@rebasepro/server-postgres 0.12.1-canary.g389e9b2 → 0.12.1-canary.g4e7bcbf

package/src/schema/introspect-db-logic.ts

@@ -67,6 +67,24 @@ const IRREGULAR_SINGULARS: Record<string, string> = {
     phenomena: "phenomenon"
 };
 
+/**
+ * Plurals in "-ves" whose singular really ends in f/fe, and which of the two.
+ *
+ * A blanket "-ves" -> "-f" rule gets `knives` -> `knif`, and mangles every
+ * ordinary "-ive" noun that happens to be plural along with it: `archives` ->
+ * `archif`, `objectives` -> `objectif`. The set of English words that genuinely
+ * swap f/fe for ves is small and closed, so it is listed rather than guessed —
+ * anything else ending in "ves" drops the trailing 's' like any other plural.
+ *
+ * Matched on the whole word, not on the suffix: `olives` ends in `lives`.
+ */
+const VES_SINGULAR_ENDINGS: Record<string, "f" | "fe"> = {
+    calves: "f", dwarves: "f", elves: "f", halves: "f", hooves: "f",
+    leaves: "f", loaves: "f", scarves: "f", selves: "f", sheaves: "f",
+    shelves: "f", thieves: "f", wharves: "f", wolves: "f",
+    knives: "fe", lives: "fe", wives: "fe"
+};
+
 /** Words ending in 's' that are already singular. */
 const UNCOUNTABLE = new Set([
     "status", "campus", "virus", "bus", "plus", "census",
@@ -100,9 +118,9 @@ export function singularize(word: string): string {
     if (lower.endsWith("ies") && lower.length > 3) {
         return word.slice(0, -3) + "y";
     }
-    if (lower.endsWith("ves")) {
-        // e.g. "wolves" -> "wolf", "leaves" -> "leaf"
-        return word.slice(0, -3) + "f";
+    if (VES_SINGULAR_ENDINGS[lower]) {
+        // e.g. "wolves" -> "wolf", "knives" -> "knife"
+        return word.slice(0, -3) + VES_SINGULAR_ENDINGS[lower];
     }
     if (lower.endsWith("ches") || lower.endsWith("shes") || lower.endsWith("sses") || lower.endsWith("xes") || lower.endsWith("zes")) {
         return word.slice(0, -2);

package/src/security/policy-drift.test.ts

@@ -158,15 +158,23 @@ describe("checkPolicyDrift", () => {
     it("also flags the tautology in a WITH CHECK clause", async () => {
         const cols = [collection("posts")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const withCheck = expected.filter((p) => p.hasWithCheck);
+        // Asserted rather than assumed: if the generator ever stopped emitting a
+        // WITH CHECK for these rules the fixture would carry no tautology at
+        // all, and every assertion below would be vacuously satisfied.
+        expect(withCheck.length).toBeGreaterThan(0);
+
         const live = expected.map((p) => liveRow(p, {
             with_check: p.hasWithCheck ? "(auth.uid() IS NOT NULL)" : null
         }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
-        const flagged = drift.insecure.some((i) => /WITH CHECK/.test(i.reason));
-        // Only assert when the fixture actually had a WITH CHECK policy to carry it.
-        if (expected.some((p) => p.hasWithCheck)) expect(flagged).toBe(true);
+        // Every WITH CHECK policy carries the tautology and no USING clause
+        // does, so anything flagged here came from the WITH CHECK scan — the
+        // half that a check reading only `qual` would miss entirely.
+        expect(drift.insecure.map((i) => i.policy.name)).toEqual(withCheck.map((p) => p.name));
+        expect(drift.insecure.every((i) => /WITH CHECK/.test(i.reason))).toBe(true);
     });
 
     it("parses roles when the driver returns the raw {a,b} text form", async () => {

package/src/services/FetchService.ts

@@ -1,10 +1,10 @@
-import { and, asc, count, desc, eq, getTableName, gt, lt, or, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
+import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, lt, or, SQL, TableRelationalConfig, TablesRelationalConfig } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, FilterValues, ResolvedRelation, LogicalCondition, isManyToMany } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
 import { resolveCollectionRelations, findRelation, createRelationRef, createRelationRefWithData } from "@rebasepro/common";
 import { generateForeignKeyName } from "@rebasepro/utils";
-import { DrizzleConditionBuilder, type FilterCompilationOptions } from "../utils/drizzle-conditions";
+import { DrizzleConditionBuilder, getUnknownFilterFieldsMode, type FilterCompilationOptions } from "../utils/drizzle-conditions";
 import {
     getCollectionByPath,
     getTableForCollection,
@@ -20,9 +20,9 @@ import { RelationService } from "./RelationService";
 import { RelationalQueryBuilder } from "drizzle-orm/pg-core/query-builders/query";
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-import { toCmsRow, toRestRow, isJunctionRelation } from "./row-pipeline";
+import { toFlatRow, toRestRow, isJunctionRelation } from "./row-pipeline";
 import { isNestedPath, resolveNestedPath, type NestedPathHop } from "./nested-path";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 /** Type-safe accessor for Drizzle's relational query API via dynamic table name */
 type DbQueryAccessor = Record<string, RelationalQueryBuilder<any, any>> | undefined;
@@ -129,12 +129,10 @@ export class FetchService {
         if (direct) return direct;
 
         // Owning relation, resolved: the relation names its own local key.
-        if (collection) {
-            const relation = resolveCollectionRelations(collection)[orderBy];
-            if (relation?.kind === "belongsTo") {
-                const foreignKey = columnAt(relation.localKey);
-                if (foreignKey) return foreignKey;
-            }
+        const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : undefined;
+        if (declaredRelation?.kind === "belongsTo") {
+            const foreignKey = columnAt(declaredRelation.localKey);
+            if (foreignKey) return foreignKey;
         }
 
         // No collection in hand — the two shapes an owning relation's key takes
@@ -145,7 +143,61 @@ export class FetchService {
             if (foreignKey) return foreignKey;
         }
 
-        return undefined;
+        // Nothing resolved. Returning `undefined` is exactly what the docblock
+        // above describes: the caller drops the ORDER BY and hands back rows in
+        // whatever order Postgres pleases, while the requester believes they
+        // are sorted. `?orderBy=titel` answered 200 with unsorted data and no
+        // hint that the sort had been ignored.
+        //
+        // A *filter* naming a field that does not exist is already refused for
+        // precisely this reason — it "used to widen results silently". An
+        // unresolvable sort field is the same drift between a query and the
+        // schema, so it answers the same way and honours the same switch: one
+        // knob, because a deployment that wants the lenient behaviour wants it
+        // for both.
+        const collectionName = collection?.slug ?? collection?.name;
+        const onCollection = collectionName ? ` on collection '${collectionName}'` : "";
+
+        // A declared to-many relation is a different mistake from a typo, and
+        // saying "unknown field" about a field the collection plainly declares
+        // sends the reader looking for a spelling error that is not there.
+        // There is simply no single value per row to order by — `posts.tags` is
+        // a set — so no ORDER BY exists to write, with or without a typo.
+        if (declaredRelation && declaredRelation.kind !== "belongsTo") {
+            throw ApiError.badRequest(
+                `Cannot sort by '${orderBy}'${onCollection}: it is a to-many relation ` +
+                `(${declaredRelation.kind}), which has no single value per row to order by.`,
+                "ORDER_BY_FIELD_NOT_SORTABLE",
+                { field: orderBy, kind: declaredRelation.kind, ...(collectionName && { collection: collectionName }) }
+            );
+        }
+
+        if (getUnknownFilterFieldsMode() === "warn") {
+            logger.warn(
+                `Sorting by field '${orderBy}'${onCollection}, but it does not exist in the table — ` +
+                "the ORDER BY was dropped and these rows are unsorted."
+            );
+            return undefined;
+        }
+
+        let validFields: string[] = [];
+        try {
+            validFields = Object.keys(getTableColumns(table)).sort();
+        } catch {
+            // A table stand-in without Drizzle's column symbols — the message
+            // is worth less without the list, but not worth failing over.
+        }
+
+        throw ApiError.badRequest(
+            `Unknown orderBy field '${orderBy}'${onCollection}` +
+            (validFields.length > 0 ? `. Valid fields: ${validFields.join(", ")}` : ""),
+            "UNKNOWN_ORDER_BY_FIELD",
+            {
+                field: orderBy,
+                ...(collectionName && { collection: collectionName }),
+                ...(validFields.length > 0 && { validFields })
+            }
+        );
     }
 
     /**
@@ -555,7 +607,7 @@ idColumn };
 
                 if (!row) return undefined;
 
-                const flatRow = toCmsRow(row, collection, this.registry);
+                const flatRow = toFlatRow(row, collection, this.registry);
 
                 // Post-fetch joinPath relations that Drizzle's `with` can't express
                 await this.resolveJoinPathRelations<M>(flatRow, collection, collectionPath, parsedId, databaseId);
@@ -682,7 +734,7 @@ idColumn };
                 const results = await qb.findMany(queryOpts as Parameters<NonNullable<typeof qb>["findMany"]>[0]);
 
                 const rows = (results as Record<string, unknown>[]).map(row =>
-                    toCmsRow(row, collection, this.registry)
+                    toFlatRow(row, collection, this.registry)
                 );
 
                 return rows;
@@ -785,7 +837,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
     /**
      * Fallback path used when db.query is unavailable.
      *
-     * The primary path runs the results through `toCmsRow`, which maps
+     * The primary path runs the results through `toFlatRow`, which maps
      * relations from what drizzle already nested — no query per row. This one
      * has no nesting to read, so it resolves relations itself, in batches.
      *
@@ -942,6 +994,7 @@ relatedTo: hop });
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            logical?: LogicalCondition;
             searchString?: string;
             databaseId?: string;
         } = {}
@@ -973,6 +1026,13 @@ relatedTo: hop });
             if (filterConditions.length > 0) allConditions.push(...filterConditions);
         }
 
+        if (options.logical) {
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(
+                options.logical, table, effectivePath, this.filterContext(effectivePath, table)
+            );
+            if (logicalCondition) allConditions.push(logicalCondition);
+        }
+
         if (allConditions.length > 0) {
             const finalCondition = DrizzleConditionBuilder.combineConditionsWithAnd(allConditions);
             if (finalCondition) query = query.where(finalCondition);
@@ -1043,6 +1103,8 @@ relatedTo: hop });
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;

package/src/services/dataService.ts

@@ -1,5 +1,5 @@
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { FilterValues } from "@rebasepro/types";
+import { FilterValues, LogicalCondition } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
 import { FetchService } from "./FetchService";
 import { PersistService } from "./PersistService";
@@ -97,6 +97,8 @@ export class DataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             searchString?: string;
             databaseId?: string;
         } = {}

package/src/services/row-pipeline.ts

@@ -164,7 +164,7 @@ export function relationTargetAddress(
  * expects real types. The row's own address is *not* among the columns — it is
  * derived by the consumer from the collection's primary keys.
  */
-export function toCmsRow(
+export function toFlatRow(
     row: Record<string, unknown>,
     collection: CollectionConfig,
     registry: PostgresCollectionRegistry

package/src/websocket.ts

@@ -7,7 +7,7 @@ import type { User } from "@rebasepro/types";
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import { extractUserFromToken, AccessTokenPayload, safeCompare } from "@rebasepro/server";
+import { extractUserFromToken, AccessTokenPayload, safeCompare, resolveRequireAuth } from "@rebasepro/server";
 import { logger } from "@rebasepro/server";
 
 /** Minimal subset of RebaseAuthConfig used by the WebSocket layer. */
@@ -116,11 +116,20 @@ export function createPostgresWebSocket(
         logger.error("❌ [WebSocket Server] Error", { error: err });
     });
 
-    // Auth is required when either: an adapter is present (secure by default),
-    // OR the config has a jwtSecret and requireAuth !== false.
-    const requireAuth = authAdapter
-        ? true
-        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
+    // The same predicate the HTTP data routes use, from the same function —
+    // this socket is the other enforcement point for one product decision, and
+    // while it computed the answer itself it computed a different one. See
+    // `resolveRequireAuth` for what its local copy got wrong and why a `false`
+    // here grants access rather than skipping a check.
+    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig as never);
+
+    if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) {
+        logger.warn(
+            "🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or " +
+            "serviceKey is configured — no client can complete AUTH, so every realtime " +
+            "message will be refused with UNAUTHORIZED."
+        );
+    }
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;