@rebasepro/server-postgres 0.12.1-canary.gf5f1d39 → 0.13.1-canary.g18cfeb7

package/src/connection.ts

@@ -21,10 +21,19 @@ export interface PostgresPoolConfig {
     statementTimeout?: number;
     /** Enable TCP keep-alive (default: true) */
     keepAlive?: boolean;
+    /**
+     * `search_path` pinned on every connection (default: `"public"`).
+     *
+     * Pass `false` to send no `search_path` at all and inherit whatever the
+     * server/role defaults to. See {@link pinSearchPath} for why the default
+     * is not "inherit".
+     */
+    searchPath?: string | false;
 }
 
 const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
+    searchPath: "public",
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
     // The client-side read timeout MUST be comfortably above the server-side
@@ -43,6 +52,67 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
 /** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
 const TX_IDLE = "I";
 
+/**
+ * Pin `search_path` into a connection string, so unqualified SQL resolves to a
+ * schema this framework chose rather than to one Postgres inferred.
+ *
+ * Postgres defaults `search_path` to `"$user", public`: the *first* candidate
+ * is a schema named after the connecting role. Rebase creates a schema called
+ * `rebase` (auth, history, api keys), and every template, compose file and
+ * deployment doc names the database role `rebase` too — so `$user` resolves to
+ * a schema that exists, and every unqualified statement lands there instead of
+ * in `public`. The generated Drizzle schema emits bare `pgTable("posts", …)`
+ * for any collection without an explicit `schema`, which makes the *runtime's*
+ * own reads and writes unqualified; a developer's raw `rebase.sql(...)`, the
+ * Studio SQL editor and any hand-written migration are unqualified too. The
+ * result is collection tables created in, and served from, `rebase`.
+ *
+ * Drizzle cannot express the fix on its side: `pgSchema("public")` throws by
+ * design ("just use pgTable() instead"), so there is no way to emit a
+ * public-qualified table from the generator. The pin has to live on the
+ * connection.
+ *
+ * Precedence is deliberate and verified against node-postgres: `options` in
+ * the connection string wins over the `options` field passed to `Pool`, so
+ * rewriting the URL — rather than setting the field — is what makes this
+ * authoritative. Two escape hatches survive it:
+ *
+ *  - an `options` that already mentions `search_path` is left untouched, so a
+ *    deployment that deliberately pins something else keeps it;
+ *  - `searchPath: false` (or an unparseable, non-URL connection string) sends
+ *    nothing and inherits the server default.
+ *
+ * Anything else in `options` (a `statement_timeout`, say) is preserved and the
+ * `search_path` flag is appended to it.
+ */
+export function pinSearchPath(connectionString: string, searchPath: string | false = "public"): string {
+    if (searchPath === false) return connectionString;
+
+    let url: URL;
+    try {
+        url = new URL(connectionString);
+    } catch {
+        // Key/value DSNs and anything else we cannot parse are returned as
+        // given: a connection that works unpinned beats one we corrupted.
+        return connectionString;
+    }
+    if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") return connectionString;
+
+    const existing = url.searchParams.get("options");
+    if (existing && /(^|\s)-c\s*search_path\s*=/.test(existing)) return connectionString;
+
+    const flag = `-c search_path=${searchPath}`;
+    url.searchParams.set("options", existing ? `${existing} ${flag}` : flag);
+    // Re-serialize by hand. `URLSearchParams` writes a space as `+`, which
+    // node-postgres happens to decode but libpq does not — and this same string
+    // is handed to `pg_dump`/`psql` for backups. Percent-encoding is the form
+    // both agree on, and is what the scaffolded `.env` already ships.
+    url.search = Array.from(url.searchParams.entries())
+        .map(([key, value]) => `${encodeURIComponent(key)}=${encodeURIComponent(value)}`)
+        .join("&");
+    return url.toString();
+}
+
 /**
  * Destroy pool clients that are released while still inside a transaction.
  *
@@ -108,6 +178,7 @@ export function createPostgresDatabaseConnection(
 ) {
     const opts = { ...DEFAULT_POOL,
 ...poolConfig };
+    connectionString = pinSearchPath(connectionString, opts.searchPath);
 
     const pgPoolConfig: PoolConfig = {
         connectionString,
@@ -159,6 +230,7 @@ export function createDirectDatabaseConnection(
         max: 5,
         ...poolConfig
     };
+    connectionString = pinSearchPath(connectionString, opts.searchPath);
 
     const pgPoolConfig: PoolConfig = {
         connectionString,
@@ -199,6 +271,7 @@ export function createReadReplicaConnection(
         max: 10,
         ...poolConfig
     };
+    connectionString = pinSearchPath(connectionString, opts.searchPath);
 
     const pgPoolConfig: PoolConfig = {
         connectionString,

package/src/data-transformer.ts

@@ -3,6 +3,7 @@ import { AnyPgColumn } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { CollectionConfig, Properties, Property, ResolvedRelation, RelationProperty, Vector, BinaryProperty, hasForeignKeyOnTarget, type ResolvedBelongsTo, type ResolvedForeignKeyOnTarget, type ResolvedVia } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
+import { isPrototypePollutingKey } from "@rebasepro/utils";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { DrizzleConditionBuilder } from "./utils/drizzle-conditions";
 import { getPrimaryKeys, buildCompositeId } from "./services/collection-helpers";
@@ -68,9 +69,15 @@ export function sanitizeAndConvertDates(obj: unknown): unknown {
     if (typeof obj === "object") {
         const newObj: Record<string, unknown> = {};
         for (const key in obj) {
-            if (Object.prototype.hasOwnProperty.call(obj, key)) {
-                newObj[key] = sanitizeAndConvertDates((obj as Record<string, unknown>)[key]);
-            }
+            if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+            // `JSON.parse` creates `__proto__` as an *own* property, so it gets
+            // past the check above — and `newObj[key] = …` then invokes the
+            // prototype setter instead of creating a property. The row's
+            // prototype becomes whatever the request body supplied, so
+            // `row.isAdmin` answers `true` while `Object.keys(row)` shows
+            // nothing of the sort. No column can be reached by these names.
+            if (isPrototypePollutingKey(key)) continue;
+            newObj[key] = sanitizeAndConvertDates((obj as Record<string, unknown>)[key]);
         }
         return newObj;
     }
@@ -126,6 +133,9 @@ joinPathRelationUpdates: [] };
     });
 
     for (const [key, value] of Object.entries(row)) {
+        // Same reasoning as `sanitizeAndConvertDates`: these keys come from the
+        // request body, and no column answers to them.
+        if (isPrototypePollutingKey(key)) continue;
         const property = properties[key as keyof M] as Property;
 
         // Coerce empty strings to null for any field that acts as a foreign key
@@ -328,9 +338,15 @@ export async function parseDataFromServer<M extends Record<string, unknown>>(
                         const targetCollection = relation.target();
                         const targetTable = registry.getTable(getTableName(targetCollection));
                         const pks = getPrimaryKeys(collection, registry!);
-                        const currentId = buildCompositeId(data, pks);
-
-                        if (targetTable && currentId) {
+                        // What the target's foreign key holds. Ordinarily this
+                        // row's id; for a link on a natural key, the value of
+                        // the column it points at — which is on the row already,
+                        // so this costs nothing extra.
+                        const currentId = relation.sourceKey
+                            ? (data as Record<string, unknown>)[relation.sourceKey] as string | number | undefined
+                            : buildCompositeId(data, pks);
+
+                        if (targetTable && currentId !== undefined && currentId !== null && currentId !== "") {
                             const foreignKeyColumn = targetTable[relation.foreignKeyOnTarget as keyof typeof targetTable] as AnyPgColumn;
                             if (foreignKeyColumn) {
                                 // Query the target table to find row that references this row

package/src/databasePoolManager.ts

@@ -2,7 +2,7 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
-import { guardPoolAgainstDirtyRelease } from "./connection";
+import { guardPoolAgainstDirtyRelease, pinSearchPath } from "./connection";
 
 export class DatabasePoolManager {
     private pools: Map<string, Pool> = new Map();
@@ -41,7 +41,10 @@ export class DatabasePoolManager {
         url.pathname = `/${databaseName}`;
 
         const pool = new Pool({
-            connectionString: url.toString(),
+            // Same pin as the primary pool: these are branch/multi-database
+            // connections to the *same* server, so they inherit the same
+            // `"$user"` hazard. See `pinSearchPath`.
+            connectionString: pinSearchPath(url.toString()),
             max: 10, // Default sensible limit, can be tuned later
             idleTimeoutMillis: 10000, // Reduced from 30000 for aggressive cleanup
             allowExitOnIdle: true // Prevent idle clients from hanging the Node.js process

package/src/history/ensure-history-table.ts

@@ -1,6 +1,7 @@
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /**
  * Auto-create the row history table if it doesn't exist.
@@ -38,6 +39,12 @@ export async function ensureHistoryTableExists(db: NodePgDatabase): Promise<void
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
 
+        // Every previous value of every audited row, in one table with no RLS
+        // and no tenant scoping — so a readable copy defeats the row policies on
+        // the tables it shadows. The driver's schema-wide grant reaches it
+        // (created here, after that grant ran), so take it back.
+        await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
+
         logger.info("✅ Entity history table ready");
     } catch (error) {
         logger.error("❌ Failed to create row history table", { error: error });

package/src/schema/auth-schema.ts

@@ -1,8 +1,19 @@
-import { pgSchema, pgTable, varchar, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
+import { pgSchema, pgTable, uuid, timestamp, boolean, jsonb, text, unique, index } from "drizzle-orm/pg-core";
 import { relations } from "drizzle-orm";
 
 /**
  * Factory function to dynamically create the auth tables bound to the specified schema names.
+ *
+ * This module builds queries; it does not create tables. `ensureAuthTablesExist`
+ * owns the DDL, which makes everything here a *claim* about a database it cannot
+ * enforce — and the claims drifted. Every column below was declared
+ * `varchar(n)` while the DDL created it as `TEXT`: `user_agent` as varchar(500),
+ * `ip_address` as varchar(45), `secret_encrypted` as varchar(500), every
+ * `token_hash` as varchar(255). None of it was true of any database this
+ * framework ever provisioned. Harmless at runtime — drizzle does not enforce a
+ * length client-side, so the widths only ever misled the next reader — but a
+ * schema module that describes columns that do not exist is worse than no
+ * schema module. They are `text` here now because they are TEXT there.
  */
 export function createAuthSchema(usersSchemaName = "rebase") {
     const usersSchema = usersSchemaName === "public" ? null : pgSchema(usersSchemaName);
@@ -15,12 +26,12 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      */
     const users = usersTableCreator("users", {
         id: uuid("id").defaultRandom().primaryKey(),
-        email: varchar("email", { length: 255 }).notNull().unique(),
-        passwordHash: varchar("password_hash", { length: 255 }), // NULL for OAuth-only users
-        displayName: varchar("display_name", { length: 255 }),
-        photoUrl: varchar("photo_url", { length: 500 }),
+        email: text("email").notNull().unique(),
+        passwordHash: text("password_hash"), // NULL for OAuth-only users
+        displayName: text("display_name"),
+        photoUrl: text("photo_url"),
         emailVerified: boolean("email_verified").default(false).notNull(),
-        emailVerificationToken: varchar("email_verification_token", { length: 255 }),
+        emailVerificationToken: text("email_verification_token"),
         emailVerificationSentAt: timestamp("email_verification_sent_at"),
         isAnonymous: boolean("is_anonymous").default(false).notNull(),
         roles: text("roles").array().default([]).notNull(),
@@ -65,7 +76,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
         sessionId: uuid("session_id").defaultRandom().notNull(),
-        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        tokenHash: text("token_hash").notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         revoked: boolean("revoked").default(false).notNull(),
         rotatedAt: timestamp("rotated_at"),
@@ -76,8 +87,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
          * that rotates immediately after it.
          */
         sessionStartedAt: timestamp("session_started_at").defaultNow().notNull(),
-        userAgent: varchar("user_agent", { length: 500 }),
-        ipAddress: varchar("ip_address", { length: 45 }),
+        userAgent: text("user_agent"),
+        ipAddress: text("ip_address"),
         createdAt: timestamp("created_at").defaultNow().notNull()
     }, (table) => ({
         sessionIdx: index("idx_refresh_tokens_session").on(table.sessionId)
@@ -89,7 +100,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const passwordResetTokens = tableCreator("password_reset_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        tokenHash: text("token_hash").notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()
@@ -99,7 +110,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
      * App config - key/value store for custom settings
      */
     const appConfig = tableCreator("app_config", {
-        key: varchar("key", { length: 100 }).primaryKey(),
+        key: text("key").primaryKey(),
         value: jsonb("value").notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
     });
@@ -110,8 +121,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const userIdentities = tableCreator("user_identities", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        provider: varchar("provider", { length: 50 }).notNull(), // e.g. 'google', 'linkedin'
-        providerId: varchar("provider_id", { length: 255 }).notNull(),
+        provider: text("provider").notNull(), // e.g. 'google', 'linkedin'
+        providerId: text("provider_id").notNull(),
         profileData: jsonb("profile_data"),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
@@ -125,9 +136,9 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const mfaFactors = tableCreator("mfa_factors", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        factorType: varchar("factor_type", { length: 20 }).notNull(), // 'totp'
-        secretEncrypted: varchar("secret_encrypted", { length: 500 }).notNull(),
-        friendlyName: varchar("friendly_name", { length: 255 }),
+        factorType: text("factor_type").notNull(), // 'totp'
+        secretEncrypted: text("secret_encrypted").notNull(),
+        friendlyName: text("friendly_name"),
         verified: boolean("verified").default(false).notNull(),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         updatedAt: timestamp("updated_at").defaultNow().notNull()
@@ -141,7 +152,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         factorId: uuid("factor_id").notNull().references(() => mfaFactors.id, { onDelete: "cascade" }),
         createdAt: timestamp("created_at").defaultNow().notNull(),
         verifiedAt: timestamp("verified_at"),
-        ipAddress: varchar("ip_address", { length: 45 }),
+        ipAddress: text("ip_address"),
         expiresAt: timestamp("expires_at").notNull()
     });
 
@@ -151,7 +162,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const recoveryCodes = tableCreator("recovery_codes", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        codeHash: varchar("code_hash", { length: 255 }).notNull(),
+        codeHash: text("code_hash").notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()
     });
@@ -162,7 +173,7 @@ export function createAuthSchema(usersSchemaName = "rebase") {
     const magicLinkTokens = tableCreator("magic_link_tokens", {
         id: uuid("id").defaultRandom().primaryKey(),
         uid: uuid("uid").notNull().references(() => users.id, { onDelete: "cascade" }),
-        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        tokenHash: text("token_hash").notNull().unique(),
         expiresAt: timestamp("expires_at").notNull(),
         usedAt: timestamp("used_at"),
         createdAt: timestamp("created_at").defaultNow().notNull()

package/src/schema/auth-users-columns.ts

@@ -0,0 +1,131 @@
+/**
+ * The one description of what an auth user table's columns must be.
+ *
+ * ## Why this exists
+ *
+ * Three different code paths create `rebase.users`, and before this module they
+ * disagreed about it:
+ *
+ * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |
+ * |------------------|-----------------------|-------------------------|--------------------------|
+ * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |
+ * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |
+ * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |
+ * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |
+ *
+ * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so
+ * whichever ran first decided the table and the other two silently no-op'd.
+ * Boot order therefore chose the constraints: a managed deploy (collection
+ * tables first) got a users table whose `email` was nullable and whose
+ * `email_verified` had no default, while the same project pushed from a
+ * checkout got the strict one. In the same table, `is_anonymous` came out
+ * `NOT NULL DEFAULT false` — because *that* column existed in only one of the
+ * three lists, so its owner's definition won by default.
+ *
+ * A second consequence was drift in the other direction. The scaffold's
+ * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and
+ * builds its desired state from the collection alone, so the two columns only
+ * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged
+ * drift, and a push run after the server had booted once planned to DROP them.
+ *
+ * Both problems are the same problem: no single place said what this table is.
+ * This is that place. Every creator asks here first and only then falls back to
+ * the collection's own property definitions, so a column auth owns has one
+ * definition regardless of who gets there first, and a column the developer
+ * added to their users collection still behaves like any other field.
+ *
+ * ## What belongs here
+ *
+ * Only columns the auth services read or write. A developer's own additions to
+ * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and
+ * must NOT be listed — they are generated from the collection like every other
+ * field, and listing them here would freeze a user's schema.
+ *
+ * `id` is deliberately absent: its type comes from the collection's id property
+ * (uuid / increment / text) and each creator already derives it.
+ *
+ * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an
+ * older runtime unable to work against a migrated table.
+ */
+
+/**
+ * A column auth owns.
+ *
+ * Structured rather than one SQL string because the same facts are needed in
+ * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,
+ * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a
+ * table that already exists with the wrong shape. Parsing a string back apart
+ * for the third of those is how the copies drifted in the first place.
+ */
+export interface AuthUsersColumn {
+    /** Physical column name. */
+    column: string;
+    /** Postgres type. */
+    type: string;
+    /** Default expression, verbatim, or absent for no default. */
+    default?: string;
+    /** Whether the column is NOT NULL. */
+    notNull?: boolean;
+}
+
+/**
+ * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
+ * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
+ * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
+ * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
+ * table that already holds a longer row.
+ */
+export const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [
+    { column: "email", type: "TEXT", notNull: true },
+    { column: "display_name", type: "TEXT" },
+    { column: "photo_url", type: "TEXT" },
+    { column: "roles", type: "TEXT[]", default: "'{}'", notNull: true },
+    { column: "password_hash", type: "TEXT" },
+    { column: "email_verified", type: "BOOLEAN", default: "FALSE", notNull: true },
+    { column: "email_verification_token", type: "TEXT" },
+    { column: "email_verification_sent_at", type: "TIMESTAMP WITH TIME ZONE" },
+    { column: "is_anonymous", type: "BOOLEAN", default: "FALSE", notNull: true },
+    { column: "metadata", type: "JSONB", default: "'{}'", notNull: true },
+    { column: "tokens_valid_after", type: "TIMESTAMP WITH TIME ZONE" },
+    { column: "created_at", type: "TIMESTAMP WITH TIME ZONE", default: "NOW()", notNull: true },
+    { column: "updated_at", type: "TIMESTAMP WITH TIME ZONE", default: "NOW()", notNull: true }
+];
+
+const BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));
+
+/** Type + inline constraints, as they appear after the column name. */
+export function authUsersColumnSql(spec: AuthUsersColumn): string {
+    return [
+        spec.type,
+        spec.default !== undefined ? `DEFAULT ${spec.default}` : "",
+        spec.notNull ? "NOT NULL" : ""
+    ].filter(Boolean).join(" ");
+}
+
+/**
+ * The auth-owned definition for a physical column name, or `undefined` when
+ * auth does not own it.
+ *
+ * Callers pass the RESOLVED column name (after `columnName` mapping), because
+ * that is the only name the three creators agree on: the scaffold's users
+ * collection spells the property `displayName` and the column `display_name`.
+ */
+export function authUsersColumnDefinition(column: string): string | undefined {
+    const spec = BY_COLUMN.get(column);
+    return spec ? authUsersColumnSql(spec) : undefined;
+}
+
+/**
+ * Whether a collection is an auth collection, i.e. whether the definitions in
+ * this module apply to its table at all.
+ *
+ * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
+ * that one takes a `CollectionConfig`, this one is called from DDL code paths
+ * that hold looser objects, and both spellings must accept `auth: true` as well
+ * as `auth: { enabled: true }`.
+ */
+export function isAuthCollection(collection: unknown): boolean {
+    const auth = (collection as { auth?: unknown } | undefined)?.auth;
+    if (auth === true) return true;
+    return typeof auth === "object" && auth !== null && (auth as { enabled?: unknown }).enabled === true;
+}

package/src/schema/doctor.ts

@@ -15,7 +15,7 @@ import chalk from "chalk";
 import { CollectionConfig, isPostgresCollectionConfig, Property, NumberProperty, StringProperty, DateProperty, ArrayProperty, MapProperty, RelationProperty, type ResolvedManyToMany, type ResolvedBelongsTo, isManyToMany } from "@rebasepro/types";
 import { generateSchema } from "./generate-drizzle-schema-logic";
 import { generateTypedefs } from "@rebasepro/codegen";
-import { getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getTableName, resolveCollectionRelations, findRelation, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { logger, loadCollectionsFromDirectory } from "@rebasepro/server";
 
@@ -164,8 +164,10 @@ export async function checkCollectionsVsSchema(
 issues };
     }
 
-    // Re-generate schema in-memory and compare with file on disk
-    const postgresCollections = collections.filter(isPostgresCollectionConfig);
+    // Re-generate schema in-memory and compare with file on disk. Only the
+    // collections the generator itself will emit — a Firestore collection has
+    // no table in the generated file and must not be reported as missing one.
+    const postgresCollections = relationalCollections(collections);
     if (postgresCollections.length === 0) {
         return { passed: true,
 issues };
@@ -292,7 +294,7 @@ export async function checkCollectionsVsDatabase(
     const schemas = Array.from(new Set([
         "public",
         "rebase",
-        ...collections
+        ...relationalCollections(collections)
             .filter(isPostgresCollectionConfig)
             .map(c => c.schema)
             .filter((s): s is string => !!s)
@@ -383,7 +385,7 @@ export async function checkCollectionsVsDatabase(
 
         // ── Compare each collection against the database ─────────────────
 
-        const postgresCollections = collections.filter(isPostgresCollectionConfig);
+        const postgresCollections = relationalCollections(collections);
 
         for (const collection of postgresCollections) {
             const tableName = getTableName(collection);

package/src/schema/ensure-collection-policies.ts

@@ -0,0 +1,105 @@
+/**
+ * Applying a bundle's RLS policies to a database at boot, idempotently.
+ *
+ * ## Why this exists
+ *
+ * {@link ensureCollectionTables} creates the collection *tables* a managed
+ * runtime boots against, but a table with row-level security disabled and no
+ * policies is not servable: authenticated requests run as the restricted
+ * `rebase_user` role, so a read with no `SELECT` policy returns nothing (a
+ * public collection answered 401) and a write with no `INSERT`/`UPDATE` policy
+ * is denied. The policies live in the collections' `securityRules`; nothing at
+ * boot applied them. `rebase db push` does — but it drives Atlas against a
+ * local `DATABASE_URL`, and a managed tenant's database is reachable only from
+ * inside the cluster, by the runtime that is already connected to it. So the
+ * runtime is the only thing that *can* apply them, and this is where it does.
+ *
+ * ## Why this is safe to run on every boot
+ *
+ * Every statement is idempotent: `ENABLE ROW LEVEL SECURITY` is a no-op once
+ * enabled, and each policy is a `DROP POLICY IF EXISTS` immediately followed by
+ * a `CREATE POLICY`, so re-applying asserts exactly the declared state. It adds
+ * and replaces; it never drops data. (It does not *reconcile* — a policy a
+ * previous push left behind under an old name is not removed here; that stays a
+ * `db push` / `db migrate` concern, alongside destructive schema changes.)
+ *
+ * Unlike table creation, a failure here is not fatal: RLS stays enabled, so a
+ * table whose policies could not be applied fails **closed** (denies) rather
+ * than leaking rows. One collection's policy failing (e.g. a rule that
+ * references a table a real migration has not created yet) must not crash-loop
+ * the whole deployment and take the other collections' working routes down with
+ * it. Failures are reported loudly and per-table so the operator can see
+ * exactly which collection is not yet servable and why.
+ */
+import { type CollectionConfig } from "@rebasepro/types";
+import { planCollectionPolicies } from "./generate-postgres-ddl-logic";
+import { readExistingSchema, type Queryable } from "./ensure-collection-tables";
+
+export interface PolicyEnsureResult {
+    /** `CREATE POLICY` statements that ran successfully. */
+    policiesApplied: number;
+    /** Tables that had RLS enabled. */
+    tablesSecured: number;
+    /** Declared tables absent from the database — left to a real migration. */
+    skipped: { table: string; reason: string }[];
+    /** Tables whose RLS could not be fully applied (fail closed). */
+    failures: { table: string; error: string }[];
+}
+
+const isCreatePolicy = (statement: string): boolean => /^\s*CREATE POLICY/i.test(statement);
+
+/**
+ * Bring the declared collections' RLS policies up to date. Returns what it did.
+ *
+ * Only tables that already exist are touched: the boot-time table creator runs
+ * first, so anything still missing is a table this additive path is not allowed
+ * to create (a junction, or a relation left to a migration). Enabling RLS on a
+ * non-existent table would error, so those are recorded as skipped, not failed.
+ */
+export async function ensureCollectionPolicies(
+    client: Queryable,
+    collections: CollectionConfig[],
+    log?: (message: string) => void
+): Promise<PolicyEnsureResult> {
+    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [] };
+
+    const plans = planCollectionPolicies(collections);
+    if (plans.length === 0) return result;
+
+    const schemas = Array.from(new Set(plans.map(p => p.schema)));
+    const existing = await readExistingSchema(client, schemas);
+
+    for (const plan of plans) {
+        if (!existing.tables.has(plan.qualified)) {
+            result.skipped.push({
+                table: plan.qualified,
+                reason: "table is not present in the database; create it with `rebase db push` / `rebase db migrate`"
+            });
+            continue;
+        }
+
+        try {
+            // Enable first: if a later policy statement fails, the table is left
+            // locked (deny-all for the user role) rather than open.
+            await client.query(plan.enableRls);
+            result.tablesSecured++;
+
+            let created = 0;
+            for (const statement of plan.policyStatements) {
+                await client.query(statement);
+                if (isCreatePolicy(statement)) {
+                    result.policiesApplied++;
+                    created++;
+                }
+            }
+            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);
+        } catch (err) {
+            result.failures.push({
+                table: plan.qualified,
+                error: err instanceof Error ? err.message : String(err)
+            });
+        }
+    }
+
+    return result;
+}