@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.0

package/src/services/PersistService.ts

@@ -1,10 +1,11 @@
 import { eq, and, sql, SQL } from "drizzle-orm";
 import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CollectionConfig, Properties, ResolvedRelation, type ResolvedManyToMany, isManyToMany, hasForeignKeyOnTarget } from "@rebasepro/types";
-import { getTableName, resolveCollectionRelations } from "@rebasepro/common";
+import { CollectionConfig, Properties, Property, ResolvedRelation, type ResolvedManyToMany, isManyToMany, hasForeignKeyOnTarget } from "@rebasepro/types";
+import { getTableName, resolveCollectionRelations, fieldKeyForColumn } from "@rebasepro/common";
 import { DrizzleConditionBuilder } from "../utils/drizzle-conditions";
 import {
+    assertWritableColumns,
     getCollectionByPath,
     getTableForCollection,
     getPrimaryKeys,
@@ -13,6 +14,7 @@ import {
 } from "./collection-helpers";
 import { sanitizeAndConvertDates, serializeDataToServer } from "../data-transformer";
 import { RelationService } from "./RelationService";
+import { RelationWriteService } from "./RelationWriteService";
 import { FetchService } from "./FetchService";
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
@@ -25,39 +27,31 @@ import {
 } from "./nested-path";
 import { ApiError, logger } from "@rebasepro/server";
 import { extractPgError, extractCauseMessage, pgErrorToFriendlyMessage } from "../utils/pg-error-utils";
+import { explainZeroRowWrite } from "./write-denial";
 
 /**
  * Service for handling all row write operations.
  * Handles saving, deleting, and updating rows.
  */
 export class PersistService {
+    /** Reads: whether a row is under a parent, the key a link joins on. */
     private relationService: RelationService;
+    /** Writes: junction membership, foreign-key stamping, links. */
+    private relationWrites: RelationWriteService;
     private fetchService: FetchService;
 
     constructor(private db: DrizzleClient, private registry: PostgresCollectionRegistry) {
         this.relationService = new RelationService(db, registry);
+        this.relationWrites = new RelationWriteService(db, registry);
         this.fetchService = new FetchService(db, registry);
     }
 
 
     /**
-     * Explain a write that matched no rows.
-     *
-     * Row-level security filters UPDATE and DELETE through the policy's USING
-     * clause instead of raising: a denied write is reported by Postgres exactly
-     * like a successful one that happened to match nothing. Left unchecked, a
-     * caller cannot tell "denied" from "done" — the write returns 200/204 and
-     * the row is untouched.
-     *
-     * Re-reading the target over the *same* RLS-scoped handle separates the two
-     * cases. A visible row means the policy rejected the write (403); an
-     * invisible one means there is nothing there to write for this caller (404,
-     * matching what a GET would say). The re-read is bound by the caller's own
-     * policies, so it discloses nothing a plain read wouldn't.
-     *
-     * Only reached when zero rows matched, so the happy path pays nothing.
+     * Explain a row write that matched nothing — see {@link explainZeroRowWrite}
+     * for why a zero-row write cannot be reported as success.
      */
-    private async explainZeroRowWrite(
+    private explainZeroRowWrite(
         handle: DrizzleClient,
         table: PgTable,
         conditions: SQL[],
@@ -65,20 +59,11 @@ export class PersistService {
         id: string | number,
         operation: "update" | "delete"
     ): Promise<ApiError> {
-        const visible = await handle
-            .select({ present: sql<number>`1` })
-            .from(table)
-            .where(and(...conditions))
-            .limit(1);
-
-        if (visible.length > 0) {
-            return ApiError.forbidden(
-                `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`,
-                "WRITE_DENIED"
-            );
-        }
-
-        return ApiError.notFound(
+        return explainZeroRowWrite(
+            handle,
+            table,
+            conditions,
+            `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`,
             `No row "${id}" in "${collectionPath}" to ${operation}.`
         );
     }
@@ -107,7 +92,7 @@ export class PersistService {
                         "RELATION_NOT_UNLINKABLE"
                     );
                 }
-                await this.relationService.unlinkRelatedEntity(this.db, hop, id);
+                await this.relationWrites.unlinkRelatedEntity(this.db, hop, id);
                 return;
             }
             // Owned child (inverse FK): deleting the row is the right meaning,
@@ -148,8 +133,14 @@ export class PersistService {
     }
 
     /**
-     * The column on the *target* table that records the parent, for a create
-     * under a nested one-to-many path.
+     * The field on the *target* row that records the parent, for a create under
+     * a nested one-to-many path.
+     *
+     * A **field**, not the column: the value is stamped into the caller's
+     * payload, which is keyed by wire names — `authorId`, never the `author_id`
+     * the relation names its link by. Stamping the column instead put a key on
+     * the payload that no property answers to, and `strictWrites` rejected the
+     * request the framework had just written to.
      *
      * Returns `undefined` when the link is not a column at all (a multi-hop
      * `joinPath`), so the caller writes the row without stamping anything.
@@ -164,13 +155,16 @@ export class PersistService {
         switch (relation.kind) {
             case "hasOne":
             case "hasMany":
-                return relation.foreignKeyOnTarget;
+                return fieldKeyForColumn(hop.targetCollection, relation.foreignKeyOnTarget);
 
             case "via":
                 // The link lives in an intermediate table, not in a column on
                 // the target — nothing to stamp.
                 return relation.joinPath.length === 1
-                    ? DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0]
+                    ? fieldKeyForColumn(
+                        hop.targetCollection,
+                        DrizzleConditionBuilder.getColumnNamesFromColumns(relation.joinPath[0].on.to)[0]
+                    )
                     : undefined;
 
             default:
@@ -307,6 +301,11 @@ export class PersistService {
 
             const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 
+            // Everything below builds SQL from the table's own column list, so
+            // a key that is not a column is silently left out rather than
+            // refused. Say so here, while the key is still in hand.
+            assertWritableColumns(entityData as Record<string, unknown>, table, effectiveCollectionPath);
+
             savedId = await this.db.transaction(async (tx) => {
                 let currentId: string | number;
 
@@ -322,7 +321,7 @@ export class PersistService {
                     // Example: changing author A→B with stale profile P1 (A's):
                     //   reads old author_id=A → clears P1.author_id → re-sets P1.author_id=A (no-op).
                     if (joinPathRelationUpdates.length > 0) {
-                        await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+                        await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
                     }
 
                     // Only issue an UPDATE if there are scalar columns to set.
@@ -380,6 +379,23 @@ export class PersistService {
                         // branch; Postgres rejects that against the conflict target.
                         for (const info of idInfoArray) delete set[info.fieldName];
 
+                        // A conflict means the row was already there, so its
+                        // `on_create` stamp is a fact about the past and not
+                        // this write's to redecide. Bulk rows are saved with
+                        // `status: "new"` on purpose (an import's rows carry a
+                        // natural key for rows that may not exist), which
+                        // computes the creation timestamp for every row — and
+                        // the conflict-update then wrote it over the original.
+                        // A nightly re-import reset `createdAt` on everything
+                        // it touched, and every "new this week" query with it.
+                        // The INSERT branch keeps the value: it is right there.
+                        for (const [propName, prop] of Object.entries(collection.properties ?? {})) {
+                            if ((prop as Property).type === "date"
+                                && (prop as { autoValue?: string }).autoValue === "on_create") {
+                                delete set[propName];
+                            }
+                        }
+
                         result = Object.keys(set).length > 0
                             ? await insertQuery.onConflictDoUpdate({ target, set }).returning(returningKeys)
                             : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
@@ -406,18 +422,18 @@ export class PersistService {
 
                     // For inserts, apply joinPath after since the parent row didn't exist before
                     if (joinPathRelationUpdates.length > 0) {
-                        await this.relationService.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
+                        await this.relationWrites.updateJoinPathOneToOneRelations(tx, collection, currentId, joinPathRelationUpdates);
                     }
                 }
 
                 // Handle inverse relation updates
                 if (inverseRelationUpdates.length > 0) {
-                    await this.relationService.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
+                    await this.relationWrites.updateInverseRelations(tx, collection, currentId, inverseRelationUpdates);
                 }
 
                 // Update many-to-many relations
                 if (Object.keys(relationValues).length > 0) {
-                    await this.relationService.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
+                    await this.relationWrites.updateRelationsUsingJoins(tx, collection, currentId, relationValues);
                 }
 
                 // Attach the row to the parent's set. Runs for updates as well as
@@ -426,7 +442,7 @@ export class PersistService {
                 // path. The insert is idempotent, so re-asserting a link is a
                 // no-op rather than a duplicate-key error.
                 if (junctionTableInfo) {
-                    await this.relationService.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
+                    await this.relationWrites.handleJunctionTableCreation(tx, currentId, junctionTableInfo);
                 }
 
                 return currentId;
@@ -455,6 +471,16 @@ export class PersistService {
         return this.relationService;
     }
 
+    /**
+     * The write half, for external use. Separate from
+     * {@link getRelationService} because they are separate objects now: reads
+     * answer questions, writes change rows, and the callers of one are not the
+     * callers of the other.
+     */
+    getRelationWriteService(): RelationWriteService {
+        return this.relationWrites;
+    }
+
     /**
      * Get the FetchService instance for external use
      */