@rebasepro/server-postgres 0.0.1-canary.fc811d7 → 0.9.1-canary.0de22e0

package/src/schema/introspect-db.ts

@@ -30,6 +30,7 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
+            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -166,8 +167,14 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--data-inference"] !== undefined) {
+        if (args["--no-data-inference"]) {
+            runDataInference = false;
+        } else if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
+        } else if (!process.stdin.isTTY) {
+            // No terminal to answer the question below (scaffolding scripts, CI,
+            // `rebase init --introspect`) — asking would hang forever.
+            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -236,7 +243,17 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                const indexContent = generateIndexContent(generatedFiles);
+                // --force replaces collections derived from the database, but the
+                // directory can also hold hand-written ones with no table in the
+                // introspected schema (the auth users collection lives in
+                // "rebase"). The backend discovers the whole directory, so an
+                // index listing only introspected tables would silently drop them
+                // from the admin UI while the API still served them.
+                const siblings = fs.readdirSync(outDir)
+                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
+                    .map(f => f.replace(/\.ts$/, ""));
+                const allFiles = [...new Set([...generatedFiles, ...siblings])];
+                const indexContent = generateIndexContent(allFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));

package/src/schema/introspect-runtime.ts

@@ -23,11 +23,11 @@ import {
     buildTablesMap,
     buildEnumMap,
     identifyJoinTables,
-    humanize,
     singularize,
     mapPgType,
     getIconForTable
 } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface IntrospectedSchema {
     tablesMap: Map<string, TableMeta>;

package/src/security/anonymous-grants.test.ts

@@ -0,0 +1,71 @@
+import { describe, expect, it, jest, afterEach } from "@jest/globals";
+import { logger } from "@rebasepro/server";
+
+import { warnOnAnonymousGrants } from "./rls-enforcement";
+
+/** Capture what the operator would actually see at boot. */
+function captureWarning(fn: () => void): string | null {
+    const spy = jest.spyOn(logger, "warn").mockImplementation(() => undefined as never);
+    try {
+        fn();
+        return spy.mock.calls.length > 0 ? String(spy.mock.calls[0][0]) : null;
+    } finally {
+        spy.mockRestore();
+    }
+}
+
+const collectionWith = (slug: string, using: string) => ({
+    slug,
+    securityRules: [{ name: "authenticated_access", operation: "all", using, withCheck: using }]
+});
+
+afterEach(() => jest.restoreAllMocks());
+
+describe("warnOnAnonymousGrants", () => {
+    // The rule found in a real app, across 8 collections of PII. It reads as
+    // "any logged-in user" and grants every anonymous visitor read and write.
+    const FROM_THE_WILD = "auth.uid() IS NOT NULL AND auth.uid() != 'anon'";
+
+    it("reports both mistakes in the rule from the wild", () => {
+        const warning = captureWarning(() => warnOnAnonymousGrants([collectionWith("talents", FROM_THE_WILD)]));
+
+        expect(warning).toContain("auth.uid() IS NOT NULL");
+        expect(warning).toContain("'anon' is a Supabase convention");
+        expect(warning).toContain("policy.authenticated()");
+    });
+
+    it("groups by mistake and names every collection it appears on", () => {
+        const warning = captureWarning(() => warnOnAnonymousGrants(
+            ["talents", "companies", "contact_messages"].map(s => collectionWith(s, FROM_THE_WILD))
+        ));
+
+        expect(warning).toContain("talents");
+        expect(warning).toContain("companies");
+        expect(warning).toContain("contact_messages");
+        // Grouped, not repeated once per collection: the same habit across 8
+        // collections should not print the same paragraph 16 times.
+        expect(warning!.match(/Supabase convention/g)).toHaveLength(1);
+        expect(warning).toContain("3 rule(s)");
+    });
+
+    it("catches the bare tautology, which carries no literal to notice", () => {
+        const warning = captureWarning(() => warnOnAnonymousGrants([collectionWith("talents", "auth.uid() IS NOT NULL")]));
+
+        expect(warning).toContain("auth.uid() IS NOT NULL");
+        expect(warning).not.toContain("Supabase convention");
+    });
+
+    it("says nothing about rules that are actually correct", () => {
+        const warning = captureWarning(() => warnOnAnonymousGrants([
+            { slug: "talents", securityRules: [{ name: "own_rows", operation: "all", ownerField: "owner_id" }] },
+            collectionWith("posts", `auth.uid() != 'anonymous'`),
+            { slug: "public_page", securityRules: [{ name: "read", operation: "select", access: "public" }] }
+        ] as never));
+
+        expect(warning).toBeNull();
+    });
+
+    it("says nothing when no collection has rules at all", () => {
+        expect(captureWarning(() => warnOnAnonymousGrants([{ slug: "empty" }]))).toBeNull();
+    });
+});

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -23,6 +23,17 @@ function dbWith(rows: Record<string, unknown>[]): Queryable {
     return { query: async () => ({ rows: rows as never[] }) };
 }
 
+/** A pg_policies row matching an expected policy, clauses and all. */
+function liveRow(p: PolicyRef, overrides: Record<string, unknown> = {}) {
+    return {
+        schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command,
+        // Postgres rewrites the text it stores; only presence is compared.
+        qual: p.hasUsing ? "(rewritten by postgres)" : null,
+        with_check: p.hasWithCheck ? "(rewritten by postgres)" : null,
+        ...overrides
+    };
+}
+
 describe("parseExpectedPolicies", () => {
     it("reads the DDL that db push actually applies", () => {
         const ddl = generatePostgresPoliciesDdl([collection("authors")]);
@@ -38,11 +49,8 @@ describe("checkPolicyDrift", () => {
     it("reports nothing when the database matches the collections", async () => {
         const cols = [collection("authors")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => ({
-            schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command
-        }));
 
-        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const drift = await checkPolicyDrift(dbWith(expected.map((p) => liveRow(p))), cols);
 
         expect(hasDrift(drift)).toBe(false);
         expect(formatPolicyDrift(drift)).toBe("");
@@ -62,8 +70,8 @@ describe("checkPolicyDrift", () => {
         const cols = [collection("customers")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
         const live = [
-            ...expected.map((p) => ({ schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command })),
-            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL" }
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL", qual: "true", with_check: null }
         ];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
@@ -76,11 +84,8 @@ describe("checkPolicyDrift", () => {
     it("flags a policy whose roles were changed underneath it as diverged", async () => {
         const cols = [collection("orders")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => ({
-            schemaname: p.schema, tablename: p.table, policyname: p.name,
-            // Someone re-granted it to a role requests never run as.
-            roles: ["authenticated"], cmd: p.command
-        }));
+        // Someone re-granted it to a role requests never run as.
+        const live = expected.map((p) => liveRow(p, { roles: ["authenticated"] }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -89,9 +94,38 @@ describe("checkPolicyDrift", () => {
         expect(formatPolicyDrift(drift)).toContain("Diverged");
     });
 
+    it("flags a policy whose expression the database is missing entirely", async () => {
+        // A real production database had jobs.public_read_published stored as
+        // SELECT / {public} / USING NULL: every field this used to compare
+        // matched, drift reported zero, and the policy denied 100% of reads.
+        const cols = [collection("jobs")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const select = expected.find((p) => p.command === "SELECT" && p.roles.includes("public"))!;
+        const live = expected.map((p) => (p === select ? liveRow(p, { qual: null }) : liveRow(p)));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.diverged).toHaveLength(1);
+        expect(drift.diverged[0].differences.join(" ")).toContain("USING: expected an expression, database has none");
+    });
+
+    it("does not mistake an expression Postgres rewrote for a missing one", async () => {
+        // The reason expression text is not compared: what comes back out of
+        // pg_policies never matches what went in.
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p, {
+            qual: p.hasUsing ? "((auth.uid() IS NOT NULL) AND ((auth.uid())::text <> 'anonymous'::text))" : null
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(hasDrift(drift)).toBe(false);
+    });
+
     it("parses roles when the driver returns the raw {a,b} text form", async () => {
         const cols = [collection("tags")];
-        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL" }];
+        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL", qual: "true", with_check: null }];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -104,7 +138,7 @@ describe("checkPolicyDrift", () => {
         // Note a collection with no securityRules is NOT this case — it still
         // generates default (admin-only) policies.
         const drift = await checkPolicyDrift(
-            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL" }]),
+            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }]),
             []
         );
 
@@ -120,3 +154,108 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
+
+describe("isGeneratedPolicyName", () => {
+    it("recognises the generator's own shape", () => {
+        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
+        // One rule spanning several operations appends the operation index.
+        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
+    });
+
+    it("does not claim names a human could have written", () => {
+        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
+        // Right shape, wrong table — belongs to something else.
+        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
+        // A digest is 7 lowercase hex characters, nothing else.
+        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
+    });
+});
+
+describe("dropOrphanedPolicies", () => {
+    /** Records the DDL issued so the test can assert on what was dropped. */
+    function recordingDb(rows: Record<string, unknown>[]) {
+        const executed: string[] = [];
+        const db: Queryable = {
+            query: async (text: string) => {
+                if (!/^SELECT/i.test(text)) executed.push(text);
+                return { rows: rows as never[] };
+            }
+        };
+        return { db, executed };
+    }
+
+    it("drops the policy a rule edit superseded", async () => {
+        // The reported failure: tightening a rule renames its policy, and the
+        // permissive original stays live and keeps ORing itself back in.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const stale = {
+            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
+            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
+        };
+        const live = [...expected.map((p) => liveRow(p)), stale];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(1);
+        expect(dropped[0].name).toBe("documents_insert_dead1ee");
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([
+            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
+        ]);
+    });
+
+    it("leaves a hand-written policy alone and reports it instead", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("never touches a table the collections do not describe", async () => {
+        // Another application sharing the schema owns this table; a
+        // generator-shaped name there is coincidence, not our leftover.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("does nothing when the database already matches", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([]);
+    });
+});

package/src/security/policy-drift.ts

@@ -25,6 +25,10 @@ export interface PolicyRef {
     roles: string[];
     /** SELECT / INSERT / UPDATE / DELETE / ALL. */
     command: string;
+    /** Whether a USING clause is present at all (not what it says). */
+    hasUsing: boolean;
+    /** Whether a WITH CHECK clause is present at all (not what it says). */
+    hasWithCheck: boolean;
 }
 
 export interface PolicyDrift {
@@ -40,18 +44,57 @@ export interface Queryable {
     query<R>(text: string, values?: unknown[]): Promise<{ rows: R[] }>;
 }
 
-const CREATE_POLICY = /CREATE POLICY "([^"]+)" ON "([^"]+)"\."([^"]+)"\s+AS (\w+)\s+FOR (\w+)\s+TO ([^\n]+?)(?:\s+USING|\s+WITH CHECK|;)/gi;
+// The trailing group captures whichever clause follows the TO list, which is
+// what tells us the clause is present.
+const CREATE_POLICY = /CREATE POLICY "([^"]+)" ON "([^"]+)"\."([^"]+)"\s+AS (\w+)\s+FOR (\w+)\s+TO ([^\n]+?)(\s+USING\s*\(|\s+WITH CHECK\s*\(|;)/gi;
+
+const WITH_CHECK_NEXT = /^\s+WITH CHECK\s*\(/i;
+
+/**
+ * Index just past the `)` closing a clause whose `(` ends at `open`.
+ *
+ * Needed because a policy expression nests parens and can contain a quoted
+ * literal holding either character, so "find the next `)`" would stop early and
+ * miss the `WITH CHECK` that follows.
+ */
+function clauseEnd(ddl: string, open: number): number {
+    let depth = 1;
+    let inQuote = false;
+    for (let i = open; i < ddl.length; i++) {
+        const c = ddl[i];
+        if (inQuote) {
+            // '' is an escaped quote inside a string, not a close.
+            if (c === "'") {
+                if (ddl[i + 1] === "'") i++;
+                else inQuote = false;
+            }
+            continue;
+        }
+        if (c === "'") inQuote = true;
+        else if (c === "(") depth++;
+        else if (c === ")" && --depth === 0) return i + 1;
+    }
+    return ddl.length;
+}
 
 /** Parse the generated DDL rather than rebuilding the shape by hand. */
 export function parseExpectedPolicies(ddl: string): PolicyRef[] {
     const found: PolicyRef[] = [];
     for (const m of ddl.matchAll(CREATE_POLICY)) {
-        const [, name, schema, table, , command, rolesRaw] = m;
+        const [, name, schema, table, , command, rolesRaw, clause] = m;
         const roles = rolesRaw
             .split(",")
             .map((r) => r.trim().replace(/^"|"$/g, ""))
             .filter(Boolean);
-        found.push({ schema, table, name, roles, command: command.toUpperCase() });
+
+        // The generator emits USING before WITH CHECK, so what follows the TO
+        // list settles USING; WITH CHECK is then whatever follows that clause.
+        const hasUsing = /USING/i.test(clause);
+        const hasWithCheck = hasUsing
+            ? WITH_CHECK_NEXT.test(ddl.slice(clauseEnd(ddl, m.index + m[0].length)))
+            : /WITH CHECK/i.test(clause);
+
+        found.push({ schema, table, name, roles, command: command.toUpperCase(), hasUsing, hasWithCheck });
     }
     return found;
 }
@@ -59,8 +102,9 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
 async function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {
     const { rows } = await client.query<{
         schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;
+        qual: string | null; with_check: string | null;
     }>(
-        `SELECT schemaname, tablename, policyname, roles, cmd
+        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check
          FROM pg_policies
          WHERE schemaname = ANY($1)`,
         [schemas]
@@ -74,7 +118,11 @@ async function readLivePolicies(client: Queryable, schemas: string[]): Promise<P
         roles: Array.isArray(r.roles)
             ? r.roles
             : String(r.roles ?? "").replace(/^\{|\}$/g, "").split(",").filter(Boolean),
-        command: (r.cmd ?? "ALL").toUpperCase()
+        command: (r.cmd ?? "ALL").toUpperCase(),
+        // Presence only. Postgres rewrites the text, but it does not invent or
+        // drop a clause: NULL here means the policy genuinely has none.
+        hasUsing: r.qual != null,
+        hasWithCheck: r.with_check != null
     }));
 }
 
@@ -85,11 +133,18 @@ const sameRoles = (a: string[], b: string[]) =>
 /**
  * Diff expected against live.
  *
- * Compares names, roles and command only — all exact values. Policy
- * *expressions* are deliberately not compared: Postgres rewrites `qual`/
- * `with_check` when storing them (parenthesising, casting, schema-qualifying),
- * so text comparison reports drift that does not exist, and a check that cries
- * wolf gets ignored. Roles alone catch the failure this exists for.
+ * Compares names, roles, command, and whether each clause exists — all exact
+ * values. Policy expression *text* is deliberately not compared: Postgres
+ * rewrites `qual`/`with_check` when storing them (parenthesising, casting,
+ * schema-qualifying), so text comparison reports drift that does not exist, and
+ * a check that cries wolf gets ignored.
+ *
+ * Presence is not text, though. A NULL `qual` is not a rewrite of an
+ * expression, it is the absence of one, and absence has no false-positive risk:
+ * either the generator emitted a clause or it did not. That distinction is worth
+ * the extra comparison — a production database was found with a SELECT policy
+ * whose `qual` was NULL, matching on every field this checked and denying 100%
+ * of reads. The same blindness would hide a policy that fails open.
  */
 export async function checkPolicyDrift(
     client: Queryable,
@@ -120,6 +175,13 @@ export async function checkPolicyDrift(
         if (want.command !== got.command) {
             differences.push(`command: expected ${want.command}, database has ${got.command}`);
         }
+        for (const clause of ["USING", "WITH CHECK"] as const) {
+            const key = clause === "USING" ? "hasUsing" : "hasWithCheck";
+            if (want[key] === got[key]) continue;
+            differences.push(want[key]
+                ? `${clause}: expected an expression, database has none — this policy matches no rows`
+                : `${clause}: expected none, database has an expression`);
+        }
         if (differences.length > 0) drift.diverged.push({ expected: want, actual: got, differences });
     }
 
@@ -130,6 +192,62 @@ export async function checkPolicyDrift(
     return drift;
 }
 
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export function isGeneratedPolicyName(name: string, table: string): boolean {
+    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
+        .test(name);
+}
+
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export async function dropOrphanedPolicies(
+    client: Queryable,
+    drift: PolicyDrift,
+    collections: CollectionConfig[]
+): Promise<OrphanCleanup> {
+    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
+    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
+
+    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
+    for (const p of drift.orphaned) {
+        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
+            cleanup.kept.push(p);
+            continue;
+        }
+        // Identifiers are quoted, and the name came from pg_policies rather than
+        // from user input, so it is already a valid identifier.
+        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
+        cleanup.dropped.push(p);
+    }
+    return cleanup;
+}
+
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 

package/src/security/rls-enforcement.ts

@@ -1,4 +1,6 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
+import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
+import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -57,7 +59,7 @@ export interface ConnectionPosture {
 }
 
 export interface AuthContext {
-    userId: string;
+    uid: string;
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }
@@ -200,19 +202,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
  * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
- * Coerce empty/blank ids to a sentinel here, at the single chokepoint, rather
- * than trusting every caller (e.g. realtime subscription auth) to do it.
+ * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
+ * rather than trusting every caller (e.g. realtime subscription auth) to do it.
+ * That sentinel is exported from `@rebasepro/types` because it leaks into rule
+ * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
  */
 export async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {
-    const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : "anonymous";
+    const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
     const normalizedRoles = auth.roles.map((r: unknown) =>
         typeof r === "string" ? r : (r as Record<string, unknown>)?.id ?? String(r)
     );
     await tx.execute(drizzleSql`
         SELECT
-            set_config('app.user_id', ${userId}, true),
+            set_config('app.user_id', ${uid}, true),
             set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
-            set_config('app.jwt', ${JSON.stringify({ sub: userId, roles: auth.roles })}, true)
+            set_config('app.jwt', ${JSON.stringify({ sub: uid, roles: auth.roles })}, true)
     `);
     if (userRole) {
         await tx.execute(drizzleSql.raw(`SET LOCAL ROLE ${quoteIdent(userRole)}`));
@@ -226,6 +230,63 @@ const FOREIGN_CONVENTION_ROLES: Record<string, string> = {
     service_role: "Supabase"
 };
 
+/**
+ * Warn about rules that read as "signed-in users only" but admit anonymous
+ * callers — `auth.uid() IS NOT NULL`, or a comparison against another
+ * platform's magic user id such as `'anon'`.
+ *
+ * The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
+ * of the same habit. A foreign `pgRoles` value makes a policy unreachable and
+ * the table reads empty — loud, and that guard throws. These do the opposite:
+ * the rule compiles to a grant, and nothing looks wrong until the data is
+ * already public.
+ *
+ * Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
+ * serving traffic today: refusing to boot would take an app offline to report a
+ * problem it already has, and on the read path it would take it offline
+ * *because* its data was exposed. Rewriting the author's SQL is not an option
+ * either — this is the escape hatch whose whole promise is that it means what it
+ * says. So: say so, loudly, and leave the rule alone.
+ */
+export function warnOnAnonymousGrants(
+    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
+): void {
+    // Grouped by the mistake, not by the rule: one habit typically repeats
+    // across every collection an author wrote, and a per-rule list would repeat
+    // the same paragraph dozens of times and get skimmed.
+    const byRisk = new Map<string, { risk: AnonymousGrantRisk; sites: string[] }>();
+
+    for (const collection of collections) {
+        for (const rule of collection.securityRules ?? []) {
+            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+            const risks = [usingExpr, withCheckExpr]
+                .filter((e): e is PolicyExpression => e !== null)
+                .flatMap(findAnonymousGrants);
+
+            for (const risk of risks) {
+                const key = `${risk.pattern}:${risk.detail}`;
+                const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+                const entry = byRisk.get(key) ?? { risk, sites: [] };
+                if (!entry.sites.includes(site)) entry.sites.push(site);
+                byRisk.set(key, entry);
+            }
+        }
+    }
+
+    if (byRisk.size === 0) return;
+
+    const problems = [...byRisk.values()].map(({ risk, sites }) =>
+        `  • ${risk.explanation}\n    ${sites.length} rule(s): ${sites.join(", ")}`
+    );
+
+    logger.warn(
+        `Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a ` +
+        `client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are ` +
+        `true for everyone:\n\n` +
+        problems.join("\n\n") + "\n"
+    );
+}
+
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *