@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g1822133

package/src/PostgresBootstrapper.ts

@@ -37,7 +37,7 @@ import { ensureHistoryTableExists } from "./history/ensure-history-table";
 import { patchPgArrayNullSafety } from "./utils/pg-array-null-patch";
 import { buildCollectionsFromSchema, introspectSchema, readRlsStatus } from "./schema/introspect-runtime";
 import { buildDrizzleTablesFromSchema, buildDrizzleRelationsFromSchema } from "./schema/dynamic-tables";
-import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
+import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, warnOnLegacyRlsFunctions, warnOnRoleSchemaCollision, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
 import { provisionTriggerCdc, type CdcTableRef } from "./services/cdc/trigger-cdc";
 import { collectJunctionLinks } from "./services/cdc/junction-tables";
 import { createChannelBus, resolveChannelBusSetting } from "./services/channel-bus";
@@ -137,6 +137,50 @@ export function resolveDriftCheckName(
         ?? col.slug;
 }
 
+/**
+ * Is this the local database `rebase init` scaffolds — i.e. the one case where
+ * "you are connected as a superuser" is not news?
+ *
+ * The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+ * which makes that role the cluster superuser, so the superuser advisory below
+ * was the only WARN a brand-new project ever saw and it was about a decision
+ * the tool had made for the developer.
+ *
+ * Of the two available fixes — provision a non-superuser table-owner role in
+ * the scaffold, or recognise the local shape and stay quiet — this is the
+ * second, because the first breaks the scaffold it is meant to improve: a
+ * non-superuser owner cannot `CREATE EXTENSION` (search collections need
+ * `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+ * schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+ * with a search block would fail. Trading a working first run for a quieter log
+ * line is the wrong trade.
+ *
+ * The condition is deliberately narrow — a *non-production* process talking to
+ * a database on the loopback interface. A genuine production superuser
+ * connection still warns, and so does a non-production process pointed at a
+ * remote database (the usual "my dev machine writes to staging" mistake, where
+ * the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+ * ships `NODE_ENV=development` and some deployments inherit it.
+ */
+export function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean {
+    if (process.env.NODE_ENV === "production") return false;
+    if (!connectionString) return false;
+    let host: string;
+    try {
+        host = new URL(connectionString).hostname;
+    } catch {
+        return false;
+    }
+    // `new URL` keeps IPv6 literals in brackets.
+    const bare = host.replace(/^\[|\]$/g, "").toLowerCase();
+    return bare === "localhost"
+        || bare === "::1"
+        || bare === "0.0.0.0"
+        || bare === ""
+        || /^127\./.test(bare)
+        || bare.endsWith(".localhost");
+}
+
 /**
  * Default PostgreSQL bootstrapper.
  *
@@ -364,29 +408,46 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             // bypasses RLS. Detect the posture and, when privileged, provision
             // the restricted `rebase_user` role and route authenticated
             // requests (reads AND writes) through it. The server context (base
-            // driver / dataAsAdmin / auth flows) stays on the owner connection
-            // and bypasses. Default-on: a privileged connection that cannot be
+            // driver / auth flows / `rebase.sql`) stays on the owner connection
+            // and bypasses; `rebase.dataAsAdmin` does NOT — it is scoped with
+            // `withAuth({ uid: "service", roles: ["admin"] })` at boot, so it
+            // runs as `rebase_user` and its policies are evaluated.
+            // Default-on: a privileged connection that cannot be
             // isolated fails the boot rather than serving unenforced requests.
             {
                 const runSql: RawSqlRunner = async (text) => {
                     const res = await schemaAwareDb.execute(sql.raw(text));
                     return (res.rows ?? []) as Record<string, unknown>[];
                 };
+                // Said before anything else touches the schema: if the role and
+                // a schema share a name, unqualified SQL from any tool that does
+                // not pin `search_path` has been landing in the wrong place, and
+                // that is worth knowing before reading the drift report below.
+                await warnOnRoleSchemaCollision(runSql);
+
                 const posture = await detectConnectionPosture(runSql);
                 if (posture.privileged) {
                     const collectionSchemas = registry.getCollections()
                         .map((c) => (c as { schema?: string }).schema)
                         .filter((s): s is string => typeof s === "string");
-                    await ensureAppRole(runSql, ["public", "rebase", "auth", ...collectionSchemas]);
+                    // `auth` is deliberately absent: the RLS helpers moved into
+                    // `rebase`, and granting USAGE on a schema Rebase does not
+                    // own would, on a Supabase database, hand the end-user role
+                    // access to theirs.
+                    await ensureAppRole(runSql, ["public", "rebase", ...collectionSchemas]);
                     driver.rlsUserRole = REBASE_USER_ROLE;
                     realtimeService.rlsUserRole = REBASE_USER_ROLE;
                     logger.info(`🔐 RLS enforcement active: authenticated requests run as "${REBASE_USER_ROLE}" (connection "${posture.role}" bypasses RLS: ${posture.superuser ? "superuser" : posture.bypassRLS ? "BYPASSRLS" : "table owner"})`);
                     if (posture.superuser || posture.bypassRLS) {
-                        logger.warn(
-                            `⚠️ The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). ` +
+                        const message =
+                            `The database connection runs as ${posture.superuser ? "a superuser" : "a BYPASSRLS role"} ("${posture.role}"). ` +
                             `User requests are isolated via SET LOCAL ROLE, but connect as a non-superuser ` +
-                            `table-owner role in production so the server/owner context is least-privilege.`
-                        );
+                            `table-owner role in production so the server/owner context is least-privilege.`;
+                        if (isScaffoldedLocalDatabase(pgConfig.connectionString)) {
+                            logger.debug(`🔐 ${message}`);
+                        } else {
+                            logger.warn(`⚠️ ${message}`);
+                        }
                     }
                 } else {
                     logger.info(`🔐 RLS enforcement: connection role "${posture.role}" is subject to RLS natively; no role switch needed.`);
@@ -406,6 +467,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                 // a rule that reads as "signed in only" but is true for every
                 // caller grants the data away rather than hiding it.
                 warnOnAnonymousGrants(registry.getCollections() as never);
+
+                // Raw policy SQL written against the pre-1.0 helper schema. It
+                // is rewritten on compile, so this is the only place the project
+                // is ever told the spelling moved.
+                warnOnLegacyRlsFunctions(registry.getCollections() as never);
             }
 
             // Ensure branch metadata table exists when branching is available
@@ -820,8 +886,15 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
             );
             for (const failure of plan.failures) {
                 logger.warn(
-                    `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the ` +
-                    `collection still serves, but rows are not policed by this constraint: ${failure.error}`
+                    failure.kind === "comment-column"
+                        // The stamp records which `search` block the generated
+                        // column was built from. Without it the next boot cannot
+                        // tell a changed block from an unchanged one and adopts
+                        // the column again instead of refusing.
+                        ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, ` +
+                          `but a later change to the \`search\` block will not be detected: ${failure.error}`
+                        : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the ` +
+                          `collection still serves, but rows are not policed by this constraint: ${failure.error}`
                 );
             }
             return { applied: plan.actions.length - plan.failures.length };
@@ -867,9 +940,61 @@ schemaHealthCheck: () => probeAuthSchema(db, resolveAuthSchema(authCollection))
             }
             for (const failure of outcome.failures) {
                 logger.warn(
-                    `🔐 [rls] Could not fully apply policies to "${failure.table}" — it stays locked (denies) until this is resolved: ${failure.error}`
+                    `🔐 [rls] Could not fully apply policies to "${failure.table}" — RLS is on, so it denies until this is resolved: ${failure.error}`
                 );
             }
+
+            // RLS could not be turned on at all. The schema-wide grant to the
+            // user role has already run by this point, so without the revoke
+            // below the table is readable and writable by every authenticated
+            // request with no row filtering — the one state this boot path must
+            // never leave behind, and the one it used to describe as "locked".
+            const unrevoked = outcome.unsecured.filter(u => !u.grantWithdrawn);
+            for (const u of outcome.unsecured.filter(u => u.grantWithdrawn)) {
+                logger.error(
+                    `🔐 [rls] Could not enable row-level security on "${u.table}": ${u.error}. ` +
+                    `Its privileges have been revoked from ${REBASE_USER_ROLE}, so the table is ` +
+                    "unreachable rather than unprotected. Reads and writes to that collection will " +
+                    "fail until RLS can be enabled."
+                );
+            }
+            if (unrevoked.length > 0) {
+                // Neither securable nor closable. Serving here would mean
+                // handing every authenticated caller unfiltered access, so the
+                // boot fails instead — this is the one failure that is not
+                // survivable per-table.
+                throw new Error(
+                    "Refusing to start: row-level security could not be enabled on " +
+                    unrevoked.map(u => `"${u.table}" (${u.error})`).join(", ") +
+                    `, and the privileges granted to ${REBASE_USER_ROLE} could not be revoked either. ` +
+                    "The table would be served with no row filtering. Fix the database permissions " +
+                    "(the connection role must own these tables, or be able to ALTER them) and boot again."
+                );
+            }
+
+            // Retire the pre-1.0 `auth` schema now that the policies above no
+            // longer call into it. Deliberately after, and deliberately quiet:
+            // Postgres refuses to drop a function an RLS policy still
+            // references, so on a database where some table has not been
+            // recompiled yet this is expected to fail and succeed on a later
+            // boot. See DROP_LEGACY_AUTH_SCHEMA_SQL for the guards that keep it
+            // off a Supabase `auth` schema.
+            try {
+                const { dropLegacyAuthSchema } = await import("./schema/rls-bootstrap-sql");
+                await dropLegacyAuthSchema(
+                    async (text) => {
+                        const res = await internals.db.execute(sql.raw(text));
+                        return (res.rows ?? []) as Record<string, unknown>[];
+                    },
+                    { info: (m) => logger.info(m), warn: (m) => logger.warn(m) }
+                );
+            } catch (err) {
+                logger.info(
+                    "Left the legacy `auth` schema in place: " +
+                    (err instanceof Error ? err.message : String(err))
+                );
+            }
+
             return { applied: outcome.policiesApplied };
         },