@rebasepro/server-postgres 0.16.1-canary.ge71347e → 0.17.0

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.16.1-canary.ge71347e",
+  "version": "0.17.0",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.22.0",
     "ws": "^8.21.1",
-    "@rebasepro/codegen": "0.16.1-canary.ge71347e",
-    "@rebasepro/common": "0.16.1-canary.ge71347e",
-    "@rebasepro/server": "0.16.1-canary.ge71347e",
-    "@rebasepro/utils": "0.16.1-canary.ge71347e",
-    "@rebasepro/types": "0.16.1-canary.ge71347e"
+    "@rebasepro/codegen": "0.17.0",
+    "@rebasepro/server": "0.17.0",
+    "@rebasepro/utils": "0.17.0",
+    "@rebasepro/types": "0.17.0",
+    "@rebasepro/common": "0.17.0"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.12",

package/src/PostgresBackendDriver.ts

@@ -42,6 +42,67 @@ import { applyAuthContext } from "./security/rls-enforcement";
 import { generateSchemaCommit } from "./schema/generate-schema-commit";
 import { readSchemaFactsFor, type Queryable } from "./schema/ensure-collection-tables";
 
+/**
+ * Has an operator opted out of database role switching entirely?
+ *
+ * `DISABLE_DB_ROLE_SWITCHING=true` is documented (README, the configuration
+ * page, the backend skill) as "run Studio SQL Editor queries as the connection
+ * owner", for deployments whose application roles have no database role behind
+ * them. It is the only sanctioned way a statement that named a role runs
+ * without it — every other route now refuses.
+ *
+ * Exact `"true"` on purpose, matching the check this replaced. `=1` and `=yes`
+ * silently do nothing, which `docs/audits/80-config-and-env.md` already records
+ * as a finding across the env surface; fixing it here alone would make this one
+ * variable disagree with the rest.
+ */
+export function isRoleSwitchingOptedOut(): boolean {
+    return process.env.DISABLE_DB_ROLE_SWITCHING === "true";
+}
+
+/**
+ * The role a statement will actually have run as, given the role it asked for.
+ *
+ * For the audit log, which recorded `options.role` — the *requested* role — and
+ * so restated the caller's request as though it were the outcome. The two part
+ * company exactly when {@link isRoleSwitchingOptedOut} holds, because every
+ * other divergence is now an error rather than a quiet substitution.
+ */
+export function effectiveSqlRole(requestedRole?: string): string {
+    if (!requestedRole) return CONNECTION_OWNER;
+    return isRoleSwitchingOptedOut() ? CONNECTION_OWNER : requestedRole;
+}
+
+/** How {@link effectiveSqlRole} names "whatever role the connection holds". */
+export const CONNECTION_OWNER = "<connection owner>";
+
+/**
+ * A statement named a database role the connection cannot assume.
+ *
+ * Its own type because the tempting recovery — run it anyway, as the owner — is
+ * the one thing that must not happen. Callers that catch this should report it,
+ * not retry unscoped.
+ */
+export class RoleSwitchUnavailableError extends Error {
+    readonly code = "ROLE_SWITCH_UNAVAILABLE";
+    readonly role: string;
+    /** The underlying Postgres error, when the refusal came from a live attempt. */
+    readonly pgError?: unknown;
+
+    constructor(role: string, pgError?: unknown) {
+        super(
+            `Cannot execute SQL as role "${role}": this connection is not permitted to SET ROLE. ` +
+            `The statement was NOT executed — running it as the connection owner would return ` +
+            `owner-visible rows, which is a different question from the one that was asked. ` +
+            `Grant the connection user membership in "${role}", or set DISABLE_DB_ROLE_SWITCHING=true ` +
+            `to run SQL Editor queries as the connection owner.`
+        );
+        this.name = "RoleSwitchUnavailableError";
+        this.role = role;
+        this.pgError = pgError;
+    }
+}
+
 export class PostgresBackendDriver implements DataDriver {
     key = "postgres";
     initialised = true;
@@ -55,12 +116,18 @@ export class PostgresBackendDriver implements DataDriver {
     public client?: RebaseClient;
 
     /**
-     * Auto-set to `true` when a SET LOCAL ROLE fails with insufficient
-     * privileges, so subsequent queries skip the doomed attempt.
-     * Mirrors the static `DISABLE_DB_ROLE_SWITCHING` env var but is
-     * learned at runtime.
+     * Auto-set to `true` once a `SET LOCAL ROLE` has failed with insufficient
+     * privileges, so later statements refuse without spending the round trip
+     * to be refused again.
+     *
+     * Deliberately NOT a mirror of `DISABLE_DB_ROLE_SWITCHING`, which it used
+     * to be described as. The env var is an operator saying "run these as the
+     * connection owner"; this flag is the database saying "I cannot give you
+     * the role you asked for". The first is a decision and permits the
+     * fallback, the second is a failure and must not — see the SECURITY note
+     * in {@link executeSql}.
      */
-    private _roleSwitchingDisabled = false;
+    private _roleSwitchingUnavailable = false;
 
     /**
      * Restricted role that authenticated (user-context) requests run as (via
@@ -1257,6 +1324,27 @@ export class PostgresBackendDriver implements DataDriver {
         return this.poolManager.getDrizzle(databaseName);
     }
 
+    /**
+     * Build one statement, binding `$n` placeholders as real parameters.
+     *
+     * Shared by the role-switched path (inside a transaction) and the
+     * unswitched one. They held byte-identical copies of this loop, which is
+     * exactly the shape where a fix lands in one copy and not the other.
+     */
+    private buildStatement(sqlText: string, params?: unknown[]) {
+        if (!params || params.length === 0) return drizzleSql.raw(sqlText);
+        const parts = sqlText.split(/\$(\d+)/);
+        const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
+        for (let i = 0; i < parts.length; i++) {
+            if (i % 2 === 0) {
+                if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
+            } else {
+                chunks.push(drizzleSql.param(params[Number(parts[i]) - 1]));
+            }
+        }
+        return drizzleSql.join(chunks, drizzleSql.raw(""));
+    }
+
     async executeSql(sqlText: string, options?: {
         database?: string,
         role?: string,
@@ -1269,77 +1357,81 @@ export class PostgresBackendDriver implements DataDriver {
         const targetDb = this.getTargetDb(options?.database);
 
         try {
-            // Determine if we actually need to switch roles.
-            // Skip SET LOCAL ROLE when the requested role matches the current session role,
-            // as it's a no-op that can fail on managed Postgres setups where the connection
-            // user doesn't have permission to SET ROLE.
+            // Does this actually need a role switch?
+            //
+            // Asking for the role the session already runs as is a no-op, not a
+            // downgrade — the statement really does execute as the requested
+            // role — so it stays allowed even where switching is unavailable.
+            // That is the ordinary Studio path: the role picker defaults to
+            // `current_user`.
             let needsRoleSwitch = false;
-            if (options?.role && process.env.DISABLE_DB_ROLE_SWITCHING !== "true" && !this._roleSwitchingDisabled) {
+            if (options?.role) {
                 try {
                     const currentRoleResult = await targetDb.execute(drizzleSql.raw("SELECT current_user AS role"));
                     const currentRole = (currentRoleResult.rows?.[0] as Record<string, unknown>)?.role as string | undefined;
                     needsRoleSwitch = !!currentRole && currentRole !== options.role;
                 } catch {
-                    // If we can't determine the current role, attempt the switch anyway
+                    // Current role unknown. Assume a switch is needed rather
+                    // than assume the session already is the requested role:
+                    // attempting and refusing beats guessing in our own favour.
                     needsRoleSwitch = true;
                 }
             }
 
             if (needsRoleSwitch && options?.role) {
-                const safeRole = options.role.replace(/"/g, "\"\"");
-                try {
-                    return await targetDb.transaction(async (tx) => {
-                        await tx.execute(drizzleSql.raw(`SET LOCAL ROLE "${safeRole}"`));
-                        let result;
-                        if (options?.params && options.params.length > 0) {
-                            const parts = sqlText.split(/\$(\d+)/);
-                            const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
-                            for (let i = 0; i < parts.length; i++) {
-                                if (i % 2 === 0) {
-                                    if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
-                                } else {
-                                    chunks.push(drizzleSql.param(options.params[Number(parts[i]) - 1]));
-                                }
-                            }
-                            result = await tx.execute(drizzleSql.join(chunks, drizzleSql.raw("")));
-                        } else {
-                            result = await tx.execute(drizzleSql.raw(sqlText));
+                if (isRoleSwitchingOptedOut()) {
+                    // The one sanctioned way to run this unswitched, and a
+                    // decision somebody made rather than a failure: the env var
+                    // is documented (README, docs/getting-started/configuration)
+                    // as "run SQL Editor queries as the connection owner", for
+                    // deployments whose application roles have no database role
+                    // behind them. `effectiveSqlRole` reads the same switch, so
+                    // the audit log records the role that actually applied.
+                    logger.debug(
+                        `[PostgresBackendDriver] DISABLE_DB_ROLE_SWITCHING=true — running as the ` +
+                        `connection owner rather than "${options.role}".`
+                    );
+                } else if (this._roleSwitchingUnavailable) {
+                    // Already learned this connection cannot SET ROLE; refuse
+                    // without spending the round trip to be told again.
+                    throw new RoleSwitchUnavailableError(options.role);
+                } else {
+                    const safeRole = options.role.replace(/"/g, "\"\"");
+                    try {
+                        return await targetDb.transaction(async (tx) => {
+                            await tx.execute(drizzleSql.raw(`SET LOCAL ROLE "${safeRole}"`));
+                            const result = await tx.execute(this.buildStatement(sqlText, options?.params));
+                            return result.rows as Record<string, unknown>[];
+                        });
+                    } catch (roleError: unknown) {
+                        if (isRoleSwitchingPermissionError(roleError)) {
+                            // SECURITY: do NOT fall through and run this as the
+                            // owner.
+                            //
+                            // The caller asked for a *constrained* execution.
+                            // Owner rows are not a degraded answer to that
+                            // question, they are a confident wrong one: the only
+                            // reason to pass a role is to see what the database
+                            // looks like under RLS, and owner output makes a
+                            // protected table read as exposed. This used to warn
+                            // and continue — and latch, so a single failure
+                            // silently unscoped every later call in the process.
+                            //
+                            // `applyAuthContext` (the user request path) and
+                            // `scopeDataDriver` both fail closed. This is the
+                            // same question, so it gets the same answer.
+                            this._roleSwitchingUnavailable = true;
+                            throw new RoleSwitchUnavailableError(options.role, roleError);
                         }
-                        return result.rows as Record<string, unknown>[];
-                    });
-                } catch (roleError: unknown) {
-                    if (isRoleSwitchingPermissionError(roleError)) {
-                        logger.warn(
-                            `[PostgresBackendDriver] SET LOCAL ROLE "${safeRole}" failed — ` +
-                            `the connection user lacks permission. Falling back to executing ` +
-                            `without role switching. To suppress this warning, set ` +
-                            `DISABLE_DB_ROLE_SWITCHING=true in your .env file.`
-                        );
-                        this._roleSwitchingDisabled = true;
-                        // Fall through to execute without role switching below
-                    } else {
                         throw roleError;
                     }
                 }
             }
 
-            let result;
-            if (options?.params && options.params.length > 0) {
-                const parts = sqlText.split(/\$(\d+)/);
-                const chunks: ReturnType<typeof drizzleSql.raw | typeof drizzleSql.param>[] = [];
-                for (let i = 0; i < parts.length; i++) {
-                    if (i % 2 === 0) {
-                        if (parts[i].length > 0) chunks.push(drizzleSql.raw(parts[i]));
-                    } else {
-                        chunks.push(drizzleSql.param(options.params[Number(parts[i]) - 1]));
-                    }
-                }
-                result = await targetDb.execute(drizzleSql.join(chunks, drizzleSql.raw("")));
-            } else {
-                result = await targetDb.execute(drizzleSql.raw(sqlText));
-            }
+            const result = await targetDb.execute(this.buildStatement(sqlText, options?.params));
             return result.rows as Record<string, unknown>[];
         } catch (error: unknown) {
+            if (error instanceof RoleSwitchUnavailableError) throw error;
             const msg = error instanceof Error ? error.message : String(error);
             // Provide a user-friendly message for connection/auth errors
             if (msg.includes("pg_hba.conf") || msg.includes("no encryption") || msg.includes("connection refused")) {

package/src/cli-helpers.ts

@@ -6,6 +6,7 @@ import { createRequire } from "module";
 import readline from "readline";
 import { pathToFileURL } from "url";
 import chalk from "chalk";
+import { isRebaseIndexName } from "./schema/collection-index";
 import { out, outWarn } from "./cli-output";
 import type { CollectionConfig, ResolvedRelation } from "@rebasepro/types";
 import { moduleDir as __helpersDirname } from "./module-dir";
@@ -306,6 +307,119 @@ export async function seedDevDatabaseSearchHelpers(
  * catalogs. Separated from {@link getTableExcludes} so its failure mode can
  * be handled explicitly (fail closed) and so tests can inject a stub.
  */
+/**
+ * Every index Postgres holds on a table Rebase manages, as
+ * `schema.table.index`.
+ *
+ * Constraint-backed indexes are left out: a `PRIMARY KEY` or a `UNIQUE` is a
+ * *constraint* to Atlas, diffed from the constraint declaration, and naming its
+ * index in an exclude would shield the constraint itself.
+ */
+export async function queryExistingIndexes(databaseUrl: string): Promise<string[]> {
+    const { Client } = await import("pg");
+    const client = new Client({ connectionString: databaseUrl });
+    await client.connect();
+    try {
+        const res = await client.query(`
+            SELECT n.nspname || '.' || t.relname || '.' || i.relname AS full_name
+            FROM pg_index x
+            JOIN pg_class i ON i.oid = x.indexrelid
+            JOIN pg_class t ON t.oid = x.indrelid
+            JOIN pg_namespace n ON n.oid = t.relnamespace
+            WHERE n.nspname NOT IN ('pg_catalog', 'information_schema')
+              AND t.relkind IN ('r', 'p')
+              AND NOT EXISTS (
+                  SELECT 1 FROM pg_constraint c WHERE c.conindid = i.oid
+              );
+        `);
+        return res.rows.map((row: { full_name: string }) => row.full_name);
+    } finally {
+        await client.end();
+    }
+}
+
+/**
+ * Glob patterns keeping Atlas away from indexes that are not Rebase's.
+ *
+ * The problem this solves is live and predates the `indexes:` block. `db push`
+ * is declarative, so an index on a managed table that is absent from
+ * `schema.sql` is drift — and Atlas plans `DROP INDEX` for it. Verified
+ * against atlas v1.2.3: create one by hand, re-run an unchanged push, and the
+ * plan is a bare drop. `DROP INDEX` is not in `DESTRUCTIVE_PATTERNS`, so the
+ * auto-approved apply took it without asking. Until now the only way to have
+ * an index at all was to write it by hand, which made that the *only* outcome.
+ *
+ * Ownership rather than a prompt, because once indexes are declarable a drop
+ * is usually correct: removing one from the config should remove it from the
+ * database, quietly. What must never be dropped is an index Rebase never
+ * created — a hand-written one, or one an introspected database arrived with.
+ * {@link isRebaseIndexName} is the test, the same arrangement
+ * `isGeneratedPolicyName` uses to let policy reconciliation drop only what it
+ * generated.
+ *
+ * The named-in-the-desired-state check comes first and is what makes removal
+ * work: a declared index that the author has just deleted still matches the
+ * name pattern, is no longer in the plan, and so is *not* excluded — Atlas
+ * drops it, as intended.
+ *
+ * Three-part `schema.table.index`, never two: a two-part pattern reads as a
+ * *table* named `<index>` in a *schema* named `<table>`, matches nothing, and
+ * reports no error — the trap already recorded for the search excludes.
+ */
+export async function getForeignIndexExcludes(
+    databaseUrl: string,
+    collectionsPath: string,
+    deps: {
+        queryExistingIndexes?: (databaseUrl: string) => Promise<string[]>;
+        getManagedIndexNames?: (collectionsPath: string) => Promise<Set<string>>;
+    } = {}
+): Promise<string[]> {
+    const queryIndexes = deps.queryExistingIndexes ?? queryExistingIndexes;
+    const getManaged = deps.getManagedIndexNames ?? managedIndexNames;
+
+    const managed = await getManaged(collectionsPath);
+
+    let existing: string[];
+    try {
+        existing = await queryIndexes(databaseUrl);
+    } catch (err) {
+        // Fails CLOSED, like getTableExcludes: without the catalogue we cannot
+        // tell a foreign index from one of ours, and guessing wrong destroys
+        // an index somebody is relying on.
+        throw new ExcludeIntrospectionError(
+            `Failed to introspect the database for unmanaged indexes: ${err instanceof Error ? err.message : String(err)}`,
+            err
+        );
+    }
+
+    return existing.filter(full => {
+        const indexName = full.slice(full.lastIndexOf(".") + 1);
+        if (managed.has(indexName)) return false;   // ours, and still declared
+        return !isRebaseIndexName(indexName);       // ours, but no longer declared -> let it drop
+    });
+}
+
+/**
+ * The index names the current collections would create — search, vector and
+ * declared alike. Anything Atlas would emit is by definition not foreign.
+ */
+async function managedIndexNames(collectionsPath: string): Promise<Set<string>> {
+    const collections = await loadCollectionsForCli(collectionsPath);
+    const { resolveColumnName, searchExcludePatterns } = await import("./schema/generate-postgres-ddl-logic");
+    const { buildCollectionIndexPlan } = await import("./schema/collection-index");
+
+    const names = new Set<string>(
+        buildCollectionIndexPlan(collections, resolveColumnName).map(spec => spec.indexName)
+    );
+    // Search objects are excluded from Atlas wholesale by their own patterns;
+    // listing them here too is harmless and keeps this the single answer to
+    // "is this index one of ours".
+    for (const pattern of searchExcludePatterns(collections)) {
+        names.add(pattern.slice(pattern.lastIndexOf(".") + 1));
+    }
+    return names;
+}
+
 export async function queryExistingTables(databaseUrl: string): Promise<string[]> {
     const { Client } = await import("pg");
     const client = new Client({ connectionString: databaseUrl });

package/src/cli.ts

@@ -18,6 +18,7 @@ import {
     readSearchDdl,
     seedDevDatabaseSearchHelpers,
     getTableExcludes,
+    getForeignIndexExcludes,
     ExcludeIntrospectionError,
     promptConfirm
 } from "./cli-helpers";
@@ -872,6 +873,27 @@ async function runAtlas(
         for (const exc of excludes) {
             atlasArgs.push("--exclude", exc);
         }
+
+        // And the indexes on those tables that Rebase did not create. Same
+        // fail-closed contract as the table list above, for the same reason: a
+        // partial answer here silently drops somebody's index.
+        let indexExcludes: string[];
+        try {
+            indexExcludes = await getForeignIndexExcludes(databaseUrl, collectionsPath);
+        } catch (err) {
+            if (err instanceof ExcludeIntrospectionError) {
+                outError(chalk.red("\n✗ Aborting push: could not determine which indexes to protect."));
+                outError(chalk.gray(`  ${err.message}`));
+                outError(chalk.gray("  Refusing to apply — a partial exclude list could drop an index Rebase does not manage."));
+                const hint = diagnoseDbError(err.cause ?? err, databaseUrl);
+                if (hint) outError(hint);
+                process.exit(1);
+            }
+            throw err;
+        }
+        for (const exc of indexExcludes) {
+            atlasArgs.push("--exclude", exc);
+        }
     }
 
     // Stream stdout live but tee stderr so we can inspect Atlas's error text