@rebasepro/server-postgres 0.12.1-canary.gdfba2a1 → 0.12.1-canary.ge1bb178

package/dist/PostgresBackendDriver.d.ts

@@ -105,7 +105,7 @@ export declare class PostgresBackendDriver implements DataDriver {
     delete<M extends Record<string, unknown>>({ row, collection }: DeleteProps<M>): Promise<void>;
     deleteAll(path: string): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;
-    count<M extends Record<string, unknown>>({ path, collection, filter, searchString }: FetchCollectionProps<M>): Promise<number>;
+    count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString }: FetchCollectionProps<M>): Promise<number>;
     private getTargetDb;
     executeSql(sqlText: string, options?: {
         database?: string;

package/dist/PostgresBootstrapper.d.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { BackendBootstrapper, type RealtimeChannelsConfig } from "@rebasepro/types";
+import { BackendBootstrapper, CollectionConfig, type RealtimeChannelsConfig } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import { RealtimeService } from "./services/realtimeService";
 import { DatabasePoolManager } from "./databasePoolManager";
@@ -65,6 +65,30 @@ export interface PostgresDriverInternals {
      */
     provisionCdcForTables?: (tables: CdcTableRef[]) => Promise<void>;
 }
+/**
+ * Which table name the boot-time drift check should look for, for one collection.
+ *
+ * A declared `table` IS the table name, not a hint to be second-guessed. This
+ * used to ask the registry whether it had indexed the declared name and fall
+ * back to the SLUG when it had not — but "the registry does not know this table"
+ * is exactly the condition the drift check exists to report, so the fallback
+ * fired precisely when it was most harmful.
+ *
+ * A collection with `slug: "usage-daily", table: "usage_daily"` was reported as
+ * missing table `usage-daily`: a name that does not exist, should never exist,
+ * and that nobody can find by looking. Worse, the remediation the caller prints
+ * says to run `rebase db push` — which would then CREATE that invented table
+ * beside the correct one, the same "second copy" hazard the misplaced-schema
+ * branch further down exists to prevent. Seen in production, where a correctly
+ * migrated database reported drift on every boot.
+ *
+ * The slug is used only when nothing was declared, which is the config shape
+ * where the slug genuinely is the table name.
+ *
+ * Exported for its own test: the caller needs a live pool and a real database,
+ * and this is the part that was wrong.
+ */
+export declare function resolveDriftCheckName(col: CollectionConfig, registeredTableNames: string[]): string;
 /**
  * Default PostgreSQL bootstrapper.
  *

package/dist/auth/services.d.ts

@@ -23,8 +23,13 @@ export interface AuthSchemaTables {
  *
  * Whitespace goes too: a trailing space survives the fold and reproduces the
  * problem exactly.
+ *
+ * Re-exported rather than defined here: `@rebasepro/server` and
+ * `@rebasepro/server-mongo` write this column too, and a second copy of this
+ * rule is the defect it exists to prevent.
  */
-export declare function normalizeEmail<T>(email: T): T | string;
+import { normalizeEmail } from "@rebasepro/common";
+export { normalizeEmail };
 /**
  * PostgreSQL implementation of UserRepository.
  * Handles all user-related database operations using Drizzle ORM.

package/dist/backup/backup-service.d.ts

@@ -1,5 +1,5 @@
 import type { StorageController } from "@rebasepro/server";
-import { BackupDestination, VersionCompatibility } from "./pg-tools";
+import { BackupDestination, type RowSecurityIdentity, VersionCompatibility } from "./pg-tools";
 import { BackupObject, RetentionOptions } from "./retention";
 export declare class BackupToolError extends Error {
     readonly hint?: string | undefined;
@@ -54,6 +54,15 @@ export declare function createDump(opts: {
     inheritStdio?: boolean;
     includeGlobals?: boolean;
     env?: Record<string, string | undefined>;
+    /**
+     * Dump with row security left on, reading as this identity.
+     *
+     * The escape hatch for a managed Postgres, where the dumping role owns
+     * nothing and has no `BYPASSRLS`. Off by default, and deliberately so: with
+     * row security on, `pg_dump` stops erroring on rows it cannot see and
+     * simply omits them. See {@link RowSecurityIdentity}.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): Promise<BackupResult>;
 /**
  * Cheap integrity check on a freshly written dump: it must be non-empty and

package/dist/backup/pg-tools.d.ts

@@ -79,6 +79,36 @@ export declare function parseBackupDestination(out: string): BackupDestination;
  * doubled slash.
  */
 export declare function joinStorageKey(prefix: string, fileName: string): string;
+/**
+ * The identity `pg_dump` reads rows as, when row security is left on.
+ *
+ * Not optional, and that is the whole design. `pg_dump --enable-row-security`
+ * on its own is the dangerous command in this file: it turns the "query would
+ * be affected by row-level security policy" *error* into a dump that exits 0
+ * and is silently missing every row the dumping role's policies exclude. A
+ * backup that looks fine and restores most of your data is worse than one that
+ * refused to run.
+ *
+ * So the flag is unreachable without a subject to evaluate the policies
+ * against. Rebase's generated policies read `app.uid` and `app.user_roles`;
+ * supplying an admin role satisfies the `admin_full_access` rule and the dump
+ * sees everything that rule sees.
+ */
+export interface RowSecurityIdentity {
+    /** Written to `app.uid`. Any non-empty value — it is only an audit trail. */
+    uid: string;
+    /** Written to `app.user_roles`. Must include a role the policies admit. */
+    roles: string[];
+}
+/**
+ * `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+ * set a GUC.
+ *
+ * A backslash escape rather than quoting, which is what libpq's `-c` parsing
+ * takes: a space inside a value ends the option otherwise, so a role list is
+ * comma-joined and never spaced.
+ */
+export declare function buildRowSecurityPgOptions(identity: RowSecurityIdentity): string;
 /**
  * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
  * which is compressed and restorable selectively via `pg_restore`.
@@ -90,7 +120,24 @@ export declare function buildPgDumpArgs(opts: {
     excludeSchemas?: string[];
     /** Number of parallel jobs (directory format only; ignored for -Fc). */
     noOwner?: boolean;
+    /**
+     * Dump with row security on, as this identity. Omit — which is the default
+     * — and `pg_dump` errors rather than skipping rows it cannot see.
+     */
+    rowSecurity?: RowSecurityIdentity;
 }): string[];
+/**
+ * Whether a `pg_dump` failure is the row-security one, and what to do about it.
+ *
+ * The error text names the table and nothing else, so the first read of it is
+ * "why would a backup be affected by RLS at all?" — the answer being that the
+ * dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+ * normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+ * Postgres. Nothing about that is visible from the message.
+ *
+ * Returns `null` for any other failure, so the caller reports it unchanged.
+ */
+export declare function diagnoseRowSecurityDumpFailure(error: unknown): string | null;
 /**
  * Assemble the `pg_restore` argument vector for a custom-format dump.
  */

package/dist/{backup-service-DH9kPg-E.js → backup-service-CD8o_1Sl.js}

@@ -1,7 +1,7 @@
 import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
-import { c as __require, l as __toESM, o as __commonJSMin, s as __exportAll } from "./connection-B5Wndbr1.js";
+import { c as __exportAll, l as __require, s as __commonJSMin, u as __toESM } from "./connection-BuZ97wsr.js";
 import "./src-DoU9yPqq.js";
 import "@rebasepro/server";
 import fs from "fs";
@@ -23,9 +23,72 @@ import { appendFileSync, createReadStream, createWriteStream, readFileSync, stat
 import { finished } from "node:stream/promises";
 import { Duplex, PassThrough, Readable, Transform, Writable, getDefaultHighWaterMark } from "node:stream";
 import { Buffer as Buffer$1 } from "node:buffer";
+import "module";
 import { fileURLToPath as fileURLToPath$1 } from "url";
+//#region src/utils/connection-string.ts
+/**
+* Connection-string rewrites for the tools Rebase shells out to.
+*
+* Pure and dependency-free: `pg-tools` builds argument vectors without a live
+* server, and these have to be usable from there.
+*/
+/**
+* The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+*/
+var LIBPQ_SSLMODES = /* @__PURE__ */ new Set([
+	"disable",
+	"allow",
+	"prefer",
+	"require",
+	"verify-ca",
+	"verify-full"
+]);
+/**
+* Make a connection string safe to hand to a libpq program.
+*
+* `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+* the certificate — and libpq does not have it. It does not degrade or warn:
+*
+*     psql: error: invalid sslmode value: "no-verify"
+*
+* which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+* `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+* points at the value rather than at the convention it comes from. It has cost
+* this project time more than once.
+*
+* `require` is the honest translation: libpq's `require` encrypts and does not
+* verify the certificate either, which is exactly what `no-verify` asks for.
+* Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+* alone, so a connection string that asked for verification still gets it.
+*
+* Only `sslmode` is touched, and only when it is a value libpq would reject.
+* Anything unparseable is returned as given: a connection that works
+* unverified beats one this corrupted.
+*/
+function forLibpq(connectionString) {
+	let url;
+	try {
+		url = new URL(connectionString);
+	} catch {
+		return connectionString;
+	}
+	if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+	const sslmode = url.searchParams.get("sslmode");
+	if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+	url.searchParams.set("sslmode", "require");
+	url.search = Array.from(url.searchParams.entries()).map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`).join("&");
+	return url.toString();
+}
+//#endregion
 //#region src/backup/pg-tools.ts
 /**
+* Pure helpers for the backup/restore commands.
+*
+* Everything in this file is side-effect free so it can be unit-tested
+* without a live Postgres server, matching the constraint that CI must
+* not require a database.
+*/
+/**
 * Extract the database name from a Postgres connection string.
 * Returns `null` when the URL has no database path (e.g. bare host).
 */
@@ -155,6 +218,22 @@ function joinStorageKey(prefix, fileName) {
 	return clean.length > 0 ? `${clean}/${fileName}` : fileName;
 }
 /**
+* `PGOPTIONS` carrying an identity, for a libpq tool that has no other way to
+* set a GUC.
+*
+* A backslash escape rather than quoting, which is what libpq's `-c` parsing
+* takes: a space inside a value ends the option otherwise, so a role list is
+* comma-joined and never spaced.
+*/
+function buildRowSecurityPgOptions(identity) {
+	const escape = (value) => value.replace(/([\\ ])/g, "\\$1");
+	return [
+		`-c app.uid=${escape(identity.uid)}`,
+		`-c app.user_id=${escape(identity.uid)}`,
+		`-c app.user_roles=${escape(identity.roles.join(","))}`
+	].join(" ");
+}
+/**
 * Assemble the `pg_dump` argument vector. Uses the custom format (`-Fc`),
 * which is compressed and restorable selectively via `pg_restore`.
 */
@@ -165,18 +244,56 @@ function buildPgDumpArgs(opts) {
 		`--file=${opts.outFile}`
 	];
 	if (opts.noOwner) args.push("--no-owner");
+	if (opts.rowSecurity) args.push("--enable-row-security");
 	for (const schema of opts.excludeSchemas ?? []) args.push(`--exclude-schema=${schema}`);
-	args.push(opts.connectionString);
+	args.push(forLibpq(opts.connectionString));
 	return args;
 }
 /**
+* Whether a `pg_dump` failure is the row-security one, and what to do about it.
+*
+* The error text names the table and nothing else, so the first read of it is
+* "why would a backup be affected by RLS at all?" — the answer being that the
+* dumping role is not the tables' owner and has no `BYPASSRLS`, which is the
+* normal state of the `postgres` user on Cloud SQL, RDS and every other managed
+* Postgres. Nothing about that is visible from the message.
+*
+* Returns `null` for any other failure, so the caller reports it unchanged.
+*/
+function diagnoseRowSecurityDumpFailure(error) {
+	const text = [error?.stderr, error?.message].map((part) => typeof part === "string" ? part : "").join("\n");
+	if (!/row-level security policy/i.test(text)) return null;
+	const table = text.match(/for table "([^"]+)"/)?.[1];
+	return [
+		`pg_dump cannot read ${table ? `"${table}"` : "one of the tables"} because row-level security applies to it.`,
+		"",
+		"  The dumping role is neither the table's owner nor `BYPASSRLS`, which is the normal",
+		"  state of the `postgres` user on Cloud SQL, RDS and other managed Postgres — there is",
+		"  no superuser to hand out.",
+		"",
+		"  Two ways out:",
+		"",
+		"    • Grant the dumping role BYPASSRLS, or make it the owner, and run this again. The",
+		"      dump then contains every row, which is what a backup should mean.",
+		"",
+		"    • Re-run with --enable-row-security to dump as an admin subject instead. Rebase",
+		"      sets `app.uid`/`app.user_roles` so the generated `admin_full_access` policy",
+		"      admits the dump. Read the warning it prints: the result contains exactly the",
+		"      rows those policies admit, and any table whose policies do not include an",
+		"      admin rule comes out short — with no error.",
+		"",
+		"  Do not reach for a bare `pg_dump --enable-row-security` by hand. Without the",
+		"  settings above it succeeds and silently omits rows."
+	].join("\n");
+}
+/**
 * Assemble the `pg_restore` argument vector for a custom-format dump.
 */
 function buildPgRestoreArgs(opts) {
 	const args = [
 		"--format=custom",
 		"--no-password",
-		`--dbname=${opts.connectionString}`
+		`--dbname=${forLibpq(opts.connectionString)}`
 	];
 	if (opts.clean) args.push("--clean", "--if-exists");
 	if (opts.noOwner) args.push("--no-owner");
@@ -209,7 +326,7 @@ function buildPgDumpallGlobalsArgs(opts) {
 		"--no-role-passwords",
 		"--no-password",
 		`--file=${opts.outFile}`,
-		`--dbname=${opts.connectionString}`
+		`--dbname=${forLibpq(opts.connectionString)}`
 	];
 }
 /**
@@ -6446,6 +6563,11 @@ createExeca(mapNode);
 createExeca(mapScriptAsync, {}, deepScriptOptions, setScriptSync);
 var { sendMessage, getOneMessage, getEachMessage, getCancelSignal } = getIpcExport();
 //#endregion
+//#region __vite-browser-external
+var require___vite_browser_external = /* @__PURE__ */ __commonJSMin(((exports, module) => {
+	module.exports = {};
+}));
+//#endregion
 //#region ../../node_modules/.pnpm/color-name@1.1.4/node_modules/color-name/index.js
 var require_color_name = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = {
@@ -8495,6 +8617,7 @@ var require_source = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	chalk.stderr.supportsColor = stderrColor;
 	module.exports = chalk;
 }));
+require___vite_browser_external();
 require_source();
 var moduleDir = path.dirname(fileURLToPath$1(import.meta.url));
 //#endregion
@@ -8669,15 +8792,25 @@ async function createDump(opts) {
 	const outDir = opts.outDir ?? fs.mkdtempSync(path.join(os.tmpdir(), "rebase-backup-"));
 	fs.mkdirSync(outDir, { recursive: true });
 	const localFile = path.join(outDir, fileName);
-	await execa(bin, buildPgDumpArgs({
+	const args = buildPgDumpArgs({
 		connectionString: opts.connectionString,
 		outFile: localFile,
 		excludeSchemas: opts.excludeSchemas,
-		noOwner: opts.noOwner
-	}), {
-		stdio: opts.inheritStdio ? "inherit" : "pipe",
-		env: { ...env }
+		noOwner: opts.noOwner,
+		rowSecurity: opts.rowSecurity
 	});
+	const dumpEnv = { ...env };
+	if (opts.rowSecurity) dumpEnv.PGOPTIONS = [env.PGOPTIONS, buildRowSecurityPgOptions(opts.rowSecurity)].filter(Boolean).join(" ");
+	try {
+		await execa(bin, args, {
+			stdio: opts.inheritStdio ? "inherit" : "pipe",
+			env: dumpEnv
+		});
+	} catch (error) {
+		const diagnosis = diagnoseRowSecurityDumpFailure(error);
+		if (!diagnosis) throw error;
+		throw new BackupToolError(diagnosis, "Run `rebase db backup --help` for the flag, and read what it says about partial dumps.");
+	}
 	const result = {
 		localFile,
 		fileName,
@@ -8861,6 +8994,6 @@ async function pruneBackups(dest, options, storage) {
 	return toDelete;
 }
 //#endregion
-export { serverVersionNumToMajor as A, globalsFileForDump as C, parseDbNameFromUrl as D, parseBackupTimestamp as E, withDatabaseName as M, parsePgToolMajor as O, checkToolServerCompatibility as S, parseBackupDestination as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, listBackups as c, resolvePgBinary as d, restoreDump as f, selectBackupsToPrune as g, require_source as h, createDump as i, splitGlobalsStatements as j, resolveConnectionString as k, preflight as l, validateDump as m, applyGlobals as n, ensureDatabaseExists as o, uploadBackup as p, backup_service_exports as r, getServerVersionMajor as s, BackupToolError as t, pruneBackups as u, buildPgDumpArgs as v, joinStorageKey as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
+export { parsePgToolMajor as A, checkToolServerCompatibility as C, parseBackupDestination as D, joinStorageKey as E, serverVersionNumToMajor as M, splitGlobalsStatements as N, parseBackupTimestamp as O, withDatabaseName as P, buildRowSecurityPgOptions as S, globalsFileForDump as T, buildBackupFilename as _, detectToolMajor as a, buildPgRestoreArgs as b, listBackups as c, resolvePgBinary as d, restoreDump as f, selectBackupsToPrune as g, require_source as h, createDump as i, resolveConnectionString as j, parseDbNameFromUrl as k, preflight as l, validateDump as m, applyGlobals as n, ensureDatabaseExists as o, uploadBackup as p, backup_service_exports as r, getServerVersionMajor as s, BackupToolError as t, pruneBackups as u, buildPgDumpArgs as v, diagnoseRowSecurityDumpFailure as w, buildPgRestoreListArgs as x, buildPgDumpallGlobalsArgs as y };
 
-//# sourceMappingURL=backup-service-DH9kPg-E.js.map
+//# sourceMappingURL=backup-service-CD8o_1Sl.js.map