@rebasepro/server-postgres 0.13.0 → 0.13.1-canary.g394d868

package/dist/index.es.js

@@ -2,7 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
-import { A as toSnakeCase, C as normalizeToEntityRelation, D as getPolicyNamesForRule, F as Vector, N as hasForeignKeyOnTarget, O as mergeDeep, P as isManyToMany, S as createRelationRefWithData, T as generateForeignKeyName, _ as buildCompositeId, a as getJunctionSecurityRules, b as parseIdValues, c as policyToPostgres, d as findRelation, f as getColumnName, g as resolveCollectionRelations, h as getTableVarName, i as getJunctionCollectionConfig, k as camelCase, l as securityRuleToConditions, m as getTableName$1, n as CollectionRegistry, o as resolveJunctionSpecs, p as getEnumVarName, r as resolveStringColumnLength, s as getEffectiveSecurityRules, t as buildSdkData, u as findAnonymousGrants, v as getDeclaredPrimaryKeys, w as updateDateAutoValues, x as createRelationRef, y as isAddressableId } from "./src-DlPBctw_.js";
+import { A as mergeDeep, C as createRelationRefWithData, D as legacyForeignKeyName, E as generateForeignKeyName, F as resolveClientListLimit, I as hasForeignKeyOnTarget, L as isManyToMany, M as toSnakeCase, O as getPolicyNamesForRule, R as Vector, S as createRelationRef, T as updateDateAutoValues, _ as resolveCollectionRelations, a as getJunctionCollectionConfig, b as isAddressableId, c as getEffectiveSecurityRules, d as findAnonymousGrants, f as findRelation, g as getTableVarName, h as getTableName$1, i as resolveStringColumnLength, j as camelCase, k as isPrototypePollutingKey, l as policyToPostgres, m as getEnumVarName, n as CollectionRegistry, o as getJunctionSecurityRules, p as getColumnName, r as relationalCollections, s as resolveJunctionSpecs, t as buildSdkData, u as securityRuleToConditions, v as buildCompositeId, w as normalizeToEntityRelation, x as parseIdValues, y as getDeclaredPrimaryKeys } from "./src-B0PGnKU3.js";
 import { n as isPostgresCollectionConfig, r as isRelationalCollectionConfig } from "./src-DoU9yPqq.js";
 import { t as ANONYMOUS_USER_ID } from "./policy-CeA1JcxP.js";
 import { t as createPostgresWebSocket } from "./websocket-B2LsrINK.js";
@@ -30,25 +30,6 @@ import { randomUUID } from "crypto";
 function isChannelBusInstance(setting) {
 	return typeof setting?.publish === "function";
 }
-/**
-* Resolve a client-supplied list `limit` into a safe, always-defined value.
-*
-* - A provided limit is coerced to an integer and clamped to `[1, maxLimit]`,
-*   so `0`, negatives, and absurd values can never bypass the cap.
-* - An absent / blank / non-numeric limit falls back to the mode default:
-*   `vectorDefaultLimit` for a vector search, otherwise `defaultLimit`.
-*
-* The return is never `undefined` — no ingress that routes its client limit
-* through this can produce an unbounded read.
-*/
-function resolveClientListLimit(rawLimit, opts = {}) {
-	const maxLimit = opts.maxLimit ?? 1e3;
-	if (rawLimit != null && String(rawLimit).trim() !== "") {
-		const parsed = typeof rawLimit === "number" ? rawLimit : parseInt(String(rawLimit), 10);
-		if (Number.isFinite(parsed)) return Math.min(Math.max(1, Math.floor(parsed)), maxLimit);
-	}
-	return opts.vectorSearch ? opts.vectorDefaultLimit ?? 10 : opts.defaultLimit ?? 50;
-}
 //#endregion
 //#region ../common/src/util/email.ts
 /**
@@ -1276,7 +1257,11 @@ function sanitizeAndConvertDates(obj) {
 	if (obj instanceof Date) return obj.toISOString();
 	if (typeof obj === "object") {
 		const newObj = {};
-		for (const key in obj) if (Object.prototype.hasOwnProperty.call(obj, key)) newObj[key] = sanitizeAndConvertDates(obj[key]);
+		for (const key in obj) {
+			if (!Object.prototype.hasOwnProperty.call(obj, key)) continue;
+			if (isPrototypePollutingKey(key)) continue;
+			newObj[key] = sanitizeAndConvertDates(obj[key]);
+		}
 		return newObj;
 	}
 	if (typeof obj === "string") {
@@ -1305,6 +1290,7 @@ function serializeDataToServer(row, properties, collection, registry) {
 		if (relation.kind === "belongsTo") foreignKeys.add(relation.localKey);
 	});
 	for (const [key, value] of Object.entries(row)) {
+		if (isPrototypePollutingKey(key)) continue;
 		const property = properties[key];
 		const effectiveValue = foreignKeys.has(key) && value === "" ? null : value;
 		if (!property) {
@@ -3796,51 +3782,6 @@ var FetchService = class {
 		return !!this.getQueryBuilder(tableName);
 	}
 	/**
-	* Attempt to use Drizzle's relational query API (db.query.<table>.findMany)
-	* for efficient JOIN-based relation loading.
-	* Returns null if the API is not available or the query fails.
-	* Note: Primary path now uses `buildWithConfig` + `buildDrizzleQueryOptions`.
-	*/
-	async fetchWithDrizzleQuery(collectionPath, collection, options, include, idInfo, idInfoArray) {
-		try {
-			const table = getTableForCollection(collection, this.registry);
-			const tableName = getTableName(table);
-			const queryTarget = this.getQueryBuilder(tableName);
-			if (!queryTarget?.findMany) return null;
-			const resolvedRelations = resolveCollectionRelations(collection);
-			const withConfig = {};
-			for (const [key, relation] of Object.entries(resolvedRelations)) if (include[0] === "*" || include.includes(key)) {
-				const drizzleRelName = relation.relationName || key;
-				withConfig[drizzleRelName] = true;
-			}
-			const queryOpts = { with: withConfig };
-			if (options.limit) queryOpts.limit = options.limit;
-			if (options.filter) {
-				const filterConditions = this.buildFilterConditions(options.filter, table, collectionPath);
-				if (filterConditions.length > 0) queryOpts.where = and(...filterConditions);
-			}
-			if (options.orderBy) {
-				const orderByField = this.resolveOrderByField(table, options.orderBy, collection);
-				if (orderByField) queryOpts.orderBy = options.order === "asc" ? asc(orderByField) : desc(orderByField);
-			}
-			return (await queryTarget.findMany(queryOpts)).map((row) => {
-				const flat = {};
-				for (const [k, v] of Object.entries(row)) if (Array.isArray(v)) flat[k] = v.map((item) => {
-					const keys = Object.keys(item);
-					const nestedObj = keys.find((nk) => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
-					if (nestedObj && keys.length <= 3) return { ...item[nestedObj] };
-					return { ...item };
-				});
-				else if (typeof v === "object" && v !== null) flat[k] = { ...v };
-				else flat[k] = v;
-				return flat;
-			});
-		} catch (e) {
-			logger.warn(`[include] Drizzle relational query failed for '${collectionPath}', falling back`, { error: e });
-			return null;
-		}
-	}
-	/**
 	* Fallback path used when db.query is unavailable.
 	* The primary path uses db.query.findMany with `with` config, which
 	* loads all relations in a single query.
@@ -4091,7 +4032,8 @@ var PersistService = class {
 		if (error instanceof ApiError || error?.name === "ApiError") return error;
 		const pgError = extractPgError(error);
 		if (pgError) {
-			const { message } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
+			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -4749,6 +4691,25 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			}
 		};
 	}
+	/**
+	* Build the context handed to every collection callback.
+	*
+	* Note `data: this.data` — `this` is whichever driver is running the
+	* operation, so the callback's data plane inherits that driver's privilege.
+	* On a user request `AuthenticatedPostgresBackendDriver.withTransaction`
+	* constructs a fresh base driver bound to the RLS-scoped transaction and
+	* runs the operation on it, so `this.data` speaks through that connection
+	* and policies apply. On server-context work `this` is the base driver on
+	* the owner connection, and they do not. Pinned by the
+	* `"scopes context.data to the caller"` case in the `rls-enforcement` e2e
+	* suite, because it is the kind of property that is easy to break from a
+	* distance and impossible to notice.
+	*
+	* Previously returned through `as unknown as RebaseCallContext`, which
+	* disabled checking for the whole object and let `driver` — documented in
+	* the callbacks guide — sit on the runtime context while absent from the
+	* contract. Both are declared now, so this is a plain typed return.
+	*/
 	buildCallContext() {
 		return {
 			user: this.user,
@@ -5204,6 +5165,106 @@ var PostgresBackendDriver = class PostgresBackendDriver {
 			return saved;
 		});
 	}
+	/**
+	* Update many rows through the same pipeline as {@link save}, in one
+	* transaction.
+	*
+	* Structurally the mirror of {@link saveMany} — same tx-bound sub-driver,
+	* same deferred notifications, same per-row error labelling — but it calls
+	* `save` with an explicit `id` and `status: "existing"`, which is precisely
+	* what `saveMany` cannot do: that one passes `status: "new"` and keeps the
+	* key inside `values`, so it inserts or upserts and can never target a
+	* particular row.
+	*
+	* All-or-nothing, so an id matching no row aborts the batch. A partial
+	* update is the outcome with no good recovery: the caller cannot tell which
+	* half landed without re-reading everything.
+	*/
+	async updateMany({ path, updates, collection }) {
+		return this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			const saved = [];
+			for (let i = 0; i < updates.length; i++) {
+				const { id, values } = updates[i];
+				try {
+					if (!await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					})) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					saved.push(await txDriver.save({
+						path,
+						id: String(id),
+						values,
+						collection,
+						status: "existing"
+					}));
+				} catch (error) {
+					throw Object.assign(new Error(`Update ${i} of ${updates.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+			return saved;
+		});
+	}
+	/**
+	* Delete many rows in one transaction, running the full delete pipeline —
+	* `beforeDelete`, the delete, `afterDelete` — for each.
+	*
+	* Looping the single-row {@link delete} rather than emitting one
+	* `DELETE ... WHERE id = ANY($1)` is the deliberate choice: a single
+	* statement would be faster and would skip every callback, so a collection
+	* relying on `beforeDelete` to veto or on `afterDelete` to clean up
+	* dependents would behave differently depending on how many rows the caller
+	* happened to delete at once. Same pipeline, one transaction.
+	*/
+	async deleteMany({ path, ids, collection }) {
+		await this.db.transaction(async (tx) => {
+			const txDriver = new PostgresBackendDriver(tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService);
+			txDriver.dataService = new DataService(tx, this.registry);
+			txDriver.client = this.client;
+			txDriver._deferNotifications = this._deferNotifications;
+			txDriver._pendingNotifications = this._pendingNotifications;
+			for (let i = 0; i < ids.length; i++) {
+				const id = ids[i];
+				try {
+					const existing = await txDriver.fetchOne({
+						path,
+						id: String(id),
+						collection
+					});
+					if (!existing) throw Object.assign(/* @__PURE__ */ new Error(`No row with id ${JSON.stringify(id)}`), {
+						statusCode: 404,
+						code: "NOT_FOUND"
+					});
+					await txDriver.delete({
+						row: {
+							id: String(id),
+							path,
+							values: existing
+						},
+						collection
+					});
+				} catch (error) {
+					throw Object.assign(new Error(`Delete ${i} of ${ids.length} (id ${JSON.stringify(id)}) failed: ${error?.message ?? error}`, { cause: error }), {
+						statusCode: error?.statusCode,
+						code: error?.code,
+						name: error?.name
+					});
+				}
+			}
+		});
+	}
 	async delete({ row, collection }) {
 		const targetPath = row.path;
 		const targetRow = { ...row.values ?? {} };
@@ -6168,7 +6229,8 @@ var computeSharedRelationName = (rel, sourceCollection, _collections) => {
 	}
 	return fallback;
 };
-var generateSchema = async (collections, stripPolicies = false) => {
+var generateSchema = async (allCollections, stripPolicies = false) => {
+	const collections = relationalCollections(allCollections);
 	let schemaContent = "// This file is auto-generated by the Rebase Drizzle generator. Do not edit manually.\n\n";
 	const hasUuid = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "string" && (p.autoValue === "uuid" || p.isId === "uuid")));
 	const hasVector = collections.some((c) => c.properties && Object.values(c.properties).some((p) => p.type === "vector"));
@@ -7816,23 +7878,18 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				path: request.path,
 				collectionRequest: {
 					filter: request.filter,
+					logical: request.logical,
 					orderBy: request.orderBy,
 					order: request.order,
 					limit: boundedLimit,
+					offset: request.offset,
 					startAfter: request.startAfter,
 					databaseId: request.collection?.databaseId,
 					searchString: request.searchString
 				},
 				authContext
 			});
-			const rows = await this.fetchCollectionWithAuth(request.path, {
-				filter: request.filter,
-				orderBy: request.orderBy,
-				order: request.order,
-				limit: boundedLimit,
-				startAfter: request.startAfter,
-				searchString: request.searchString
-			}, authContext);
+			const rows = await this.fetchCollectionWithAuth(request.path, this._subscriptions.get(subscriptionId).collectionRequest, authContext);
 			this.sendCollectionUpdate(clientId, subscriptionId, rows, request.path);
 		} catch (error) {
 			const sanitized = sanitizeErrorForClient(error, request.path);
@@ -8016,6 +8073,7 @@ var RealtimeService = class RealtimeService extends EventEmitter {
 				});
 				else fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
 					filter: collectionRequest.filter,
+					logical: collectionRequest.logical,
 					orderBy: collectionRequest.orderBy,
 					order: collectionRequest.order,
 					limit: collectionRequest.limit,
@@ -9203,6 +9261,54 @@ var quote = (xs) => Array.from(xs).map((s) => `\`${s}\``).join(", ");
 /** `on.from` / `on.to` accept a single column or a composite tuple. */
 var asColumns = (value) => Array.isArray(value) ? value : [value];
 /**
+* Distinguish "this column name is wrong" from "the generated schema is old".
+*
+* They present identically here — a relation asks for a column the registered
+* table does not have — but they are opposite problems with opposite fixes, and
+* getting them the wrong way round is how the 0.12 → 0.13 upgrade bricked
+* projects.
+*
+* The registered table is not the database. It comes from the project's
+* checked-in `backend/src/schema.generated.ts`, and 0.13 changed the rule that
+* derives foreign-key names: `categories` yields `category_id` where it used to
+* yield `categorie_id`. Boot-ensure renames the database column to match, so by
+* the time this runs the *database* is correct and the *generated module* is the
+* stale one. Reporting "not a column" then points at the wrong artifact, and the
+* generic fix — "set `through.targetColumn` to one of: …", listing the legacy
+* name because that is what the stale module still has — talks the reader into
+* pinning a column that no longer exists.
+*
+* So when the wanted name is what the current rule derives, and the table
+* carries what the *previous* rule would have derived from the same source, say
+* that instead.
+*
+* @param wanted   the column the relation asks for
+* @param available every column the registered table has
+* @param sources  names the default could have been derived from (a slug, a
+*                 relation name) — checking against these rather than guessing
+*                 backwards from `wanted` keeps the match exact
+*/
+function staleCodegenRename(wanted, available, sources) {
+	for (const source of sources) {
+		if (!source) continue;
+		const current = generateForeignKeyName(source);
+		const legacy = legacyForeignKeyName(source);
+		if (current !== wanted || legacy === current) continue;
+		if (available.has(legacy) && !available.has(current)) return {
+			legacy,
+			current
+		};
+	}
+	return null;
+}
+/** The shared explanation, so every relation kind reports it identically. */
+function staleCodegenDefect(table, { legacy, current }) {
+	return {
+		problem: `the generated Drizzle schema still declares \`${legacy}\` on \`${table}\`, but this release derives \`${current}\` — the generated schema predates the foreign-key naming fix and no longer describes the database`,
+		fix: `regenerate it with \`rebase schema generate\` (or \`pnpm run schema:generate\`). The database column has already been renamed for you at boot, so nothing else is needed. To keep \`${legacy}\` instead, name it explicitly on the relation and regenerate.`
+	};
+}
+/**
 * Relations whose names do not resolve against the registered schema.
 *
 * Fails open wherever it cannot see enough to be sure — an unregistered source
@@ -9249,19 +9355,31 @@ function findRelationDefects(collections, registry) {
 			const targetColumns = columnNames(targetTable);
 			switch (relation.kind) {
 				case "belongsTo":
-					if (!sourceColumns.has(relation.localKey)) defects.push({
-						...at,
-						problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
-						fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
-					});
+					if (!sourceColumns.has(relation.localKey)) {
+						const stale = staleCodegenRename(relation.localKey, sourceColumns, [relation.relationName, targetCollection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(sourceTableName, stale)
+						} : {
+							...at,
+							problem: `\`localKey: "${relation.localKey}"\` is not a column on \`${sourceTableName}\``,
+							fix: `add the column, or set \`localKey\` to one of: ${quote(sourceColumns)}`
+						});
+					}
 					break;
 				case "hasOne":
 				case "hasMany":
-					if (!targetColumns.has(relation.foreignKeyOnTarget)) defects.push({
-						...at,
-						problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
-						fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
-					});
+					if (!targetColumns.has(relation.foreignKeyOnTarget)) {
+						const stale = staleCodegenRename(relation.foreignKeyOnTarget, targetColumns, [collection.slug]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(targetTableName, stale)
+						} : {
+							...at,
+							problem: `\`foreignKeyOnTarget: "${relation.foreignKeyOnTarget}"\` is not a column on the target table \`${targetTableName}\``,
+							fix: `add the column, or set \`foreignKeyOnTarget\` to one of: ${quote(targetColumns)}`
+						});
+					}
 					if (relation.sourceKey && !sourceColumns.has(relation.sourceKey)) defects.push({
 						...at,
 						problem: `\`sourceKey: "${relation.sourceKey}"\` is not a column on \`${sourceTableName}\``,
@@ -9280,11 +9398,21 @@ function findRelationDefects(collections, registry) {
 						break;
 					}
 					const junctionColumns = columnNames(junction);
-					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) defects.push({
-						...at,
-						problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
-						fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
-					});
+					const derivedFrom = {
+						sourceColumn: [collection.slug],
+						targetColumn: [targetCollection.slug]
+					};
+					for (const [label, column] of [["sourceColumn", sourceColumn], ["targetColumn", targetColumn]]) if (!junctionColumns.has(column)) {
+						const stale = staleCodegenRename(column, junctionColumns, [...derivedFrom[label]]);
+						defects.push(stale ? {
+							...at,
+							...staleCodegenDefect(table, stale)
+						} : {
+							...at,
+							problem: `\`through.${label}: "${column}"\` is not a column on the junction table \`${table}\``,
+							fix: `set \`through.${label}\` to one of: ${quote(junctionColumns)}` + (label === "sourceColumn" ? " — it is the column naming *this* collection" : "")
+						});
+					}
 					break;
 				}
 				case "via": {
@@ -9356,7 +9484,16 @@ function assertRelationsResolve(collections, registry) {
 	const defects = findRelationDefects(collections, registry);
 	if (defects.length === 0) return;
 	const lines = defects.map((d) => `  • ${d.collection}.${d.relationName} (${d.kind})\n      ${d.problem}\n      fix: ${d.fix}`);
-	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against the database schema.\n\nEach of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+	throw new Error(`${defects.length} relation${defects.length === 1 ? "" : "s"} cannot resolve against \`backend/src/schema.generated.ts\`.
+
+Each of these would return no rows at query time rather than reporting an error, so they are fatal at boot instead.
+
+If the database was migrated recently — an upgrade, a \`db push\`, a restore — this file is
+probably older than the schema it describes. Regenerate it before changing anything else:
+
+    rebase schema generate
+
+If it is already current, then the collection is what disagrees with it:
 
 ` + lines.join("\n\n") + "\n");
 }
@@ -12288,7 +12425,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-CBQdOETu.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-CdRsuy33.js");
 			const plan = await ensureCollectionTables({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };
@@ -12313,7 +12450,7 @@ function createPostgresBootstrapper(pgConfig) {
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
 			const internals = driverResult.internals;
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-ViG8XiPn.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-BTdgHBKV.js");
 			const outcome = await ensureCollectionPolicies({ async query(text) {
 				const result = await internals.db.execute(sql.raw(text));
 				return { rows: result.rows ?? (Array.isArray(result) ? result : []) };