@rebasepro/server-postgres 0.13.1-canary.gef9608c → 0.14.0

package/src/schema/doctor-policy-checks.ts

@@ -0,0 +1,105 @@
+/**
+ * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.
+ *
+ * Lives beside `doctor-cli.ts` rather than inside it because that file runs
+ * `main()` on import: a gate whose failure modes cannot be unit-tested is how
+ * this one shipped reporting success for work it never did.
+ */
+import path from "path";
+import chalk from "chalk";
+import { CollectionConfig } from "@rebasepro/types";
+import { loadCollections } from "./doctor";
+import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
+import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
+
+/**
+ * What the RLS checks concluded.
+ *
+ * `unchecked` exists because "we could not look" and "we looked and it is fine"
+ * used to be reported identically: a collections path that did not resolve made
+ * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
+ * early-returned an empty diff, and the gate printed
+ * `✓ RLS policies match your collections` having compared zero policies against
+ * zero collections. Any exception at all — a collection file that throws on
+ * import, a `pg_policies` read the CI role is not granted, a connection reset —
+ * did the same thing through a `warn`, and exited 0.
+ */
+export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
+
+/**
+ * The exit code for `rebase doctor --policies`.
+ *
+ * A gate that could not run has not passed. Only a completed, clean check
+ * exits 0 — anything else, including "we never opened a connection", is a
+ * failure, or the flag certifies a database nobody looked at.
+ */
+export function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {
+    return status === "ok" ? 0 : 1;
+}
+
+/**
+ * Policies actually deployed vs the ones the collections describe, plus policy
+ * roles this server could never satisfy.
+ *
+ * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
+ */
+export async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {
+    if (!databaseUrl) {
+        console.error(chalk.yellow("  ⚠ No DATABASE_URL — RLS policies were NOT checked"));
+        return "unchecked";
+    }
+
+    const resolvedPath = path.resolve(process.cwd(), collectionsPath);
+    let problems = false;
+    const { Pool } = await import("pg");
+    const pool = new Pool({ connectionString: databaseUrl });
+    try {
+        const collections: CollectionConfig[] = await loadCollections(resolvedPath);
+
+        // Zero collections is not "no drift", it is nothing to compare. The
+        // loader returns `[]` for a path that does not exist, so the commonest
+        // way to get here is a `--collections` path resolved against the wrong
+        // directory — which used to render as a green tick.
+        if (collections.length === 0) {
+            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));
+            console.error(chalk.gray("    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere."));
+            return "unchecked";
+        }
+
+        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];
+
+        // A policy naming a role the server never runs as filters every row, so
+        // the collection reads as empty. Report it without booting a server.
+        try {
+            await validatePolicyPgRoles(runSql, collections as never);
+            console.log(chalk.green("  ✓ Policy roles are usable by this server"));
+        } catch (err) {
+            problems = true;
+            console.log("");
+            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
+        }
+
+        // A rule that reads as a lockdown but is true for every caller compiles
+        // to a grant. Report it without booting a server.
+        warnOnAnonymousGrants(collections as never);
+
+        const drift = await checkPolicyDrift(pool as never, collections);
+        console.log("");
+        if (hasDrift(drift)) {
+            problems = true;
+            console.log(chalk.yellow("  RLS policies: database does not match your collections"));
+            console.log(formatPolicyDrift(drift));
+        } else {
+            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));
+        }
+    } catch (err) {
+        // Fail closed. This catch covers every query and every collection import
+        // above, so returning the pre-catch verdict made the documented CI gate
+        // green on exactly the runs it exists to catch.
+        console.error(chalk.red("  ✗ Could not check RLS policies:"), err instanceof Error ? err.message : String(err));
+        return "unchecked";
+    } finally {
+        await pool.end();
+    }
+    return problems ? "problems" : "ok";
+}

package/src/schema/doctor.ts

@@ -17,7 +17,9 @@ import { generateSchema } from "./generate-drizzle-schema-logic";
 import { generateTypedefs } from "@rebasepro/codegen";
 import { getTableName, resolveCollectionRelations, findRelation, relationalCollections } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
-import { logger, loadCollectionsFromDirectory } from "@rebasepro/server";
+import { loadCollectionsFromDirectory } from "@rebasepro/server";
+// The report is CLI output, not application logging — see cli-output.ts.
+import { out, outError } from "../cli-output";
 
 /**
  * Resolve the SQL column name for a property.
@@ -37,7 +39,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated" | "sdk_ungeneratable";
     table?: string;
     column?: string;
     expected?: string;
@@ -46,11 +48,44 @@ export interface DoctorIssue {
     fix: string;
 }
 
+export interface DoctorPhase {
+    passed: boolean;
+    issues: DoctorIssue[];
+    /**
+     * Why this phase never ran, when it did not.
+     *
+     * A check that did not happen is a third state, not a passing one. While a
+     * skipped phase initialised to `{ passed: true, issues: [] }` it rendered as
+     * `✅ Collections → Database: In sync` and counted towards
+     * `✓ All schemas are in sync!` — so a project whose connection string was
+     * spelled `POSTGRES_URL`, or a CI job that never exported one, got two green
+     * ticks and exit 0 against a database with no tables in it.
+     */
+    skipped?: string;
+    /**
+     * Why this phase had nothing to compare against, when it had nothing.
+     *
+     * Distinct from `skipped`, which means "the check could not run, and that
+     * is probably worth fixing". This one means "the artifact is optional and
+     * you have not asked for it": no drift is possible, so the run is still a
+     * clean bill of health.
+     *
+     * It exists because the alternative was a contradiction. The typed-SDK
+     * phase returned `{ passed: true }` when `generated/sdk/database.types.ts`
+     * did not exist, so a fresh project's report read
+     * `✅ Collections → SDK Types: In sync` directly above
+     * `ℹ Typed SDK not generated (optional).` — one line calling a file
+     * synchronised and the next saying it is absent. "In sync" is a claim about
+     * a comparison, and no comparison happened.
+     */
+    notApplicable?: string;
+}
+
 export interface DoctorReport {
-    collectionsToSchema: { passed: boolean; issues: DoctorIssue[] };
-    collectionsToSdk: { passed: boolean; issues: DoctorIssue[] };
-    schemaToDatabase: { passed: boolean; issues: DoctorIssue[] };
-    summary: { passed: number; warnings: number; errors: number };
+    collectionsToSchema: DoctorPhase;
+    collectionsToSdk: DoctorPhase;
+    schemaToDatabase: DoctorPhase;
+    summary: { passed: number; skipped: number; notApplicable: number; warnings: number; errors: number };
 }
 
 // ── Column type mapping (mirrors generate-drizzle-schema-logic.ts) ───────
@@ -149,7 +184,7 @@ export async function loadCollections(collectionsPath: string): Promise<Collecti
 export async function checkCollectionsVsSchema(
     collections: CollectionConfig[],
     schemaFilePath: string
-): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
+): Promise<DoctorPhase> {
     const issues: DoctorIssue[] = [];
 
     // Check if schema file exists
@@ -210,7 +245,7 @@ issues };
 export async function checkCollectionsVsSdk(
     collections: CollectionConfig[],
     sdkFilePath: string
-): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
+): Promise<DoctorPhase> {
     const issues: DoctorIssue[] = [];
 
     // The typed SDK is opt-in — nothing in a scaffolded project imports it until
@@ -225,7 +260,8 @@ export async function checkCollectionsVsSdk(
             fix: "Run `rebase generate-sdk` if you want typed collection access"
         });
         return { passed: true,
-issues };
+issues,
+notApplicable: "not generated (optional)" };
     }
 
     try {
@@ -250,12 +286,27 @@ issues };
         }
     } catch (err: unknown) {
         const message = err instanceof Error ? err.message : String(err);
-        issues.push({
-            severity: "warning",
-            category: "sdk_stale",
-            message: `Could not regenerate SDK types for comparison: ${message}`,
-            fix: "Run `rebase generate-sdk` to verify"
-        });
+
+        // A `CodegenError` is not "the comparison did not run" — it is the
+        // schema saying it cannot produce a valid typed client at all, most
+        // often two slugs collapsing onto one accessor. Reporting that as a
+        // warning about staleness described the wrong problem and pointed at a
+        // command that would fail the same way.
+        if (err instanceof Error && err.name === "CodegenError") {
+            issues.push({
+                severity: "error",
+                category: "sdk_ungeneratable",
+                message: `The typed SDK cannot be generated from these collections: ${message}`,
+                fix: "Fix the collection definitions named above, then run `rebase generate-sdk`"
+            });
+        } else {
+            issues.push({
+                severity: "warning",
+                category: "sdk_stale",
+                message: `Could not regenerate SDK types for comparison: ${message}`,
+                fix: "Run `rebase generate-sdk` to verify"
+            });
+        }
     }
 
     return { passed: issues.length === 0,
@@ -282,7 +333,7 @@ interface DbEnumValue {
 export async function checkCollectionsVsDatabase(
     collections: CollectionConfig[],
     databaseUrl: string
-): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
+): Promise<DoctorPhase> {
     const issues: DoctorIssue[] = [];
 
     // Dynamic import to avoid loading pg when not needed
@@ -597,96 +648,112 @@ issues };
 // ── Report Rendering ─────────────────────────────────────────────────────
 
 export function renderReport(report: DoctorReport): void {
-    logger.info("");
-    logger.info(chalk.bold("  🩺 Rebase Schema Doctor"));
-    logger.info(chalk.gray("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"));
-    logger.info("");
+    out();
+    out(chalk.bold("  🩺 Rebase Schema Doctor"));
+    out(chalk.gray("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"));
+    out();
 
     // Phase 1
-    renderPhase(
-        "Collections → Generated Schema",
-        report.collectionsToSchema.passed,
-        report.collectionsToSchema.issues
-    );
+    renderPhase("Collections → Generated Schema", report.collectionsToSchema);
 
     // Phase 2
-    renderPhase(
-        "Collections → Database",
-        report.schemaToDatabase.passed,
-        report.schemaToDatabase.issues
-    );
+    renderPhase("Collections → Database", report.schemaToDatabase);
 
     // Phase 3
-    renderPhase(
-        "Collections → SDK Types",
-        report.collectionsToSdk.passed,
-        report.collectionsToSdk.issues
-    );
+    renderPhase("Collections → SDK Types", report.collectionsToSdk);
 
     // Summary
-    logger.info(chalk.gray("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"));
-    const { passed, warnings, errors } = report.summary;
+    out(chalk.gray("  ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━"));
+    const { passed, skipped, notApplicable, warnings, errors } = report.summary;
 
     const parts: string[] = [];
     parts.push(chalk.green(`${passed} passed`));
+    if (skipped > 0) parts.push(chalk.yellow(`${skipped} skipped`));
+    if (notApplicable > 0) parts.push(chalk.gray(`${notApplicable} not applicable`));
     if (warnings > 0) parts.push(chalk.yellow(`${warnings} warnings`));
     if (errors > 0) parts.push(chalk.red(`${errors} errors`));
 
-    logger.info(`  Summary: ${parts.join(", ")}`);
-    logger.info("");
+    out(`  Summary: ${parts.join(", ")}`);
+    out();
 
     if (errors > 0) {
-        logger.info(chalk.red.bold("  ✗ Schema drift detected. Run the suggested fixes above."));
+        out(chalk.red.bold("  ✗ Schema drift detected. Run the suggested fixes above."));
     } else if (warnings > 0) {
-        logger.info(chalk.yellow.bold("  ⚠ Minor issues detected. Consider running the suggested fixes."));
+        out(chalk.yellow.bold("  ⚠ Minor issues detected. Consider running the suggested fixes."));
+    } else if (skipped > 0) {
+        // Never "all schemas are in sync" off the back of a check that did not
+        // run: a clean bill of health has to come from measurement.
+        out(chalk.yellow.bold(`  ⚠ Nothing wrong in the checks that ran, but ${skipped} did not run — this is not a clean bill of health.`));
     } else {
-        logger.info(chalk.green.bold("  ✓ All schemas are in sync!"));
+        out(chalk.green.bold("  ✓ All schemas are in sync!"));
     }
-    logger.info("");
+    out();
 }
 
-function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
+function renderPhase(label: string, phase: DoctorPhase): void {
+    // A phase that never ran gets its own marker and its reason. It is neither
+    // "In sync" nor a drift report; conflating it with the former is what let
+    // doctor certify a database it had not opened.
+    if (phase.skipped) {
+        out(`  ${chalk.yellow("⏭")}  ${label}: ${chalk.yellow(`skipped (${phase.skipped})`)}`);
+        out();
+        return;
+    }
+
+    // Nothing to compare against. Its own marker, and only the remedy under it
+    // — the phase header already carries the reason, so re-printing the note
+    // would say the same thing twice. See DoctorPhase.notApplicable.
+    if (phase.notApplicable) {
+        out(`  ${chalk.gray("➖")} ${label}: ${chalk.gray(phase.notApplicable)}`);
+        for (const issue of phase.issues.filter((i) => i.severity === "info")) {
+            out(`     ${chalk.gray(issue.fix)}`);
+        }
+        out();
+        return;
+    }
+
+    const issues = phase.issues;
     const errorCount = issues.filter((i) => i.severity === "error").length;
     const warnCount = issues.filter((i) => i.severity === "warning").length;
     const infoIssues = issues.filter((i) => i.severity === "info");
 
     // Informational notes don't make a phase unhealthy, so key the header off
-    // real problems rather than `passed` alone.
+    // real problems rather than `phase.passed` alone.
     if (errorCount === 0 && warnCount === 0) {
-        logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
+        out(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
-        logger.info(`  ${chalk.yellow("⚠️")}  ${label}: ${chalk.yellow(parts.join(", "))}`);
+        out(`  ${chalk.yellow("⚠️")}  ${label}: ${chalk.yellow(parts.join(", "))}`);
     }
-    logger.info("");
+    out();
 
     // Notes render as a quiet one-liner, not a full drift box.
     for (const issue of infoIssues) {
         const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
-        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
-        logger.info("");
+        out(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
+        out();
     }
 
     for (const issue of issues.filter((i) => i.severity !== "info")) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
-        logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
+        out(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
 
         if (issue.table) {
             const colPart = issue.column ? ` │ Column: ${chalk.cyan(issue.column)}` : "";
-            logger.info(`  ${chalk.gray("│")} Table: ${chalk.cyan(issue.table)}${colPart}`);
+            out(`  ${chalk.gray("│")} Table: ${chalk.cyan(issue.table)}${colPart}`);
         }
 
         if (issue.expected && issue.actual) {
-            logger.info(`  ${chalk.gray("│")} Expected: ${chalk.green(issue.expected)} │ Actual: ${chalk.red(issue.actual)}`);
+            out(`  ${chalk.gray("│")} Expected: ${chalk.green(issue.expected)} │ Actual: ${chalk.red(issue.actual)}`);
         }
 
-        logger.info(`  ${chalk.gray("│")} ${issue.message}`);
-        logger.info(`  ${chalk.gray("│")} Fix: ${chalk.blue(issue.fix)}`);
-        logger.info(`  ${chalk.gray("└" + "─".repeat(48))}`);
-        logger.info("");
+        out(`  ${chalk.gray("│")} ${issue.message}`);
+        out(`  ${chalk.gray("│")} Fix: ${chalk.blue(issue.fix)}`);
+        out(`  ${chalk.gray("└" + "─".repeat(48))}`);
+        out();
     }
 }
 
@@ -701,7 +768,8 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
         sdk_stale: "Stale SDK Types",
-        sdk_not_generated: "SDK Types Not Generated"
+        sdk_not_generated: "SDK Types Not Generated",
+        sdk_ungeneratable: "SDK Cannot Be Generated"
     };
     return labels[cat];
 }
@@ -714,38 +782,47 @@ export async function runDoctor(options: {
     sdkPath: string;
     databaseUrl?: string;
 }): Promise<DoctorReport> {
-    logger.info("");
-    logger.info(chalk.bold("  🩺 Loading collections..."));
+    out();
+    out(chalk.bold("  🩺 Loading collections..."));
     const collections = await loadCollections(options.collectionsPath);
     if (collections.length === 0) {
-        logger.error(chalk.red("  ✗ No collections found."));
+        outError(chalk.red("  ✗ No collections found."));
         process.exit(1);
     }
-    logger.info(chalk.gray(`  Found ${collections.length} collection(s)`));
-    logger.info("");
+    out(chalk.gray(`  Found ${collections.length} collection(s)`));
+    out();
 
     // Phase 1: Collections ↔ Generated Schema
-    logger.info(chalk.gray("  Checking Collections → Generated Schema..."));
+    out(chalk.gray("  Checking Collections → Generated Schema..."));
     const collectionsToSchema = await checkCollectionsVsSchema(collections, options.schemaPath);
 
     // Phase 2: Collections ↔ Database (only if we have a DATABASE_URL)
-    let schemaToDatabase: { passed: boolean; issues: DoctorIssue[] } = { passed: true,
-issues: [] };
+    let schemaToDatabase: DoctorPhase;
     if (options.databaseUrl) {
-        logger.info(chalk.gray("  Checking Collections → Database..."));
+        out(chalk.gray("  Checking Collections → Database..."));
         schemaToDatabase = await checkCollectionsVsDatabase(collections, options.databaseUrl);
     } else {
-        logger.info(chalk.yellow("  ⚠ DATABASE_URL not set — skipping database comparison."));
-        logger.info(chalk.gray("    Set DATABASE_URL in your .env to enable full drift detection."));
+        // Not `{ passed: true }`: see DoctorPhase.skipped.
+        schemaToDatabase = { passed: false,
+issues: [],
+skipped: "DATABASE_URL not set" };
+        out(chalk.yellow("  ⚠ DATABASE_URL not set — skipping database comparison."));
+        out(chalk.gray("    Set DATABASE_URL in your .env to enable full drift detection."));
     }
 
     // Phase 3: Collections ↔ SDK Types
-    logger.info(chalk.gray("  Checking Collections → SDK Types..."));
+    out(chalk.gray("  Checking Collections → SDK Types..."));
     const collectionsToSdk = await checkCollectionsVsSdk(collections, options.sdkPath);
 
-    const allIssues = [...collectionsToSchema.issues, ...schemaToDatabase.issues, ...collectionsToSdk.issues];
+    const phases = [collectionsToSchema, schemaToDatabase, collectionsToSdk];
+    const allIssues = phases.flatMap((p) => p.issues);
     const summary = {
-        passed: [collectionsToSchema, schemaToDatabase, collectionsToSdk].filter((p) => p.passed).length,
+        // A skipped phase is not a passing one, however few issues it collected.
+        // Nor is one with nothing to compare against: "passed" would put a
+        // never-generated SDK in the same column as a verified one.
+        passed: phases.filter((p) => p.passed && !p.skipped && !p.notApplicable).length,
+        skipped: phases.filter((p) => p.skipped).length,
+        notApplicable: phases.filter((p) => p.notApplicable && !p.skipped).length,
         warnings: allIssues.filter((i) => i.severity === "warning").length,
         errors: allIssues.filter((i) => i.severity === "error").length
     };

package/src/schema/ensure-collection-policies.ts

@@ -32,8 +32,10 @@
  * exactly which collection is not yet servable and why.
  */
 import { type CollectionConfig } from "@rebasepro/types";
-import { planCollectionPolicies } from "./generate-postgres-ddl-logic";
+import { planCollectionPolicies, type CollectionPolicyPlan } from "./generate-postgres-ddl-logic";
+import { isGeneratedPolicyName } from "../security/policy-drift";
 import { readExistingSchema, type Queryable } from "./ensure-collection-tables";
+import { REBASE_USER_ROLE } from "../security/rls-enforcement";
 
 export interface PolicyEnsureResult {
     /** `CREATE POLICY` statements that ran successfully. */
@@ -42,8 +44,36 @@ export interface PolicyEnsureResult {
     tablesSecured: number;
     /** Declared tables absent from the database — left to a real migration. */
     skipped: { table: string; reason: string }[];
-    /** Tables whose RLS could not be fully applied (fail closed). */
+    /**
+     * Tables that have RLS on but did not get every policy. They deny — RLS
+     * with no matching policy is deny-all — so they are safe but not servable.
+     */
     failures: { table: string; error: string }[];
+    /**
+     * Tables RLS could not be enabled on, whose DML grant was withdrawn instead.
+     *
+     * This state had no name, and that was the bug: `ENABLE ROW LEVEL SECURITY`
+     * failing was recorded as a `failure` and reported with the same "it stays
+     * locked (denies)" wording as a failed policy — but the two are opposites.
+     * A policy statement failing leaves RLS on and the table denying. `enableRls`
+     * failing leaves RLS *off*, and the schema-wide grant to the user role has
+     * already been made by `ensureRlsEnforcement`, so the table is readable and
+     * writable by every authenticated request with no row filtering at all.
+     */
+    unsecured: { table: string; error: string; grantWithdrawn: boolean }[];
+    /**
+     * Generated policies removed because no current rule produces them.
+     *
+     * A policy's name embeds a hash of the rule's semantics, so editing a rule
+     * does not update a policy — it creates a new one and abandons the old.
+     * Postgres ORs permissive policies, so the abandoned one keeps granting:
+     * a `USING (true)` tightened to an owner check went on admitting everyone,
+     * forever, while the deploy logged success.
+     *
+     * `db push` reconciles this, and cannot reach a managed tenant's in-cluster
+     * database — which is the reason this module exists. So boot has to do it.
+     */
+    orphansDropped: number;
 }
 
 const isCreatePolicy = (statement: string): boolean => /^\s*CREATE POLICY/i.test(statement);
@@ -56,12 +86,46 @@ const isCreatePolicy = (statement: string): boolean => /^\s*CREATE POLICY/i.test
  * to create (a junction, or a relation left to a migration). Enabling RLS on a
  * non-existent table would error, so those are recorded as skipped, not failed.
  */
+
+/**
+ * Remove generated policies on this table that the current plan does not
+ * produce.
+ *
+ * Scoped hard, because dropping a policy is destructive: only this one table,
+ * only names matching the generated `<table>_<op>_<sha1>` shape, and only names
+ * absent from the statements just applied. A hand-written policy, or one
+ * belonging to another table, is never touched — `isGeneratedPolicyName` is the
+ * same predicate `db push` uses to draw that line.
+ */
+async function dropOrphanedPoliciesOn(client: Queryable, plan: CollectionPolicyPlan): Promise<number> {
+    const expected = new Set<string>();
+    for (const statement of plan.policyStatements) {
+        const match = /^\s*CREATE POLICY\s+"([^"]+)"/i.exec(statement);
+        if (match) expected.add(match[1]);
+    }
+
+    const existing = await client.query<{ policyname: string }>(
+        `SELECT policyname FROM pg_policies WHERE schemaname = '${plan.schema.replace(/'/g, "''")}' ` +
+        `AND tablename = '${plan.table.replace(/'/g, "''")}'`
+    );
+
+    let dropped = 0;
+    for (const row of existing.rows) {
+        const name = row.policyname;
+        if (expected.has(name)) continue;
+        if (!isGeneratedPolicyName(name, plan.table)) continue;
+        await client.query(`DROP POLICY IF EXISTS "${name}" ON "${plan.schema}"."${plan.table}"`);
+        dropped++;
+    }
+    return dropped;
+}
+
 export async function ensureCollectionPolicies(
     client: Queryable,
     collections: CollectionConfig[],
     log?: (message: string) => void
 ): Promise<PolicyEnsureResult> {
-    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [] };
+    const result: PolicyEnsureResult = { policiesApplied: 0, tablesSecured: 0, skipped: [], failures: [], unsecured: [], orphansDropped: 0 };
 
     const plans = planCollectionPolicies(collections);
     if (plans.length === 0) return result;
@@ -78,12 +142,36 @@ export async function ensureCollectionPolicies(
             continue;
         }
 
+        // Enabling RLS is its own step, because its failure is the opposite of
+        // every other failure here. Once RLS is on, anything that goes wrong
+        // afterwards leaves the table denying; while it is off, the grant made
+        // earlier in boot leaves the table wide open. Sharing one `try` meant
+        // the dangerous case was reported in the safe case's words.
         try {
-            // Enable first: if a later policy statement fails, the table is left
-            // locked (deny-all for the user role) rather than open.
             await client.query(plan.enableRls);
             result.tablesSecured++;
+        } catch (err) {
+            const error = err instanceof Error ? err.message : String(err);
+            // Take the privilege back rather than serve an unprotected table.
+            // This is the fail-closed step the old code assumed it already had:
+            // per-table, so one collection cannot take the rest of the
+            // deployment down, but leaving nothing readable without RLS.
+            let grantWithdrawn = false;
+            try {
+                await client.query(`REVOKE ALL PRIVILEGES ON ${plan.qualified} FROM ${REBASE_USER_ROLE}`);
+                grantWithdrawn = true;
+            } catch {
+                // Fall through: reported below with `grantWithdrawn: false`,
+                // which the caller escalates. There is nothing else this
+                // function can do to make the table safe.
+            }
+            result.unsecured.push({ table: plan.qualified,
+error,
+grantWithdrawn });
+            continue;
+        }
 
+        try {
             let created = 0;
             for (const statement of plan.policyStatements) {
                 await client.query(statement);
@@ -92,7 +180,12 @@ export async function ensureCollectionPolicies(
                     created++;
                 }
             }
-            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied`);
+
+            const orphans = await dropOrphanedPoliciesOn(client, plan);
+            result.orphansDropped += orphans;
+
+            log?.(`${plan.qualified}: RLS enabled, ${created} policy(ies) applied` +
+                (orphans > 0 ? `, ${orphans} orphan(s) dropped` : ""));
         } catch (err) {
             result.failures.push({
                 table: plan.qualified,