@rebasepro/server-postgres 0.13.1-canary.g06dbe5b → 0.13.1-canary.g1bf9303

package/dist/PostgresBootstrapper.d.ts

@@ -89,6 +89,32 @@ export interface PostgresDriverInternals {
  * and this is the part that was wrong.
  */
 export declare function resolveDriftCheckName(col: CollectionConfig, registeredTableNames: string[]): string;
+/**
+ * Is this the local database `rebase init` scaffolds — i.e. the one case where
+ * "you are connected as a superuser" is not news?
+ *
+ * The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+ * which makes that role the cluster superuser, so the superuser advisory below
+ * was the only WARN a brand-new project ever saw and it was about a decision
+ * the tool had made for the developer.
+ *
+ * Of the two available fixes — provision a non-superuser table-owner role in
+ * the scaffold, or recognise the local shape and stay quiet — this is the
+ * second, because the first breaks the scaffold it is meant to improve: a
+ * non-superuser owner cannot `CREATE EXTENSION` (search collections need
+ * `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+ * schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+ * with a search block would fail. Trading a working first run for a quieter log
+ * line is the wrong trade.
+ *
+ * The condition is deliberately narrow — a *non-production* process talking to
+ * a database on the loopback interface. A genuine production superuser
+ * connection still warns, and so does a non-production process pointed at a
+ * remote database (the usual "my dev machine writes to staging" mistake, where
+ * the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+ * ships `NODE_ENV=development` and some deployments inherit it.
+ */
+export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
 /**
  * Default PostgreSQL bootstrapper.
  *

package/dist/auth/services.d.ts

@@ -287,6 +287,7 @@ export declare class PostgresAuthRepository implements AuthRepository {
         secretEncrypted: string;
     }) | null>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
@@ -323,6 +324,7 @@ export declare class MfaService implements MfaRepository {
      */
     claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;

package/dist/{auth-users-columns-CBEOeYqa.js → auth-users-columns-BxT6FRyu.js}

@@ -3,7 +3,7 @@ import "process";
 __createRequire(import.meta.url);
 import { l as __require, s as __commonJSMin } from "./connection-BuZ97wsr.js";
 import { a as policy, i as ANONYMOUS_USER_IDS, r as ANONYMOUS_USER_ID } from "./data_driver-ULAyJEi9.js";
-import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as NULL_OPS, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as toCanonicalOp, p as REST_TO_CANONICAL, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-C_wvdMnl.js";
+import { a as rewriteLegacyRlsFunctions, c as isPostgresCollectionConfig, d as getDataSourceCapabilities, f as ALL_WHERE_FILTER_OPS, g as toCanonicalOp, h as REST_TO_CANONICAL, i as RLS_UID_SQL, l as isRelationalCollectionConfig, m as NULL_OPS, p as CANONICAL_TO_REST, r as RLS_ROLES_SQL, s as getDeclaredSubcollections } from "./src-DCdn3Val.js";
 import { createHash } from "node:crypto";
 //#region ../types/src/types/entities.ts
 /**
@@ -2115,11 +2115,32 @@ function sqlToPolicy(sql) {
 * is the more dangerous spelling, because it inverts a rule instead of
 * emptying a table.
 */
-var FOREIGN_CONVENTION_UIDS = {
-	anon: "Supabase",
-	authenticated: "Supabase",
-	service_role: "Supabase"
-};
+/**
+* A `Map`, not an object literal.
+*
+* As `Record<string, string>` this was indexed with a literal taken straight
+* out of a policy, so every key on `Object.prototype` answered: a rule
+* comparing `rebase.uid()` to `"valueOf"`, `"toString"`, `"constructor"` or
+* `"hasOwnProperty"` found a truthy "platform" and reported an anonymous-grant
+* risk that does not exist — with the matched function interpolated into the
+* explanation as the platform's name. A security warning that fires on
+* innocent input is worse than none: it is what teaches people to skip the
+* warnings that are real.
+*
+* Same shape as the prototype-pollution class swept out of `setIn`, `getIn`,
+* `mergeDeep` and `unflattenObject` — a data-derived key reaching a plain
+* object. Found by a property test, on the input `"valueOf"`.
+*/
+var FOREIGN_CONVENTION_UIDS = /* @__PURE__ */ new Map([
+	["anon", "Supabase"],
+	["authenticated", "Supabase"],
+	["service_role", "Supabase"]
+]);
+/**
+* The same foreign literals, as a pattern for SQL that could not be parsed
+* back into structure.
+*/
+var FOREIGN_UID_LITERAL_SQL = new RegExp(String.raw`rebase\.uid\(\)\s*=\s*'(${[...FOREIGN_CONVENTION_UIDS.keys()].join("|")})'`, "i");
 /**
 * `rebase.uid() IS NOT NULL` in raw SQL, the clause that is always true.
 *
@@ -2166,17 +2187,27 @@ function findAnonymousGrants(expr) {
 			case "existsIn":
 				visit(e.where);
 				return;
-			case "raw":
+			case "raw": {
 				if (UID_NOT_NULL.test(e.sql)) found.push({
 					pattern: "uid-not-null",
 					detail: e.sql,
 					explanation: `\`rebase.uid() IS NOT NULL\` is true for every request that came from a client, including anonymous ones — they carry '${ANONYMOUS_USER_ID}', not NULL. Use \`condition: policy.authenticated()\` to mean "signed in".`
 				});
+				const foreign = FOREIGN_UID_LITERAL_SQL.exec(e.sql);
+				if (foreign) {
+					const literal = foreign[1];
+					found.push({
+						pattern: "foreign-uid-literal",
+						detail: literal,
+						explanation: `'${literal}' is a ${FOREIGN_CONVENTION_UIDS.get(literal)} convention. Rebase reports an anonymous request as '${ANONYMOUS_USER_ID}', so comparing against '${literal}' passes for every caller. Use \`condition: policy.authenticated()\` to mean "signed in".`
+					});
+				}
 				return;
+			}
 			case "compare": {
 				const literal = [e.left, e.right].find((o) => o.kind === "literal");
 				if (!(e.left.kind === "authUid" || e.right.kind === "authUid") || typeof literal?.value !== "string") return;
-				const platform = FOREIGN_CONVENTION_UIDS[literal.value];
+				const platform = FOREIGN_CONVENTION_UIDS.get(literal.value);
 				if (!platform) return;
 				found.push({
 					pattern: "foreign-uid-literal",
@@ -2451,11 +2482,28 @@ function getIdPropertyName$1(collection) {
 *
 * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
 */
+/**
+* The restrictive write gate for an auth collection.
+*
+* Restrictive, so it is ANDed with everything else: whatever an author's
+* permissive rules allow, a write to this table still has to satisfy this too.
+* It is the only thing standing between "users may edit their own row" and
+* "users may grant themselves any role".
+*/
+function adminWriteGate(tableName) {
+	return {
+		name: `${tableName}_require_admin_write`,
+		mode: "restrictive",
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	};
+}
 function getEffectiveSecurityRules(collection) {
 	const explicit = [...collection.securityRules ?? []];
-	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return explicit;
 	const tableName = getTableName(collection);
 	const injected = [];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return isAuthCollection$1(collection) ? [...explicit, adminWriteGate(tableName)] : explicit;
 	injected.push({
 		name: `${tableName}_default_admin_read`,
 		operations: ["select"],
@@ -2473,13 +2521,7 @@ function getEffectiveSecurityRules(collection) {
 			operations: ["select"],
 			condition: policy.compare(policy.field(getIdPropertyName$1(collection)), "eq", policy.authUid())
 		});
-		injected.push({
-			name: `${tableName}_require_admin_write`,
-			mode: "restrictive",
-			operations: [...DEFAULT_GUARDED_OPS],
-			condition: SERVER_OR_ADMIN_EXPR$1,
-			check: SERVER_OR_ADMIN_EXPR$1
-		});
+		injected.push(adminWriteGate(tableName));
 	}
 	return [...explicit, ...injected];
 }
@@ -3993,6 +4035,17 @@ async function collectAllPages(find, params, label = "collection") {
 * @module
 */
 /**
+* Escape a value for the wire format: `\` → `\\`, `,` → `\,`, `(` → `\(`,
+* `)` → `\)`.
+*/
+/**
+* The wire spelling of an empty list.
+*
+* A lone backslash: unproducible by {@link escapeWireValue}, which doubles
+* every backslash it emits, so it cannot collide with any real item.
+*/
+var EMPTY_LIST_TOKEN = "\\";
+/**
 * Unescape a wire-format value.
 *
 * **Conservative**, and deliberately so: only the four sequences
@@ -4041,7 +4094,199 @@ function splitListItems(inner) {
 	items.push(unescapeWireValue(current));
 	return items;
 }
-var REST_OP_LOOKUP = REST_TO_CANONICAL;
+/**
+* Operator tables as `Map`s, because the key comes off the wire.
+*
+* Indexed as plain objects, every `Object.prototype` member answered: a query
+* string of `?f=valueOf.x` found a truthy "operator" — the inherited function —
+* and `deserializeTuple` returned it *as the operator*, so a function object
+* travelled on into the compilers in place of a `WhereFilterOp`. The guard one
+* line below (`if (!canonicalOp)`) reads as though it rejects anything unknown,
+* and does not: `Object.prototype` is not unknown to a plain object.
+*
+* Same shape as the prototype-key defects swept out of `setIn`, `getIn`,
+* `mergeDeep`, `unflattenObject` and `FOREIGN_CONVENTION_UIDS`.
+*/
+var REST_OP_LOOKUP = new Map(Object.entries(REST_TO_CANONICAL));
+new Map(Object.entries(CANONICAL_TO_REST));
+/** The operator spellings a rejection lists back to the caller. */
+var VALID_OPERATOR_LIST = ALL_WHERE_FILTER_OPS.join(", ");
+/**
+* A filter condition named an operator this dialect does not have.
+*
+* ## Why this throws, rather than returning a typed rejection
+*
+* `deserializeFilter` is the *shared* codec: the REST ingress
+* (`packages/server/src/api/rest/query-parser.ts`), the browser SDK and the
+* admin panel (`buildRebaseData.ts`) all decode through it. Two constraints
+* follow.
+*
+* - It cannot throw the server's `ApiError`. `@rebasepro/common` does not
+*   depend on `@rebasepro/server` (the dependency runs the other way), and a
+*   browser client has no error handler to render an `ApiError` with. So the
+*   rejection is this plain `Error` subclass, whose `message` reads correctly
+*   wherever it surfaces — a rejected promise in an app, a 400 body over HTTP.
+* - It cannot be a returned rejection *value*. Every caller assigns the result
+*   straight into a query it is about to run; a sentinel that none of them
+*   check would be ignored, which is exactly the silently-wrong-filter failure
+*   this exists to stop. Throwing is also what this file already does for the
+*   sibling cases — `serializeTuple` on an unknown canonical operator,
+*   `deserializeLogicalCondition` past the nesting bound — and the REST parser
+*   already converts the latter into a 400.
+*
+* `statusCode`, `code` and `details` are carried as fields because the server's
+* Hono error handler duck-types those off any thrown error: a decode path that
+* forgets to convert still answers 400 with the canonical envelope instead of a
+* 500 that says "An unexpected error occurred". `query-parser.ts` converts
+* explicitly all the same — that is the path the contract is stated on, and an
+* incidental 400 is not a contract.
+*/
+var UnknownFilterOperatorError = class extends Error {
+	/** The field the condition was written against. */
+	field;
+	/** The operator string as it arrived, verbatim. */
+	operator;
+	/** Every operator this dialect accepts, in canonical spelling. */
+	validOperators = ALL_WHERE_FILTER_OPS;
+	/** See the class docblock: read by the server's error handler. */
+	statusCode = 400;
+	code = "UNKNOWN_FILTER_OPERATOR";
+	details;
+	constructor(field, operator) {
+		super(`Unknown filter operator '${operator}' on field '${field}'. Valid operators: ${VALID_OPERATOR_LIST}`);
+		this.name = "UnknownFilterOperatorError";
+		this.field = field;
+		this.operator = operator;
+		this.details = {
+			field,
+			operator,
+			validOperators: ALL_WHERE_FILTER_OPS
+		};
+	}
+};
+/**
+* Two to three characters of ASCII punctuation and nothing else — the shape
+* every symbolic operator has (`==`, `>=`, `<>`, `~~`, `!!`, `>>`, `===`), and
+* one a column value effectively never has.
+*
+* Two characters minimum on purpose. A *single* punctuation character is a
+* perfectly ordinary value — `{ grade: ["-", "+"] }` is a two-item list, not a
+* condition — and the only single-character operator anyone actually mistypes
+* is `=`, which is named separately below. `<` and `>` need no special case:
+* they are real operators and resolve.
+*/
+var SYMBOLIC_OPERATOR = /^[^\p{L}\p{N}\s]{2,3}$/u;
+/** Lowercase, strip everything that is not a letter or digit. */
+function normalizeOperatorName(op) {
+	return op.toLowerCase().replace(/[^a-z0-9]/g, "");
+}
+/**
+* Every real operator name with its case and separators removed, so a
+* respelling of one — `arrayContains`, `not_in`, `NOT-LIKE`, `isNull` — is
+* recognised as an attempt at an operator rather than read as a value.
+*
+* These are rejected rather than accepted: admitting a second spelling of an
+* operator would leave two wire spellings of one thing, and the rejection
+* message names the one that works.
+*/
+var RESPELLED_OPERATORS = new Set([...ALL_WHERE_FILTER_OPS, ...Object.keys(REST_TO_CANONICAL)].map(normalizeOperatorName));
+/**
+* Operator names *other* query dialects use, which this one does not have.
+*
+* This list is curated, and deliberately so. For a word-shaped string there is
+* no rule that separates "an operator the caller guessed" from "a value that
+* happens to be a word": `{ tags: ["a", "b"] }` has to keep meaning a two-item
+* `in` list, so the codec cannot simply refuse every unrecognised word in
+* position 0. The line is therefore drawn by name, and only around names whose
+* use as an operator is far more likely than their use as one of two sibling
+* values. `contains` is the motivating case — the first thing a developer
+* reaches for, and until now it compiled to `title IN ('contains', 'Hell')`.
+*
+* Genuinely ambiguous single words (`any`, `all`, `exists`, `search`, `not`)
+* are left off: as operators they are rare, and as enum values they are common.
+* Everywhere else the tie goes to *rejecting*, because a 400 naming the
+* supported set costs the caller one round trip, and the alternative — which is
+* what every name on this list used to produce — is a query that runs, returns
+* rows, and is wrong.
+*/
+var NEAR_MISS_OPERATORS = /* @__PURE__ */ new Set([
+	"contains",
+	"notcontains",
+	"doesnotcontain",
+	"doesnotcontains",
+	"includes",
+	"notincludes",
+	"startswith",
+	"notstartswith",
+	"beginswith",
+	"startingwith",
+	"endswith",
+	"notendswith",
+	"matches",
+	"notmatches",
+	"regex",
+	"regexp",
+	"between",
+	"notbetween",
+	"equals",
+	"notequals",
+	"equalto",
+	"isequalto",
+	"isnotequalto",
+	"greaterthan",
+	"greaterthanorequal",
+	"greaterthanorequalto",
+	"lessthan",
+	"lessthanorequal",
+	"lessthanorequalto",
+	"isempty",
+	"isnotempty",
+	"oneof",
+	"noneof",
+	"anyof",
+	"allof",
+	"null",
+	"isnullorempty"
+]);
+/**
+* Was this string *meant* as an operator?
+*
+* Only consulted after {@link toCanonicalOp} has already failed to resolve it,
+* so a `true` here is always a rejection.
+*/
+function isOperatorShaped(op) {
+	if (op === "=") return true;
+	if (SYMBOLIC_OPERATOR.test(op)) return true;
+	const normalized = normalizeOperatorName(op);
+	if (!normalized) return false;
+	return RESPELLED_OPERATORS.has(normalized) || NEAR_MISS_OPERATORS.has(normalized);
+}
+/**
+* Read a `[op, value]` tuple, if that is what this is.
+*
+* Three outcomes, and the middle one is the defect this function exists for:
+*
+* - the operator resolves (canonical *or* REST spelling) → the canonical tuple;
+* - the operator does not resolve but was plainly meant as one → throw;
+* - it does not look like an operator at all → `undefined`, and the caller
+*   falls back to reading the array as a list of values.
+*
+* The old test was `toCanonicalOp(raw[0]) === raw[0]`, i.e. canonical spelling
+* only, with *everything else* — including every REST short-code — dropping
+* through to `["in", raw]`. So the operator string itself became a value in a
+* membership test: `["!!", "Hello"]` compiled to `title IN ('!!','Hello')`,
+* which matches, and the caller got back rows their filter was written to
+* exclude. `["eq", "active"]` had the same shape of failure.
+*/
+function readTuple(field, raw) {
+	if (!Array.isArray(raw) || raw.length !== 2) return void 0;
+	const [op, value] = raw;
+	if (typeof op !== "string") return void 0;
+	const canonical = toCanonicalOp(op);
+	if (canonical) return [canonical, value];
+	if (op.includes(".")) return void 0;
+	if (isOperatorShaped(op)) throw new UnknownFilterOperatorError(field, op);
+}
 /**
 * Parse a single PostgREST dot-string into a `[WhereFilterOp, unknown]` tuple.
 *
@@ -4058,10 +4303,13 @@ function deserializeSingle(raw) {
 	if (dotIndex === -1) return ["==", raw];
 	const prefix = raw.substring(0, dotIndex);
 	const rest = raw.substring(dotIndex + 1);
-	const canonicalOp = REST_OP_LOOKUP[prefix];
+	const canonicalOp = REST_OP_LOOKUP.get(prefix);
 	if (!canonicalOp) return ["==", raw];
 	if (NULL_OPS.has(canonicalOp)) return [canonicalOp, null];
-	if (rest.startsWith("(") && rest.endsWith(")")) return [canonicalOp, splitListItems(rest.slice(1, -1))];
+	if (rest.startsWith("(") && rest.endsWith(")")) {
+		const inner = rest.slice(1, -1);
+		return [canonicalOp, inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)];
+	}
 	return [canonicalOp, rest];
 }
 /**
@@ -4076,20 +4324,27 @@ function deserializeSingle(raw) {
 *
 * deserializeFilter({ age: ["gte.18", "lt.65"] })
 * // → { age: [[">=", "18"], ["<", "65"]] }
+*
+* @throws {UnknownFilterOperatorError} when a condition names an operator this
+* dialect does not have. See that class for why a rejection here is a throw.
 */
 function deserializeFilter(query) {
 	const result = {};
 	for (const [field, raw] of Object.entries(query)) {
 		if (raw === void 0) continue;
-		if (Array.isArray(raw) && raw.length === 2 && typeof raw[0] === "string" && toCanonicalOp(raw[0]) === raw[0]) {
-			result[field] = raw;
+		const tuple = readTuple(field, raw);
+		if (tuple) {
+			result[field] = tuple;
 			continue;
 		}
 		if (Array.isArray(raw)) {
 			if (raw.length === 0) continue;
-			if (Array.isArray(raw[0]) && raw[0].length === 2 && typeof raw[0][0] === "string" && toCanonicalOp(raw[0][0]) === raw[0][0]) {
-				result[field] = raw;
-				continue;
+			if (Array.isArray(raw[0])) {
+				const tuples = raw.map((item) => readTuple(field, item));
+				if (tuples.every((t) => t !== void 0)) {
+					result[field] = tuples;
+					continue;
+				}
 			}
 			if (raw.length === 1) result[field] = typeof raw[0] === "string" ? deserializeSingle(raw[0]) : ["==", raw[0]];
 			else if (typeof raw[0] === "string" && raw[0].includes(".")) result[field] = raw.map((r) => typeof r === "string" ? deserializeSingle(r) : ["==", r]);
@@ -5068,4 +5323,4 @@ function isAuthCollection(collection) {
 //#endregion
 export { isManyToMany as $, getTableName as A, normalizeToEntityRelation as B, getEffectiveSecurityRules as C, findRelation as D, findAnonymousGrants as E, isAddressableId as F, getPolicyNamesForRule as G, generateForeignKeyName as H, parseIdValues as I, camelCase as J, isPrototypePollutingKey as K, sortCollectionsBySlug as L, resolveCollectionRelations as M, buildCompositeId as N, getColumnName as O, getDeclaredPrimaryKeys as P, hasForeignKeyOnTarget as Q, createRelationRef as R, resolveJunctionSpecs as S, securityRuleToConditions as T, legacyForeignKeyName as U, updateDateAutoValues as V, toPostgresIdentifier as W, DEFAULT_ONE_OF_TYPE as X, toSnakeCase as Y, DEFAULT_ONE_OF_VALUE as Z, CollectionRegistry as _, SEARCH_STAMP_PREFIX as a, getJunctionCollectionConfig as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, Vector as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, getTableVarName as j, getEnumVarName as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, SEARCH_TEXT_FN as o, searchHelperFunctions as p, mergeDeep as q, authUsersColumnSql as r, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, hiddenColumnsOption as u, relationalCollections as v, policyToPostgres as w, getJunctionSecurityRules as x, resolveStringColumnLength as y, createRelationRefWithData as z };
 
-//# sourceMappingURL=auth-users-columns-CBEOeYqa.js.map
+//# sourceMappingURL=auth-users-columns-BxT6FRyu.js.map