@rebasepro/server-postgres 0.15.0 → 0.15.1-canary.g869ace1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (45) hide show
  1. package/dist/PostgresBackendDriver.d.ts +1 -1
  2. package/dist/PostgresBootstrapper.d.ts +0 -11
  3. package/dist/auth/services.d.ts +2 -2
  4. package/dist/{auth-users-columns-JJ8ngvy5.js → auth-users-columns-CgyPWQ18.js} +3 -3
  5. package/dist/auth-users-columns-CgyPWQ18.js.map +1 -0
  6. package/dist/backup/backup-logic.d.ts +20 -0
  7. package/dist/backup/backup-service.d.ts +6 -0
  8. package/dist/backup/retention.d.ts +11 -0
  9. package/dist/{backup-service-czK-OAuG.js → backup-service-BZoixhVl.js} +56 -11
  10. package/dist/backup-service-BZoixhVl.js.map +1 -0
  11. package/dist/collections-schema-version-BMeu3cgv.js +81 -0
  12. package/dist/collections-schema-version-BMeu3cgv.js.map +1 -0
  13. package/dist/{ensure-collection-policies-D5PtQLyR.js → ensure-collection-policies-BVFb2olB.js} +4 -3
  14. package/dist/ensure-collection-policies-BVFb2olB.js.map +1 -0
  15. package/dist/{ensure-collection-tables-BHUjQ-z4.js → ensure-collection-tables-BY1pHRD_.js} +2 -2
  16. package/dist/{ensure-collection-tables-BHUjQ-z4.js.map → ensure-collection-tables-BY1pHRD_.js.map} +1 -1
  17. package/dist/index.es.js +65 -21
  18. package/dist/index.es.js.map +1 -1
  19. package/dist/{rls-enforcement-BDBfuTD4.js → rls-enforcement-Ch0T6OwW.js} +7 -7
  20. package/dist/rls-enforcement-Ch0T6OwW.js.map +1 -0
  21. package/dist/schema/collections-schema-version.d.ts +32 -0
  22. package/dist/security/policy-drift.d.ts +2 -2
  23. package/dist/security/rls-enforcement.d.ts +6 -6
  24. package/dist/services/realtimeService.d.ts +3 -1
  25. package/dist/src-BBFsDaeA.js.map +1 -1
  26. package/dist/websocket-BVgDVO-V.js.map +1 -1
  27. package/package.json +6 -6
  28. package/src/PostgresAdapter.ts +14 -0
  29. package/src/PostgresBackendDriver.ts +3 -3
  30. package/src/PostgresBootstrapper.ts +82 -12
  31. package/src/auth/services.ts +2 -2
  32. package/src/backup/backup-cli.ts +49 -12
  33. package/src/backup/backup-logic.ts +31 -0
  34. package/src/backup/backup-service.ts +42 -8
  35. package/src/backup/pg-tools.ts +12 -1
  36. package/src/backup/retention.ts +11 -0
  37. package/src/schema/collections-schema-version.ts +103 -0
  38. package/src/security/policy-drift.test.ts +25 -6
  39. package/src/security/policy-drift.ts +14 -6
  40. package/src/security/rls-enforcement.ts +7 -7
  41. package/src/services/realtimeService.ts +9 -1
  42. package/dist/auth-users-columns-JJ8ngvy5.js.map +0 -1
  43. package/dist/backup-service-czK-OAuG.js.map +0 -1
  44. package/dist/ensure-collection-policies-D5PtQLyR.js.map +0 -1
  45. package/dist/rls-enforcement-BDBfuTD4.js.map +0 -1
@@ -168,7 +168,7 @@ export declare class PostgresBackendDriver implements DataDriver {
168
168
  * PostgreSQL roles from `pg_roles` (`postgres`, `rebase_user`, …). Those
169
169
  * are the roles the SQL editor can `SET ROLE` to. *These* are the strings
170
170
  * held in the users table's `roles` column, injected per-transaction as
171
- * `auth.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
171
+ * `rebase.roles()` and matched by `SecurityRule.roles`. Feeding the pg roles
172
172
  * into a `SecurityRule.roles` field produces a condition no user can ever
173
173
  * satisfy, so the two must not be conflated.
174
174
  *
@@ -134,15 +134,4 @@ export declare function describeSchemaDriftCause(provisioning: {
134
134
  * ships `NODE_ENV=development` and some deployments inherit it.
135
135
  */
136
136
  export declare function isScaffoldedLocalDatabase(connectionString: string | undefined): boolean;
137
- /**
138
- * Default PostgreSQL bootstrapper.
139
- *
140
- * Use it to register Postgres with `initializeRebaseBackend()`:
141
- * ```typescript
142
- * initializeRebaseBackend({
143
- * ...config,
144
- * bootstrappers: [postgresBootstrapper()]
145
- * });
146
- * ```
147
- */
148
137
  export declare function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): BackendBootstrapper;
@@ -44,7 +44,7 @@ export declare class UserService implements UserRepository {
44
44
  * Run a privileged auth write with an explicitly cleared RLS context.
45
45
  *
46
46
  * The auth services run on the base/owner connection, which by design
47
- * carries a NULL `app.uid` so the `auth.uid() IS NULL` server-escape
47
+ * carries a NULL `app.uid` so the `rebase.uid() IS NULL` server-escape
48
48
  * in the default policies applies. That NULL is normally guaranteed by
49
49
  * `set_config(..., is_local = true)` resetting at transaction end — but a
50
50
  * GUC that survives on a pooled connection (or a connection role that
@@ -52,7 +52,7 @@ export declare class UserService implements UserRepository {
52
52
  * turns the trusted write into an RLS-scoped one and denies it with
53
53
  * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
54
54
  * single chokepoint, makes the server context deterministic instead of
55
- * trusting whatever state the pool hands us. `auth.uid()` reads '' as
55
+ * trusting whatever state the pool hands us. `rebase.uid()` reads '' as
56
56
  * NULL via NULLIF, so '' is the server context.
57
57
  */
58
58
  private withServerContext;
@@ -2719,7 +2719,7 @@ function rolesArraySql(roles) {
2719
2719
  * rows").
2720
2720
  *
2721
2721
  * **For auth collections additionally**
2722
- * 3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
2722
+ * 3. A permissive **self SELECT** grant (`id = rebase.uid()`), so users can read
2723
2723
  * their own row (profile, session bootstrap) without every app re-declaring
2724
2724
  * it.
2725
2725
  * 4. A **restrictive** admin write gate. Restrictive policies are AND'd with
@@ -2728,7 +2728,7 @@ function rolesArraySql(roles) {
2728
2728
  * such as "a user may edit their own row". Without this, a permissive owner
2729
2729
  * rule would let a user change their own `roles`.
2730
2730
  *
2731
- * The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
2731
+ * The server context is recognised as `rebase.uid() IS NULL` (`policy.serverContext()`)
2732
2732
  * — the built-in flows that run without a user (signup, migrations) set no user
2733
2733
  * GUC — which also lets the owner connection satisfy these policies even under
2734
2734
  * FORCE RLS. A *user* request never reaches that state: an anonymous one carries
@@ -5704,4 +5704,4 @@ function isAuthCollection(collection) {
5704
5704
  //#endregion
5705
5705
  export { mergeDeep as $, fieldKeyForColumn as A, parseIdValues as B, getJunctionCollectionConfig as C, policyToPostgres as D, getEffectiveSecurityRules as E, getTableVarName as F, updateDateAutoValues as G, createRelationRef as H, resolveCollectionRelations as I, legacyForeignKeyName as J, firstFreeKey as K, buildCompositeId as L, getColumnName as M, getEnumVarName as N, securityRuleToConditions as O, getTableName as P, isPrototypePollutingKey as Q, getDeclaredPrimaryKeys as R, resolveStringColumnLength as S, resolveJunctionSpecs as T, createRelationRefWithData as U, sortCollectionsBySlug as V, normalizeToEntityRelation as W, toWireKey as X, toPostgresIdentifier as Y, getPolicyNamesForRule as Z, OrderBySpecError as _, SEARCH_STAMP_PREFIX as a, isManyToMany as at, CollectionRegistry as b, assertSearchIsPostgresOnly as c, searchColumnStamps as d, camelCase as et, searchExtensionStatements as f, buildSdkData as g, visibleColumnProjection as h, isAuthCollection as i, hasForeignKeyOnTarget as it, findRelation as j, findAnonymousGrants as k, buildSearchColumnSpec as l, searchIndexStatements as m, authUsersColumnDefinition as n, DEFAULT_ONE_OF_TYPE as nt, SEARCH_TEXT_FN as o, Vector as ot, searchHelperFunctions as p, generateForeignKeyName as q, authUsersColumnSql as r, DEFAULT_ONE_OF_VALUE as rt, SEARCH_UNACCENT_FN as s, AUTH_USERS_COLUMNS as t, toSnakeCase as tt, hiddenColumnsOption as u, normalizeDriverOrderBy as v, getJunctionSecurityRules as w, relationalCollections as x, parseOrderBySpecStrict as y, isAddressableId as z };
5706
5706
 
5707
- //# sourceMappingURL=auth-users-columns-JJ8ngvy5.js.map
5707
+ //# sourceMappingURL=auth-users-columns-CgyPWQ18.js.map