@rebasepro/server-postgres 0.13.1-canary.gef9608c → 0.14.0

package/src/schema/introspect-db.ts

@@ -14,10 +14,11 @@ import {
     mergeIndexContent,
     safeHostFromUrl
 } from "./introspect-db-logic";
+import { detectCollectionBuilder } from "./introspect-db-project";
 import { countRowsUpTo, readSchemaMetadata } from "./introspect-db-queries";
 import { classifyTables, lookupCandidates, LOOKUP_MAX_ROWS } from "./introspect-db-structure";
 import { parseCheckConstraints } from "./introspect-db-constraints";
-import { logger } from "@rebasepro/server";
+import { out, outWarn, outError } from "../cli-output";
 
 async function main() {
     const args = arg(
@@ -59,14 +60,14 @@ async function main() {
 
     for (const p of envPaths) {
         if (fs.existsSync(p)) {
-            dotenv.config({ path: p });
+            dotenv.config({ path: p, quiet: true });
             break;
         }
     }
 
     const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
     if (!databaseUrl) {
-        logger.error(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
+        outError(chalk.red("✗ DATABASE_URL is not set. Make sure your .env file is configured."));
         process.exit(1);
     }
 
@@ -75,15 +76,15 @@ async function main() {
     try {
         await client.connect();
     } catch (err) {
-        logger.error(chalk.red(`✗ Failed to connect to database: ${err instanceof Error ? err.message : String(err)}`));
-        logger.error(chalk.gray("  Check your DATABASE_URL and ensure the database is reachable."));
+        outError(chalk.red(`✗ Failed to connect to database: ${err instanceof Error ? err.message : String(err)}`));
+        outError(chalk.gray("  Check your DATABASE_URL and ensure the database is reachable."));
         process.exit(1);
     }
 
     // Log the host portion safely — handle URLs without "@"
     const hostPart = safeHostFromUrl(databaseUrl);
-    logger.info(chalk.gray(`Connected to database: ${hostPart}`));
-    logger.info(chalk.gray(`Introspecting schema '${pgSchema}'...`));
+    out(chalk.gray(`Connected to database: ${hostPart}`));
+    out(chalk.gray(`Introspecting schema '${pgSchema}'...`));
 
     try {
         const metadata = await readSchemaMetadata(client, pgSchema);
@@ -101,12 +102,28 @@ async function main() {
             } catch (err) {
                 // A table this run cannot read is simply not classified as a code
                 // list; everything else about it still generates.
-                logger.info(chalk.gray(`  (skipped row count for ${table}: ${err instanceof Error ? err.message : String(err)})`));
+                out(chalk.gray(`  (skipped row count for ${table}: ${err instanceof Error ? err.message : String(err)})`));
             }
         }
 
         const classifications = classifyTables(metadata, tablesMap);
         const checkFacts = parseCheckConstraints(metadata.checks);
+
+        // Which builder the generated files may import — read from the manifests
+        // above `outDir`, because a project without `@rebasepro/admin-types` cannot
+        // resolve that import and has no `admin` block to write into either.
+        const builder = detectCollectionBuilder(outDir);
+        if (builder === "annotation") {
+            outWarn(chalk.yellow(
+                "⚠ Neither @rebasepro/admin-types nor @rebasepro/common is declared above " +
+                `${outDir}.`
+            ));
+            outWarn(chalk.gray(
+                "  Generating plain type annotations, which widen the property keys to `string`: " +
+                "`propertiesOrder` and friends will not be checked. Add @rebasepro/common to the " +
+                "config package to turn that checking on."
+            ));
+        }
         const joinTables = new Set(
             Array.from(classifications.values())
                 .filter((c) => c.role === "junction")
@@ -116,8 +133,8 @@ async function main() {
         const roleCount = (role: string) =>
             Array.from(classifications.values()).filter((c) => c.role === role).length;
 
-        logger.info(chalk.blue(`Found ${tablesMap.size} tables.`));
-        logger.info(chalk.gray(
+        out(chalk.blue(`Found ${tablesMap.size} tables.`));
+        out(chalk.gray(
             `  ${roleCount("entity")} entities, ${joinTables.size} join tables (folded into relations), ` +
             `${roleCount("lookup")} code lists, ${roleCount("owned-child")} owned by another table (hidden from navigation).`
         ));
@@ -130,7 +147,7 @@ async function main() {
         } else if (!process.stdin.isTTY) {
             // No terminal to answer the question below (scaffolding scripts, CI,
             // `rebase init --introspect`) — asking would hang forever.
-            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
+            out(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -142,7 +159,7 @@ async function main() {
         }
 
         if (runDataInference) {
-            logger.info(chalk.gray("Sampling database rows for data inference..."));
+            out(chalk.gray("Sampling database rows for data inference..."));
         }
 
         // Generate Collections
@@ -169,7 +186,7 @@ async function main() {
                         const { rows } = await client.query(`SELECT * FROM "${pgSchema}"."${tableName}" LIMIT 100`);
                         sampleData = rows;
                     } catch (err) {
-                        logger.error(chalk.yellow(`⚠ Failed to sample data for table ${tableName}: ${err instanceof Error ? err.message : String(err)}`));
+                        outError(chalk.yellow(`⚠ Failed to sample data for table ${tableName}: ${err instanceof Error ? err.message : String(err)}`));
                     }
                 }
 
@@ -181,12 +198,12 @@ async function main() {
                     tablesMap,
                     enumMap,
                     sampleData,
-                    { metadata, classifications, checkFacts }
+                    { metadata, classifications, checkFacts, builder }
                 );
 
                 fs.writeFileSync(filePath, fileContent, "utf-8");
                 generatedFiles.push(tableName);
-                logger.info(chalk.green(`  ✓ ${filePath}`));
+                out(chalk.green(`  ✓ ${filePath}`));
             }));
         }
 
@@ -213,21 +230,21 @@ async function main() {
                 const indexContent = generateIndexContent(allFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
-            logger.info(chalk.green(`  ✓ ${indexPath}`));
+            out(chalk.green(`  ✓ ${indexPath}`));
         }
 
-        logger.info("");
+        out("");
         if (skippedFiles.length > 0) {
-            logger.info(chalk.yellow(`⚠ Skipped ${skippedFiles.length} existing file(s): ${skippedFiles.join(", ")}`));
-            logger.info(chalk.gray("  Use --force to overwrite existing files."));
-            logger.info("");
+            out(chalk.yellow(`⚠ Skipped ${skippedFiles.length} existing file(s): ${skippedFiles.join(", ")}`));
+            out(chalk.gray("  Use --force to overwrite existing files."));
+            out("");
         }
-        logger.info(chalk.bold.green(`✓ Introspected ${tablesMap.size} tables — generated ${generatedFiles.length} collection(s).`));
-        logger.info(chalk.gray(`  Review the generated files in ${outDir} and customize properties as needed.`));
-        logger.info("");
+        out(chalk.bold.green(`✓ Introspected ${tablesMap.size} tables — generated ${generatedFiles.length} collection(s).`));
+        out(chalk.gray(`  Review the generated files in ${outDir} and customize properties as needed.`));
+        out("");
 
     } catch (e) {
-        logger.error(chalk.red(`✗ Error introspecting database: ${e instanceof Error ? e.message : String(e)}`));
+        outError(chalk.red(`✗ Error introspecting database: ${e instanceof Error ? e.message : String(e)}`));
         process.exit(1);
     } finally {
         await client.end();
@@ -235,6 +252,6 @@ async function main() {
 }
 
 main().catch((err) => {
-    logger.error(String(err));
+    outError(String(err));
     process.exit(1);
 });

package/src/schema/introspect-runtime.ts

@@ -28,6 +28,7 @@ import {
     getIconForTable
 } from "./introspect-db-logic";
 import { humanize } from "./introspect-db-naming";
+import { firstFreeKey, toWireKey } from "@rebasepro/utils";
 
 export interface IntrospectedSchema {
     tablesMap: Map<string, TableMeta>;
@@ -169,6 +170,7 @@ function buildProperties(
     enumMap: Map<string, string[]>
 ): Record<string, Record<string, unknown>> {
     const properties: Record<string, Record<string, unknown>> = {};
+    const takenKeys = new Set<string>();
 
     for (const col of meta.columns) {
         const isPk = meta.pks.includes(col.column_name);
@@ -188,7 +190,17 @@ function buildProperties(
             type: propType
         };
 
-        const key = col.column_name;
+        // The wire name, with `columnName` above carrying the column. The two
+        // are different names for different things — this used to serve the
+        // column, so a runtime-introspected collection answered `user_id` while
+        // every authored one beside it answered `displayName`.
+        //
+        // `user_id` and `userId` as two real columns camel-case to one key, so
+        // the first free candidate wins and the second falls back to its own
+        // column name, then to a numbered tail. Never dropped, and stable for a
+        // given database: columns arrive in ordinal order.
+        const key = firstFreeKey([toWireKey(col.column_name), col.column_name], takenKeys);
+        takenKeys.add(key);
 
         if (isPk) {
             property.isId = idKindFor(col, propType);
@@ -239,7 +251,7 @@ function buildRelations(
         if (!targetSlug) continue;
 
         // Strip the conventional _id suffix: author_id -> author
-        let key = fk.column_name.replace(/_id$/, "");
+        let key = toWireKey(fk.column_name.replace(/_id$/, ""));
         if (meta.pks.includes(fk.column_name) && key === fk.column_name) {
             // The FK is also the PK and its name doesn't imply a relation (e.g.
             // "id"), so naming the relation after the column would collide with

package/src/schema/rls-bootstrap-sql.ts

@@ -0,0 +1,288 @@
+import { LEGACY_RLS_SCHEMA, REBASE_SCHEMA } from "@rebasepro/types";
+
+/**
+ * Canonical SQL bootstrap for the RLS helper functions.
+ *
+ * Generated RLS policies reference `rebase.uid()` / `rebase.roles()` /
+ * `rebase.jwt()`, so any SQL stream that can contain policies must be
+ * self-contained: it has to (re)create these helpers first. This matters for
+ * the migration directory in particular — Atlas replays migrations against a
+ * clean dev database where no out-of-band bootstrap has ever run, so a
+ * migration carrying policies without this preamble fails with
+ * "function rebase.uid() does not exist".
+ *
+ * Idempotent (`IF NOT EXISTS` / `OR REPLACE`) so it can be prepended to every
+ * policies block and re-applied freely. The runtime boot path
+ * (`auth/ensure-tables.ts`) creates the same functions under an advisory lock
+ * for HMR-safety; keep the definitions in sync.
+ *
+ * ## Creating the `rebase` schema here is now safe, and required
+ *
+ * It deliberately did not, once. These functions lived in a schema called
+ * `auth`, and the note here read: creating `rebase` would leak it into Atlas's
+ * replayed migration state, and — absent from the desired `schema.sql` — Atlas
+ * would then plan `DROP SCHEMA "rebase" CASCADE`, taking the auth tables with
+ * it. That reasoning still holds; what changed is the second half of it. The
+ * DDL generator now emits `CREATE SCHEMA IF NOT EXISTS "rebase"`
+ * unconditionally, so the schema is always in the desired state and the diff is
+ * empty. (It used to appear only when some collection happened to declare
+ * `schema: "rebase"` — true for the scaffold's users collection, and not a
+ * property anything guaranteed.) `db push` additionally excludes the whole
+ * schema from the declarative apply.
+ *
+ * See `@rebasepro/types`' `rls-functions` for why the functions moved out of
+ * `auth` at all: the short version is that the name was Supabase's, and
+ * `CREATE OR REPLACE FUNCTION auth.uid() RETURNS text` cannot be applied over
+ * Supabase's `RETURNS uuid` — Postgres refuses, and the refusal used to be
+ * swallowed.
+ */
+/**
+ * The bootstrap as individual statements.
+ *
+ * Kept as an array because the two consumers need different shapes and only one
+ * of them can take a multi-command string: the migration preamble is written to
+ * a file and replayed by Atlas, but the boot path runs through drizzle, whose
+ * node-postgres handle speaks the extended query protocol and rejects more than
+ * one command per call. Splitting a joined string back apart on `$$;` would be
+ * a parser for a problem that does not need one.
+ */
+export const RLS_BOOTSTRAP_STATEMENTS: readonly string[] = [
+    `CREATE SCHEMA IF NOT EXISTS ${REBASE_SCHEMA}`,
+
+    // Falls back to the pre-rename `app.user_id` so a database that has taken
+    // the new schema but is still served by an older backend keeps resolving
+    // the principal. Drop the COALESCE once no such deployment remains.
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.uid() RETURNS text AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.uid', true), ''),
+        NULLIF(current_setting('app.user_id', true), '')
+    );
+$$ LANGUAGE sql STABLE`,
+
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.jwt() RETURNS jsonb AS $$
+    SELECT COALESCE(
+        NULLIF(current_setting('app.jwt', true), ''),
+        '{}'
+    )::jsonb;
+$$ LANGUAGE sql STABLE`,
+
+    `CREATE OR REPLACE FUNCTION ${REBASE_SCHEMA}.roles() RETURNS text AS $$
+    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+$$ LANGUAGE sql STABLE`
+];
+
+/** The same statements as one script, for migration files and raw clients. */
+export const RLS_BOOTSTRAP_SQL =
+    "-- Rebase schema + RLS helper functions (required by the policies below)\n" +
+    RLS_BOOTSTRAP_STATEMENTS.map(s => `${s};`).join("\n\n") + "\n";
+
+/**
+ * Removes the pre-1.0 `auth` schema, but only when Rebase is what put it there.
+ *
+ * ## Why this is safe against a Supabase database
+ *
+ * Two independent guards, and both have to pass:
+ *
+ *  1. **Each function is identified before it is dropped.** Ours returns `text`
+ *     and reads the `app.uid` GUC; Supabase's returns `uuid` and reads
+ *     `request.jwt.claims`. Nothing is dropped on a signature we did not write,
+ *     so a Supabase database — where our `CREATE OR REPLACE` could never have
+ *     succeeded in the first place, Postgres refusing to change a return type —
+ *     matches nothing and this is a no-op.
+ *  2. **`DROP SCHEMA … RESTRICT`**, never CASCADE. If anything else at all still
+ *     lives in `auth` (Supabase's `users` table, its other helpers), the drop
+ *     fails and the schema stays. CASCADE here would be unrecoverable.
+ *
+ * ## Why it cannot run too early
+ *
+ * Postgres records a dependency from every RLS policy to the functions its body
+ * calls, so `DROP FUNCTION auth.uid()` fails for as long as a single policy
+ * still references it. That is the interlock, and it is load-bearing: the drop
+ * can only succeed once every policy has been recompiled to \`rebase.uid()\`.
+ * Callers therefore run this *after* applying policies, and treat a failure as
+ * "not yet — try again next boot" rather than as an error.
+ */
+export const DROP_LEGACY_AUTH_SCHEMA_SQL = `
+DO $rebase_drop_legacy$
+DECLARE
+    dropped_any boolean := false;
+BEGIN
+    -- Each function is matched on its own result type and body, so a schema
+    -- that merely shares the name keeps everything it has.
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'uid'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.uid%'
+    ) THEN
+        DROP FUNCTION auth.uid();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'jwt'
+          AND pg_get_function_result(p.oid) = 'jsonb'
+          AND p.prosrc LIKE '%app.jwt%'
+    ) THEN
+        DROP FUNCTION auth.jwt();
+        dropped_any := true;
+    END IF;
+
+    IF EXISTS (
+        SELECT 1 FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+        WHERE n.nspname = 'auth' AND p.proname = 'roles'
+          AND pg_get_function_result(p.oid) = 'text'
+          AND p.prosrc LIKE '%app.user_roles%'
+    ) THEN
+        DROP FUNCTION auth.roles();
+        dropped_any := true;
+    END IF;
+
+    -- RESTRICT: only an empty schema goes. Anything else in there — including a
+    -- Supabase installation left untouched above — keeps it.
+    IF dropped_any THEN
+        BEGIN
+            EXECUTE 'DROP SCHEMA auth RESTRICT';
+        EXCEPTION WHEN OTHERS THEN
+            NULL;
+        END;
+    END IF;
+END
+$rebase_drop_legacy$;
+`;
+
+/** Somebody's policy that still calls a pre-1.0 helper. */
+export interface LegacyRlsDependent {
+    schema: string;
+    table: string;
+    policy: string;
+}
+
+/**
+ * Policies whose body still calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+ *
+ * Postgres will not drop a function a policy depends on, so this is exactly the
+ * set standing between a database and losing the legacy schema. Rebase's own
+ * policies leave the list on the next push or boot, when they are recompiled —
+ * anything still here afterwards is hand-written, will never be recompiled by
+ * anybody, and is the reason the drop keeps being skipped. Silence there would
+ * leave an operator staring at a schema the release notes said would go.
+ */
+export const LEGACY_RLS_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, c.relname AS "table", p.polname AS policy
+    FROM pg_policy p
+    JOIN pg_class c ON c.oid = p.polrelid
+    JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE pg_get_expr(p.polqual, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+       OR pg_get_expr(p.polwithcheck, p.polrelid) ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2, 3
+`;
+
+/** Somebody's *function* that still calls a pre-1.0 helper from its own body. */
+export interface LegacyRlsFunctionDependent {
+    schema: string;
+    function: string;
+}
+
+/**
+ * Functions whose body calls `auth.uid()` / `auth.roles()` / `auth.jwt()`.
+ *
+ * This is the half `DROP FUNCTION ... RESTRICT` cannot see, and the reason it
+ * needs its own query. Postgres records a dependency for a *policy* that calls a
+ * function, which is why the drop is safe against the policies above — but a
+ * `LANGUAGE sql` function whose body is a **string literal** is not parsed when
+ * it is created, so nothing is recorded and `RESTRICT` has nothing to refuse on.
+ * The drop succeeds and the caller is left pointing at a function that no longer
+ * exists, which fails at *query* time rather than at boot.
+ *
+ * A downstream project building on these helpers is not hypothetical: the Rebase
+ * control plane defines `auth.is_org_member(uuid)` and `auth.is_org_admin(uuid)`
+ * in this very schema, each calling `auth.uid()` in a string body, and eleven of
+ * its row-level-security policies go through them. Every one of those would have
+ * started failing the first time a recompile left no policy referencing
+ * `auth.uid()` directly — the drop's own precondition.
+ *
+ * Matching on the body text is the only option available, and it is deliberately
+ * broad: a false positive costs a schema that stays one release longer and says
+ * why, while a false negative costs somebody their policies.
+ */
+export const LEGACY_RLS_FUNCTION_DEPENDENTS_SQL = `
+    SELECT n.nspname AS schema, p.proname AS function
+    FROM pg_proc p
+    JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+      AND NOT (n.nspname = '${LEGACY_RLS_SCHEMA}' AND p.proname IN ('uid', 'jwt', 'roles'))
+      AND p.prosrc ~* '\\m${LEGACY_RLS_SCHEMA}\\.(uid|jwt|roles)\\s*\\('
+    ORDER BY 1, 2
+`;
+
+/**
+ * Retire the pre-1.0 `auth` schema, reporting what is holding it back.
+ *
+ * The shared implementation behind the CLI's post-push step and the runtime's
+ * post-policy step. Both used to just fire {@link DROP_LEGACY_AUTH_SCHEMA_SQL}
+ * and swallow whatever came back, which is right for the ordinary case — a
+ * table not recompiled *yet* — and wrong for the one that never resolves: a
+ * hand-written policy nothing will ever rewrite. Then the schema stays forever
+ * and nothing ever says why.
+ */
+export async function dropLegacyAuthSchema(
+    run: (sql: string) => Promise<Record<string, unknown>[]>,
+    report: { info: (m: string) => void; warn: (m: string) => void }
+): Promise<void> {
+    let blockers: LegacyRlsDependent[];
+    try {
+        blockers = (await run(LEGACY_RLS_DEPENDENTS_SQL)) as unknown as LegacyRlsDependent[];
+    } catch {
+        return; // No catalogue access; nothing here is worth failing a boot for.
+    }
+
+    if (blockers.length > 0) {
+        report.warn(
+            `The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${blockers.length} ` +
+            `${blockers.length === 1 ? "policy still calls" : "policies still call"} ` +
+            `\`${LEGACY_RLS_SCHEMA}.uid()\` and friends, and Postgres will not drop a function a policy ` +
+            `depends on. Rebase's own policies are ` +
+            `rewritten automatically — anything listed here is hand-written SQL that has to be updated to ` +
+            `\`${REBASE_SCHEMA}.uid()\` by hand, after which the schema goes on its own:\n` +
+            blockers.map(b => `  • ${b.schema}.${b.table} → "${b.policy}"`).join("\n")
+        );
+        return;
+    }
+
+    // The half Postgres will not refuse on. See LEGACY_RLS_FUNCTION_DEPENDENTS_SQL:
+    // a string-literal SQL body records no dependency, so `DROP FUNCTION` drops
+    // out from under a caller that is still using it and nothing complains until
+    // a query runs.
+    let borrowers: LegacyRlsFunctionDependent[];
+    try {
+        borrowers = (await run(LEGACY_RLS_FUNCTION_DEPENDENTS_SQL)) as unknown as LegacyRlsFunctionDependent[];
+    } catch {
+        return;
+    }
+
+    if (borrowers.length > 0) {
+        report.warn(
+            `The pre-1.0 \`${LEGACY_RLS_SCHEMA}\` schema cannot be removed yet: ${borrowers.length} ` +
+            `${borrowers.length === 1 ? "function calls" : "functions call"} ` +
+            `\`${LEGACY_RLS_SCHEMA}.uid()\` and friends from its own body. Postgres records no dependency ` +
+            `for that — a SQL body written as a string literal is never parsed — so dropping the helpers ` +
+            `would leave these pointing at nothing, and they would fail when a query reached them rather ` +
+            `than now. Repoint them at \`${REBASE_SCHEMA}.uid()\`, after which the schema goes on its own:\n` +
+            borrowers.map(b => `  • ${b.schema}.${b.function}()`).join("\n")
+        );
+        return;
+    }
+
+    try {
+        await run(DROP_LEGACY_AUTH_SCHEMA_SQL);
+    } catch (err) {
+        // Something else depends on it, or the connection does not own it.
+        // Not fatal: the schema is inert either way now that no policy calls it.
+        report.info(
+            `Left the \`${LEGACY_RLS_SCHEMA}\` schema in place: ` +
+            (err instanceof Error ? err.message : String(err))
+        );
+    }
+}