@rebasepro/server-postgres 0.12.1-canary.gdfba2a1 → 0.12.1-canary.ge1bb178

package/src/utils/connection-string.ts

@@ -0,0 +1,58 @@
+/**
+ * Connection-string rewrites for the tools Rebase shells out to.
+ *
+ * Pure and dependency-free: `pg-tools` builds argument vectors without a live
+ * server, and these have to be usable from there.
+ */
+
+/**
+ * The `sslmode` values libpq accepts. `no-verify` is conspicuously not one.
+ */
+const LIBPQ_SSLMODES = new Set(["disable", "allow", "prefer", "require", "verify-ca", "verify-full"]);
+
+/**
+ * Make a connection string safe to hand to a libpq program.
+ *
+ * `sslmode=no-verify` is a node-postgres convention — encrypt, but do not check
+ * the certificate — and libpq does not have it. It does not degrade or warn:
+ *
+ *     psql: error: invalid sslmode value: "no-verify"
+ *
+ * which means a `DATABASE_URL` that works perfectly for the app makes `psql`,
+ * `pg_dump`, `pg_restore` and Atlas all refuse to start, with an error that
+ * points at the value rather than at the convention it comes from. It has cost
+ * this project time more than once.
+ *
+ * `require` is the honest translation: libpq's `require` encrypts and does not
+ * verify the certificate either, which is exactly what `no-verify` asks for.
+ * Nothing is relaxed by the rewrite — `verify-ca` and `verify-full` are left
+ * alone, so a connection string that asked for verification still gets it.
+ *
+ * Only `sslmode` is touched, and only when it is a value libpq would reject.
+ * Anything unparseable is returned as given: a connection that works
+ * unverified beats one this corrupted.
+ */
+export function forLibpq(connectionString: string): string {
+    let url: URL;
+    try {
+        url = new URL(connectionString);
+    } catch {
+        // Key/value DSNs and anything else we cannot parse. A `sslmode` in one
+        // of those is space-separated rather than a query parameter, and
+        // rewriting it with a regex is how a password containing "sslmode="
+        // gets mangled.
+        return connectionString;
+    }
+    if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+
+    const sslmode = url.searchParams.get("sslmode");
+    if (sslmode === null || LIBPQ_SSLMODES.has(sslmode)) return connectionString;
+
+    url.searchParams.set("sslmode", "require");
+    // Re-serialize by hand for the reason `pinSearchPath` does: URLSearchParams
+    // writes a space as `+`, which node-postgres decodes and libpq does not.
+    url.search = Array.from(url.searchParams.entries())
+        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+        .join("&");
+    return url.toString();
+}

package/src/utils/drizzle-conditions.ts

@@ -175,10 +175,11 @@ export class DrizzleConditionBuilder {
     static buildRelationScopeCondition(
         relation: ResolvedRelation,
         /**
-         * Lazy: only `via` and `belongsTo` need the parent's own table. A
-         * foreign key on the target and a junction are both expressible from
-         * the parent's *id* alone, and requiring the table for them would make
-         * a child listing fail on a parent whose table isn't registered.
+         * Lazy: `via`, `belongsTo`, and a foreign key that points at a
+         * `sourceKey` need the parent's own table. A junction and a plain
+         * foreign key are expressible from the parent's *id* alone, and
+         * requiring the table for them would make a child listing fail on a
+         * parent whose table isn't registered.
          */
         parent: () => { table: PgTable<any>; idColumn: AnyPgColumn },
         parentId: string | number,
@@ -239,7 +240,16 @@ export class DrizzleConditionBuilder {
                         `relation '${relation.relationName}'.`
                     );
                 }
-                return eq(fkColumn, parentId);
+                if (!relation.sourceKey) return eq(fkColumn, parentId);
+
+                // A link on a natural key: the foreign key holds a column of the
+                // parent row, not its id, so the parent has to be read. As a
+                // subquery rather than a prior SELECT, for the same reason
+                // `belongsTo` below is — one statement sees one snapshot, and a
+                // scope condition that read the key separately could be built
+                // from a value the very next statement no longer agrees with.
+                const { table, idColumn } = parent();
+                return sql`${fkColumn} = (SELECT ${sql.identifier(relation.sourceKey)} FROM ${table} WHERE ${idColumn} = ${parentId})`;
             }
 
             case "belongsTo": {
@@ -385,7 +395,22 @@ export class DrizzleConditionBuilder {
             // inverse, so reversing it into a filter is a different problem
             // from the two shapes below rather than a third case of them.
             if (relation && (hasForeignKeyOnTarget(relation) || isManyToMany(relation)) && registry && sourceIdColumn) {
-                return { kind: "relation", relation, registry, sourceIdColumn };
+                // The `EXISTS` correlates the target's foreign key with a column
+                // on *this* table, and that is the primary key only when the
+                // link joins on it. A `sourceKey` names a different one, and
+                // correlating on the id anyway silently matches nothing —
+                // "filter by this relation" would quietly return zero rows.
+                const correlationColumn = hasForeignKeyOnTarget(relation) && relation.sourceKey
+                    ? columnAt(relation.sourceKey)
+                    : sourceIdColumn;
+                if (!correlationColumn) {
+                    throw new Error(
+                        `\`sourceKey: "${(relation as ResolvedForeignKeyOnTarget).sourceKey}"\` on relation ` +
+                        `'${relation.relationName}' is not a column on '${collectionPath}', so a filter on ` +
+                        "that relation has nothing to correlate against."
+                    );
+                }
+                return { kind: "relation", relation, registry, sourceIdColumn: correlationColumn };
             }
         }
 

package/src/utils/pg-error-utils.ts

@@ -97,6 +97,52 @@ export function extractCauseMessage(error: unknown): string | null {
     return null;
 }
 
+/**
+ * Codes that mean "this connection will never work as configured".
+ *
+ * A wrong password or a database that does not exist is a settled fact about
+ * the connection string, not a transient fault — retrying produces the same
+ * answer forever.
+ */
+const UNRECOVERABLE_CONNECT_CODES = new Set([
+    "28P01", // invalid_password
+    "28000", // invalid_authorization_specification
+    "3D000", // invalid_catalog_name — the database does not exist
+    "42501"  // insufficient_privilege
+]);
+
+export interface ConnectFailure {
+    /** True when retrying cannot help: the connection string itself is wrong. */
+    fatal: boolean;
+    /** The deepest message available — the Postgres one where there is one. */
+    reason: string;
+    /** The `SQLSTATE`, when the failure came from Postgres rather than the socket. */
+    code?: string;
+}
+
+/**
+ * Describe a failed connection attempt in terms a developer can act on.
+ *
+ * The error a caller catches is Drizzle's wrapper: its message is
+ * `Failed query: SELECT 1` and its stack runs through drizzle internals, while
+ * the sentence that says what is actually wrong — "password authentication
+ * failed for user …", "database … does not exist" — sits in `.cause`. Logging
+ * the wrapper, as the bootstrapper used to, tells a developer with a typo in
+ * their `DATABASE_URL` nothing at all.
+ */
+export function classifyConnectFailure(error: unknown): ConnectFailure {
+    const pgError = extractPgError(error);
+    const reason =
+        pgError?.message ??
+        extractCauseMessage(error) ??
+        (error instanceof Error ? error.message : String(error));
+    return {
+        fatal: Boolean(pgError?.code && UNRECOVERABLE_CONNECT_CODES.has(pgError.code)),
+        reason,
+        code: pgError?.code
+    };
+}
+
 /**
  * Detect whether an error is specifically a role-switching permission failure
  * (e.g. "permission denied to set role" or "must be member of role"),

package/src/websocket.ts

@@ -1,13 +1,13 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import type { DataDriver, DeleteProps, FetchCollectionProps, FetchOneProps, SaveProps, TableMetadata, BranchInfo, AuthAdapter } from "@rebasepro/types";
-import { isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { ANONYMOUS_USER_ID, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
 import type { User } from "@rebasepro/types";
 
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
-import { extractUserFromToken, AccessTokenPayload, safeCompare } from "@rebasepro/server";
+import { extractUserFromToken, AccessTokenPayload, safeCompare, resolveRequireAuth } from "@rebasepro/server";
 import { logger } from "@rebasepro/server";
 
 /** Minimal subset of RebaseAuthConfig used by the WebSocket layer. */
@@ -116,11 +116,20 @@ export function createPostgresWebSocket(
         logger.error("❌ [WebSocket Server] Error", { error: err });
     });
 
-    // Auth is required when either: an adapter is present (secure by default),
-    // OR the config has a jwtSecret and requireAuth !== false.
-    const requireAuth = authAdapter
-        ? true
-        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
+    // The same predicate the HTTP data routes use, from the same function —
+    // this socket is the other enforcement point for one product decision, and
+    // while it computed the answer itself it computed a different one. See
+    // `resolveRequireAuth` for what its local copy got wrong and why a `false`
+    // here grants access rather than skipping a check.
+    const requireAuth = !!authAdapter || resolveRequireAuth(authConfig as never);
+
+    if (requireAuth && !authAdapter && !authConfig?.jwtSecret && !authConfig?.serviceKey) {
+        logger.warn(
+            "🔐 [WebSocket Server] Authentication is required but no adapter, jwtSecret or " +
+            "serviceKey is configured — no client can complete AUTH, so every realtime " +
+            "message will be refused with UNAUTHORIZED."
+        );
+    }
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
@@ -281,7 +290,7 @@ roles: verifiedUser.roles }
                                     roles: session.user.roles ?? []
                                 }
                                 : {
-                                    uid: "anon",
+                                    uid: ANONYMOUS_USER_ID,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -620,7 +629,7 @@ colors: true }));
                         const authContext = session?.user
                             ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { uid: "anon",
+                            : { uid: ANONYMOUS_USER_ID,
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {