@rebasepro/server-postgres 0.15.0 → 0.15.1-canary.g869ace1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/PostgresBackendDriver.d.ts +1 -1
- package/dist/PostgresBootstrapper.d.ts +0 -11
- package/dist/auth/services.d.ts +2 -2
- package/dist/{auth-users-columns-JJ8ngvy5.js → auth-users-columns-CgyPWQ18.js} +3 -3
- package/dist/auth-users-columns-CgyPWQ18.js.map +1 -0
- package/dist/backup/backup-logic.d.ts +20 -0
- package/dist/backup/backup-service.d.ts +6 -0
- package/dist/backup/retention.d.ts +11 -0
- package/dist/{backup-service-czK-OAuG.js → backup-service-BZoixhVl.js} +56 -11
- package/dist/backup-service-BZoixhVl.js.map +1 -0
- package/dist/collections-schema-version-BMeu3cgv.js +81 -0
- package/dist/collections-schema-version-BMeu3cgv.js.map +1 -0
- package/dist/{ensure-collection-policies-D5PtQLyR.js → ensure-collection-policies-BVFb2olB.js} +4 -3
- package/dist/ensure-collection-policies-BVFb2olB.js.map +1 -0
- package/dist/{ensure-collection-tables-BHUjQ-z4.js → ensure-collection-tables-BY1pHRD_.js} +2 -2
- package/dist/{ensure-collection-tables-BHUjQ-z4.js.map → ensure-collection-tables-BY1pHRD_.js.map} +1 -1
- package/dist/index.es.js +65 -21
- package/dist/index.es.js.map +1 -1
- package/dist/{rls-enforcement-BDBfuTD4.js → rls-enforcement-Ch0T6OwW.js} +7 -7
- package/dist/rls-enforcement-Ch0T6OwW.js.map +1 -0
- package/dist/schema/collections-schema-version.d.ts +32 -0
- package/dist/security/policy-drift.d.ts +2 -2
- package/dist/security/rls-enforcement.d.ts +6 -6
- package/dist/services/realtimeService.d.ts +3 -1
- package/dist/src-BBFsDaeA.js.map +1 -1
- package/dist/websocket-BVgDVO-V.js.map +1 -1
- package/package.json +6 -6
- package/src/PostgresAdapter.ts +14 -0
- package/src/PostgresBackendDriver.ts +3 -3
- package/src/PostgresBootstrapper.ts +82 -12
- package/src/auth/services.ts +2 -2
- package/src/backup/backup-cli.ts +49 -12
- package/src/backup/backup-logic.ts +31 -0
- package/src/backup/backup-service.ts +42 -8
- package/src/backup/pg-tools.ts +12 -1
- package/src/backup/retention.ts +11 -0
- package/src/schema/collections-schema-version.ts +103 -0
- package/src/security/policy-drift.test.ts +25 -6
- package/src/security/policy-drift.ts +14 -6
- package/src/security/rls-enforcement.ts +7 -7
- package/src/services/realtimeService.ts +9 -1
- package/dist/auth-users-columns-JJ8ngvy5.js.map +0 -1
- package/dist/backup-service-czK-OAuG.js.map +0 -1
- package/dist/ensure-collection-policies-D5PtQLyR.js.map +0 -1
- package/dist/rls-enforcement-BDBfuTD4.js.map +0 -1
|
@@ -168,7 +168,7 @@ export declare class PostgresBackendDriver implements DataDriver {
|
|
|
168
168
|
* PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
|
|
169
169
|
* are the roles the SQL editor can `SET ROLE` to. *These* are the strings
|
|
170
170
|
* held in the users table's `roles` column, injected per-transaction as
|
|
171
|
-
* `
|
|
171
|
+
* `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
|
|
172
172
|
* into a `SecurityRule.roles` field produces a condition no user can ever
|
|
173
173
|
* satisfy, so the two must not be conflated.
|
|
174
174
|
*
|
|
@@ -134,15 +134,4 @@ export declare function describeSchemaDriftCause(provisioning: {
|
|
|
134
134
|
* ships `NODE_ENV=development` and some deployments inherit it.
|
|
135
135
|
*/
|
|
136
136
|
export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
|
|
137
|
-
/**
|
|
138
|
-
* Default PostgreSQL bootstrapper.
|
|
139
|
-
*
|
|
140
|
-
* Use it to register Postgres with `initializeRebaseBackend()`:
|
|
141
|
-
* ```typescript
|
|
142
|
-
* initializeRebaseBackend({
|
|
143
|
-
* ...config,
|
|
144
|
-
* bootstrappers: [postgresBootstrapper()]
|
|
145
|
-
* });
|
|
146
|
-
* ```
|
|
147
|
-
*/
|
|
148
137
|
export declare function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper;
|
package/dist/auth/services.d.ts
CHANGED
|
@@ -44,7 +44,7 @@ export declare class UserService implements UserRepository {
|
|
|
44
44
|
* Run a privileged auth write with an explicitly cleared RLS context.
|
|
45
45
|
*
|
|
46
46
|
* The auth services run on the base/owner connection, which by design
|
|
47
|
-
* carries a NULL `app.uid` so the `
|
|
47
|
+
* carries a NULL `app.uid` so the `rebase.uid() IS NULL` server-escape
|
|
48
48
|
* in the default policies applies. That NULL is normally guaranteed by
|
|
49
49
|
* `set_config(..., is_local = true)` resetting at transaction end — but a
|
|
50
50
|
* GUC that survives on a pooled connection (or a connection role that
|
|
@@ -52,7 +52,7 @@ export declare class UserService implements UserRepository {
|
|
|
52
52
|
* turns the trusted write into an RLS-scoped one and denies it with
|
|
53
53
|
* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
|
|
54
54
|
* single chokepoint, makes the server context deterministic instead of
|
|
55
|
-
* trusting whatever state the pool hands us. `
|
|
55
|
+
* trusting whatever state the pool hands us. `rebase.uid()` reads '' as
|
|
56
56
|
* NULL via NULLIF, so '' is the server context.
|
|
57
57
|
*/
|
|
58
58
|
private withServerContext;
|
|
@@ -2719,7 +2719,7 @@ function rolesArraySql(roles) {
|
|
|
2719
2719
|
* rows").
|
|
2720
2720
|
*
|
|
2721
2721
|
* **For auth collections additionally**
|
|
2722
|
-
* 3. A permissive **self SELECT** grant (`id =
|
|
2722
|
+
* 3. A permissive **self SELECT** grant (`id = rebase.uid()`), so users can read
|
|
2723
2723
|
* their own row (profile, session bootstrap) without every app re-declaring
|
|
2724
2724
|
* it.
|
|
2725
2725
|
* 4. A **restrictive** admin write gate. Restrictive policies are AND'd with
|
|
@@ -2728,7 +2728,7 @@ function rolesArraySql(roles) {
|
|
|
2728
2728
|
* such as "a user may edit their own row". Without this, a permissive owner
|
|
2729
2729
|
* rule would let a user change their own `roles`.
|
|
2730
2730
|
*
|
|
2731
|
-
* The server context is recognised as `
|
|
2731
|
+
* The server context is recognised as `rebase.uid() IS NULL` (`policy.serverContext()`)
|
|
2732
2732
|
* — the built-in flows that run without a user (signup, migrations) set no user
|
|
2733
2733
|
* GUC — which also lets the owner connection satisfy these policies even under
|
|
2734
2734
|
* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
|
|
@@ -5704,4 +5704,4 @@ function isAuthCollection(collection) {
|
|
|
5704
5704
|
//#endregion
|
|
5705
5705
|
export { mergeDeep as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, isPrototypePollutingKey as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, toWireKey as X, toPostgresIdentifier as Y, getPolicyNamesForRule as Z, OrderBySpecError as _, SEARCH_STAMP_PREFIX as a, isManyToMany as at, CollectionRegistry as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, camelCase as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, hasForeignKeyOnTarget as it, findRelation as j, findAnonymousGrants as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, DEFAULT_ONE_OF_TYPE as nt, SEARCH_TEXT_FN as o, Vector as ot, searchHelperFunctions as p, generateForeignKeyName as q, authUsersColumnSql as r, DEFAULT_ONE_OF_VALUE as rt, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, toSnakeCase as tt, hiddenColumnsOption as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
|
|
5706
5706
|
|
|
5707
|
-
//# sourceMappingURL=auth-users-columns-
|
|
5707
|
+
//# sourceMappingURL=auth-users-columns-CgyPWQ18.js.map
|