@rebasepro/server-postgres 0.10.1-canary.31c773c → 0.10.1-canary.6f89f77

package/src/schema/auth-schema.ts

@@ -1,4 +1,4 @@
-import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
@@ -25,24 +25,62 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         isAnonymous: boolean("is_anonymous").default(false).notNull(),
         roles: text("roles").array().default([]).notNull(),
         metadata: jsonb("metadata").$type<Record<string, unknown>>().default({}).notNull(),
+        /**
+         * Sessions that began before this instant are dead, whatever tokens
+         * they still hold. Password resets and admin revocations stamp it.
+         *
+         * Deleting the user's refresh-token rows (which we also do) is not
+         * sufficient on its own: a request already in flight can insert a
+         * freshly rotated row microseconds after the delete and survive it.
+         * This timestamp cannot be outrun that way — it is checked against
+         * `refresh_tokens.session_started_at`, which rotation carries forward.
+         */
+        tokensValidAfter: timestamp("tokens_valid_after"),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
 
 
     /**
-     * Refresh tokens for long-lived sessions
+     * Refresh tokens for long-lived sessions.
+     *
+     * A row is one token, not one device. Every token minted from the same
+     * sign-in shares a `sessionId`, and rotation ADDS a row rather than
+     * replacing one: the superseded token stays on file, flagged `revoked`
+     * with a `rotatedAt` stamp. That record is what lets the refresh endpoint
+     * tell a client replaying a token it never got an answer for (a response
+     * lost to a redeploy, a second tab racing on boot) apart from a stranger
+     * presenting a token that was never issued. Deleting the old row on sight
+     * — the previous behaviour — made those two cases indistinguishable, and
+     * the legitimate one is overwhelmingly the common one.
+     *
+     * There is deliberately NO unique constraint on (uid, user_agent,
+     * ip_address). Keying a session on the IP meant one row per "device",
+     * so a second browser profile behind the same NAT silently evicted the
+     * first, and a phone changing networks orphaned a row on every hop.
+     * User agent and IP are descriptive metadata for the sessions list;
+     * `sessionId` is the identity.
      */
     const refreshTokens = tableCreator("refresh_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
+        sessionId: uuid("session_id").defaultRandom().notNull(),
         tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
+        revoked: boolean("revoked").default(false).notNull(),
+        rotatedAt: timestamp("rotated_at"),
+        /**
+         * When the sign-in this token descends from happened — carried across
+         * every rotation, unlike `createdAt`. `users.tokensValidAfter` is
+         * compared against this, so a revocation cannot be outrun by a token
+         * that rotates immediately after it.
+         */
+        sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
         userAgent: varchar("user_agent", { length: 500 }),
         ipAddress: varchar("ip_address", { length: 45 }),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
-        uniqueDeviceSession: unique("unique_device_session").on(table.uid, table.userAgent, table.ipAddress)
+        sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId)
     }));
 
     /**

package/src/schema/destructive-sql.ts

@@ -0,0 +1,94 @@
+/**
+ * Pure helpers that classify an Atlas declarative-apply plan as destructive
+ * or not, and decide what `rebase db push` should do about it.
+ *
+ * `db push` runs `atlas schema apply` to make the live database match the
+ * generated `schema.sql`. Removing a collection field compiles to
+ * `DROP COLUMN`; renaming compiles to drop-then-add — either destroys data.
+ * We first run the apply with `--dry-run` to obtain the planned SQL, scan it
+ * here, and refuse to auto-approve anything destructive without an explicit
+ * opt-in.
+ *
+ * Everything in this file is side-effect free so it can be unit-tested
+ * without Atlas or a database.
+ */
+
+/**
+ * SQL fragments that destroy data or data-bearing objects. Matched
+ * case-insensitively against each statement of the plan. `IF EXISTS` /
+ * whitespace variations are tolerated by the regexes below.
+ */
+const DESTRUCTIVE_PATTERNS: { label: string; re: RegExp }[] = [
+    { label: "DROP TABLE", re: /\bDROP\s+TABLE\b/i },
+    { label: "DROP COLUMN", re: /\bDROP\s+COLUMN\b/i },
+    { label: "DROP SCHEMA", re: /\bDROP\s+SCHEMA\b/i },
+    { label: "DROP VIEW", re: /\bDROP\s+(MATERIALIZED\s+)?VIEW\b/i },
+    { label: "DROP TYPE", re: /\bDROP\s+TYPE\b/i },
+    { label: "TRUNCATE", re: /\bTRUNCATE\b/i }
+];
+
+/**
+ * Split a SQL script into individual statements, dropping blank lines and
+ * `--` comment lines. Deliberately simple: Atlas emits one plain statement
+ * per `;`, without string literals that contain semicolons in a schema DDL
+ * plan, so a naive split is safe and keeps this dependency-free.
+ */
+export function splitSqlStatements(sql: string): string[] {
+    // Strip full-line SQL comments so a commented-out DROP never trips the
+    // detector, then split on semicolons.
+    const withoutComments = sql
+        .split("\n")
+        .filter((line) => !line.trim().startsWith("--"))
+        .join("\n");
+    return withoutComments
+        .split(";")
+        .map((s) => s.trim())
+        .filter((s) => s.length > 0);
+}
+
+export interface DestructiveStatement {
+    /** The offending statement (trimmed, without the trailing `;`). */
+    statement: string;
+    /** Which destructive operation it was flagged for, e.g. "DROP COLUMN". */
+    kind: string;
+}
+
+/**
+ * Scan an Atlas plan (the SQL printed by `schema apply --dry-run`) and return
+ * the statements that would destroy data. An empty array means the plan is
+ * safe to auto-approve.
+ */
+export function detectDestructiveStatements(planSql: string): DestructiveStatement[] {
+    const found: DestructiveStatement[] = [];
+    for (const statement of splitSqlStatements(planSql)) {
+        for (const { label, re } of DESTRUCTIVE_PATTERNS) {
+            if (re.test(statement)) {
+                found.push({ statement, kind: label });
+                break; // one label per statement is enough to flag it
+            }
+        }
+    }
+    return found;
+}
+
+export type PushDecision = "apply" | "confirm" | "refuse";
+
+/**
+ * Decide how `db push` should proceed given the plan's destructiveness and
+ * the invocation context.
+ *
+ *  - No destructive statements → `apply` (safe to auto-approve).
+ *  - Destructive + `--allow-destructive` → `apply` (operator opted in).
+ *  - Destructive + interactive TTY → `confirm` (prompt before applying).
+ *  - Destructive + non-interactive → `refuse` (never silently drop data in
+ *    CI / scripts / agents).
+ */
+export function decidePushSafety(opts: {
+    destructiveCount: number;
+    allowDestructive: boolean;
+    interactive: boolean;
+}): PushDecision {
+    if (opts.destructiveCount === 0) return "apply";
+    if (opts.allowDestructive) return "apply";
+    return opts.interactive ? "confirm" : "refuse";
+}

package/src/services/realtimeService.ts

@@ -4,7 +4,7 @@ import { Client as PgClient } from "pg";
 import { randomUUID } from "crypto";
 import { DataService } from "./dataService";
 
-import { FetchCollectionProps, ListenCollectionProps, ListenOneProps, DataDriver, CollectionUpdateMessage, SingleUpdateMessage, CollectionPatchMessage, WebSocketMessage, FilterValues, CollectionConfig, RebaseCallContext } from "@rebasepro/types";
+import { FetchCollectionProps, ListenCollectionProps, ListenOneProps, DataDriver, CollectionUpdateMessage, SingleUpdateMessage, CollectionPatchMessage, WebSocketMessage, FilterValues, CollectionConfig, RebaseCallContext, resolveClientListLimit } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { sql as drizzleSql } from "drizzle-orm";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
@@ -391,6 +391,16 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                 return;
             }
 
+            // Bound the client-supplied limit with the SAME guarantee the REST
+            // ingress applies (`resolveClientListLimit`): clamp to the hard max
+            // and default an absent limit by mode. A subscription is re-fetched
+            // on every matching write, so an unbounded one is a DoS amplified
+            // per write — resolve it once and reuse for the stored request and
+            // the initial fetch.
+            const boundedLimit = resolveClientListLimit(request.limit, {
+                vectorSearch: !!request.vectorSearch
+            });
+
             // Store subscription with full request parameters and auth context for RLS
             this._subscriptions.set(subscriptionId, {
                 clientId,
@@ -400,7 +410,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                     filter: request.filter,
                     orderBy: request.orderBy,
                     order: request.order,
-                    limit: request.limit,
+                    limit: boundedLimit,
                     startAfter: request.startAfter as Record<string, unknown> | undefined,
                     databaseId: request.collection?.databaseId,
                     searchString: request.searchString
@@ -415,7 +425,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                     filter: request.filter,
                     orderBy: request.orderBy,
                     order: request.order,
-                    limit: request.limit,
+                    limit: boundedLimit,
                     startAfter: request.startAfter as Record<string, unknown> | undefined,
                     searchString: request.searchString
                 },