@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/src/security/policy-drift.ts

@@ -29,6 +29,20 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
+    /**
+     * PERMISSIVE or RESTRICTIVE — the `AS` clause.
+     *
+     * An exact catalogue value on both sides, so it belongs with roles and
+     * command rather than with the expression text. It matters more than either:
+     * permissive policies are ORed together and restrictive ones ANDed, so a rule
+     * declared `mode: "restrictive"` whose live policy is PERMISSIVE has had its
+     * gate turned from a requirement into an alternative — the maximally
+     * permissive way for this to be wrong.
+     *
+     * The DDL regex captured this from the start and the destructuring threw it
+     * away; `pg_policies.permissive` was never selected.
+     */
+    mode?: "PERMISSIVE" | "RESTRICTIVE";
     /**
      * The live clause text, when read from `pg_policies`. Present only for live
      * policies (the expected side is parsed from DDL and does not carry it).
@@ -59,6 +73,22 @@ export interface PolicyDrift {
      * @see reason  a sentence naming the clause and what to do.
      */
     insecure: { policy: PolicyRef; reason: string }[];
+    /**
+     * A table the collections describe whose RLS switch is off.
+     *
+     * `ALTER TABLE posts DISABLE ROW LEVEL SECURITY` leaves every row in
+     * `pg_policies` untouched, so before this category every expected policy
+     * still matched on name, roles, command and clause presence and the checker
+     * reported clean — on a table Postgres was applying no filter to at all.
+     * Requests run as `rebase_user`, which holds full DML, so the table is wide
+     * open while `doctor` certifies it.
+     *
+     * `forced` reports `relforcerowsecurity`, which is what also subjects the
+     * table's *owner* to its policies. Its absence is not drift on its own —
+     * Rebase does not connect as the owner in the request path — so it is
+     * reported for context rather than raised as a failure.
+     */
+    rlsDisabled: { schema: string; table: string; forced: boolean }[];
 }
 
 export interface Queryable {
@@ -98,11 +128,29 @@ function clauseEnd(ddl: string, open: number): number {
     return ddl.length;
 }
 
+/**
+ * `AS PERMISSIVE` / `AS RESTRICTIVE` from either side, or undefined.
+ *
+ * The DDL spells it as a bare word; `pg_policies.permissive` is the string
+ * `"PERMISSIVE"`/`"RESTRICTIVE"` on modern Postgres but a boolean on some
+ * drivers and older servers, so both are accepted. Anything unrecognised
+ * becomes `undefined` and the comparison below skips it rather than inventing
+ * drift from a shape we did not anticipate.
+ */
+function normalizeMode(raw: unknown): "PERMISSIVE" | "RESTRICTIVE" | undefined {
+    if (typeof raw === "boolean") return raw ? "PERMISSIVE" : "RESTRICTIVE";
+    if (typeof raw !== "string") return undefined;
+    const upper = raw.trim().toUpperCase();
+    if (upper === "PERMISSIVE" || upper === "TRUE" || upper === "T") return "PERMISSIVE";
+    if (upper === "RESTRICTIVE" || upper === "FALSE" || upper === "F") return "RESTRICTIVE";
+    return undefined;
+}
+
 /** Parse the generated DDL rather than rebuilding the shape by hand. */
 export function parseExpectedPolicies(ddl: string): PolicyRef[] {
     const found: PolicyRef[] = [];
     for (const m of ddl.matchAll(CREATE_POLICY)) {
-        const [, name, schema, table, , command, rolesRaw, clause] = m;
+        const [, name, schema, table, modeRaw, command, rolesRaw, clause] = m;
         const roles = rolesRaw
             .split(",")
             .map((r) => r.trim().replace(/^"|"$/g, ""))
@@ -115,7 +163,12 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
             ? WITH_CHECK_NEXT.test(ddl.slice(clauseEnd(ddl, m.index + m[0].length)))
             : /WITH CHECK/i.test(clause);
 
-        found.push({ schema, table, name, roles, command: command.toUpperCase(), hasUsing, hasWithCheck });
+        found.push({
+            schema, table, name, roles,
+            command: command.toUpperCase(),
+            hasUsing, hasWithCheck,
+            mode: normalizeMode(modeRaw)
+        });
     }
     return found;
 }
@@ -123,9 +176,9 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
 async function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {
     const { rows } = await client.query<{
         schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;
-        qual: string | null; with_check: string | null;
+        qual: string | null; with_check: string | null; permissive: string | boolean | null;
     }>(
-        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check
+        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check, permissive
          FROM pg_policies
          WHERE schemaname = ANY($1)`,
         [schemas]
@@ -144,11 +197,51 @@ async function readLivePolicies(client: Queryable, schemas: string[]): Promise<P
         // drop a clause: NULL here means the policy genuinely has none.
         hasUsing: r.qual != null,
         hasWithCheck: r.with_check != null,
+        mode: normalizeMode(r.permissive),
         qual: r.qual,
         withCheck: r.with_check
     }));
 }
 
+/**
+ * Tables the collections describe whose RLS switch is off.
+ *
+ * Read from `pg_class` because `pg_policies` cannot answer it: disabling RLS
+ * leaves the policy rows in place, so every other comparison in this file keeps
+ * matching while Postgres applies none of them.
+ *
+ * Only tables that expect at least one policy are considered. A table with no
+ * declared rules is not asserting anything about RLS, and reporting it would
+ * make the check noisy on exactly the projects least able to judge the noise.
+ */
+async function readTablesWithRlsOff(
+    client: Queryable,
+    tables: { schema: string; table: string }[]
+): Promise<{ schema: string; table: string; forced: boolean }[]> {
+    if (tables.length === 0) return [];
+    const { rows } = await client.query<{
+        schemaname: string; tablename: string; relrowsecurity: boolean; relforcerowsecurity: boolean;
+    }>(
+        `SELECT n.nspname AS schemaname,
+                c.relname AS tablename,
+                c.relrowsecurity,
+                c.relforcerowsecurity
+           FROM pg_class c
+           JOIN pg_namespace n ON n.oid = c.relnamespace
+          WHERE c.relkind = 'r'
+            AND (n.nspname || '.' || c.relname) = ANY($1)`,
+        [tables.map((t) => `${t.schema}.${t.table}`)]
+    );
+
+    return rows
+        .filter((r) => !r.relrowsecurity)
+        .map((r) => ({
+            schema: r.schemaname,
+            table: r.tablename,
+            forced: !!r.relforcerowsecurity
+        }));
+}
+
 /**
  * The permissive tautology `auth.uid() IS NOT NULL`, without the
  * `<> 'anonymous'` guard that makes it mean "signed in".
@@ -195,13 +288,21 @@ export async function checkPolicyDrift(
     const schemas = [...new Set(expected.map((p) => p.schema))];
     // Nothing expected means nothing to reconcile against; scanning every
     // schema would report the whole database as orphaned.
-    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [] };
+    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };
 
     const live = await readLivePolicies(client, schemas);
     const liveByKey = new Map(live.map((p) => [keyOf(p), p]));
     const expectedByKey = new Map(expected.map((p) => [keyOf(p), p]));
 
-    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [] };
+    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [], rlsDisabled: [] };
+
+    // Before comparing policy against policy: is the switch even on? A table
+    // with RLS disabled matches every expected policy on every field compared
+    // below, so this has to be asked separately or it cannot be asked at all.
+    const expectedTables = [...new Map(
+        expected.map((p) => [`${p.schema}.${p.table}`, { schema: p.schema, table: p.table }])
+    ).values()];
+    drift.rlsDisabled = await readTablesWithRlsOff(client, expectedTables);
 
     // Scan every live policy for the permissive tautology. This is deliberately
     // independent of the name-keyed diff below: a database pushed before the
@@ -234,6 +335,16 @@ export async function checkPolicyDrift(
         if (want.command !== got.command) {
             differences.push(`command: expected ${want.command}, database has ${got.command}`);
         }
+        // Skipped when either side is unknown: an unrecognised catalogue shape
+        // should not manufacture drift. See `normalizeMode`.
+        if (want.mode && got.mode && want.mode !== got.mode) {
+            differences.push(
+                `mode: expected ${want.mode}, database has ${got.mode}` +
+                (got.mode === "PERMISSIVE"
+                    ? " — a RESTRICTIVE rule is ANDed with the others, a PERMISSIVE one is ORed, so this policy now widens access instead of narrowing it"
+                    : " — a PERMISSIVE rule is ORed with the others, a RESTRICTIVE one is ANDed, so this policy now narrows access instead of widening it")
+            );
+        }
         for (const clause of ["USING", "WITH CHECK"] as const) {
             const key = clause === "USING" ? "hasUsing" : "hasWithCheck";
             if (want[key] === got[key]) continue;
@@ -308,13 +419,24 @@ export async function dropOrphanedPolicies(
 }
 
 export const hasDrift = (d: PolicyDrift): boolean =>
-    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0;
+    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0
+    || d.rlsDisabled.length > 0;
 
 /** Human-readable report; empty string when the database matches the config. */
 export function formatPolicyDrift(drift: PolicyDrift): string {
     if (!hasDrift(drift)) return "";
     const lines: string[] = [];
 
+    // First, because it subsumes every other finding on the same table: if RLS
+    // is off, the policies listed below are not being applied at all.
+    if (drift.rlsDisabled.length > 0) {
+        lines.push("  RLS DISABLED — the table has policies, and Postgres is applying none of them:");
+        for (const t of drift.rlsDisabled) {
+            lines.push(`    • ${t.schema}.${t.table}${t.forced ? "" : " (and FORCE is off)"}`);
+        }
+        lines.push("    Every row is readable and writable by any request that reaches the table.");
+        lines.push(`    Fix: ALTER TABLE "<schema>"."<table>" ENABLE ROW LEVEL SECURITY; or re-run \`rebase db push\`.`);
+    }
     if (drift.missing.length > 0) {
         lines.push("  Missing — described by your collections, absent from the database:");
         for (const p of drift.missing) lines.push(`    • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`);

package/src/security/rls-enforcement.ts

@@ -23,9 +23,14 @@ import { logger } from "@rebasepro/server";
  *    are validation/side-effects, not a security boundary.
  *
  *  - **Server context** — the base (owner) connection: auth flows, migrations,
- *    background jobs, and the explicit `rebase.dataAsAdmin` accessor. As table
- *    owner it bypasses RLS. This is the trusted plane, equivalent to
- *    Supabase's `service_role`.
+ *    and raw `rebase.sql`. As table owner it bypasses RLS. This is the trusted
+ *    plane, equivalent to Supabase's `service_role`.
+ *
+ *    `rebase.dataAsAdmin` is **not** in it, despite the name. `init.ts` scopes
+ *    that driver with `withAuth(SERVICE_IDENTITY)`, so it arrives as user
+ *    context above — `rebase_user`, `app.uid = 'service'`, policies evaluated —
+ *    and clears the default policies through their admin arm rather than the
+ *    `auth.uid() IS NULL` one.
  *
  * This module provides the three pieces:
  *
@@ -261,7 +266,7 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
         });
     }
 
-    logger.info(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
+    logger.debug(`🔐 [rls] User role "${REBASE_USER_ROLE}" provisioned (schemas: ${uniqueSchemas.join(", ")})`);
 }
 
 /**

package/src/services/FetchService.ts

@@ -2,8 +2,8 @@ import { and, asc, count, desc, eq, getTableColumns, getTableName, gt, lt, or, S
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 import { CollectionConfig, FilterValues, ResolvedRelation, LogicalCondition, isManyToMany } from "@rebasepro/types";
 import type { VectorSearchParams } from "@rebasepro/types";
-import { resolveCollectionRelations, findRelation, createRelationRef, createRelationRefWithData } from "@rebasepro/common";
-import { generateForeignKeyName } from "@rebasepro/utils";
+import { resolveCollectionRelations, findRelation, fieldKeyForColumn, createRelationRef, createRelationRefWithData } from "@rebasepro/common";
+import { generateForeignKeyName, toWireKey } from "@rebasepro/utils";
 import { DrizzleConditionBuilder, getUnknownFilterFieldsMode, type FilterCompilationOptions } from "../utils/drizzle-conditions";
 import {
     getCollectionByPath,
@@ -159,14 +159,21 @@ export class FetchService {
         // Owning relation, resolved: the relation names its own local key.
         const declaredRelation = collection ? resolveCollectionRelations(collection)[orderBy] : undefined;
         if (declaredRelation?.kind === "belongsTo") {
-            const foreignKey = columnAt(declaredRelation.localKey);
+            // `localKey` is the column; the table is keyed by the wire name.
+            const foreignKey = columnAt(fieldKeyForColumn(collection, declaredRelation.localKey));
             if (foreignKey) return foreignKey;
         }
 
-        // No collection in hand — the two shapes an owning relation's key takes
-        // by default (e.g. `project` → `project_id`, `userProfile` →
-        // `user_profile_id`).
-        for (const guess of [`${orderBy}_id`, generateForeignKeyName(orderBy)]) {
+        // No collection in hand — the shapes an owning relation's key takes by
+        // default (e.g. `project` → `projectId`, `userProfile` →
+        // `userProfileId`), then the snake forms for a project that authored the
+        // property under its column name.
+        for (const guess of [
+            `${orderBy}Id`,
+            toWireKey(generateForeignKeyName(orderBy)),
+            `${orderBy}_id`,
+            generateForeignKeyName(orderBy)
+        ]) {
             const foreignKey = columnAt(guess);
             if (foreignKey) return foreignKey;
         }
@@ -326,6 +333,14 @@ export class FetchService {
                         );
                     }
                 } catch (e) {
+                    // A relation that failed to load is not a relation that is absent.
+                    // Without this the request answers 200 with the field quietly
+                    // missing — and because a Postgres error poisons the surrounding
+                    // transaction, every later relation in the same request is
+                    // swallowed too, so one failure becomes a response missing
+                    // several fields. Same guard the four other catches in this file
+                    // already use.
+                    if (reachedDatabase(e)) throw e;
                     logger.warn(`Could not resolve joinPath relation '${key}'`, { error: e });
                 }
             });
@@ -404,6 +419,14 @@ export class FetchService {
                     }
                 }
             } catch (e) {
+                // A relation that failed to load is not a relation that is absent.
+                // Without this the request answers 200 with the field quietly
+                // missing — and because a Postgres error poisons the surrounding
+                // transaction, every later relation in the same request is
+                // swallowed too, so one failure becomes a response missing
+                // several fields. Same guard the four other catches in this file
+                // already use.
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`Could not batch resolve joinPath relation '${key}' for REST`, { error: e });
             }
         }
@@ -727,6 +750,14 @@ idColumn };
                                 values[key] = createRelationRef(e.id, e.path);
                             }
                         } catch (e) {
+                            // A relation that failed to load is not a relation that is absent.
+                            // Without this the request answers 200 with the field quietly
+                            // missing — and because a Postgres error poisons the surrounding
+                            // transaction, every later relation in the same request is
+                            // swallowed too, so one failure becomes a response missing
+                            // several fields. Same guard the four other catches in this file
+                            // already use.
+                            if (reachedDatabase(e)) throw e;
                             logger.warn(`Could not resolve one-to-one relation property: ${key}`, { error: e });
                         }
                     }
@@ -998,6 +1029,14 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                         }
                     });
                 } catch (e) {
+                    // A relation that failed to load is not a relation that is absent.
+                    // Without this the request answers 200 with the field quietly
+                    // missing — and because a Postgres error poisons the surrounding
+                    // transaction, every later relation in the same request is
+                    // swallowed too, so one failure becomes a response missing
+                    // several fields. Same guard the four other catches in this file
+                    // already use.
+                    if (reachedDatabase(e)) throw e;
                     logger.warn(`Could not batch load one-to-one relation property: ${key}`, { error: e });
                 }
             }
@@ -1025,6 +1064,14 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                         );
                     });
                 } catch (e) {
+                    // A relation that failed to load is not a relation that is absent.
+                    // Without this the request answers 200 with the field quietly
+                    // missing — and because a Postgres error poisons the surrounding
+                    // transaction, every later relation in the same request is
+                    // swallowed too, so one failure becomes a response missing
+                    // several fields. Same guard the four other catches in this file
+                    // already use.
+                    if (reachedDatabase(e)) throw e;
                     logger.warn(`Could not batch load many relation property: ${key}`, { error: e });
                 }
             }
@@ -1081,6 +1128,15 @@ relatedTo: hop });
         searchString: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /**
+             * An `or(...)`/`and(...)` group, applied alongside `filter`.
+             *
+             * `fetchRowsWithConditions` has always applied one; it was missing
+             * from this signature, so a realtime search subscription carrying a
+             * group could not pass it on and served every row matching the text
+             * that RLS allowed.
+             */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
@@ -1315,6 +1371,14 @@ relatedTo: hop }, include
                     }
                 }
             } catch (e) {
+                // A relation that failed to load is not a relation that is absent.
+                // Without this the request answers 200 with the field quietly
+                // missing — and because a Postgres error poisons the surrounding
+                // transaction, every later relation in the same request is
+                // swallowed too, so one failure becomes a response missing
+                // several fields. Same guard the four other catches in this file
+                // already use.
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[include] Failed to batch load one-to-one '${key}'`, { error: e });
             }
         }
@@ -1331,6 +1395,14 @@ relatedTo: hop }, include
                     (row as Record<string, unknown>)[key] = relatedList;
                 }
             } catch (e) {
+                // A relation that failed to load is not a relation that is absent.
+                // Without this the request answers 200 with the field quietly
+                // missing — and because a Postgres error poisons the surrounding
+                // transaction, every later relation in the same request is
+                // swallowed too, so one failure becomes a response missing
+                // several fields. Same guard the four other catches in this file
+                // already use.
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[include] Failed to batch load many '${key}'`, { error: e });
             }
         }
@@ -1439,6 +1511,14 @@ relatedTo: hop }, include
                     }));
                 }
             } catch (e) {
+                // A relation that failed to load is not a relation that is absent.
+                // Without this the request answers 200 with the field quietly
+                // missing — and because a Postgres error poisons the surrounding
+                // transaction, every later relation in the same request is
+                // swallowed too, so one failure becomes a response missing
+                // several fields. Same guard the four other catches in this file
+                // already use.
+                if (reachedDatabase(e)) throw e;
                 logger.warn(`[include] Failed to load relation '${key}'`, { error: e });
             }
         }
@@ -1453,6 +1533,19 @@ relatedTo: hop }, include
         collectionPath: string,
         options: {
             filter?: FilterValues<Extract<keyof M, string>>;
+            /**
+             * An `or(...)`/`and(...)` group, applied alongside `filter`.
+             *
+             * Declared *and applied*, because this is the path every REST search
+             * and vector read takes: `fetchCollectionForRest` skips `db.query`
+             * whenever a `searchString` or a `vectorSearch` is present. The
+             * group arrived here on `options` from the very beginning and was
+             * simply never read, so `?searchString=x&or=(...)` served every row
+             * matching `x` that RLS allowed — while `count` (which does apply
+             * it) reported the narrowed total, so `meta.total` and `data`
+             * described different sets of rows.
+             */
+            logical?: LogicalCondition;
             orderBy?: string;
             order?: "desc" | "asc";
             limit?: number;
@@ -1520,6 +1613,11 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             if (filterConditions.length > 0) allConditions.push(...filterConditions);
         }
 
+        if (options.logical) {
+            const logicalCondition = DrizzleConditionBuilder.buildLogicalConditions(options.logical, table, collectionPath, this.filterContext(collectionPath, table));
+            if (logicalCondition) allConditions.push(logicalCondition);
+        }
+
         if (vectorMeta?.filter) {
             allConditions.push(vectorMeta.filter);
         }