@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g18cfeb7

package/src/auth/ensure-tables.ts

@@ -1,7 +1,10 @@
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableAccess } from "@rebasepro/common";
 import type { CollectionConfig } from "@rebasepro/types";
+import { AUTH_USERS_COLUMNS, authUsersColumnSql } from "../schema/auth-users-columns";
+import { RLS_BOOTSTRAP_STATEMENTS } from "../schema/rls-bootstrap-sql";
 import {
     AuthSchemaVersionError,
     assertAuthSchemaCompatible,
@@ -44,13 +47,23 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 ? `"${resolvedTable}"`
                 : `"${usersSchema}"."${resolvedTable}"`;
 
-            // Derive ID column type from collection properties
+            // Derive ID column type from collection properties.
+            //
+            // `"increment"`, not `"autoincrement"`. The latter was tested for
+            // here and exists nowhere in the type system — the union is
+            // `boolean | "manual" | "increment" | string` — so the INTEGER branch
+            // was unreachable and an integer-keyed auth collection fell through
+            // to TEXT. Introspection below hid it whenever the table already
+            // existed; on a database where it did not, this created
+            // `id TEXT DEFAULT gen_random_uuid()::text` for a collection that
+            // declares a number, and every `uid` foreign key was typed to match
+            // the wrong thing.
             const idProp = collection.properties?.id;
             if (idProp) {
                 const isId = ("isId" in idProp) ? (idProp as unknown as Record<string, unknown>).isId : undefined;
                 if (isId === "uuid") {
                     userIdType = "UUID";
-                } else if (isId === "autoincrement") {
+                } else if (isId === "increment") {
                     userIdType = "INTEGER";
                 }
                 // Otherwise keep TEXT as default
@@ -107,22 +120,46 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
                 ? "GENERATED ALWAYS AS IDENTITY"
                 : "DEFAULT gen_random_uuid()::text";
 
+        // Identifiers for the constraint and indexes reconciled further down.
+        // Derived from the resolved table name so two auth tables in different
+        // schemas cannot collide, and truncated to Postgres's 63-byte identifier
+        // limit here rather than letting the server truncate silently — the
+        // `IF NOT EXISTS` guards below have to compare against the same name
+        // Postgres actually stored, or they re-run forever.
+        const authIdentifier = (suffix: string) => `${resolvedTable}_${suffix}`.slice(0, 63);
+        const emailLengthConstraint = `"${authIdentifier("email_length_check")}"`;
+        const emailLowerUniqueIndex = authIdentifier("email_lower_key");
+        const verificationTokenIndex = authIdentifier("email_verification_token_idx");
+
+        // Every string column here is TEXT, deliberately. In Postgres VARCHAR(n)
+        // and TEXT are the same type with the same storage and the same
+        // performance; the only difference is a length check, and none of these
+        // columns wants one. The widths this table used to carry were inherited
+        // MySQL habit (255) and they were all wrong in the same direction —
+        // `password_hash VARCHAR(255)` against a 193-char scrypt string left 62
+        // characters of headroom in front of a KEY_LENGTH constant living in
+        // another package, and `photo_url VARCHAR(500)` rejected the `data:` URIs
+        // and long signed URLs that OAuth providers hand back. A limit worth
+        // having is a CHECK — alterable without a table rewrite, unlike a type
+        // modifier — which is why `email` has one and nothing else does.
+        //
+        // The column list comes from AUTH_USERS_COLUMNS rather than being spelled
+        // out here, because this is not the only place that creates this table:
+        // `db push` and the boot-time collection ensure do too, and when the
+        // three lists were maintained separately they disagreed and boot order
+        // silently decided which shape the database got. The `email` CHECK is
+        // appended rather than listed there — it is a named constraint the
+        // migration below has to be able to add separately, `NOT VALID`, to a
+        // table that already holds rows.
+        const usersColumnDdl = AUTH_USERS_COLUMNS
+            .map((spec) => spec.column === "email"
+                ? `${spec.column} ${authUsersColumnSql(spec)} CONSTRAINT ${emailLengthConstraint} CHECK (length(email) <= 320)`
+                : `${spec.column} ${authUsersColumnSql(spec)}`)
+            .join(",\n                ");
         await db.execute(sql`
             CREATE TABLE IF NOT EXISTS ${sql.raw(usersTableName)} (
                 id ${sql.raw(userIdType)} PRIMARY KEY ${sql.raw(idDefault)},
-                email VARCHAR(255) UNIQUE NOT NULL,
-                display_name VARCHAR(255),
-                photo_url VARCHAR(500),
-                roles TEXT[] DEFAULT '{}' NOT NULL,
-                password_hash VARCHAR(255),
-                email_verified BOOLEAN DEFAULT FALSE NOT NULL,
-                email_verification_token VARCHAR(255),
-                email_verification_sent_at TIMESTAMP WITH TIME ZONE,
-                is_anonymous BOOLEAN DEFAULT FALSE NOT NULL,
-                metadata JSONB DEFAULT '{}' NOT NULL,
-                tokens_valid_after TIMESTAMP WITH TIME ZONE,
-                created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL,
-                updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL
+                ${sql.raw(usersColumnDdl)}
             )
         `);
 
@@ -142,26 +179,51 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // column once no old backend remains (phase 2, contract).
         //
         // Idempotent throughout: every step is guarded on catalogue state.
-        await db.execute(sql`
-            CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
-            BEGIN
-                IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
-                    NEW.uid := NEW.user_id;
-                ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
-                    NEW.user_id := NEW.uid;
-                END IF;
-                RETURN NEW;
-            END $$ LANGUAGE plpgsql
-        `);
-
-        for (const authTable of [
+        const legacyFkTables = [
             "user_identities",
             "refresh_tokens",
             "password_reset_tokens",
             "magic_link_tokens",
             "mfa_factors",
             "recovery_codes"
-        ]) {
+        ];
+
+        // Only on a database that actually carries the legacy column. This whole
+        // block is a 0.x compatibility shim, and it used to run unconditionally —
+        // so every brand-new database was provisioned with a trigger function
+        // written to reconcile a column it can never have, permanently, as part
+        // of its first boot. A fresh install should not ship someone else's
+        // migration history.
+        // The table list is inlined rather than bound: drizzle expands a JS
+        // array into a parameter TUPLE — `ANY(($2, $3, …))` — which Postgres
+        // rejects, and the thrown error is swallowed by the catch around this
+        // whole function, so auth would silently stop provisioning. These are
+        // module-level constants, not input.
+        const legacyFkTableList = legacyFkTables.map(t => `'${t}'`).join(", ");
+        const legacyUserIdPresent = await db.execute(sql`
+            SELECT 1
+            FROM information_schema.columns
+            WHERE table_schema = ${authSchema}
+              AND table_name IN (${sql.raw(legacyFkTableList)})
+              AND column_name = 'user_id'
+            LIMIT 1
+        `);
+
+        if (legacyUserIdPresent.rows.length > 0) {
+            await db.execute(sql`
+                CREATE OR REPLACE FUNCTION ${sql.raw(`"${authSchema}"`)}.sync_uid_user_id() RETURNS trigger AS $$
+                BEGIN
+                    IF NEW.uid IS NULL AND NEW.user_id IS NOT NULL THEN
+                        NEW.uid := NEW.user_id;
+                    ELSIF NEW.user_id IS NULL AND NEW.uid IS NOT NULL THEN
+                        NEW.user_id := NEW.uid;
+                    END IF;
+                    RETURN NEW;
+                END $$ LANGUAGE plpgsql
+            `);
+        }
+
+        for (const authTable of legacyUserIdPresent.rows.length > 0 ? legacyFkTables : []) {
             const qualified = `"${authSchema}"."${authTable}"`;
             await db.execute(sql`
                 DO $$
@@ -313,39 +375,21 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             )
         `);
 
-        // Create the `auth` schema with PostgreSQL RLS helper functions.
-        await db.execute(sql`CREATE SCHEMA IF NOT EXISTS auth`);
-
-        // Use an advisory transaction lock to serialize function recreation during HMR
+        // The RLS helper functions every generated policy calls. They live in
+        // `rebase`, alongside the tables above — Rebase creates exactly one
+        // schema in a user's database. Advisory-locked so concurrent HMR
+        // reloads cannot race on `CREATE OR REPLACE`.
+        //
+        // The same statements the migration preamble carries, from the same
+        // constant — these definitions being identical across the boot path and
+        // the migration stream is the whole point of having them in one place.
+        // One call per statement: this handle speaks the extended query
+        // protocol, which rejects multi-command strings.
         await db.transaction(async (tx) => {
             await tx.execute(sql`SELECT pg_advisory_xact_lock(hashtext('rebase_auth_functions_init'))`);
-
-            // Falls back to the pre-rename `app.user_id` so a database that has
-            // taken the new schema but is still served by an older backend keeps
-            // resolving the principal. Keep in sync with AUTH_BOOTSTRAP_SQL.
-            await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.uid', true), ''),
-                        NULLIF(current_setting('app.user_id', true), '')
-                    );
-                $$ LANGUAGE sql STABLE
-            `);
-
-            await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
-                    SELECT COALESCE(
-                        NULLIF(current_setting('app.jwt', true), ''),
-                        '{}'
-                    )::jsonb;
-                $$ LANGUAGE sql STABLE
-            `);
-
-            await tx.execute(sql`
-                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
-                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
-                $$ LANGUAGE sql STABLE
-            `);
+            for (const statement of RLS_BOOTSTRAP_STATEMENTS) {
+                await tx.execute(sql.raw(statement));
+            }
         });
 
         // Seed default roles if none exist
@@ -356,26 +400,204 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // database provisioned by an older framework era is missing every
         // column added since. Each column the auth services read or write must
         // be back-filled here, or upgraded deployments break on the first
-        // statement that references it. `email` is deliberately absent: it has
-        // existed since the first era and cannot be added NOT NULL safely.
-        const userColumnBackfills = [
-            "display_name VARCHAR(255)",
-            "photo_url VARCHAR(500)",
-            "roles TEXT[] DEFAULT '{}' NOT NULL",
-            "password_hash VARCHAR(255)",
-            "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-            "email_verification_token VARCHAR(255)",
-            "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-            "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-            "metadata JSONB DEFAULT '{}' NOT NULL",
-            "tokens_valid_after TIMESTAMP WITH TIME ZONE",
-            "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-            "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-        ];
-        for (const columnDef of userColumnBackfills) {
+        // statement that references it.
+        //
+        // `email` is skipped: it has existed since the first era, so it is never
+        // the missing one, and `ADD COLUMN … NOT NULL` with no default fails on
+        // a table with rows.
+        for (const spec of AUTH_USERS_COLUMNS) {
+            if (spec.column === "email") continue;
+            await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(`${spec.column} ${authUsersColumnSql(spec)}`)}
+            `);
+        }
+
+        // Which of the columns below the table actually has. An adopted table —
+        // one this framework did not create, which the column-name resolution in
+        // `services.ts` exists to support — may be missing any of them, and every
+        // statement past this point has to tolerate that rather than abort the
+        // whole migration block.
+        const usersColumns = await db.execute(sql`
+            SELECT column_name, data_type, is_nullable, column_default
+            FROM information_schema.columns
+            WHERE table_schema = ${usersSchema} AND table_name = ${resolvedTable}
+        `);
+        type UsersColumnRow = {
+            column_name: string;
+            data_type: string;
+            is_nullable: "YES" | "NO";
+            column_default: string | null;
+        };
+        const usersColumnRows = usersColumns.rows as UsersColumnRow[];
+        const usersColumnTypes = new Map(usersColumnRows.map(row => [row.column_name, row.data_type]));
+        const usersColumnState = new Map(usersColumnRows.map(row => [row.column_name, row]));
+
+        // ── Migration: restore defaults and NOT NULL that another creator dropped ──
+        // `ADD COLUMN IF NOT EXISTS` above only creates what is MISSING. A column
+        // that exists with the wrong shape stays wrong forever — and until
+        // AUTH_USERS_COLUMNS became the single source, that was the normal
+        // outcome rather than an edge case: whichever of `db push`, boot-ensure
+        // and this function reached the table first decided its constraints, so
+        // a managed deploy ended up with a nullable `email`, a `roles` with no
+        // `'{}'` default, and an `email_verified` that could be NULL.
+        //
+        // Ordered DEFAULT → back-fill → SET NOT NULL, because SET NOT NULL is
+        // checked against existing rows: without the back-fill it throws on the
+        // very databases that need it. `email` can carry no default, so a NULL
+        // there is not repairable automatically — say so and leave the column
+        // alone rather than inventing an address.
+        for (const spec of AUTH_USERS_COLUMNS) {
+            const state = usersColumnState.get(spec.column);
+            if (!state) continue;
+
+            if (spec.default !== undefined && state.column_default === null) {
+                await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET DEFAULT ${sql.raw(spec.default)}
+                `);
+                logger.info(`🔧 Restored the default on ${usersTableName}.${spec.column}`);
+            }
+
+            if (!spec.notNull || state.is_nullable !== "YES") continue;
+
+            if (spec.default !== undefined) {
+                await db.execute(sql`
+                    UPDATE ${sql.raw(usersTableName)}
+                    SET ${sql.raw(`"${spec.column}"`)} = ${sql.raw(spec.default)}
+                    WHERE ${sql.raw(`"${spec.column}"`)} IS NULL
+                `);
+            }
+            try {
+                await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ALTER COLUMN ${sql.raw(`"${spec.column}"`)} SET NOT NULL
+                `);
+                logger.info(`🔧 Restored NOT NULL on ${usersTableName}.${spec.column}`);
+            } catch (err) {
+                logger.warn(
+                    `⚠️ ${usersTableName}.${spec.column} should be NOT NULL but still holds NULLs, so the ` +
+                    "constraint was not applied. Fill or remove those rows and restart: " +
+                    (err instanceof Error ? err.message : String(err))
+                );
+            }
+        }
+
+        // ── Migration: VARCHAR(n) → TEXT on the users string columns ────────
+        // Tables created before the widths came off still carry them. Postgres
+        // treats varchar(n) → text as binary-coercible with no stricter
+        // constraint, so this is a catalogue-only change: no table rewrite, no
+        // index rebuild, just a brief ACCESS EXCLUSIVE lock. Guarded on the
+        // current type so it runs once and is a pure catalogue read thereafter.
+        for (const column of ["email", "display_name", "photo_url", "password_hash", "email_verification_token"]) {
+            if (usersColumnTypes.get(column) !== "character varying") continue;
             await db.execute(sql`
                 ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+                ALTER COLUMN ${sql.raw(`"${column}"`)} TYPE TEXT
+            `);
+            logger.info(`🔧 Widened ${usersTableName}.${column} from VARCHAR(n) to TEXT`);
+        }
+
+        // ── Migration: case-insensitive email identity ──────────────────────
+        // `getUserByEmail` has always searched `email.toLowerCase()` while the
+        // write path stored whatever it was handed, leaving normalisation to a
+        // convention every caller had to remember. A row that reached the table
+        // with mixed case is then invisible to every lookup — the account exists,
+        // login reports no such user, and the plain UNIQUE on `email` does not
+        // stop a second row differing only in case, because it compares bytes.
+        //
+        // Fixed on both sides: `mapPayload` now folds on write, and this index
+        // makes the database agree. A unique index on lower(email) is strictly
+        // stronger than the byte-exact UNIQUE that older tables carry, so the
+        // old constraint is left alone — it can no longer fire on anything the
+        // new one would allow.
+        //
+        // Deliberately no AUTH_SCHEMA_VERSION bump: a runtime that predates this
+        // migration keeps working against the migrated table (all of its own
+        // write paths already lower-cased), which is exactly the additive case
+        // the version stamp is documented not to cover.
+        if (usersColumnTypes.has("email")) {
+            const indexPresent = await db.execute(sql`
+                SELECT 1 FROM pg_class c
+                JOIN pg_namespace n ON n.oid = c.relnamespace
+                WHERE n.nspname = ${usersSchema} AND c.relname = ${emailLowerUniqueIndex} AND c.relkind = 'i'
+            `);
+            if (indexPresent.rows.length === 0) {
+                // Case-collisions already in the table would make the unique
+                // index impossible to build. Report them and leave the table
+                // alone: the next boot retries, so fixing the rows is all the
+                // operator has to do. Failing loudly beats folding the emails
+                // and letting CREATE INDEX pick which account survives.
+                const collisions = await db.execute(sql`
+                    SELECT lower(email) AS normalized, count(*)::int AS occurrences
+                    FROM ${sql.raw(usersTableName)}
+                    WHERE email IS NOT NULL
+                    GROUP BY lower(email)
+                    HAVING count(*) > 1
+                    LIMIT 10
+                `);
+                if (collisions.rows.length > 0) {
+                    const sample = (collisions.rows as { normalized: string; occurrences: number }[])
+                        .map(row => `${row.normalized} (×${row.occurrences})`)
+                        .join(", ");
+                    logger.error(
+                        `❌ Cannot enforce case-insensitive email uniqueness on ${usersTableName}: ` +
+                        `these addresses already exist more than once, differing only in case — ${sample}. ` +
+                        "Merge or delete the duplicates and restart; until then two accounts can share " +
+                        "one address and only the lower-cased one is reachable by login."
+                    );
+                } else {
+                    const folded = await db.execute(sql`
+                        UPDATE ${sql.raw(usersTableName)}
+                        SET email = lower(email)
+                        WHERE email IS NOT NULL AND email <> lower(email)
+                    `);
+                    if (folded.rowCount) {
+                        logger.info(`🔧 Lower-cased ${folded.rowCount} email address(es) in ${usersTableName}`);
+                    }
+                    await db.execute(sql`
+                        CREATE UNIQUE INDEX IF NOT EXISTS ${sql.raw(`"${emailLowerUniqueIndex}"`)}
+                        ON ${sql.raw(usersTableName)} (lower(email))
+                    `);
+                    logger.info(`✅ Email uniqueness on ${usersTableName} is now case-insensitive`);
+                }
+            }
+        }
+
+        // ── Migration: bound the email column's length ──────────────────────
+        // The only length limit on this table worth keeping. 320 is the RFC 5321
+        // maximum (64-char local part + @ + 255-char domain), and it matters here
+        // beyond tidiness: `email` carries a btree index, and a sufficiently long
+        // value fails index insertion with an error that says nothing about
+        // email. NOT VALID so an adopted table with a long row still migrates —
+        // it binds all new writes, which is the part that matters.
+        if (usersColumnTypes.has("email")) {
+            const checkPresent = await db.execute(sql`
+                SELECT 1 FROM pg_constraint c
+                JOIN pg_class t ON t.oid = c.conrelid
+                JOIN pg_namespace n ON n.oid = t.relnamespace
+                WHERE n.nspname = ${usersSchema}
+                  AND t.relname = ${resolvedTable}
+                  AND c.conname = ${authIdentifier("email_length_check")}
+            `);
+            if (checkPresent.rows.length === 0) {
+                await db.execute(sql`
+                    ALTER TABLE ${sql.raw(usersTableName)}
+                    ADD CONSTRAINT ${sql.raw(emailLengthConstraint)} CHECK (length(email) <= 320) NOT VALID
+                `);
+            }
+        }
+
+        // ── Index: email verification token lookups ─────────────────────────
+        // `getUserByVerificationToken` filters on this column, which had no
+        // index — every click of a verification link was a sequential scan of
+        // the whole users table. Partial, because the column is NULL for every
+        // user who is not mid-verification, which is nearly all of them.
+        if (usersColumnTypes.has("email_verification_token")) {
+            await db.execute(sql`
+                CREATE INDEX IF NOT EXISTS ${sql.raw(`"${verificationTokenIndex}"`)}
+                ON ${sql.raw(usersTableName)} (email_verification_token)
+                WHERE email_verification_token IS NOT NULL
             `);
         }
 
@@ -562,15 +784,22 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // registration after an upgrade fails with SQLSTATE 42501. Reconcile
         // on boot; only tables actually flagged get the ALTER (and its lock).
         try {
+            // Every table this function creates, not a subset. `magic_link_tokens`
+            // and `schema_meta` were missing here while their six siblings were
+            // listed — so on a database carrying FORCE from the older RLS model,
+            // magic-link sign-in kept failing 42501 after the upgrade that was
+            // supposed to fix exactly that, and only for the one auth method.
             const authTablePairs: [string, string][] = [
                 [usersSchema, resolvedTable],
                 [authSchema, "user_identities"],
                 [authSchema, "refresh_tokens"],
                 [authSchema, "password_reset_tokens"],
+                [authSchema, "magic_link_tokens"],
                 [authSchema, "app_config"],
                 [authSchema, "mfa_factors"],
                 [authSchema, "mfa_challenges"],
-                [authSchema, "recovery_codes"]
+                [authSchema, "recovery_codes"],
+                [authSchema, "schema_meta"]
             ];
             for (const [schemaName, tableName] of authTablePairs) {
                 const forced = await db.execute(sql`
@@ -601,10 +830,35 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             );
         }
 
-        // Stamped last, so a boot that died partway through the migrations above
-        // leaves the older stamp in place and the next boot runs them again.
+        // Stamped last of the MIGRATIONS, so a boot that died partway through
+        // the ones above leaves the older stamp in place and the next boot runs
+        // them again.
         await stampAuthSchemaVersion(db, authSchema);
 
+        // ── Keep the end-user role out of auth's tables ─────────────────────
+        // These carry session token hashes, TOTP secrets and recovery codes, and
+        // none of them has RLS — they are not collections, so nothing ever
+        // compiled a policy for them. Meanwhile the role provisioning grants
+        // `rebase_user` DML on every table in this schema, and its
+        // ALTER DEFAULT PRIVILEGES reaches the ones created right here, after it
+        // ran. So the grant has to come back off; see `revokeInternalTableSql`
+        // for why a revoke rather than an empty RLS policy set.
+        //
+        // After the stamp deliberately: `schema_meta` is created BY the stamp,
+        // so revoking first would leave the one table holding this database's
+        // schema version writable by every signed-in user until the next boot.
+        // Nothing below re-runs the migrations, so the stamp's guarantee holds.
+        await revokeInternalTableAccess(
+            async (text) => { await db.execute(sql.raw(text)); },
+            authSchema,
+            {
+                onError: (table, err) => logger.warn(
+                    `🔐 Could not revoke authenticated-role access to "${authSchema}"."${table}": ` +
+                    (err instanceof Error ? err.message : String(err))
+                )
+            }
+        );
+
         logger.info("✅ Auth tables ready");
     } catch (error) {
         // The one failure that must not be survived. Continuing here is what

package/src/auth/services.ts

@@ -54,6 +54,28 @@ function getColumn(table: RebasePgTable | undefined, ...keys: string[]): RebaseP
     return key ? table[key] : undefined;
 }
 
+/**
+ * The single definition of what an email address looks like in storage.
+ *
+ * Reads have always folded case; writes did not, and normalising was left to
+ * each caller. That asymmetry is only ever one forgotten `.toLowerCase()` away
+ * from a row no lookup can find — the account exists, every sign-in path
+ * reports no such user, and the byte-exact UNIQUE on the column does not stop a
+ * duplicate differing only in case. Applied on both sides here so the guarantee
+ * belongs to the repository rather than to its callers' discipline; the
+ * `lower(email)` unique index added in `ensureAuthTablesExist` is the database
+ * half of the same rule.
+ *
+ * Whitespace goes too: a trailing space survives the fold and reproduces the
+ * problem exactly.
+ *
+ * Re-exported rather than defined here: `@rebasepro/server` and
+ * `@rebasepro/server-mongo` write this column too, and a second copy of this
+ * rule is the defect it exists to prevent.
+ */
+import { normalizeEmail } from "@rebasepro/common";
+export { normalizeEmail };
+
 /**
  * PostgreSQL implementation of UserRepository.
  * Handles all user-related database operations using Drizzle ORM.
@@ -184,7 +206,7 @@ export class UserService implements UserRepository {
         const metadataKey = getColumnKey(this.usersTable, "metadata") || "metadata";
 
         if ("id" in data) payload[idKey] = data.id;
-        if ("email" in data) payload[emailKey] = data.email;
+        if ("email" in data) payload[emailKey] = normalizeEmail(data.email);
         if ("passwordHash" in data) payload[passwordHashKey] = data.passwordHash;
         if ("displayName" in data) payload[displayNameKey] = data.displayName;
         if ("photoUrl" in data) payload[photoUrlKey] = data.photoUrl;
@@ -244,7 +266,7 @@ export class UserService implements UserRepository {
     async getUserByEmail(email: string): Promise<UserData | null> {
         const emailCol = getColumn(this.usersTable, "email");
         if (!emailCol) return null;
-        const [row] = await this.db.select().from(this.usersTable).where(eq(emailCol, email.toLowerCase()));
+        const [row] = await this.db.select().from(this.usersTable).where(eq(emailCol, normalizeEmail(email)));
         return row ? this.mapRowToUser(row as Record<string, unknown>) : null;
     }
 

package/src/backup/backup-cli.ts

@@ -100,6 +100,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
             "--out": String,
             "--exclude-schema": [String],
             "--no-owner": Boolean,
+            "--enable-row-security": Boolean,
+            "--row-security-role": String,
             "-o": "--out"
         },
         { argv: rawArgs.slice(2), permissive: true }
@@ -129,6 +131,23 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
     }
     logger.info(chalk.gray(`  Using pg_dump ${pf.toolMajor} against server ${pf.serverMajor}.`));
 
+    // Opt-in, and loud. With row security on, pg_dump stops refusing to read
+    // rows it cannot see and starts leaving them out — an exit-0 backup that
+    // is quietly short. Anyone choosing that should know they chose it.
+    const rowSecurity = args["--enable-row-security"]
+        ? { uid: "rebase-db-backup", roles: [args["--row-security-role"] || "admin"] }
+        : undefined;
+
+    if (rowSecurity) {
+        logger.warn("");
+        logger.warn(chalk.yellow("  ⚠  Dumping with row-level security ON."));
+        logger.warn(chalk.gray(`     Reading as roles [${rowSecurity.roles.join(", ")}], which satisfies the generated`));
+        logger.warn(chalk.gray("     `admin_full_access` policy. This backup contains exactly the rows those"));
+        logger.warn(chalk.gray("     policies admit — a table whose policies have no admin rule comes out short,"));
+        logger.warn(chalk.gray("     and pg_dump will not say so. Prefer granting the dumping role BYPASSRLS."));
+        logger.warn("");
+    }
+
     try {
         if (dest.kind === "local") {
             // Honour an explicit `…/name.dump` path; otherwise treat it as a
@@ -141,7 +160,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
                 fileName: explicitFile ? path.basename(dest.path) : undefined,
                 excludeSchemas: args["--exclude-schema"],
                 noOwner: args["--no-owner"],
-                inheritStdio: true
+                inheritStdio: true,
+                rowSecurity
             });
             await assertDumpValid(dump.localFile);
             logger.info("");
@@ -156,7 +176,8 @@ export async function backupCommand(rawArgs: string[]): Promise<void> {
                 dbName,
                 excludeSchemas: args["--exclude-schema"],
                 noOwner: args["--no-owner"],
-                inheritStdio: true
+                inheritStdio: true,
+                rowSecurity
             });
             try {
                 await assertDumpValid(dump.localFile);
@@ -395,6 +416,24 @@ ${chalk.green.bold("Options")}
   ${chalk.blue("--out, -o")} <dest>        Local path or s3://…/gs://… URL (default: ./backups)
   ${chalk.blue("--exclude-schema")} <s>    Exclude a schema (repeatable)
   ${chalk.blue("--no-owner")}              Omit ownership commands from the dump
+  ${chalk.blue("--enable-row-security")}   Dump as an admin subject instead of failing on RLS
+                             ${chalk.red("(may produce a partial dump — see below)")}
+  ${chalk.blue("--row-security-role")} <r> Role to read as with the flag above (default: admin)
+
+${chalk.green.bold("Row-level security")}
+  On a managed Postgres the dumping role usually owns nothing and has no
+  BYPASSRLS, so pg_dump refuses:
+
+    ERROR: query would be affected by row-level security policy for table "..."
+
+  That refusal is the safe behaviour. --enable-row-security replaces it by
+  reading as an admin subject: Rebase sets app.uid/app.user_roles so the
+  generated admin_full_access policy admits the dump. The dump then contains
+  exactly what those policies admit ${chalk.red("and no error is raised for what they do not")} —
+  a table whose policies lack an admin rule comes out short, silently.
+
+  Granting the dumping role BYPASSRLS is the option that keeps a backup
+  meaning "every row".
 
 ${chalk.green.bold("Notes")}
   Backups may contain secrets and PII. Use private storage destinations and