@rebasepro/server-postgres 0.12.0 → 0.12.1-canary.g181d0fe

package/dist/schema/ensure-collection-policies.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Applying a bundle's RLS policies to a database at boot, idempotently.
+ *
+ * ## Why this exists
+ *
+ * {@link ensureCollectionTables} creates the collection *tables* a managed
+ * runtime boots against, but a table with row-level security disabled and no
+ * policies is not servable: authenticated requests run as the restricted
+ * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a
+ * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy
+ * is denied. The policies live in the collections' `securityRules`; nothing at
+ * boot applied them. `rebase db push` does — but it drives Atlas against a
+ * local `DATABASE_URL`, and a managed tenant's database is reachable only from
+ * inside the cluster, by the runtime that is already connected to it. So the
+ * runtime is the only thing that *can* apply them, and this is where it does.
+ *
+ * ## Why this is safe to run on every boot
+ *
+ * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once
+ * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by
+ * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds
+ * and replaces; it never drops data. (It does not *reconcile* — a policy a
+ * previous push left behind under an old name is not removed here; that stays a
+ * `db push` / `db migrate` concern, alongside destructive schema changes.)
+ *
+ * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a
+ * table whose policies could not be applied fails **closed** (denies) rather
+ * than leaking rows. One collection's policy failing (e.g. a rule that
+ * references a table a real migration has not created yet) must not crash-loop
+ * the whole deployment and take the other collections' working routes down with
+ * it. Failures are reported loudly and per-table so the operator can see
+ * exactly which collection is not yet servable and why.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import { type Queryable } from "./ensure-collection-tables";
+export interface PolicyEnsureResult {
+    /** `CREATE POLICY` statements that ran successfully. */
+    policiesApplied: number;
+    /** Tables that had RLS enabled. */
+    tablesSecured: number;
+    /** Declared tables absent from the database — left to a real migration. */
+    skipped: {
+        table: string;
+        reason: string;
+    }[];
+    /** Tables whose RLS could not be fully applied (fail closed). */
+    failures: {
+        table: string;
+        error: string;
+    }[];
+}
+/**
+ * Bring the declared collections' RLS policies up to date. Returns what it did.
+ *
+ * Only tables that already exist are touched: the boot-time table creator runs
+ * first, so anything still missing is a table this additive path is not allowed
+ * to create (a junction, or a relation left to a migration). Enabling RLS on a
+ * non-existent table would error, so those are recorded as skipped, not failed.
+ */
+export declare function ensureCollectionPolicies(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<PolicyEnsureResult>;

package/dist/schema/generate-postgres-ddl-logic.d.ts

@@ -1,8 +1,50 @@
-import { CollectionConfig, Property } from "@rebasepro/types";
+import { CollectionConfig, Property, SecurityRule } from "@rebasepro/types";
 export declare const resolveColumnName: (propName: string, prop?: Property | null) => string;
 export declare const isIdProperty: (propName: string, prop: Property, collection: CollectionConfig) => boolean;
+type ResolveCollection = (slug: string) => CollectionConfig | undefined;
+/**
+ * The individual SQL statements a single security rule compiles to: a
+ * `DROP POLICY IF EXISTS` / `CREATE POLICY` pair per operation, each a complete
+ * statement (terminated by `;`, no trailing newline).
+ *
+ * This is the primitive the boot-time RLS applier runs one statement at a time
+ * (the runtime's DB handle speaks the extended query protocol, which forbids
+ * multiple commands in one execute), while `db push` writes the joined string.
+ */
+export declare const generatePolicyStatements: (collection: CollectionConfig, rule: SecurityRule, resolveCollection: ResolveCollection) => string[];
 export declare const getSqlColumnType: (propName: string, prop: Property, collection: CollectionConfig, collections: CollectionConfig[]) => string;
 export declare const generatePostgresDdl: (collections: CollectionConfig[], options?: {
     includePolicies?: boolean;
 }) => Promise<string>;
+/** The RLS statements one declared collection's table needs, ready to run. */
+export interface CollectionPolicyPlan {
+    /** The table's schema (e.g. `public`, `rebase`). */
+    schema: string;
+    /** The bare table name, no schema prefix. */
+    table: string;
+    /** `schema.table` — matches the keys `readExistingSchema` returns. */
+    qualified: string;
+    /** `ALTER TABLE … ENABLE ROW LEVEL SECURITY;` — locked by default. */
+    enableRls: string;
+    /** `DROP POLICY IF EXISTS` / `CREATE POLICY` statements, in order. */
+    policyStatements: string[];
+}
+/**
+ * The per-table RLS plan for the *declared* collections, as executable
+ * statements — what the managed runtime applies at boot so a freshly
+ * provisioned tenant database serves data instead of 401ing every read.
+ *
+ * Mirrors the non-junction half of {@link generatePostgresPoliciesDdl} exactly
+ * (same `generatePolicyStatements`, same enable-RLS, same effective rules), so
+ * boot and `db push` produce identical policies from identical collections.
+ *
+ * Junction tables are deliberately excluded: they are derived from `through`
+ * relations, not declared collections, and the boot-time *table* creator
+ * (`ensureCollectionTables`) does not create them either — enabling RLS on a
+ * table that boot never created would fail. Their RLS stays a `db push` /
+ * `db migrate` concern, which is where those tables get created in the first
+ * place. `db push` still applies junction policies via the string generator.
+ */
+export declare const planCollectionPolicies: (collections: CollectionConfig[]) => CollectionPolicyPlan[];
 export declare const generatePostgresPoliciesDdl: (collections: CollectionConfig[]) => string;
+export {};

package/dist/{src-BbFOPJ1S.js → src-DihrDFuP.js}

@@ -1,8 +1,135 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { a as policy, c as getDeclaredSubcollections, f as getDataSourceCapabilities, g as EntityRelation, h as toCanonicalOp, i as ANONYMOUS_USER_ID, l as isPostgresCollectionConfig, m as REST_TO_CANONICAL, p as NULL_OPS, s as isManyToMany, u as isRelationalCollectionConfig } from "./src-Zqwaw3P5.js";
+import { c as __require, o as __commonJSMin } from "./connection-B5Wndbr1.js";
+import { a as getDataSourceCapabilities, c as toCanonicalOp, n as isPostgresCollectionConfig, o as NULL_OPS, r as isRelationalCollectionConfig, s as REST_TO_CANONICAL, t as getDeclaredSubcollections } from "./src-DoU9yPqq.js";
+//#region ../types/src/types/entities.ts
+/**
+* Class used to create a reference to a entity in a different path
+*/
+var EntityRelation = class {
+	__type = "relation";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Pre-fetched data payload to eliminate N+1 queries.
+	* When present, clients can use this directly instead of fetching.
+	*/
+	data;
+	constructor(id, path, data) {
+		this.id = id;
+		this.path = path;
+		this.data = data;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	isEntityReference() {
+		return false;
+	}
+	isEntityRelation() {
+		return true;
+	}
+};
+var Vector = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+};
+//#endregion
+//#region ../types/src/types/relations.ts
+/** @group Models */
+function hasForeignKeyOnTarget(relation) {
+	return relation.kind === "hasOne" || relation.kind === "hasMany";
+}
+/** @group Models */
+function isManyToMany(relation) {
+	return relation.kind === "manyToMany";
+}
+//#endregion
+//#region ../types/src/types/policy.ts
+/**
+* The id a request without a logged-in user reports as `auth.uid()`.
+*
+* A user-context request always sets `app.uid`: blank would read back as
+* `NULL`, and `NULL` is how the trusted server context is recognised, so an
+* anonymous visitor would be promoted to server privileges. The driver
+* therefore substitutes this sentinel at the single chokepoint where the GUC
+* is set.
+*
+* The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+* tautology on the user path** — it is true for anonymous visitors too. Use
+* {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
+* in", and {@link policy.serverContext} to mean "the trusted server context".
+*
+* @group Models
+*/
+var ANONYMOUS_USER_ID = "anonymous";
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	serverContext: () => ({ kind: "serverContext" }),
+	existsIn: (args) => ({
+		kind: "existsIn",
+		collection: args.collection,
+		where: args.where
+	}),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	outerField: (name) => ({
+		kind: "outerField",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
+//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -2016,75 +2143,6 @@ function rolesArraySql(roles) {
 	return `ARRAY[${[...roles].sort().map((r) => `'${r}'`).join(",")}]`;
 }
 //#endregion
-//#region ../common/src/util/callbacks.ts
-/**
-* Helper function to recursively check if there are any callbacks in the properties.
-*/
-function hasPropertyCallbacks(properties, callbackName) {
-	if (!properties) return false;
-	for (const property of Object.values(properties)) {
-		if (property.callbacks?.[callbackName]) return true;
-		if (property.type === "map" && property.properties) {
-			if (hasPropertyCallbacks(property.properties, callbackName)) return true;
-		} else if (property.type === "array" && property.of) {
-			const ofs = Array.isArray(property.of) ? property.of : [property.of];
-			for (const of of ofs) {
-				if (of.callbacks?.[callbackName]) return true;
-				if (of.type === "map" && of.properties && hasPropertyCallbacks(of.properties, callbackName)) return true;
-			}
-		}
-	}
-	return false;
-}
-/**
-* Recursively process properties to apply field-level hooks.
-*/
-async function processProperties(properties, values, previousValues, propsContext, callbackName) {
-	if (!values || typeof values !== "object") return values;
-	const result = { ...values };
-	for (const [key, property] of Object.entries(properties)) {
-		if (result[key] === void 0) continue;
-		let currentValue = result[key];
-		const previousValue = previousValues?.[key];
-		if (property.type === "array" && Array.isArray(currentValue)) {
-			if (property.of && !Array.isArray(property.of)) currentValue = await Promise.all(currentValue.map(async (item, index) => {
-				const prevItem = Array.isArray(previousValue) ? previousValue[index] : void 0;
-				return (await processProperties({ "_tmp": property.of }, { "_tmp": item }, { "_tmp": prevItem }, propsContext, callbackName))["_tmp"];
-			}));
-		} else if (property.type === "map" && property.properties && typeof currentValue === "object") currentValue = await processProperties(property.properties, currentValue, previousValue ?? {}, propsContext, callbackName);
-		if (property.callbacks?.[callbackName]) {
-			const cbRes = await Promise.resolve(property.callbacks[callbackName]({
-				...propsContext,
-				value: currentValue,
-				previousValue
-			}));
-			if (cbRes !== void 0) currentValue = cbRes;
-		}
-		result[key] = currentValue;
-	}
-	return result;
-}
-/**
-* Helper function to extract field-level PropertyCallbacks from a properties schema
-* and wrap them into an CollectionCallbacks object recursively.
-*/
-var buildPropertyCallbacks = (properties) => {
-	if (!properties) return void 0;
-	const propertyCallbacks = {};
-	if (hasPropertyCallbacks(properties, "afterRead")) propertyCallbacks.afterRead = async (props) => {
-		const row = props.row;
-		const processedValues = await processProperties(properties, row, row, props, "afterRead");
-		return {
-			...props.row,
-			...processedValues
-		};
-	};
-	if (hasPropertyCallbacks(properties, "beforeSave")) propertyCallbacks.beforeSave = async (props) => {
-		return await processProperties(properties, props.values, props.previousValues ?? {}, props, "beforeSave");
-	};
-	return Object.keys(propertyCallbacks).length > 0 ? propertyCallbacks : void 0;
-};
-//#endregion
 //#region ../common/src/util/auth-default-policies.ts
 /**
 * Default RLS policies injected by the schema generator.
@@ -2659,10 +2717,27 @@ function getJunctionSecurityRules(spec) {
 	});
 })))();
 /**
-* Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
+* How wide a `varchar`/`char` column should be for a given property.
+*
+* One definition, three call sites, because they used to disagree. For the same
+* `columnType: "varchar"` property the DDL generator emitted `VARCHAR(255)`
+* while the Drizzle generator emitted a bare `varchar("col")` — which Postgres
+* reads as *unbounded* — so which of the two you ran decided whether the column
+* had a limit at all. Introspection then dropped the length entirely, so reading
+* an existing `character varying(500)` column back and regenerating it produced
+* a `VARCHAR(255)`: a silent narrowing of a column with data already in it.
+*
+* `validation.max` is the property's own statement about how long the value may
+* be, so it is the only sensible source for the column's width — and it keeps
+* the constraint the database enforces in step with the one the app enforces,
+* rather than inventing a second, different limit underneath it.
 */
+function resolveStringColumnLength(prop) {
+	const max = prop.validation?.max;
+	return typeof max === "number" && Number.isInteger(max) && max > 0 ? max : 255;
+}
 //#endregion
-//#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
+//#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
 /**
@@ -2698,7 +2773,8 @@ function createIsCircular(areItemsEqual) {
 * not enumerable and symbol properties.
 */
 function getStrictProperties(object) {
-	return getOwnPropertyNames(object).concat(getOwnPropertySymbols(object));
+	const symbols = getOwnPropertySymbols(object);
+	return symbols.length ? getOwnPropertyNames(object).concat(symbols) : getOwnPropertyNames(object);
 }
 /**
 * Whether the object contains the property passed as an own property.
@@ -2771,7 +2847,7 @@ function areMapsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.entries();
 	let aResult;
 	let bResult;
@@ -2779,7 +2855,7 @@ function areMapsEqual(a, b, state) {
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.entries();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
@@ -2790,7 +2866,7 @@ function areMapsEqual(a, b, state) {
 			const aEntry = aResult.value;
 			const bEntry = bResult.value;
 			if (state.equals(aEntry[0], bEntry[0], index, matchIndex, a, b, state) && state.equals(aEntry[1], bEntry[1], aEntry[0], bEntry[0], a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2848,19 +2924,19 @@ function areSetsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.values();
 	let aResult;
 	let bResult;
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.values();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
 			if (!matchedIndices[matchIndex] && state.equals(aResult.value, bResult.value, aResult.value, bResult.value, a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -2873,8 +2949,8 @@ function areSetsEqual(a, b, state) {
 * Whether the TypedArray instances are equal in value.
 */
 function areTypedArraysEqual(a, b) {
-	let index = a.byteLength;
-	if (b.byteLength !== index || a.byteOffset !== b.byteOffset) return false;
+	let index = a.length;
+	if (b.length !== index || a.byteOffset !== b.byteOffset) return false;
 	while (index-- > 0) if (a[index] !== b[index]) return false;
 	return true;
 }
@@ -4102,72 +4178,6 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-//#region ../common/src/table-classification.ts
-/** Schemas that are always considered Rebase-internal. */
-var REBASE_INTERNAL_SCHEMAS = ["rebase", "auth"];
-/** Table-name prefixes that mark a table as Rebase-internal regardless of schema. */
-var REBASE_INTERNAL_PREFIXES = [
-	"_rebase_",
-	"_auth_",
-	"drizzle_"
-];
-/**
-* Synchronously classify a table based on naming conventions.
-*
-* @param tableName  - The unqualified name of the table.
-* @param schemaName - The schema the table belongs to (e.g. `"public"`, `"rebase"`).
-* @returns `"rebase-internal"` when the table belongs to a reserved schema or
-*          carries a reserved prefix; `"user"` otherwise.
-*
-* @remarks
-* Junction-table detection requires an async database query and is therefore
-* **not** handled by this function. Use {@link detectJunctionTables} to obtain
-* the set of junction tables, then reclassify as needed.
-*/
-function classifyTable(tableName, schemaName) {
-	if (REBASE_INTERNAL_SCHEMAS.includes(schemaName) || REBASE_INTERNAL_PREFIXES.some((prefix) => tableName.startsWith(prefix))) return "rebase-internal";
-	return "user";
-}
-/** SQL query that detects junction tables in the `public` schema. */
-var JUNCTION_TABLES_SQL = `
-  SELECT t.table_name
-  FROM information_schema.tables t
-  WHERE t.table_schema = 'public'
-    AND t.table_type = 'BASE TABLE'
-    AND NOT EXISTS (
-      SELECT 1
-      FROM information_schema.columns c
-      WHERE c.table_schema = t.table_schema
-        AND c.table_name = t.table_name
-        AND c.column_name NOT IN (
-          SELECT kcu.column_name
-          FROM information_schema.key_column_usage kcu
-          JOIN information_schema.table_constraints tc
-            ON tc.constraint_name = kcu.constraint_name
-            AND tc.table_schema = kcu.table_schema
-          WHERE tc.constraint_type = 'FOREIGN KEY'
-            AND kcu.table_schema = t.table_schema
-            AND kcu.table_name = t.table_name
-        )
-    )
-`;
-/**
-* Asynchronously detect junction (link) tables in the `public` schema.
-*
-* A junction table is defined as a table where **every** column participates in
-* at least one foreign-key constraint.
-*
-* @param executeSql - A callback that executes a raw SQL string and returns the
-*                     resulting rows.
-* @returns A `Set` containing the names of all detected junction tables.
-*/
-async function detectJunctionTables(executeSql) {
-	const rows = await executeSql(JUNCTION_TABLES_SQL);
-	const junctionTables = /* @__PURE__ */ new Set();
-	for (const row of rows) if (typeof row.table_name === "string") junctionTables.add(row.table_name);
-	return junctionTables;
-}
-//#endregion
-export { toSnakeCase as A, createRelationRefWithData as C, getPolicyNamesForRule as D, generateForeignKeyName as E, DEFAULT_ONE_OF_VALUE as M, mergeDeep as O, createRelationRef as S, updateDateAutoValues as T, getTableVarName as _, getJunctionCollectionConfig as a, getDeclaredPrimaryKeys as b, getEffectiveSecurityRules as c, securityRuleToConditions as d, findAnonymousGrants as f, getTableName as g, getEnumVarName as h, CollectionRegistry as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, buildPropertyCallbacks as l, getColumnName as m, detectJunctionTables as n, getJunctionSecurityRules as o, findRelation as p, buildSdkData as r, resolveJunctionSpecs as s, classifyTable as t, policyToPostgres as u, resolveCollectionRelations as v, normalizeToEntityRelation as w, parseIdValues as x, buildCompositeId as y };
+export { DEFAULT_ONE_OF_VALUE as A, updateDateAutoValues as C, camelCase as D, mergeDeep as E, hasForeignKeyOnTarget as M, isManyToMany as N, toSnakeCase as O, Vector as P, normalizeToEntityRelation as S, getPolicyNamesForRule as T, buildCompositeId as _, getJunctionSecurityRules as a, createRelationRef as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, ANONYMOUS_USER_ID as j, DEFAULT_ONE_OF_TYPE as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, generateForeignKeyName as w, createRelationRefWithData as x, parseIdValues as y };
 
-//# sourceMappingURL=src-BbFOPJ1S.js.map
+//# sourceMappingURL=src-DihrDFuP.js.map