@rebasepro/server-postgres 0.13.1-canary.gef9608c → 0.14.0

package/src/security/policy-drift.test.ts

@@ -18,9 +18,50 @@ function collection(slug: string): CollectionConfig {
     } as unknown as CollectionConfig;
 }
 
-/** Stands in for pg_policies. */
-function dbWith(rows: Record<string, unknown>[]): Queryable {
-    return { query: async () => ({ rows: rows as never[] }) };
+/** A collection whose write rule is declared RESTRICTIVE, so the DDL says `AS RESTRICTIVE`. */
+function restrictiveCollection(slug: string): CollectionConfig {
+    return {
+        name: slug,
+        slug,
+        table: slug,
+        schema: "public",
+        properties: { id: { name: "ID", type: "string", isId: "uuid" } },
+        securityRules: [
+            { operation: "select", access: "public" },
+            { operations: ["insert", "update", "delete"], roles: ["admin"], mode: "restrictive" }
+        ]
+    } as unknown as CollectionConfig;
+}
+
+/**
+ * Stands in for the two catalogue reads: `pg_policies`, then `pg_class`.
+ *
+ * The second one is dispatched on the query text rather than call order, so a
+ * test that stops caring about ordering does not silently start feeding policy
+ * rows to the RLS-status read — which would report every table as RLS-off,
+ * since a policy row has no `relrowsecurity` column and `undefined` is falsy.
+ *
+ * `rlsOff` names tables whose RLS switch is off. Anything not listed is on,
+ * which is what a healthy `db push` leaves behind.
+ */
+function dbWith(rows: Record<string, unknown>[], rlsOff: string[] = []): Queryable {
+    return {
+        query: async (text: string, values?: unknown[]) => {
+            if (!text.includes("pg_class")) return { rows: rows as never[] };
+            const wanted = (values?.[0] as string[] | undefined) ?? [];
+            return {
+                rows: wanted.map((qualified) => {
+                    const [schemaname, tablename] = qualified.split(".");
+                    return {
+                        schemaname,
+                        tablename,
+                        relrowsecurity: !rlsOff.includes(tablename),
+                        relforcerowsecurity: !rlsOff.includes(tablename)
+                    };
+                }) as never[]
+            };
+        }
+    };
 }
 
 /** A pg_policies row matching an expected policy, clauses and all. */
@@ -30,6 +71,7 @@ function liveRow(p: PolicyRef, overrides: Record<string, unknown> = {}) {
         // Postgres rewrites the text it stores; only presence is compared.
         qual: p.hasUsing ? "(rewritten by postgres)" : null,
         with_check: p.hasWithCheck ? "(rewritten by postgres)" : null,
+        permissive: p.mode ?? "PERMISSIVE",
         ...overrides
     };
 }
@@ -56,6 +98,65 @@ describe("checkPolicyDrift", () => {
         expect(formatPolicyDrift(drift)).toBe("");
     });
 
+    it("flags a table whose RLS switch is off, though every policy still matches", async () => {
+        // The whole point: DISABLE ROW LEVEL SECURITY leaves pg_policies
+        // untouched, so name, roles, command and clause presence all agree and
+        // every other check here passes. Before this category the report was
+        // empty on a table Postgres was filtering nothing on.
+        const cols = [collection("authors")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+
+        const drift = await checkPolicyDrift(
+            dbWith(expected.map((p) => liveRow(p)), ["authors"]),
+            cols
+        );
+
+        expect(drift.missing).toHaveLength(0);
+        expect(drift.diverged).toHaveLength(0);
+        expect(drift.orphaned).toHaveLength(0);
+        expect(drift.rlsDisabled).toEqual([{ schema: "public", table: "authors", forced: false }]);
+        expect(hasDrift(drift)).toBe(true);
+        expect(formatPolicyDrift(drift)).toContain("RLS DISABLED");
+    });
+
+    it("flags a RESTRICTIVE rule the database stores as PERMISSIVE", async () => {
+        // A gate that should be ANDed in is now ORed in — it widens access
+        // instead of narrowing it, with identical name, roles, command and
+        // clauses. Only the `AS` clause differs, and it used to be discarded by
+        // the DDL parser and never selected from pg_policies.
+        const cols = [restrictiveCollection("ledger")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const restrictive = expected.filter((p) => p.mode === "RESTRICTIVE");
+        // Guards the test itself: if the generator stops emitting AS RESTRICTIVE
+        // this must fail loudly rather than pass by having nothing to compare.
+        expect(restrictive.length).toBeGreaterThan(0);
+
+        const live = expected.map((p) =>
+            p.name === restrictive[0].name ? liveRow(p, { permissive: "PERMISSIVE" }) : liveRow(p)
+        );
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.diverged).toHaveLength(1);
+        expect(drift.diverged[0].differences.join(" ")).toContain("mode: expected RESTRICTIVE");
+        expect(formatPolicyDrift(drift)).toContain("widens access");
+    });
+
+    it("does not invent drift when either side's mode is unreadable", async () => {
+        // An older server or a driver that hands back a shape we do not know
+        // must not turn into a wall of false positives.
+        const cols = [collection("authors")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+
+        const drift = await checkPolicyDrift(
+            dbWith(expected.map((p) => liveRow(p, { permissive: null }))),
+            cols
+        );
+
+        expect(drift.diverged).toHaveLength(0);
+        expect(hasDrift(drift)).toBe(false);
+    });
+
     it("flags a policy the database never received as missing", async () => {
         const drift = await checkPolicyDrift(dbWith([]), [collection("authors")]);
 

package/src/security/policy-drift.ts

@@ -29,6 +29,20 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
+    /**
+     * PERMISSIVE or RESTRICTIVE — the `AS` clause.
+     *
+     * An exact catalogue value on both sides, so it belongs with roles and
+     * command rather than with the expression text. It matters more than either:
+     * permissive policies are ORed together and restrictive ones ANDed, so a rule
+     * declared `mode: "restrictive"` whose live policy is PERMISSIVE has had its
+     * gate turned from a requirement into an alternative — the maximally
+     * permissive way for this to be wrong.
+     *
+     * The DDL regex captured this from the start and the destructuring threw it
+     * away; `pg_policies.permissive` was never selected.
+     */
+    mode?: "PERMISSIVE" | "RESTRICTIVE";
     /**
      * The live clause text, when read from `pg_policies`. Present only for live
      * policies (the expected side is parsed from DDL and does not carry it).
@@ -59,6 +73,22 @@ export interface PolicyDrift {
      * @see reason  a sentence naming the clause and what to do.
      */
     insecure: { policy: PolicyRef; reason: string }[];
+    /**
+     * A table the collections describe whose RLS switch is off.
+     *
+     * `ALTER TABLE posts DISABLE ROW LEVEL SECURITY` leaves every row in
+     * `pg_policies` untouched, so before this category every expected policy
+     * still matched on name, roles, command and clause presence and the checker
+     * reported clean — on a table Postgres was applying no filter to at all.
+     * Requests run as `rebase_user`, which holds full DML, so the table is wide
+     * open while `doctor` certifies it.
+     *
+     * `forced` reports `relforcerowsecurity`, which is what also subjects the
+     * table's *owner* to its policies. Its absence is not drift on its own —
+     * Rebase does not connect as the owner in the request path — so it is
+     * reported for context rather than raised as a failure.
+     */
+    rlsDisabled: { schema: string; table: string; forced: boolean }[];
 }
 
 export interface Queryable {
@@ -98,11 +128,29 @@ function clauseEnd(ddl: string, open: number): number {
     return ddl.length;
 }
 
+/**
+ * `AS PERMISSIVE` / `AS RESTRICTIVE` from either side, or undefined.
+ *
+ * The DDL spells it as a bare word; `pg_policies.permissive` is the string
+ * `"PERMISSIVE"`/`"RESTRICTIVE"` on modern Postgres but a boolean on some
+ * drivers and older servers, so both are accepted. Anything unrecognised
+ * becomes `undefined` and the comparison below skips it rather than inventing
+ * drift from a shape we did not anticipate.
+ */
+function normalizeMode(raw: unknown): "PERMISSIVE" | "RESTRICTIVE" | undefined {
+    if (typeof raw === "boolean") return raw ? "PERMISSIVE" : "RESTRICTIVE";
+    if (typeof raw !== "string") return undefined;
+    const upper = raw.trim().toUpperCase();
+    if (upper === "PERMISSIVE" || upper === "TRUE" || upper === "T") return "PERMISSIVE";
+    if (upper === "RESTRICTIVE" || upper === "FALSE" || upper === "F") return "RESTRICTIVE";
+    return undefined;
+}
+
 /** Parse the generated DDL rather than rebuilding the shape by hand. */
 export function parseExpectedPolicies(ddl: string): PolicyRef[] {
     const found: PolicyRef[] = [];
     for (const m of ddl.matchAll(CREATE_POLICY)) {
-        const [, name, schema, table, , command, rolesRaw, clause] = m;
+        const [, name, schema, table, modeRaw, command, rolesRaw, clause] = m;
         const roles = rolesRaw
             .split(",")
             .map((r) => r.trim().replace(/^"|"$/g, ""))
@@ -115,7 +163,12 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
             ? WITH_CHECK_NEXT.test(ddl.slice(clauseEnd(ddl, m.index + m[0].length)))
             : /WITH CHECK/i.test(clause);
 
-        found.push({ schema, table, name, roles, command: command.toUpperCase(), hasUsing, hasWithCheck });
+        found.push({
+            schema, table, name, roles,
+            command: command.toUpperCase(),
+            hasUsing, hasWithCheck,
+            mode: normalizeMode(modeRaw)
+        });
     }
     return found;
 }
@@ -123,9 +176,9 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
 async function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {
     const { rows } = await client.query<{
         schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;
-        qual: string | null; with_check: string | null;
+        qual: string | null; with_check: string | null; permissive: string | boolean | null;
     }>(
-        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check
+        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check, permissive
          FROM pg_policies
          WHERE schemaname = ANY($1)`,
         [schemas]
@@ -144,11 +197,51 @@ async function readLivePolicies(client: Queryable, schemas: string[]): Promise<P
         // drop a clause: NULL here means the policy genuinely has none.
         hasUsing: r.qual != null,
         hasWithCheck: r.with_check != null,
+        mode: normalizeMode(r.permissive),
         qual: r.qual,
         withCheck: r.with_check
     }));
 }
 
+/**
+ * Tables the collections describe whose RLS switch is off.
+ *
+ * Read from `pg_class` because `pg_policies` cannot answer it: disabling RLS
+ * leaves the policy rows in place, so every other comparison in this file keeps
+ * matching while Postgres applies none of them.
+ *
+ * Only tables that expect at least one policy are considered. A table with no
+ * declared rules is not asserting anything about RLS, and reporting it would
+ * make the check noisy on exactly the projects least able to judge the noise.
+ */
+async function readTablesWithRlsOff(
+    client: Queryable,
+    tables: { schema: string; table: string }[]
+): Promise<{ schema: string; table: string; forced: boolean }[]> {
+    if (tables.length === 0) return [];
+    const { rows } = await client.query<{
+        schemaname: string; tablename: string; relrowsecurity: boolean; relforcerowsecurity: boolean;
+    }>(
+        `SELECT n.nspname AS schemaname,
+                c.relname AS tablename,
+                c.relrowsecurity,
+                c.relforcerowsecurity
+           FROM pg_class c
+           JOIN pg_namespace n ON n.oid = c.relnamespace
+          WHERE c.relkind = 'r'
+            AND (n.nspname || '.' || c.relname) = ANY($1)`,
+        [tables.map((t) => `${t.schema}.${t.table}`)]
+    );
+
+    return rows
+        .filter((r) => !r.relrowsecurity)
+        .map((r) => ({
+            schema: r.schemaname,
+            table: r.tablename,
+            forced: !!r.relforcerowsecurity
+        }));
+}
+
 /**
  * The permissive tautology `auth.uid() IS NOT NULL`, without the
  * `<> 'anonymous'` guard that makes it mean "signed in".
@@ -195,13 +288,21 @@ export async function checkPolicyDrift(
     const schemas = [...new Set(expected.map((p) => p.schema))];
     // Nothing expected means nothing to reconcile against; scanning every
     // schema would report the whole database as orphaned.
-    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [] };
+    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };
 
     const live = await readLivePolicies(client, schemas);
     const liveByKey = new Map(live.map((p) => [keyOf(p), p]));
     const expectedByKey = new Map(expected.map((p) => [keyOf(p), p]));
 
-    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [] };
+    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };
+
+    // Before comparing policy against policy: is the switch even on? A table
+    // with RLS disabled matches every expected policy on every field compared
+    // below, so this has to be asked separately or it cannot be asked at all.
+    const expectedTables = [...new Map(
+        expected.map((p) => [`${p.schema}.${p.table}`, { schema: p.schema, table: p.table }])
+    ).values()];
+    drift.rlsDisabled = await readTablesWithRlsOff(client, expectedTables);
 
     // Scan every live policy for the permissive tautology. This is deliberately
     // independent of the name-keyed diff below: a database pushed before the
@@ -234,6 +335,16 @@ export async function checkPolicyDrift(
         if (want.command !== got.command) {
             differences.push(`command: expected ${want.command}, database has ${got.command}`);
         }
+        // Skipped when either side is unknown: an unrecognised catalogue shape
+        // should not manufacture drift. See `normalizeMode`.
+        if (want.mode && got.mode && want.mode !== got.mode) {
+            differences.push(
+                `mode: expected ${want.mode}, database has ${got.mode}` +
+                (got.mode === "PERMISSIVE"
+                    ? " — a RESTRICTIVE rule is ANDed with the others, a PERMISSIVE one is ORed, so this policy now widens access instead of narrowing it"
+                    : " — a PERMISSIVE rule is ORed with the others, a RESTRICTIVE one is ANDed, so this policy now narrows access instead of widening it")
+            );
+        }
         for (const clause of ["USING", "WITH CHECK"] as const) {
             const key = clause === "USING" ? "hasUsing" : "hasWithCheck";
             if (want[key] === got[key]) continue;
@@ -308,13 +419,24 @@ export async function dropOrphanedPolicies(
 }
 
 export const hasDrift = (d: PolicyDrift): boolean =>
-    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0;
+    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0
+    || d.rlsDisabled.length > 0;
 
 /** Human-readable report; empty string when the database matches the config. */
 export function formatPolicyDrift(drift: PolicyDrift): string {
     if (!hasDrift(drift)) return "";
     const lines: string[] = [];
 
+    // First, because it subsumes every other finding on the same table: if RLS
+    // is off, the policies listed below are not being applied at all.
+    if (drift.rlsDisabled.length > 0) {
+        lines.push("  RLS DISABLED — the table has policies, and Postgres is applying none of them:");
+        for (const t of drift.rlsDisabled) {
+            lines.push(`    • ${t.schema}.${t.table}${t.forced ? "" : " (and FORCE is off)"}`);
+        }
+        lines.push("    Every row is readable and writable by any request that reaches the table.");
+        lines.push(`    Fix: ALTER TABLE "<schema>"."<table>" ENABLE ROW LEVEL SECURITY; or re-run \`rebase db push\`.`);
+    }
     if (drift.missing.length > 0) {
         lines.push("  Missing — described by your collections, absent from the database:");
         for (const p of drift.missing) lines.push(`    • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`);

package/src/security/rls-enforcement.ts

@@ -1,6 +1,13 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
 import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
-import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
+import {
+    AnonymousGrantRisk,
+    findAnonymousGrants,
+    REBASE_USER_ROLE,
+    revokeInternalTableAccess,
+    securityRuleToConditions
+} from "@rebasepro/common";
+import { REBASE_SCHEMA, usesLegacyRlsFunctions } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -16,9 +23,14 @@ import { logger } from "@rebasepro/server";
  *    are validation/side-effects, not a security boundary.
  *
  *  - **Server context** — the base (owner) connection: auth flows, migrations,
- *    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
- *    owner it bypasses RLS. This is the trusted plane, equivalent to
- *    Supabase's `service_role`.
+ *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted
+ *    plane, equivalent to Supabase's `service_role`.
+ *
+ *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes
+ *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user
+ *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —
+ *    and clears the default policies through their admin arm rather than the
+ *    `auth.uid() IS NULL` one.
  *
  * This module provides the three pieces:
  *
@@ -36,8 +48,14 @@ import { logger } from "@rebasepro/server";
  * not an operator opt-in.
  */
 
-/** The restricted role every authenticated (user-context) request runs as. */
-export const REBASE_USER_ROLE = "rebase_user";
+/**
+ * The restricted role every authenticated (user-context) request runs as.
+ *
+ * Re-exported, not re-declared: the same name is needed by
+ * `@rebasepro/common`'s internal-table revokes, and two spellings of a role name
+ * fail as a silent no-op rather than an error.
+ */
+export { REBASE_USER_ROLE };
 
 /** Minimal SQL runner so callers can adapt drizzle or pg.Client. */
 export type RawSqlRunner = (sqlText: string) => Promise<Record<string, unknown>[]>;
@@ -69,6 +87,57 @@ const quoteIdent = (name: string): string => `"${name.replace(/"/g, "\"\"")}"`;
 /** DML the user role holds on managed tables (RLS still filters per row). */
 const USER_TABLE_PRIVILEGES = "SELECT, INSERT, UPDATE, DELETE";
 
+/**
+ * Warn when the connection role shares its name with an existing schema.
+ *
+ * Postgres resolves unqualified names through `search_path`, which defaults to
+ * `"$user", public` — and `$user` is the connection ROLE. When a schema of that
+ * name exists it sits ahead of `public`, so every unqualified statement
+ * silently operates on it instead:
+ *
+ *     CREATE TABLE posts (...);   -- you meant public.posts; you got <role>.posts
+ *
+ * Nothing errors. You get a second table of the same name in the wrong schema,
+ * and reads that pin `public` cannot see it — which reads as "missing table" and
+ * sends people to re-run a push that creates a *third* copy. The bootstrapper
+ * has a whole branch dedicated to recognising the symptom after the fact.
+ *
+ * Rebase shipped straight into this: it creates a schema named `rebase` while
+ * every template named the database role `rebase` too. The scaffold uses
+ * `rebase_app` now, and every pool Rebase opens pins `search_path=public`
+ * (`pinSearchPath`), which covers the paths the framework controls. This covers
+ * the ones it does not — `psql`, `pg_dump`, drizzle-kit, a colleague's script,
+ * a hand-written migration — because the hazard is a property of the two NAMES,
+ * not of any one connection.
+ *
+ * A warning rather than a boot failure: the database works, the framework's own
+ * traffic is pinned, and refusing to start over a naming choice a user may have
+ * inherited would be worse than the risk.
+ */
+export async function warnOnRoleSchemaCollision(run: RawSqlRunner): Promise<void> {
+    try {
+        const rows = await run(`
+            SELECT current_user AS role,
+                   EXISTS (
+                       SELECT 1 FROM pg_namespace n WHERE n.nspname = current_user
+                   ) AS collides
+        `);
+        if (rows[0]?.collides !== true) return;
+        const role = String(rows[0]?.role ?? "the connection role");
+        logger.warn(
+            `⚠️  The database role "${role}" has the same name as a schema. Postgres resolves unqualified ` +
+            `names through \`search_path\`, which defaults to \`"$user", public\` — so "${role}" is searched ` +
+            `BEFORE public, and any unqualified \`CREATE TABLE\`/\`SELECT\` from a tool that does not pin the ` +
+            `path (psql, pg_dump, drizzle-kit, a hand-written migration) silently lands in "${role}" instead. ` +
+            `Rebase's own connections pin \`search_path=public\`, so the server is unaffected. To remove the ` +
+            `hazard entirely, connect as a role whose name is not also a schema — the scaffold uses ` +
+            `"rebase_app".`
+        );
+    } catch {
+        // A diagnostic must never be the reason a boot fails.
+    }
+}
+
 export async function detectConnectionPosture(run: RawSqlRunner): Promise<ConnectionPosture> {
     const rows = await run(`
         SELECT current_user            AS role,
@@ -180,9 +249,24 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
         // migrations), so a migrate can never strand the user role.
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT ${USER_TABLE_PRIVILEGES} ON TABLES TO ${REBASE_USER_ROLE}`);
         await run(`ALTER DEFAULT PRIVILEGES IN SCHEMA ${s} GRANT USAGE, SELECT ON SEQUENCES TO ${REBASE_USER_ROLE}`);
+
+        // The grants above are deliberately schema-wide — a project's own
+        // collections may live in `rebase`, and future tables must be reachable
+        // or a migration strands the role. Rebase's OWN tables are the exception:
+        // refresh tokens, MFA secrets, API keys and the rest carry no RLS and no
+        // row an end user should ever address. Taking the privilege back here
+        // covers every table that already exists; each creator revokes on the
+        // table it just made, for the boot that creates them for the first time.
+        await revokeInternalTableAccess(async (text) => { await run(text); }, schema, {
+            onError: (table, error) => logger.warn(
+                `🔐 [rls] Could not revoke "${REBASE_USER_ROLE}" access to "${schema}"."${table}" — ` +
+                "it stays reachable by authenticated requests: " +
+                (error instanceof Error ? error.message : String(error))
+            )
+        });
     }
 
-    logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
+    logger.debug(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
 }
 
 /**
@@ -293,6 +377,65 @@ export function warnOnAnonymousGrants(
     );
 }
 
+/**
+ * Name the collections whose raw policy SQL still calls the pre-1.0 helpers.
+ *
+ * The compiler rewrites `auth.uid()` to `rebase.uid()` on the way into the
+ * database, so nothing is broken and no policy is wrong — which is exactly why
+ * this has to be said out loud. A silent rewrite that works forever is not a
+ * migration, it is a second supported spelling nobody wrote down, and the next
+ * person to read those rules will copy the old one.
+ *
+ * Only `raw` expressions can carry it. Structured rules (`policy.authUid()`,
+ * `policy.rolesOverlap(...)`) compile from the model and were never affected.
+ */
+export function warnOnLegacyRlsFunctions(
+    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
+): void {
+    const sites: string[] = [];
+
+    for (const collection of collections) {
+        for (const rule of collection.securityRules ?? []) {
+            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+            const carriesLegacy = [usingExpr, withCheckExpr]
+                .filter((e): e is PolicyExpression => e !== null)
+                .some(containsLegacyRlsCall);
+            if (!carriesLegacy) continue;
+
+            const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
+            if (!sites.includes(site)) sites.push(site);
+        }
+    }
+
+    if (sites.length === 0) return;
+
+    logger.warn(
+        `These security rules call the pre-1.0 RLS helpers (\`auth.uid()\`, \`auth.roles()\`, \`auth.jwt()\`). ` +
+        `They still work — the compiler rewrites them — but the functions now live in the \`rebase\` schema, ` +
+        `and the \`auth\` one is Supabase's. Update the raw SQL in these rules to \`${REBASE_SCHEMA}.uid()\` ` +
+        `and friends, or switch them to the structured helpers (\`policy.authUid()\`, \`policy.rolesOverlap()\`), ` +
+        `which never had to be spelled by hand:\n\n` +
+        sites.map(s => `  • ${s}`).join("\n") + "\n"
+    );
+}
+
+/** Whether any `raw` expression in the tree calls a pre-1.0 helper. */
+function containsLegacyRlsCall(expr: PolicyExpression): boolean {
+    switch (expr.kind) {
+        case "raw":
+            return usesLegacyRlsFunctions(expr.sql);
+        case "and":
+        case "or":
+            return expr.operands.some(containsLegacyRlsCall);
+        case "not":
+            return containsLegacyRlsCall(expr.operand);
+        case "existsIn":
+            return containsLegacyRlsCall(expr.where);
+        default:
+            return false;
+    }
+}
+
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/src/services/BranchService.ts

@@ -9,6 +9,7 @@
 
 import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
+import { revokeInternalTableSql } from "@rebasepro/common";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
 import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
@@ -124,6 +125,10 @@ export class BranchService {
                 metadata     JSONB DEFAULT '{}'
             );
         `));
+
+        // Not a collection, so no RLS — and it names every branch database on
+        // this server. The driver's schema-wide grant reaches it, so revoke.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "branches")));
     }
 
     /**