@rebasepro/server-postgres 0.17.3 → 0.18.1

package/src/schema/doctor-cli.ts

@@ -1,66 +0,0 @@
-#!/usr/bin/env node
-/**
- * CLI entry point for `rebase doctor`.
- * Invoked via tsx by the server-postgres CLI plugin.
- */
-import path from "path";
-import chalk from "chalk";
-import { runDoctor } from "./doctor";
-import { exitCodeForPolicyGate, runPolicyChecks } from "./doctor-policy-checks";
-
-async function main() {
-    const collectionsArg = process.argv.find((a) => a.startsWith("--collections="));
-    const schemaArg = process.argv.find((a) => a.startsWith("--schema="));
-    const sdkArg = process.argv.find((a) => a.startsWith("--sdk="));
-    // --policies runs only the RLS checks: no schema diff, no SDK types. Useful
-    // as a CI gate against a deployed database, where the collection files and
-    // generated schema are not what you are asking about.
-    const policiesOnly = process.argv.includes("--policies");
-
-    const collectionsPath = collectionsArg?.split("=")[1] ?? path.join("..", "config", "collections");
-    const schemaPath = schemaArg?.split("=")[1] ?? path.join("src", "schema.generated.ts");
-    const sdkPath = sdkArg?.split("=")[1] ?? path.join("..", "generated", "sdk", "database.types.ts");
-
-    // Load .env
-    try {
-        const dotenv = await import("dotenv");
-        const envPath = process.env.DOTENV_CONFIG_PATH;
-        if (envPath) {
-            dotenv.config({ path: envPath, quiet: true });
-        } else {
-            dotenv.config({ quiet: true });
-        }
-    } catch {
-        // dotenv may not be installed
-    }
-
-    const databaseUrl = process.env.DATABASE_URL || process.env.ADMIN_CONNECTION_STRING;
-
-    if (policiesOnly) {
-        // Non-zero so this can gate CI — the whole point of the flag, and a
-        // check that could not run has not passed. See exitCodeForPolicyGate.
-        process.exit(exitCodeForPolicyGate(await runPolicyChecks(collectionsPath, databaseUrl)));
-    }
-
-    const report = await runDoctor({
-        collectionsPath: path.resolve(process.cwd(), collectionsPath),
-        schemaPath: path.resolve(process.cwd(), schemaPath),
-        sdkPath: path.resolve(process.cwd(), sdkPath),
-        databaseUrl: databaseUrl ?? undefined
-    });
-
-    const policyStatus = await runPolicyChecks(collectionsPath, databaseUrl);
-
-    // Exit non-zero if there are errors. A policy run that could not happen is
-    // reported loudly above but does not fail the interactive command — the
-    // same treatment the skipped database phase gets. `--policies` is the gate,
-    // and that one fails closed.
-    if (report.summary.errors > 0 || policyStatus === "problems") {
-        process.exit(1);
-    }
-}
-
-main().catch((err) => {
-    console.error(chalk.red("  ✗ Doctor failed"), err instanceof Error ? (err.stack ?? err.message) : String(err));
-    process.exit(1);
-});

package/src/schema/doctor-policy-checks.ts

@@ -1,105 +0,0 @@
-/**
- * The RLS half of `rebase doctor`, and the exit code `--policies` gates CI on.
- *
- * Lives beside `doctor-cli.ts` rather than inside it because that file runs
- * `main()` on import: a gate whose failure modes cannot be unit-tested is how
- * this one shipped reporting success for work it never did.
- */
-import path from "path";
-import chalk from "chalk";
-import { CollectionConfig } from "@rebasepro/types";
-import { loadCollections } from "./doctor";
-import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
-import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
-
-/**
- * What the RLS checks concluded.
- *
- * `unchecked` exists because "we could not look" and "we looked and it is fine"
- * used to be reported identically: a collections path that did not resolve made
- * the loader return `[]` (it warns, it does not throw), `checkPolicyDrift`
- * early-returned an empty diff, and the gate printed
- * `✓ RLS policies match your collections` having compared zero policies against
- * zero collections. Any exception at all — a collection file that throws on
- * import, a `pg_policies` read the CI role is not granted, a connection reset —
- * did the same thing through a `warn`, and exited 0.
- */
-export type PolicyCheckStatus = "ok" | "problems" | "unchecked";
-
-/**
- * The exit code for `rebase doctor --policies`.
- *
- * A gate that could not run has not passed. Only a completed, clean check
- * exits 0 — anything else, including "we never opened a connection", is a
- * failure, or the flag certifies a database nobody looked at.
- */
-export function exitCodeForPolicyGate(status: PolicyCheckStatus): 0 | 1 {
-    return status === "ok" ? 0 : 1;
-}
-
-/**
- * Policies actually deployed vs the ones the collections describe, plus policy
- * roles this server could never satisfy.
- *
- * Never reports `ok` for work it did not do — see {@link PolicyCheckStatus}.
- */
-export async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): Promise<PolicyCheckStatus> {
-    if (!databaseUrl) {
-        console.error(chalk.yellow("  ⚠ No DATABASE_URL — RLS policies were NOT checked"));
-        return "unchecked";
-    }
-
-    const resolvedPath = path.resolve(process.cwd(), collectionsPath);
-    let problems = false;
-    const { Pool } = await import("pg");
-    const pool = new Pool({ connectionString: databaseUrl });
-    try {
-        const collections: CollectionConfig[] = await loadCollections(resolvedPath);
-
-        // Zero collections is not "no drift", it is nothing to compare. The
-        // loader returns `[]` for a path that does not exist, so the commonest
-        // way to get here is a `--collections` path resolved against the wrong
-        // directory — which used to render as a green tick.
-        if (collections.length === 0) {
-            console.error(chalk.red(`  ✗ No collections found in ${resolvedPath}`));
-            console.error(chalk.gray("    RLS policies were NOT checked. Pass --collections=<dir> if your collections live elsewhere."));
-            return "unchecked";
-        }
-
-        const runSql = async (text: string) => (await pool.query(text)).rows as Record<string, unknown>[];
-
-        // A policy naming a role the server never runs as filters every row, so
-        // the collection reads as empty. Report it without booting a server.
-        try {
-            await validatePolicyPgRoles(runSql, collections as never);
-            console.log(chalk.green("  ✓ Policy roles are usable by this server"));
-        } catch (err) {
-            problems = true;
-            console.log("");
-            console.error(chalk.red(err instanceof Error ? err.message : String(err)));
-        }
-
-        // A rule that reads as a lockdown but is true for every caller compiles
-        // to a grant. Report it without booting a server.
-        warnOnAnonymousGrants(collections as never);
-
-        const drift = await checkPolicyDrift(pool as never, collections);
-        console.log("");
-        if (hasDrift(drift)) {
-            problems = true;
-            console.log(chalk.yellow("  RLS policies: database does not match your collections"));
-            console.log(formatPolicyDrift(drift));
-        } else {
-            console.log(chalk.green(`  ✓ RLS policies match your collections (${collections.length} collection(s) checked)`));
-        }
-    } catch (err) {
-        // Fail closed. This catch covers every query and every collection import
-        // above, so returning the pre-catch verdict made the documented CI gate
-        // green on exactly the runs it exists to catch.
-        console.error(chalk.red("  ✗ Could not check RLS policies:"), err instanceof Error ? err.message : String(err));
-        return "unchecked";
-    } finally {
-        await pool.end();
-    }
-    return problems ? "problems" : "ok";
-}