@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g249daa1

package/src/security/rls-enforcement.ts

@@ -1,6 +1,13 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
 import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
-import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
+import {
+    AnonymousGrantRisk,
+    findAnonymousGrants,
+    REBASE_USER_ROLE,
+    revokeInternalTableAccess,
+    securityRuleToConditions
+} from "@rebasepro/common";
+import { REBASE_SCHEMA, usesLegacyRlsFunctions } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -36,8 +43,14 @@ import { logger } from "@rebasepro/server";
  * not an operator opt-in.
  */
 
-/** The restricted role every authenticated (user-context) request runs as. */
-export const REBASE_USER_ROLE = "rebase_user";
+/**
+ * The restricted role every authenticated (user-context) request runs as.
+ *
+ * Re-exported, not re-declared: the same name is needed by
+ * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name
+ * fail as a silent no-op rather than an error.
+ */
+export { REBASE_USER_ROLE };
 
 /** Minimal SQL runner so callers can adapt drizzle or pg.Client. */
 export type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;
@@ -69,6 +82,57 @@ const quoteIdent = (name: string): string => `"${name.replace(/"/g, "\"\"")}"`;
 /** DML the user role holds on managed tables (RLS still filters per row). */
 const USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 
+/**
+ * Warn when the connection role shares its name with an existing schema.
+ *
+ * Postgres resolves unqualified names through `search_path`, which defaults to
+ * `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+ * name exists it sits ahead of `public`, so every unqualified statement
+ * silently operates on it instead:
+ *
+ *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+ *
+ * Nothing errors. You get a second table of the same name in the wrong schema,
+ * and reads that pin `public` cannot see it — which reads as "missing table" and
+ * sends people to re-run a push that creates a *third* copy. The bootstrapper
+ * has a whole branch dedicated to recognising the symptom after the fact.
+ *
+ * Rebase shipped straight into this: it creates a schema named `rebase` while
+ * every template named the database role `rebase` too. The scaffold uses
+ * `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+ * (`pinSearchPath`), which covers the paths the framework controls. This covers
+ * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+ * a hand-written migration — because the hazard is a property of the two NAMES,
+ * not of any one connection.
+ *
+ * A warning rather than a boot failure: the database works, the framework's own
+ * traffic is pinned, and refusing to start over a naming choice a user may have
+ * inherited would be worse than the risk.
+ */
+export async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {
+    try {
+        const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+        if (rows[0]?.collides !== true) return;
+        const role = String(rows[0]?.role ?? "the connection role");
+        logger.warn(
+            `⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified ` +
+            `names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched ` +
+            `BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the ` +
+            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. ` +
+            `Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the ` +
+            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +
+            `"rebase_app".`
+        );
+    } catch {
+        // A diagnostic must never be the reason a boot fails.
+    }
+}
+
 export async function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture> {
     const rows = await run(`
         SELECT current_user            AS role,
@@ -180,6 +244,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
         // migrations), so a migrate can never strand the user role.
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+
+        // The grants above are deliberately schema-wide — a project's own
+        // collections may live in `rebase`, and future tables must be reachable
+        // or a migration strands the role. Rebase's OWN tables are the exception:
+        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no
+        // row an end user should ever address. Taking the privilege back here
+        // covers every table that already exists; each creator revokes on the
+        // table it just made, for the boot that creates them for the first time.
+        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {
+            onError: (table, error) => logger.warn(
+                `🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — ` +
+                "it stays reachable by authenticated requests: " +
+                (error instanceof Error ? error.message : String(error))
+            )
+        });
     }
 
     logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
@@ -293,6 +372,65 @@ export function warnOnAnonymousGrants(
     );
 }
 
+/**
+ * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+ *
+ * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+ * database, so nothing is broken and no policy is wrong — which is exactly why
+ * this has to be said out loud. A silent rewrite that works forever is not a
+ * migration, it is a second supported spelling nobody wrote down, and the next
+ * person to read those rules will copy the old one.
+ *
+ * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+ * `policy.rolesOverlap(...)`) compile from the model and were never affected.
+ */
+export function warnOnLegacyRlsFunctions(
+    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
+): void {
+    const sites: string[] = [];
+
+    for (const collection of collections) {
+        for (const rule of collection.securityRules ?? []) {
+            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+            const carriesLegacy = [usingExpr, withCheckExpr]
+                .filter((e): e is PolicyExpression => e !== null)
+                .some(containsLegacyRlsCall);
+            if (!carriesLegacy) continue;
+
+            const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+            if (!sites.includes(site)) sites.push(site);
+        }
+    }
+
+    if (sites.length === 0) return;
+
+    logger.warn(
+        `These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). ` +
+        `They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, ` +
+        `and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` ` +
+        `and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), ` +
+        `which never had to be spelled by hand:\n\n` +
+        sites.map(s => `  • ${s}`).join("\n") + "\n"
+    );
+}
+
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr: PolicyExpression): boolean {
+    switch (expr.kind) {
+        case "raw":
+            return usesLegacyRlsFunctions(expr.sql);
+        case "and":
+        case "or":
+            return expr.operands.some(containsLegacyRlsCall);
+        case "not":
+            return containsLegacyRlsCall(expr.operand);
+        case "existsIn":
+            return containsLegacyRlsCall(expr.where);
+        default:
+            return false;
+    }
+}
+
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/src/services/BranchService.ts

@@ -9,6 +9,7 @@
 
 import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
+import { revokeInternalTableSql } from "@rebasepro/common";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
 import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
@@ -124,6 +125,10 @@ export class BranchService {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+
+        // Not a collection, so no RLS — and it names every branch database on
+        // this server. The driver's schema-wide grant reaches it, so revoke.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
     }
 
     /**

package/src/services/FetchService.ts

@@ -22,6 +22,7 @@ import { RelationalQueryBuilder } from "drizzle-orm/pg-core/query-builders/query
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { toFlatRow, toRestRow, isJunctionRelation } from "./row-pipeline";
+import { visibleColumnProjection, hiddenColumnsOption } from "../schema/search-column";
 import { isNestedPath, resolveNestedPath, type NestedPathHop } from "./nested-path";
 import { ApiError, logger } from "@rebasepro/server";
 import { reachedDatabase } from "../utils/pg-error-utils";
@@ -119,6 +120,31 @@ export class FetchService {
      * and skips rows rather than erroring. The guesses stay, last, for a
      * caller that hands over no collection to resolve against.
      */
+    /**
+     * The ORDER BY target, which may be relevance rather than a column.
+     *
+     * `_score` is only meaningful for a collection that declared a `search`
+     * block *and* for a request that carried a search string — ranking rows
+     * against no query ranks them all at zero. Outside those two conditions it
+     * is an unknown field and gets the same 400 as any other typo, which is the
+     * behaviour that matters: a sort that is silently dropped returns 200 with
+     * rows in arbitrary order, and paging over that repeats and skips rows.
+     */
+    static readonly SCORE_FIELD = "_score";
+
+    private resolveOrderTarget(
+        table: PgTable<any>,
+        orderBy: string,
+        collection?: CollectionConfig,
+        searchString?: string
+    ): AnyPgColumn | SQL | undefined {
+        if (orderBy === FetchService.SCORE_FIELD && collection && searchString) {
+            const rank = DrizzleConditionBuilder.buildSearchRankExpression(searchString, table, collection);
+            if (rank) return rank;
+        }
+        return this.resolveOrderByField(table, orderBy, collection);
+    }
+
     private resolveOrderByField(
         table: PgTable<any>,
         orderBy: string,
@@ -407,6 +433,15 @@ export class FetchService {
     ): Record<string, unknown> {
         const queryOpts: Record<string, unknown> = {};
 
+        // Same exclusion the `db.select` fallback applies, in the shape the
+        // relational query builder takes. Both paths serve the same request, so
+        // a row must not carry the search column down one and not the other.
+        const hidden = hiddenColumnsOption(
+            getTableColumns(table),
+            this.registry.getCollectionByPath(collectionPath) ?? undefined
+        );
+        if (hidden) queryOpts.columns = hidden;
+
         if (withConfig) queryOpts.with = withConfig;
 
         // Build where conditions
@@ -417,7 +452,7 @@ export class FetchService {
         if (options.searchString) {
             const collection = getCollectionByPath(collectionPath, this.registry);
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
-                options.searchString, collection.properties, table
+                options.searchString, collection.properties, table, collection
             );
             if (searchConditions.length === 0) {
                 // Return options that will produce empty results
@@ -451,7 +486,7 @@ export class FetchService {
         const orderExpressions: unknown[] = [];
         if (options.orderBy) {
             const collection = getCollectionByPath(collectionPath, this.registry);
-            const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+            const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
             if (orderByField) {
                 orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
             }
@@ -485,6 +520,21 @@ export class FetchService {
         const cursor = options.startAfter;
 
         if (options.orderBy) {
+            // Relevance is computed per query, not stored, so there is no value
+            // on the cursor row to compare a later page against — and two
+            // requests with different search strings would produce scores that
+            // are not on the same scale at all. Refusing is the only honest
+            // answer: a dropped cursor condition silently repeats and skips
+            // rows, which is precisely what paging exists to prevent.
+            if (options.orderBy === FetchService.SCORE_FIELD) {
+                throw ApiError.badRequest(
+                    "Cursor pagination (`startAfter`) cannot be combined with `orderBy: \"_score\"`. " +
+                    "Relevance is computed per query rather than stored, so it cannot key a cursor. " +
+                    "Use `limit`/`offset` for relevance-ordered pages, or order by a column.",
+                    "SCORE_CURSOR_UNSUPPORTED",
+                    { field: FetchService.SCORE_FIELD }
+                );
+            }
             const collection = collectionPath ? getCollectionByPath(collectionPath, this.registry) : undefined;
             const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
             if (orderByField) {
@@ -607,9 +657,12 @@ idColumn };
             try {
                 const withConfig = this.buildWithConfig(collection);
 
+                const hidden = hiddenColumnsOption(getTableColumns(table), collection);
+
                 const row = await qb.findFirst({
                     where: eq(idField, parsedId),
-                    with: withConfig
+                    with: withConfig,
+                    ...(hidden ? { columns: hidden } : {})
                 } as Parameters<NonNullable<typeof qb>["findFirst"]>[0]);
 
                 if (!row) return undefined;
@@ -631,8 +684,9 @@ idColumn };
         }
 
         // Fallback: db.select + N+1 relation loading
+        const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
         const result = await this.db
-            .select()
+            .select(visibleOne as never)
             .from(table)
             .where(eq(idField, parsedId))
             .limit(1);
@@ -700,6 +754,7 @@ idColumn };
             offset?: number;
             startAfter?: Record<string, unknown>;
             searchString?: string;
+            searchExplain?: boolean;
             databaseId?: string;
             vectorSearch?: VectorSearchParams;
             logical?: LogicalCondition;
@@ -763,17 +818,41 @@ idColumn };
             vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
         }
 
+        // A generated search column is an index in column form; `SELECT *`
+        // would ship it to every caller. The projection is undefined — and the
+        // SQL therefore unchanged — for any table without one.
+        const visible = visibleColumnProjection(getTableColumns(table), collection);
+
+        // Relevance, alongside the row, exactly as `_distance` rides along with
+        // a vector search. Present only when the collection opted in and the
+        // request carried a search string, so a caller can order by it, show
+        // it, or blend it with a score of their own.
+        const rankSelect = options.searchString
+            ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection)
+            : undefined;
+
+        // Only when asked: a `ts_headline` per declared field per row.
+        const matchesSelect = options.searchString && options.searchExplain
+            ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection)
+            : undefined;
+
         let query = vectorMeta
-            ? this.db.select({ table_row: table,
+            ? this.db.select({ table_row: (visible ?? table) as never,
 _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
-            : this.db.select().from(table).$dynamic();
+            : rankSelect
+                ? this.db.select({
+                    table_row: (visible ?? table) as never,
+                    _score: rankSelect,
+                    ...(matchesSelect ? { _matches: matchesSelect } : {})
+                }).from(table).$dynamic()
+                : (visible ? this.db.select(visible as never).from(table).$dynamic() : this.db.select().from(table).$dynamic());
         const allConditions: SQL[] = [];
 
         if (scopeCondition) allConditions.push(scopeCondition);
 
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
-                options.searchString, collection.properties, table
+                options.searchString, collection.properties, table, collection
             );
             if (searchConditions.length === 0) return [];
             allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions)!);
@@ -804,7 +883,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         if (vectorMeta) {
             orderExpressions.push(asc(vectorMeta.orderBy));
         } else if (options.orderBy) {
-            const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+            const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
             if (orderByField) {
                 orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
             }
@@ -838,7 +917,15 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                 ...r.table_row,
                 _distance: typeof r._distance === "number" ? r._distance : parseFloat(String(r._distance))
             }))
-            : rawResults as Record<string, unknown>[];
+            // Same nested shape, unwrapped the same way, when a relevance
+            // score was selected instead.
+            : rankSelect
+                ? (rawResults as { table_row: Record<string, unknown>; _score: unknown; _matches?: unknown }[]).map(r => ({
+                    ...r.table_row,
+                    _score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+                    ...(matchesSelect ? { _matches: r._matches ?? [] } : {})
+                }))
+                : rawResults as Record<string, unknown>[];
 
         return this.processRowResults<M>(results, collection, collectionPath, idInfo, options.databaseId, false, idInfoArray);
     }
@@ -954,6 +1041,16 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /**
+             * An `or(...)`/`and(...)` group, applied alongside `filter`.
+             *
+             * `fetchRowsWithConditions` below has always applied this; it was
+             * simply absent from this signature, so the only callers that could
+             * pass one were the ones that went around this method. Realtime
+             * came through here, which is why a subscription filtered by a
+             * logical group was pushed every row in the table.
+             */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
@@ -988,6 +1085,8 @@ relatedTo: hop });
             order?: "desc" | "asc";
             limit?: number;
             databaseId?: string;
+            /** Ask each row which declared search field matched. */
+            searchExplain?: boolean;
         } = {}
     ): Promise<Record<string, unknown>[]> {
         return this.fetchRowsWithConditions<M>(collectionPath, {
@@ -1024,7 +1123,7 @@ relatedTo: hop });
 
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
-                options.searchString, collection.properties, table
+                options.searchString, collection.properties, table, collection
             );
             if (searchConditions.length === 0) return 0;
             allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions)!);
@@ -1298,8 +1397,9 @@ relatedTo: hop }, include
         }
 
         // Fallback: db.select + N+1 relation loading
+        const visibleOne = visibleColumnProjection(getTableColumns(table), collection);
         const result = await this.db
-            .select()
+            .select(visibleOne as never)
             .from(table)
             .where(eq(idField, parsedId))
             .limit(1);
@@ -1359,6 +1459,7 @@ relatedTo: hop }, include
             offset?: number;
             startAfter?: Record<string, unknown>;
             searchString?: string;
+            searchExplain?: boolean;
             vectorSearch?: VectorSearchParams;
             relatedTo?: NestedPathHop;
         } = {}
@@ -1374,17 +1475,41 @@ relatedTo: hop }, include
             vectorMeta = DrizzleConditionBuilder.buildVectorSearchConditions(table, options.vectorSearch);
         }
 
+        // A generated search column is an index in column form; `SELECT *`
+        // would ship it to every caller. The projection is undefined — and the
+        // SQL therefore unchanged — for any table without one.
+        const visible = visibleColumnProjection(getTableColumns(table), collection);
+
+        // Relevance, alongside the row, exactly as `_distance` rides along with
+        // a vector search. Present only when the collection opted in and the
+        // request carried a search string, so a caller can order by it, show
+        // it, or blend it with a score of their own.
+        const rankSelect = options.searchString
+            ? DrizzleConditionBuilder.buildSearchRankExpression(options.searchString, table, collection)
+            : undefined;
+
+        // Only when asked: a `ts_headline` per declared field per row.
+        const matchesSelect = options.searchString && options.searchExplain
+            ? DrizzleConditionBuilder.buildSearchMatchesExpression(options.searchString, table, collection)
+            : undefined;
+
         let query = vectorMeta
-            ? this.db.select({ table_row: table,
+            ? this.db.select({ table_row: (visible ?? table) as never,
 _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
-            : this.db.select().from(table).$dynamic();
+            : rankSelect
+                ? this.db.select({
+                    table_row: (visible ?? table) as never,
+                    _score: rankSelect,
+                    ...(matchesSelect ? { _matches: matchesSelect } : {})
+                }).from(table).$dynamic()
+                : (visible ? this.db.select(visible as never).from(table).$dynamic() : this.db.select().from(table).$dynamic());
         const allConditions: SQL[] = [];
 
         if (options.relatedTo) allConditions.push(this.buildRelationScope(options.relatedTo));
 
         if (options.searchString) {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
-                options.searchString, collection.properties, table
+                options.searchString, collection.properties, table, collection
             );
             if (searchConditions.length === 0) return [];
             allConditions.push(DrizzleConditionBuilder.combineConditionsWithOr(searchConditions)!);
@@ -1408,7 +1533,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         if (vectorMeta) {
             orderExpressions.push(asc(vectorMeta.orderBy));
         } else if (options.orderBy) {
-            const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
+            const orderByField = this.resolveOrderTarget(table, options.orderBy, collection, options.searchString);
             if (orderByField) {
                 orderExpressions.push(options.order === "asc" ? asc(orderByField) : desc(orderByField));
             }
@@ -1433,6 +1558,14 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             }));
         }
 
+        if (rankSelect) {
+            return (rawResults as { table_row: Record<string, unknown>; _score: unknown; _matches?: unknown }[]).map(r => ({
+                ...r.table_row,
+                _score: typeof r._score === "number" ? r._score : parseFloat(String(r._score)),
+                ...(matchesSelect ? { _matches: r._matches ?? [] } : {})
+            }));
+        }
+
         return rawResults as Record<string, unknown>[];
     }
 
@@ -1454,99 +1587,6 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         return !!this.getQueryBuilder(tableName);
     }
 
-    /**
-     * Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-     * for efficient JOIN-based relation loading.
-     * Returns null if the API is not available or the query fails.
-     * Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-     */
-    private async fetchWithDrizzleQuery<M extends Record<string, unknown>>(
-        collectionPath: string,
-        collection: CollectionConfig,
-        options: {
-            filter?: FilterValues<Extract<keyof M, string>>;
-            orderBy?: string;
-            order?: "desc" | "asc";
-            limit?: number;
-        },
-        include: string[],
-        idInfo: { fieldName: string; type: "string" | "number" },
-        idInfoArray?: { fieldName: string; type: "string" | "number" }[]
-    ): Promise<Record<string, unknown>[] | null> {
-        try {
-
-            const table = getTableForCollection(collection, this.registry);
-            const tableName = getTableName(table);
-            const queryTarget = this.getQueryBuilder(tableName);
-
-            if (!queryTarget?.findMany) return null;
-
-            // Build the `with` config from include array
-            const resolvedRelations = resolveCollectionRelations(collection);
-            const withConfig: Record<string, boolean> = {};
-            for (const [key, relation] of Object.entries(resolvedRelations)) {
-                if (include[0] === "*" || include.includes(key)) {
-                    // Use the Drizzle relation name (from the schema)
-                    const drizzleRelName = relation.relationName || key;
-                    withConfig[drizzleRelName] = true;
-                }
-            }
-
-            // Build query options
-            const queryOpts: Record<string, unknown> = { with: withConfig };
-            if (options.limit) queryOpts.limit = options.limit;
-
-            // Build where clause
-            if (options.filter) {
-                const filterConditions = this.buildFilterConditions(
-                    options.filter, table, collectionPath
-                );
-                if (filterConditions.length > 0) {
-                    queryOpts.where = and(...filterConditions);
-                }
-            }
-
-            // Build orderBy
-            if (options.orderBy) {
-                const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-                if (orderByField) {
-                    queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
-                }
-            }
-
-
-            const results = await queryTarget.findMany(queryOpts as Parameters<NonNullable<typeof queryTarget>["findMany"]>[0]);
-
-            // Inline the nested Drizzle results, columns only — no synthesized id.
-            return results.map((row: Record<string, unknown>) => {
-                const flat: Record<string, unknown> = {};
-                for (const [k, v] of Object.entries(row)) {
-                    if (Array.isArray(v)) {
-                        // Many relation — inline each nested row
-                        flat[k] = v.map((item: Record<string, unknown>) => {
-                            // Junction table rows may have the target nested, unwrap those
-                            const keys = Object.keys(item);
-                            const nestedObj = keys.find(nk => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-                            if (nestedObj && keys.length <= 3) {
-                                return { ...(item[nestedObj] as Record<string, unknown>) };
-                            }
-                            return { ...item };
-                        });
-                    } else if (typeof v === "object" && v !== null) {
-                        // One-to-one relation — inline the target's columns
-                        flat[k] = { ...(v as Record<string, unknown>) };
-                    } else {
-                        flat[k] = v;
-                    }
-                }
-                return flat;
-            });
-        } catch (e) {
-            logger.warn(`[include] Drizzle relational query failed for '${collectionPath}', falling back`, { error: e });
-            return null;
-        }
-    }
-
     /**
      * Fallback path used when db.query is unavailable.
      * The primary path uses db.query.findMany with `with` config, which

package/src/services/PersistService.ts

@@ -477,7 +477,20 @@ export class PersistService {
         const pgError = extractPgError(error);
 
         if (pgError) {
-            const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+            const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+            // This is the only layer that holds the SQLSTATE, so it is the only
+            // one that can say whose fault a failure was. Returning a bare
+            // `Error` threw that away, and the REST layer compensated by calling
+            // *every* unclassified error a 400 — so an unreachable database was
+            // reported to callers as a bad request. Classes 22 (data exception)
+            // and 23 (integrity constraint violation) are the caller's data;
+            // everything else — a dropped connection, a missing column, a
+            // permission problem — is ours, and stays a 500.
+            if (/^2[23]/.test(code)) {
+                return code === "23505"
+                    ? ApiError.conflict(message, `PG_${code}`)
+                    : ApiError.badRequest(message, `PG_${code}`);
+            }
             return new Error(message);
         }
 

package/src/services/RelationService.ts

@@ -423,7 +423,8 @@ export class RelationService {
             const searchConditions = DrizzleConditionBuilder.buildSearchConditions(
                 options.searchString,
                 targetCollection.properties,
-                targetTable
+                targetTable,
+                targetCollection
             );
 
             if (searchConditions.length === 0) {

package/src/services/channel-history.ts

@@ -34,6 +34,7 @@ import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** How many messages a replay returns when the caller does not say. */
 const DEFAULT_REPLAY_LIMIT = 200;
@@ -198,6 +199,13 @@ export class ChannelHistoryStore {
             )
         `);
 
+        // Retained broadcasts for every channel in one table, with no RLS: who
+        // may replay a channel is decided by the channel rules the server
+        // evaluates before it reads. The driver's schema-wide grant reaches
+        // these (created here, after it ran), so take the privilege back.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+
         this.tablesReady = true;
         logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
     }