@rebasepro/server-postgres 0.13.1-canary.gf57a27e → 0.14.1-canary.g7e666eb

package/dist/PostgresBackendDriver.d.ts

@@ -152,7 +152,7 @@ export declare class PostgresBackendDriver implements DataDriver {
     delete<M extends Record<string, unknown>>({ row, collection }: DeleteProps<M>): Promise<void>;
     deleteAll(path: string): Promise<void>;
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;
-    count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString }: FetchCollectionProps<M>): Promise<number>;
+    count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString, vectorSearch }: FetchCollectionProps<M>): Promise<number>;
     private getTargetDb;
     executeSql(sqlText: string, options?: {
         database?: string;

package/dist/PostgresBootstrapper.d.ts

@@ -89,6 +89,32 @@ export interface PostgresDriverInternals {
  * and this is the part that was wrong.
  */
 export declare function resolveDriftCheckName(col: CollectionConfig, registeredTableNames: string[]): string;
+/**
+ * Is this the local database `rebase init` scaffolds — i.e. the one case where
+ * "you are connected as a superuser" is not news?
+ *
+ * The scaffold's own `docker-compose.yml` sets `POSTGRES_USER: rebase_app`,
+ * which makes that role the cluster superuser, so the superuser advisory below
+ * was the only WARN a brand-new project ever saw and it was about a decision
+ * the tool had made for the developer.
+ *
+ * Of the two available fixes — provision a non-superuser table-owner role in
+ * the scaffold, or recognise the local shape and stay quiet — this is the
+ * second, because the first breaks the scaffold it is meant to improve: a
+ * non-superuser owner cannot `CREATE EXTENSION` (search collections need
+ * `pg_trgm`/`unaccent`, applied by `rebase db push` and again by the boot
+ * schema-ensure), so the very first `pnpm run db:push` on a scaffolded project
+ * with a search block would fail. Trading a working first run for a quieter log
+ * line is the wrong trade.
+ *
+ * The condition is deliberately narrow — a *non-production* process talking to
+ * a database on the loopback interface. A genuine production superuser
+ * connection still warns, and so does a non-production process pointed at a
+ * remote database (the usual "my dev machine writes to staging" mistake, where
+ * the advisory is exactly right). NODE_ENV alone would not do: the scaffold
+ * ships `NODE_ENV=development` and some deployments inherit it.
+ */
+export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
 /**
  * Default PostgreSQL bootstrapper.
  *

package/dist/auth/services.d.ts

@@ -58,6 +58,16 @@ export declare class UserService implements UserRepository {
     private withServerContext;
     private mapRowToUser;
     private mapPayload;
+    /**
+     * @see UserRepository.createUser — an email already in use is a 409.
+     *
+     * The route checks first and answers 409; this is the same answer for the
+     * requests that get past the check, which two clicks on a signup button
+     * are enough to produce. `PersistService` has mapped `23505` to a conflict
+     * for collection writes since the layer that holds the SQLSTATE was made
+     * responsible for saying whose fault a failure is; the auth writes never
+     * got the same treatment and reached the client as "Internal Server Error".
+     */
     createUser(data: CreateUserData): Promise<UserData>;
     getUserById(id: string): Promise<UserData | null>;
     getUserByEmail(email: string): Promise<UserData | null>;
@@ -287,6 +297,7 @@ export declare class PostgresAuthRepository implements AuthRepository {
         secretEncrypted: string;
     }) | null>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
@@ -296,6 +307,8 @@ export declare class PostgresAuthRepository implements AuthRepository {
     getUnusedRecoveryCodeCount(uid: string): Promise<number>;
     deleteAllRecoveryCodes(uid: string): Promise<void>;
     hasVerifiedMfaFactors(uid: string): Promise<boolean>;
+    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
+    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
 }
 /**
  * PostgreSQL implementation of MfaRepository.
@@ -311,10 +324,28 @@ export declare class MfaService implements MfaRepository {
     getMfaFactorById(factorId: string): Promise<(MfaFactor & {
         secretEncrypted: string;
     }) | null>;
+    /**
+     * Spend a TOTP time step, once and only once.
+     *
+     * One statement: the `WHERE` is the check, the `UPDATE` is the act, and
+     * `RETURNING` reports which of two concurrent requests carrying the same
+     * six digits won. Reading the counter and then writing it would let both
+     * pass — the exact replay this closes.
+     */
+    claimMfaFactorCounter(factorId: string, counter: number): Promise<boolean>;
     verifyMfaFactor(factorId: string): Promise<void>;
+    updateMfaFactorSecret(factorId: string, secretEncrypted: string): Promise<void>;
     deleteMfaFactor(factorId: string, uid: string): Promise<void>;
     createMfaChallenge(factorId: string, ipAddress?: string): Promise<MfaChallengeInfo>;
     getMfaChallengeById(challengeId: string): Promise<MfaChallengeInfo | null>;
+    /**
+     * Count one failed guess against a challenge and report the new total.
+     *
+     * Incremented in the database rather than in the route so that guesses
+     * arriving in parallel — the shape any real brute-force takes — cannot
+     * share a single increment.
+     */
+    recordMfaChallengeAttempt(challengeId: string): Promise<number>;
     verifyMfaChallenge(challengeId: string): Promise<void>;
     createRecoveryCodes(uid: string, codeHashes: string[]): Promise<void>;
     useRecoveryCode(uid: string, codeHash: string): Promise<boolean>;