@rebasepro/server-postgres 0.14.1 → 0.14.2-canary.gca521e9

package/dist/index.es.js

@@ -3,10 +3,10 @@ import process from "process";
 __createRequire(import.meta.url);
 import { a as guardPoolAgainstDirtyRelease, i as createReadReplicaConnection, n as createDirectDatabaseConnection, o as pinSearchPath, r as createPostgresDatabaseConnection } from "./connection-BuZ97wsr.js";
 import { n as resolveClientListLimit, t as ListLimitError } from "./data_driver-ULAyJEi9.js";
-import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-C-FDnL_e.js";
+import { $ as mergeDeep, A as fieldKeyForColumn, B as parseIdValues, C as getJunctionCollectionConfig, D as policyToPostgres, E as getEffectiveSecurityRules, F as getTableVarName, G as updateDateAutoValues, H as createRelationRef, I as resolveCollectionRelations, J as legacyForeignKeyName, K as firstFreeKey, L as buildCompositeId, M as getColumnName, N as getEnumVarName, O as securityRuleToConditions, P as getTableName$1, Q as isPrototypePollutingKey, R as getDeclaredPrimaryKeys, S as resolveStringColumnLength, T as resolveJunctionSpecs, U as createRelationRefWithData, V as sortCollectionsBySlug, W as normalizeToEntityRelation, X as toWireKey, Z as getPolicyNamesForRule, _ as OrderBySpecError, at as isManyToMany, b as CollectionRegistry, et as camelCase, g as buildSdkData, h as visibleColumnProjection, it as hasForeignKeyOnTarget, j as findRelation, l as buildSearchColumnSpec, ot as Vector, q as generateForeignKeyName, r as authUsersColumnSql, s as SEARCH_UNACCENT_FN, t as AUTH_USERS_COLUMNS, tt as toSnakeCase, u as hiddenColumnsOption, v as normalizeDriverOrderBy, w as getJunctionSecurityRules, x as relationalCollections, y as parseOrderBySpecStrict, z as isAddressableId } from "./auth-users-columns-DLwxDqYb.js";
 import { c as isPostgresCollectionConfig, f as ALL_WHERE_FILTER_OPS, l as isRelationalCollectionConfig } from "./src-DCdn3Val.js";
 import { t as createPostgresWebSocket } from "./websocket-D2jXv0Ds.js";
-import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-gUNDfm7l.js";
+import { a as warnOnAnonymousGrants, c as REBASE_USER_ROLE, i as validatePolicyPgRoles, l as revokeInternalTableAccess, n as detectConnectionPosture, o as warnOnLegacyRlsFunctions, r as ensureAppRole, s as warnOnRoleSchemaCollision, t as applyAuthContext, u as revokeInternalTableSql } from "./rls-enforcement-Kz0NpF8J.js";
 import { A as parsePgToolMajor, C as checkToolServerCompatibility, D as parseBackupDestination, E as joinStorageKey, M as serverVersionNumToMajor, N as splitGlobalsStatements, O as parseBackupTimestamp, P as withDatabaseName, S as buildRowSecurityPgOptions, T as globalsFileForDump, _ as buildBackupFilename, a as detectToolMajor, b as buildPgRestoreArgs, c as listBackups, d as resolvePgBinary, f as restoreDump, g as selectBackupsToPrune, h as require_source, i as createDump, j as resolveConnectionString, k as parseDbNameFromUrl, l as preflight, m as validateDump, n as applyGlobals, o as ensureDatabaseExists, p as uploadBackup, s as getServerVersionMajor, t as BackupToolError, u as pruneBackups, v as buildPgDumpArgs, w as diagnoseRowSecurityDumpFailure, x as buildPgRestoreListArgs, y as buildPgDumpallGlobalsArgs } from "./backup-service-BH0Dzo_h.js";
 import { t as RLS_BOOTSTRAP_STATEMENTS } from "./rls-bootstrap-sql-69hYT8nr.js";
 import { Client, Pool } from "pg";
@@ -3155,6 +3155,37 @@ function isRoleSwitchingPermissionError(error) {
 	return msg.includes("set role") || msg.includes("member of role");
 }
 /**
+* Was this `42501` the *caller* being refused by a policy, rather than the
+* server lacking a privilege?
+*
+* Both arrive as `insufficient_privilege`, and they are opposite kinds of
+* problem. A row-level-security refusal is a working access-control system
+* doing its job: the caller asked for something their policies do not permit,
+* which is a 403 and nobody's bug. A missing `GRANT` is the deployment being
+* wrong — the connection role cannot touch the table at all, no policy is
+* involved, and nothing the caller changes about the request will help.
+*
+* Postgres distinguishes them in the message, so this does too:
+*
+*     new row violates row-level security policy for table "notes"  → the caller
+*     permission denied for table notes                             → the server
+*
+* Only writes reach this. A read that RLS excludes is not an error — the rows
+* are filtered and the caller gets an empty page — so the erroring case is
+* specifically an `INSERT`/`UPDATE` whose row fails a policy's `WITH CHECK`.
+*
+* Matched on the message because that is the only thing carrying the
+* distinction; the SQLSTATE is identical either way. Narrow by design: anything
+* not naming row-level security stays the server's problem, since reporting a
+* genuine privilege misconfiguration as "forbidden" would send an operator
+* hunting for a policy bug that does not exist.
+*/
+function isRowLevelSecurityDenial(error) {
+	const pgError = extractPgError(error);
+	if (!pgError || pgError.code !== "42501") return false;
+	return pgError.message.toLowerCase().includes("row-level security policy");
+}
+/**
 * Translate a raw PostgreSQL error into a user-friendly message.
 *
 * @param pgError  - The extracted PostgreSQL error (from {@link extractPgError})
@@ -3209,8 +3240,11 @@ function pgErrorToFriendlyMessage(pgError, context) {
 			message: `Table not found for "${context}": ${pgMessage}. Check if your schema is up to date (run migrations).${suffix}`,
 			code
 		};
-		case "42501": return {
-			message: `Permission denied on "${tableRef}". Check your database credentials and RLS policies.${suffix}`,
+		case "42501": return pgMessage.toLowerCase().includes("row-level security policy") ? {
+			message: `Not permitted to write this row in "${tableRef}": it does not satisfy the row-level security policy.${suffix}`,
+			code
+		} : {
+			message: `Permission denied on "${tableRef}": the database role this server connects as lacks privileges on it.${suffix}`,
 			code
 		};
 		case "28000": return {
@@ -4766,6 +4800,7 @@ var PersistService = class {
 		if (pgError) {
 			const { message, code } = pgErrorToFriendlyMessage(pgError, collectionSlug);
 			if (/^2[23]/.test(code)) return code === "23505" ? ApiError.conflict(message, `PG_${code}`) : ApiError.badRequest(message, `PG_${code}`);
+			if (isRowLevelSecurityDenial(error)) return ApiError.forbidden(message, "WRITE_DENIED");
 			return new Error(message);
 		}
 		const causeMessage = extractCauseMessage(error);
@@ -13512,7 +13547,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* proved it can bootstrap with.
 		*/
 		async ensureCollectionSchema(collections, driverResult, log) {
-			const { ensureCollectionTables } = await import("./ensure-collection-tables-DT2eq859.js");
+			const { ensureCollectionTables } = await import("./ensure-collection-tables-Dnb7scJ1.js");
 			const plan = await ensureCollectionTables(provisioningQueryable(driverResult), collections, log);
 			for (const failure of plan.failures) logger.warn(failure.kind === "comment-column" ? `🔍 [schema] Could not record the search fingerprint on "${failure.target}" — search works, but a later change to the \`search\` block will not be detected: ${failure.error}` : `🔗 [schema] Could not add foreign key "${failure.target}" — the column exists and the collection still serves, but rows are not policed by this constraint: ${failure.error}`);
 			return { applied: plan.actions.length - plan.failures.length };
@@ -13533,7 +13568,7 @@ function createPostgresBootstrapper(pgConfig) {
 		* stays RLS-enabled, so it denies rather than leaks.
 		*/
 		async ensureCollectionPolicies(collections, driverResult, log) {
-			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-DoHwhVf8.js");
+			const { ensureCollectionPolicies } = await import("./ensure-collection-policies-KzpXpHEL.js");
 			const queryable = provisioningQueryable(driverResult);
 			const outcome = await ensureCollectionPolicies(queryable, collections, log);
 			for (const skip of outcome.skipped) logger.warn(`🔐 [rls] Policies not applied to "${skip.table}": ${skip.reason}`);