@rebasepro/server-postgres 0.16.1-canary.ge71347e → 0.17.0

package/dist/PostgresBackendDriver.d.ts

@@ -6,6 +6,46 @@ import { DrizzleClient } from "./interfaces.js";
 import { DatabaseAdmin, DataDriver, DeleteProps, CollectionConfig, FetchCollectionProps, FetchOneProps, ListenCollectionProps, ListenOneProps, RebaseClient, RebaseSdkData, RestFetchService, SaveManyProps, SaveProps, UpdateManyProps, DeleteManyProps, TableMetadata, User } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry.js";
 import { HistoryService } from "./history/HistoryService.js";
+/**
+ * Has an operator opted out of database role switching entirely?
+ *
+ * `DISABLE_DB_ROLE_SWITCHING=true` is documented (README, the configuration
+ * page, the backend skill) as "run Studio SQL Editor queries as the connection
+ * owner", for deployments whose application roles have no database role behind
+ * them. It is the only sanctioned way a statement that named a role runs
+ * without it — every other route now refuses.
+ *
+ * Exact `"true"` on purpose, matching the check this replaced. `=1` and `=yes`
+ * silently do nothing, which `docs/audits/80-config-and-env.md` already records
+ * as a finding across the env surface; fixing it here alone would make this one
+ * variable disagree with the rest.
+ */
+export declare function isRoleSwitchingOptedOut(): boolean;
+/**
+ * The role a statement will actually have run as, given the role it asked for.
+ *
+ * For the audit log, which recorded `options.role` — the *requested* role — and
+ * so restated the caller's request as though it were the outcome. The two part
+ * company exactly when {@link isRoleSwitchingOptedOut} holds, because every
+ * other divergence is now an error rather than a quiet substitution.
+ */
+export declare function effectiveSqlRole(requestedRole?: string): string;
+/** How {@link effectiveSqlRole} names "whatever role the connection holds". */
+export declare const CONNECTION_OWNER = "<connection owner>";
+/**
+ * A statement named a database role the connection cannot assume.
+ *
+ * Its own type because the tempting recovery — run it anyway, as the owner — is
+ * the one thing that must not happen. Callers that catch this should report it,
+ * not retry unscoped.
+ */
+export declare class RoleSwitchUnavailableError extends Error {
+    readonly code = "ROLE_SWITCH_UNAVAILABLE";
+    readonly role: string;
+    /** The underlying Postgres error, when the refusal came from a live attempt. */
+    readonly pgError?: unknown;
+    constructor(role: string, pgError?: unknown);
+}
 export declare class PostgresBackendDriver implements DataDriver {
     db: DrizzleClient;
     readonly registry: PostgresCollectionRegistry;
@@ -20,12 +60,18 @@ export declare class PostgresBackendDriver implements DataDriver {
     data: RebaseSdkData;
     client?: RebaseClient;
     /**
-     * Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
-     * privileges, so subsequent queries skip the doomed attempt.
-     * Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
-     * learned at runtime.
+     * Auto-set to `true` once a `SET LOCAL ROLE` has failed with insufficient
+     * privileges, so later statements refuse without spending the round trip
+     * to be refused again.
+     *
+     * Deliberately NOT a mirror of `DISABLE_DB_ROLE_SWITCHING`, which it used
+     * to be described as. The env var is an operator saying "run these as the
+     * connection owner"; this flag is the database saying "I cannot give you
+     * the role you asked for". The first is a decision and permits the
+     * fallback, the second is a failure and must not — see the SECURITY note
+     * in {@link executeSql}.
      */
-    private _roleSwitchingDisabled;
+    private _roleSwitchingUnavailable;
     /**
      * Restricted role that authenticated (user-context) requests run as (via
      * `SET LOCAL ROLE`) so RLS binds every statement — reads *and* writes. Set
@@ -163,6 +209,14 @@ export declare class PostgresBackendDriver implements DataDriver {
     checkUniqueField(path: string, name: string, value: unknown, id?: string, collection?: CollectionConfig): Promise<boolean>;
     count<M extends Record<string, unknown>>({ path, collection, filter, logical, searchString, vectorSearch }: FetchCollectionProps<M>): Promise<number>;
     private getTargetDb;
+    /**
+     * Build one statement, binding `$n` placeholders as real parameters.
+     *
+     * Shared by the role-switched path (inside a transaction) and the
+     * unswitched one. They held byte-identical copies of this loop, which is
+     * exactly the shape where a fix lands in one copy and not the other.
+     */
+    private buildStatement;
     executeSql(sqlText: string, options?: {
         database?: string;
         role?: string;

package/dist/{backup-service-BL5x6Fj5.js → backup-service-BtgHxfFm.js}

@@ -2,6 +2,7 @@ import { createRequire as __createRequire } from "module";
 import process from "process";
 __createRequire(import.meta.url);
 import { d as __require, f as __toESM, l as __commonJSMin, u as __exportAll } from "./connection-GOKU3Hu5.js";
+import "./collection-index-DxJBvVTH.js";
 import "./src-DiDgtX8P.js";
 import fs from "fs";
 import path from "path";
@@ -9040,4 +9041,4 @@ async function pruneBackups(dest, options, storage) {
 //#endregion
 export { parseDbNameFromUrl as A, buildRowSecurityPgOptions as C, joinStorageKey as D, globalsFileForDump as E, withDatabaseName as F, resolveConnectionString as M, serverVersionNumToMajor as N, parseBackupDestination as O, splitGlobalsStatements as P, buildPgRestoreListArgs as S, diagnoseRowSecurityDumpFailure as T, selectBackupsToPrune as _, detectToolMajor as a, buildPgDumpallGlobalsArgs as b, getServerVersionMajor as c, pruneBackups as d, resolvePgBinary as f, require_source as g, validateDump as h, createDump as i, parsePgToolMajor as j, parseBackupTimestamp as k, listBackups as l, uploadBackup as m, applyGlobals as n, discardPartialDump as o, restoreDump as p, backup_service_exports as r, ensureDatabaseExists as s, BackupToolError as t, preflight as u, buildBackupFilename as v, checkToolServerCompatibility as w, buildPgRestoreArgs as x, buildPgDumpArgs as y };
 
-//# sourceMappingURL=backup-service-BL5x6Fj5.js.map
+//# sourceMappingURL=backup-service-BtgHxfFm.js.map