@rebasepro/server-postgres 0.14.1 → 0.14.2-canary.g991e9df

package/dist/index.es.js

@@ -3155,6 +3155,37 @@ function isRoleSwitchingPermissionError(error) {
 	return msg.includes("set role") || msg.includes("member of role");
 }
 /**
+* Was this `42501` the *caller* being refused by a policy, rather than the
+* server lacking a privilege?
+*
+* Both arrive as `insufficient_privilege`, and they are opposite kinds of
+* problem. A row-level-security refusal is a working access-control system
+* doing its job: the caller asked for something their policies do not permit,
+* which is a 403 and nobody's bug. A missing `GRANT` is the deployment being
+* wrong — the connection role cannot touch the table at all, no policy is
+* involved, and nothing the caller changes about the request will help.
+*
+* Postgres distinguishes them in the message, so this does too:
+*
+*     new row violates row-level security policy for table "notes"  → the caller
+*     permission denied for table notes                             → the server
+*
+* Only writes reach this. A read that RLS excludes is not an error — the rows
+* are filtered and the caller gets an empty page — so the erroring case is
+* specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.
+*
+* Matched on the message because that is the only thing carrying the
+* distinction; the SQLSTATE is identical either way. Narrow by design: anything
+* not naming row-level security stays the server's problem, since reporting a
+* genuine privilege misconfiguration as "forbidden" would send an operator
+* hunting for a policy bug that does not exist.
+*/
+function isRowLevelSecurityDenial(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	return pgError.message.toLowerCase().includes("row-level security policy");
+}
+/**
 * Translate a raw PostgreSQL error into a user-friendly message.
 *
 * @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
@@ -3209,8 +3240,11 @@ function pgErrorToFriendlyMessage(pgError, context) {
 			message: `Table not found for "${context}": ${pgMessage}. Check if your schema is up to date (run migrations).${suffix}`,
 			code
 		};
-		case "42501": return {
-			message: `Permission denied on "${tableRef}". Check your database credentials and RLS policies.${suffix}`,
+		case "42501": return pgMessage.toLowerCase().includes("row-level security policy") ? {
+			message: `Not permitted to write this row in "${tableRef}": it does not satisfy the row-level security policy.${suffix}`,
+			code
+		} : {
+			message: `Permission denied on "${tableRef}": the database role this server connects as lacks privileges on it.${suffix}`,
 			code
 		};
 		case "28000": return {
@@ -4766,6 +4800,7 @@ var PersistService = class {
 		if (pgError) {
 			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
 			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
+			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);