@rebasepro/server-postgres 0.10.1-canary.18115ba → 0.10.1-canary.31c773c

package/dist/schema/auth-schema.d.ts

@@ -232,23 +232,6 @@ export declare function createAuthSchema(usersSchemaName?: string): {
             }, {}, {
                 $type: Record<string, unknown>;
             }>;
-            tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
-                name: "tokens_valid_after";
-                tableName: "users";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
             createdAt: import("drizzle-orm/pg-core").PgColumn<{
                 name: "created_at";
                 tableName: "users";
@@ -324,23 +307,6 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            sessionId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "session_id";
-                tableName: "refresh_tokens";
-                dataType: "string";
-                columnType: "PgUUID";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
             tokenHash: import("drizzle-orm/pg-core").PgColumn<{
                 name: "token_hash";
                 tableName: "refresh_tokens";
@@ -377,57 +343,6 @@ export declare function createAuthSchema(usersSchemaName?: string): {
                 identity: undefined;
                 generated: undefined;
             }, {}, {}>;
-            revoked: import("drizzle-orm/pg-core").PgColumn<{
-                name: "revoked";
-                tableName: "refresh_tokens";
-                dataType: "boolean";
-                columnType: "PgBoolean";
-                data: boolean;
-                driverParam: boolean;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "rotated_at";
-                tableName: "refresh_tokens";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "session_started_at";
-                tableName: "refresh_tokens";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
             userAgent: import("drizzle-orm/pg-core").PgColumn<{
                 name: "user_agent";
                 tableName: "refresh_tokens";
@@ -1483,23 +1398,6 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         }, {}, {
             $type: Record<string, unknown>;
         }>;
-        tokensValidAfter: import("drizzle-orm/pg-core").PgColumn<{
-            name: "tokens_valid_after";
-            tableName: "users";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "users";
@@ -1575,23 +1473,6 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        sessionId: import("drizzle-orm/pg-core").PgColumn<{
-            name: "session_id";
-            tableName: "refresh_tokens";
-            dataType: "string";
-            columnType: "PgUUID";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
         tokenHash: import("drizzle-orm/pg-core").PgColumn<{
             name: "token_hash";
             tableName: "refresh_tokens";
@@ -1628,57 +1509,6 @@ export declare const refreshTokens: import("drizzle-orm/pg-core").PgTableWithCol
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
-        revoked: import("drizzle-orm/pg-core").PgColumn<{
-            name: "revoked";
-            tableName: "refresh_tokens";
-            dataType: "boolean";
-            columnType: "PgBoolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        rotatedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "rotated_at";
-            tableName: "refresh_tokens";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
-        sessionStartedAt: import("drizzle-orm/pg-core").PgColumn<{
-            name: "session_started_at";
-            tableName: "refresh_tokens";
-            dataType: "date";
-            columnType: "PgTimestamp";
-            data: Date;
-            driverParam: string;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            baseColumn: never;
-            identity: undefined;
-            generated: undefined;
-        }, {}, {}>;
         userAgent: import("drizzle-orm/pg-core").PgColumn<{
             name: "user_agent";
             tableName: "refresh_tokens";

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.10.1-canary.18115ba",
+  "version": "0.10.1-canary.31c773c",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.10.1-canary.18115ba",
-    "@rebasepro/common": "0.10.1-canary.18115ba",
-    "@rebasepro/utils": "0.10.1-canary.18115ba",
-    "@rebasepro/server": "0.10.1-canary.18115ba",
-    "@rebasepro/types": "0.10.1-canary.18115ba"
+    "@rebasepro/codegen": "0.10.1-canary.31c773c",
+    "@rebasepro/common": "0.10.1-canary.31c773c",
+    "@rebasepro/server": "0.10.1-canary.31c773c",
+    "@rebasepro/types": "0.10.1-canary.31c773c",
+    "@rebasepro/utils": "0.10.1-canary.31c773c"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",

package/src/auth/ensure-tables.ts

@@ -107,7 +107,6 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -210,23 +209,17 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         `);
 
 
-        // Create refresh tokens table. One row per TOKEN, grouped into a
-        // sign-in by session_id — deliberately without a uniqueness rule on
-        // (uid, user_agent, ip_address); see the schema module for why that
-        // constraint had to go.
+        // Create refresh tokens table (includes user_agent, ip_address, and unique constraint)
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
-                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
-                revoked BOOLEAN DEFAULT FALSE NOT NULL,
-                rotated_at TIMESTAMP WITH TIME ZONE,
-                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
+                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
             )
         `);
 
@@ -355,7 +348,6 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
             "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
             "metadata JSONB DEFAULT '{}' NOT NULL",
-            "tokens_valid_after TIMESTAMP WITH TIME ZONE",
             "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
             "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
         ];
@@ -366,26 +358,16 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
-        // ── Migration: refresh_tokens become session-scoped, rotation-safe ──
-        // Two shapes are reconciled here, on EVERY table named refresh_tokens
-        // in whatever schema it lives (a database provisioned by an older era
-        // can carry the table in a different schema than the one this run
-        // derives, and auth would then read a table nobody migrated):
-        //
-        //   1. The new columns. A token is now a member of a session
-        //      (`session_id`) and is retained after rotation (`revoked`,
-        //      `rotated_at`) so a replayed token can be recognised instead of
-        //      looking like a forgery. `session_started_at` is carried across
-        //      rotations so `users.tokens_valid_after` cannot be outrun.
-        //   2. The removal of `unique_device_session`. It made (uid,
-        //      user_agent, ip_address) the identity of a session, which evicted
-        //      a second browser profile behind one NAT and churned rows as
-        //      phones changed networks. UA and IP are metadata now.
-        //
-        // Every existing row is adopted rather than dropped: it keeps its
-        // token_hash, gets a session of its own, and stays unrevoked — so the
-        // sessions live in browsers right now survive the upgrade rather than
-        // everyone being signed out by the fix for being signed out.
+        // ── Migration: reconcile refresh_tokens for the device-session upsert ──
+        // The refresh-token rotation does `INSERT ... ON CONFLICT (uid, user_agent,
+        // ip_address) DO UPDATE`, which requires the `unique_device_session`
+        // constraint. `CREATE TABLE IF NOT EXISTS` never adds it to a table that
+        // predates the constraint, so every login on such a database 500s with
+        // `42P10 no unique or exclusion constraint matching the ON CONFLICT`.
+        // Reconcile EVERY table named refresh_tokens, in whatever schema it lives,
+        // rather than only the derived name: a database provisioned by an older
+        // era can carry the table in a different schema than the one this run
+        // derives, and the login upsert then hits a table without the constraint.
         try {
             const rtTables = await db.execute(sql`
                 SELECT table_schema, table_name
@@ -397,53 +379,57 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             for (const { table_schema } of found) {
                 const qualified = `"${table_schema}"."refresh_tokens"`;
                 try {
-                    // Added nullable, then back-filled, then constrained: adding
-                    // `session_id NOT NULL DEFAULT gen_random_uuid()` in one step
-                    // would stamp every existing row with the SAME uuid on some
-                    // Postgres versions, silently merging every live session into
-                    // one that a single logout would then wipe.
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
-
-                    // One session per pre-existing row: under the old model a row
-                    // WAS a device session, and there is no record of which rows
-                    // descended from the same sign-in.
+                    // Old tables may lack these columns entirely.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
+                    // The upsert relies on '' (not NULL) so a device with no UA/IP collides.
+                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
+                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
+                    // Drop pre-existing duplicates that would block the unique constraint,
+                    // keeping one row per (uid, user_agent, ip_address).
                     await db.execute(sql`
-                        UPDATE ${sql.raw(qualified)}
-                        SET session_id = gen_random_uuid()::text
-                        WHERE session_id IS NULL
+                        DELETE FROM ${sql.raw(qualified)} a
+                        USING ${sql.raw(qualified)} b
+                        WHERE a.ctid < b.ctid
+                          AND a.uid = b.uid
+                          AND a.user_agent = b.user_agent
+                          AND a.ip_address = b.ip_address
                     `);
-                    await db.execute(sql`
-                        UPDATE ${sql.raw(qualified)}
-                        SET session_started_at = COALESCE(created_at, NOW())
-                        WHERE session_started_at IS NULL
+                    // Log every unique constraint on the table so drift is visible.
+                    const uniques = await db.execute(sql`
+                        SELECT conname, pg_get_constraintdef(oid) AS def
+                        FROM pg_constraint
+                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
                     `);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
-                    // SET NOT NULL only once the back-fill above has definitely
-                    // run; on a table that somehow still holds a NULL this throws
-                    // and is caught below rather than failing the boot.
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
-
-                    await db.execute(sql`
-                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
-                        ON ${sql.raw(qualified)}(session_id)
-                    `);
-
-                    // The device-session constraint is now actively harmful: two
-                    // live tokens of one session (a rotation in flight) share a
-                    // uid, and usually a user agent and IP too.
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-                    logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
+                    for (const u of uniques.rows as { conname: string; def: string }[]) {
+                        logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
+                    }
+                    // Does a usable unique constraint cover EXACTLY (uid, user_agent, ip_address)?
+                    // Checking by name alone is not enough: an older era may carry a
+                    // `unique_device_session` on different columns, which the ON CONFLICT
+                    // cannot infer, so login keeps 500ing with 42P10.
+                    const hasCorrect = (uniques.rows as { def: string }[]).some((u) => {
+                        const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "")
+                            .split(",").map((c) => c.trim().replace(/"/g, ""));
+                        return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
+                    });
+                    if (hasCorrect) {
+                        logger.info(`✓ correct device-session unique already present on ${qualified}`);
+                    } else {
+                        // Remove a wrong-columned constraint squatting on the name, then add the right one.
+                        await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+                        await db.execute(sql`
+                            ALTER TABLE ${sql.raw(qualified)}
+                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                        `);
+                        logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
+                    }
                 } catch (perTableError: unknown) {
                     logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
                 }
             }
         } catch (migrationError: unknown) {
-            logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+            logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
         }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──