@rebasepro/server-postgres 0.12.1-canary.g4e7bcbf → 0.12.1-canary.g52d71ee

package/dist/auth/services.d.ts

@@ -23,8 +23,13 @@ export interface AuthSchemaTables {
  *
  * Whitespace goes too: a trailing space survives the fold and reproduces the
  * problem exactly.
+ *
+ * Re-exported rather than defined here: `@rebasepro/server` and
+ * `@rebasepro/server-mongo` write this column too, and a second copy of this
+ * rule is the defect it exists to prevent.
  */
-export declare function normalizeEmail<T>(email: T): T | string;
+import { normalizeEmail } from "@rebasepro/common";
+export { normalizeEmail };
 /**
  * PostgreSQL implementation of UserRepository.
  * Handles all user-related database operations using Drizzle ORM.

package/dist/backup/backup-service.d.ts

@@ -1,5 +1,5 @@
 import type { StorageController } from "@rebasepro/server";
-import { BackupDestination, VersionCompatibility } from "./pg-tools";
+import { BackupDestination, type RowSecurityIdentity, VersionCompatibility } from "./pg-tools";
 import { BackupObject, RetentionOptions } from "./retention";
 export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
@@ -54,6 +54,15 @@ export declare function createDump(opts: {
     inheritStdio?: boolean;
     includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
+    /**
+     * Dump with row security left on, reading as this identity.
+     *
+     * The escape hatch for a managed Postgres, where the dumping role owns
+     * nothing and has no `BYPASSRLS`. Off by default, and deliberately so: with
+     * row security on, `pg_dump` stops erroring on rows it cannot see and
+     * simply omits them. See {@link RowSecurityIdentity}.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): Promise<BackupResult>;
 /**
  * Cheap integrity check on a freshly written dump: it must be non-empty and

package/dist/backup/pg-tools.d.ts

@@ -79,6 +79,36 @@ export declare function parseBackupDestination(out: string): BackupDestination;
  * doubled slash.
  */
 export declare function joinStorageKey(prefix: string, fileName: string): string;
+/**
+ * The identity `pg_dump` reads rows as, when row security is left on.
+ *
+ * Not optional, and that is the whole design. `pg_dump --enable-row-security`
+ * on its own is the dangerous command in this file: it turns the "query would
+ * be affected by row-level security policy" *error* into a dump that exits 0
+ * and is silently missing every row the dumping role's policies exclude. A
+ * backup that looks fine and restores most of your data is worse than one that
+ * refused to run.
+ *
+ * So the flag is unreachable without a subject to evaluate the policies
+ * against. Rebase's generated policies read `app.uid` and `app.user_roles`;
+ * supplying an admin role satisfies the `admin_full_access` rule and the dump
+ * sees everything that rule sees.
+ */
+export interface RowSecurityIdentity {
+    /** Written to `app.uid`. Any non-empty value — it is only an audit trail. */
+    uid: string;
+    /** Written to `app.user_roles`. Must include a role the policies admit. */
+    roles: string[];
+}
+/**
+ * `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+ * set a GUC.
+ *
+ * A backslash escape rather than quoting, which is what libpq's `-c` parsing
+ * takes: a space inside a value ends the option otherwise, so a role list is
+ * comma-joined and never spaced.
+ */
+export declare function buildRowSecurityPgOptions(identity: RowSecurityIdentity): string;
 /**
  * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
  * which is compressed and restorable selectively via `pg_restore`.
@@ -90,7 +120,24 @@ export declare function buildPgDumpArgs(opts: {
     excludeSchemas?: string[];
     /** Number of parallel jobs (directory format only; ignored for -Fc). */
     noOwner?: boolean;
+    /**
+     * Dump with row security on, as this identity. Omit — which is the default
+     * — and `pg_dump` errors rather than skipping rows it cannot see.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): string[];
+/**
+ * Whether a `pg_dump` failure is the row-security one, and what to do about it.
+ *
+ * The error text names the table and nothing else, so the first read of it is
+ * "why would a backup be affected by RLS at all?" — the answer being that the
+ * dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+ * normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+ * Postgres. Nothing about that is visible from the message.
+ *
+ * Returns `null` for any other failure, so the caller reports it unchanged.
+ */
+export declare function diagnoseRowSecurityDumpFailure(error: unknown): string | null;
 /**
  * Assemble the `pg_restore` argument vector for a custom-format dump.
  */

package/dist/{backup-service-DLb2drIH.js → backup-service-CD8o_1Sl.js}

@@ -25,8 +25,70 @@ import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWater
 import { Buffer as Buffer$1 } from "node:buffer";
 import "module";
 import { fileURLToPath as fileURLToPath$1 } from "url";
+//#region src/utils/connection-string.ts
+/**
+* Connection-string rewrites for the tools Rebase shells out to.
+*
+* Pure and dependency-free: `pg-tools` builds argument vectors without a live
+* server, and these have to be usable from there.
+*/
+/**
+* The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+*/
+var LIBPQ_SSLMODES = /* @__PURE__ */ new Set([
+	"disable",
+	"allow",
+	"prefer",
+	"require",
+	"verify-ca",
+	"verify-full"
+]);
+/**
+* Make a connection string safe to hand to a libpq program.
+*
+* `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+* the certificate — and libpq does not have it. It does not degrade or warn:
+*
+*     psql: error: invalid sslmode value: "no-verify"
+*
+* which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+* `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+* points at the value rather than at the convention it comes from. It has cost
+* this project time more than once.
+*
+* `require` is the honest translation: libpq's `require` encrypts and does not
+* verify the certificate either, which is exactly what `no-verify` asks for.
+* Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+* alone, so a connection string that asked for verification still gets it.
+*
+* Only `sslmode` is touched, and only when it is a value libpq would reject.
+* Anything unparseable is returned as given: a connection that works
+* unverified beats one this corrupted.
+*/
+function forLibpq(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return connectionString;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+	const sslmode = url.searchParams.get("sslmode");
+	if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+	url.searchParams.set("sslmode", "require");
+	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return url.toString();
+}
+//#endregion
 //#region src/backup/pg-tools.ts
 /**
+* Pure helpers for the backup/restore commands.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without a live Postgres server, matching the constraint that CI must
+* not require a database.
+*/
+/**
 * Extract the database name from a Postgres connection string.
 * Returns `null` when the URL has no database path (e.g. bare host).
 */
@@ -156,6 +218,22 @@ function joinStorageKey(prefix, fileName) {
 	return clean.length > 0 ? `${clean}/${fileName}` : fileName;
 }
 /**
+* `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+* set a GUC.
+*
+* A backslash escape rather than quoting, which is what libpq's `-c` parsing
+* takes: a space inside a value ends the option otherwise, so a role list is
+* comma-joined and never spaced.
+*/
+function buildRowSecurityPgOptions(identity) {
+	const escape = (value) => value.replace(/([\\ ])/g, "\\$1");
+	return [
+		`-c app.uid=${escape(identity.uid)}`,
+		`-c app.user_id=${escape(identity.uid)}`,
+		`-c app.user_roles=${escape(identity.roles.join(","))}`
+	].join(" ");
+}
+/**
 * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
 * which is compressed and restorable selectively via `pg_restore`.
 */
@@ -166,18 +244,56 @@ function buildPgDumpArgs(opts) {
 		`--file=${opts.outFile}`
 	];
 	if (opts.noOwner) args.push("--no-owner");
+	if (opts.rowSecurity) args.push("--enable-row-security");
 	for (const schema of opts.excludeSchemas ?? []) args.push(`--exclude-schema=${schema}`);
-	args.push(opts.connectionString);
+	args.push(forLibpq(opts.connectionString));
 	return args;
 }
 /**
+* Whether a `pg_dump` failure is the row-security one, and what to do about it.
+*
+* The error text names the table and nothing else, so the first read of it is
+* "why would a backup be affected by RLS at all?" — the answer being that the
+* dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+* normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+* Postgres. Nothing about that is visible from the message.
+*
+* Returns `null` for any other failure, so the caller reports it unchanged.
+*/
+function diagnoseRowSecurityDumpFailure(error) {
+	const text = [error?.stderr, error?.message].map((part) => typeof part === "string" ? part : "").join("\n");
+	if (!/row-level security policy/i.test(text)) return null;
+	const table = text.match(/for table "([^"]+)"/)?.[1];
+	return [
+		`pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
+		"",
+		"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
+		"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
+		"  no superuser to hand out.",
+		"",
+		"  Two ways out:",
+		"",
+		"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
+		"      dump then contains every row, which is what a backup should mean.",
+		"",
+		"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
+		"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
+		"      admits the dump. Read the warning it prints: the result contains exactly the",
+		"      rows those policies admit, and any table whose policies do not include an",
+		"      admin rule comes out short — with no error.",
+		"",
+		"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
+		"  settings above it succeeds and silently omits rows."
+	].join("\n");
+}
+/**
 * Assemble the `pg_restore` argument vector for a custom-format dump.
 */
 function buildPgRestoreArgs(opts) {
 	const args = [
 		"--format=custom",
 		"--no-password",
-		`--dbname=${opts.connectionString}`
+		`--dbname=${forLibpq(opts.connectionString)}`
 	];
 	if (opts.clean) args.push("--clean", "--if-exists");
 	if (opts.noOwner) args.push("--no-owner");
@@ -210,7 +326,7 @@ function buildPgDumpallGlobalsArgs(opts) {
 		"--no-role-passwords",
 		"--no-password",
 		`--file=${opts.outFile}`,
-		`--dbname=${opts.connectionString}`
+		`--dbname=${forLibpq(opts.connectionString)}`
 	];
 }
 /**
@@ -8676,15 +8792,25 @@ async function createDump(opts) {
 	const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "rebase-backup-"));
 	fs.mkdirSync(outDir, { recursive: true });
 	const localFile = path.join(outDir, fileName);
-	await execa(bin, buildPgDumpArgs({
+	const args = buildPgDumpArgs({
 		connectionString: opts.connectionString,
 		outFile: localFile,
 		excludeSchemas: opts.excludeSchemas,
-		noOwner: opts.noOwner
-	}), {
-		stdio: opts.inheritStdio ? "inherit" : "pipe",
-		env: { ...env }
+		noOwner: opts.noOwner,
+		rowSecurity: opts.rowSecurity
 	});
+	const dumpEnv = { ...env };
+	if (opts.rowSecurity) dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)].filter(Boolean).join(" ");
+	try {
+		await execa(bin, args, {
+			stdio: opts.inheritStdio ? "inherit" : "pipe",
+			env: dumpEnv
+		});
+	} catch (error) {
+		const diagnosis = diagnoseRowSecurityDumpFailure(error);
+		if (!diagnosis) throw error;
+		throw new BackupToolError(diagnosis, "Run `rebase db backup --help` for the flag, and read what it says about partial dumps.");
+	}
 	const result = {
 		localFile,
 		fileName,
@@ -8868,6 +8994,6 @@ async function pruneBackups(dest, options, storage) {
 	return toDelete;
 }
 //#endregion
-export { serverVersionNumToMajor as A, globalsFileForDump as C, parseDbNameFromUrl as D, parseBackupTimestamp as E, withDatabaseName as M, parsePgToolMajor as O, checkToolServerCompatibility as S, parseBackupDestination as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, listBackups as c, resolvePgBinary as d, restoreDump as f, selectBackupsToPrune as g, require_source as h, createDump as i, splitGlobalsStatements as j, resolveConnectionString as k, preflight as l, validateDump as m, applyGlobals as n, ensureDatabaseExists as o, uploadBackup as p, backup_service_exports as r, getServerVersionMajor as s, BackupToolError as t, pruneBackups as u, buildPgDumpArgs as v, joinStorageKey as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
+export { parsePgToolMajor as A, checkToolServerCompatibility as C, parseBackupDestination as D, joinStorageKey as E, serverVersionNumToMajor as M, splitGlobalsStatements as N, parseBackupTimestamp as O, withDatabaseName as P, buildRowSecurityPgOptions as S, globalsFileForDump as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, listBackups as c, resolvePgBinary as d, restoreDump as f, selectBackupsToPrune as g, require_source as h, createDump as i, resolveConnectionString as j, parseDbNameFromUrl as k, preflight as l, validateDump as m, applyGlobals as n, ensureDatabaseExists as o, uploadBackup as p, backup_service_exports as r, getServerVersionMajor as s, BackupToolError as t, pruneBackups as u, buildPgDumpArgs as v, diagnoseRowSecurityDumpFailure as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
 
-//# sourceMappingURL=backup-service-DLb2drIH.js.map
+//# sourceMappingURL=backup-service-CD8o_1Sl.js.map