@rebasepro/server-postgres 0.12.1-canary.gf4240e3 → 0.13.0

package/dist/utils/pg-error-utils.d.ts

@@ -24,6 +24,22 @@ export interface PostgresError extends Error {
  * error code (5-char alphanumeric, e.g. `42P01`).
  */
 export declare function extractPgError(error: unknown): PostgresError | null;
+/**
+ * Whether the failure came back from Postgres rather than from building the
+ * query — which decides whether a fallback query is worth issuing.
+ *
+ * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+ * RLS). Once a statement raises, that transaction is aborted, and every later
+ * statement on it returns `25P02` — "current transaction is aborted, commands
+ * ignored until end of transaction block". So a retry after a database error
+ * cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+ * for type uuid") with a generic one. Rethrow instead.
+ *
+ * A query the driver could not even build — a missing reciprocal relation, say
+ * — never reached Postgres, leaves the transaction usable, and is exactly what
+ * the fallback paths exist for.
+ */
+export declare function reachedDatabase(error: unknown): boolean;
 /**
  * Walk the error cause chain and return the deepest meaningful message.
  */

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.12.1-canary.gf4240e3",
+  "version": "0.13.0",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/codegen": "0.12.1-canary.gf4240e3",
-    "@rebasepro/common": "0.12.1-canary.gf4240e3",
-    "@rebasepro/server": "0.12.1-canary.gf4240e3",
-    "@rebasepro/utils": "0.12.1-canary.gf4240e3",
-    "@rebasepro/types": "0.12.1-canary.gf4240e3"
+    "@rebasepro/codegen": "0.13.0",
+    "@rebasepro/common": "0.13.0",
+    "@rebasepro/types": "0.13.0",
+    "@rebasepro/server": "0.13.0",
+    "@rebasepro/utils": "0.13.0"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",

package/src/schema/generate-drizzle-schema-logic.ts

@@ -137,6 +137,25 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: Collecti
             let baseType = (numProp.validation?.integer || isId) ? `integer("${colName}")` : `numeric("${colName}")`;
             if (numProp.columnType) {
                 if (numProp.columnType === "double precision") baseType = `doublePrecision("${colName}")`;
+                // `bigint` and `bigserial` are the only pg-core builders that
+                // *require* a config argument: without `mode`, drizzle cannot
+                // know whether to hand back a `number` or a `bigint`, and the
+                // emitted call does not typecheck.
+                //
+                // This is why `schema.generated.ts` drifted. Regenerating it
+                // produced a file that would not compile, so the bigint lines
+                // were hand-patched — and every regeneration after that looked
+                // like a large, alarming diff nobody wanted to ship. The file
+                // then sat stale for long enough that a security fix to two RLS
+                // policies never reached production.
+                //
+                // `number` rather than `bigint`: these are counters and byte
+                // totals that every caller already treats as numbers, and
+                // switching the runtime type would be a breaking change to
+                // every consumer of the generated schema.
+                else if (numProp.columnType === "bigint" || numProp.columnType === "bigserial") {
+                    baseType = `${numProp.columnType}("${colName}", { mode: "number" })`;
+                }
                 else baseType = `${numProp.columnType}("${colName}")`;
             }
 

package/src/services/BranchService.ts

@@ -64,20 +64,41 @@ function validateIdentifier(value: string, label: string): void {
 }
 
 /**
- * Sanitize a user-provided branch name to a safe PostgreSQL identifier.
- * Only allows alphanumeric characters and underscores.
+ * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it
+ * silently. The prefix comes out of the same budget.
  */
-function sanitizeBranchName(name: string): string {
-    return name.replace(/[^a-zA-Z0-9_]/g, "");
+const MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;
+
+/**
+ * Check a user-provided branch name, and otherwise leave it exactly as given.
+ *
+ * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was
+ * quietly created as `myfeature`: the name you typed was not the name `list`
+ * gave back. Nothing ever needed that. Every identifier this service builds is
+ * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen
+ * safe, and `validateIdentifier` has always accepted hyphens for the `--from`
+ * source database — the two disagreed about the same character class.
+ *
+ * Refusing a name we cannot represent is better than representing a different
+ * one, which is also why the length is checked here rather than left to
+ * Postgres, whose answer to an over-long identifier is a silent rename.
+ */
+function assertValidBranchName(name: string): void {
+    validateIdentifier(name, "branch name");
+    if (name.length > MAX_BRANCH_NAME_LENGTH) {
+        throw new Error(
+            `Branch name "${name}" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +
+            "Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose."
+        );
+    }
 }
 
 /**
  * Convert a user-facing branch name to the actual PostgreSQL database name.
  */
 function toBranchDbName(name: string): string {
-    const sanitized = sanitizeBranchName(name);
-    if (!sanitized) throw new Error("Branch name must contain at least one alphanumeric character.");
-    return `${BRANCH_DB_PREFIX}${sanitized}`;
+    assertValidBranchName(name);
+    return `${BRANCH_DB_PREFIX}${name}`;
 }
 
 export class BranchService {
@@ -120,15 +141,14 @@ export class BranchService {
         }
 
         const dbName = toBranchDbName(name);
-        const sanitizedName = sanitizeBranchName(name);
         const sourceDb = options?.source || this.poolManager.defaultDatabaseName;
 
         // Check if branch already exists
         const existing = await this.db.execute(
-            sql`SELECT name FROM rebase.branches WHERE name = ${sanitizedName} OR db_name = ${dbName}`
+            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`
         );
         if ((existing.rows as unknown[]).length > 0) {
-            throw new Error(`Branch "${sanitizedName}" already exists.`);
+            throw new Error(`Branch "${name}" already exists.`);
         }
 
         // Disconnect any idle pools to the source DB so TEMPLATE works.
@@ -158,12 +178,12 @@ export class BranchService {
         // Record metadata in the default database
         const now = new Date();
         await this.db.execute(
-            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
-                VALUES (${sanitizedName}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
+            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)
+                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
         );
 
         return {
-            name: sanitizedName,
+            name,
             parentDatabase: sourceDb,
             createdAt: now
         };
@@ -174,20 +194,35 @@ export class BranchService {
      * Cannot delete the main/default database.
      */
     async deleteBranch(name: string): Promise<void> {
-        const sanitizedName = sanitizeBranchName(name);
-        const dbName = toBranchDbName(name);
+        assertValidBranchName(name);
 
-        // Safety: never delete the default database
-        if (dbName === this.poolManager.defaultDatabaseName) {
+        // Safety, first pass: a request that would target the default database
+        // is refused before any metadata is read, so the answer costs nothing
+        // and cannot depend on what a row happens to say.
+        if (toBranchDbName(name) === this.poolManager.defaultDatabaseName) {
             throw new Error("Cannot delete the main database.");
         }
 
-        // Verify the branch exists in our metadata
+        // Verify the branch exists, and take the database name from the row
+        // rather than deriving it again. A branch created before names stopped
+        // being stripped is recorded as `rb_myfeature` while `my-feature` now
+        // derives `rb_my-feature`; re-deriving would drop a database this row
+        // never named — or, if that name happened to exist, somebody else's.
+        // The stored value is the only one that is true by construction.
         const existing = await this.db.execute(
-            sql`SELECT db_name FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`
         );
-        if ((existing.rows as unknown[]).length === 0) {
-            throw new Error(`Branch "${sanitizedName}" not found.`);
+        const existingRows = existing.rows as Record<string, unknown>[];
+        if (existingRows.length === 0) {
+            throw new Error(`Branch "${name}" not found.`);
+        }
+        const dbName = existingRows[0].db_name as string;
+
+        // Safety, second pass: the first checked a name we derived, this checks
+        // the one we are about to drop. They differ for any row written under
+        // the old scheme, and it is this one that governs.
+        if (dbName === this.poolManager.defaultDatabaseName) {
+            throw new Error("Cannot delete the main database.");
         }
 
         // Disconnect any pools to this branch before dropping
@@ -201,7 +236,7 @@ export class BranchService {
             const pgError = extractPgError(err);
             if (pgError?.code === PG_OBJECT_IN_USE) {
                 throw new Error(
-                    `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
+                    `Cannot delete branch "${name}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
@@ -210,7 +245,7 @@ export class BranchService {
 
         // Remove metadata
         await this.db.execute(
-            sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`DELETE FROM rebase.branches WHERE name = ${name}`
         );
     }
 
@@ -242,15 +277,16 @@ export class BranchService {
      * Get info about a specific branch.
      */
     async getBranchInfo(name: string): Promise<BranchInfo | undefined> {
-        const sanitizedName = sanitizeBranchName(name);
+        assertValidBranchName(name);
 
         const result = await this.db.execute(sql`
-            SELECT 
+            SELECT
                 b.name,
+                b.db_name,
                 b.parent_db,
                 b.created_at
             FROM rebase.branches b
-            WHERE b.name = ${sanitizedName}
+            WHERE b.name = ${name}
         `);
 
         const rows = result.rows as Record<string, unknown>[];
@@ -258,10 +294,12 @@ export class BranchService {
 
         const row = rows[0];
 
-        // Attempt to get size — may fail if the DB was externally dropped
+        // Attempt to get size — may fail if the DB was externally dropped.
+        // Same reason as `deleteBranch`: the size of a re-derived name is the
+        // size of some other database, or of nothing.
         let sizeBytes: number | undefined;
         try {
-            const dbName = toBranchDbName(sanitizedName);
+            const dbName = row.db_name as string;
             const sizeResult = await this.db.execute(
                 sql`SELECT pg_database_size(${dbName}) as size_bytes`
             );

package/src/services/FetchService.ts

@@ -12,6 +12,7 @@ import {
     requirePrimaryKeys,
     deriveRowAddress,
     parseIdValues,
+    idCanAddressTable,
     buildCompositeId,
     COMPOSITE_ID_SEPARATOR
 } from "./collection-helpers";
@@ -23,6 +24,7 @@ import { PostgresCollectionRegistry } from "../collections/PostgresCollectionReg
 import { toFlatRow, toRestRow, isJunctionRelation } from "./row-pipeline";
 import { isNestedPath, resolveNestedPath, type NestedPathHop } from "./nested-path";
 import { ApiError, logger } from "@rebasepro/server";
+import { reachedDatabase } from "../utils/pg-error-utils";
 
 /** Type-safe accessor for Drizzle's relational query API via dynamic table name */
 type DbQueryAccessor = Record<string, RelationalQueryBuilder<any, any>> | undefined;
@@ -588,6 +590,11 @@ idColumn };
             throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
         }
 
+        // An address the key columns cannot hold names no row — the same answer
+        // as a well-formed id nobody has. Asking Postgres instead raises 22P02
+        // and aborts the transaction around this read.
+        if (!idCanAddressTable(id, table, idInfoArray)) return undefined;
+
         const parsedIdObj = parseIdValues(id, idInfoArray);
         const parsedId = parsedIdObj[idInfo.fieldName];
 
@@ -618,6 +625,7 @@ idColumn };
                     logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
                     logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
                 }
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[FetchService] db.query.findFirst failed for ${collectionPath}, falling back to db.select`, { error: e });
             }
         }
@@ -743,6 +751,7 @@ idColumn };
                     logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
                     logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
                 }
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[FetchService] db.query.findMany failed for ${collectionPath}, falling back to db.select`, { error: e });
             }
         }
@@ -1173,6 +1182,7 @@ relatedTo: hop }, include
                     logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
                     logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
                 }
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[fetchCollectionForRest] db.query.findMany failed for ${collectionPath}, falling back`, { error: e });
             }
         }
@@ -1246,6 +1256,9 @@ relatedTo: hop }, include
         const idInfo = idInfoArray[0];
         const idField = table[idInfo.fieldName as keyof typeof table] as AnyPgColumn;
 
+        // See `fetchOne`: an unaddressable id is a 404, not a database error.
+        if (!idCanAddressTable(id, table, idInfoArray)) return null;
+
         const parsedIdObj = parseIdValues(id, idInfoArray);
         const parsedId = parsedIdObj[idInfo.fieldName];
 
@@ -1279,6 +1292,7 @@ relatedTo: hop }, include
                     logger.error(`[FetchService] ResolvedRelation inference error for collection '${collectionPath}': ${e.message}`);
                     logger.error("Hint: This usually means a relation in your drizzle schema is missing a reciprocal 'one()' or 'many()' definition. Run 'rebase schema generate' to fix this.");
                 }
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[fetchOneForRest] db.query.findFirst failed for ${collectionPath}, falling back`, { error: e });
             }
         }

package/src/services/collection-helpers.ts

@@ -7,9 +7,9 @@ import { logger } from "@rebasepro/server";
 // Row identity is derived on both sides of the wire — the driver parses an
 // incoming address into key columns, the admin derives one from a served row —
 // so the implementation lives in `common` and both agree by construction.
-export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
+export { buildCompositeId, parseIdValues, isAddressableId, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
 export type { PrimaryKeyInfo } from "@rebasepro/common";
-import { buildCompositeId, COMPOSITE_ID_SEPARATOR, getDeclaredPrimaryKeys } from "@rebasepro/common";
+import { buildCompositeId, COMPOSITE_ID_SEPARATOR, getDeclaredPrimaryKeys, isAddressableId } from "@rebasepro/common";
 import type { PrimaryKeyInfo } from "@rebasepro/common";
 
 /**
@@ -40,6 +40,33 @@ export function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta {
     };
 }
 
+/**
+ * Whether an address could name a row in this table, judged by the columns.
+ *
+ * {@link getPrimaryKeys} lets a config's `isId: "uuid"` win over the schema, so
+ * its `isUUID` is a claim rather than a fact — right for deriving addresses,
+ * wrong for refusing a query. Here the Drizzle column type decides, because it
+ * is what Postgres will enforce: a `uuid` column meets `/c/products/new` with
+ * `22P02`, which aborts the surrounding transaction and turns every later
+ * statement into an unrelated-looking `25P02`.
+ */
+export function idCanAddressTable(
+    id: string | number,
+    table: PgTable,
+    idInfoArray: PrimaryKeyInfo[]
+): boolean {
+    const columnBacked = idInfoArray.map(info => {
+        const col = table[info.fieldName as keyof typeof table] as AnyPgColumn | undefined;
+        const meta = col ? getColumnMeta(col) : undefined;
+        // No column to ask (a key the schema does not carry) leaves the id
+        // addressable: refusing on a guess would 404 rows that do exist.
+        if (!meta?.columnType) return info;
+        return { ...info,
+            isUUID: meta.columnType === "PgUUID" };
+    });
+    return isAddressableId(id, columnBacked);
+}
+
 export function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig {
     const collection = registry.getCollectionByPath(collectionPath);
     if (!collection) {

package/src/utils/pg-error-utils.ts

@@ -79,6 +79,25 @@ export function extractPgError(error: unknown): PostgresError | null {
     return null;
 }
 
+/**
+ * Whether the failure came back from Postgres rather than from building the
+ * query — which decides whether a fallback query is worth issuing.
+ *
+ * Reads here run inside a transaction (that is where `SET LOCAL ROLE` binds
+ * RLS). Once a statement raises, that transaction is aborted, and every later
+ * statement on it returns `25P02` — "current transaction is aborted, commands
+ * ignored until end of transaction block". So a retry after a database error
+ * cannot succeed, and it replaces a precise diagnosis ("invalid input syntax
+ * for type uuid") with a generic one. Rethrow instead.
+ *
+ * A query the driver could not even build — a missing reciprocal relation, say
+ * — never reached Postgres, leaves the transaction usable, and is exactly what
+ * the fallback paths exist for.
+ */
+export function reachedDatabase(error: unknown): boolean {
+    return extractPgError(error) !== null;
+}
+
 /**
  * Walk the error cause chain and return the deepest meaningful message.
  */