner(): string {
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  Schema push failed: a type/table could not be dropped\n` +
+        `      because other objects still depend on it.\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  ${chalk.yellow("The database may now be partially migrated.")} Atlas applies\n` +
+        `  statements individually, so earlier changes in this push may\n` +
+        `  already be committed while later ones failed.\n` +
+        `\n` +
+        `  This commonly happens when a collection is removed but an enum\n` +
+        `  type it defined is still referenced. To recover:\n` +
+        `\n` +
+        `    1. Inspect the leftover object named in the error above.\n` +
+        `    2. Drop it with CASCADE, e.g.:\n` +
+        `         psql "$DATABASE_URL" -c 'DROP TYPE "<name>" CASCADE;'\n` +
+        `    3. Re-run:  ${chalk.bold.green("rebase db push")}\n` +
+        `\n` +
+        `  Prefer a safe, versioned workflow? Use ${chalk.bold("rebase db generate")}\n` +
+        `  + ${chalk.bold("rebase db migrate")} instead of push for destructive changes.\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Pre-flight check: verify that the database is reachable before running
+ * a heavy subprocess (Atlas, migrations, etc.).
+ *
+ * Exits with code 1 and a friendly banner on known failure modes.
+ * On unknown errors, logs a warning and allows the caller to proceed.
+ */
+export async function checkDatabaseConnectivity(databaseUrl: string): Promise<void> {
+    let client: import("pg").Client | undefined;
+    try {
+        const { Client } = await import("pg");
+        client = new Client({
+            connectionString: databaseUrl,
+            connectionTimeoutMillis: 5000
+        });
+        await client.connect();
+        await client.query("SELECT 1");
+    } catch (err: unknown) {
+        if (isEconnrefused(err)) {
+            logger.error(formatConnectionRefusedBanner(databaseUrl));
+            process.exit(1);
+        }
+        if (isAuthFailure(err)) {
+            logger.error(formatAuthFailureBanner(databaseUrl));
+            process.exit(1);
+        }
+        if (isSslNotEnabled(err)) {
+            logger.error(formatSslNotEnabledBanner(databaseUrl));
+            process.exit(1);
+        }
+        // Unknown error — warn but don't block; let the downstream tool surface details
+        logger.warn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
+        logger.warn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
+    } finally {
+        try {
+            await client?.end();
+        } catch {
+            // ignore cleanup errors
+        }
+    }
+}
+
+/**
+ * Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).
+ * Returns a formatted diagnostic string if the error matches a known pattern,
+ * or null if unrecognized.
+ */
+export function diagnoseDbError(err: unknown, databaseUrl?: string): string | null {
+    if (isEconnrefused(err)) {
+        return formatConnectionRefusedBanner(databaseUrl || "");
+    }
+    if (isAuthFailure(err)) {
+        return formatAuthFailureBanner(databaseUrl || "");
+    }
+    if (isSslNotEnabled(err)) {
+        return formatSslNotEnabledBanner(databaseUrl || "");
+    }
+    if (isDependencyDropError(err)) {
+        return formatDependencyDropBanner();
+    }
+    return null;
+}

package/src/cli-helpers.ts

@@ -0,0 +1,196 @@
+import path from "path";
+import fs from "fs";
+import { execSync } from "child_process";
+import { fileURLToPath, pathToFileURL } from "url";
+import chalk from "chalk";
+import { logger } from "@rebasepro/server";
+import type { CollectionConfig, Relation } from "@rebasepro/types";
+
+const getHelpersDirname = () => {
+    try {
+        return eval("__dirname");
+    } catch {
+        const err = new Error();
+        const stackLine = err.stack?.split("\n")[1] || "";
+        const match = stackLine.match(/\((.*?):\d+:\d+\)/) || stackLine.match(/at (.*?):\d+:\d+/);
+        if (match && match[1]) {
+            let cleanPath = match[1];
+            if (cleanPath.startsWith("file://")) {
+                cleanPath = fileURLToPath(cleanPath);
+            }
+            return path.dirname(cleanPath);
+        }
+        return process.cwd();
+    }
+};
+const __helpersDirname = getHelpersDirname();
+
+
+
+export function resolveLocalBin(binName: string): string | null {
+    // Try to find node_modules/.bin upwards from __helpersDirname first (package-relative)
+    let dir = __helpersDirname;
+    while (true) {
+        const candidate = path.join(dir, "node_modules", ".bin", binName);
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+    }
+
+    let cwd = process.cwd();
+    // Try to find node_modules/.bin upwards from process.cwd()
+    while (true) {
+        const candidate = path.join(cwd, "node_modules", ".bin", binName);
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(cwd);
+        if (parent === cwd) break;
+        cwd = parent;
+    }
+    // Fall back to globally installed binary via which/where
+    try {
+        const cmd = process.platform === "win32" ? `where ${binName}` : `which ${binName}`;
+        const globalPath = execSync(cmd, { encoding: "utf-8" }).trim().split("\n")[0].trim();
+        if (globalPath && fs.existsSync(globalPath)) return globalPath;
+    } catch {
+        // not found globally
+    }
+    return null;
+}
+
+export async function getTableIncludesFromCollections(collections: CollectionConfig[]): Promise<string[]> {
+    const { getTableName, resolveCollectionRelations } = await import("@rebasepro/common");
+    const { isPostgresCollectionConfig } = await import("@rebasepro/types");
+
+    const includes: string[] = [];
+    for (const col of collections) {
+        const tableName = getTableName(col);
+        const schema = isPostgresCollectionConfig(col) && col.schema ? col.schema : "public";
+        if (tableName) {
+            includes.push(`${schema}.${tableName}`);
+        }
+
+        const resolvedRelations = resolveCollectionRelations(col);
+        for (const relation of Object.values(resolvedRelations) as Relation[]) {
+            if (relation.through) {
+                const junctionTableName = relation.through.table;
+                const targetCollection = relation.target();
+                const targetSchema = isPostgresCollectionConfig(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+                includes.push(`${targetSchema}.${junctionTableName}`);
+            }
+        }
+    }
+    
+    return Array.from(new Set(includes));
+}
+
+export async function getTableIncludes(collectionsPath: string): Promise<string[]> {
+    // Note: a relative --collections path resolves against the *current working
+    // directory*, not the backend package. When invoked via the generated npm
+    // script (cwd = backend/), the script uses "../config/collections" to
+    // compensate — so running the CLI directly from the repo root with a
+    // different relative path can silently point at the wrong place.
+    const resolvedPath = path.resolve(collectionsPath);
+    const collections: CollectionConfig[] = [];
+    if (!fs.existsSync(resolvedPath)) {
+        logger.warn(chalk.yellow(
+            `  ⚠  Collections path not found: "${collectionsPath}"\n` +
+            `     Resolved to: ${resolvedPath}\n` +
+            `     (relative to cwd: ${process.cwd()})\n` +
+            `     Pass an absolute path, or a path relative to where you run the command.`
+        ));
+    }
+    if (fs.existsSync(resolvedPath)) {
+        const stats = fs.statSync(resolvedPath);
+        if (stats.isDirectory()) {
+            const files = fs.readdirSync(resolvedPath);
+            for (const file of files) {
+                if ((file.endsWith(".ts") || file.endsWith(".js")) &&
+                    !file.includes(".test.") &&
+                    !file.endsWith(".d.ts") &&
+                    file !== "index.ts" && file !== "index.js") {
+                    try {
+                        const filePath = path.join(resolvedPath, file);
+                        const fileUrl = pathToFileURL(filePath).href;
+                        const module = await import(fileUrl);
+                        if (module && module.default) {
+                            collections.push(module.default);
+                        }
+                    } catch {
+                        // ignore
+                    }
+                }
+            }
+        }
+    }
+
+    return getTableIncludesFromCollections(collections);
+}
+
+export function getDevDatabaseUrl(databaseUrl: string): string {
+    try {
+        const parsed = new URL(databaseUrl);
+        const dbName = parsed.pathname.slice(1);
+        parsed.pathname = `/${dbName}_dev_diff`;
+        return parsed.toString();
+    } catch {
+        return databaseUrl + "_dev_diff";
+    }
+}
+
+export async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string) {
+    try {
+        const { Client } = await import("pg");
+        const parsed = new URL(databaseUrl);
+        const devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+        
+        parsed.pathname = "/postgres";
+        const client = new Client({ connectionString: parsed.toString() });
+        await client.connect();
+        try {
+            const res = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName]);
+            if (res.rowCount === 0) {
+                await client.query(`CREATE DATABASE "${devDbName}"`);
+                logger.info(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch {
+        // Ignore, let Atlas handle connection failures
+    }
+}
+
+export async function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]> {
+    const includes = await getTableIncludes(collectionsPath);
+    const excludes: string[] = ["atlas_schema_revisions.*", "auth.*"];
+    
+    try {
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const res = await client.query(`
+                SELECT table_schema || '.' || table_name AS full_name
+                FROM information_schema.tables
+                WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+                  AND table_type IN ('BASE TABLE', 'VIEW');
+            `);
+            
+            const existingTables = res.rows.map((row: { full_name: string }) => row.full_name);
+            
+            for (const table of existingTables) {
+                if (!includes.includes(table)) {
+                    excludes.push(table);
+                }
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Failed to query database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`));
+    }
+    
+    return excludes;
+}
+