@rebasepro/server-postgres 0.10.1-canary.31c773c → 0.10.1-canary.6f89f77

package/dist/auth/services.d.ts

@@ -1,6 +1,6 @@
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { RebasePgTable } from "../types";
-import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
+import { UserRepository, TokenRepository, MfaRepository, AuthRepository, UserData, CreateUserData, RoleData, CreateRoleData, RefreshTokenInfo, RefreshTokenSession, PasswordResetTokenInfo, MagicLinkTokenInfo, UserIdentityData, ListUsersOptions, PaginatedUsersResult, MfaFactor, MfaChallengeInfo, RoleData as Role } from "@rebasepro/server";
 export type { Role };
 export interface AuthSchemaTables {
     users: RebasePgTable;
@@ -90,9 +90,38 @@ export declare class UserService implements UserRepository {
 export declare class RefreshTokenService {
     private db;
     private refreshTokensTable;
+    private usersTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    /**
+     * Whether the table actually carries a column, so a host application that
+     * supplied its own `refresh_tokens` table — one that predates session
+     * grouping — degrades instead of throwing on every sign-in.
+     */
+    private has;
+    private col;
+    /** The columns to read back, narrowed to the ones this table has. */
+    private selection;
+    createToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
     findByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
+    /**
+     * Record that a token was rotated away, keeping the row.
+     *
+     * The row is what lets `/auth/refresh` distinguish "you already used this,
+     * here is a fresh one" from "no idea what this is". Deleting it — which is
+     * what this used to do — collapsed both into a 401 and signed the user out
+     * for the crime of losing a response.
+     */
+    markRotated(tokenHash: string): Promise<void>;
+    /** Final kill of one sign-in: logout, or revoking a device remotely. */
+    revokeSession(sessionId: string): Promise<void>;
+    /**
+     * Housekeeping: rotation would otherwise leave a row per refresh forever.
+     * Superseded rows are only needed for as long as a straggler might still
+     * present them, and expired ones are dead weight everywhere.
+     */
+    prune(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     deleteByHash(tokenHash: string): Promise<void>;
     deleteAllForUser(uid: string): Promise<void>;
     listForUser(uid: string): Promise<RefreshTokenInfo[]>;
@@ -153,7 +182,12 @@ export declare class PostgresTokenRepository implements TokenRepository {
     private passwordResetTokenService;
     private magicLinkTokenService;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;
@@ -205,7 +239,12 @@ export declare class PostgresAuthRepository implements AuthRepository {
     createRole(_data: CreateRoleData): Promise<RoleData>;
     updateRole(id: string, data: Partial<Omit<RoleData, "id">>): Promise<RoleData | null>;
     deleteRole(_id: string): Promise<void>;
-    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string): Promise<void>;
+    createRefreshToken(uid: string, tokenHash: string, expiresAt: Date, userAgent?: string, ipAddress?: string, session?: RefreshTokenSession): Promise<void>;
+    markRefreshTokenRotated(tokenHash: string): Promise<void>;
+    revokeRefreshTokenSession(sessionId: string): Promise<void>;
+    pruneRefreshTokens(uid: string, sessionId: string, supersededBefore: Date): Promise<void>;
+    getTokensValidAfter(uid: string): Promise<Date | null>;
+    setTokensValidAfter(uid: string, at: Date): Promise<void>;
     findRefreshTokenByHash(tokenHash: string): Promise<RefreshTokenInfo | null>;
     deleteRefreshToken(tokenHash: string): Promise<void>;
     deleteAllRefreshTokensForUser(uid: string): Promise<void>;

package/dist/backup/backup-logic.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Replay a `pg_dumpall --globals-only` script one statement at a time,
+ * tolerating per-statement failures. On a same-cluster restore the roles
+ * usually already exist (`CREATE ROLE` → "already exists") and on a managed
+ * provider an `ALTER ROLE <superuser>` may be refused; neither should abort
+ * recreation of the roles that *are* missing. Returns how many statements
+ * applied vs were skipped.
+ *
+ * `runStatement` executes one SQL statement and rejects on error.
+ */
+export declare function applyGlobalsWith(runStatement: (sql: string) => Promise<void>, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
+/**
+ * Delete each pruned dump together with its `.globals.sql` roles sidecar, so
+ * pruning never orphans the roles file. The sidecar is best-effort — older
+ * backups predate it, so a missing-sidecar failure is swallowed while a
+ * failure deleting the dump itself propagates.
+ *
+ * `deleteObject` removes one key and rejects if it cannot (e.g. not found).
+ */
+export declare function pruneWith(keys: string[], deleteObject: (key: string) => Promise<void>): Promise<void>;

package/dist/backup/backup-service.d.ts

@@ -5,8 +5,8 @@ export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
     constructor(message: string, hint?: string | undefined);
 }
-/** Locate `pg_dump` / `pg_restore`, honouring an env override. */
-export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore", env?: Record<string, string | undefined>): string | null;
+/** Locate `pg_dump` / `pg_restore` / `pg_dumpall`, honouring an env override. */
+export declare function resolvePgBinary(tool: "pg_dump" | "pg_restore" | "pg_dumpall", env?: Record<string, string | undefined>): string | null;
 /** Run `<bin> --version` and extract the major version. */
 export declare function detectToolMajor(bin: string): Promise<number | null>;
 /** Query the server for its major version via `server_version_num`. */
@@ -27,11 +27,22 @@ export interface BackupResult {
     localFile: string;
     fileName: string;
     sizeBytes: number;
+    /**
+     * Absolute path of the `.globals.sql` sidecar holding cluster-wide roles
+     * (present unless globals capture was disabled or unavailable).
+     */
+    globalsFile?: string;
+    globalsSizeBytes?: number;
 }
 /**
  * Produce a custom-format dump on local disk. When `outDir` is omitted the
  * file is written to the OS temp directory (used by the upload path, which
  * cleans it up afterwards).
+ *
+ * Alongside the `-Fc` dump it writes a `<name>.globals.sql` sidecar via
+ * `pg_dumpall --globals-only` so the roles the dump's GRANT/RLS statements
+ * depend on can be recreated on restore. Set `includeGlobals: false` to skip
+ * it (e.g. when the caller has no privilege to read cluster globals).
  */
 export declare function createDump(opts: {
     connectionString: string;
@@ -41,19 +52,50 @@ export declare function createDump(opts: {
     excludeSchemas?: string[];
     noOwner?: boolean;
     inheritStdio?: boolean;
+    includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<BackupResult>;
+/**
+ * Cheap integrity check on a freshly written dump: it must be non-empty and
+ * `pg_restore --list` must parse its table of contents without error. Used
+ * before pruning older backups so a corrupt-but-exit-0 dump never becomes
+ * the reason the last good backup is deleted.
+ */
+export declare function validateDump(localFile: string, env?: Record<string, string | undefined>): Promise<{
+    ok: boolean;
+    reason?: string;
+}>;
+/**
+ * Replay a `pg_dumpall --globals-only` script to recreate cluster roles
+ * before a restore, so the dump's GRANT/RLS statements (which reference
+ * `rebase_user` and any owner roles) actually apply. Runs statement by
+ * statement and tolerates per-statement failures — on a same-cluster restore
+ * the roles usually already exist (`CREATE ROLE` → "already exists"), and on
+ * a managed provider an `ALTER ROLE <superuser>` may be refused; neither
+ * should abort role recreation. Returns how many statements applied vs were
+ * skipped.
+ */
+export declare function applyGlobals(connectionString: string, globalsSql: string, log?: (message: string) => void): Promise<{
+    applied: number;
+    skipped: number;
+}>;
 /**
  * Restore a custom-format dump into the database named by
  * `connectionString`. Destructive when `clean` is set (drops objects
  * first). Never called automatically — the CLI gates it behind explicit
  * confirmation.
+ *
+ * Runs with `--exit-on-error` by default: a restore that logs-and-continues
+ * past a failed GRANT (because a role was missing) reports success with RLS
+ * un-enforced. Callers should recreate roles first (see {@link applyGlobals})
+ * and only set `exitOnError: false` deliberately.
  */
 export declare function restoreDump(opts: {
     connectionString: string;
     inputFile: string;
     clean?: boolean;
     noOwner?: boolean;
+    exitOnError?: boolean;
     inheritStdio?: boolean;
     env?: Record<string, string | undefined>;
 }): Promise<void>;

package/dist/backup/pg-tools.d.ts

@@ -99,10 +99,50 @@ export declare function buildPgRestoreArgs(opts: {
     inputFile: string;
     /** Drop objects before recreating them (destructive but idempotent). */
     clean?: boolean;
-    /** Continue past individual errors instead of aborting. */
+    /**
+     * Abort on the first error instead of logging and continuing. Defaults
+     * ON: a restore that silently skips failed GRANT/RLS statements (because
+     * a role is missing) "succeeds" with RLS un-enforced — a security hole.
+     * Fail loudly instead so the operator knows the restore is incomplete.
+     */
     exitOnError?: boolean;
     noOwner?: boolean;
 }): string[];
+/**
+ * Assemble the `pg_restore --list` argument vector. Reading a dump's table
+ * of contents parses the whole archive without touching a database, so it is
+ * a cheap integrity check that the file isn't truncated or corrupt.
+ */
+export declare function buildPgRestoreListArgs(inputFile: string): string[];
+/**
+ * Assemble the `pg_dumpall --globals-only` argument vector. Roles (and other
+ * cluster-wide objects) live outside any single database, so a per-database
+ * `pg_dump` omits them. Without the `rebase_user` role the RLS GRANT
+ * statements in the main dump fail on restore and RLS is silently lost — so
+ * every backup captures the globals into a sidecar `.globals.sql`.
+ *
+ * `--no-role-passwords` keeps role secrets out of the artifact (backups may
+ * be shipped off-box); roles are recreated password-less and re-secured by
+ * the operator.
+ */
+export declare function buildPgDumpallGlobalsArgs(opts: {
+    connectionString: string;
+    outFile: string;
+}): string[];
+/**
+ * Derive the globals sidecar path/key for a given `.dump` file. Keeps the
+ * two artifacts adjacent so listing, uploading and pruning can find one from
+ * the other. A name that doesn't end in `.dump` is returned unchanged with a
+ * `.globals.sql` suffix appended.
+ */
+export declare function globalsFileForDump(dumpPath: string): string;
+/**
+ * Split a `pg_dumpall --globals-only` script into individual statements.
+ * Used when replaying globals on restore so each `CREATE ROLE` / `GRANT`
+ * can run independently and a benign "role already exists" on one doesn't
+ * abort the rest. Drops `--` comment lines and blank statements.
+ */
+export declare function splitGlobalsStatements(sql: string): string[];
 /**
  * Resolve the Postgres connection string the backup commands should use,
  * mirroring the precedence the branch command already relies on.

package/dist/cli-helpers.d.ts

@@ -4,4 +4,36 @@ export declare function getTableIncludesFromCollections(collections: CollectionC
 export declare function getTableIncludes(collectionsPath: string): Promise<string[]>;
 export declare function getDevDatabaseUrl(databaseUrl: string): string;
 export declare function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string): Promise<void>;
-export declare function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]>;
+/**
+ * Query the live database for every user table/view outside the system
+ * catalogs. Separated from {@link getTableExcludes} so its failure mode can
+ * be handled explicitly (fail closed) and so tests can inject a stub.
+ */
+export declare function queryExistingTables(databaseUrl: string): Promise<string[]>;
+/**
+ * Raised when the exclude list could not be built. `db push` MUST abort on
+ * this rather than continue: the exclude list is the only thing shielding
+ * non-collection (user/system) tables from the auto-approved declarative
+ * apply. A partial list — the old fail-open behaviour — meant a transient
+ * introspection hiccup dropped every table not present in `schema.sql`.
+ */
+export declare class ExcludeIntrospectionError extends Error {
+    readonly cause?: unknown | undefined;
+    constructor(message: string, cause?: unknown | undefined);
+}
+/**
+ * Build the `--exclude` list that protects tables Rebase doesn't manage from
+ * the declarative apply. Anything not backing a collection (or its M2M
+ * junctions) is excluded so Atlas never drops it.
+ *
+ * Fails **closed**: if the database can't be introspected we cannot know
+ * which tables to protect, so we throw {@link ExcludeIntrospectionError}
+ * instead of returning a near-empty list and letting the caller drop
+ * everything.
+ *
+ * `deps` is injectable for tests; production uses the real pg-backed queries.
+ */
+export declare function getTableExcludes(databaseUrl: string, collectionsPath: string, deps?: {
+    queryExistingTables?: (databaseUrl: string) => Promise<string[]>;
+    getIncludes?: (collectionsPath: string) => Promise<string[]>;
+}): Promise<string[]>;