@rebasepro/server-postgres 0.11.1-canary.gfd39654 → 0.12.1-canary.g181d0fe

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -45,7 +45,28 @@ export const isIdProperty = (propName: string, prop: Property, collection: Colle
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
-const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string => {
+/**
+ * Render statements produced by {@link generatePolicyStatements} back into the
+ * exact string the DDL/policies files have always carried: each statement on
+ * its own line, terminated by a newline. Keeping the string form derived from
+ * the statement array means the two can never drift — the boot-time applier and
+ * the generated `policies.sql` emit the same SQL, from the same source.
+ */
+const statementsToDdl = (statements: string[]): string => statements.map(s => `${s}\n`).join("");
+
+const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string =>
+    statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
+
+/**
+ * The individual SQL statements a single security rule compiles to: a
+ * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+ * statement (terminated by `;`, no trailing newline).
+ *
+ * This is the primitive the boot-time RLS applier runs one statement at a time
+ * (the runtime's DB handle speaks the extended query protocol, which forbids
+ * multiple commands in one execute), while `db push` writes the joined string.
+ */
+export const generatePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string[] => {
     const tableName = getTableName(collection);
     const ops: readonly SecurityOperation[] = rule.operations && rule.operations.length > 0
         ? rule.operations
@@ -53,12 +74,12 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
 
     const policyNames = getPolicyNamesForRule(rule, tableName);
 
-    return ops.map((op, opIdx) => {
-        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
-    }).join("");
+    return ops.flatMap((op, opIdx) => {
+        return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+    });
 };
 
-const generateSinglePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string => {
+const generateSinglePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string[] => {
     const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
     const tableName = getTableName(collection);
     const mode = (rule.mode ?? "permissive").toUpperCase();
@@ -83,11 +104,12 @@ const generateSinglePolicyDdl = (collection: CollectionConfig, rule: SecurityRul
         withCheckClause = "false";
     }
 
-    let ddl = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";\n`;
-    ddl += `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `"${r}"`).join(", ")}`;
-    if (usingClause) ddl += ` USING (${usingClause})`;
-    if (withCheckClause) ddl += ` WITH CHECK (${withCheckClause})`;
-    return `${ddl};\n`;
+    const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+    let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `"${r}"`).join(", ")}`;
+    if (usingClause) create += ` USING (${usingClause})`;
+    if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+    create += ";";
+    return [drop, create];
 };
 
 export const getSqlColumnType = (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]): string => {
@@ -103,11 +125,15 @@ export const getSqlColumnType = (propName: string, prop: Property, collection: C
             if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") {
                 return "UUID";
             }
+            // Width comes from `validation.max` when the property states one.
+            // It used to be a hardcoded 255 here and *absent* on the Drizzle
+            // path, so the same property produced a bounded column down one
+            // generator and an unbounded one down the other.
             if (stringProp.columnType === "char") {
-                return "CHAR(255)";
+                return `CHAR(${resolveStringColumnLength(stringProp)})`;
             }
             if (stringProp.columnType === "varchar") {
-                return "VARCHAR(255)";
+                return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
             }
             // `text` is the default. The two generators disagreed here before:
             // this one emitted VARCHAR(255) while the drizzle path emitted a bare
@@ -470,6 +496,67 @@ export const generatePostgresDdl = async (
     return ddl;
 };
 
+/** The RLS statements one declared collection's table needs, ready to run. */
+export interface CollectionPolicyPlan {
+    /** The table's schema (e.g. `public`, `rebase`). */
+    schema: string;
+    /** The bare table name, no schema prefix. */
+    table: string;
+    /** `schema.table` — matches the keys `readExistingSchema` returns. */
+    qualified: string;
+    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */
+    enableRls: string;
+    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */
+    policyStatements: string[];
+}
+
+/**
+ * The per-table RLS plan for the *declared* collections, as executable
+ * statements — what the managed runtime applies at boot so a freshly
+ * provisioned tenant database serves data instead of 401ing every read.
+ *
+ * Mirrors the non-junction half of {@link generatePostgresPoliciesDdl} exactly
+ * (same `generatePolicyStatements`, same enable-RLS, same effective rules), so
+ * boot and `db push` produce identical policies from identical collections.
+ *
+ * Junction tables are deliberately excluded: they are derived from `through`
+ * relations, not declared collections, and the boot-time *table* creator
+ * (`ensureCollectionTables`) does not create them either — enabling RLS on a
+ * table that boot never created would fail. Their RLS stays a `db push` /
+ * `db migrate` concern, which is where those tables get created in the first
+ * place. `db push` still applies junction policies via the string generator.
+ */
+export const planCollectionPolicies = (collections: CollectionConfig[]): CollectionPolicyPlan[] => {
+    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+    const plans: CollectionPolicyPlan[] = [];
+    const seen = new Set<string>();
+
+    for (const collection of collections) {
+        const tableName = getTableName(collection);
+        if (!tableName) continue;
+        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+        const baseTableName = tableName.includes(".") ? tableName.split(".").pop()! : tableName;
+        const qualified = `${schema}.${baseTableName}`;
+        if (seen.has(qualified)) continue;
+        seen.add(qualified);
+
+        const policyStatements: string[] = [];
+        for (const rule of getEffectiveSecurityRules(collection)) {
+            policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+        }
+
+        plans.push({
+            schema,
+            table: baseTableName,
+            qualified,
+            enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+            policyStatements
+        });
+    }
+
+    return plans;
+};
+
 export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): string => {
     let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
 

package/src/schema/introspect-runtime.ts

@@ -7,7 +7,7 @@
  * single config file.
  *
  * Distinct from `introspect-db.ts`, which runs the same queries but emits
- * TypeScript *source* for a developer to edit and commit (CMS mode). The two
+ * TypeScript *source* for a developer to edit and commit (declared collections). The two
  * share the mapping helpers in `introspect-db-logic.ts` so a table is described
  * the same way whether it was generated or introspected.
  */

package/src/services/FetchService.ts

@@ -3,10 +3,12 @@ import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, FilterValues, ResolvedRelation, LogicalCondition, isManyToMany } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
 import { resolveCollectionRelations, findRelation, createRelationRef, createRelationRefWithData } from "@rebasepro/common";
-import { DrizzleConditionBuilder } from "../utils/drizzle-conditions";
+import { generateForeignKeyName } from "@rebasepro/utils";
+import { DrizzleConditionBuilder, type FilterCompilationOptions } from "../utils/drizzle-conditions";
 import {
     getCollectionByPath,
     getTableForCollection,
+    getPrimaryKeys,
     requirePrimaryKeys,
     deriveRowAddress,
     parseIdValues,
@@ -45,6 +47,45 @@ export class FetchService {
         return query?.[tableName] as RelationalQueryBuilder<TablesRelationalConfig, TableRelationalConfig> | undefined;
     }
 
+    /**
+     * The context the condition builder needs to compile a filter key that is
+     * not a column name outright.
+     *
+     * Two such keys. An owning relation's key resolves through the collection's
+     * relations to its foreign-key column; a relation whose link lives on the
+     * target table or in a junction resolves to a correlated `EXISTS`, which
+     * needs the registry to reach that other table and this table's key column
+     * to correlate back.
+     *
+     * Looked up rather than passed: every read path already has the path, only
+     * some have the collection, and a path that names no registered collection
+     * (a nested/derived one) is not an error here — the builder simply falls
+     * back to guessing the default key shapes, and a relation filter it cannot
+     * compile stays unresolvable and so fails closed.
+     */
+    private filterContext(collectionPath: string, table: PgTable<any>): FilterCompilationOptions {
+        const collection = this.registry.getCollectionByPath(collectionPath) ?? undefined;
+        return {
+            collection,
+            registry: this.registry,
+            sourceIdColumn: collection ? this.resolveIdColumn(collection, table) : undefined
+        };
+    }
+
+    /**
+     * The table column this collection's rows are keyed by, or `undefined`.
+     *
+     * `getPrimaryKeys` rather than `requirePrimaryKeys`: a collection with no
+     * resolvable key is not an error on the filter path — it only means the
+     * relation filters that would correlate on it cannot be compiled, which
+     * the builder already handles by failing that field closed.
+     */
+    private resolveIdColumn(collection: CollectionConfig, table: PgTable<any>): AnyPgColumn | undefined {
+        const [idInfo] = getPrimaryKeys(collection, this.registry);
+        if (!idInfo) return undefined;
+        return table[idInfo.fieldName as keyof typeof table] as AnyPgColumn | undefined;
+    }
+
     /**
      * Build filter conditions from FilterValues
      * Delegates to DrizzleConditionBuilder.buildFilterConditions
@@ -54,7 +95,9 @@ export class FetchService {
         table: PgTable<any>,
         collectionPath: string
     ): SQL[] {
-        return DrizzleConditionBuilder.buildFilterConditions(filter, table, collectionPath);
+        return DrizzleConditionBuilder.buildFilterConditions(
+            filter, table, collectionPath, this.filterContext(collectionPath, table)
+        );
     }
 
     // =============================================================
@@ -64,20 +107,45 @@ export class FetchService {
     /**
      * Resolves the correct Drizzle column for sorting.
      * Automatically maps owning relation property keys to their underlying foreign key column.
+     *
+     * The relation's own `localKey` is the authority for that foreign key, not
+     * `<field>_id`. The default local key comes from `generateForeignKeyName`,
+     * which snake-cases *and singularises* — `userProfile` → `user_profile_id`,
+     * `users` → `user_id` — and an author can override it outright. A wrong
+     * guess resolves to nothing, the caller drops the `ORDER BY`, and the rows
+     * come back in whatever order Postgres pleases: paging over that repeats
+     * and skips rows rather than erroring. The guesses stay, last, for a
+     * caller that hands over no collection to resolve against.
      */
     private resolveOrderByField(
         table: PgTable<any>,
         orderBy: string,
         collection?: CollectionConfig
     ): AnyPgColumn | undefined {
-        let orderByField = table[orderBy as keyof typeof table] as AnyPgColumn;
-        if (!orderByField && collection) {
-            const property = collection.properties[orderBy];
-            if (property && property.type === "relation" && "relation" in property && property.resolvedRelation?.kind === "belongsTo") {
-                orderByField = table[`${orderBy}_id` as keyof typeof table] as AnyPgColumn;
+        const columnAt = (key: string): AnyPgColumn | undefined =>
+            (key in table ? table[key as keyof typeof table] as AnyPgColumn : undefined) || undefined;
+
+        const direct = columnAt(orderBy);
+        if (direct) return direct;
+
+        // Owning relation, resolved: the relation names its own local key.
+        if (collection) {
+            const relation = resolveCollectionRelations(collection)[orderBy];
+            if (relation?.kind === "belongsTo") {
+                const foreignKey = columnAt(relation.localKey);
+                if (foreignKey) return foreignKey;
             }
         }
-        return orderByField;
+
+        // No collection in hand — the two shapes an owning relation's key takes
+        // by default (e.g. `project` → `project_id`, `userProfile` →
+        // `user_profile_id`).
+        for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
+            const foreignKey = columnAt(guess);
+            if (foreignKey) return foreignKey;
+        }
+
+        return undefined;
     }
 
     /**
@@ -85,7 +153,7 @@ export class FetchService {
      * Converts collection relations to a Drizzle-compatible `with` object.
      *
      * When `include` is provided, only those relations are loaded.
-     * When `include` is absent, ALL relations are loaded (CMS path).
+     * When `include` is absent, ALL relations are loaded (the admin path).
      *
      * Automatically detects many-to-many junction tables and nests
      * the target relation so actual row data is returned.
@@ -311,7 +379,7 @@ export class FetchService {
         }
 
         if (options.logical) {
-            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath);
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
             if (logicalCondition) allConditions.push(logicalCondition);
         }
 
@@ -656,7 +724,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         }
 
         if (options.logical) {
-            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath);
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
             if (logicalCondition) allConditions.push(logicalCondition);
         }
 

package/src/services/row-pipeline.ts

@@ -14,7 +14,9 @@ import { PostgresCollectionRegistry } from "../collections/PostgresCollectionReg
  *
  * - `"ref"` — a `{ id, path, __type: "relation" }` reference carrying the
  *   target's values. This is what the admin renders.
- * - `"inline"` — the target's own columns, flat. This is what REST serves.
+ * - `"inline"` — the target's own columns, flat. This is what REST serves, and
+ *   — since the in-process SDK reads through the same pipeline — what
+ *   `rebase.data` / `context.data` serve too. A developer never sees a ref.
  *
  * They used to be two functions that happened to agree, and the agreement was
  * not enforced by anything: the row-identity bug had to be fixed five times