@rebasepro/server-postgres 0.12.1-canary.gcfa333c → 0.12.1-canary.gddbd489

package/dist/{src-DihrDFuP.js → src-DlPBctw_.js}

@@ -1,8 +1,9 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { c as __require, o as __commonJSMin } from "./connection-B5Wndbr1.js";
+import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
 import { a as getDataSourceCapabilities, c as toCanonicalOp, n as isPostgresCollectionConfig, o as NULL_OPS, r as isRelationalCollectionConfig, s as REST_TO_CANONICAL, t as getDeclaredSubcollections } from "./src-DoU9yPqq.js";
+import { n as ANONYMOUS_USER_IDS, r as policy, t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
 //#region ../types/src/types/entities.ts
 /**
 * Class used to create a reference to a entity in a different path
@@ -55,81 +56,6 @@ function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
 //#endregion
-//#region ../types/src/types/policy.ts
-/**
-* The id a request without a logged-in user reports as `auth.uid()`.
-*
-* A user-context request always sets `app.uid`: blank would read back as
-* `NULL`, and `NULL` is how the trusted server context is recognised, so an
-* anonymous visitor would be promoted to server privileges. The driver
-* therefore substitutes this sentinel at the single chokepoint where the GUC
-* is set.
-*
-* The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
-* tautology on the user path** — it is true for anonymous visitors too. Use
-* {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
-* in", and {@link policy.serverContext} to mean "the trusted server context".
-*
-* @group Models
-*/
-var ANONYMOUS_USER_ID = "anonymous";
-/** @group Models */
-var policy = {
-	true: () => ({ kind: "true" }),
-	false: () => ({ kind: "false" }),
-	and: (...operands) => ({
-		kind: "and",
-		operands
-	}),
-	or: (...operands) => ({
-		kind: "or",
-		operands
-	}),
-	not: (operand) => ({
-		kind: "not",
-		operand
-	}),
-	compare: (left, op, right) => ({
-		kind: "compare",
-		op,
-		left,
-		right
-	}),
-	rolesOverlap: (roles) => ({
-		kind: "rolesOverlap",
-		roles
-	}),
-	rolesContain: (roles) => ({
-		kind: "rolesContain",
-		roles
-	}),
-	authenticated: () => ({ kind: "authenticated" }),
-	serverContext: () => ({ kind: "serverContext" }),
-	existsIn: (args) => ({
-		kind: "existsIn",
-		collection: args.collection,
-		where: args.where
-	}),
-	raw: (sql) => ({
-		kind: "raw",
-		sql
-	}),
-	field: (name) => ({
-		kind: "field",
-		name
-	}),
-	outerField: (name) => ({
-		kind: "outerField",
-		name
-	}),
-	literal: (value) => ({
-		kind: "literal",
-		value
-	}),
-	authUid: () => ({ kind: "authUid" }),
-	authRoles: () => ({ kind: "authRoles" })
-};
-//#endregion
 //#region ../common/src/util/common.ts
 var DEFAULT_ONE_OF_TYPE = "type";
 var DEFAULT_ONE_OF_VALUE = "value";
@@ -1141,16 +1067,12 @@ function removeFunctions(o) {
 	if (o === void 0) return void 0;
 	if (o === null) return null;
 	if (typeof o === "object") {
-		if (Array.isArray(o)) return o.map((v) => removeFunctions(v));
+		if (Array.isArray(o)) return o.filter((v) => typeof v !== "function").map((v) => removeFunctions(v));
 		if (!isPlainObject(o)) return o;
-		return Object.entries(o).filter(([_, value]) => typeof value !== "function").map(([key, value]) => {
-			if (Array.isArray(value)) return { [key]: value.map((v) => removeFunctions(v)) };
-			else if (typeof value === "object") return { [key]: removeFunctions(value) };
-			else return { [key]: value };
-		}).reduce((a, b) => ({
-			...a,
-			...b
-		}), {});
+		return Object.entries(o).filter(([_, value]) => typeof value !== "function").reduce((acc, [key, value]) => {
+			acc[key] = removeFunctions(value);
+			return acc;
+		}, {});
 	}
 	return o;
 }
@@ -1289,11 +1211,101 @@ function getPolicyNamesForRule(rule, tableName) {
 	return ops.map((op, opIdx) => rule.name ? ops.length > 1 ? `${rule.name}_${op}` : rule.name : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`);
 }
 //#endregion
+//#region ../utils/src/plurals.ts
+/**
+* Returns the singular of an English word.
+*
+* @param {string} word
+* @param {number} [amount]
+* @returns {string}
+*/
+function singular(word, amount) {
+	if (amount !== void 0 && amount !== 1) return word;
+	const singulars = {
+		"(quiz)zes$": "$1",
+		"(matr)ices$": "$1ix",
+		"(vert|ind)ices$": "$1ex",
+		"^(ox)en$": "$1",
+		"(alias)es$": "$1",
+		"(octop|vir)i$": "$1us",
+		"(cris|ax|test)es$": "$1is",
+		"(shoe)s$": "$1",
+		"(o)es$": "$1",
+		"(bus)es$": "$1",
+		"([m|l])ice$": "$1ouse",
+		"(x|ch|ss|sh)es$": "$1",
+		"(m)ovies$": "$1ovie",
+		"(s)eries$": "$1eries",
+		"([^aeiouy]|qu)ies$": "$1y",
+		"([lr])ves$": "$1f",
+		"(tive)s$": "$1",
+		"(hive)s$": "$1",
+		"(li|wi|kni)ves$": "$1fe",
+		"(shea|loa|lea|thie)ves$": "$1f",
+		"(^analy)ses$": "$1sis",
+		"((a)naly|(b)a|(d)iagno|(p)arenthe|(p)rogno|(s)ynop|(t)he)ses$": "$1$2sis",
+		"([ti])a$": "$1um",
+		"(n)ews$": "$1ews",
+		"(h|bl)ouses$": "$1ouse",
+		"(corpse)s$": "$1",
+		"(us)es$": "$1",
+		s$: ""
+	};
+	const irregular = {
+		move: "moves",
+		foot: "feet",
+		goose: "geese",
+		sex: "sexes",
+		child: "children",
+		man: "men",
+		tooth: "teeth",
+		person: "people"
+	};
+	if ([
+		"sheep",
+		"fish",
+		"deer",
+		"moose",
+		"series",
+		"species",
+		"money",
+		"rice",
+		"information",
+		"equipment",
+		"bison",
+		"cod",
+		"offspring",
+		"pike",
+		"salmon",
+		"shrimp",
+		"swine",
+		"trout",
+		"aircraft",
+		"hovercraft",
+		"spacecraft",
+		"sugar",
+		"tuna",
+		"you",
+		"wood"
+	].indexOf(word.toLowerCase()) >= 0) return word;
+	for (const w in irregular) {
+		const pattern = new RegExp(`${irregular[w]}$`, "i");
+		if (pattern.test(word)) return word.replace(pattern, w);
+	}
+	for (const reg in singulars) {
+		const pattern = new RegExp(reg, "i");
+		if (pattern.test(word)) return word.replace(pattern, singulars[reg]);
+	}
+	return word;
+}
+//#endregion
 //#region ../utils/src/names.ts
 /**
 * Generates a foreign key column name from a given string, typically a collection slug or name.
-* It converts the name to snake_case, attempts to singularize it by removing a trailing 's'
-* (a common convention for collection names), and appends '_id'.
+* It singularizes the name, converts it to snake_case and appends '_id'.
+*
+* Singularization runs *before* snake-casing so that acronyms survive: `toSnakeCase`
+* splits on every capital, which turned "URLs" into "ur_ls" and then "ur_l_id".
 *
 * @param name The base name to convert to a foreign key.
 * @returns A foreign key name in the format 'singular_name_id'.
@@ -1303,8 +1315,8 @@ function getPolicyNamesForRule(rule, tableName) {
 * generateForeignKeyName("users")
 *
 * @example
-* // returns "post_id"
-* generateForeignKeyName("posts")
+* // returns "category_id"
+* generateForeignKeyName("categories")
 *
 * @example
 * // returns "product_id"
@@ -1312,8 +1324,41 @@ function getPolicyNamesForRule(rule, tableName) {
 *
 */
 function generateForeignKeyName(name) {
-	const snakeCaseName = toSnakeCase(name);
-	return `${snakeCaseName.endsWith("s") ? snakeCaseName.slice(0, -1) : snakeCaseName}_id`;
+	return `${toSnakeCase(singularizeForKey(name))}_id`;
+}
+/**
+* `singular()` handles real English plurals, but its final catch-all rule strips
+* any trailing "s", which mangles words that only look plural. Guard the two
+* cases that produce a column name nobody would recognise:
+*
+* - a double "s" ending is never a plural marker ("address", "class", "process"),
+*   so stripping it yields "addres";
+* - a name that singularizes to nothing (the literal "s") would yield "_id".
+*/
+function singularizeForKey(name) {
+	if (/ss$/i.test(name)) return name;
+	const result = singular(name);
+	return result.length > 0 ? result : name;
+}
+/**
+* What `generateForeignKeyName` returned before it learned to singularize:
+* snake-case the name, then chop one trailing "s".
+*
+* This is here to be *detected*, never to be generated. A database provisioned
+* under the old rule carries `categorie_id`, `addresse_id`, `children_id` or
+* `ur_l_id` where the current rule expects `category_id`, `address_id`,
+* `child_id` and `url_id` — and the boot-time schema ensure is additive, so it
+* would create the new column empty beside the populated old one and leave the
+* relation reading nothing. No error, no missing table: the failure is silent,
+* which is the only reason this function still exists.
+*
+* `ensureCollectionSchema` calls it to recognise that shape and say so.
+* Returns the same string as `generateForeignKeyName` for every regular plural,
+* so a caller can compare the two and act only when they differ.
+*/
+function legacyForeignKeyName(name) {
+	const snake = toSnakeCase(name);
+	return `${snake.endsWith("s") ? snake.slice(0, -1) : snake}_id`;
 }
 //#endregion
 //#region ../common/src/util/entities.ts
@@ -1413,6 +1458,34 @@ function createRelationRefWithData(id, path, data) {
 		data
 	};
 }
+/** The eight-four-four-four-twelve shape of a UUID, any version. */
+var UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Whether one address part can be a value of the column it addresses. */
+function partIsAddressable(part, pk) {
+	if (pk.isUUID) return UUID_PATTERN.test(String(part));
+	if (pk.type === "number") return typeof part === "number" ? Number.isFinite(part) : !isNaN(parseInt(String(part), 10));
+	return true;
+}
+/**
+* Whether an address could name a row at all, before asking the database.
+*
+* A `uuid` column cannot hold `"new"`, and an `integer` column cannot hold
+* `"abc"` — so the answer to "which row is this" is "none", and that is a 404,
+* not a failure. Postgres cannot say so politely: the comparison never runs, it
+* raises `22P02` and aborts the enclosing transaction, after which every
+* further statement returns the far less helpful `25P02`.
+*
+* `isUUID` must come from the column, not from `isId: "uuid"` in a config: the
+* config is a claim about a key, and a `text` column that holds ids of some
+* other shape is a working app this must not start rejecting.
+*/
+function isAddressableId(idValue, primaryKeys) {
+	if (primaryKeys.length === 0) return false;
+	if (primaryKeys.length === 1) return partIsAddressable(idValue, primaryKeys[0]);
+	const parts = String(idValue).split(":::");
+	if (parts.length !== primaryKeys.length) return false;
+	return parts.every((part, i) => partIsAddressable(part, primaryKeys[i]));
+}
 /**
 * Derive a row's address from its key columns.
 *
@@ -1553,8 +1626,7 @@ function enumToObjectEntries(enumValues) {
 function resolveRelation(relation, sourceCollection, propertyKey) {
 	const target = relation.target;
 	if (typeof target !== "function") throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has no \`target\`. Give it a thunk: \`target: () => otherCollection\`.`);
-	const targetCollection = target();
-	if (!targetCollection?.slug) throw new Error(`Relation${relation.relationName ? ` '${relation.relationName}'` : ""} on '${sourceCollection.slug}' has a \`target\` that did not resolve to a collection.`);
+	const targetCollection = callTarget(relation, sourceCollection, propertyKey, target);
 	const relationName = relation.relationName ?? propertyKey ?? toSnakeCase(targetCollection.slug);
 	const shared = {
 		relationName,
@@ -1581,7 +1653,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "one",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "hasMany": return {
 			...shared,
@@ -1589,7 +1662,8 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 			cardinality: "many",
 			writable: true,
 			shared: false,
-			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName)
+			foreignKeyOnTarget: relation.foreignKeyOnTarget ?? generateForeignKeyName(sourceName),
+			sourceKey: relation.sourceKey
 		};
 		case "manyToMany": {
 			const sourceTable = getTableName(sourceCollection);
@@ -1618,6 +1692,43 @@ function resolveRelation(relation, sourceCollection, propertyKey) {
 		default: throw new Error(`Unknown relation kind: ${JSON.stringify(relation)}`);
 	}
 }
+/** How this relation is addressed in an error message, before it has a resolved name. */
+function describe(relation, sourceCollection, propertyKey) {
+	const name = relation.relationName ?? propertyKey;
+	return `Relation${name ? ` '${name}'` : ""} on '${sourceCollection.slug}'`;
+}
+/**
+* Call the `target` thunk, and translate the two ways an import cycle breaks it
+* into an error that names the cause.
+*
+* The thunk exists to defer the reference until every module has finished
+* evaluating, and for a cycle that closes at import time it does. What it cannot
+* defer is a cycle that leaves the binding permanently unusable, and there are
+* two shapes of that:
+*
+*  - **ESM/TDZ.** `const` and `class` bindings in a not-yet-evaluated module are
+*    in the temporal dead zone, so reading one throws `ReferenceError: x is not
+*    defined`. The stack points at the thunk — a one-line arrow function that is
+*    obviously fine — and says nothing about the cycle that made it throw.
+*  - **CJS interop.** The half-initialised module object has no `default` yet,
+*    the import resolves to `undefined`, and the thunk returns it without
+*    complaint. That one used to surface here as "did not resolve to a
+*    collection", which is true and unhelpful.
+*
+* Both mean the same thing, and the fix for both is the same: break the cycle,
+* or move the relation into the collection that does not close it.
+*/
+function callTarget(relation, sourceCollection, propertyKey, target) {
+	let targetCollection;
+	try {
+		targetCollection = target();
+	} catch (error) {
+		if (error instanceof ReferenceError) throw new Error(`${describe(relation, sourceCollection, propertyKey)} targets a collection that is not initialized yet — almost always an import cycle between the two collection files. Break the cycle (move the shared piece into a third module, or import the target lazily) so the target's module finishes evaluating before the registry is built.`, { cause: error });
+		throw error;
+	}
+	if (!targetCollection?.slug) throw new Error(`${describe(relation, sourceCollection, propertyKey)} has a \`target\` that resolved to ${targetCollection === void 0 ? "`undefined`" : "something that is not a collection"}. ` + (targetCollection === void 0 ? "Under CommonJS interop an import cycle resolves the default import to `undefined`, so check whether this collection and its target import each other. Otherwise the thunk is returning the wrong value — it must return the collection itself, not a promise or a module." : "The thunk must return a collection config with a `slug`."));
+	return targetCollection;
+}
 //#endregion
 //#region ../common/src/util/relations.ts
 /**
@@ -1938,7 +2049,12 @@ var UID_NOT_NULL = /auth\.uid\(\)\s+IS\s+NOT\s+NULL/i;
 * is how the trusted *server* context is recognised), so:
 *
 *  - `auth.uid() IS NOT NULL` is a tautology on the user path, and
-*  - `auth.uid() != 'anon'` compares against a string no caller ever has.
+*  - `auth.uid() != 'anon'` excludes one spelling of anonymous and admits the
+*    other. This one is not hypothetical and was not only a foreign habit:
+*    rebase's own request path reported `'anon'` while everything that compiled
+*    or checked a policy used `'anonymous'`, so whichever literal an author
+*    picked, half the anonymous callers walked through. See
+*    {@link ANONYMOUS_USER_IDS}.
 *
 * Either one turns a lockdown into a full grant, and neither looks wrong. No
 * real user id is ever one of these literals, and a user-context request is
@@ -1976,7 +2092,7 @@ function findAnonymousGrants(expr) {
 				found.push({
 					pattern: "foreign-uid-literal",
 					detail: literal.value,
-					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					explanation: `'${literal.value}' is a ${platform} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal.value}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in" — it compiles to NOT IN (${ANONYMOUS_USER_IDS.map((v) => `'${v}'`).join(", ")}), covering every spelling rebase has reported rather than whichever one you remember.`
 				});
 				return;
 			}
@@ -2071,7 +2187,7 @@ function compile(expr, scope) {
 		}
 		case "rolesOverlap": return `string_to_array(auth.roles(), ',') && ${rolesArraySql(expr.roles)}`;
 		case "rolesContain": return `string_to_array(auth.roles(), ',') @> ${rolesArraySql(expr.roles)}`;
-		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() <> ${quoteLiteral(ANONYMOUS_USER_ID)}`;
+		case "authenticated": return `auth.uid() IS NOT NULL AND auth.uid() NOT IN (${ANONYMOUS_USER_IDS.map(quoteLiteral).join(", ")})`;
 		case "serverContext": return "auth.uid() IS NULL";
 		case "existsIn": return compileExistsIn(expr, scope);
 		case "raw": return expr.sql.replace(/\{(\w+)\}/g, (_, col) => `${outerQualifier(scope)}${resolveColumnName(col, scope.outerCollection)}`);
@@ -3800,7 +3916,7 @@ function rowToEntity(row, slug, primaryKeys = []) {
 	};
 }
 /**
-* The relation envelope `toCmsRow` writes where a relation was:
+* The relation envelope `toFlatRow` writes where a relation was:
 * `{ id, path, __type: "relation", data: { id, path, values } }`. It is the
 * admin's view-model, and the only pipeline that produces one is postgres'.
 */
@@ -4178,6 +4294,6 @@ function buildSdkData(driver) {
 	return wrapAsSdkData(buildRebaseData(driver));
 }
 //#endregion
-export { DEFAULT_ONE_OF_VALUE as A, updateDateAutoValues as C, camelCase as D, mergeDeep as E, hasForeignKeyOnTarget as M, isManyToMany as N, toSnakeCase as O, Vector as P, normalizeToEntityRelation as S, getPolicyNamesForRule as T, buildCompositeId as _, getJunctionSecurityRules as a, createRelationRef as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, ANONYMOUS_USER_ID as j, DEFAULT_ONE_OF_TYPE as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, generateForeignKeyName as w, createRelationRefWithData as x, parseIdValues as y };
+export { toSnakeCase as A, normalizeToEntityRelation as C, getPolicyNamesForRule as D, legacyForeignKeyName as E, Vector as F, DEFAULT_ONE_OF_VALUE as M, hasForeignKeyOnTarget as N, mergeDeep as O, isManyToMany as P, createRelationRefWithData as S, generateForeignKeyName as T, buildCompositeId as _, getJunctionSecurityRules as a, parseIdValues as b, policyToPostgres as c, findRelation as d, getColumnName as f, resolveCollectionRelations as g, getTableVarName as h, getJunctionCollectionConfig as i, DEFAULT_ONE_OF_TYPE as j, camelCase as k, securityRuleToConditions as l, getTableName as m, CollectionRegistry as n, resolveJunctionSpecs as o, getEnumVarName as p, resolveStringColumnLength as r, getEffectiveSecurityRules as s, buildSdkData as t, findAnonymousGrants as u, getDeclaredPrimaryKeys as v, updateDateAutoValues as w, createRelationRef as x, isAddressableId as y };
 
-//# sourceMappingURL=src-DihrDFuP.js.map
+//# sourceMappingURL=src-DlPBctw_.js.map