@rebasepro/server-postgres 0.13.1-canary.gef9608c → 0.14.0

package/src/services/channel-history.ts

@@ -34,6 +34,7 @@ import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import type { ChannelHistoryEntry, ChannelRetentionRule } from "@rebasepro/types";
 import { logger } from "@rebasepro/server";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** How many messages a replay returns when the caller does not say. */
 const DEFAULT_REPLAY_LIMIT = 200;
@@ -198,6 +199,19 @@ export class ChannelHistoryStore {
             )
         `);
 
+        // Retained broadcasts for every channel in one table, with no RLS: who
+        // may replay a channel is decided before the read, by the channel gate
+        // in `realtimeService.authorizeChannelAction` — a replay is answered
+        // only for a client that has joined the channel, plus whatever an
+        // installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed; the
+        // rule language it does not yet have is written up in
+        // `docs/channel-authorization.md`. The driver's schema-wide
+        // grant reaches these (created here, after it ran), so take the
+        // privilege back.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_messages")));
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_cursors")));
+
         this.tablesReady = true;
         logger.info(`✅ [ChannelHistory] Retained channels ready (${this.rules.length} rule(s)).`);
     }

package/src/services/channel-presence.ts

@@ -28,6 +28,7 @@
 
 import { sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
+import { revokeInternalTableSql } from "@rebasepro/common";
 
 /** A tracked client, as any instance sees it. */
 export interface PresenceRow {
@@ -71,6 +72,18 @@ export class ChannelPresenceStore {
             ON rebase.channel_presence (last_seen)
         `);
 
+        // The roster of every client on every channel, with no RLS — a row
+        // policy has nothing to match on here, since a channel name is a string
+        // a client invents rather than a row anyone owns. What guards it is the
+        // channel gate in `realtimeService.authorizeChannelAction`: presence is
+        // readable only to a client that has joined the channel, plus whatever
+        // an installed `ChannelAuthorizer` adds. That gate is the entire reason
+        // this table can sit outside the RLS model, so it fails closed —
+        // see `docs/channel-authorization.md` for what it does *not*
+        // yet decide. Revoke the schema-wide grant the driver handed out
+        // before this table existed.
+        await this.db.execute(sql.raw(revokeInternalTableSql("rebase", "channel_presence")));
+
         this.tablesReady = true;
     }
 

package/src/services/collection-helpers.ts

@@ -1,8 +1,9 @@
 import { PgTable, AnyPgColumn } from "drizzle-orm/pg-core";
+import { getTableColumns } from "drizzle-orm";
 import { CollectionConfig, Property, ResolvedHasMany, ResolvedHasOne } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-import { getTableName } from "@rebasepro/common";
-import { logger } from "@rebasepro/server";
+import { fieldKeyForColumn, getTableName } from "@rebasepro/common";
+import { ApiError, logger } from "@rebasepro/server";
 
 // Row identity is derived on both sides of the wire — the driver parses an
 // incoming address into key columns, the admin derives one from a served row —
@@ -76,6 +77,82 @@ export function getCollectionByPath(collectionPath: string, registry: PostgresCo
     return collection;
 }
 
+/**
+ * Reject a write naming something that is not a column of the table.
+ *
+ * Drizzle builds INSERT from `Object.entries(table[Symbol.Columns])` and UPDATE
+ * from `Object.keys(tableColumns)`, so a key the table does not carry is not
+ * rejected by anything — it is *left out of the statement*. The insert answers
+ * 201 having stored nothing under that name; the update, if the key was the
+ * only one, builds `update "posts" set  where …` and Postgres raises a syntax
+ * error (SQLSTATE 42601), which is neither class 22 nor 23 and so surfaces as a
+ * 500 for what is a caller's typo.
+ *
+ * That makes this the last honest place to check, and the only one every write
+ * passes through. `assertKnownWriteFields` in the REST layer checks the same
+ * thing against the *config* and is skipped on four paths — `strictWrites:
+ * false`, a collection declaring no properties, an auth adapter that owns the
+ * body's shape, and a nested route whose target cannot be walked — and it never
+ * sees an in-process `rebase.data` write at all.
+ *
+ * It also gives `strictWrites: false` a truthful implementation. The flag is
+ * documented for "a column that really does exist which the config never
+ * declared", and skipping the config check alone could not deliver that: the
+ * value was dropped a layer later regardless. Skipping the config check and
+ * keeping this one does exactly what the flag says — the column must exist,
+ * the property need not.
+ */
+export function assertWritableColumns(
+    values: Record<string, unknown>,
+    table: PgTable,
+    collectionPath: string
+): void {
+    // Only a real Drizzle table carries a column list. A stand-in that does not
+    // (a test double, a registry entry built by hand) has nothing to check
+    // against, and inventing an answer from its own keys would reject writes
+    // over the shape of the double rather than the shape of the table.
+    const columns = getTableColumns(table) as Record<string, unknown> | undefined;
+    if (!columns || Object.keys(columns).length === 0) return;
+
+    const unknown = Object.keys(values).filter(key => !(key in columns));
+    if (unknown.length === 0) return;
+
+    // The offending keys, and deliberately not the list of real ones: this
+    // error is reachable on paths where the REST field check was skipped, and
+    // an `excludeFromApi` column is documented as never being served to a
+    // caller. Naming what was sent is the actionable half anyway.
+    throw ApiError.badRequest(
+        `'${collectionPath}' has no column${unknown.length > 1 ? "s" : ""} ` +
+        `${unknown.map(key => `'${key}'`).join(", ")}, so the value${unknown.length > 1 ? "s" : ""} ` +
+        "would have been dropped before the statement was built.",
+        "VALIDATION_UNKNOWN_FIELDS"
+    );
+}
+
+/**
+ * A relation whose names do not resolve against the registered schema.
+ *
+ * Every one of these used to be a `logger.warn` followed by `continue`, so a
+ * save reported success for a relation it had not written and a read answered
+ * `[]` for one it could not resolve. `assertRelationsResolve` (validate-relations)
+ * fails boot on the same defects, which is where they belong — a server that
+ * refuses to start is recoverable in a minute. This is the second line, for the
+ * paths that assemble a registry by hand, and it exists so that "cannot resolve"
+ * is never again reported as "done".
+ *
+ * @param label  `<collection>.<relation>`
+ * @param detail what does not resolve, in terms of the schema
+ */
+export function relationMisconfigured(label: string, detail: string): ApiError {
+    return ApiError.internal(
+        `Relation '${label}' does not resolve against the registered schema: ${detail}. ` +
+        "The operation was refused rather than skipped — silently dropping it would report " +
+        "success for a write that never happened, or emptiness for rows that exist. Run " +
+        "`rebase schema generate` if the generated schema is older than the database.",
+        "RELATION_MISCONFIGURED"
+    );
+}
+
 export function getTableForCollection(collection: CollectionConfig, registry: PostgresCollectionRegistry): PgTable<any> {
     const tableName = getTableName(collection);
     const table = registry.getTable(tableName);
@@ -193,7 +270,13 @@ export function sourceKeyField(
     sourceCollection: CollectionConfig,
     registry: PostgresCollectionRegistry
 ): string {
-    if (relation.sourceKey) return relation.sourceKey;
+    // A **field**, as the name says: callers index the Drizzle table and the
+    // rows it returns with what comes back from here, and both are keyed by the
+    // wire name. `sourceKey` is authored in *column* terms, like every other
+    // link on a relation, so it is translated here rather than at each of the
+    // call sites — where it used to be `tenant_id` looked up on a table whose
+    // key is `tenantId`, finding nothing.
+    if (relation.sourceKey) return fieldKeyForColumn(sourceCollection, relation.sourceKey);
     return requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 
@@ -212,7 +295,9 @@ export function joinsOnNaturalKey(
     registry: PostgresCollectionRegistry
 ): boolean {
     if (!relation.sourceKey) return false;
-    return relation.sourceKey !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
+    // Compared as fields, because the right-hand side is one.
+    return fieldKeyForColumn(sourceCollection, relation.sourceKey)
+        !== requirePrimaryKeys(sourceCollection, registry)[0].fieldName;
 }
 
 /**

package/src/services/dataService.ts

@@ -83,10 +83,13 @@ export class DataService implements DataRepository {
         searchString: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /** An `or(...)`/`and(...)` group, applied alongside `filter`. */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
             databaseId?: string;
+            searchExplain?: boolean;
         } = {}
     ): Promise<Record<string, unknown>[]> {
         return this.fetchService.searchRows<M>(collectionPath, searchString, options);

package/src/services/junction-writes.ts

@@ -0,0 +1,295 @@
+import { and, eq, inArray, sql } from "drizzle-orm";
+import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
+import { ApiError, logger } from "@rebasepro/server";
+import type { ResolvedVia } from "@rebasepro/types";
+import { DrizzleClient } from "../interfaces";
+import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
+import { relationMisconfigured } from "./collection-helpers";
+import { explainZeroRowWrite } from "./write-denial";
+
+/**
+ * Writing a many-to-many means writing rows in a junction table, and doing that
+ * needs three things: the table, the column naming the row being written from,
+ * and the column naming the far side.
+ *
+ * Those three used to be re-derived at each of the four call sites — twice for
+ * `through`, twice for `joinPath`, in the owning and the inverse direction —
+ * and the two `joinPath` derivations did not agree. The inverse one keyed off
+ * `step.table`; the owning one asked `getTableNamesFromColumns` which table a
+ * step's columns belonged to, and that answers `""` for an unqualified column
+ * name. So for `{ table: "posts_tags", on: { from: "id", to: "tag_id" } }` —
+ * the form the docs and every fixture use — no branch matched, both columns
+ * stayed null, and the write was skipped with a warning nobody reads. Writing
+ * a to-many `via` relation did nothing at all.
+ *
+ * Hence one binder, keyed on `step.table` (always present) and accepting the
+ * qualified `table.column` form where it is used.
+ */
+export interface JunctionBinding {
+    table: PgTable;
+    /** The junction column holding the id of the row being written from. */
+    parentColumn: AnyPgColumn;
+    /** The junction column holding the id of the row on the far side. */
+    targetColumn: AnyPgColumn;
+    /** `<collection>.<relation>`, for error messages. */
+    label: string;
+}
+
+/** A junction that cannot be resolved is a broken relation, not a no-op. */
+const misconfigured = (label: string, detail: string): ApiError =>
+    relationMisconfigured(label, detail);
+
+function column(table: PgTable, name: string | undefined, label: string, role: string): AnyPgColumn {
+    const col = name ? table[name as keyof typeof table] as AnyPgColumn : undefined;
+    if (!col) {
+        throw misconfigured(label, `no ${role} column '${name ?? "?"}' on the junction table`);
+    }
+    return col;
+}
+
+/** The junction a `manyToMany` names outright. */
+export function bindThroughJunction(
+    registry: PostgresCollectionRegistry,
+    through: { table: string; sourceColumn: string; targetColumn: string },
+    label: string
+): JunctionBinding {
+    const table = registry.getTable(through.table);
+    if (!table) {
+        throw misconfigured(label, `no table '${through.table}' in the registry`);
+    }
+    return {
+        table,
+        parentColumn: column(table, through.sourceColumn, label, "source"),
+        targetColumn: column(table, through.targetColumn, label, "target"),
+        label
+    };
+}
+
+/** The bare column name, whether written as `col` or `table.col`. */
+const columnPart = (spec: string | string[]): string => {
+    const one = Array.isArray(spec) ? spec[0] : spec;
+    return one.includes(".") ? one.split(".")[1] : one;
+};
+
+/** The table a column spec names, or undefined when it is unqualified. */
+const tablePart = (spec: string | string[]): string | undefined => {
+    const one = Array.isArray(spec) ? spec[0] : spec;
+    return one.includes(".") ? one.split(".")[0] : undefined;
+};
+
+/**
+ * The junction a `via` relation reaches through, from either end.
+ *
+ * A step is `{ table: T, on: { from, to } }` where `from` names a column on
+ * whatever the walk was standing on and `to` names one on `T`. That positional
+ * meaning is what makes the unqualified form work at all, so the walk carries
+ * the previous table rather than asking the column names where they live.
+ */
+export function bindJoinPathJunction(
+    registry: PostgresCollectionRegistry,
+    joinPath: ResolvedVia["joinPath"],
+    parentTableName: string,
+    targetTableName: string,
+    label: string
+): JunctionBinding {
+    const junctionName = joinPath
+        .map(step => step.table)
+        .find(table => table !== parentTableName && table !== targetTableName);
+
+    if (!junctionName) {
+        throw misconfigured(label, "its joinPath has no table between the two ends to hold the links");
+    }
+
+    const table = registry.getTable(junctionName);
+    if (!table) {
+        throw misconfigured(label, `no table '${junctionName}' in the registry`);
+    }
+
+    let parentColumnName: string | undefined;
+    let targetColumnName: string | undefined;
+    let previousTable = parentTableName;
+
+    for (const step of joinPath) {
+        const fromTable = tablePart(step.on.from) ?? previousTable;
+        const toTable = tablePart(step.on.to) ?? step.table;
+
+        // Take the column on the junction's own side of the step, and let the
+        // other side say which end of the relation this step reached.
+        if (toTable === junctionName && fromTable === parentTableName) {
+            parentColumnName = columnPart(step.on.to);
+        } else if (fromTable === junctionName && toTable === parentTableName) {
+            parentColumnName = columnPart(step.on.from);
+        } else if (toTable === junctionName && fromTable === targetTableName) {
+            targetColumnName = columnPart(step.on.to);
+        } else if (fromTable === junctionName && toTable === targetTableName) {
+            targetColumnName = columnPart(step.on.from);
+        }
+
+        previousTable = step.table;
+    }
+
+    if (!parentColumnName || !targetColumnName) {
+        throw misconfigured(
+            label,
+            `its joinPath does not connect '${parentTableName}' and '${targetTableName}' through '${junctionName}'`
+        );
+    }
+
+    return {
+        table,
+        parentColumn: column(table, parentColumnName, label, "source"),
+        targetColumn: column(table, targetColumnName, label, "target"),
+        label
+    };
+}
+
+/**
+ * Remove one link, leaving the row on the far side alone.
+ *
+ * This is what `DELETE authors/1/tags/5` has to mean for a many-to-many: the
+ * target is shared, so deleting the row would remove the tag from every other
+ * post that uses it.
+ */
+export async function removeJunctionLink(
+    tx: DrizzleClient,
+    binding: JunctionBinding,
+    parentId: unknown,
+    targetId: unknown,
+    subject: { parent: string; relation: string }
+): Promise<void> {
+    const conditions = [
+        eq(binding.parentColumn, parentId),
+        eq(binding.targetColumn, targetId)
+    ];
+    const result = await tx.delete(binding.table).where(and(...conditions));
+
+    // The link is the row here, so the junction's own policies decide. Callers
+    // establish membership first, over this same handle, which is what makes a
+    // zero-row delete meaningful rather than ambiguous.
+    if ((result.rowCount ?? 0) === 0) {
+        throw await explainZeroRowWrite(
+            tx,
+            binding.table,
+            conditions,
+            `Not allowed to unlink "${targetId}" from "${subject.parent}" "${parentId}": ` +
+            "a row-level security policy rejected the write.",
+            `No "${subject.relation}" link between "${subject.parent}" "${parentId}" ` +
+            `and "${targetId}" to remove.`
+        );
+    }
+
+    logger.info(`Unlinked '${subject.relation}' ${targetId} from ${subject.parent} ${parentId}`);
+}
+
+/**
+ * Make the junction say that `parentId` is linked to exactly `targetIds`, by
+ * diffing against what is linked now rather than replacing the set.
+ *
+ * A save of the parent used to delete every junction row for it and re-insert
+ * the ids the browser sent — a list the browser assembled from a read it did
+ * earlier. Three things followed, all data loss rather than display:
+ *
+ *  - **Lost update.** Two editors with post 7 open: A adds tag X and saves, B
+ *    saves any field from a form that predates it, and X is gone with nothing
+ *    reported to either of them.
+ *  - **A partially-read set is a partially-deleted set.** The read that fills
+ *    the form runs under RLS, so a user who may edit the parent but cannot see
+ *    some of the linked rows gets a shorter list — and writing it back deleted
+ *    the links they were never shown. The select that drives the diff runs in
+ *    this same transaction under the same policies, so a link the caller cannot
+ *    read is in neither list and survives the save.
+ *  - **Junction payload columns.** A junction carrying its own columns
+ *    (`position`, `role`, `created_at`) lost them on every save, because every
+ *    row was re-inserted with only the two keys. Untouched links are left alone.
+ *
+ * The insert is `ON CONFLICT DO NOTHING`, so two sessions adding the same link
+ * concurrently is a no-op rather than a unique violation.
+ */
+export async function applyJunctionMembership(
+    tx: DrizzleClient,
+    binding: JunctionBinding,
+    parentId: unknown,
+    targetIds: unknown[]
+): Promise<void> {
+    const existingRows = await tx
+        .select({ targetId: binding.targetColumn })
+        .from(binding.table)
+        .where(eq(binding.parentColumn, parentId));
+
+    // Keyed by `String(...)` because a junction key can come back from the
+    // driver as a string where the parsed value is a number, and a diff that
+    // missed that would delete and re-insert every link on every save.
+    const existingById = new Map<string, unknown>();
+    for (const row of existingRows as Array<{ targetId: unknown }>) {
+        if (row.targetId === null || row.targetId === undefined) continue;
+        existingById.set(String(row.targetId), row.targetId);
+    }
+
+    const wantedById = new Map<string, unknown>();
+    for (const targetId of targetIds) {
+        if (targetId === null || targetId === undefined) continue;
+        wantedById.set(String(targetId), targetId);
+    }
+
+    const removed = [...existingById.entries()]
+        .filter(([key]) => !wantedById.has(key))
+        .map(([, value]) => value);
+    const added = [...wantedById.entries()]
+        .filter(([key]) => !existingById.has(key))
+        .map(([, value]) => value);
+
+    if (removed.length > 0) {
+        await removeLinks(tx, binding, parentId, removed);
+    }
+
+    if (added.length > 0) {
+        await tx.insert(binding.table)
+            .values(added.map(targetId => ({
+                [binding.parentColumn.name]: parentId,
+                [binding.targetColumn.name]: targetId
+            })))
+            .onConflictDoNothing();
+    }
+}
+
+/**
+ * Drop the named links, and refuse to call it done if the database kept any.
+ *
+ * Every id here came out of the select in {@link applyJunctionMembership}, on
+ * this same handle, so all of them were visible. Fewer deletions than that means
+ * something refused them — and a save that reports success while the membership
+ * it stored is not the membership it was given has told the caller something
+ * untrue about the database.
+ */
+async function removeLinks(
+    tx: DrizzleClient,
+    binding: JunctionBinding,
+    parentId: unknown,
+    removed: unknown[]
+): Promise<void> {
+    const conditions = [
+        eq(binding.parentColumn, parentId),
+        inArray(binding.targetColumn, removed)
+    ];
+    const result = await tx.delete(binding.table).where(and(...conditions));
+    const deleted = result.rowCount ?? 0;
+
+    if (deleted >= removed.length) return;
+
+    const survivors = await tx
+        .select({ present: sql<number>`1` })
+        .from(binding.table)
+        .where(and(...conditions))
+        .limit(1);
+
+    // Nothing survived: a concurrent session removed the rest between the
+    // select and the delete. The membership is what the caller asked for,
+    // which is all this promised.
+    if (survivors.length === 0) return;
+
+    throw ApiError.forbidden(
+        `Not allowed to remove ${removed.length - deleted} of ${removed.length} link(s) ` +
+        `for relation '${binding.label}': a row-level security policy rejected the write.`,
+        "WRITE_DENIED"
+    );
+}

package/src/services/pg-notify-listener.ts

@@ -111,7 +111,7 @@ export class PgNotifyListener {
             await client.connect();
             await client.query(`LISTEN ${channel}`);
             this.client = client;
-            logger.info(`📡 ${logLabel} Listening on channel "${channel}".`);
+            logger.debug(`📡 ${logLabel} Listening on channel "${channel}".`);
         } catch (err) {
             // Surface the initial failure so callers can choose to fall back;
             // for reconnects, keep retrying quietly in the background.