@rebasepro/server-postgres 0.0.1-canary.4829d6e

package/src/schema/introspect-runtime.ts

@@ -0,0 +1,293 @@
+/**
+ * Runtime introspection — builds collections in memory from the live database.
+ *
+ * This is what makes BaaS mode work with zero configuration: instead of loading
+ * collection files from disk, the server reads `information_schema` at boot and
+ * derives a collection per table, so any database is served over REST without a
+ * single config file.
+ *
+ * Distinct from `introspect-db.ts`, which runs the same queries but emits
+ * TypeScript *source* for a developer to edit and commit (CMS mode). The two
+ * share the mapping helpers in `introspect-db-logic.ts` so a table is described
+ * the same way whether it was generated or introspected.
+ */
+import type { PostgresCollectionConfig } from "@rebasepro/types";
+
+import {
+    TableRow,
+    TableColumn,
+    EnumValue,
+    PrimaryKeyRow,
+    ForeignKeyRow,
+    TableMeta,
+    buildTablesMap,
+    buildEnumMap,
+    identifyJoinTables,
+    humanize,
+    singularize,
+    mapPgType,
+    getIconForTable
+} from "./introspect-db-logic";
+
+export interface IntrospectedSchema {
+    tablesMap: Map<string, TableMeta>;
+    enumMap: Map<string, string[]>;
+    joinTables: Set<string>;
+}
+
+/** Whether a table carries an authorization model of its own. */
+export interface TableRlsStatus {
+    table: string;
+    /** ALTER TABLE … ENABLE ROW LEVEL SECURITY has been run. */
+    rlsEnabled: boolean;
+    /** Policies attached to it. RLS enabled with none = nothing is visible. */
+    policyCount: number;
+}
+
+/**
+ * Read the RLS posture of each table in a schema.
+ *
+ * This is what decides whether baas mode may serve a table. A table with RLS
+ * disabled has no authorization model: since every authenticated request runs
+ * as `rebase_user`, and that role is granted DML on the schema, serving such a
+ * table hands every row to every logged-in user.
+ */
+export async function readRlsStatus(client: Queryable, pgSchema: string): Promise<Map<string, TableRlsStatus>> {
+    const { rows } = await client.query<{ table: string; rls_enabled: boolean; policy_count: string | number }>(
+        `SELECT c.relname AS table,
+                c.relrowsecurity AS rls_enabled,
+                (SELECT count(*) FROM pg_policy p WHERE p.polrelid = c.oid) AS policy_count
+         FROM pg_class c
+         JOIN pg_namespace n ON n.oid = c.relnamespace
+         WHERE n.nspname = $1 AND c.relkind = 'r'`,
+        [pgSchema]
+    );
+
+    return new Map(
+        rows.map((r) => [
+            r.table,
+            { table: r.table, rlsEnabled: r.rls_enabled === true, policyCount: Number(r.policy_count ?? 0) }
+        ])
+    );
+}
+
+/** Minimal query surface — satisfied by pg.Client and pg.Pool alike. */
+export interface Queryable {
+    query<R>(text: string, values?: unknown[]): Promise<{ rows: R[] }>;
+}
+
+/**
+ * Read tables, columns, enums, primary keys and foreign keys for a schema.
+ * Mirrors the queries in introspect-db.ts.
+ */
+export async function introspectSchema(client: Queryable, pgSchema: string): Promise<IntrospectedSchema> {
+    const { rows: tables } = await client.query<TableRow>(
+        `SELECT table_name
+         FROM information_schema.tables
+         WHERE table_schema = $1 AND table_type = 'BASE TABLE'
+           AND table_name NOT LIKE 'drizzle_%'
+           AND table_name NOT LIKE 'rebase_%'
+         ORDER BY table_name`,
+        [pgSchema]
+    );
+
+    const { rows: columns } = await client.query<TableColumn>(
+        `SELECT
+            c.table_name,
+            c.column_name,
+            c.data_type,
+            c.udt_name,
+            c.is_nullable,
+            c.column_default,
+            (SELECT a.atttypmod FROM pg_attribute a
+             JOIN pg_class pc ON a.attrelid = pc.oid
+             WHERE pc.relname = c.table_name
+               AND a.attname = c.column_name
+               AND pc.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = c.table_schema)) as atttypmod
+         FROM information_schema.columns c
+         WHERE c.table_schema = $1`,
+        [pgSchema]
+    );
+
+    const { rows: enumValues } = await client.query<EnumValue>(
+        `SELECT t.typname AS enum_name,
+                e.enumlabel AS enum_value,
+                e.enumsortorder AS sort_order
+         FROM pg_type t
+         JOIN pg_enum e ON t.oid = e.enumtypid
+         JOIN pg_namespace n ON t.typnamespace = n.oid
+         WHERE n.nspname = $1
+         ORDER BY t.typname, e.enumsortorder`,
+        [pgSchema]
+    );
+
+    const { rows: pks } = await client.query<PrimaryKeyRow>(
+        `SELECT t.relname as table_name, a.attname as column_name
+         FROM   pg_index i
+         JOIN   pg_attribute a ON a.attrelid = i.indrelid
+                             AND a.attnum = ANY(i.indkey)
+         JOIN   pg_class t ON t.oid = i.indrelid
+         JOIN   pg_namespace n ON n.oid = t.relnamespace
+         WHERE  i.indisprimary AND n.nspname = $1`,
+        [pgSchema]
+    );
+
+    const { rows: fks } = await client.query<ForeignKeyRow>(
+        `SELECT
+            tc.table_name,
+            kcu.column_name,
+            ccu.table_name AS foreign_table_name,
+            ccu.column_name AS foreign_column_name
+         FROM information_schema.table_constraints AS tc
+         JOIN information_schema.key_column_usage AS kcu
+           ON tc.constraint_name = kcu.constraint_name
+           AND tc.table_schema = kcu.table_schema
+         JOIN information_schema.constraint_column_usage AS ccu
+           ON ccu.constraint_name = tc.constraint_name
+           AND ccu.table_schema = tc.table_schema
+         WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_schema = $1`,
+        [pgSchema]
+    );
+
+    const tablesMap = buildTablesMap(tables, columns, pks, fks);
+    return {
+        tablesMap,
+        enumMap: buildEnumMap(enumValues),
+        joinTables: identifyJoinTables(tablesMap)
+    };
+}
+
+/** Derive the `isId` flavour for a primary-key column. */
+function idKindFor(col: TableColumn, propType: string): "uuid" | "increment" | true {
+    if (col.data_type.toLowerCase() === "uuid") return "uuid";
+    if (propType === "number") return "increment";
+    return true;
+}
+
+function buildProperties(
+    meta: TableMeta,
+    enumMap: Map<string, string[]>
+): Record<string, Record<string, unknown>> {
+    const properties: Record<string, Record<string, unknown>> = {};
+
+    for (const col of meta.columns) {
+        const isPk = meta.pks.includes(col.column_name);
+        // Foreign keys surface as relations below, unless they are also part of
+        // the primary key, in which case the column itself must stay.
+        const isFk = meta.fks.some((fk) => fk.column_name === col.column_name);
+        if (isFk && !isPk) continue;
+
+        const enumValues = enumMap.get(col.udt_name);
+        const isEnum = col.data_type === "USER-DEFINED" && enumValues !== undefined;
+        const isVector = col.udt_name === "vector";
+        const propType = isEnum ? "string" : isVector ? "vector" : mapPgType(col.data_type);
+
+        const property: Record<string, unknown> = {
+            name: humanize(col.column_name),
+            columnName: col.column_name,
+            type: propType
+        };
+
+        const key = col.column_name;
+
+        if (isPk) {
+            property.isId = idKindFor(col, propType);
+        } else if (col.is_nullable === "NO" && col.column_default === null) {
+            property.validation = { required: true };
+        }
+
+        if (isEnum && enumValues) {
+            property.enum = enumValues.map((value) => ({ id: value, label: humanize(value) }));
+        }
+
+        properties[key] = property;
+    }
+
+    return properties;
+}
+
+/**
+ * Owning relations, derived from this table's foreign keys. Mirrors the shape
+ * `generateCollectionFile` emits, except `target` uses the slug string form
+ * rather than a thunk to a module import.
+ */
+function buildRelations(
+    meta: TableMeta,
+    slugByTable: Map<string, string>
+): Record<string, Record<string, unknown>> {
+    const relations: Record<string, Record<string, unknown>> = {};
+
+    for (const fk of meta.fks) {
+        const targetSlug = slugByTable.get(fk.foreign_table_name);
+        if (!targetSlug) continue;
+
+        // Strip the conventional _id suffix: author_id -> author
+        let key = fk.column_name.replace(/_id$/, "");
+        if (meta.pks.includes(fk.column_name) && key === fk.column_name) {
+            // The FK is also the PK and its name doesn't imply a relation (e.g.
+            // "id"), so naming the relation after the column would collide with
+            // the primary-key property.
+            key = fk.foreign_table_name;
+        }
+
+        relations[key] = {
+            name: humanize(key),
+            type: "relation",
+            target: targetSlug,
+            cardinality: "one",
+            direction: "owning",
+            localKey: fk.column_name
+        };
+    }
+
+    return relations;
+}
+
+/**
+ * Turn an introspected schema into collections.
+ *
+ * Join tables are skipped: they carry no identity of their own and exist to
+ * express a many-to-many edge between two other tables.
+ */
+export function buildCollectionsFromSchema(
+    { tablesMap, enumMap, joinTables }: IntrospectedSchema,
+    pgSchema: string
+): PostgresCollectionConfig[] {
+    const slugByTable = new Map<string, string>();
+    for (const tableName of tablesMap.keys()) {
+        if (!joinTables.has(tableName)) slugByTable.set(tableName, tableName);
+    }
+
+    const collections: PostgresCollectionConfig[] = [];
+
+    for (const [tableName, meta] of tablesMap) {
+        if (joinTables.has(tableName)) continue;
+
+        const collectionName = humanize(tableName);
+        const collection = {
+            name: collectionName,
+            singularName: singularize(collectionName),
+            slug: tableName,
+            table: tableName,
+            schema: pgSchema,
+            icon: getIconForTable(tableName),
+            properties: {
+                ...buildProperties(meta, enumMap),
+                ...buildRelations(meta, slugByTable)
+            }
+        } as unknown as PostgresCollectionConfig;
+
+        collections.push(collection);
+    }
+
+    return collections;
+}
+
+/** Introspect the database and return ready-to-serve collections. */
+export async function introspectCollections(
+    client: Queryable,
+    pgSchema: string
+): Promise<PostgresCollectionConfig[]> {
+    const schema = await introspectSchema(client, pgSchema);
+    return buildCollectionsFromSchema(schema, pgSchema);
+}

package/src/schema/test-schema.ts

@@ -0,0 +1,11 @@
+import { pgTable, text, pgPolicy } from "drizzle-orm/pg-core";
+import { sql } from "drizzle-orm";
+
+export const testTable = pgTable("test", {
+  id: text("id").primaryKey()
+}, (t) => [
+  pgPolicy("renamed_policy", { as: "permissive",
+to: "public",
+for: "select",
+using: sql`true` })
+]);

package/src/security/policy-drift.test.ts

@@ -0,0 +1,122 @@
+import { describe, expect, it } from "@jest/globals";
+import type { CollectionConfig } from "@rebasepro/types";
+
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type Queryable } from "./policy-drift";
+import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
+
+function collection(slug: string): CollectionConfig {
+    return {
+        name: slug,
+        slug,
+        table: slug,
+        schema: "public",
+        properties: { id: { name: "ID", type: "string", isId: "uuid" } },
+        securityRules: [
+            { operation: "select", access: "public" },
+            { operations: ["insert", "update", "delete"], roles: ["admin"] }
+        ]
+    } as unknown as CollectionConfig;
+}
+
+/** Stands in for pg_policies. */
+function dbWith(rows: Record<string, unknown>[]): Queryable {
+    return { query: async () => ({ rows: rows as never[] }) };
+}
+
+describe("parseExpectedPolicies", () => {
+    it("reads the DDL that db push actually applies", () => {
+        const ddl = generatePostgresPoliciesDdl([collection("authors")]);
+        const parsed = parseExpectedPolicies(ddl);
+
+        expect(parsed.length).toBeGreaterThan(0);
+        const select = parsed.find((p) => p.command === "SELECT" && p.roles.includes("public"));
+        expect(select).toMatchObject({ schema: "public", table: "authors", command: "SELECT" });
+    });
+});
+
+describe("checkPolicyDrift", () => {
+    it("reports nothing when the database matches the collections", async () => {
+        const cols = [collection("authors")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => ({
+            schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(hasDrift(drift)).toBe(false);
+        expect(formatPolicyDrift(drift)).toBe("");
+    });
+
+    it("flags a policy the database never received as missing", async () => {
+        const drift = await checkPolicyDrift(dbWith([]), [collection("authors")]);
+
+        expect(drift.missing.length).toBeGreaterThan(0);
+        expect(formatPolicyDrift(drift)).toContain("Missing");
+        expect(formatPolicyDrift(drift)).toContain("rebase db push");
+    });
+
+    it("flags a stale policy left by an earlier push as orphaned", async () => {
+        // The demo's actual bug: test_policy TO authenticated outlived the
+        // config that created it, and kept filtering every row.
+        const cols = [collection("customers")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => ({ schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command })),
+            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL" }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.orphaned).toHaveLength(1);
+        expect(drift.orphaned[0]).toMatchObject({ name: "test_policy", roles: ["authenticated"] });
+        expect(formatPolicyDrift(drift)).toContain("Orphaned");
+    });
+
+    it("flags a policy whose roles were changed underneath it as diverged", async () => {
+        const cols = [collection("orders")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => ({
+            schemaname: p.schema, tablename: p.table, policyname: p.name,
+            // Someone re-granted it to a role requests never run as.
+            roles: ["authenticated"], cmd: p.command
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.diverged.length).toBeGreaterThan(0);
+        expect(drift.diverged[0].differences.join(" ")).toContain("roles");
+        expect(formatPolicyDrift(drift)).toContain("Diverged");
+    });
+
+    it("parses roles when the driver returns the raw {a,b} text form", async () => {
+        const cols = [collection("tags")];
+        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL" }];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.orphaned[0].roles).toEqual(["authenticated", "anon"]);
+    });
+
+    it("reports nothing when there are no collections at all", async () => {
+        // With no collections there is no expectation to reconcile against, so
+        // scanning would report every policy in the database as orphaned.
+        // Note a collection with no securityRules is NOT this case — it still
+        // generates default (admin-only) policies.
+        const drift = await checkPolicyDrift(
+            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL" }]),
+            []
+        );
+
+        expect(hasDrift(drift)).toBe(false);
+    });
+
+    it("still expects the default policies a collection without securityRules generates", async () => {
+        const bare = { name: "x", slug: "x", table: "x", schema: "public", properties: {} } as unknown as CollectionConfig;
+
+        const drift = await checkPolicyDrift(dbWith([]), [bare]);
+
+        // Locked-by-default: absence of rules means admin-only policies, not none.
+        expect(drift.missing.length).toBeGreaterThan(0);
+    });
+});

package/src/security/policy-drift.ts

@@ -0,0 +1,159 @@
+/**
+ * Compare the RLS policies a database actually has against the ones the
+ * collections describe.
+ *
+ * Policies live in Postgres; the collection config is only their *source*.
+ * Nothing reconciled the two, which is how the demo database served empty
+ * collections indefinitely: its policies granted `TO authenticated` (a Supabase
+ * role name) while requests run as `rebase_user`, so RLS filtered every row.
+ * The config was later corrected and the database never noticed — an empty
+ * table is indistinguishable from a table with no data.
+ *
+ * Expected policies are parsed from `generatePostgresPoliciesDdl`, the same
+ * function `db push` uses to write `drizzle/policies.sql`, so this compares
+ * against exactly what would be applied rather than a reimplementation.
+ */
+import type { CollectionConfig } from "@rebasepro/types";
+
+import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
+
+export interface PolicyRef {
+    schema: string;
+    table: string;
+    name: string;
+    /** Roles in the TO clause. */
+    roles: string[];
+    /** SELECT / INSERT / UPDATE / DELETE / ALL. */
+    command: string;
+}
+
+export interface PolicyDrift {
+    /** Described by the collections, absent from the database. */
+    missing: PolicyRef[];
+    /** In the database, described by no collection — stale pushes live here. */
+    orphaned: PolicyRef[];
+    /** Same policy name, different roles or command. */
+    diverged: { expected: PolicyRef; actual: PolicyRef; differences: string[] }[];
+}
+
+export interface Queryable {
+    query<R>(text: string, values?: unknown[]): Promise<{ rows: R[] }>;
+}
+
+const CREATE_POLICY = /CREATE POLICY "([^"]+)" ON "([^"]+)"\."([^"]+)"\s+AS (\w+)\s+FOR (\w+)\s+TO ([^\n]+?)(?:\s+USING|\s+WITH CHECK|;)/gi;
+
+/** Parse the generated DDL rather than rebuilding the shape by hand. */
+export function parseExpectedPolicies(ddl: string): PolicyRef[] {
+    const found: PolicyRef[] = [];
+    for (const m of ddl.matchAll(CREATE_POLICY)) {
+        const [, name, schema, table, , command, rolesRaw] = m;
+        const roles = rolesRaw
+            .split(",")
+            .map((r) => r.trim().replace(/^"|"$/g, ""))
+            .filter(Boolean);
+        found.push({ schema, table, name, roles, command: command.toUpperCase() });
+    }
+    return found;
+}
+
+async function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {
+    const { rows } = await client.query<{
+        schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;
+    }>(
+        `SELECT schemaname, tablename, policyname, roles, cmd
+         FROM pg_policies
+         WHERE schemaname = ANY($1)`,
+        [schemas]
+    );
+
+    return rows.map((r) => ({
+        schema: r.schemaname,
+        table: r.tablename,
+        name: r.policyname,
+        // node-postgres yields text[] as an array; some drivers hand back "{a,b}".
+        roles: Array.isArray(r.roles)
+            ? r.roles
+            : String(r.roles ?? "").replace(/^\{|\}$/g, "").split(",").filter(Boolean),
+        command: (r.cmd ?? "ALL").toUpperCase()
+    }));
+}
+
+const keyOf = (p: PolicyRef) => `${p.schema}.${p.table}.${p.name}`;
+const sameRoles = (a: string[], b: string[]) =>
+    a.length === b.length && [...a].sort().join(",") === [...b].sort().join(",");
+
+/**
+ * Diff expected against live.
+ *
+ * Compares names, roles and command only — all exact values. Policy
+ * *expressions* are deliberately not compared: Postgres rewrites `qual`/
+ * `with_check` when storing them (parenthesising, casting, schema-qualifying),
+ * so text comparison reports drift that does not exist, and a check that cries
+ * wolf gets ignored. Roles alone catch the failure this exists for.
+ */
+export async function checkPolicyDrift(
+    client: Queryable,
+    collections: CollectionConfig[]
+): Promise<PolicyDrift> {
+    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
+    const schemas = [...new Set(expected.map((p) => p.schema))];
+    // Nothing expected means nothing to reconcile against; scanning every
+    // schema would report the whole database as orphaned.
+    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [] };
+
+    const live = await readLivePolicies(client, schemas);
+    const liveByKey = new Map(live.map((p) => [keyOf(p), p]));
+    const expectedByKey = new Map(expected.map((p) => [keyOf(p), p]));
+
+    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [] };
+
+    for (const [key, want] of expectedByKey) {
+        const got = liveByKey.get(key);
+        if (!got) {
+            drift.missing.push(want);
+            continue;
+        }
+        const differences: string[] = [];
+        if (!sameRoles(want.roles, got.roles)) {
+            differences.push(`roles: expected [${want.roles.join(", ")}], database has [${got.roles.join(", ")}]`);
+        }
+        if (want.command !== got.command) {
+            differences.push(`command: expected ${want.command}, database has ${got.command}`);
+        }
+        if (differences.length > 0) drift.diverged.push({ expected: want, actual: got, differences });
+    }
+
+    for (const [key, got] of liveByKey) {
+        if (!expectedByKey.has(key)) drift.orphaned.push(got);
+    }
+
+    return drift;
+}
+
+export const hasDrift = (d: PolicyDrift): boolean =>
+    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
+
+/** Human-readable report; empty string when the database matches the config. */
+export function formatPolicyDrift(drift: PolicyDrift): string {
+    if (!hasDrift(drift)) return "";
+    const lines: string[] = [];
+
+    if (drift.missing.length > 0) {
+        lines.push("  Missing — described by your collections, absent from the database:");
+        for (const p of drift.missing) lines.push(`    • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`);
+        lines.push("    Run `rebase db push` to apply them.");
+    }
+    if (drift.orphaned.length > 0) {
+        lines.push("  Orphaned — in the database, described by no collection:");
+        for (const p of drift.orphaned) lines.push(`    • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`);
+        lines.push("    Left behind by an earlier push. These still filter rows.");
+    }
+    if (drift.diverged.length > 0) {
+        lines.push("  Diverged — same policy, different definition:");
+        for (const d of drift.diverged) {
+            lines.push(`    • ${d.expected.schema}.${d.expected.table} → "${d.expected.name}"`);
+            for (const diff of d.differences) lines.push(`        ${diff}`);
+        }
+    }
+    return lines.join("\n");
+}