@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g249daa1

package/src/collections/validate-relations.ts

@@ -2,6 +2,7 @@ import { getTableColumns } from "drizzle-orm";
 import { PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, ResolvedRelation } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations } from "@rebasepro/common";
+import { generateForeignKeyName, legacyForeignKeyName } from "@rebasepro/utils";
 
 import { PostgresCollectionRegistry } from "./PostgresCollectionRegistry";
 
@@ -58,6 +59,68 @@ const quote = (xs: Iterable<string>) => Array.from(xs).map(s => `\`${s}\``).join
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 const asColumns = (value: string | string[]): string[] => Array.isArray(value) ? value : [value];
 
+/**
+ * Distinguish "this column name is wrong" from "the generated schema is old".
+ *
+ * They present identically here — a relation asks for a column the registered
+ * table does not have — but they are opposite problems with opposite fixes, and
+ * getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
+ * projects.
+ *
+ * The registered table is not the database. It comes from the project's
+ * checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
+ * derives foreign-key names: `categories` yields `category_id` where it used to
+ * yield `categorie_id`. Boot-ensure renames the database column to match, so by
+ * the time this runs the *database* is correct and the *generated module* is the
+ * stale one. Reporting "not a column" then points at the wrong artifact, and the
+ * generic fix — "set `through.targetColumn` to one of: …", listing the legacy
+ * name because that is what the stale module still has — talks the reader into
+ * pinning a column that no longer exists.
+ *
+ * So when the wanted name is what the current rule derives, and the table
+ * carries what the *previous* rule would have derived from the same source, say
+ * that instead.
+ *
+ * @param wanted   the column the relation asks for
+ * @param available every column the registered table has
+ * @param sources  names the default could have been derived from (a slug, a
+ *                 relation name) — checking against these rather than guessing
+ *                 backwards from `wanted` keeps the match exact
+ */
+function staleCodegenRename(
+    wanted: string,
+    available: Set<string>,
+    sources: string[]
+): { legacy: string; current: string } | null {
+    for (const source of sources) {
+        if (!source) continue;
+        const current = generateForeignKeyName(source);
+        const legacy = legacyForeignKeyName(source);
+        // Only a name that actually moved, and only when the table still has the
+        // old spelling and not the new one.
+        if (current !== wanted || legacy === current) continue;
+        if (available.has(legacy) && !available.has(current)) return { legacy, current };
+    }
+    return null;
+}
+
+/** The shared explanation, so every relation kind reports it identically. */
+function staleCodegenDefect(
+    table: string,
+    { legacy, current }: { legacy: string; current: string }
+): Pick<RelationDefect, "problem" | "fix"> {
+    return {
+        problem:
+            `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this ` +
+            `release derives \`${current}\` — the generated schema predates the foreign-key ` +
+            "naming fix and no longer describes the database",
+        fix:
+            "regenerate it with `rebase schema generate` (or `pnpm run schema:generate`). The " +
+            "database column has already been renamed for you at boot, so nothing else is needed. " +
+            `To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+    };
+}
+
 /**
  * Relations whose names do not resolve against the registered schema.
  *
@@ -117,11 +180,20 @@ kind: relation.kind };
             switch (relation.kind) {
                 case "belongsTo": {
                     if (!sourceColumns.has(relation.localKey)) {
-                        defects.push({
-                            ...at,
-                            problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-                            fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
-                        });
+                        // `localKey` defaults to the relation name run through
+                        // the foreign-key rule, so it moves with that rule.
+                        const stale = staleCodegenRename(
+                            relation.localKey,
+                            sourceColumns,
+                            [relation.relationName, targetCollection.slug]
+                        );
+                        defects.push(stale
+                            ? { ...at, ...staleCodegenDefect(sourceTableName, stale) }
+                            : {
+                                ...at,
+                                problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+                                fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+                            });
                     }
                     break;
                 }
@@ -129,11 +201,20 @@ kind: relation.kind };
                 case "hasOne":
                 case "hasMany": {
                     if (!targetColumns.has(relation.foreignKeyOnTarget)) {
-                        defects.push({
-                            ...at,
-                            problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-                            fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
-                        });
+                        // The default is derived from *this* collection's slug —
+                        // the column on the target that points back here.
+                        const stale = staleCodegenRename(
+                            relation.foreignKeyOnTarget,
+                            targetColumns,
+                            [collection.slug]
+                        );
+                        defects.push(stale
+                            ? { ...at, ...staleCodegenDefect(targetTableName, stale) }
+                            : {
+                                ...at,
+                                problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+                                fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+                            });
                     }
                     // `sourceKey` is the easiest of the two to put on the wrong
                     // side — it is the only column in a `hasMany` that lives
@@ -167,14 +248,24 @@ kind: relation.kind };
                         break;
                     }
                     const junctionColumns = columnNames(junction);
+                    // Junction columns are the ones that actually moved in 0.13:
+                    // each defaults to its endpoint collection's *slug* run
+                    // through the foreign-key rule, and slugs are plural.
+                    const derivedFrom = {
+                        sourceColumn: [collection.slug],
+                        targetColumn: [targetCollection.slug]
+                    } as const;
                     for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]] as const) {
                         if (!junctionColumns.has(column)) {
-                            defects.push({
-                                ...at,
-                                problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-                                fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` +
-                                    (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
-                            });
+                            const stale = staleCodegenRename(column, junctionColumns, [...derivedFrom[label]]);
+                            defects.push(stale
+                                ? { ...at, ...staleCodegenDefect(table, stale) }
+                                : {
+                                    ...at,
+                                    problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+                                    fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` +
+                                        (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+                                });
                         }
                     }
                     break;
@@ -287,9 +378,25 @@ export function assertRelationsResolve(
     );
 
     throw new Error(
-        `${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\n` +
+        `${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against ` +
+        "`backend/src/schema.generated.ts`.\n\n" +
         "Each of these would return no rows at query time rather than reporting an error, " +
         "so they are fatal at boot instead.\n\n" +
+        // This reads the *generated file*, not the database, and the difference
+        // is the whole diagnosis after an upgrade. Boot-ensure renames columns
+        // in the database — a 0.12 → 0.13 upgrade singularises a junction key,
+        // `categorie_id` → `category_id` — and the checked-in file still
+        // declares the old name. The config is then correct and the file is
+        // stale, so the per-defect advice below, which lists the columns this
+        // file has, names a column that no longer exists in the database.
+        // Following it turns a recoverable state into a broken config.
+        //
+        // Hence the ordering: regenerate first, and only then consider that the
+        // collection might be the thing that is wrong.
+        "If the database was migrated recently — an upgrade, a `db push`, a restore — this file is\n" +
+        "probably older than the schema it describes. Regenerate it before changing anything else:\n\n" +
+        "    rebase schema generate\n\n" +
+        "If it is already current, then the collection is what disagrees with it:\n\n" +
         lines.join("\n\n") + "\n"
     );
 }

package/src/data-transformer.ts

@@ -3,6 +3,7 @@ import { AnyPgColumn } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { CollectionConfig, Properties, Property, ResolvedRelation, RelationProperty, Vector, BinaryProperty, hasForeignKeyOnTarget, type ResolvedBelongsTo, type ResolvedForeignKeyOnTarget, type ResolvedVia } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
+import { isPrototypePollutingKey } from "@rebasepro/utils";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { DrizzleConditionBuilder } from "./utils/drizzle-conditions";
 import { getPrimaryKeys, buildCompositeId } from "./services/collection-helpers";
@@ -68,9 +69,15 @@ export function sanitizeAndConvertDates(obj: unknown): unknown {
     if (typeof obj === "object") {
         const newObj: Record<string, unknown> = {};
         for (const key in obj) {
-            if (Object.prototype.hasOwnProperty.call(obj, key)) {
-                newObj[key] = sanitizeAndConvertDates((obj as Record<string, unknown>)[key]);
-            }
+            if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+            // `JSON.parse` creates `__proto__` as an *own* property, so it gets
+            // past the check above — and `newObj[key] = …` then invokes the
+            // prototype setter instead of creating a property. The row's
+            // prototype becomes whatever the request body supplied, so
+            // `row.isAdmin` answers `true` while `Object.keys(row)` shows
+            // nothing of the sort. No column can be reached by these names.
+            if (isPrototypePollutingKey(key)) continue;
+            newObj[key] = sanitizeAndConvertDates((obj as Record<string, unknown>)[key]);
         }
         return newObj;
     }
@@ -126,6 +133,9 @@ joinPathRelationUpdates: [] };
     });
 
     for (const [key, value] of Object.entries(row)) {
+        // Same reasoning as `sanitizeAndConvertDates`: these keys come from the
+        // request body, and no column answers to them.
+        if (isPrototypePollutingKey(key)) continue;
         const property = properties[key as keyof M] as Property;
 
         // Coerce empty strings to null for any field that acts as a foreign key
@@ -675,6 +685,15 @@ export function parsePropertyFromServer(value: unknown, property: Property, coll
  *                       from the result (used by `normalizeDbValues` where
  *                       Drizzle's relational API already hydrates them).
  */
+/**
+ * Keys a query computes and attaches to a row, rather than reads from a column.
+ *
+ * An explicit set rather than a `_` prefix rule: a user's column may perfectly
+ * well be called `_internal`, and passing it through here would put a value on
+ * the row that no property describes and nothing downstream knows how to type.
+ */
+const QUERY_METADATA_KEYS = new Set(["_score", "_distance", "_matches"]);
+
 function normalizeScalarValues<M extends Record<string, unknown>>(
     data: M,
     properties: Properties,
@@ -699,6 +718,15 @@ function normalizeScalarValues<M extends Record<string, unknown>>(
             continue;
         }
 
+        // Query-computed metadata, which by definition is not a column and so
+        // has no property to be found. Dropped here until now — which meant
+        // `_distance` was computed for every vector search on this path and
+        // then discarded before the caller ever saw it.
+        if (QUERY_METADATA_KEYS.has(key)) {
+            result[key] = value;
+            continue;
+        }
+
         const property = properties[key as keyof M] as Property;
         if (!property) continue; // Skip DB columns not defined in properties
 

package/src/history/ensure-history-table.ts

@@ -1,6 +1,7 @@
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /**
  * Auto-create the row history table if it doesn't exist.
@@ -38,6 +39,12 @@ export async function ensureHistoryTableExists(db: NodePgDatabase): Promise<void
             ON rebase.entity_history(table_name, entity_id, updated_at DESC)
         `);
 
+        // Every previous value of every audited row, in one table with no RLS
+        // and no tenant scoping — so a readable copy defeats the row policies on
+        // the tables it shadows. The driver's schema-wide grant reaches it
+        // (created here, after that grant ran), so take it back.
+        await db.execute(sql.raw(revokeInternalTableSql("rebase", "entity_history")));
+
         logger.info("✅ Entity history table ready");
     } catch (error) {
         logger.error("❌ Failed to create row history table", { error: error });

package/src/schema/auth-users-columns.ts

@@ -0,0 +1,131 @@
+/**
+ * The one description of what an auth user table's columns must be.
+ *
+ * ## Why this exists
+ *
+ * Three different code paths create `rebase.users`, and before this module they
+ * disagreed about it:
+ *
+ * | column           | `db push` (generator) | `ensureAuthTablesExist` | `ensureCollectionTables` |
+ * |------------------|-----------------------|-------------------------|--------------------------|
+ * | `email`          | `TEXT UNIQUE NOT NULL`| `TEXT NOT NULL` + CHECK | `TEXT` (nullable)        |
+ * | `roles`          | `TEXT[]`              | `NOT NULL DEFAULT '{}'` | nullable, no default     |
+ * | `email_verified` | `BOOLEAN`             | `NOT NULL DEFAULT FALSE`| nullable                 |
+ * | `created_at`     | `DEFAULT now()`       | `NOT NULL DEFAULT NOW()`| no default               |
+ *
+ * They are all `CREATE TABLE IF NOT EXISTS` / `ADD COLUMN IF NOT EXISTS`, so
+ * whichever ran first decided the table and the other two silently no-op'd.
+ * Boot order therefore chose the constraints: a managed deploy (collection
+ * tables first) got a users table whose `email` was nullable and whose
+ * `email_verified` had no default, while the same project pushed from a
+ * checkout got the strict one. In the same table, `is_anonymous` came out
+ * `NOT NULL DEFAULT false` — because *that* column existed in only one of the
+ * three lists, so its owner's definition won by default.
+ *
+ * A second consequence was drift in the other direction. The scaffold's
+ * `users.ts` describes 12 columns; auth needs 14. `db push` is declarative and
+ * builds its desired state from the collection alone, so the two columns only
+ * auth knows about (`is_anonymous`, `tokens_valid_after`) read as unmanaged
+ * drift, and a push run after the server had booted once planned to DROP them.
+ *
+ * Both problems are the same problem: no single place said what this table is.
+ * This is that place. Every creator asks here first and only then falls back to
+ * the collection's own property definitions, so a column auth owns has one
+ * definition regardless of who gets there first, and a column the developer
+ * added to their users collection still behaves like any other field.
+ *
+ * ## What belongs here
+ *
+ * Only columns the auth services read or write. A developer's own additions to
+ * their users collection (`bio`, `stripe_customer_id`) are ordinary columns and
+ * must NOT be listed — they are generated from the collection like every other
+ * field, and listing them here would freeze a user's schema.
+ *
+ * `id` is deliberately absent: its type comes from the collection's id property
+ * (uuid / increment / text) and each creator already derives it.
+ *
+ * Keep in step with {@link AUTH_SCHEMA_VERSION} when a change here makes an
+ * older runtime unable to work against a migrated table.
+ */
+
+/**
+ * A column auth owns.
+ *
+ * Structured rather than one SQL string because the same facts are needed in
+ * three grammars — a `CREATE TABLE` column list, an `ADD COLUMN IF NOT EXISTS`,
+ * and a pair of `ALTER COLUMN … SET DEFAULT` / `SET NOT NULL` reconciles for a
+ * table that already exists with the wrong shape. Parsing a string back apart
+ * for the third of those is how the copies drifted in the first place.
+ */
+export interface AuthUsersColumn {
+    /** Physical column name. */
+    column: string;
+    /** Postgres type. */
+    type: string;
+    /** Default expression, verbatim, or absent for no default. */
+    default?: string;
+    /** Whether the column is NOT NULL. */
+    notNull?: boolean;
+}
+
+/**
+ * `email` is NOT NULL on purpose, and the anonymous sign-in route depends on it
+ * — it synthesizes `anon_<32 hex>@anonymous.local` rather than inserting NULL.
+ * The 320-char bound (RFC 5321) is a CHECK rather than a `VARCHAR(n)`, added
+ * separately by `ensureAuthTablesExist` so it can be `NOT VALID` on an adopted
+ * table that already holds a longer row.
+ */
+export const AUTH_USERS_COLUMNS: readonly AuthUsersColumn[] = [
+    { column: "email", type: "TEXT", notNull: true },
+    { column: "display_name", type: "TEXT" },
+    { column: "photo_url", type: "TEXT" },
+    { column: "roles", type: "TEXT[]", default: "'{}'", notNull: true },
+    { column: "password_hash", type: "TEXT" },
+    { column: "email_verified", type: "BOOLEAN", default: "FALSE", notNull: true },
+    { column: "email_verification_token", type: "TEXT" },
+    { column: "email_verification_sent_at", type: "TIMESTAMP WITH TIME ZONE" },
+    { column: "is_anonymous", type: "BOOLEAN", default: "FALSE", notNull: true },
+    { column: "metadata", type: "JSONB", default: "'{}'", notNull: true },
+    { column: "tokens_valid_after", type: "TIMESTAMP WITH TIME ZONE" },
+    { column: "created_at", type: "TIMESTAMP WITH TIME ZONE", default: "NOW()", notNull: true },
+    { column: "updated_at", type: "TIMESTAMP WITH TIME ZONE", default: "NOW()", notNull: true }
+];
+
+const BY_COLUMN = new Map(AUTH_USERS_COLUMNS.map(c => [c.column, c]));
+
+/** Type + inline constraints, as they appear after the column name. */
+export function authUsersColumnSql(spec: AuthUsersColumn): string {
+    return [
+        spec.type,
+        spec.default !== undefined ? `DEFAULT ${spec.default}` : "",
+        spec.notNull ? "NOT NULL" : ""
+    ].filter(Boolean).join(" ");
+}
+
+/**
+ * The auth-owned definition for a physical column name, or `undefined` when
+ * auth does not own it.
+ *
+ * Callers pass the RESOLVED column name (after `columnName` mapping), because
+ * that is the only name the three creators agree on: the scaffold's users
+ * collection spells the property `displayName` and the column `display_name`.
+ */
+export function authUsersColumnDefinition(column: string): string | undefined {
+    const spec = BY_COLUMN.get(column);
+    return spec ? authUsersColumnSql(spec) : undefined;
+}
+
+/**
+ * Whether a collection is an auth collection, i.e. whether the definitions in
+ * this module apply to its table at all.
+ *
+ * Duplicated in shape from `@rebasepro/common`'s policy defaults on purpose:
+ * that one takes a `CollectionConfig`, this one is called from DDL code paths
+ * that hold looser objects, and both spellings must accept `auth: true` as well
+ * as `auth: { enabled: true }`.
+ */
+export function isAuthCollection(collection: unknown): boolean {
+    const auth = (collection as { auth?: unknown } | undefined)?.auth;
+    if (auth === true) return true;
+    return typeof auth === "object" && auth !== null && (auth as { enabled?: unknown }).enabled === true;
+}

package/src/schema/doctor.ts

@@ -15,7 +15,7 @@ import chalk from "chalk";
 import { CollectionConfig, isPostgresCollectionConfig, Property, NumberProperty, StringProperty, DateProperty, ArrayProperty, MapProperty, RelationProperty, type ResolvedManyToMany, type ResolvedBelongsTo, isManyToMany } from "@rebasepro/types";
 import { generateSchema } from "./generate-drizzle-schema-logic";
 import { generateTypedefs } from "@rebasepro/codegen";
-import { getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getTableName, resolveCollectionRelations, findRelation, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { logger, loadCollectionsFromDirectory } from "@rebasepro/server";
 
@@ -164,8 +164,10 @@ export async function checkCollectionsVsSchema(
 issues };
     }
 
-    // Re-generate schema in-memory and compare with file on disk
-    const postgresCollections = collections.filter(isPostgresCollectionConfig);
+    // Re-generate schema in-memory and compare with file on disk. Only the
+    // collections the generator itself will emit — a Firestore collection has
+    // no table in the generated file and must not be reported as missing one.
+    const postgresCollections = relationalCollections(collections);
     if (postgresCollections.length === 0) {
         return { passed: true,
 issues };
@@ -292,7 +294,7 @@ export async function checkCollectionsVsDatabase(
     const schemas = Array.from(new Set([
         "public",
         "rebase",
-        ...collections
+        ...relationalCollections(collections)
             .filter(isPostgresCollectionConfig)
             .map(c => c.schema)
             .filter((s): s is string => !!s)
@@ -383,7 +385,7 @@ export async function checkCollectionsVsDatabase(
 
         // ── Compare each collection against the database ─────────────────
 
-        const postgresCollections = collections.filter(isPostgresCollectionConfig);
+        const postgresCollections = relationalCollections(collections);
 
         for (const collection of postgresCollections) {
             const tableName = getTableName(collection);