@rebasepro/server-postgres 0.10.1-canary.a54c057 → 0.10.1-canary.af2af91

package/dist/utils/drizzle-conditions.d.ts

@@ -18,6 +18,47 @@ export interface DrizzleDynamicQuery {
  * const builder: ConditionBuilderStatic<SQL> = DrizzleConditionBuilder;
  */
 export declare class DrizzleConditionBuilder {
+    /**
+     * Express "reachable from this parent through this relation" as a plain
+     * `WHERE` condition on the target table.
+     *
+     * This is the primitive that lets a relation be a *filter* rather than an
+     * addressing scheme. A nested listing used to be served by its own query
+     * builder — `fetchEntitiesUsingJoins`, which grew joins the root pipeline
+     * did not have and lost the options the root pipeline did have (offset,
+     * filter, orderBy, include). Reduced to a condition, the same listing runs
+     * through the ordinary collection query, so it inherits all of them and
+     * there is one read path instead of two.
+     *
+     * The shapes:
+     *   - inverse FK  → `target.<fk> = :parentId`, a column comparison.
+     *   - `through`   → `EXISTS (SELECT 1 FROM junction …)`, correlated on the
+     *                   target's key, so the junction never multiplies rows the
+     *                   way an `INNER JOIN` would.
+     *   - `joinPath`  → the same `EXISTS`, with the path's steps joined inside
+     *                   it and the final step correlating to the outer row.
+     */
+    static buildRelationScopeCondition(relation: Relation, 
+    /**
+     * Lazy: only `joinPath` and `localKey` relations need the parent's own
+     * table. An inverse foreign key and a junction are both expressible
+     * from the parent's *id* alone, and requiring the table for them would
+     * make a child listing fail on a parent whose table isn't registered.
+     */
+    parent: () => {
+        table: PgTable<any>;
+        idColumn: AnyPgColumn;
+    }, parentId: string | number, targetTable: PgTable<any>, targetIdColumn: AnyPgColumn, registry: PostgresCollectionRegistry): SQL;
+    /**
+     * `EXISTS` for an explicit `joinPath`.
+     *
+     * The path is declared source → target. The subquery replays every step but
+     * the last from inside, and turns the last one into the correlation with the
+     * outer target row — so the target table is never named twice and needs no
+     * alias. Each intermediate table is aliased positionally, which keeps a path
+     * that revisits a table (a self-referencing many-to-many) unambiguous.
+     */
+    private static buildJoinPathScopeCondition;
     /**
      * Build filter conditions from FilterValues
      */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.10.1-canary.a54c057",
+  "version": "0.10.1-canary.af2af91",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,21 +47,20 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.10.1-canary.a54c057",
-    "@rebasepro/common": "0.10.1-canary.a54c057",
-    "@rebasepro/server": "0.10.1-canary.a54c057",
-    "@rebasepro/types": "0.10.1-canary.a54c057",
-    "@rebasepro/utils": "0.10.1-canary.a54c057"
+    "@rebasepro/codegen": "0.10.1-canary.af2af91",
+    "@rebasepro/server": "0.10.1-canary.af2af91",
+    "@rebasepro/types": "0.10.1-canary.af2af91",
+    "@rebasepro/utils": "0.10.1-canary.af2af91",
+    "@rebasepro/common": "0.10.1-canary.af2af91"
   },
   "devDependencies": {
-    "@hono/node-server": "^2.0.9",
+    "@hono/node-server": "^2.0.11",
     "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",
     "@types/ws": "^8.18.1",
-    "@vitejs/plugin-react": "^6.0.2",
-    "hono": "^4.12.25",
+    "hono": "^4.12.27",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.11",
     "typescript": "^6.0.3",

package/src/PostgresBootstrapper.ts

@@ -37,6 +37,9 @@ import { buildCollectionsFromSchema, introspectSchema, readRlsStatus } from "./s
 import { buildDrizzleTablesFromSchema, buildDrizzleRelationsFromSchema } from "./schema/dynamic-tables";
 import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
 import { provisionTriggerCdc, type CdcTableRef } from "./services/cdc/trigger-cdc";
+import { collectJunctionLinks } from "./services/cdc/junction-tables";
+import { createChannelBus, resolveChannelBusSetting } from "./services/channel-bus";
+import { isChannelBusInstance } from "@rebasepro/types";
 
 export interface PostgresDriverConfig {
     connectionString?: string;
@@ -54,9 +57,13 @@ export interface PostgresDriverConfig {
      */
     introspectionSchema?: string;
     /**
-     * Realtime options. Currently only channel retention, which is opt-in:
-     * without rules here no channel keeps any history and broadcast stays
-     * fire-and-forget. See {@link ChannelRetentionRule}.
+     * Realtime options, both opt-in:
+     *
+     *  - `channels` — retention. Without rules no channel keeps any history and
+     *    broadcast stays fire-and-forget. See {@link ChannelRetentionRule}.
+     *  - `bus` — the cross-instance transport for channel broadcast and
+     *    presence. Defaults to in-process only, which is correct for a single
+     *    instance and wrong for two. See {@link ChannelBusConfig}.
      */
     realtime?: RealtimeChannelsConfig;
 }
@@ -227,8 +234,8 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                         `  The database server is not running or is not accepting\n` +
                         `  connections. Common fixes:\n` +
                         `\n` +
+                        `    • docker compose up -d db          (the service a Rebase scaffold ships)\n` +
                         `    • brew services start postgresql@18\n` +
-                        `    • docker compose up -d postgres\n` +
                         `    • Verify DATABASE_URL in your .env file\n` +
                         `\n` +
                         `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
@@ -337,6 +344,29 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             // Prefer DATABASE_DIRECT_URL to bypass PgBouncer for LISTEN/NOTIFY.
             const directUrl = process.env.DATABASE_DIRECT_URL || pgConfig.connectionString;
 
+            // ── Cross-instance channel bus ───────────────────────────────────
+            // Entity changes already span instances (CDC / LISTEN below).
+            // Channel broadcast and presence did not — they lived in per-process
+            // maps, so behind two replicas the clients of one were invisible to
+            // the other. Opt-in, and a no-op when left at "memory".
+            try {
+                const busSetting = resolveChannelBusSetting(pgConfig.realtime?.bus);
+                // A supplied instance is always installed; a named built-in only
+                // when it is not the in-process default, so the common case
+                // touches none of this machinery.
+                const wantsBus = isChannelBusInstance(busSetting) || busSetting.type !== "memory";
+                if (wantsBus) {
+                    await realtimeService.configureChannelBus(
+                        createChannelBus(busSetting, {
+                            db: schemaAwareDb as unknown as NodePgDatabase<Record<string, unknown>>,
+                            directUrl
+                        })
+                    );
+                }
+            } catch (err) {
+                logger.warn("⚠️ [ChannelBus] Could not configure the channel bus — channel broadcast and presence stay per-instance", { error: err });
+            }
+
             // Database-level Change Data Capture. When active, realtime events are
             // emitted for EVERY committed write — including ones that bypass the
             // Rebase API (psql, another service's cron, raw SQL, the Studio SQL
@@ -388,6 +418,14 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                             table: getCollectionTableName(c)
                         }))
                         .filter((t) => Boolean(t.table) && registry.hasTableForCollection(t.table));
+                    // Junction tables back no collection, so the list above misses
+                    // them — and a link or unlink is a write nobody would hear
+                    // about. Their rows are the contents of a child list, which is
+                    // as much a change as a write to the rows themselves.
+                    for (const link of collectJunctionLinks(registry)) {
+                        cdcTables.push({ schema: link.schema,
+table: link.table });
+                    }
                     // Provisioning throws only when the connection can't create the
                     // trigger function (insufficient privilege); enableCdc throws when
                     // the LISTEN connection can't be established. Either → fall back.
@@ -615,6 +653,46 @@ authRepository };
             return internals.realtimeService;
         },
 
+        /**
+         * Create any collection tables, columns and enum types the database is
+         * missing — additively, never destructively.
+         *
+         * This is what lets the managed runtime boot a project against a fresh
+         * database and actually serve it. Before this, only auth tables were
+         * ensured, so a managed tenant came up with working sign-in and a 500 on
+         * every data route.
+         *
+         * Runs through the drizzle handle's underlying session so it uses the
+         * same connection (and therefore the same privileges) the driver already
+         * proved it can bootstrap with.
+         */
+        async ensureCollectionSchema(
+            collections: unknown[],
+            driverResult: InitializedDriver,
+            log?: (message: string) => void
+        ): Promise<{ applied: number }> {
+            const internals = driverResult.internals as PostgresDriverInternals;
+            const { ensureCollectionTables } = await import("./schema/ensure-collection-tables");
+            // Runs through the drizzle handle the driver already bootstrapped
+            // with, so it uses exactly the connection and privileges that were
+            // proven to work. Every statement is DDL or a catalogue read with no
+            // bindable values (schema names are identifiers), and the module
+            // validates them before they reach a string.
+            const queryable = {
+                async query<T>(text: string): Promise<{ rows: T[] }> {
+                    const result = await internals.db.execute(sql.raw(text));
+                    const rows = (result as unknown as { rows?: T[] }).rows;
+                    return { rows: rows ?? (Array.isArray(result) ? (result as T[]) : []) };
+                }
+            };
+            const plan = await ensureCollectionTables(
+                queryable,
+                collections as Parameters<typeof ensureCollectionTables>[1],
+                log
+            );
+            return { applied: plan.actions.length };
+        },
+
         getAdmin(driverResult: InitializedDriver): DatabaseAdmin | undefined {
             const internals = driverResult.internals as PostgresDriverInternals;
             return internals.driver.admin;

package/src/auth/ensure-tables.ts

@@ -107,6 +107,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 email_verification_sent_at TIMESTAMP WITH TIME ZONE,
                 is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
                 metadata JSONB DEFAULT '{}' NOT NULL,
+                tokens_valid_after TIMESTAMP WITH TIME ZONE,
                 created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
             )
@@ -209,17 +210,23 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         `);
 
 
-        // Create refresh tokens table (includes user_agent, ip_address, and unique constraint)
+        // Create refresh tokens table. One row per TOKEN, grouped into a
+        // sign-in by session_id — deliberately without a uniqueness rule on
+        // (uid, user_agent, ip_address); see the schema module for why that
+        // constraint had to go.
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(refreshTokensTableName)} (
                 id TEXT PRIMARY KEY DEFAULT gen_random_uuid()::text,
                 uid ${sql.raw(userIdType)} NOT NULL REFERENCES ${sql.raw(usersTableName)}(id) ON DELETE CASCADE,
+                session_id TEXT NOT NULL DEFAULT gen_random_uuid()::text,
                 token_hash TEXT NOT NULL UNIQUE,
                 expires_at TIMESTAMP WITH TIME ZONE NOT NULL,
+                revoked BOOLEAN DEFAULT FALSE NOT NULL,
+                rotated_at TIMESTAMP WITH TIME ZONE,
+                session_started_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
                 user_agent TEXT,
                 ip_address TEXT,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW(),
-                CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
+                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW()
             )
         `);
 
@@ -348,6 +355,7 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
             "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
             "metadata JSONB DEFAULT '{}' NOT NULL",
+            "tokens_valid_after TIMESTAMP WITH TIME ZONE",
             "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
             "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
         ];
@@ -358,16 +366,26 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             `);
         }
 
-        // ── Migration: reconcile refresh_tokens for the device-session upsert ──
-        // The refresh-token rotation does `INSERT ... ON CONFLICT (uid, user_agent,
-        // ip_address) DO UPDATE`, which requires the `unique_device_session`
-        // constraint. `CREATE TABLE IF NOT EXISTS` never adds it to a table that
-        // predates the constraint, so every login on such a database 500s with
-        // `42P10 no unique or exclusion constraint matching the ON CONFLICT`.
-        // Reconcile EVERY table named refresh_tokens, in whatever schema it lives,
-        // rather than only the derived name: a database provisioned by an older
-        // era can carry the table in a different schema than the one this run
-        // derives, and the login upsert then hits a table without the constraint.
+        // ── Migration: refresh_tokens become session-scoped, rotation-safe ──
+        // Two shapes are reconciled here, on EVERY table named refresh_tokens
+        // in whatever schema it lives (a database provisioned by an older era
+        // can carry the table in a different schema than the one this run
+        // derives, and auth would then read a table nobody migrated):
+        //
+        //   1. The new columns. A token is now a member of a session
+        //      (`session_id`) and is retained after rotation (`revoked`,
+        //      `rotated_at`) so a replayed token can be recognised instead of
+        //      looking like a forgery. `session_started_at` is carried across
+        //      rotations so `users.tokens_valid_after` cannot be outrun.
+        //   2. The removal of `unique_device_session`. It made (uid,
+        //      user_agent, ip_address) the identity of a session, which evicted
+        //      a second browser profile behind one NAT and churned rows as
+        //      phones changed networks. UA and IP are metadata now.
+        //
+        // Every existing row is adopted rather than dropped: it keeps its
+        // token_hash, gets a session of its own, and stays unrevoked — so the
+        // sessions live in browsers right now survive the upgrade rather than
+        // everyone being signed out by the fix for being signed out.
         try {
             const rtTables = await db.execute(sql`
                 SELECT table_schema, table_name
@@ -379,57 +397,53 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             for (const { table_schema } of found) {
                 const qualified = `"${table_schema}"."refresh_tokens"`;
                 try {
-                    // Old tables may lack these columns entirely.
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS user_agent TEXT`);
-                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS ip_address TEXT`);
-                    // The upsert relies on '' (not NULL) so a device with no UA/IP collides.
-                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET user_agent = '' WHERE user_agent IS NULL`);
-                    await db.execute(sql`UPDATE ${sql.raw(qualified)} SET ip_address = '' WHERE ip_address IS NULL`);
-                    // Drop pre-existing duplicates that would block the unique constraint,
-                    // keeping one row per (uid, user_agent, ip_address).
+                    // Added nullable, then back-filled, then constrained: adding
+                    // `session_id NOT NULL DEFAULT gen_random_uuid()` in one step
+                    // would stamp every existing row with the SAME uuid on some
+                    // Postgres versions, silently merging every live session into
+                    // one that a single logout would then wipe.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_id TEXT`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS revoked BOOLEAN DEFAULT FALSE NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS rotated_at TIMESTAMP WITH TIME ZONE`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ADD COLUMN IF NOT EXISTS session_started_at TIMESTAMP WITH TIME ZONE`);
+
+                    // One session per pre-existing row: under the old model a row
+                    // WAS a device session, and there is no record of which rows
+                    // descended from the same sign-in.
                     await db.execute(sql`
-                        DELETE FROM ${sql.raw(qualified)} a
-                        USING ${sql.raw(qualified)} b
-                        WHERE a.ctid < b.ctid
-                          AND a.uid = b.uid
-                          AND a.user_agent = b.user_agent
-                          AND a.ip_address = b.ip_address
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_id = gen_random_uuid()::text
+                        WHERE session_id IS NULL
                     `);
-                    // Log every unique constraint on the table so drift is visible.
-                    const uniques = await db.execute(sql`
-                        SELECT conname, pg_get_constraintdef(oid) AS def
-                        FROM pg_constraint
-                        WHERE conrelid = ${sql.raw(`'${qualified}'`)}::regclass AND contype = 'u'
+                    await db.execute(sql`
+                        UPDATE ${sql.raw(qualified)}
+                        SET session_started_at = COALESCE(created_at, NOW())
+                        WHERE session_started_at IS NULL
                     `);
-                    for (const u of uniques.rows as { conname: string; def: string }[]) {
-                        logger.info(`   ${qualified} unique: ${u.conname} → ${u.def}`);
-                    }
-                    // Does a usable unique constraint cover EXACTLY (uid, user_agent, ip_address)?
-                    // Checking by name alone is not enough: an older era may carry a
-                    // `unique_device_session` on different columns, which the ON CONFLICT
-                    // cannot infer, so login keeps 500ing with 42P10.
-                    const hasCorrect = (uniques.rows as { def: string }[]).some((u) => {
-                        const cols = (u.def.match(/\(([^)]*)\)/)?.[1] || "")
-                            .split(",").map((c) => c.trim().replace(/"/g, ""));
-                        return cols.length === 3 && cols.includes("uid") && cols.includes("user_agent") && cols.includes("ip_address");
-                    });
-                    if (hasCorrect) {
-                        logger.info(`✓ correct device-session unique already present on ${qualified}`);
-                    } else {
-                        // Remove a wrong-columned constraint squatting on the name, then add the right one.
-                        await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
-                        await db.execute(sql`
-                            ALTER TABLE ${sql.raw(qualified)}
-                                ADD CONSTRAINT unique_device_session UNIQUE (uid, user_agent, ip_address)
-                        `);
-                        logger.info(`✅ Added correct unique_device_session constraint to ${qualified}`);
-                    }
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET DEFAULT gen_random_uuid()::text`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET DEFAULT NOW()`);
+                    // SET NOT NULL only once the back-fill above has definitely
+                    // run; on a table that somehow still holds a NULL this throws
+                    // and is caught below rather than failing the boot.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_id SET NOT NULL`);
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} ALTER COLUMN session_started_at SET NOT NULL`);
+
+                    await db.execute(sql`
+                        CREATE INDEX IF NOT EXISTS idx_refresh_tokens_session
+                        ON ${sql.raw(qualified)}(session_id)
+                    `);
+
+                    // The device-session constraint is now actively harmful: two
+                    // live tokens of one session (a rotation in flight) share a
+                    // uid, and usually a user agent and IP too.
+                    await db.execute(sql`ALTER TABLE ${sql.raw(qualified)} DROP CONSTRAINT IF EXISTS unique_device_session`);
+                    logger.info(`✅ refresh_tokens reconciled for session-scoped rotation: ${qualified}`);
                 } catch (perTableError: unknown) {
                     logger.warn(`⚠️  refresh_tokens reconcile failed for ${qualified}: ${perTableError instanceof Error ? perTableError.message : String(perTableError)}`);
                 }
             }
         } catch (migrationError: unknown) {
-            logger.warn(`⚠️  refresh_tokens device-session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
+            logger.warn(`⚠️  refresh_tokens session migration skipped: ${migrationError instanceof Error ? migrationError.message : String(migrationError)}`);
         }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──