@rebasepro/server-postgres 0.10.0 → 0.10.1-canary.14e53ae

package/src/cli-helpers.ts

@@ -143,36 +143,91 @@ export async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUr
     }
 }
 
-export async function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]> {
-    const includes = await getTableIncludes(collectionsPath);
-    const excludes: string[] = ["atlas_schema_revisions.*", "auth.*"];
-    
+/**
+ * Query the live database for every user table/view outside the system
+ * catalogs. Separated from {@link getTableExcludes} so its failure mode can
+ * be handled explicitly (fail closed) and so tests can inject a stub.
+ */
+export async function queryExistingTables(databaseUrl: string): Promise<string[]> {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
     try {
-        const { Client } = await import("pg");
-        const client = new Client({ connectionString: databaseUrl });
-        await client.connect();
-        try {
-            const res = await client.query(`
-                SELECT table_schema || '.' || table_name AS full_name
-                FROM information_schema.tables
-                WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-                  AND table_type IN ('BASE TABLE', 'VIEW');
-            `);
-            
-            const existingTables = res.rows.map((row: { full_name: string }) => row.full_name);
-            
-            for (const table of existingTables) {
-                if (!includes.includes(table)) {
-                    excludes.push(table);
-                }
-            }
-        } finally {
-            await client.end();
-        }
+        const res = await client.query(`
+            SELECT table_schema || '.' || table_name AS full_name
+            FROM information_schema.tables
+            WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+              AND table_type IN ('BASE TABLE', 'VIEW');
+        `);
+        return res.rows.map((row: { full_name: string }) => row.full_name);
+    } finally {
+        await client.end();
+    }
+}
+
+/**
+ * Raised when the exclude list could not be built. `db push` MUST abort on
+ * this rather than continue: the exclude list is the only thing shielding
+ * non-collection (user/system) tables from the auto-approved declarative
+ * apply. A partial list — the old fail-open behaviour — meant a transient
+ * introspection hiccup dropped every table not present in `schema.sql`.
+ */
+export class ExcludeIntrospectionError extends Error {
+    constructor(message: string, readonly cause?: unknown) {
+        super(message);
+        this.name = "ExcludeIntrospectionError";
+    }
+}
+
+/**
+ * Build the `--exclude` list that protects tables Rebase doesn't manage from
+ * the declarative apply. Anything not backing a collection (or its M2M
+ * junctions) is excluded so Atlas never drops it.
+ *
+ * Fails **closed**: if the database can't be introspected we cannot know
+ * which tables to protect, so we throw {@link ExcludeIntrospectionError}
+ * instead of returning a near-empty list and letting the caller drop
+ * everything.
+ *
+ * `deps` is injectable for tests; production uses the real pg-backed queries.
+ */
+export async function getTableExcludes(
+    databaseUrl: string,
+    collectionsPath: string,
+    deps: {
+        queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+        getIncludes?: (collectionsPath: string) => Promise<string[]>;
+    } = {}
+): Promise<string[]> {
+    const getIncludes = deps.getIncludes ?? getTableIncludes;
+    const queryTables = deps.queryExistingTables ?? queryExistingTables;
+
+    const includes = await getIncludes(collectionsPath);
+    // Framework-owned schemas Rebase manages itself — the declarative apply
+    // must never touch them. `auth` holds the helper functions; `rebase` holds
+    // the auth tables (users, refresh_tokens, …) and Atlas's own revision
+    // table. Excluding both the schema object AND its contents keeps Atlas
+    // from planning a `DROP SCHEMA … CASCADE` — which on a live database would
+    // take the user/auth tables with it. `atlas_schema_revisions.*` is kept
+    // for backwards-compatibility with any external revision schema.
+    const excludes: string[] = ["atlas_schema_revisions.*", "auth", "auth.*", "rebase", "rebase.*"];
+
+    let existingTables: string[];
+    try {
+        existingTables = await queryTables(databaseUrl);
     } catch (err) {
-        logger.warn(chalk.yellow(`  ⚠️  Failed to query database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`));
+        throw new ExcludeIntrospectionError(
+            `Failed to introspect the database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`,
+            err
+        );
     }
-    
+
+    for (const table of existingTables) {
+        if (!includes.includes(table)) {
+            excludes.push(table);
+        }
+    }
+
     return excludes;
 }
 

package/src/cli.ts

@@ -10,10 +10,13 @@ import {
     getTableIncludes,
     getDevDatabaseUrl,
     ensureDevDatabaseExists,
-    getTableExcludes
+    getTableExcludes,
+    ExcludeIntrospectionError
 } from "./cli-helpers";
 import { checkDatabaseConnectivity, diagnoseDbError } from "./cli-errors";
 import { AUTH_BOOTSTRAP_SQL } from "./schema/auth-bootstrap-sql";
+import { detectDestructiveStatements, decidePushSafety } from "./schema/destructive-sql";
+import readline from "readline";
 
 const __cliDirname = path.dirname(fileURLToPath(import.meta.url));
 
@@ -87,7 +90,10 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
     const argsList = arg(
         {
             "--collections": String,
-            "-c": "--collections"
+            "--allow-destructive": Boolean,
+            "--yes": Boolean,
+            "-c": "--collections",
+            "-y": "--yes"
         },
         {
             argv: rawArgs.slice(2),
@@ -171,10 +177,60 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             if (databaseUrl) {
                 await ensureAuthSchemaAndFunctions(databaseUrl);
             }
+
+            // Preview the plan before touching data. `atlas schema apply` with
+            // --auto-approve will silently DROP COLUMN on a field removal and
+            // drop+add on a rename, so we first dry-run to obtain the planned
+            // SQL and gate anything destructive.
+            const plan = await runAtlas(
+                "schema",
+                ["apply", "--to", "file://drizzle/schema.sql", "--dry-run"],
+                collectionsPath,
+                { captureStdout: true }
+            );
+            const destructive = detectDestructiveStatements(plan);
+            const allowDestructive = argsList["--allow-destructive"] === true || argsList["--yes"] === true;
+            const decision = decidePushSafety({
+                destructiveCount: destructive.length,
+                allowDestructive,
+                interactive: process.stdin.isTTY === true
+            });
+
+            if (destructive.length > 0) {
+                logger.warn(chalk.yellow(`  ⚠️  This push includes ${destructive.length} destructive change(s) that will DESTROY data:`));
+                logger.warn("");
+                for (const d of destructive) {
+                    logger.warn(chalk.red(`       ${d.kind}: `) + chalk.gray(d.statement.replace(/\s+/g, " ")));
+                }
+                logger.warn("");
+                logger.warn(chalk.yellow("  Full planned changes:"));
+                logger.warn(chalk.gray(plan.trim().split("\n").map((l) => `       ${l}`).join("\n")));
+                logger.warn("");
+
+                if (decision === "refuse") {
+                    logger.error(chalk.red("  ✗ Aborting: destructive changes require confirmation."));
+                    logger.error(chalk.gray("    Re-run interactively, or pass --allow-destructive to proceed. Back up first: rebase db backup"));
+                    process.exit(1);
+                }
+                if (decision === "confirm") {
+                    const confirmed = await promptConfirm(
+                        chalk.yellow("  Type 'yes' to apply these destructive changes (this cannot be undone): ")
+                    );
+                    if (!confirmed) {
+                        logger.info(chalk.gray("  Aborted. No changes were made."));
+                        process.exit(1);
+                    }
+                } else {
+                    // decision === "apply" via --allow-destructive
+                    logger.warn(chalk.yellow("  Proceeding because --allow-destructive was passed."));
+                }
+            }
+
             await runAtlas("schema", ["apply", "--to", "file://drizzle/schema.sql", "--auto-approve"], collectionsPath);
             logger.info("");
             
             if (databaseUrl) {
+                await ensureAuthTables(databaseUrl, collectionsPath);
                 await applyPolicies(databaseUrl);
                 await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
@@ -218,6 +274,43 @@ async function ensureAuthSchemaAndFunctions(databaseUrl: string): Promise<void>
     }
 }
 
+/**
+ * Create the framework auth tables (e.g. `rebase.users`) that the generated RLS
+ * policies reference, before `applyPolicies` runs. Mirrors what the server does
+ * at boot (`PostgresBootstrapper.initializeAuth` → `ensureAuthTablesExist`).
+ *
+ * Without this, `rebase db push` against a database that has never booted the
+ * server fails while applying policies with `relation "rebase.users" does not
+ * exist` — the documented first-run does `db push` *before* the first `dev`.
+ * `ensureAuthTablesExist` is idempotent (CREATE TABLE IF NOT EXISTS), so it is
+ * safe to run on every push and harmless once the server has also created them.
+ */
+async function ensureAuthTables(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { drizzle } = await import("drizzle-orm/node-postgres");
+        const { ensureAuthTablesExist } = await import("./auth/ensure-tables");
+        const { loadCollections } = await import("./schema/doctor");
+        const { Client } = await import("pg");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        // The auth collection is flagged with `auth: true` or `auth: { enabled: true }`.
+        const authCollection = collections.find((c) => {
+            const a = c.auth;
+            return a === true || (typeof a === "object" && a !== null && a.enabled === true);
+        });
+
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            await ensureAuthTablesExist(drizzle(client), authCollection);
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Failed to ensure framework auth tables: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 /**
  * Provision the restricted `rebase_user` role right after schema changes land,
  * so grants cover freshly created tables (default privileges cover future
@@ -517,7 +610,29 @@ function timeAgo(date: Date): string {
 
 
 
-async function runAtlas(domain: "schema" | "migrate", args: string[], collectionsPath?: string): Promise<void> {
+/**
+ * Ask a yes/no question on an interactive terminal. Non-interactive shells
+ * (CI, pipes, agents) can't answer, so this must only be reached after
+ * {@link decidePushSafety} has already ruled that interactive confirmation is
+ * possible.
+ */
+async function promptConfirm(question: string): Promise<boolean> {
+    if (!process.stdin.isTTY) return false;
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        const answer: string = await new Promise((resolve) => rl.question(question, resolve));
+        return /^y(es)?$/i.test(answer.trim());
+    } finally {
+        rl.close();
+    }
+}
+
+async function runAtlas(
+    domain: "schema" | "migrate",
+    args: string[],
+    collectionsPath?: string,
+    opts: { captureStdout?: boolean } = {}
+): Promise<string> {
     const atlasBin = resolveLocalBin("atlas");
     if (!atlasBin) {
         logger.error(chalk.red("✗ Could not find atlas binary."));
@@ -587,7 +702,24 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
     }
 
     if (domain === "schema" && args.includes("apply") && collectionsPath) {
-        const excludes = await getTableExcludes(databaseUrl, collectionsPath);
+        // Fail CLOSED: the exclude list is the only thing shielding
+        // non-collection tables from the auto-approved apply. If we can't
+        // introspect the database to build it, abort rather than proceed with
+        // a partial list that would let Atlas drop unmanaged tables.
+        let excludes: string[];
+        try {
+            excludes = await getTableExcludes(databaseUrl, collectionsPath);
+        } catch (err) {
+            if (err instanceof ExcludeIntrospectionError) {
+                logger.error(chalk.red("\n✗ Aborting push: could not determine which tables to protect."));
+                logger.error(chalk.gray(`  ${err.message}`));
+                logger.error(chalk.gray("  Refusing to apply — a partial exclude list could drop tables Rebase does not manage."));
+                const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+                if (hint) logger.error(hint);
+                process.exit(1);
+            }
+            throw err;
+        }
         for (const exc of excludes) {
             atlasArgs.push("--exclude", exc);
         }
@@ -595,13 +727,20 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
 
     // Stream stdout live but tee stderr so we can inspect Atlas's error text
     // for known, actionable failure modes (e.g. a dependency-drop that leaves
-    // the schema half-applied) after the process exits.
+    // the schema half-applied) after the process exits. When capturing (used
+    // for the destructive-change dry-run), pipe stdout and collect it instead.
     const subprocess = execa(atlasBin, atlasArgs, {
         cwd: process.cwd(),
-        stdout: "inherit",
+        stdout: opts.captureStdout ? "pipe" : "inherit",
         stderr: "pipe",
         env
     });
+    let stdoutText = "";
+    if (opts.captureStdout) {
+        subprocess.stdout?.on("data", (chunk: Buffer) => {
+            stdoutText += chunk.toString();
+        });
+    }
     let stderrText = "";
     subprocess.stderr?.on("data", (chunk: Buffer) => {
         const text = chunk.toString();
@@ -619,6 +758,13 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
         }
         process.exit(1);
     }
+    // Atlas prints the plan to stdout, but fall back to stderr so the
+    // destructive-change detector never misses a plan on a version/build that
+    // routes it differently.
+    if (opts.captureStdout) {
+        return stdoutText.trim().length > 0 ? stdoutText : stderrText;
+    }
+    return "";
 }
 
 async function generatePostgresDdlCommand(rawArgs: string[]): Promise<void> {

package/src/index.ts

@@ -7,6 +7,10 @@ export * from "./schema/generate-drizzle-schema-logic";
 export * from "./schema/generate-drizzle-schema";
 export * from "./utils/drizzle-conditions";
 export * from "./services/realtimeService";
+// The channel bus is a public extension point: a transport published as its own
+// package implements `ChannelBus` (declared in @rebasepro/types and re-exported
+// here) and is passed to `realtime.bus`. Without this export it would be one.
+export * from "./services/channel-bus";
 export * from "./websocket";
 export * from "./collections/PostgresCollectionRegistry";
 export * from "./services/BranchService";

package/src/schema/auth-schema.ts

@@ -1,4 +1,4 @@
-import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
@@ -25,24 +25,62 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         isAnonymous: boolean("is_anonymous").default(false).notNull(),
         roles: text("roles").array().default([]).notNull(),
         metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}).notNull(),
+        /**
+         * Sessions that began before this instant are dead, whatever tokens
+         * they still hold. Password resets and admin revocations stamp it.
+         *
+         * Deleting the user's refresh-token rows (which we also do) is not
+         * sufficient on its own: a request already in flight can insert a
+         * freshly rotated row microseconds after the delete and survive it.
+         * This timestamp cannot be outrun that way — it is checked against
+         * `refresh_tokens.session_started_at`, which rotation carries forward.
+         */
+        tokensValidAfter: timestamp("tokens_valid_after"),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
 
 
     /**
-     * Refresh tokens for long-lived sessions
+     * Refresh tokens for long-lived sessions.
+     *
+     * A row is one token, not one device. Every token minted from the same
+     * sign-in shares a `sessionId`, and rotation ADDS a row rather than
+     * replacing one: the superseded token stays on file, flagged `revoked`
+     * with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+     * tell a client replaying a token it never got an answer for (a response
+     * lost to a redeploy, a second tab racing on boot) apart from a stranger
+     * presenting a token that was never issued. Deleting the old row on sight
+     * — the previous behaviour — made those two cases indistinguishable, and
+     * the legitimate one is overwhelmingly the common one.
+     *
+     * There is deliberately NO unique constraint on (uid, user_agent,
+     * ip_address). Keying a session on the IP meant one row per "device",
+     * so a second browser profile behind the same NAT silently evicted the
+     * first, and a phone changing networks orphaned a row on every hop.
+     * User agent and IP are descriptive metadata for the sessions list;
+     * `sessionId` is the identity.
      */
     const refreshTokens = tableCreator("refresh_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+        sessionId: uuid("session_id").defaultRandom().notNull(),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
+        revoked: boolean("revoked").default(false).notNull(),
+        rotatedAt: timestamp("rotated_at"),
+        /**
+         * When the sign-in this token descends from happened — carried across
+         * every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+         * compared against this, so a revocation cannot be outrun by a token
+         * that rotates immediately after it.
+         */
+        sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
         userAgent: varchar("user_agent", { length: 500 }),
         ipAddress: varchar("ip_address", { length: 45 }),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
-        uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress)
+        sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId)
     }));
 
     /**

package/src/schema/destructive-sql.ts

@@ -0,0 +1,94 @@
+/**
+ * Pure helpers that classify an Atlas declarative-apply plan as destructive
+ * or not, and decide what `rebase db push` should do about it.
+ *
+ * `db push` runs `atlas schema apply` to make the live database match the
+ * generated `schema.sql`. Removing a collection field compiles to
+ * `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+ * We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+ * here, and refuse to auto-approve anything destructive without an explicit
+ * opt-in.
+ *
+ * Everything in this file is side-effect free so it can be unit-tested
+ * without Atlas or a database.
+ */
+
+/**
+ * SQL fragments that destroy data or data-bearing objects. Matched
+ * case-insensitively against each statement of the plan. `IF EXISTS` /
+ * whitespace variations are tolerated by the regexes below.
+ */
+const DESTRUCTIVE_PATTERNS: { label: string; re: RegExp }[] = [
+    { label: "DROP TABLE", re: /\bDROP\s+TABLE\b/i },
+    { label: "DROP COLUMN", re: /\bDROP\s+COLUMN\b/i },
+    { label: "DROP SCHEMA", re: /\bDROP\s+SCHEMA\b/i },
+    { label: "DROP VIEW", re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i },
+    { label: "DROP TYPE", re: /\bDROP\s+TYPE\b/i },
+    { label: "TRUNCATE", re: /\bTRUNCATE\b/i }
+];
+
+/**
+ * Split a SQL script into individual statements, dropping blank lines and
+ * `--` comment lines. Deliberately simple: Atlas emits one plain statement
+ * per `;`, without string literals that contain semicolons in a schema DDL
+ * plan, so a naive split is safe and keeps this dependency-free.
+ */
+export function splitSqlStatements(sql: string): string[] {
+    // Strip full-line SQL comments so a commented-out DROP never trips the
+    // detector, then split on semicolons.
+    const withoutComments = sql
+        .split("\n")
+        .filter((line) => !line.trim().startsWith("--"))
+        .join("\n");
+    return withoutComments
+        .split(";")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+
+export interface DestructiveStatement {
+    /** The offending statement (trimmed, without the trailing `;`). */
+    statement: string;
+    /** Which destructive operation it was flagged for, e.g. "DROP COLUMN". */
+    kind: string;
+}
+
+/**
+ * Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+ * the statements that would destroy data. An empty array means the plan is
+ * safe to auto-approve.
+ */
+export function detectDestructiveStatements(planSql: string): DestructiveStatement[] {
+    const found: DestructiveStatement[] = [];
+    for (const statement of splitSqlStatements(planSql)) {
+        for (const { label, re } of DESTRUCTIVE_PATTERNS) {
+            if (re.test(statement)) {
+                found.push({ statement, kind: label });
+                break; // one label per statement is enough to flag it
+            }
+        }
+    }
+    return found;
+}
+
+export type PushDecision = "apply" | "confirm" | "refuse";
+
+/**
+ * Decide how `db push` should proceed given the plan's destructiveness and
+ * the invocation context.
+ *
+ *  - No destructive statements → `apply` (safe to auto-approve).
+ *  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+ *  - Destructive + interactive TTY → `confirm` (prompt before applying).
+ *  - Destructive + non-interactive → `refuse` (never silently drop data in
+ *    CI / scripts / agents).
+ */
+export function decidePushSafety(opts: {
+    destructiveCount: number;
+    allowDestructive: boolean;
+    interactive: boolean;
+}): PushDecision {
+    if (opts.destructiveCount === 0) return "apply";
+    if (opts.allowDestructive) return "apply";
+    return opts.interactive ? "confirm" : "refuse";
+}