@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g18cfeb7

package/src/schema/non-sql-collections.test.ts

@@ -0,0 +1,131 @@
+/**
+ * A collection served by another engine is not this engine's to provision.
+ *
+ * Firestore and MongoDB collections are declared in the same
+ * `config/collections` directory as the Postgres ones — that is what
+ * `dataSource` routing is for — and every stage of the SQL toolchain used to
+ * read "the collections" as all of them. So a Firestore collection got a
+ * `pgTable` in the generated schema, a `CREATE TABLE` at boot, RLS policies,
+ * and an entry in the `db push` include list, while the app went on reading its
+ * documents from Firestore.
+ *
+ * The include list is the one that can lose data: a name on it is a name Atlas
+ * is *allowed to drop*, so a Firestore collection called `exercises` removed a
+ * real, unrelated `public.exercises` table's protection from the next
+ * auto-approved `db push`.
+ */
+import { describe, expect, it } from "@jest/globals";
+import type { CollectionConfig } from "@rebasepro/types";
+
+import { generateSchema } from "./generate-drizzle-schema-logic";
+import {
+    generatePostgresDdl,
+    generatePostgresPoliciesDdl,
+    planCollectionPolicies
+} from "./generate-postgres-ddl-logic";
+import { planCollectionSchemaEnsure, type ExistingSchema } from "./ensure-collection-tables";
+import { getTableIncludesFromCollections } from "../cli-helpers";
+
+const sqlCollection = {
+    name: "Customers",
+    slug: "customers",
+    properties: {
+        id: { name: "ID", type: "string", isId: "uuid" },
+        email: { name: "Email", type: "string" }
+    },
+    securityRules: [{ operation: "read", policy: "true" }]
+} as unknown as CollectionConfig;
+
+const firestoreCollection = {
+    name: "Exercises",
+    slug: "exercises",
+    engine: "firestore",
+    dataSource: "firestore",
+    properties: {
+        id: { name: "ID", type: "string" },
+        title: { name: "Title", type: "string" },
+        difficulty: {
+            name: "Difficulty",
+            type: "string",
+            enum: [{ id: "easy", label: "Easy" }, { id: "hard", label: "Hard" }]
+        }
+    }
+} as unknown as CollectionConfig;
+
+const mongoCollection = {
+    name: "Events",
+    slug: "events",
+    engine: "mongodb",
+    properties: { id: { name: "ID", type: "string" } }
+} as unknown as CollectionConfig;
+
+/** Routed by `dataSource` alone — no `engine` field to read. */
+const dataSourceOnlyCollection = {
+    name: "Articles",
+    slug: "articles",
+    dataSource: "firestore",
+    properties: { id: { name: "ID", type: "string" } }
+} as unknown as CollectionConfig;
+
+const all = [sqlCollection, firestoreCollection, mongoCollection, dataSourceOnlyCollection];
+
+describe("the Drizzle schema generator", () => {
+    it("emits a table for the Postgres collection only", async () => {
+        const schema = await generateSchema(all);
+
+        expect(schema).toContain("customers");
+        expect(schema).not.toContain("exercises");
+        expect(schema).not.toContain("events");
+        expect(schema).not.toContain("articles");
+    });
+
+    it("does not emit enum types for a document store's fields", async () => {
+        const schema = await generateSchema(all);
+        expect(schema).not.toContain("difficulty");
+    });
+});
+
+describe("the Postgres DDL generator", () => {
+    it("creates no table for a non-SQL collection", async () => {
+        const ddl = await generatePostgresDdl(all, { includePolicies: false });
+
+        expect(ddl).toContain('CREATE TABLE "public"."customers"');
+        expect(ddl).not.toContain("exercises");
+        expect(ddl).not.toContain("events");
+    });
+
+    it("plans no RLS for a store that has none", () => {
+        const policies = generatePostgresPoliciesDdl(all);
+        expect(policies).not.toContain("exercises");
+
+        const plans = planCollectionPolicies(all);
+        expect(plans.map(p => p.qualified)).toEqual(["public.customers"]);
+    });
+});
+
+describe("the boot-time schema ensure", () => {
+    const empty = (): ExistingSchema => ({ tables: new Map(), enums: new Set() });
+
+    it("creates nothing for collections another engine stores", () => {
+        const plan = planCollectionSchemaEnsure(all, empty());
+
+        expect(plan.actions.map(a => a.target)).toEqual(
+            expect.arrayContaining(["public.customers"])
+        );
+        for (const action of plan.actions) {
+            expect(action.target).not.toContain("exercises");
+            expect(action.target).not.toContain("events");
+            expect(action.target).not.toContain("articles");
+        }
+    });
+});
+
+describe("the db push include list", () => {
+    it("does not claim a table for a Firestore collection", async () => {
+        // Anything absent from this list is *excluded* from the declarative
+        // apply, which is what protects it from being dropped.
+        const includes = await getTableIncludesFromCollections(all);
+
+        expect(includes).toEqual(["public.customers"]);
+    });
+});

package/src/schema/rls-bootstrap-sql.ts

@@ -0,0 +1,288 @@
+import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
+
+/**
+ * Canonical SQL bootstrap for the RLS helper functions.
+ *
+ * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /
+ * `rebase.jwt()`, so any SQL stream that can contain policies must be
+ * self-contained: it has to (re)create these helpers first. This matters for
+ * the migration directory in particular — Atlas replays migrations against a
+ * clean dev database where no out-of-band bootstrap has ever run, so a
+ * migration carrying policies without this preamble fails with
+ * "function rebase.uid() does not exist".
+ *
+ * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
+ * policies block and re-applied freely. The runtime boot path
+ * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
+ * for HMR-safety; keep the definitions in sync.
+ *
+ * ## Creating the `rebase` schema here is now safe, and required
+ *
+ * It deliberately did not, once. These functions lived in a schema called
+ * `auth`, and the note here read: creating `rebase` would leak it into Atlas's
+ * replayed migration state, and — absent from the desired `schema.sql` — Atlas
+ * would then plan `DROP SCHEMA "rebase" CASCADE`, taking the auth tables with
+ * it. That reasoning still holds; what changed is the second half of it. The
+ * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS "rebase"`
+ * unconditionally, so the schema is always in the desired state and the diff is
+ * empty. (It used to appear only when some collection happened to declare
+ * `schema: "rebase"` — true for the scaffold's users collection, and not a
+ * property anything guaranteed.) `db push` additionally excludes the whole
+ * schema from the declarative apply.
+ *
+ * See `@rebasepro/types`' `rls-functions` for why the functions moved out of
+ * `auth` at all: the short version is that the name was Supabase's, and
+ * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over
+ * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be
+ * swallowed.
+ */
+/**
+ * The bootstrap as individual statements.
+ *
+ * Kept as an array because the two consumers need different shapes and only one
+ * of them can take a multi-command string: the migration preamble is written to
+ * a file and replayed by Atlas, but the boot path runs through drizzle, whose
+ * node-postgres handle speaks the extended query protocol and rejects more than
+ * one command per call. Splitting a joined string back apart on `$$;` would be
+ * a parser for a problem that does not need one.
+ */
+export const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [
+    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,
+
+    // Falls back to the pre-rename `app.user_id` so a database that has taken
+    // the new schema but is still served by an older backend keeps resolving
+    // the principal. Drop the COALESCE once no such deployment remains.
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
+$$ LANGUAGE sql STABLE`,
+
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.jwt', true), ''),
+        '{}'
+    )::jsonb;
+$$ LANGUAGE sql STABLE`,
+
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+$$ LANGUAGE sql STABLE`
+];
+
+/** The same statements as one script, for migration files and raw clients. */
+export const RLS_BOOTSTRAP_SQL =
+    "-- Rebase schema + RLS helper functions (required by the policies below)\n" +
+    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join("\n\n") + "\n";
+
+/**
+ * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
+ *
+ * ## Why this is safe against a Supabase database
+ *
+ * Two independent guards, and both have to pass:
+ *
+ *  1. **Each function is identified before it is dropped.** Ours returns `text`
+ *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
+ *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
+ *     so a Supabase database — where our `CREATE OR REPLACE` could never have
+ *     succeeded in the first place, Postgres refusing to change a return type —
+ *     matches nothing and this is a no-op.
+ *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
+ *     lives in `auth` (Supabase's `users` table, its other helpers), the drop
+ *     fails and the schema stays. CASCADE here would be unrecoverable.
+ *
+ * ## Why it cannot run too early
+ *
+ * Postgres records a dependency from every RLS policy to the functions its body
+ * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy
+ * still references it. That is the interlock, and it is load-bearing: the drop
+ * can only succeed once every policy has been recompiled to \`rebase.uid()\`.
+ * Callers therefore run this *after* applying policies, and treat a failure as
+ * "not yet — try again next boot" rather than as an error.
+ */
+export const DROP_LEGACY_AUTH_SCHEMA_SQL = `
+DO $rebase_drop_legacy$
+DECLARE
+    dropped_any boolean := false;
+BEGIN
+    -- Each function is matched on its own result type and body, so a schema
+    -- that merely shares the name keeps everything it has.
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.uid%'
+    ) THEN
+        DROP FUNCTION auth.uid();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
+          AND pg_get_function_result(p.oid) = 'jsonb'
+          AND p.prosrc LIKE '%app.jwt%'
+    ) THEN
+        DROP FUNCTION auth.jwt();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'roles'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.user_roles%'
+    ) THEN
+        DROP FUNCTION auth.roles();
+        dropped_any := true;
+    END IF;
+
+    -- RESTRICT: only an empty schema goes. Anything else in there — including a
+    -- Supabase installation left untouched above — keeps it.
+    IF dropped_any THEN
+        BEGIN
+            EXECUTE 'DROP SCHEMA auth RESTRICT';
+        EXCEPTION WHEN OTHERS THEN
+            NULL;
+        END;
+    END IF;
+END
+$rebase_drop_legacy$;
+`;
+
+/** Somebody's policy that still calls a pre-1.0 helper. */
+export interface LegacyRlsDependent {
+    schema: string;
+    table: string;
+    policy: string;
+}
+
+/**
+ * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+ *
+ * Postgres will not drop a function a policy depends on, so this is exactly the
+ * set standing between a database and losing the legacy schema. Rebase's own
+ * policies leave the list on the next push or boot, when they are recompiled —
+ * anything still here afterwards is hand-written, will never be recompiled by
+ * anybody, and is the reason the drop keeps being skipped. Silence there would
+ * leave an operator staring at a schema the release notes said would go.
+ */
+export const LEGACY_RLS_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, c.relname AS "table", p.polname AS policy
+    FROM pg_policy p
+    JOIN pg_class c ON c.oid = p.polrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2, 3
+`;
+
+/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */
+export interface LegacyRlsFunctionDependent {
+    schema: string;
+    function: string;
+}
+
+/**
+ * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+ *
+ * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it
+ * needs its own query. Postgres records a dependency for a *policy* that calls a
+ * function, which is why the drop is safe against the policies above — but a
+ * `LANGUAGE sql` function whose body is a **string literal** is not parsed when
+ * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.
+ * The drop succeeds and the caller is left pointing at a function that no longer
+ * exists, which fails at *query* time rather than at boot.
+ *
+ * A downstream project building on these helpers is not hypothetical: the Rebase
+ * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+ * in this very schema, each calling `auth.uid()` in a string body, and eleven of
+ * its row-level-security policies go through them. Every one of those would have
+ * started failing the first time a recompile left no policy referencing
+ * `auth.uid()` directly — the drop's own precondition.
+ *
+ * Matching on the body text is the only option available, and it is deliberately
+ * broad: a false positive costs a schema that stays one release longer and says
+ * why, while a false negative costs somebody their policies.
+ */
+export const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, p.proname AS function
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))
+      AND p.prosrc ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2
+`;
+
+/**
+ * Retire the pre-1.0 `auth` schema, reporting what is holding it back.
+ *
+ * The shared implementation behind the CLI's post-push step and the runtime's
+ * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}
+ * and swallow whatever came back, which is right for the ordinary case — a
+ * table not recompiled *yet* — and wrong for the one that never resolves: a
+ * hand-written policy nothing will ever rewrite. Then the schema stays forever
+ * and nothing ever says why.
+ */
+export async function dropLegacyAuthSchema(
+    run: (sql: string) => Promise<Record<string, unknown>[]>,
+    report: { info: (m: string) => void; warn: (m: string) => void }
+): Promise<void> {
+    let blockers: LegacyRlsDependent[];
+    try {
+        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];
+    } catch {
+        return; // No catalogue access; nothing here is worth failing a boot for.
+    }
+
+    if (blockers.length > 0) {
+        report.warn(
+            `The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${blockers.length} ` +
+            `${blockers.length === 1 ? "policy still calls" : "policies still call"} ` +
+            `\`${LEGACY_RLS_SCHEMA}.uid()\` and friends, and Postgres will not drop a function a policy ` +
+            `depends on. Rebase's own policies are ` +
+            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +
+            `\`${REBASE_SCHEMA}.uid()\` by hand, after which the schema goes on its own:\n` +
+            blockers.map(b => `  • ${b.schema}.${b.table} → "${b.policy}"`).join("\n")
+        );
+        return;
+    }
+
+    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:
+    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops
+    // out from under a caller that is still using it and nothing complains until
+    // a query runs.
+    let borrowers: LegacyRlsFunctionDependent[];
+    try {
+        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];
+    } catch {
+        return;
+    }
+
+    if (borrowers.length > 0) {
+        report.warn(
+            `The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ` +
+            `${borrowers.length === 1 ? "function calls" : "functions call"} ` +
+            `\`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency ` +
+            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +
+            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +
+            `than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` +
+            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join("\n")
+        );
+        return;
+    }
+
+    try {
+        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
+    } catch (err) {
+        // Something else depends on it, or the connection does not own it.
+        // Not fatal: the schema is inert either way now that no policy calls it.
+        report.info(
+            `Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` +
+            (err instanceof Error ? err.message : String(err))
+        );
+    }
+}

package/src/security/anonymous-grants.test.ts

@@ -29,7 +29,9 @@ describe("warnOnAnonymousGrants", () => {
     it("reports both mistakes in the rule from the wild", () => {
         const warning = captureWarning(() => warnOnAnonymousGrants([collectionWith("talents", FROM_THE_WILD)]));
 
-        expect(warning).toContain("auth.uid() IS NOT NULL");
+        // The rule is written in the pre-1.0 spelling and must still be
+        // detected; the advice is printed in the current one.
+        expect(warning).toContain("rebase.uid() IS NOT NULL");
         expect(warning).toContain("'anon' is a Supabase convention");
         expect(warning).toContain("policy.authenticated()");
     });
@@ -51,7 +53,7 @@ describe("warnOnAnonymousGrants", () => {
     it("catches the bare tautology, which carries no literal to notice", () => {
         const warning = captureWarning(() => warnOnAnonymousGrants([collectionWith("talents", "auth.uid() IS NOT NULL")]));
 
-        expect(warning).toContain("auth.uid() IS NOT NULL");
+        expect(warning).toContain("rebase.uid() IS NOT NULL");
         expect(warning).not.toContain("Supabase convention");
     });
 

package/src/security/rls-enforcement.ts

@@ -1,6 +1,13 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
 import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
-import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
+import {
+    AnonymousGrantRisk,
+    findAnonymousGrants,
+    REBASE_USER_ROLE,
+    revokeInternalTableAccess,
+    securityRuleToConditions
+} from "@rebasepro/common";
+import { REBASE_SCHEMA, usesLegacyRlsFunctions } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -36,8 +43,14 @@ import { logger } from "@rebasepro/server";
  * not an operator opt-in.
  */
 
-/** The restricted role every authenticated (user-context) request runs as. */
-export const REBASE_USER_ROLE = "rebase_user";
+/**
+ * The restricted role every authenticated (user-context) request runs as.
+ *
+ * Re-exported, not re-declared: the same name is needed by
+ * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name
+ * fail as a silent no-op rather than an error.
+ */
+export { REBASE_USER_ROLE };
 
 /** Minimal SQL runner so callers can adapt drizzle or pg.Client. */
 export type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;
@@ -69,6 +82,57 @@ const quoteIdent = (name: string): string => `"${name.replace(/"/g, "\"\"")}"`;
 /** DML the user role holds on managed tables (RLS still filters per row). */
 const USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 
+/**
+ * Warn when the connection role shares its name with an existing schema.
+ *
+ * Postgres resolves unqualified names through `search_path`, which defaults to
+ * `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+ * name exists it sits ahead of `public`, so every unqualified statement
+ * silently operates on it instead:
+ *
+ *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+ *
+ * Nothing errors. You get a second table of the same name in the wrong schema,
+ * and reads that pin `public` cannot see it — which reads as "missing table" and
+ * sends people to re-run a push that creates a *third* copy. The bootstrapper
+ * has a whole branch dedicated to recognising the symptom after the fact.
+ *
+ * Rebase shipped straight into this: it creates a schema named `rebase` while
+ * every template named the database role `rebase` too. The scaffold uses
+ * `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+ * (`pinSearchPath`), which covers the paths the framework controls. This covers
+ * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+ * a hand-written migration — because the hazard is a property of the two NAMES,
+ * not of any one connection.
+ *
+ * A warning rather than a boot failure: the database works, the framework's own
+ * traffic is pinned, and refusing to start over a naming choice a user may have
+ * inherited would be worse than the risk.
+ */
+export async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {
+    try {
+        const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+        if (rows[0]?.collides !== true) return;
+        const role = String(rows[0]?.role ?? "the connection role");
+        logger.warn(
+            `⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified ` +
+            `names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched ` +
+            `BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the ` +
+            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. ` +
+            `Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the ` +
+            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +
+            `"rebase_app".`
+        );
+    } catch {
+        // A diagnostic must never be the reason a boot fails.
+    }
+}
+
 export async function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture> {
     const rows = await run(`
         SELECT current_user            AS role,
@@ -180,6 +244,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
         // migrations), so a migrate can never strand the user role.
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+
+        // The grants above are deliberately schema-wide — a project's own
+        // collections may live in `rebase`, and future tables must be reachable
+        // or a migration strands the role. Rebase's OWN tables are the exception:
+        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no
+        // row an end user should ever address. Taking the privilege back here
+        // covers every table that already exists; each creator revokes on the
+        // table it just made, for the boot that creates them for the first time.
+        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {
+            onError: (table, error) => logger.warn(
+                `🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — ` +
+                "it stays reachable by authenticated requests: " +
+                (error instanceof Error ? error.message : String(error))
+            )
+        });
     }
 
     logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
@@ -293,6 +372,65 @@ export function warnOnAnonymousGrants(
     );
 }
 
+/**
+ * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+ *
+ * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+ * database, so nothing is broken and no policy is wrong — which is exactly why
+ * this has to be said out loud. A silent rewrite that works forever is not a
+ * migration, it is a second supported spelling nobody wrote down, and the next
+ * person to read those rules will copy the old one.
+ *
+ * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+ * `policy.rolesOverlap(...)`) compile from the model and were never affected.
+ */
+export function warnOnLegacyRlsFunctions(
+    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
+): void {
+    const sites: string[] = [];
+
+    for (const collection of collections) {
+        for (const rule of collection.securityRules ?? []) {
+            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+            const carriesLegacy = [usingExpr, withCheckExpr]
+                .filter((e): e is PolicyExpression => e !== null)
+                .some(containsLegacyRlsCall);
+            if (!carriesLegacy) continue;
+
+            const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+            if (!sites.includes(site)) sites.push(site);
+        }
+    }
+
+    if (sites.length === 0) return;
+
+    logger.warn(
+        `These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). ` +
+        `They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, ` +
+        `and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` ` +
+        `and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), ` +
+        `which never had to be spelled by hand:\n\n` +
+        sites.map(s => `  • ${s}`).join("\n") + "\n"
+    );
+}
+
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr: PolicyExpression): boolean {
+    switch (expr.kind) {
+        case "raw":
+            return usesLegacyRlsFunctions(expr.sql);
+        case "and":
+        case "or":
+            return expr.operands.some(containsLegacyRlsCall);
+        case "not":
+            return containsLegacyRlsCall(expr.operand);
+        case "existsIn":
+            return containsLegacyRlsCall(expr.where);
+        default:
+            return false;
+    }
+}
+
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/src/services/BranchService.ts

@@ -9,6 +9,7 @@
 
 import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
+import { revokeInternalTableSql } from "@rebasepro/common";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
 import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
@@ -124,6 +125,10 @@ export class BranchService {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+
+        // Not a collection, so no RLS — and it names every branch database on
+        // this server. The driver's schema-wide grant reaches it, so revoke.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
     }
 
     /**