@rebasepro/server-postgres 0.0.1-canary.fc811d7 → 0.9.1-canary.0de22e0

package/src/connection.ts

@@ -27,11 +27,68 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
-    queryTimeout: 30_000,
+    // The client-side read timeout MUST be comfortably above the server-side
+    // statement_timeout. When the client timer fires first, node-postgres
+    // abandons the in-flight statement but keeps the connection — inside a
+    // transaction that leaves the tx open (and any pending ROLLBACK is
+    // spliced out of the client queue before it ever reaches the wire), so
+    // the pooled connection is returned still in-transaction with its RLS
+    // GUCs set. The server abort (SQLSTATE 57014) is the clean path; the
+    // client timeout is only a backstop for a dead network.
+    queryTimeout: 60_000,
     statementTimeout: 30_000,
     keepAlive: true
 };
 
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+const TX_IDLE = "I";
+
+/**
+ * Destroy pool clients that are released while still inside a transaction.
+ *
+ * pg-pool returns a client to the idle list whenever `release()` is called
+ * without an error — even if the connection is still mid-transaction (status
+ * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+ * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+ * (e.g. it was queued behind a statement that hit the client-side
+ * query_timeout), the client goes back dirty. The next checkout then runs
+ * its statements inside the zombie transaction — with the previous request's
+ * `app.*` RLS GUCs still applied, which turns unrelated queries into
+ * RLS-scoped ones (observed in production as registration failing with
+ * SQLSTATE 42501 under a leaked anonymous context).
+ *
+ * pg-pool emits `release` before it consults its private `_expired` set, so
+ * marking the client expired here makes `_release()` destroy it instead of
+ * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+ * private APIs — feature-detect and fall back to loud logging so an upstream
+ * change degrades to observability, never to silent corruption.
+ */
+export function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void {
+    pool.on("release", (err: Error | undefined, client: unknown) => {
+        if (err) return; // errored clients are already destroyed by pg-pool
+        const txStatus = (client as { _txStatus?: string | null })?._txStatus;
+        if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+
+        // pg-pool keeps expired clients in a WeakSet (a plain object works too
+        // if upstream ever changes it — duck-type on add/has).
+        const expired = (pool as unknown as { _expired?: { add(c: object): unknown; has(c: object): boolean } })._expired;
+        if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+            expired.add(client);
+            logger.error(
+                `[${label}] Client released back to the pool while still in a transaction ` +
+                `(status '${txStatus}') — destroying it so the open transaction and its ` +
+                `session state (RLS GUCs) cannot leak into the next request.`
+            );
+        } else {
+            logger.error(
+                `[${label}] Client released mid-transaction (status '${txStatus}') but the ` +
+                `pool's internal expiry set is unavailable (pg-pool internals changed?). ` +
+                `The connection may leak its open transaction into subsequent requests.`
+            );
+        }
+    });
+}
+
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.
@@ -75,6 +132,7 @@ export function createPostgresDatabaseConnection(
             logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
         }
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-pool");
 
     // Create drizzle instance — pass schema when available to enable db.query relational API
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
@@ -118,6 +176,7 @@ export function createDirectDatabaseConnection(
     pool.on("error", (err) => {
         logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 
@@ -157,6 +216,7 @@ export function createReadReplicaConnection(
     pool.on("error", (err) => {
         logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 

package/src/data-transformer.ts

@@ -20,12 +20,19 @@ import { logger } from "@rebasepro/server";
 export interface SerializedEntityData {
     /** Scalar column values ready for INSERT/UPDATE. */
     scalarData: Record<string, unknown>;
-    /** Inverse relation updates that must be applied to target tables. */
+    /**
+     * Inverse relation updates that must be applied to target tables.
+     *
+     * No address here: the row being written does not know its own. These are
+     * applied by `PersistService`, which addresses them with the id it holds —
+     * the one it was given for an update, or the one the INSERT returned — and
+     * that is the authority. This item used to carry a `currentId` derived from
+     * the *input* values, which nothing ever read.
+     */
     inverseRelationUpdates: Array<{
         relationKey: string;
         relation: Relation;
         newValue: unknown;
-        currentId?: string | number;
     }>;
     /** JoinPath relation updates that require multi-hop writes. */
     joinPathRelationUpdates: Array<{
@@ -105,7 +112,6 @@ joinPathRelationUpdates: [] };
         relationKey: string;
         relation: Relation;
         newValue: unknown;
-        currentId?: string | number;
     }> = [];
     const joinPathRelationUpdates: Array<{
         relationKey: string;
@@ -146,12 +152,10 @@ joinPathRelationUpdates: [] };
                 } else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
                     // Inverse relation: Need to update the target table's FK
                     const serializedValue = serializePropertyToServer(effectiveValue, property);
-                    const pks = getPrimaryKeys(collection, registry!);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
-                        newValue: serializedValue,
-                        currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
+                        newValue: serializedValue
                     });
                     // Don't add the original relation property to the result
                     continue;
@@ -170,12 +174,10 @@ joinPathRelationUpdates: [] };
                         });
                     } else {
                         // Many inverse joinPath: capture as inverse relation update
-                        const pks = getPrimaryKeys(collection, registry!);
                         inverseRelationUpdates.push({
                             relationKey: key,
                             relation,
-                            newValue: serializedValue,
-                            currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
+                            newValue: serializedValue
                         });
                     }
                     // Don't add the original relation property to the result

package/src/databasePoolManager.ts

@@ -2,6 +2,7 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
+import { guardPoolAgainstDirtyRelease } from "./connection";
 
 export class DatabasePoolManager {
     private pools: Map<string, Pool> = new Map();
@@ -50,6 +51,7 @@ export class DatabasePoolManager {
         pool.on("error", (err) => {
             logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
         });
+        guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 
         this.pools.set(databaseName, pool);
         return pool;

package/src/module-dir.ts

@@ -0,0 +1,7 @@
+import path from "path";
+import { fileURLToPath } from "url";
+
+// Isolated in its own module so the jest CommonJS transform can swap it for a
+// __dirname shim via moduleNameMapper — `import.meta` is a syntax error once
+// ts-jest transpiles to CJS.
+export const moduleDir = path.dirname(fileURLToPath(import.meta.url));

package/src/schema/doctor-cli.ts

@@ -8,7 +8,7 @@ import chalk from "chalk";
 import fs from "fs";
 import { runDoctor, loadCollections } from "./doctor";
 import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
-import { validatePolicyPgRoles } from "../security/rls-enforcement";
+import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -41,6 +41,10 @@ async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): P
             logger.error(chalk.red(err instanceof Error ? err.message : String(err)));
         }
 
+        // A rule that reads as a lockdown but is true for every caller compiles
+        // to a grant. Report it without booting a server.
+        warnOnAnonymousGrants(collections as never);
+
         const drift = await checkPolicyDrift(pool as never, collections);
         logger.info("");
         if (hasDrift(drift)) {

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,19 +61,29 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "text") return "text";
+            if (sp.columnType === "uuid") return "uuid";
+            // A markdown/multiline string compiles to `text`, not varchar — the
+            // generator treats those UI hints as column-type signals, so the
+            // expectation here must too or every such column reads as drift.
+            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType === "double precision") return "double precision";
-            if (np.columnType === "real") return "real";
-            if (np.columnType === "bigint") return "bigint";
-            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
-            if (np.columnType === "bigserial") return "bigint";
-            if (np.columnType === "integer") return "integer";
-            if (np.columnType === "numeric") return "numeric";
+            if (np.columnType) {
+                // The generator passes any columnType straight through to drizzle,
+                // so mirror that rather than enumerating a subset (which reported
+                // drift for anything unlisted, e.g. smallint). Serial types are
+                // integers with a sequence default; information_schema reports the
+                // underlying width.
+                const serialWidths: Record<string, string> = {
+                    serial: "integer",
+                    bigserial: "bigint",
+                    smallserial: "smallint"
+                };
+                return serialWidths[np.columnType] ?? np.columnType;
+            }
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -201,15 +211,18 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // Check if SDK file exists
+    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
+    // you choose to. A project that never generated one isn't drifting, so report
+    // it as information rather than a warning; otherwise `doctor` can never come
+    // back clean on a fresh project and users learn to ignore its output.
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "warning",
-            category: "sdk_stale",
-            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
-            fix: "Run `rebase generate-sdk`"
+            severity: "info",
+            category: "sdk_not_generated",
+            message: "Typed SDK not generated (optional).",
+            fix: "Run `rebase generate-sdk` if you want typed collection access"
         });
-        return { passed: false,
+        return { passed: true,
 issues };
     }
 
@@ -631,11 +644,15 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    if (passed) {
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const infoIssues = issues.filter((i) => i.severity === "info");
+
+    // Informational notes don't make a phase unhealthy, so key the header off
+    // real problems rather than `passed` alone.
+    if (errorCount === 0 && warnCount === 0) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
-        const errorCount = issues.filter((i) => i.severity === "error").length;
-        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -643,7 +660,14 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    for (const issue of issues) {
+    // Notes render as a quiet one-liner, not a full drift box.
+    for (const issue of infoIssues) {
+        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
+        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
+        logger.info("");
+    }
+
+    for (const issue of issues.filter((i) => i.severity !== "info")) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -674,7 +698,8 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types"
+        sdk_stale: "Stale SDK Types",
+        sdk_not_generated: "SDK Types Not Generated"
     };
     return labels[cat];
 }

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,10 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -315,22 +313,6 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -351,15 +333,11 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -567,6 +545,10 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -623,9 +605,22 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ({\n";
-            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-            schemaContent += "}));\n\n";
+            schemaContent += "}, (table) => ([\n";
+            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+
+            // Junctions are generated tables like any other: locked by default,
+            // with derived policies (reads follow the endpoints, writes follow
+            // the declaring side's update rules). RLS is enabled regardless of
+            // policy stripping — a bare junction must default-deny, not fail open.
+            const junctionSpec = junctionSpecs.get(baseTableName);
+            if (!stripPolicies && junctionSpec) {
+                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
+                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+                });
+            }
+            schemaContent += "])).enableRLS();\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,8 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
 
@@ -44,22 +42,6 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -69,14 +51,10 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -248,6 +226,10 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -283,6 +265,11 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
+    // Policies are emitted after every CREATE TABLE, like the FK constraints:
+    // a policy may reference other tables (a junction's derived policies always
+    // reference both endpoints; `policy.existsIn` references a join table), and
+    // CREATE POLICY validates those relations at creation time.
+    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -315,6 +302,25 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+
+            if (options.includePolicies) {
+                // Junction tables are generated tables like any other: locked by
+                // default, with derived policies — reads follow the endpoints'
+                // visibility, writes follow the declaring side's update rules.
+                // Without this they were the one kind of generated table with no
+                // RLS at all, readable and writable by every signed-in user.
+                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+                ddl += `\n`;
+
+                const spec = junctionSpecs.get(baseTableName);
+                if (spec) {
+                    const junctionCollection = getJunctionCollectionConfig(spec);
+                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
+                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+                    });
+                }
+            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -436,9 +442,8 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
+                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
                     });
-                    ddl += "\n";
                 }
             }
         }
@@ -449,6 +454,12 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
+    if (policyStatements.length > 0) {
+        ddl += "-- Row Level Security Policies\n";
+        ddl += policyStatements.join("");
+        ddl += "\n";
+    }
+
     return ddl;
 };
 
@@ -478,13 +489,50 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+
             securityRules.forEach((rule: SecurityRule) => {
+                // Say which policies the author did not write. They are permissive,
+                // so they OR with the declared rules and widen the final ACL beyond
+                // what `securityRules` reads like — and re-appear after any manual
+                // DROP, because a push asserts the declared state.
+                if (rule.name && injectedNames.has(rule.name)) {
+                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
+                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
+                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";
         }
     }
 
+    // Junction tables are generated from `through` relations, not declared as
+    // collections, so the walk above never sees them. They get the same
+    // treatment as any generated table: locked by default, with derived
+    // policies — reads follow the endpoints, writes follow the declaring
+    // side's update rules.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+    for (const spec of junctionSpecs.values()) {
+        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+        ddl += `\n`;
+
+        const junctionRules = getJunctionSecurityRules(spec);
+        if (junctionRules.length === 0) continue;
+
+        const junctionCollection = getJunctionCollectionConfig(spec);
+        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
+
+        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+        junctionRules.forEach((rule: SecurityRule) => {
+            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+        });
+        ddl += "\n";
+    }
+
     return ddl;
 };
 

package/src/schema/introspect-db-inference.ts

@@ -1,4 +1,4 @@
-import { humanize } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface InferenceResult {
     propType?: string; // If the inference changes the base type

package/src/schema/introspect-db-logic.ts

@@ -7,6 +7,7 @@
  * and consumed directly by tests.
  */
 import { inferPropertyFromData } from "./introspect-db-inference";
+import { humanize } from "./introspect-db-naming";
 
 // ── Typed interfaces for SQL query results ────────────────────────────
 
@@ -117,16 +118,6 @@ export function singularize(word: string): string {
     return word;
 }
 
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export function humanize(snakeName: string): string {
-    return snakeName
-        .replace(/_/g, " ")
-        .replace(/\b\w/g, (c) => c.toUpperCase());
-}
-
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/src/schema/introspect-db-naming.ts

@@ -0,0 +1,15 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export function humanize(snakeName: string): string {
+    return snakeName
+        .replace(/_/g, " ")
+        .replace(/\b\w/g, (c) => c.toUpperCase());
+}