@rebasepro/server-postgres 0.12.1-canary.g181d0fe → 0.12.1-canary.g35be8cb

package/dist/schema/ensure-collection-tables.d.ts

@@ -46,9 +46,17 @@ export interface ExistingSchema {
     tables: Map<string, Set<string>>;
     /** `schema.typename` of every enum type that already exists. */
     enums: Set<string>;
+    /**
+     * `schema.table.constraint` of every constraint that already exists.
+     *
+     * Optional so a caller that only cares about tables can still build one by
+     * hand; absent is read as "none known", which at worst re-attempts a
+     * constraint that then fails harmlessly as a duplicate.
+     */
+    constraints?: Set<string>;
 }
 export interface EnsureAction {
-    kind: "create-enum" | "create-table" | "add-column";
+    kind: "create-enum" | "create-table" | "add-column" | "add-constraint";
     /** Qualified target, for logging: `public.posts` or `public.posts.title`. */
     target: string;
     sql: string;
@@ -58,6 +66,20 @@ export interface EnsurePlan {
     /** Every statement, in dependency order. Empty when the schema is current. */
     statements: string[];
 }
+export interface EnsureOutcome extends EnsurePlan {
+    /**
+     * Constraints that could not be added — always non-fatal.
+     *
+     * A foreign key can only fail on data that already violates it, and the
+     * column it would police exists either way, so the collection still serves.
+     * Refusing to boot over one would turn a pre-existing data problem into an
+     * outage. Reported loudly instead.
+     */
+    failures: {
+        target: string;
+        error: string;
+    }[];
+}
 /**
  * Decide what to add. Pure — the caller supplies what exists and runs the result.
  *
@@ -76,4 +98,4 @@ export declare function readExistingSchema(client: Queryable, schemas: string[])
  * cannot be added, say) should not roll back the tables that were created fine.
  * The error is surfaced with the statement that caused it.
  */
-export declare function ensureCollectionTables(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<EnsurePlan>;
+export declare function ensureCollectionTables(client: Queryable, collections: CollectionConfig[], log?: (message: string) => void): Promise<EnsureOutcome>;

package/dist/schema/generate-postgres-ddl-logic.d.ts

@@ -1,5 +1,12 @@
 import { CollectionConfig, Property, SecurityRule } from "@rebasepro/types";
 export declare const resolveColumnName: (propName: string, prop?: Property | null) => string;
+export declare const getPrimaryKeyProp: (collection: CollectionConfig) => {
+    name: string;
+    type: "string" | "number";
+    isUuid: boolean;
+};
+export declare const isNumericId: (collection: CollectionConfig) => boolean;
+export declare const getPrimaryKeyName: (collection: CollectionConfig) => string;
 export declare const isIdProperty: (propName: string, prop: Property, collection: CollectionConfig) => boolean;
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 /**
@@ -17,6 +24,73 @@ export declare const generatePostgresDdl: (collections: CollectionConfig[], opti
     includePolicies?: boolean;
 }) => Promise<string>;
 /** The RLS statements one declared collection's table needs, ready to run. */
+/**
+ * A foreign key, as both its parts and the statement that creates it.
+ *
+ * `ALTER TABLE … ADD CONSTRAINT` has no `IF NOT EXISTS`, so a caller applying
+ * these has to skip by name — hence the name is a field and not only a substring
+ * of the SQL.
+ */
+export interface ForeignKeyPlan {
+    constraintName: string;
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    targetSchema: string;
+    targetTable: string;
+    targetColumn: string;
+    sql: string;
+}
+/** A column a `relation` or `reference` property owns on its own table. */
+export interface RelationalColumnPlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    column: string;
+    /** Postgres type, exactly as the DDL generator declares it. */
+    type: string;
+    /** Absent when the target collection is not part of this bundle. */
+    foreignKey?: ForeignKeyPlan;
+}
+/** The table behind a many-to-many `through` relation. */
+export interface JunctionTablePlan {
+    schema: string;
+    /** Bare table name, no schema prefix. */
+    table: string;
+    columns: {
+        name: string;
+        type: string;
+    }[];
+    /** Both endpoint columns plus the composite primary key. */
+    createTable: string;
+    foreignKeys: ForeignKeyPlan[];
+}
+/**
+ * The FK columns the declared collections own — one entry per `relation`
+ * (`belongsTo` side) or `reference` property.
+ *
+ * Split out of {@link generatePostgresDdl} so the boot-time schema ensure can
+ * create the same columns with the same names, types and constraints. Before
+ * this it skipped them outright, which was survivable only because `db push`
+ * always followed; on a managed tenant nothing follows, so a table arrived
+ * without the column its own collection reads and wrote 400 on every insert.
+ *
+ * A relation whose target is not in the bundle yields no column at all (the
+ * generator returns early on an unresolvable target); a `reference` whose target
+ * is unknown yields the column without a constraint. Both mirror the generator
+ * exactly — a divergence here is a schema fork between boot and `db push`.
+ */
+export declare const planRelationalColumns: (collections: CollectionConfig[]) => RelationalColumnPlan[];
+/**
+ * The junction tables a bundle's many-to-many relations imply.
+ *
+ * Derived from {@link resolveJunctionSpecs}, the same source the junction RLS
+ * comes from, so a table created here always has policies planned for it — a
+ * junction with row-level security left off is readable and writable by every
+ * signed-in user, which is why the two must ship together.
+ */
+export declare const planJunctionTables: (collections: CollectionConfig[]) => JunctionTablePlan[];
 export interface CollectionPolicyPlan {
     /** The table's schema (e.g. `public`, `rebase`). */
     schema: string;
@@ -34,16 +108,15 @@ export interface CollectionPolicyPlan {
  * statements — what the managed runtime applies at boot so a freshly
  * provisioned tenant database serves data instead of 401ing every read.
  *
- * Mirrors the non-junction half of {@link generatePostgresPoliciesDdl} exactly
- * (same `generatePolicyStatements`, same enable-RLS, same effective rules), so
- * boot and `db push` produce identical policies from identical collections.
+ * Mirrors {@link generatePostgresPoliciesDdl} exactly (same
+ * `generatePolicyStatements`, same enable-RLS, same effective rules, same
+ * derived junction rules), so boot and `db push` produce identical policies from
+ * identical collections.
  *
- * Junction tables are deliberately excluded: they are derived from `through`
- * relations, not declared collections, and the boot-time *table* creator
- * (`ensureCollectionTables`) does not create them either — enabling RLS on a
- * table that boot never created would fail. Their RLS stays a `db push` /
- * `db migrate` concern, which is where those tables get created in the first
- * place. `db push` still applies junction policies via the string generator.
+ * Junction tables are included, and have to be: boot creates them now
+ * ({@link planJunctionTables}), and a junction with RLS left off is readable and
+ * writable by every signed-in user. A junction whose table is still absent is
+ * skipped by the applier, not planned away here.
  */
 export declare const planCollectionPolicies: (collections: CollectionConfig[]) => CollectionPolicyPlan[];
 export declare const generatePostgresPoliciesDdl: (collections: CollectionConfig[]) => string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.12.1-canary.g181d0fe",
+  "version": "0.12.1-canary.g35be8cb",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/codegen": "0.12.1-canary.g181d0fe",
-    "@rebasepro/common": "0.12.1-canary.g181d0fe",
-    "@rebasepro/server": "0.12.1-canary.g181d0fe",
-    "@rebasepro/types": "0.12.1-canary.g181d0fe",
-    "@rebasepro/utils": "0.12.1-canary.g181d0fe"
+    "@rebasepro/codegen": "0.12.1-canary.g35be8cb",
+    "@rebasepro/server": "0.12.1-canary.g35be8cb",
+    "@rebasepro/types": "0.12.1-canary.g35be8cb",
+    "@rebasepro/utils": "0.12.1-canary.g35be8cb",
+    "@rebasepro/common": "0.12.1-canary.g35be8cb"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",

package/src/PostgresBootstrapper.ts

@@ -757,7 +757,13 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
                 collections as Parameters<typeof ensureCollectionTables>[1],
                 log
             );
-            return { applied: plan.actions.length };
+            for (const failure of plan.failures) {
+                logger.warn(
+                    `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the ` +
+                    `collection still serves, but rows are not policed by this constraint: ${failure.error}`
+                );
+            }
+            return { applied: plan.actions.length - plan.failures.length };
         },
 
         /**

package/src/schema/ensure-collection-tables.test.ts

@@ -87,16 +87,112 @@ describe("planning an additive schema ensure", () => {
         expect(sql).not.toMatch(/NOT NULL/i);
     });
 
-    it("leaves relation columns to a real migration rather than adding them without their key", () => {
-        const withRelation = {
-            ...posts,
-            properties: {
-                ...(posts as unknown as { properties: Record<string, unknown> }).properties,
-                author: { name: "Author", type: "reference", target: () => posts }
+    // ── Relations ────────────────────────────────────────────────────────────
+    //
+    // These columns were once skipped outright, on the reasoning that a bare
+    // column without its foreign key would disagree with what `db push` later
+    // generated. On a managed tenant nothing pushes afterwards, so the table
+    // arrived without the column its own collection reads: every insert 400ed
+    // with `column "author_id" does not exist`. The answer is to emit the key
+    // too, from the same planner `db push` uses.
+
+    const authors = {
+        name: "Authors",
+        slug: "authors",
+        properties: {
+            id: { name: "ID", type: "string", isId: "uuid" },
+            name: { name: "Name", type: "string" }
+        }
+    } as unknown as CollectionConfig;
+
+    const postsWithAuthor = {
+        ...posts,
+        properties: {
+            ...(posts as unknown as { properties: Record<string, unknown> }).properties,
+            author: { name: "Author", type: "reference", path: "authors" }
+        }
+    } as unknown as CollectionConfig;
+
+    const tags = {
+        name: "Tags",
+        slug: "tags",
+        properties: {
+            id: { name: "ID", type: "number", isId: "increment" },
+            name: { name: "Name", type: "string" }
+        }
+    } as unknown as CollectionConfig;
+
+    const postsWithTags = {
+        ...posts,
+        properties: {
+            ...(posts as unknown as { properties: Record<string, unknown> }).properties,
+            tags: {
+                name: "Tags",
+                type: "relation",
+                relation: { kind: "manyToMany", target: () => tags, relationName: "tags" }
             }
-        } as unknown as CollectionConfig;
-        const plan = planCollectionSchemaEnsure([withRelation], withTable("public.posts", ["id"]));
-        expect(plan.actions.some(a => a.target.endsWith(".author"))).toBe(false);
+        }
+    } as unknown as CollectionConfig;
+
+    it("adds a reference column, and the foreign key that makes it one", () => {
+        const plan = planCollectionSchemaEnsure([postsWithAuthor, authors], withTable("public.posts", ["id"]));
+
+        expect(plan.actions.some(a => a.kind === "add-column" && a.target === "public.posts.author")).toBe(true);
+        const fk = plan.actions.find(a => a.kind === "add-constraint");
+        expect(fk?.target).toBe("public.posts.posts_author_fkey");
+        expect(fk?.sql).toMatch(/REFERENCES "public"\."authors" \("id"\)/);
+    });
+
+    it("orders every constraint after the columns and tables it depends on", () => {
+        const plan = planCollectionSchemaEnsure([postsWithAuthor, authors], empty());
+        const kinds = plan.actions.map(a => a.kind);
+        expect(kinds.lastIndexOf("add-column")).toBeLessThan(kinds.indexOf("add-constraint"));
+        expect(kinds.lastIndexOf("create-table")).toBeLessThan(kinds.indexOf("add-constraint"));
+    });
+
+    it("skips a foreign key the database already has, since ADD CONSTRAINT has no IF NOT EXISTS", () => {
+        const existing: ExistingSchema = {
+            tables: new Map([
+                ["public.posts", new Set(["id", "author"])],
+                ["public.authors", new Set(["id", "name"])]
+            ]),
+            enums: new Set(["public.posts_status"]),
+            constraints: new Set(["public.posts.posts_author_fkey"])
+        };
+        const plan = planCollectionSchemaEnsure([postsWithAuthor, authors], existing);
+        expect(plan.actions.some(a => a.kind === "add-constraint")).toBe(false);
+    });
+
+    it("creates the junction table behind a many-to-many, keyed on both endpoints", () => {
+        const plan = planCollectionSchemaEnsure([postsWithTags, tags], empty());
+        const junction = plan.actions.find(a => a.kind === "create-table" && a.target === "public.posts_tags");
+
+        expect(junction).toBeDefined();
+        // The endpoint key types have to match the primary keys they reference:
+        // posts is a uuid, tags an auto-increment integer.
+        expect(junction!.sql).toMatch(/"post_id" UUID NOT NULL/);
+        expect(junction!.sql).toMatch(/"tag_id" INTEGER NOT NULL/);
+        expect(junction!.sql).toMatch(/PRIMARY KEY \("post_id", "tag_id"\)/);
+
+        const fks = plan.actions.filter(a => a.kind === "add-constraint").map(a => a.target);
+        expect(fks).toContain("public.posts_tags.posts_tags_post_id_fkey");
+        expect(fks).toContain("public.posts_tags.posts_tags_tag_id_fkey");
+    });
+
+    it("leaves an existing junction table alone", () => {
+        const existing: ExistingSchema = {
+            tables: new Map([
+                ["public.posts", new Set(["id", "title", "views", "status"])],
+                ["public.tags", new Set(["id", "name"])],
+                ["public.posts_tags", new Set(["post_id", "tag_id"])]
+            ]),
+            enums: new Set(["public.posts_status"]),
+            constraints: new Set([
+                "public.posts_tags.posts_tags_post_id_fkey",
+                "public.posts_tags.posts_tags_tag_id_fkey"
+            ])
+        };
+        expect(planCollectionSchemaEnsure([postsWithTags, tags], existing).actions).toEqual([]);
     });
 });
 

package/src/schema/ensure-collection-tables.ts

@@ -30,7 +30,9 @@ import { getTableName } from "@rebasepro/common";
 import {
     getSqlColumnType,
     resolveColumnName,
-    isIdProperty
+    isIdProperty,
+    planRelationalColumns,
+    planJunctionTables
 } from "./generate-postgres-ddl-logic";
 
 /**
@@ -62,10 +64,18 @@ export interface ExistingSchema {
     tables: Map<string, Set<string>>;
     /** `schema.typename` of every enum type that already exists. */
     enums: Set<string>;
+    /**
+     * `schema.table.constraint` of every constraint that already exists.
+     *
+     * Optional so a caller that only cares about tables can still build one by
+     * hand; absent is read as "none known", which at worst re-attempts a
+     * constraint that then fails harmlessly as a duplicate.
+     */
+    constraints?: Set<string>;
 }
 
 export interface EnsureAction {
-    kind: "create-enum" | "create-table" | "add-column";
+    kind: "create-enum" | "create-table" | "add-column" | "add-constraint";
     /** Qualified target, for logging: `public.posts` or `public.posts.title`. */
     target: string;
     sql: string;
@@ -77,6 +87,18 @@ export interface EnsurePlan {
     statements: string[];
 }
 
+export interface EnsureOutcome extends EnsurePlan {
+    /**
+     * Constraints that could not be added — always non-fatal.
+     *
+     * A foreign key can only fail on data that already violates it, and the
+     * column it would police exists either way, so the collection still serves.
+     * Refusing to boot over one would turn a pre-existing data problem into an
+     * outage. Reported loudly instead.
+     */
+    failures: { target: string; error: string }[];
+}
+
 function schemaOf(collection: CollectionConfig): string {
     return isPostgresCollectionConfig(collection) && collection.schema ? collection.schema : "public";
 }
@@ -183,34 +205,98 @@ export function planCollectionSchemaEnsure(
         });
     }
 
+    // 2b. Junction tables behind many-to-many relations. No collection declares
+    //     them, so the walk above never sees them — and until they existed, an
+    //     m2m write had nowhere to land and the junction's derived RLS had
+    //     nothing to attach to.
+    const junctions = planJunctionTables(collections);
+    for (const junction of junctions) {
+        const key = `${junction.schema}.${junction.table}`;
+        if (existing.tables.has(key) || created.has(key)) continue;
+        created.add(key);
+        actions.push({ kind: "create-table", target: key, sql: junction.createTable });
+    }
+
     // 3. Missing columns, on both brand-new and pre-existing tables.
+    const addColumn = (
+        key: string,
+        schema: string,
+        table: string,
+        column: string,
+        type: string
+    ): void => {
+        const present = existing.tables.get(key);
+        if (present?.has(column)) return;
+        actions.push({
+            kind: "add-column",
+            target: `${key}.${column}`,
+            // Never NOT NULL: an existing table with rows cannot take a
+            // non-null column without a default, and inventing one would be
+            // guessing at the customer's data.
+            sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
+        });
+    };
+
     for (const collection of collections) {
         const key = qualified(collection);
         const schema = schemaOf(collection);
         const table = getTableName(collection);
-        const present = existing.tables.get(key) ?? new Set<string>();
         for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
             const p = prop as Property;
             if (isIdProperty(propName, p, collection)) continue;
-            // A relation's own column is emitted by the DDL generator with a
-            // foreign key; adding a bare column here would create the column
-            // without the constraint and make the generator's later output
-            // disagree with the database. Left to a real migration.
+            // Relation and reference columns are planned from the shared
+            // relational planner below, which derives the column name, type and
+            // foreign key the same way `db push` does. Deriving them here as
+            // plain columns is what once produced a column with no constraint.
             if (p.type === "reference" || p.type === "relation") continue;
-            const column = resolveColumnName(propName, p);
-            if (present.has(column)) continue;
-            const type = getSqlColumnType(propName, p, collection, collections);
-            actions.push({
-                kind: "add-column",
-                target: `${key}.${column}`,
-                // Never NOT NULL: an existing table with rows cannot take a
-                // non-null column without a default, and inventing one would be
-                // guessing at the customer's data.
-                sql: `ALTER TABLE "${schema}"."${table}" ADD COLUMN IF NOT EXISTS "${column}" ${type};`
-            });
+            addColumn(key, schema, table, resolveColumnName(propName, p), getSqlColumnType(propName, p, collection, collections));
+        }
+    }
+
+    // 3b. A junction that already existed, but is short a column. One created
+    //     above already carries both — unlike a collection table, whose CREATE
+    //     declares only the identity column — so re-listing them would log two
+    //     no-op statements and inflate the count of changes applied.
+    for (const junction of junctions) {
+        const key = `${junction.schema}.${junction.table}`;
+        if (created.has(key)) continue;
+        for (const column of junction.columns) {
+            addColumn(key, junction.schema, junction.table, column.name, column.type);
         }
     }
 
+    // 3c. The columns relation and reference properties own.
+    for (const relational of planRelationalColumns(collections)) {
+        addColumn(
+            `${relational.schema}.${relational.table}`,
+            relational.schema,
+            relational.table,
+            relational.column,
+            relational.type
+        );
+    }
+
+    // 4. Foreign keys, last: the tables and columns on both ends have to exist
+    //    first, and a constraint is the one thing here that can fail on data
+    //    rather than on schema, so nothing else depends on it.
+    const knownConstraints = existing.constraints ?? new Set<string>();
+    const plannedConstraints = new Set<string>();
+    const foreignKeys = [
+        ...planRelationalColumns(collections).map(r => r.foreignKey),
+        ...junctions.flatMap(j => j.foreignKeys)
+    ];
+    for (const fk of foreignKeys) {
+        if (!fk) continue;
+        const name = `${fk.schema}.${fk.table}.${fk.constraintName}`;
+        if (knownConstraints.has(name) || plannedConstraints.has(name)) continue;
+        plannedConstraints.add(name);
+        actions.push({
+            kind: "add-constraint",
+            target: `${fk.schema}.${fk.table}.${fk.constraintName}`,
+            sql: fk.sql
+        });
+    }
+
     return { actions, statements: actions.map(a => a.sql) };
 }
 
@@ -250,7 +336,23 @@ export async function readExistingSchema(
     );
     for (const row of enumRows) enums.add(`${row.schema}.${row.name}`);
 
-    return { tables, enums };
+    // `ADD CONSTRAINT` has no IF NOT EXISTS, so an existing foreign key is
+    // skipped by name rather than guarded in SQL.
+    const constraints = new Set<string>();
+    const { rows: constraintRows } = await client.query<{
+        schema: string;
+        table: string;
+        name: string;
+    }>(
+        `SELECT n.nspname AS schema, c.relname AS table, con.conname AS name
+         FROM pg_constraint con
+         JOIN pg_class c ON con.conrelid = c.oid
+         JOIN pg_namespace n ON c.relnamespace = n.oid
+         WHERE n.nspname IN (${inList})`
+    );
+    for (const row of constraintRows) constraints.add(`${row.schema}.${row.table}.${row.name}`);
+
+    return { tables, enums, constraints };
 }
 
 /**
@@ -265,8 +367,14 @@ export async function ensureCollectionTables(
     client: Queryable,
     collections: CollectionConfig[],
     log?: (message: string) => void
-): Promise<EnsurePlan> {
-    const schemas = Array.from(new Set(collections.map(schemaOf)));
+): Promise<EnsureOutcome> {
+    // Junctions live alongside the collections that declare them, so their
+    // schema has to be read too — otherwise an existing junction reads as
+    // missing and its constraints as unplanned.
+    const schemas = Array.from(new Set([
+        ...collections.map(schemaOf),
+        ...planJunctionTables(collections).map(j => j.schema)
+    ]));
     for (const schema of schemas) {
         assertSafeIdentifier(schema, "schema name");
         if (schema !== "public") {
@@ -276,10 +384,11 @@ export async function ensureCollectionTables(
 
     const existing = await readExistingSchema(client, schemas);
     const plan = planCollectionSchemaEnsure(collections, existing);
+    const failures: { target: string; error: string }[] = [];
 
     if (plan.actions.length === 0) {
         log?.("Schema is up to date; nothing to create.");
-        return plan;
+        return { ...plan, failures };
     }
 
     for (const action of plan.actions) {
@@ -287,11 +396,19 @@ export async function ensureCollectionTables(
             await client.query(action.sql);
             log?.(`${action.kind}: ${action.target}`);
         } catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            // A foreign key is the only action that can fail on the customer's
+            // data rather than on the schema. The column it polices is already
+            // there, so the collection serves either way — record it and carry
+            // on rather than crash-looping the deployment.
+            if (action.kind === "add-constraint") {
+                failures.push({ target: action.target, error: message });
+                continue;
+            }
             throw new Error(
-                `Failed to ${action.kind} ${action.target}: ` +
-                `${err instanceof Error ? err.message : String(err)}\n  ${action.sql}`
+                `Failed to ${action.kind} ${action.target}: ${message}\n  ${action.sql}`
             );
         }
     }
-    return plan;
+    return { ...plan, failures };
 }