@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.0

package/src/schema/introspect-db-types.ts

@@ -0,0 +1,56 @@
+/**
+ * The PostgreSQL type → Rebase property type mapping.
+ *
+ * Split out of `introspect-db-logic` so that the structural analysis can use it
+ * without importing the generator, which imports the analysis. Re-exported from
+ * `introspect-db-logic` so existing callers keep their import path.
+ */
+
+/**
+ * Map a PostgreSQL data type to a Rebase property type.
+ */
+export function mapPgType(dataType: string): string {
+    const dt = dataType.toLowerCase();
+
+    // Interval MUST be checked before numeric ("interval" contains "int")
+    if (dt === "interval") return "string";
+
+    // Array types MUST be checked before numeric ("_int4" contains "int")
+    if (dt === "array" || dt.startsWith("_")) return "array";
+
+    // Numeric types
+    if (
+        dt.includes("int") || // integer, smallint, bigint
+        dt.includes("numeric") ||
+        dt.includes("decimal") ||
+        dt.includes("serial") || // serial, bigserial
+        dt === "real" ||
+        dt === "float4" ||
+        dt === "float8" ||
+        dt === "double precision" ||
+        dt === "money"
+    ) {
+        return "number";
+    }
+
+    // Boolean
+    if (dt.includes("bool")) return "boolean";
+
+    // Date / Time
+    if (dt.includes("time") || dt.includes("date")) return "date";
+
+    // JSON
+    if (dt === "json" || dt === "jsonb") return "map";
+
+    // Binary
+    if (dt === "bytea") return "binary";
+
+    // Network types
+    if (dt === "inet" || dt === "cidr" || dt === "macaddr" || dt === "macaddr8") return "string";
+
+    // UUID
+    if (dt === "uuid") return "string";
+
+    // Text/varchar/char — default to string
+    return "string";
+}

package/src/schema/introspect-db.ts

@@ -7,19 +7,16 @@ import * as dotenv from "dotenv";
 import readline from "readline";
 
 import {
-    TableRow,
-    TableColumn,
-    EnumValue,
-    PrimaryKeyRow,
-    ForeignKeyRow,
     buildTablesMap,
     buildEnumMap,
-    identifyJoinTables,
     generateCollectionFile,
     generateIndexContent,
     mergeIndexContent,
     safeHostFromUrl
 } from "./introspect-db-logic";
+import { countRowsUpTo, readSchemaMetadata } from "./introspect-db-queries";
+import { classifyTables, lookupCandidates, LOOKUP_MAX_ROWS } from "./introspect-db-structure";
+import { parseCheckConstraints } from "./introspect-db-constraints";
 import { logger } from "@rebasepro/server";
 
 async function main() {
@@ -89,82 +86,41 @@ async function main() {
     logger.info(chalk.gray(`Introspecting schema '${pgSchema}'...`));
 
     try {
-        // 1. Get Tables
-        const { rows: tables } = await client.query<TableRow>(`
-            SELECT table_name
-            FROM information_schema.tables
-            WHERE table_schema = $1 AND table_type = 'BASE TABLE'
-              AND table_name NOT LIKE 'drizzle_%'
-              AND table_name NOT LIKE 'rebase_%'
-            ORDER BY table_name
-        `, [pgSchema]);
-
-        // 2. Get Columns
-        const { rows: columns } = await client.query<TableColumn>(`
-            SELECT 
-                c.table_name, 
-                c.column_name, 
-                c.data_type, 
-                c.udt_name, 
-                c.is_nullable, 
-                c.column_default,
-                (SELECT a.atttypmod FROM pg_attribute a 
-                 JOIN pg_class pc ON a.attrelid = pc.oid 
-                 WHERE pc.relname = c.table_name 
-                   AND a.attname = c.column_name 
-                   AND pc.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = c.table_schema)) as atttypmod
-            FROM information_schema.columns c
-            WHERE c.table_schema = $1
-        `, [pgSchema]);
-
-        // 2b. Get Enum Types and their values
-        const { rows: enumValues } = await client.query<EnumValue>(`
-            SELECT t.typname AS enum_name,
-                   e.enumlabel AS enum_value,
-                   e.enumsortorder AS sort_order
-            FROM pg_type t
-            JOIN pg_enum e ON t.oid = e.enumtypid
-            JOIN pg_namespace n ON t.typnamespace = n.oid
-            WHERE n.nspname = $1
-            ORDER BY t.typname, e.enumsortorder
-        `, [pgSchema]);
-
-        // Build a map: enum_name -> ordered list of values
-        const enumMap = buildEnumMap(enumValues);
-
-        // 3. Get Primary Keys
-        const { rows: pks } = await client.query<PrimaryKeyRow>(`
-            SELECT t.relname as table_name, a.attname as column_name
-            FROM   pg_index i
-            JOIN   pg_attribute a ON a.attrelid = i.indrelid
-                                AND a.attnum = ANY(i.indkey)
-            JOIN   pg_class t ON t.oid = i.indrelid
-            JOIN   pg_namespace n ON n.oid = t.relnamespace
-            WHERE  i.indisprimary AND n.nspname = $1
-        `, [pgSchema]);
+        const metadata = await readSchemaMetadata(client, pgSchema);
+        const enumMap = buildEnumMap(metadata.enumValues);
+        const tablesMap = buildTablesMap(metadata.tables, metadata.columns, metadata.pks, metadata.fks);
+        const fks = metadata.fks;
+
+        // Only tables that could structurally be a code list are counted, and
+        // each count stops at the threshold — see `countRowsUpTo`. Introspection
+        // runs against a database it does not own, so "cheap on a table of any
+        // size" is a requirement, not an optimization.
+        for (const table of lookupCandidates(metadata, tablesMap)) {
+            try {
+                metadata.rowCounts[table] = await countRowsUpTo(client, pgSchema, table, LOOKUP_MAX_ROWS);
+            } catch (err) {
+                // A table this run cannot read is simply not classified as a code
+                // list; everything else about it still generates.
+                logger.info(chalk.gray(`  (skipped row count for ${table}: ${err instanceof Error ? err.message : String(err)})`));
+            }
+        }
 
-        // 4. Get Foreign Keys
-        const { rows: fks } = await client.query<ForeignKeyRow>(`
-            SELECT
-                tc.table_name, 
-                kcu.column_name, 
-                ccu.table_name AS foreign_table_name,
-                ccu.column_name AS foreign_column_name 
-            FROM 
-                information_schema.table_constraints AS tc 
-                JOIN information_schema.key_column_usage AS kcu
-                  ON tc.constraint_name = kcu.constraint_name
-                  AND tc.table_schema = kcu.table_schema
-                JOIN information_schema.constraint_column_usage AS ccu
-                  ON ccu.constraint_name = tc.constraint_name
-                  AND ccu.table_schema = tc.table_schema
-            WHERE tc.constraint_type = 'FOREIGN KEY' AND tc.table_schema = $1
-        `, [pgSchema]);
+        const classifications = classifyTables(metadata, tablesMap);
+        const checkFacts = parseCheckConstraints(metadata.checks);
+        const joinTables = new Set(
+            Array.from(classifications.values())
+                .filter((c) => c.role === "junction")
+                .map((c) => c.table)
+        );
 
-        const tablesMap = buildTablesMap(tables, columns, pks, fks);
-        const joinTables = identifyJoinTables(tablesMap);
+        const roleCount = (role: string) =>
+            Array.from(classifications.values()).filter((c) => c.role === role).length;
 
-        logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
+        logger.info(chalk.blue(`Found ${tablesMap.size} tables.`));
+        logger.info(chalk.gray(
+            `  ${roleCount("entity")} entities, ${joinTables.size} join tables (folded into relations), ` +
+            `${roleCount("lookup")} code lists, ${roleCount("owned-child")} owned by another table (hidden from navigation).`
+        ));
 
         let runDataInference = false;
         if (args["--no-data-inference"]) {
@@ -224,7 +180,8 @@ async function main() {
                     joinTables,
                     tablesMap,
                     enumMap,
-                    sampleData
+                    sampleData,
+                    { metadata, classifications, checkFacts }
                 );
 
                 fs.writeFileSync(filePath, fileContent, "utf-8");

package/src/schema/introspect-runtime.test.ts

@@ -1,4 +1,6 @@
 import { describe, expect, it } from "@jest/globals";
+import { resolveCollectionRelations } from "@rebasepro/common";
+import type { CollectionConfig } from "@rebasepro/types";
 
 import { buildCollectionsFromSchema, introspectSchema, readRlsStatus, IntrospectedSchema, Queryable } from "./introspect-runtime";
 import { buildTablesMap, identifyJoinTables, TableColumn, ForeignKeyRow, PrimaryKeyRow } from "./introspect-db-logic";
@@ -121,14 +123,60 @@ describe("buildCollectionsFromSchema", () => {
         const props = posts.properties as any;
 
         expect(props.author_id).toBeUndefined();
-        expect(props.author).toEqual({
-            name: "Author",
-            type: "relation",
-            target: "authors",
-            cardinality: "one",
-            direction: "owning",
-            localKey: "author_id"
-        });
+        expect(props.author.name).toBe("Author");
+        expect(props.author.type).toBe("relation");
+        // The descriptor is nested under `relation`, carries `kind`, and its
+        // `target` is a thunk — see the resolvability test below for why none of
+        // those three are stylistic.
+        expect(props.author.relation).toMatchObject({ kind: "belongsTo", localKey: "author_id" });
+        expect(typeof props.author.relation.target).toBe("function");
+        expect(props.author.relation.target().slug).toBe("authors");
+    });
+
+    /**
+     * The shape has to be one the resolver actually reads.
+     *
+     * This path emitted `cardinality` / `direction` / a bare-string `target`
+     * flat on the property — the shape `Relation` stopped accepting, and the
+     * same drift `introspect-emits-valid-relations.test.ts` caught in the
+     * generated-file path and this one was missed by. Nothing threw:
+     * `resolveCollectionRelations` reads `property.relation`, found none, and
+     * reported a collection with no relations at all.
+     *
+     * The visible cost was writes. `assertKnownWriteFields` learns an owning
+     * relation's FK column from the *resolved* relation's `localKey`, and the FK
+     * column is deliberately absent from `properties` ("surfaces as a
+     * relation"), so with nothing resolving, `POST /api/data/orders` with
+     * `product_id` came back 400 `has no field 'product_id'` — the column was
+     * simultaneously the only way to set the relation and not a known field.
+     *
+     * Asserting the literal object is what let it drift, so this asserts
+     * through the resolver instead: a future reshape has to keep it resolvable,
+     * not merely keep the keys someone once wrote down.
+     */
+    it("emits a relation the resolver can read, so the fk column is writable", () => {
+        const schema = schemaOf(
+            [
+                column({ table_name: "products", column_name: "id", data_type: "integer", udt_name: "int4", is_nullable: "NO" }),
+                column({ table_name: "orders", column_name: "id", data_type: "integer", udt_name: "int4", is_nullable: "NO" }),
+                column({ table_name: "orders", column_name: "product_id", data_type: "integer", udt_name: "int4" })
+            ],
+            [
+                { table_name: "products", column_name: "id" },
+                { table_name: "orders", column_name: "id" }
+            ],
+            [{ table_name: "orders", column_name: "product_id", foreign_table_name: "products", foreign_column_name: "id" }]
+        );
+
+        const orders = buildCollectionsFromSchema(schema, "public").find((c) => c.slug === "orders")!;
+        const resolved = resolveCollectionRelations(orders as unknown as CollectionConfig);
+
+        expect(Object.keys(resolved)).toEqual(["product"]);
+        expect(resolved.product.kind).toBe("belongsTo");
+        // `localKey` is the field `assertKnownWriteFields` adds to the known set,
+        // which is what makes `product_id` writable. The write itself is covered
+        // end-to-end by `scripts/smoke-baas.ts` against a real database.
+        expect((resolved.product as { localKey: string }).localKey).toBe("product_id");
     });
 
     it("skips join tables — they are an edge between collections, not a collection", () => {

package/src/schema/introspect-runtime.ts

@@ -207,13 +207,30 @@ function buildProperties(
 }
 
 /**
- * Owning relations, derived from this table's foreign keys. Mirrors the shape
- * `generateCollectionFile` emits, except `target` uses the slug string form
- * rather than a thunk to a module import.
+ * Owning relations, derived from this table's foreign keys — the same shape
+ * `generateCollectionFile` writes into a collection file: a `relation` property
+ * whose nested descriptor carries `kind`, a `target` thunk and the `localKey`.
+ *
+ * The shape is load-bearing, not cosmetic. `resolveCollectionRelations` reads
+ * relations from `property.relation` and `resolveRelation` requires `target` to
+ * be a thunk; this used to emit `target`/`cardinality`/`localKey` flat on the
+ * property with the slug as a bare string, which satisfies neither. Nothing
+ * threw — the resolver simply skipped every such property and reported that the
+ * collection had no relations. So an introspected BaaS collection had its FK
+ * columns removed from `properties` (they "surface as relations") and then no
+ * resolvable relation to surface as, which is why writing the FK column
+ * directly came back as `has no field 'product_id'`: `assertKnownWriteFields`
+ * learns that column from the resolved relation's `localKey`.
+ *
+ * The thunk closes over the collections being built in this same pass rather
+ * than importing a module, which is what a runtime introspection has instead of
+ * generated files. It is called lazily, after the map is fully populated, so a
+ * table may reference one introspected later.
  */
 function buildRelations(
     meta: TableMeta,
-    slugByTable: Map<string, string>
+    slugByTable: Map<string, string>,
+    collectionBySlug: Map<string, PostgresCollectionConfig>
 ): Record<string, Record<string, unknown>> {
     const relations: Record<string, Record<string, unknown>> = {};
 
@@ -233,10 +250,11 @@ function buildRelations(
         relations[key] = {
             name: humanize(key),
             type: "relation",
-            target: targetSlug,
-            cardinality: "one",
-            direction: "owning",
-            localKey: fk.column_name
+            relation: {
+                kind: "belongsTo",
+                target: () => collectionBySlug.get(targetSlug),
+                localKey: fk.column_name
+            }
         };
     }
 
@@ -259,6 +277,9 @@ export function buildCollectionsFromSchema(
     }
 
     const collections: PostgresCollectionConfig[] = [];
+    // Filled as we go; the relation thunks read it lazily, so a table may point
+    // at one that has not been built yet at the moment its relation is created.
+    const collectionBySlug = new Map<string, PostgresCollectionConfig>();
 
     for (const [tableName, meta] of tablesMap) {
         if (joinTables.has(tableName)) continue;
@@ -273,11 +294,12 @@ export function buildCollectionsFromSchema(
             icon: getIconForTable(tableName),
             properties: {
                 ...buildProperties(meta, enumMap),
-                ...buildRelations(meta, slugByTable)
+                ...buildRelations(meta, slugByTable, collectionBySlug)
             }
         } as unknown as PostgresCollectionConfig;
 
         collections.push(collection);
+        collectionBySlug.set(tableName, collection);
     }
 
     return collections;

package/src/security/policy-drift.test.ts

@@ -158,15 +158,23 @@ describe("checkPolicyDrift", () => {
     it("also flags the tautology in a WITH CHECK clause", async () => {
         const cols = [collection("posts")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const withCheck = expected.filter((p) => p.hasWithCheck);
+        // Asserted rather than assumed: if the generator ever stopped emitting a
+        // WITH CHECK for these rules the fixture would carry no tautology at
+        // all, and every assertion below would be vacuously satisfied.
+        expect(withCheck.length).toBeGreaterThan(0);
+
         const live = expected.map((p) => liveRow(p, {
             with_check: p.hasWithCheck ? "(auth.uid() IS NOT NULL)" : null
         }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
-        const flagged = drift.insecure.some((i) => /WITH CHECK/.test(i.reason));
-        // Only assert when the fixture actually had a WITH CHECK policy to carry it.
-        if (expected.some((p) => p.hasWithCheck)) expect(flagged).toBe(true);
+        // Every WITH CHECK policy carries the tautology and no USING clause
+        // does, so anything flagged here came from the WITH CHECK scan — the
+        // half that a check reading only `qual` would miss entirely.
+        expect(drift.insecure.map((i) => i.policy.name)).toEqual(withCheck.map((p) => p.name));
+        expect(drift.insecure.every((i) => /WITH CHECK/.test(i.reason))).toBe(true);
     });
 
     it("parses roles when the driver returns the raw {a,b} text form", async () => {

package/src/services/BranchService.ts

@@ -64,20 +64,41 @@ function validateIdentifier(value: string, label: string): void {
 }
 
 /**
- * Sanitize a user-provided branch name to a safe PostgreSQL identifier.
- * Only allows alphanumeric characters and underscores.
+ * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it
+ * silently. The prefix comes out of the same budget.
  */
-function sanitizeBranchName(name: string): string {
-    return name.replace(/[^a-zA-Z0-9_]/g, "");
+const MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;
+
+/**
+ * Check a user-provided branch name, and otherwise leave it exactly as given.
+ *
+ * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was
+ * quietly created as `myfeature`: the name you typed was not the name `list`
+ * gave back. Nothing ever needed that. Every identifier this service builds is
+ * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen
+ * safe, and `validateIdentifier` has always accepted hyphens for the `--from`
+ * source database — the two disagreed about the same character class.
+ *
+ * Refusing a name we cannot represent is better than representing a different
+ * one, which is also why the length is checked here rather than left to
+ * Postgres, whose answer to an over-long identifier is a silent rename.
+ */
+function assertValidBranchName(name: string): void {
+    validateIdentifier(name, "branch name");
+    if (name.length > MAX_BRANCH_NAME_LENGTH) {
+        throw new Error(
+            `Branch name "${name}" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +
+            "Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose."
+        );
+    }
 }
 
 /**
  * Convert a user-facing branch name to the actual PostgreSQL database name.
  */
 function toBranchDbName(name: string): string {
-    const sanitized = sanitizeBranchName(name);
-    if (!sanitized) throw new Error("Branch name must contain at least one alphanumeric character.");
-    return `${BRANCH_DB_PREFIX}${sanitized}`;
+    assertValidBranchName(name);
+    return `${BRANCH_DB_PREFIX}${name}`;
 }
 
 export class BranchService {
@@ -120,15 +141,14 @@ export class BranchService {
         }
 
         const dbName = toBranchDbName(name);
-        const sanitizedName = sanitizeBranchName(name);
         const sourceDb = options?.source || this.poolManager.defaultDatabaseName;
 
         // Check if branch already exists
         const existing = await this.db.execute(
-            sql`SELECT name FROM rebase.branches WHERE name = ${sanitizedName} OR db_name = ${dbName}`
+            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`
         );
         if ((existing.rows as unknown[]).length > 0) {
-            throw new Error(`Branch "${sanitizedName}" already exists.`);
+            throw new Error(`Branch "${name}" already exists.`);
         }
 
         // Disconnect any idle pools to the source DB so TEMPLATE works.
@@ -158,12 +178,12 @@ export class BranchService {
         // Record metadata in the default database
         const now = new Date();
         await this.db.execute(
-            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
-                VALUES (${sanitizedName}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
+            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)
+                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
         );
 
         return {
-            name: sanitizedName,
+            name,
             parentDatabase: sourceDb,
             createdAt: now
         };
@@ -174,20 +194,35 @@ export class BranchService {
      * Cannot delete the main/default database.
      */
     async deleteBranch(name: string): Promise<void> {
-        const sanitizedName = sanitizeBranchName(name);
-        const dbName = toBranchDbName(name);
+        assertValidBranchName(name);
 
-        // Safety: never delete the default database
-        if (dbName === this.poolManager.defaultDatabaseName) {
+        // Safety, first pass: a request that would target the default database
+        // is refused before any metadata is read, so the answer costs nothing
+        // and cannot depend on what a row happens to say.
+        if (toBranchDbName(name) === this.poolManager.defaultDatabaseName) {
             throw new Error("Cannot delete the main database.");
         }
 
-        // Verify the branch exists in our metadata
+        // Verify the branch exists, and take the database name from the row
+        // rather than deriving it again. A branch created before names stopped
+        // being stripped is recorded as `rb_myfeature` while `my-feature` now
+        // derives `rb_my-feature`; re-deriving would drop a database this row
+        // never named — or, if that name happened to exist, somebody else's.
+        // The stored value is the only one that is true by construction.
         const existing = await this.db.execute(
-            sql`SELECT db_name FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`
         );
-        if ((existing.rows as unknown[]).length === 0) {
-            throw new Error(`Branch "${sanitizedName}" not found.`);
+        const existingRows = existing.rows as Record<string, unknown>[];
+        if (existingRows.length === 0) {
+            throw new Error(`Branch "${name}" not found.`);
+        }
+        const dbName = existingRows[0].db_name as string;
+
+        // Safety, second pass: the first checked a name we derived, this checks
+        // the one we are about to drop. They differ for any row written under
+        // the old scheme, and it is this one that governs.
+        if (dbName === this.poolManager.defaultDatabaseName) {
+            throw new Error("Cannot delete the main database.");
         }
 
         // Disconnect any pools to this branch before dropping
@@ -201,7 +236,7 @@ export class BranchService {
             const pgError = extractPgError(err);
             if (pgError?.code === PG_OBJECT_IN_USE) {
                 throw new Error(
-                    `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
+                    `Cannot delete branch "${name}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
@@ -210,7 +245,7 @@ export class BranchService {
 
         // Remove metadata
         await this.db.execute(
-            sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`DELETE FROM rebase.branches WHERE name = ${name}`
         );
     }
 
@@ -242,15 +277,16 @@ export class BranchService {
      * Get info about a specific branch.
      */
     async getBranchInfo(name: string): Promise<BranchInfo | undefined> {
-        const sanitizedName = sanitizeBranchName(name);
+        assertValidBranchName(name);
 
         const result = await this.db.execute(sql`
-            SELECT 
+            SELECT
                 b.name,
+                b.db_name,
                 b.parent_db,
                 b.created_at
             FROM rebase.branches b
-            WHERE b.name = ${sanitizedName}
+            WHERE b.name = ${name}
         `);
 
         const rows = result.rows as Record<string, unknown>[];
@@ -258,10 +294,12 @@ export class BranchService {
 
         const row = rows[0];
 
-        // Attempt to get size — may fail if the DB was externally dropped
+        // Attempt to get size — may fail if the DB was externally dropped.
+        // Same reason as `deleteBranch`: the size of a re-derived name is the
+        // size of some other database, or of nothing.
         let sizeBytes: number | undefined;
         try {
-            const dbName = toBranchDbName(sanitizedName);
+            const dbName = row.db_name as string;
             const sizeResult = await this.db.execute(
                 sql`SELECT pg_database_size(${dbName}) as size_bytes`
             );