@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g06dbe5b

package/src/services/PersistService.ts

@@ -1,10 +1,11 @@
 import { eq, and, sql, SQL } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CollectionConfig, Properties, ResolvedRelation, type ResolvedManyToMany, isManyToMany, hasForeignKeyOnTarget } from "@rebasepro/types";
+import { CollectionConfig, Properties, Property, ResolvedRelation, type ResolvedManyToMany, isManyToMany, hasForeignKeyOnTarget } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations } from "@rebasepro/common";
 import { DrizzleConditionBuilder } from "../utils/drizzle-conditions";
 import {
+    assertWritableColumns,
     getCollectionByPath,
     getTableForCollection,
     getPrimaryKeys,
@@ -307,6 +308,11 @@ export class PersistService {
 
             const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 
+            // Everything below builds SQL from the table's own column list, so
+            // a key that is not a column is silently left out rather than
+            // refused. Say so here, while the key is still in hand.
+            assertWritableColumns(entityData as Record<string, unknown>, table, effectiveCollectionPath);
+
             savedId = await this.db.transaction(async (tx) => {
                 let currentId: string | number;
 
@@ -380,6 +386,23 @@ export class PersistService {
                         // branch; Postgres rejects that against the conflict target.
                         for (const info of idInfoArray) delete set[info.fieldName];
 
+                        // A conflict means the row was already there, so its
+                        // `on_create` stamp is a fact about the past and not
+                        // this write's to redecide. Bulk rows are saved with
+                        // `status: "new"` on purpose (an import's rows carry a
+                        // natural key for rows that may not exist), which
+                        // computes the creation timestamp for every row — and
+                        // the conflict-update then wrote it over the original.
+                        // A nightly re-import reset `createdAt` on everything
+                        // it touched, and every "new this week" query with it.
+                        // The INSERT branch keeps the value: it is right there.
+                        for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+                            if ((prop as Property).type === "date"
+                                && (prop as { autoValue?: string }).autoValue === "on_create") {
+                                delete set[propName];
+                            }
+                        }
+
                         result = Object.keys(set).length > 0
                             ? await insertQuery.onConflictDoUpdate({ target, set }).returning(returningKeys)
                             : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
@@ -477,7 +500,20 @@ export class PersistService {
         const pgError = extractPgError(error);
 
         if (pgError) {
-            const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+            const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+            // This is the only layer that holds the SQLSTATE, so it is the only
+            // one that can say whose fault a failure was. Returning a bare
+            // `Error` threw that away, and the REST layer compensated by calling
+            // *every* unclassified error a 400 — so an unreachable database was
+            // reported to callers as a bad request. Classes 22 (data exception)
+            // and 23 (integrity constraint violation) are the caller's data;
+            // everything else — a dropped connection, a missing column, a
+            // permission problem — is ours, and stays a 500.
+            if (/^2[23]/.test(code)) {
+                return code === "23505"
+                    ? ApiError.conflict(message, `PG_${code}`)
+                    : ApiError.badRequest(message, `PG_${code}`);
+            }
             return new Error(message);
         }
 

package/src/services/RelationService.ts

@@ -423,7 +423,8 @@ export class RelationService {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
                 options.searchString,
                 targetCollection.properties,
-                targetTable
+                targetTable,
+                targetCollection
             );
 
             if (searchConditions.length === 0) {
@@ -1004,6 +1005,87 @@ export class RelationService {
         return resultMap;
     }
 
+    /**
+     * Bring one row's junction links in line with the ids a save carried,
+     * by diffing against what is stored rather than replacing the lot.
+     *
+     * The old shape was `DELETE every link for this parent` followed by
+     * `INSERT what the client sent`, which makes a save of the parent a full
+     * replacement of the membership set from a list the browser assembled out
+     * of a read it did earlier. Three things follow from that, and the diff
+     * closes all three:
+     *
+     *  - **Lost update.** Two editors with post 7 open: A adds tag X and saves;
+     *    B saves any field and the whole set is rewritten from B's older list,
+     *    dropping X with nothing to show for it. A diff only names the ids that
+     *    actually changed, so edits to disjoint tags no longer collide.
+     *  - **Partial read, partial delete.** The read that fills the form runs
+     *    under RLS, so a user who may edit the parent but cannot *see* some of
+     *    the linked rows gets a shorter list — and writing it back deleted the
+     *    links they were never shown. The DELETE now names ids instead of
+     *    "everything for this parent", and the select that produces them runs
+     *    in this same transaction under the same policies, so a link the caller
+     *    cannot read is in neither list and survives the save.
+     *  - **Junction payload columns.** A junction carrying its own columns
+     *    (`position`, `role`, `created_at`) lost them on every save, because
+     *    every row was re-inserted with only the two keys. Untouched links are
+     *    now left alone.
+     *
+     * The insert is `ON CONFLICT DO NOTHING` so that two sessions adding the
+     * same link concurrently is a no-op rather than a unique violation.
+     */
+    private async syncJunctionLinks(
+        tx: DrizzleClient,
+        junctionTable: PgTable,
+        sourceJunctionColumn: AnyPgColumn,
+        targetJunctionColumn: AnyPgColumn,
+        parsedParentId: unknown,
+        parsedTargetIds: unknown[]
+    ) {
+        const existingRows = await tx
+            .select({ targetId: targetJunctionColumn })
+            .from(junctionTable)
+            .where(eq(sourceJunctionColumn, parsedParentId));
+
+        // Keyed by `String(...)` because a junction key can come back from the
+        // driver as a string where the parsed value is a number, and a diff
+        // that misses that would delete and re-insert every link.
+        const existingById = new Map<string, unknown>();
+        for (const row of existingRows as Array<{ targetId: unknown }>) {
+            if (row.targetId === null || row.targetId === undefined) continue;
+            existingById.set(String(row.targetId), row.targetId);
+        }
+
+        const wantedById = new Map<string, unknown>();
+        for (const targetId of parsedTargetIds) {
+            if (targetId === null || targetId === undefined) continue;
+            wantedById.set(String(targetId), targetId);
+        }
+
+        const removed = [...existingById.entries()]
+            .filter(([key]) => !wantedById.has(key))
+            .map(([, value]) => value);
+        const added = [...wantedById.entries()]
+            .filter(([key]) => !existingById.has(key))
+            .map(([, value]) => value);
+
+        if (removed.length > 0) {
+            await tx.delete(junctionTable).where(and(
+                eq(sourceJunctionColumn, parsedParentId),
+                inArray(targetJunctionColumn, removed)
+            ));
+        }
+
+        if (added.length > 0) {
+            await tx.insert(junctionTable)
+                .values(added.map(targetId => ({
+                    [sourceJunctionColumn.name]: parsedParentId,
+                    [targetJunctionColumn.name]: targetId
+                })))
+                .onConflictDoNothing();
+        }
+    }
+
     /**
      * Update many-to-many and junction relations
      */
@@ -1072,23 +1154,15 @@ export class RelationService {
                 const parsedParentIdObj = parseIdValues(id, parentPks);
                 const parsedParentId = parsedParentIdObj[parentIdInfo.fieldName];
 
-                // Delete existing relations for this row
-                await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-
+                let parsedTargetIds: unknown[] = [];
                 if (targetEntityIds.length > 0) {
                     const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                     const targetIdInfo = targetPks[0];
-                    const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-
-                    const newLinks = parsedTargetIds.map(targetId => ({
-                        [sourceJunctionColumn.name]: parsedParentId,
-                        [targetJunctionColumn.name]: targetId
-                    }));
-
-                    if (newLinks.length > 0) {
-                        await tx.insert(junctionTable).values(newLinks);
-                    }
+                    parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
                 }
+
+                await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn,
+                    parsedParentId, parsedTargetIds);
             } else if (relation.kind === "manyToMany") {
                 // Handle many-to-many relations with junction table using 'through' property
                 const junctionTable = this.registry.getTable(relation.through.table);
@@ -1110,23 +1184,15 @@ export class RelationService {
                 const parsedParentIdObj = parseIdValues(id, parentPks);
                 const parsedParentId = parsedParentIdObj[parentIdInfo.fieldName];
 
-                // Delete existing relations for this row
-                await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedParentId));
-
+                let parsedTargetIds: unknown[] = [];
                 if (targetEntityIds.length > 0) {
                     const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                     const targetIdInfo = targetPks[0];
-                    const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-
-                    const newLinks = parsedTargetIds.map(targetId => ({
-                        [sourceJunctionColumn.name]: parsedParentId,
-                        [targetJunctionColumn.name]: targetId
-                    }));
-
-                    if (newLinks.length > 0) {
-                        await tx.insert(junctionTable).values(newLinks);
-                    }
+                    parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
                 }
+
+                await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn,
+                    parsedParentId, parsedTargetIds);
             } else if (relation.cardinality === "many" && hasForeignKeyOnTarget(relation)) {
                 // Handle one-to-many (inverse) by updating target FK to point to parent
                 const targetTable = getTableForCollection(targetCollection, this.registry);
@@ -1358,41 +1424,25 @@ export class RelationService {
                 const parsedSourceIdObj = parseIdValues(sourceEntityId, sourcePks);
                 const parsedSourceId = parsedSourceIdObj[sourceIdInfo.fieldName];
 
-                // Clear existing entries for this source row
-                await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-
-                // Add new entries if newValue is provided
+                // The membership this write asks for, as parsed keys. A single
+                // value is the one-to-one case and reads as a set of one.
+                let parsedTargetIds: unknown[] = [];
                 if (newValue && Array.isArray(newValue) && newValue.length > 0) {
                     const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                     const targetIdInfo = targetPks[0];
                     // This path already read both shapes; the other two did not.
                     // Same helper now, so the three cannot drift again.
                     const targetEntityIds = relationTargetIds(newValue, relation.relationName, sourceCollection.slug);
-                    const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-
-                    const newLinks = parsedTargetIds.map(targetId => ({
-                        [sourceJunctionColumn!.name]: parsedSourceId,
-                        [targetJunctionColumn!.name]: targetId
-                    }));
-
-                    if (newLinks.length > 0) {
-                        await tx.insert(junctionTable).values(newLinks);
-                    }
+                    parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
                 } else if (newValue && !Array.isArray(newValue)) {
-                    // Single value for one-to-one
                     const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                     const targetIdInfo = targetPks[0];
                     const targetId = typeof newValue === "object" && newValue !== null ? (newValue as Record<string, unknown>).id as string | number : newValue as string | number;
-                    const parsedTargetIdObj = parseIdValues(targetId, targetPks);
-                    const parsedTargetId = parsedTargetIdObj[targetIdInfo.fieldName];
-
-                    const newLink = {
-                        [sourceJunctionColumn.name]: parsedSourceId,
-                        [targetJunctionColumn.name]: parsedTargetId
-                    };
-
-                    await tx.insert(junctionTable).values(newLink);
+                    parsedTargetIds = [parseIdValues(targetId, targetPks)[targetIdInfo.fieldName]];
                 }
+
+                await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn,
+                    parsedSourceId, parsedTargetIds);
             }
         } catch (error) {
             logger.error(`Failed to update inverse joinPath relation '${relation.relationName}'`, { error: error });
@@ -1432,25 +1482,18 @@ export class RelationService {
             const parsedSourceIdObj = parseIdValues(sourceEntityId, sourcePks);
             const parsedSourceId = parsedSourceIdObj[sourceIdInfo.fieldName];
 
-            // Clear existing entries for this source row
-            await tx.delete(junctionTable).where(eq(sourceJunctionColumn, parsedSourceId));
-
-            // Add new entries if newValue is provided
-            if (newValue && Array.isArray(newValue) && newValue.length > 0) {
+            const targetEntityIds = Array.isArray(newValue)
+                ? relationTargetIds(newValue, relation.relationName, sourceCollection.slug)
+                : [];
+            let parsedTargetIds: unknown[] = [];
+            if (targetEntityIds.length > 0) {
                 const targetPks = requirePrimaryKeys(targetCollection, this.registry);
                 const targetIdInfo = targetPks[0];
-                const targetEntityIds = relationTargetIds(newValue, relation.relationName, sourceCollection.slug);
-                const parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
-
-                const newLinks = parsedTargetIds.map(targetId => ({
-                    [sourceJunctionColumn.name]: parsedSourceId,
-                    [targetJunctionColumn.name]: targetId
-                }));
-
-                if (newLinks.length > 0) {
-                    await tx.insert(junctionTable).values(newLinks);
-                }
+                parsedTargetIds = targetEntityIds.map(id => parseIdValues(id, targetPks)[targetIdInfo.fieldName]);
             }
+
+            await this.syncJunctionLinks(tx, junctionTable, sourceJunctionColumn, targetJunctionColumn,
+                parsedSourceId, parsedTargetIds);
         } catch (error) {
             logger.error(`Failed to update many-to-many inverse relation '${relation.relationName}'`, { error: error });
             throw error;

package/src/services/channel-history.ts

@@ -34,6 +34,7 @@ import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** How many messages a replay returns when the caller does not say. */
 const DEFAULT_REPLAY_LIMIT = 200;
@@ -198,6 +199,19 @@ export class ChannelHistoryStore {
             )
         `);
 
+        // Retained broadcasts for every channel in one table, with no RLS: who
+        // may replay a channel is decided before the read, by the channel gate
+        // in `realtimeService.authorizeChannelAction` — a replay is answered
+        // only for a client that has joined the channel, plus whatever an
+        // installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed; the
+        // rule language it does not yet have is written up in
+        // `docs/channel-authorization.md`. The driver's schema-wide
+        // grant reaches these (created here, after it ran), so take the
+        // privilege back.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+
         this.tablesReady = true;
         logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
     }

package/src/services/channel-presence.ts

@@ -28,6 +28,7 @@
 
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** A tracked client, as any instance sees it. */
 export interface PresenceRow {
@@ -71,6 +72,18 @@ export class ChannelPresenceStore {
             ON rebase.channel_presence (last_seen)
         `);
 
+        // The roster of every client on every channel, with no RLS — a row
+        // policy has nothing to match on here, since a channel name is a string
+        // a client invents rather than a row anyone owns. What guards it is the
+        // channel gate in `realtimeService.authorizeChannelAction`: presence is
+        // readable only to a client that has joined the channel, plus whatever
+        // an installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed —
+        // see `docs/channel-authorization.md` for what it does *not*
+        // yet decide. Revoke the schema-wide grant the driver handed out
+        // before this table existed.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
+
         this.tablesReady = true;
     }
 

package/src/services/collection-helpers.ts

@@ -1,8 +1,9 @@
 import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
+import { getTableColumns } from "drizzle-orm";
 import { CollectionConfig, Property, ResolvedHasMany, ResolvedHasOne } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { getTableName } from "@rebasepro/common";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 
 // Row identity is derived on both sides of the wire — the driver parses an
 // incoming address into key columns, the admin derives one from a served row —
@@ -76,6 +77,58 @@ export function getCollectionByPath(collectionPath: string, registry: PostgresCo
     return collection;
 }
 
+/**
+ * Reject a write naming something that is not a column of the table.
+ *
+ * Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+ * from `Object.keys(tableColumns)`, so a key the table does not carry is not
+ * rejected by anything — it is *left out of the statement*. The insert answers
+ * 201 having stored nothing under that name; the update, if the key was the
+ * only one, builds `update "posts" set  where …` and Postgres raises a syntax
+ * error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+ * 500 for what is a caller's typo.
+ *
+ * That makes this the last honest place to check, and the only one every write
+ * passes through. `assertKnownWriteFields` in the REST layer checks the same
+ * thing against the *config* and is skipped on four paths — `strictWrites:
+ * false`, a collection declaring no properties, an auth adapter that owns the
+ * body's shape, and a nested route whose target cannot be walked — and it never
+ * sees an in-process `rebase.data` write at all.
+ *
+ * It also gives `strictWrites: false` a truthful implementation. The flag is
+ * documented for "a column that really does exist which the config never
+ * declared", and skipping the config check alone could not deliver that: the
+ * value was dropped a layer later regardless. Skipping the config check and
+ * keeping this one does exactly what the flag says — the column must exist,
+ * the property need not.
+ */
+export function assertWritableColumns(
+    values: Record<string, unknown>,
+    table: PgTable,
+    collectionPath: string
+): void {
+    // Only a real Drizzle table carries a column list. A stand-in that does not
+    // (a test double, a registry entry built by hand) has nothing to check
+    // against, and inventing an answer from its own keys would reject writes
+    // over the shape of the double rather than the shape of the table.
+    const columns = getTableColumns(table) as Record<string, unknown> | undefined;
+    if (!columns || Object.keys(columns).length === 0) return;
+
+    const unknown = Object.keys(values).filter(key => !(key in columns));
+    if (unknown.length === 0) return;
+
+    // The offending keys, and deliberately not the list of real ones: this
+    // error is reachable on paths where the REST field check was skipped, and
+    // an `excludeFromApi` column is documented as never being served to a
+    // caller. Naming what was sent is the actionable half anyway.
+    throw ApiError.badRequest(
+        `'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ` +
+        `${unknown.map(key => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} ` +
+        "would have been dropped before the statement was built.",
+        "VALIDATION_UNKNOWN_FIELDS"
+    );
+}
+
 export function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any> {
     const tableName = getTableName(collection);
     const table = registry.getTable(tableName);

package/src/services/dataService.ts

@@ -60,6 +60,8 @@ export class DataService implements DataRepository {
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
@@ -81,10 +83,13 @@ export class DataService implements DataRepository {
         searchString: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
             databaseId?: string;
+            searchExplain?: boolean;
         } = {}
     ): Promise<Record<string, unknown>[]> {
         return this.fetchService.searchRows<M>(collectionPath, searchString, options);