@rebasepro/server-postgres 0.12.0 → 0.12.1-canary.g06f263c

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, ResolvedRelation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty, isManyToMany, type ResolvedManyToMany, type ResolvedBelongsTo } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig, resolveStringColumnLength } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -11,7 +11,7 @@ export const resolveColumnName = (propName: string, prop?: Property | null): str
     return toSnakeCase(propName);
 };
 
-const getPrimaryKeyProp = (collection: CollectionConfig): { name: string, type: "string" | "number", isUuid: boolean } => {
+export const getPrimaryKeyProp = (collection: CollectionConfig): { name: string, type: "string" | "number", isUuid: boolean } => {
     if (collection.properties) {
         const idPropEntry = Object.entries(collection.properties).find(([_, prop]) => "isId" in (prop as unknown as object) && Boolean((prop as unknown as Record<string, unknown>).isId));
         if (idPropEntry) {
@@ -28,14 +28,18 @@ const getPrimaryKeyProp = (collection: CollectionConfig): { name: string, type:
     return { name: "id", type: "string", isUuid: isUuid ?? false };
 };
 
-const isNumericId = (collection: CollectionConfig): boolean => {
+export const isNumericId = (collection: CollectionConfig): boolean => {
     return getPrimaryKeyProp(collection).type === "number";
 };
 
-const getPrimaryKeyName = (collection: CollectionConfig): string => {
+export const getPrimaryKeyName = (collection: CollectionConfig): string => {
     return getPrimaryKeyProp(collection).name;
 };
 
+/** The column type a junction holds for one endpoint's primary key. */
+const junctionKeyType = (collection: CollectionConfig): string =>
+    isNumericId(collection) ? "INTEGER" : (getPrimaryKeyProp(collection).isUuid ? "UUID" : "TEXT");
+
 export const isIdProperty = (propName: string, prop: Property, collection: CollectionConfig): boolean => {
     if ("isId" in prop && Boolean(prop.isId)) return true;
     const hasExplicitId = Object.values(collection.properties ?? {}).some(p => "isId" in (p as unknown as object) && Boolean((p as unknown as Record<string, unknown>).isId));
@@ -45,7 +49,28 @@ export const isIdProperty = (propName: string, prop: Property, collection: Colle
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
-const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string => {
+/**
+ * Render statements produced by {@link generatePolicyStatements} back into the
+ * exact string the DDL/policies files have always carried: each statement on
+ * its own line, terminated by a newline. Keeping the string form derived from
+ * the statement array means the two can never drift — the boot-time applier and
+ * the generated `policies.sql` emit the same SQL, from the same source.
+ */
+const statementsToDdl = (statements: string[]): string => statements.map(s => `${s}\n`).join("");
+
+const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string =>
+    statementsToDdl(generatePolicyStatements(collection, rule, resolveCollection));
+
+/**
+ * The individual SQL statements a single security rule compiles to: a
+ * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+ * statement (terminated by `;`, no trailing newline).
+ *
+ * This is the primitive the boot-time RLS applier runs one statement at a time
+ * (the runtime's DB handle speaks the extended query protocol, which forbids
+ * multiple commands in one execute), while `db push` writes the joined string.
+ */
+export const generatePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection): string[] => {
     const tableName = getTableName(collection);
     const ops: readonly SecurityOperation[] = rule.operations && rule.operations.length > 0
         ? rule.operations
@@ -53,12 +78,12 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
 
     const policyNames = getPolicyNamesForRule(rule, tableName);
 
-    return ops.map((op, opIdx) => {
-        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
-    }).join("");
+    return ops.flatMap((op, opIdx) => {
+        return generateSinglePolicyStatements(collection, rule, op, policyNames[opIdx], resolveCollection);
+    });
 };
 
-const generateSinglePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string => {
+const generateSinglePolicyStatements = (collection: CollectionConfig, rule: SecurityRule, operation: SecurityOperation, policyName: string, resolveCollection: ResolveCollection): string[] => {
     const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
     const tableName = getTableName(collection);
     const mode = (rule.mode ?? "permissive").toUpperCase();
@@ -83,11 +108,12 @@ const generateSinglePolicyDdl = (collection: CollectionConfig, rule: SecurityRul
         withCheckClause = "false";
     }
 
-    let ddl = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";\n`;
-    ddl += `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `"${r}"`).join(", ")}`;
-    if (usingClause) ddl += ` USING (${usingClause})`;
-    if (withCheckClause) ddl += ` WITH CHECK (${withCheckClause})`;
-    return `${ddl};\n`;
+    const drop = `DROP POLICY IF EXISTS "${policyName}" ON "${schema}"."${tableName}";`;
+    let create = `CREATE POLICY "${policyName}" ON "${schema}"."${tableName}" AS ${mode} FOR ${operationUpper} TO ${pgRoles.map(r => `"${r}"`).join(", ")}`;
+    if (usingClause) create += ` USING (${usingClause})`;
+    if (withCheckClause) create += ` WITH CHECK (${withCheckClause})`;
+    create += ";";
+    return [drop, create];
 };
 
 export const getSqlColumnType = (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]): string => {
@@ -103,11 +129,15 @@ export const getSqlColumnType = (propName: string, prop: Property, collection: C
             if (stringProp.isId === "uuid" || stringProp.columnType === "uuid") {
                 return "UUID";
             }
+            // Width comes from `validation.max` when the property states one.
+            // It used to be a hardcoded 255 here and *absent* on the Drizzle
+            // path, so the same property produced a bounded column down one
+            // generator and an unbounded one down the other.
             if (stringProp.columnType === "char") {
-                return "CHAR(255)";
+                return `CHAR(${resolveStringColumnLength(stringProp)})`;
             }
             if (stringProp.columnType === "varchar") {
-                return "VARCHAR(255)";
+                return `VARCHAR(${resolveStringColumnLength(stringProp)})`;
             }
             // `text` is the default. The two generators disagreed here before:
             // this one emitted VARCHAR(255) while the drizzle path emitted a bare
@@ -470,6 +500,295 @@ export const generatePostgresDdl = async (
     return ddl;
 };
 
+/** The RLS statements one declared collection's table needs, ready to run. */
+/**
+ * A foreign key, as both its parts and the statement that creates it.
+ *
+ * `ALTER TABLE … ADD CONSTRAINT` has no `IF NOT EXISTS`, so a caller applying
+ * these has to skip by name — hence the name is a field and not only a substring
+ * of the SQL.
+ */
+export interface ForeignKeyPlan {
+    constraintName: string;
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    targetSchema: string;
+    targetTable: string;
+    targetColumn: string;
+    sql: string;
+}
+
+/** A column a `relation` or `reference` property owns on its own table. */
+export interface RelationalColumnPlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    /** Postgres type, exactly as the DDL generator declares it. */
+    type: string;
+    /** Absent when the target collection is not part of this bundle. */
+    foreignKey?: ForeignKeyPlan;
+}
+
+/** The table behind a many-to-many `through` relation. */
+export interface JunctionTablePlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    columns: { name: string; type: string }[];
+    /** Both endpoint columns plus the composite primary key. */
+    createTable: string;
+    foreignKeys: ForeignKeyPlan[];
+}
+
+const schemaOfCollection = (collection: CollectionConfig): string =>
+    isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+
+const bareTableName = (name: string): string => (name.includes(".") ? name.split(".").pop()! : name);
+
+const foreignKeyPlan = (
+    args: Omit<ForeignKeyPlan, "constraintName" | "sql"> & { onDelete: string; onUpdate?: string }
+): ForeignKeyPlan => {
+    const constraintName = `${args.table}_${args.column}_fkey`;
+    const onUpdate = args.onUpdate ? ` ON UPDATE ${args.onUpdate.toUpperCase()}` : "";
+    return {
+        constraintName,
+        schema: args.schema,
+        table: args.table,
+        column: args.column,
+        targetSchema: args.targetSchema,
+        targetTable: args.targetTable,
+        targetColumn: args.targetColumn,
+        sql:
+            `ALTER TABLE "${args.schema}"."${args.table}" ADD CONSTRAINT "${constraintName}" ` +
+            `FOREIGN KEY ("${args.column}") REFERENCES "${args.targetSchema}"."${args.targetTable}" ` +
+            `("${args.targetColumn}") ON DELETE ${args.onDelete.toUpperCase()}${onUpdate};`
+    };
+};
+
+/**
+ * The FK columns the declared collections own — one entry per `relation`
+ * (`belongsTo` side) or `reference` property.
+ *
+ * Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+ * create the same columns with the same names, types and constraints. Before
+ * this it skipped them outright, which was survivable only because `db push`
+ * always followed; on a managed tenant nothing follows, so a table arrived
+ * without the column its own collection reads and wrote 400 on every insert.
+ *
+ * A relation whose target is not in the bundle yields no column at all (the
+ * generator returns early on an unresolvable target); a `reference` whose target
+ * is unknown yields the column without a constraint. Both mirror the generator
+ * exactly — a divergence here is a schema fork between boot and `db push`.
+ */
+export const planRelationalColumns = (collections: CollectionConfig[]): RelationalColumnPlan[] => {
+    const plans: RelationalColumnPlan[] = [];
+
+    for (const collection of collections) {
+        const tableName = getTableName(collection);
+        if (!tableName) continue;
+        const schema = schemaOfCollection(collection);
+        const table = bareTableName(tableName);
+
+        for (const [propName, rawProp] of Object.entries(collection.properties ?? {})) {
+            const prop = rawProp as Property;
+
+            if (prop.type === "relation") {
+                const refProp = prop as RelationProperty;
+                const resolvedRelations = resolveCollectionRelations(collection);
+                const relInfo = findRelation(resolvedRelations, refProp.relation?.relationName ?? propName);
+                if (relInfo?.kind !== "belongsTo") continue;
+                // The relation and an explicit FK property can both be declared;
+                // the explicit one owns the column.
+                if (collection.properties[relInfo.localKey] && propName !== relInfo.localKey) continue;
+
+                let targetCollection: CollectionConfig;
+                try {
+                    targetCollection = relInfo.target();
+                } catch {
+                    continue;
+                }
+                if (!targetCollection) continue;
+
+                const required = prop.validation?.required;
+                plans.push({
+                    schema,
+                    table,
+                    column: relInfo.localKey,
+                    type: getSqlColumnType(propName, prop, collection, collections),
+                    foreignKey: foreignKeyPlan({
+                        schema,
+                        table,
+                        column: relInfo.localKey,
+                        targetSchema: schemaOfCollection(targetCollection),
+                        targetTable: bareTableName(getTableName(targetCollection)),
+                        targetColumn: getPrimaryKeyName(targetCollection),
+                        onDelete: relInfo.onDelete ?? (required ? "CASCADE" : "SET NULL"),
+                        onUpdate: relInfo.onUpdate
+                    })
+                });
+            } else if (prop.type === "reference") {
+                const refProp = prop as ReferenceProperty;
+                const targetCollection = collections.find(
+                    c => c.slug === refProp.path || getTableName(c) === refProp.path
+                );
+                const column = resolveColumnName(propName, prop);
+                const type = getSqlColumnType(propName, prop, collection, collections);
+                const required = prop.validation?.required;
+
+                plans.push({
+                    schema,
+                    table,
+                    column,
+                    type,
+                    foreignKey: targetCollection
+                        ? foreignKeyPlan({
+                            schema,
+                            table,
+                            column,
+                            targetSchema: schemaOfCollection(targetCollection),
+                            targetTable: bareTableName(getTableName(targetCollection)),
+                            targetColumn: getPrimaryKeyName(targetCollection),
+                            onDelete: required ? "CASCADE" : "SET NULL"
+                        })
+                        : undefined
+                });
+            }
+        }
+    }
+
+    return plans;
+};
+
+/**
+ * The junction tables a bundle's many-to-many relations imply.
+ *
+ * Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+ * comes from, so a table created here always has policies planned for it — a
+ * junction with row-level security left off is readable and writable by every
+ * signed-in user, which is why the two must ship together.
+ */
+export const planJunctionTables = (collections: CollectionConfig[]): JunctionTablePlan[] => {
+    const plans: JunctionTablePlan[] = [];
+
+    for (const spec of resolveJunctionSpecs(collections).values()) {
+        const [source, target] = spec.endpoints;
+        const columns = [
+            { name: source.junctionColumn, type: junctionKeyType(source.collection) },
+            { name: target.junctionColumn, type: junctionKeyType(target.collection) }
+        ];
+        // Every declaring side agrees on the edge's lifetime; the first one wins,
+        // as it does in the generator's walk.
+        const onDelete = spec.declaringSides[0]?.relation.onDelete ?? "CASCADE";
+
+        plans.push({
+            schema: spec.schema,
+            table: spec.table,
+            columns,
+            createTable:
+                `CREATE TABLE IF NOT EXISTS "${spec.schema}"."${spec.table}" (` +
+                columns.map(c => `"${c.name}" ${c.type} NOT NULL`).join(", ") +
+                `, PRIMARY KEY (${columns.map(c => `"${c.name}"`).join(", ")}));`,
+            foreignKeys: [source, target].map((endpoint, i) =>
+                foreignKeyPlan({
+                    schema: spec.schema,
+                    table: spec.table,
+                    column: columns[i].name,
+                    targetSchema: schemaOfCollection(endpoint.collection),
+                    targetTable: bareTableName(getTableName(endpoint.collection)),
+                    targetColumn: getPrimaryKeyName(endpoint.collection),
+                    onDelete
+                })
+            )
+        });
+    }
+
+    return plans;
+};
+
+export interface CollectionPolicyPlan {
+    /** The table's schema (e.g. `public`, `rebase`). */
+    schema: string;
+    /** The bare table name, no schema prefix. */
+    table: string;
+    /** `schema.table` — matches the keys `readExistingSchema` returns. */
+    qualified: string;
+    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */
+    enableRls: string;
+    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */
+    policyStatements: string[];
+}
+
+/**
+ * The per-table RLS plan for the *declared* collections, as executable
+ * statements — what the managed runtime applies at boot so a freshly
+ * provisioned tenant database serves data instead of 401ing every read.
+ *
+ * Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+ * `generatePolicyStatements`, same enable-RLS, same effective rules, same
+ * derived junction rules), so boot and `db push` produce identical policies from
+ * identical collections.
+ *
+ * Junction tables are included, and have to be: boot creates them now
+ * ({@link planJunctionTables}), and a junction with RLS left off is readable and
+ * writable by every signed-in user. A junction whose table is still absent is
+ * skipped by the applier, not planned away here.
+ */
+export const planCollectionPolicies = (collections: CollectionConfig[]): CollectionPolicyPlan[] => {
+    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+    const plans: CollectionPolicyPlan[] = [];
+    const seen = new Set<string>();
+
+    for (const collection of collections) {
+        const tableName = getTableName(collection);
+        if (!tableName) continue;
+        const schema = isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
+        const baseTableName = tableName.includes(".") ? tableName.split(".").pop()! : tableName;
+        const qualified = `${schema}.${baseTableName}`;
+        if (seen.has(qualified)) continue;
+        seen.add(qualified);
+
+        const policyStatements: string[] = [];
+        for (const rule of getEffectiveSecurityRules(collection)) {
+            policyStatements.push(...generatePolicyStatements(collection, rule, resolveCollection));
+        }
+
+        plans.push({
+            schema,
+            table: baseTableName,
+            qualified,
+            enableRls: `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;`,
+            policyStatements
+        });
+    }
+
+    // Junctions are derived from `through` relations rather than declared, so
+    // the walk above never sees them.
+    for (const spec of resolveJunctionSpecs(collections).values()) {
+        const qualified = `${spec.schema}.${spec.table}`;
+        if (seen.has(qualified)) continue;
+        seen.add(qualified);
+
+        const junctionCollection = getJunctionCollectionConfig(spec);
+        const policyStatements: string[] = [];
+        for (const rule of getJunctionSecurityRules(spec)) {
+            policyStatements.push(...generatePolicyStatements(junctionCollection, rule, resolveCollection));
+        }
+
+        plans.push({
+            schema: spec.schema,
+            table: spec.table,
+            qualified,
+            enableRls: `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;`,
+            policyStatements
+        });
+    }
+
+    return plans;
+};
+
 export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): string => {
     let ddl = "-- This file contains RLS policies generated by Rebase. Applied separately from migrations.\n\n";
 

package/src/schema/introspect-runtime.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from "@jest/globals";
+import { resolveCollectionRelations } from "@rebasepro/common";
+import type { CollectionConfig } from "@rebasepro/types";
 
 import { buildCollectionsFromSchema, introspectSchema, readRlsStatus, IntrospectedSchema, Queryable } from "./introspect-runtime";
 import { buildTablesMap, identifyJoinTables, TableColumn, ForeignKeyRow, PrimaryKeyRow } from "./introspect-db-logic";
@@ -121,14 +123,60 @@ describe("buildCollectionsFromSchema", () => {
         const props = posts.properties as any;
 
         expect(props.author_id).toBeUndefined();
-        expect(props.author).toEqual({
-            name: "Author",
-            type: "relation",
-            target: "authors",
-            cardinality: "one",
-            direction: "owning",
-            localKey: "author_id"
-        });
+        expect(props.author.name).toBe("Author");
+        expect(props.author.type).toBe("relation");
+        // The descriptor is nested under `relation`, carries `kind`, and its
+        // `target` is a thunk — see the resolvability test below for why none of
+        // those three are stylistic.
+        expect(props.author.relation).toMatchObject({ kind: "belongsTo", localKey: "author_id" });
+        expect(typeof props.author.relation.target).toBe("function");
+        expect(props.author.relation.target().slug).toBe("authors");
+    });
+
+    /**
+     * The shape has to be one the resolver actually reads.
+     *
+     * This path emitted `cardinality` / `direction` / a bare-string `target`
+     * flat on the property — the shape `Relation` stopped accepting, and the
+     * same drift `introspect-emits-valid-relations.test.ts` caught in the
+     * generated-file path and this one was missed by. Nothing threw:
+     * `resolveCollectionRelations` reads `property.relation`, found none, and
+     * reported a collection with no relations at all.
+     *
+     * The visible cost was writes. `assertKnownWriteFields` learns an owning
+     * relation's FK column from the *resolved* relation's `localKey`, and the FK
+     * column is deliberately absent from `properties` ("surfaces as a
+     * relation"), so with nothing resolving, `POST /api/data/orders` with
+     * `product_id` came back 400 `has no field 'product_id'` — the column was
+     * simultaneously the only way to set the relation and not a known field.
+     *
+     * Asserting the literal object is what let it drift, so this asserts
+     * through the resolver instead: a future reshape has to keep it resolvable,
+     * not merely keep the keys someone once wrote down.
+     */
+    it("emits a relation the resolver can read, so the fk column is writable", () => {
+        const schema = schemaOf(
+            [
+                column({ table_name: "products", column_name: "id", data_type: "integer", udt_name: "int4", is_nullable: "NO" }),
+                column({ table_name: "orders", column_name: "id", data_type: "integer", udt_name: "int4", is_nullable: "NO" }),
+                column({ table_name: "orders", column_name: "product_id", data_type: "integer", udt_name: "int4" })
+            ],
+            [
+                { table_name: "products", column_name: "id" },
+                { table_name: "orders", column_name: "id" }
+            ],
+            [{ table_name: "orders", column_name: "product_id", foreign_table_name: "products", foreign_column_name: "id" }]
+        );
+
+        const orders = buildCollectionsFromSchema(schema, "public").find((c) => c.slug === "orders")!;
+        const resolved = resolveCollectionRelations(orders as unknown as CollectionConfig);
+
+        expect(Object.keys(resolved)).toEqual(["product"]);
+        expect(resolved.product.kind).toBe("belongsTo");
+        // `localKey` is the field `assertKnownWriteFields` adds to the known set,
+        // which is what makes `product_id` writable. The write itself is covered
+        // end-to-end by `scripts/smoke-baas.ts` against a real database.
+        expect((resolved.product as { localKey: string }).localKey).toBe("product_id");
     });
 
     it("skips join tables — they are an edge between collections, not a collection", () => {

package/src/schema/introspect-runtime.ts

@@ -207,13 +207,30 @@ function buildProperties(
 }
 
 /**
- * Owning relations, derived from this table's foreign keys. Mirrors the shape
- * `generateCollectionFile` emits, except `target` uses the slug string form
- * rather than a thunk to a module import.
+ * Owning relations, derived from this table's foreign keys — the same shape
+ * `generateCollectionFile` writes into a collection file: a `relation` property
+ * whose nested descriptor carries `kind`, a `target` thunk and the `localKey`.
+ *
+ * The shape is load-bearing, not cosmetic. `resolveCollectionRelations` reads
+ * relations from `property.relation` and `resolveRelation` requires `target` to
+ * be a thunk; this used to emit `target`/`cardinality`/`localKey` flat on the
+ * property with the slug as a bare string, which satisfies neither. Nothing
+ * threw — the resolver simply skipped every such property and reported that the
+ * collection had no relations. So an introspected BaaS collection had its FK
+ * columns removed from `properties` (they "surface as relations") and then no
+ * resolvable relation to surface as, which is why writing the FK column
+ * directly came back as `has no field 'product_id'`: `assertKnownWriteFields`
+ * learns that column from the resolved relation's `localKey`.
+ *
+ * The thunk closes over the collections being built in this same pass rather
+ * than importing a module, which is what a runtime introspection has instead of
+ * generated files. It is called lazily, after the map is fully populated, so a
+ * table may reference one introspected later.
  */
 function buildRelations(
     meta: TableMeta,
-    slugByTable: Map<string, string>
+    slugByTable: Map<string, string>,
+    collectionBySlug: Map<string, PostgresCollectionConfig>
 ): Record<string, Record<string, unknown>> {
     const relations: Record<string, Record<string, unknown>> = {};
 
@@ -233,10 +250,11 @@ function buildRelations(
         relations[key] = {
             name: humanize(key),
             type: "relation",
-            target: targetSlug,
-            cardinality: "one",
-            direction: "owning",
-            localKey: fk.column_name
+            relation: {
+                kind: "belongsTo",
+                target: () => collectionBySlug.get(targetSlug),
+                localKey: fk.column_name
+            }
         };
     }
 
@@ -259,6 +277,9 @@ export function buildCollectionsFromSchema(
     }
 
     const collections: PostgresCollectionConfig[] = [];
+    // Filled as we go; the relation thunks read it lazily, so a table may point
+    // at one that has not been built yet at the moment its relation is created.
+    const collectionBySlug = new Map<string, PostgresCollectionConfig>();
 
     for (const [tableName, meta] of tablesMap) {
         if (joinTables.has(tableName)) continue;
@@ -273,11 +294,12 @@ export function buildCollectionsFromSchema(
             icon: getIconForTable(tableName),
             properties: {
                 ...buildProperties(meta, enumMap),
-                ...buildRelations(meta, slugByTable)
+                ...buildRelations(meta, slugByTable, collectionBySlug)
             }
         } as unknown as PostgresCollectionConfig;
 
         collections.push(collection);
+        collectionBySlug.set(tableName, collection);
     }
 
     return collections;

package/src/services/RelationService.ts

@@ -18,6 +18,39 @@ import { PostgresCollectionRegistry } from "../collections/PostgresCollectionReg
 import { logger } from "@rebasepro/server";
 import type { NestedPathHop } from "./nested-path";
 
+/**
+ * The ids in a to-many relation write, whatever shape the caller sent.
+ *
+ * A membership list is written as either the related rows (`[{ id: 1 }]`, what
+ * the admin UI sends back after reading them) or as bare keys (`[1]`, `["t-1"]`,
+ * what anyone writing the API by hand sends). Only the first was read, via a
+ * blind `.map(rel => rel.id)`, and a bare key therefore became `undefined`:
+ * on a numeric-keyed target that surfaced as `Invalid numeric ID: undefined`,
+ * and on a string-keyed one it did not surface at all — `String(undefined)`
+ * wrote a junction row pointing at the literal `"undefined"`, which no read
+ * would ever match. Both shapes are accepted here, in one place, because both
+ * call sites had the same assumption.
+ *
+ * An element that carries no key is refused rather than skipped: dropping it
+ * would silently write a shorter membership list than the caller asked for.
+ */
+function relationTargetIds(value: unknown, relationName: string, collectionSlug: string): (string | number)[] {
+    if (!Array.isArray(value)) return [];
+
+    return value.map((element, index) => {
+        if (typeof element === "string" || typeof element === "number") return element;
+        if (element && typeof element === "object") {
+            const id = (element as { id?: unknown }).id;
+            if (typeof id === "string" || typeof id === "number") return id;
+        }
+        throw new Error(
+            `Cannot write relation "${relationName}" on "${collectionSlug}": element ${index} carries no id. ` +
+            "Pass either the related rows (`[{ id: … }]`) or their keys (`[1, 2]`), not " +
+            `${element === null ? "null" : typeof element}.`
+        );
+    });
+}
+
 /**
  * Typed wrapper for Drizzle dynamic query innerJoin.
  * Drizzle's `$dynamic()` queries lose the `innerJoin` method from
@@ -840,7 +873,7 @@ export class RelationService {
             const relation = findRelation(resolvedRelations, key);
             if (!relation || relation.cardinality !== "many") continue;
 
-            const targetEntityIds = (value && Array.isArray(value)) ? value.map((rel: { id: string | number }) => rel.id) : [];
+            const targetEntityIds = relationTargetIds(value, key, collection.slug);
             const targetCollection = relation.target();
 
             // Use joinPath if available
@@ -1166,7 +1199,9 @@ export class RelationService {
                 if (newValue && Array.isArray(newValue) && newValue.length > 0) {
                     const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                     const targetIdInfo = targetPks[0];
-                    const targetEntityIds = (newValue as Array<{ id: string | number } | string | number>).map((rel) => typeof rel === "object" && rel !== null ? rel.id : rel);
+                    // This path already read both shapes; the other two did not.
+                    // Same helper now, so the three cannot drift again.
+                    const targetEntityIds = relationTargetIds(newValue, relation.relationName, sourceCollection.slug);
                     const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 
                     const newLinks = parsedTargetIds.map(targetId => ({
@@ -1238,7 +1273,7 @@ export class RelationService {
             if (newValue && Array.isArray(newValue) && newValue.length > 0) {
                 const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                 const targetIdInfo = targetPks[0];
-                const targetEntityIds = (newValue as Array<{ id: string | number }>).map((rel) => rel.id);
+                const targetEntityIds = relationTargetIds(newValue, relation.relationName, sourceCollection.slug);
                 const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
 
                 const newLinks = parsedTargetIds.map(targetId => ({

package/src/services/realtimeService.ts

@@ -4,7 +4,7 @@ import { Client as PgClient } from "pg";
 import { randomUUID } from "crypto";
 import { DataService } from "./dataService";
 
-import { FetchCollectionProps, ListenCollectionProps, ListenOneProps, DataDriver, CollectionUpdateMessage, SingleUpdateMessage, CollectionPatchMessage, WebSocketMessage, FilterValues, CollectionConfig, RebaseCallContext, resolveClientListLimit } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, FetchCollectionProps, ListenCollectionProps, ListenOneProps, DataDriver, CollectionUpdateMessage, SingleUpdateMessage, CollectionPatchMessage, WebSocketMessage, FilterValues, CollectionConfig, RebaseCallContext, resolveClientListLimit } from "@rebasepro/types";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { sql as drizzleSql } from "drizzle-orm";
 import { RealtimeProvider, CollectionSubscriptionConfig, SingleSubscriptionConfig } from "../interfaces";
@@ -751,7 +751,7 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
             // Always wrap in a transaction with session vars, defaulting to anonymous context if missing.
             // Refetches are reads: apply the same GUCs + reader-role downgrade as the
             // driver's read path, so realtime cannot leak rows the initial fetch hid.
-            const activeAuth = authContext || { uid: "anon",
+            const activeAuth = authContext || { uid: ANONYMOUS_USER_ID,
 roles: ["anon"] };
             return await this.db.transaction(async (tx) => {
                 await applyAuthContext(tx, { uid: activeAuth.uid, roles: activeAuth.roles }, this.rlsUserRole);
@@ -931,7 +931,7 @@ roles: activeAuth.roles },
 
             // Always wrap in a transaction with session vars, defaulting to anonymous context if missing.
             // Same read isolation as collection refetches: GUCs + reader-role downgrade.
-            const activeAuth = authContext || { uid: "anon",
+            const activeAuth = authContext || { uid: ANONYMOUS_USER_ID,
 roles: ["anon"] };
             return await this.db.transaction(async (tx) => {
                 await applyAuthContext(tx, { uid: activeAuth.uid, roles: activeAuth.roles }, this.rlsUserRole);