@rebasepro/server-postgres 0.0.1-canary.fc811d7 → 0.9.1-canary.0de22e0

package/src/websocket.ts

@@ -27,7 +27,7 @@ interface WsAuthConfig {
  * Normalized user identity for WebSocket sessions.
  */
 interface WsUserIdentity {
-    userId: string;
+    uid: string;
     roles: string[];
     isAdmin: boolean;
 }
@@ -183,7 +183,7 @@ code } }
 
                             if (adapterUser) {
                                 verifiedUser = {
-                                    userId: adapterUser.uid,
+                                    uid: adapterUser.uid,
                                     roles: adapterUser.roles,
                                     isAdmin: adapterUser.isAdmin
                                 };
@@ -195,13 +195,13 @@ code } }
                         // Service key: a static secret, not a JWT. Checked
                         // before verification, mirroring the HTTP middleware —
                         // verifying it as a JWT can only ever fail.
-                        verifiedUser = { userId: "service", roles: ["admin"], isAdmin: true };
+                        verifiedUser = { uid: "service", roles: ["admin"], isAdmin: true };
                     } else {
                         // Standard JWT path
                         const jwtPayload = extractUserFromToken(token);
                         if (jwtPayload) {
                             verifiedUser = {
-                                userId: jwtPayload.userId,
+                                uid: jwtPayload.uid,
                                 roles: jwtPayload.roles ?? [],
                                 isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin")
                             };
@@ -218,10 +218,10 @@ code } }
                         ws.send(JSON.stringify({
                             type: "AUTH_SUCCESS",
                             requestId,
-                            payload: { userId: verifiedUser.userId,
+                            payload: { uid: verifiedUser.uid,
 roles: verifiedUser.roles }
                         }));
-                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
+                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
                     } else {
                         wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -272,7 +272,7 @@ roles: verifiedUser.roles }
                         try {
                             const userForAuth: User = session?.user
                                 ? {
-                                    uid: session.user.userId,
+                                    uid: session.user.uid,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -421,7 +421,7 @@ colors: true }));
                                 sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
                                 options,
                                 resultRows: Array.isArray(result) ? result.length : "unknown",
-                                userId: auditSession?.user?.userId ?? "unknown",
+                                uid: auditSession?.user?.uid ?? "unknown",
                                 roles: auditSession?.user?.roles ?? [],
                                 isAdmin: auditSession?.user?.isAdmin ?? false,
                             }));
@@ -476,6 +476,24 @@ colors: true }));
                     }
                         break;
 
+                    case "FETCH_APPLICATION_ROLES": {
+                        wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+                        const delegate = await getScopedDelegate();
+                        const admin = delegate.admin;
+                        let roles: string[] = [];
+                        if (isSQLAdmin(admin) && admin.fetchApplicationRoles) {
+                            roles = await admin.fetchApplicationRoles();
+                        }
+                        wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+                        const response = {
+                            type: "FETCH_APPLICATION_ROLES_SUCCESS",
+                            payload: { roles },
+                            requestId
+                        };
+                        ws.send(JSON.stringify(response));
+                    }
+                        break;
+
                     case "FETCH_CURRENT_DATABASE": {
                         wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
                         const delegate = await getScopedDelegate();
@@ -594,14 +612,15 @@ colors: true }));
                     case "broadcast":
                     case "presence_track":
                     case "presence_untrack":
-                    case "presence_state": {
+                    case "presence_state":
+                    case "channel_history": {
                         wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
                         // Attach auth context from the WS session so RLS-aware refetches work
                         const session = clientSessions.get(clientId);
                         const authContext = session?.user
-                            ? { userId: session.user.userId,
+                            ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { userId: "anon",
+                            : { uid: "anon",
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {
@@ -620,9 +639,12 @@ roles: ["anon"] };
                 if (error instanceof Error) {
                     logger.error("Stack trace", { detail: error.stack });
                 }
+                // Unwrap the cause chain: a Drizzle failure reports itself as
+                // "Failed query: <sql> params:", which tells the user nothing and
+                // echoes the statement back at them. The reason is in the cause.
                 const errorMessage = process.env.NODE_ENV === "production"
                     ? "An unexpected error occurred"
-                    : (error instanceof Error ? error.message : "An unexpected error occurred");
+                    : extractErrorMessage(error);
                 const errorResponse = {
                     type: "ERROR",
                     requestId,

package/dist/chunk-DSJWtz9O.js

@@ -1,40 +0,0 @@
-import { createRequire as __createRequire } from "module";
-import "process";
-const require = __createRequire(import.meta.url);
-//#region \0rolldown/runtime.js
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __commonJSMin = (cb, mod) => () => (mod || (cb((mod = { exports: {} }).exports, mod), cb = null), mod.exports);
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, { get: (a, b) => (typeof require !== "undefined" ? require : a)[b] }) : x)(function(x) {
-	if (typeof require !== "undefined") return require.apply(this, arguments);
-	throw Error("Calling `require` for \"" + x + "\" in an environment that doesn't expose the `require` function. See https://rolldown.rs/in-depth/bundling-cjs#require-external-modules for more details.");
-});
-//#endregion
-export { __toESM as i, __exportAll as n, __require as r, __commonJSMin as t };

package/dist/schema/auth-default-policies.d.ts

@@ -1,10 +0,0 @@
-import { CollectionConfig, SecurityRule } from "@rebasepro/types";
-/**
- * Returns the security rules that should be applied to a collection: the
- * author's explicit `securityRules` plus the framework defaults described in
- * the module doc (baseline server/admin read for all collections; self-read
- * and the admin write gate for auth collections).
- *
- * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
- */
-export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];