@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g06dbe5b

package/src/security/policy-drift.test.ts

@@ -158,15 +158,23 @@ describe("checkPolicyDrift", () => {
     it("also flags the tautology in a WITH CHECK clause", async () => {
         const cols = [collection("posts")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const withCheck = expected.filter((p) => p.hasWithCheck);
+        // Asserted rather than assumed: if the generator ever stopped emitting a
+        // WITH CHECK for these rules the fixture would carry no tautology at
+        // all, and every assertion below would be vacuously satisfied.
+        expect(withCheck.length).toBeGreaterThan(0);
+
         const live = expected.map((p) => liveRow(p, {
             with_check: p.hasWithCheck ? "(auth.uid() IS NOT NULL)" : null
         }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
-        const flagged = drift.insecure.some((i) => /WITH CHECK/.test(i.reason));
-        // Only assert when the fixture actually had a WITH CHECK policy to carry it.
-        if (expected.some((p) => p.hasWithCheck)) expect(flagged).toBe(true);
+        // Every WITH CHECK policy carries the tautology and no USING clause
+        // does, so anything flagged here came from the WITH CHECK scan — the
+        // half that a check reading only `qual` would miss entirely.
+        expect(drift.insecure.map((i) => i.policy.name)).toEqual(withCheck.map((p) => p.name));
+        expect(drift.insecure.every((i) => /WITH CHECK/.test(i.reason))).toBe(true);
     });
 
     it("parses roles when the driver returns the raw {a,b} text form", async () => {

package/src/security/rls-enforcement.ts

@@ -1,6 +1,13 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
 import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
-import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
+import {
+    AnonymousGrantRisk,
+    findAnonymousGrants,
+    REBASE_USER_ROLE,
+    revokeInternalTableAccess,
+    securityRuleToConditions
+} from "@rebasepro/common";
+import { REBASE_SCHEMA, usesLegacyRlsFunctions } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -16,9 +23,14 @@ import { logger } from "@rebasepro/server";
  *    are validation/side-effects, not a security boundary.
  *
  *  - **Server context** — the base (owner) connection: auth flows, migrations,
- *    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
- *    owner it bypasses RLS. This is the trusted plane, equivalent to
- *    Supabase's `service_role`.
+ *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted
+ *    plane, equivalent to Supabase's `service_role`.
+ *
+ *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes
+ *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user
+ *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —
+ *    and clears the default policies through their admin arm rather than the
+ *    `auth.uid() IS NULL` one.
  *
  * This module provides the three pieces:
  *
@@ -36,8 +48,14 @@ import { logger } from "@rebasepro/server";
  * not an operator opt-in.
  */
 
-/** The restricted role every authenticated (user-context) request runs as. */
-export const REBASE_USER_ROLE = "rebase_user";
+/**
+ * The restricted role every authenticated (user-context) request runs as.
+ *
+ * Re-exported, not re-declared: the same name is needed by
+ * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name
+ * fail as a silent no-op rather than an error.
+ */
+export { REBASE_USER_ROLE };
 
 /** Minimal SQL runner so callers can adapt drizzle or pg.Client. */
 export type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;
@@ -69,6 +87,57 @@ const quoteIdent = (name: string): string => `"${name.replace(/"/g, "\"\"")}"`;
 /** DML the user role holds on managed tables (RLS still filters per row). */
 const USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 
+/**
+ * Warn when the connection role shares its name with an existing schema.
+ *
+ * Postgres resolves unqualified names through `search_path`, which defaults to
+ * `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+ * name exists it sits ahead of `public`, so every unqualified statement
+ * silently operates on it instead:
+ *
+ *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+ *
+ * Nothing errors. You get a second table of the same name in the wrong schema,
+ * and reads that pin `public` cannot see it — which reads as "missing table" and
+ * sends people to re-run a push that creates a *third* copy. The bootstrapper
+ * has a whole branch dedicated to recognising the symptom after the fact.
+ *
+ * Rebase shipped straight into this: it creates a schema named `rebase` while
+ * every template named the database role `rebase` too. The scaffold uses
+ * `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+ * (`pinSearchPath`), which covers the paths the framework controls. This covers
+ * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+ * a hand-written migration — because the hazard is a property of the two NAMES,
+ * not of any one connection.
+ *
+ * A warning rather than a boot failure: the database works, the framework's own
+ * traffic is pinned, and refusing to start over a naming choice a user may have
+ * inherited would be worse than the risk.
+ */
+export async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {
+    try {
+        const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+        if (rows[0]?.collides !== true) return;
+        const role = String(rows[0]?.role ?? "the connection role");
+        logger.warn(
+            `⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified ` +
+            `names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched ` +
+            `BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the ` +
+            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. ` +
+            `Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the ` +
+            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +
+            `"rebase_app".`
+        );
+    } catch {
+        // A diagnostic must never be the reason a boot fails.
+    }
+}
+
 export async function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture> {
     const rows = await run(`
         SELECT current_user            AS role,
@@ -180,6 +249,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
         // migrations), so a migrate can never strand the user role.
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+
+        // The grants above are deliberately schema-wide — a project's own
+        // collections may live in `rebase`, and future tables must be reachable
+        // or a migration strands the role. Rebase's OWN tables are the exception:
+        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no
+        // row an end user should ever address. Taking the privilege back here
+        // covers every table that already exists; each creator revokes on the
+        // table it just made, for the boot that creates them for the first time.
+        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {
+            onError: (table, error) => logger.warn(
+                `🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — ` +
+                "it stays reachable by authenticated requests: " +
+                (error instanceof Error ? error.message : String(error))
+            )
+        });
     }
 
     logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
@@ -293,6 +377,65 @@ export function warnOnAnonymousGrants(
     );
 }
 
+/**
+ * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+ *
+ * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+ * database, so nothing is broken and no policy is wrong — which is exactly why
+ * this has to be said out loud. A silent rewrite that works forever is not a
+ * migration, it is a second supported spelling nobody wrote down, and the next
+ * person to read those rules will copy the old one.
+ *
+ * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+ * `policy.rolesOverlap(...)`) compile from the model and were never affected.
+ */
+export function warnOnLegacyRlsFunctions(
+    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
+): void {
+    const sites: string[] = [];
+
+    for (const collection of collections) {
+        for (const rule of collection.securityRules ?? []) {
+            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+            const carriesLegacy = [usingExpr, withCheckExpr]
+                .filter((e): e is PolicyExpression => e !== null)
+                .some(containsLegacyRlsCall);
+            if (!carriesLegacy) continue;
+
+            const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+            if (!sites.includes(site)) sites.push(site);
+        }
+    }
+
+    if (sites.length === 0) return;
+
+    logger.warn(
+        `These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). ` +
+        `They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, ` +
+        `and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` ` +
+        `and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), ` +
+        `which never had to be spelled by hand:\n\n` +
+        sites.map(s => `  • ${s}`).join("\n") + "\n"
+    );
+}
+
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr: PolicyExpression): boolean {
+    switch (expr.kind) {
+        case "raw":
+            return usesLegacyRlsFunctions(expr.sql);
+        case "and":
+        case "or":
+            return expr.operands.some(containsLegacyRlsCall);
+        case "not":
+            return containsLegacyRlsCall(expr.operand);
+        case "existsIn":
+            return containsLegacyRlsCall(expr.where);
+        default:
+            return false;
+    }
+}
+
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/src/services/BranchService.ts

@@ -9,6 +9,7 @@
 
 import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
+import { revokeInternalTableSql } from "@rebasepro/common";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
 import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
@@ -64,20 +65,41 @@ function validateIdentifier(value: string, label: string): void {
 }
 
 /**
- * Sanitize a user-provided branch name to a safe PostgreSQL identifier.
- * Only allows alphanumeric characters and underscores.
+ * Postgres truncates identifiers at NAMEDATALEN-1 = 63 bytes, and does it
+ * silently. The prefix comes out of the same budget.
  */
-function sanitizeBranchName(name: string): string {
-    return name.replace(/[^a-zA-Z0-9_]/g, "");
+const MAX_BRANCH_NAME_LENGTH = 63 - BRANCH_DB_PREFIX.length;
+
+/**
+ * Check a user-provided branch name, and otherwise leave it exactly as given.
+ *
+ * This used to strip everything outside [a-zA-Z0-9_], so `my-feature` was
+ * quietly created as `myfeature`: the name you typed was not the name `list`
+ * gave back. Nothing ever needed that. Every identifier this service builds is
+ * double-quoted (see `CREATE DATABASE` below), which is what makes a hyphen
+ * safe, and `validateIdentifier` has always accepted hyphens for the `--from`
+ * source database — the two disagreed about the same character class.
+ *
+ * Refusing a name we cannot represent is better than representing a different
+ * one, which is also why the length is checked here rather than left to
+ * Postgres, whose answer to an over-long identifier is a silent rename.
+ */
+function assertValidBranchName(name: string): void {
+    validateIdentifier(name, "branch name");
+    if (name.length > MAX_BRANCH_NAME_LENGTH) {
+        throw new Error(
+            `Branch name "${name}" is too long: ${name.length} characters, maximum ${MAX_BRANCH_NAME_LENGTH}. ` +
+            "Postgres truncates identifiers past 63 bytes, which would give the branch a name you did not choose."
+        );
+    }
 }
 
 /**
  * Convert a user-facing branch name to the actual PostgreSQL database name.
  */
 function toBranchDbName(name: string): string {
-    const sanitized = sanitizeBranchName(name);
-    if (!sanitized) throw new Error("Branch name must contain at least one alphanumeric character.");
-    return `${BRANCH_DB_PREFIX}${sanitized}`;
+    assertValidBranchName(name);
+    return `${BRANCH_DB_PREFIX}${name}`;
 }
 
 export class BranchService {
@@ -103,6 +125,10 @@ export class BranchService {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+
+        // Not a collection, so no RLS — and it names every branch database on
+        // this server. The driver's schema-wide grant reaches it, so revoke.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
     }
 
     /**
@@ -120,15 +146,14 @@ export class BranchService {
         }
 
         const dbName = toBranchDbName(name);
-        const sanitizedName = sanitizeBranchName(name);
         const sourceDb = options?.source || this.poolManager.defaultDatabaseName;
 
         // Check if branch already exists
         const existing = await this.db.execute(
-            sql`SELECT name FROM rebase.branches WHERE name = ${sanitizedName} OR db_name = ${dbName}`
+            sql`SELECT name FROM rebase.branches WHERE name = ${name} OR db_name = ${dbName}`
         );
         if ((existing.rows as unknown[]).length > 0) {
-            throw new Error(`Branch "${sanitizedName}" already exists.`);
+            throw new Error(`Branch "${name}" already exists.`);
         }
 
         // Disconnect any idle pools to the source DB so TEMPLATE works.
@@ -158,12 +183,12 @@ export class BranchService {
         // Record metadata in the default database
         const now = new Date();
         await this.db.execute(
-            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at) 
-                VALUES (${sanitizedName}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
+            sql`INSERT INTO rebase.branches (name, db_name, parent_db, created_at)
+                VALUES (${name}, ${dbName}, ${sourceDb}, ${now.toISOString()})`
         );
 
         return {
-            name: sanitizedName,
+            name,
             parentDatabase: sourceDb,
             createdAt: now
         };
@@ -174,20 +199,35 @@ export class BranchService {
      * Cannot delete the main/default database.
      */
     async deleteBranch(name: string): Promise<void> {
-        const sanitizedName = sanitizeBranchName(name);
-        const dbName = toBranchDbName(name);
+        assertValidBranchName(name);
 
-        // Safety: never delete the default database
-        if (dbName === this.poolManager.defaultDatabaseName) {
+        // Safety, first pass: a request that would target the default database
+        // is refused before any metadata is read, so the answer costs nothing
+        // and cannot depend on what a row happens to say.
+        if (toBranchDbName(name) === this.poolManager.defaultDatabaseName) {
             throw new Error("Cannot delete the main database.");
         }
 
-        // Verify the branch exists in our metadata
+        // Verify the branch exists, and take the database name from the row
+        // rather than deriving it again. A branch created before names stopped
+        // being stripped is recorded as `rb_myfeature` while `my-feature` now
+        // derives `rb_my-feature`; re-deriving would drop a database this row
+        // never named — or, if that name happened to exist, somebody else's.
+        // The stored value is the only one that is true by construction.
         const existing = await this.db.execute(
-            sql`SELECT db_name FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`SELECT db_name FROM rebase.branches WHERE name = ${name}`
         );
-        if ((existing.rows as unknown[]).length === 0) {
-            throw new Error(`Branch "${sanitizedName}" not found.`);
+        const existingRows = existing.rows as Record<string, unknown>[];
+        if (existingRows.length === 0) {
+            throw new Error(`Branch "${name}" not found.`);
+        }
+        const dbName = existingRows[0].db_name as string;
+
+        // Safety, second pass: the first checked a name we derived, this checks
+        // the one we are about to drop. They differ for any row written under
+        // the old scheme, and it is this one that governs.
+        if (dbName === this.poolManager.defaultDatabaseName) {
+            throw new Error("Cannot delete the main database.");
         }
 
         // Disconnect any pools to this branch before dropping
@@ -201,7 +241,7 @@ export class BranchService {
             const pgError = extractPgError(err);
             if (pgError?.code === PG_OBJECT_IN_USE) {
                 throw new Error(
-                    `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
+                    `Cannot delete branch "${name}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
@@ -210,7 +250,7 @@ export class BranchService {
 
         // Remove metadata
         await this.db.execute(
-            sql`DELETE FROM rebase.branches WHERE name = ${sanitizedName}`
+            sql`DELETE FROM rebase.branches WHERE name = ${name}`
         );
     }
 
@@ -242,15 +282,16 @@ export class BranchService {
      * Get info about a specific branch.
      */
     async getBranchInfo(name: string): Promise<BranchInfo | undefined> {
-        const sanitizedName = sanitizeBranchName(name);
+        assertValidBranchName(name);
 
         const result = await this.db.execute(sql`
-            SELECT 
+            SELECT
                 b.name,
+                b.db_name,
                 b.parent_db,
                 b.created_at
             FROM rebase.branches b
-            WHERE b.name = ${sanitizedName}
+            WHERE b.name = ${name}
         `);
 
         const rows = result.rows as Record<string, unknown>[];
@@ -258,10 +299,12 @@ export class BranchService {
 
         const row = rows[0];
 
-        // Attempt to get size — may fail if the DB was externally dropped
+        // Attempt to get size — may fail if the DB was externally dropped.
+        // Same reason as `deleteBranch`: the size of a re-derived name is the
+        // size of some other database, or of nothing.
         let sizeBytes: number | undefined;
         try {
-            const dbName = toBranchDbName(sanitizedName);
+            const dbName = row.db_name as string;
             const sizeResult = await this.db.execute(
                 sql`SELECT pg_database_size(${dbName}) as size_bytes`
             );