@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g06dbe5b

package/src/services/channel-bus/index.ts

@@ -80,15 +80,6 @@ export function resolveChannelBusSetting(configured?: ChannelBusSetting): Channe
     return raw === "memory" ? { type: "memory" } : { type: "postgres" };
 }
 
-/**
- * @deprecated Use {@link resolveChannelBusSetting}, which also accepts a
- * supplied {@link ChannelBus} instance. Kept as a narrow alias so existing
- * config-only callers keep their exact types.
- */
-export function resolveChannelBusConfig(configured?: ChannelBusConfig): ChannelBusConfig {
-    return resolveChannelBusSetting(configured) as ChannelBusConfig;
-}
-
 /**
  * Produce the bus a setting asks for.
  *

package/src/services/channel-history.ts

@@ -34,6 +34,7 @@ import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** How many messages a replay returns when the caller does not say. */
 const DEFAULT_REPLAY_LIMIT = 200;
@@ -198,6 +199,19 @@ export class ChannelHistoryStore {
             )
         `);
 
+        // Retained broadcasts for every channel in one table, with no RLS: who
+        // may replay a channel is decided before the read, by the channel gate
+        // in `realtimeService.authorizeChannelAction` — a replay is answered
+        // only for a client that has joined the channel, plus whatever an
+        // installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed; the
+        // rule language it does not yet have is written up in
+        // `docs/channel-authorization.md`. The driver's schema-wide
+        // grant reaches these (created here, after it ran), so take the
+        // privilege back.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+
         this.tablesReady = true;
         logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
     }

package/src/services/channel-presence.ts

@@ -28,6 +28,7 @@
 
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** A tracked client, as any instance sees it. */
 export interface PresenceRow {
@@ -71,6 +72,18 @@ export class ChannelPresenceStore {
             ON rebase.channel_presence (last_seen)
         `);
 
+        // The roster of every client on every channel, with no RLS — a row
+        // policy has nothing to match on here, since a channel name is a string
+        // a client invents rather than a row anyone owns. What guards it is the
+        // channel gate in `realtimeService.authorizeChannelAction`: presence is
+        // readable only to a client that has joined the channel, plus whatever
+        // an installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed —
+        // see `docs/channel-authorization.md` for what it does *not*
+        // yet decide. Revoke the schema-wide grant the driver handed out
+        // before this table existed.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
+
         this.tablesReady = true;
     }
 

package/src/services/collection-helpers.ts

@@ -1,15 +1,16 @@
 import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
-import { CollectionConfig, Property } from "@rebasepro/types";
+import { getTableColumns } from "drizzle-orm";
+import { CollectionConfig, Property, ResolvedHasMany, ResolvedHasOne } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { getTableName } from "@rebasepro/common";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 // Row identity is derived on both sides of the wire — the driver parses an
 // incoming address into key columns, the admin derives one from a served row —
 // so the implementation lives in `common` and both agree by construction.
-export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
+export { buildCompositeId, parseIdValues, isAddressableId, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
 export type { PrimaryKeyInfo } from "@rebasepro/common";
-import { buildCompositeId, COMPOSITE_ID_SEPARATOR, getDeclaredPrimaryKeys } from "@rebasepro/common";
+import { buildCompositeId, COMPOSITE_ID_SEPARATOR, getDeclaredPrimaryKeys, isAddressableId } from "@rebasepro/common";
 import type { PrimaryKeyInfo } from "@rebasepro/common";
 
 /**
@@ -40,6 +41,33 @@ export function getColumnMeta(col: AnyPgColumn): DrizzleColumnMeta {
     };
 }
 
+/**
+ * Whether an address could name a row in this table, judged by the columns.
+ *
+ * {@link getPrimaryKeys} lets a config's `isId: "uuid"` win over the schema, so
+ * its `isUUID` is a claim rather than a fact — right for deriving addresses,
+ * wrong for refusing a query. Here the Drizzle column type decides, because it
+ * is what Postgres will enforce: a `uuid` column meets `/c/products/new` with
+ * `22P02`, which aborts the surrounding transaction and turns every later
+ * statement into an unrelated-looking `25P02`.
+ */
+export function idCanAddressTable(
+    id: string | number,
+    table: PgTable,
+    idInfoArray: PrimaryKeyInfo[]
+): boolean {
+    const columnBacked = idInfoArray.map(info => {
+        const col = table[info.fieldName as keyof typeof table] as AnyPgColumn | undefined;
+        const meta = col ? getColumnMeta(col) : undefined;
+        // No column to ask (a key the schema does not carry) leaves the id
+        // addressable: refusing on a guess would 404 rows that do exist.
+        if (!meta?.columnType) return info;
+        return { ...info,
+            isUUID: meta.columnType === "PgUUID" };
+    });
+    return isAddressableId(id, columnBacked);
+}
+
 export function getCollectionByPath(collectionPath: string, registry: PostgresCollectionRegistry): CollectionConfig {
     const collection = registry.getCollectionByPath(collectionPath);
     if (!collection) {
@@ -49,6 +77,58 @@ export function getCollectionByPath(collectionPath: string, registry: PostgresCo
     return collection;
 }
 
+/**
+ * Reject a write naming something that is not a column of the table.
+ *
+ * Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+ * from `Object.keys(tableColumns)`, so a key the table does not carry is not
+ * rejected by anything — it is *left out of the statement*. The insert answers
+ * 201 having stored nothing under that name; the update, if the key was the
+ * only one, builds `update "posts" set  where …` and Postgres raises a syntax
+ * error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+ * 500 for what is a caller's typo.
+ *
+ * That makes this the last honest place to check, and the only one every write
+ * passes through. `assertKnownWriteFields` in the REST layer checks the same
+ * thing against the *config* and is skipped on four paths — `strictWrites:
+ * false`, a collection declaring no properties, an auth adapter that owns the
+ * body's shape, and a nested route whose target cannot be walked — and it never
+ * sees an in-process `rebase.data` write at all.
+ *
+ * It also gives `strictWrites: false` a truthful implementation. The flag is
+ * documented for "a column that really does exist which the config never
+ * declared", and skipping the config check alone could not deliver that: the
+ * value was dropped a layer later regardless. Skipping the config check and
+ * keeping this one does exactly what the flag says — the column must exist,
+ * the property need not.
+ */
+export function assertWritableColumns(
+    values: Record<string, unknown>,
+    table: PgTable,
+    collectionPath: string
+): void {
+    // Only a real Drizzle table carries a column list. A stand-in that does not
+    // (a test double, a registry entry built by hand) has nothing to check
+    // against, and inventing an answer from its own keys would reject writes
+    // over the shape of the double rather than the shape of the table.
+    const columns = getTableColumns(table) as Record<string, unknown> | undefined;
+    if (!columns || Object.keys(columns).length === 0) return;
+
+    const unknown = Object.keys(values).filter(key => !(key in columns));
+    if (unknown.length === 0) return;
+
+    // The offending keys, and deliberately not the list of real ones: this
+    // error is reachable on paths where the REST field check was skipped, and
+    // an `excludeFromApi` column is documented as never being served to a
+    // caller. Naming what was sent is the actionable half anyway.
+    throw ApiError.badRequest(
+        `'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ` +
+        `${unknown.map(key => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} ` +
+        "would have been dropped before the statement was built.",
+        "VALIDATION_UNKNOWN_FIELDS"
+    );
+}
+
 export function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any> {
     const tableName = getTableName(collection);
     const table = registry.getTable(tableName);
@@ -149,6 +229,45 @@ export function requirePrimaryKeys(collection: CollectionConfig, registry: Postg
     return keys;
 }
 
+/**
+ * The column on the *source* table that a `hasOne`/`hasMany` link points at.
+ *
+ * `sourceKey` is authored when the two sides join on a natural key — an
+ * external identity id, a SKU — and left off when they join on the row id,
+ * which is the overwhelming majority. That makes `undefined` the only optional
+ * field on a resolved relation, so it gets exactly one reader: this function.
+ * Every consumer that needs the column asks here, and none of them re-derives
+ * "or else the primary key" for itself. That is the whole point — the fallback
+ * chains this codebase removed from relation resolution were dangerous because
+ * they were *duplicated* and could disagree, not because they existed.
+ */
+export function sourceKeyField(
+    relation: ResolvedHasOne | ResolvedHasMany,
+    sourceCollection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): string {
+    if (relation.sourceKey) return relation.sourceKey;
+    return requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+}
+
+/**
+ * Whether this link joins on something other than the source's primary key.
+ *
+ * Callers that hold a parent *id* — which is most of them, since an id is what
+ * a URL carries — must translate it to the source key's value before it can be
+ * compared with the target's foreign key. Those that hold the parent *row*, or
+ * that build a correlated subquery over the source table, can read the column
+ * directly and skip the lookup.
+ */
+export function joinsOnNaturalKey(
+    relation: ResolvedHasOne | ResolvedHasMany,
+    sourceCollection: CollectionConfig,
+    registry: PostgresCollectionRegistry
+): boolean {
+    if (!relation.sourceKey) return false;
+    return relation.sourceKey !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+}
+
 /**
  * Collections whose key the *browser* cannot resolve, and what it will do
  * instead.

package/src/services/dataService.ts

@@ -1,5 +1,5 @@
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { FilterValues } from "@rebasepro/types";
+import { FilterValues, LogicalCondition } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
 import { FetchService } from "./FetchService";
 import { PersistService } from "./PersistService";
@@ -60,6 +60,8 @@ export class DataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
@@ -81,10 +83,13 @@ export class DataService implements DataRepository {
         searchString: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
             databaseId?: string;
+            searchExplain?: boolean;
         } = {}
     ): Promise<Record<string, unknown>[]> {
         return this.fetchService.searchRows<M>(collectionPath, searchString, options);
@@ -97,6 +102,8 @@ export class DataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             searchString?: string;
             databaseId?: string;
         } = {}