@rebasepro/server-postgres 0.9.1-canary.16c42e9 → 0.9.1-canary.26fe4b2

package/src/services/row-pipeline.ts

@@ -91,6 +91,30 @@ function coerceDeclaredNumbers(
 }
 
 /** Render one target row in the requested style. */
+/**
+ * Drop every column the collection marked `excludeFromApi`.
+ *
+ * Password hashes and verification tokens have to be readable server-side but
+ * must never reach a client — and "never" has to mean every exit from this
+ * pipeline, including relation targets, or a secret leaks through whichever
+ * path was overlooked. Keyed by both the property name and its column name,
+ * since a row can arrive keyed either way depending on the caller.
+ */
+function stripExcluded(
+    row: Record<string, unknown>,
+    collection: CollectionConfig
+): Record<string, unknown> {
+    const properties = collection.properties as Record<string, Property> | undefined;
+    if (!properties) return row;
+
+    for (const [key, property] of Object.entries(properties)) {
+        if (!property?.excludeFromApi) continue;
+        delete row[key];
+        if (property.columnName) delete row[property.columnName];
+    }
+    return row;
+}
+
 function renderTarget(
     targetRow: Record<string, unknown>,
     targetCollection: CollectionConfig,
@@ -100,7 +124,7 @@ function renderTarget(
     if (style === "inline") {
         // The target's columns, and only those: its address is the consumer's
         // to derive, and merging one in overwrites a real `id` column.
-        return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+        return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
     }
 
     const address = relationTargetAddress(targetRow, targetCollection, registry);
@@ -168,7 +192,7 @@ export function toCmsRow(
         }
     }
 
-    return normalized;
+    return stripExcluded(normalized, collection);
 }
 
 /**
@@ -211,5 +235,5 @@ export function toRestRow(
         }
     }
 
-    return flat;
+    return stripExcluded(flat, collection);
 }

package/src/websocket.ts

@@ -27,7 +27,7 @@ interface WsAuthConfig {
  * Normalized user identity for WebSocket sessions.
  */
 interface WsUserIdentity {
-    userId: string;
+    uid: string;
     roles: string[];
     isAdmin: boolean;
 }
@@ -183,7 +183,7 @@ code } }
 
                             if (adapterUser) {
                                 verifiedUser = {
-                                    userId: adapterUser.uid,
+                                    uid: adapterUser.uid,
                                     roles: adapterUser.roles,
                                     isAdmin: adapterUser.isAdmin
                                 };
@@ -195,13 +195,13 @@ code } }
                         // Service key: a static secret, not a JWT. Checked
                         // before verification, mirroring the HTTP middleware —
                         // verifying it as a JWT can only ever fail.
-                        verifiedUser = { userId: "service", roles: ["admin"], isAdmin: true };
+                        verifiedUser = { uid: "service", roles: ["admin"], isAdmin: true };
                     } else {
                         // Standard JWT path
                         const jwtPayload = extractUserFromToken(token);
                         if (jwtPayload) {
                             verifiedUser = {
-                                userId: jwtPayload.userId,
+                                uid: jwtPayload.uid,
                                 roles: jwtPayload.roles ?? [],
                                 isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin")
                             };
@@ -218,10 +218,10 @@ code } }
                         ws.send(JSON.stringify({
                             type: "AUTH_SUCCESS",
                             requestId,
-                            payload: { userId: verifiedUser.userId,
+                            payload: { uid: verifiedUser.uid,
 roles: verifiedUser.roles }
                         }));
-                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
+                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
                     } else {
                         wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -272,7 +272,7 @@ roles: verifiedUser.roles }
                         try {
                             const userForAuth: User = session?.user
                                 ? {
-                                    uid: session.user.userId,
+                                    uid: session.user.uid,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -421,7 +421,7 @@ colors: true }));
                                 sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
                                 options,
                                 resultRows: Array.isArray(result) ? result.length : "unknown",
-                                userId: auditSession?.user?.userId ?? "unknown",
+                                uid: auditSession?.user?.uid ?? "unknown",
                                 roles: auditSession?.user?.roles ?? [],
                                 isAdmin: auditSession?.user?.isAdmin ?? false,
                             }));
@@ -476,6 +476,24 @@ colors: true }));
                     }
                         break;
 
+                    case "FETCH_APPLICATION_ROLES": {
+                        wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+                        const delegate = await getScopedDelegate();
+                        const admin = delegate.admin;
+                        let roles: string[] = [];
+                        if (isSQLAdmin(admin) && admin.fetchApplicationRoles) {
+                            roles = await admin.fetchApplicationRoles();
+                        }
+                        wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+                        const response = {
+                            type: "FETCH_APPLICATION_ROLES_SUCCESS",
+                            payload: { roles },
+                            requestId
+                        };
+                        ws.send(JSON.stringify(response));
+                    }
+                        break;
+
                     case "FETCH_CURRENT_DATABASE": {
                         wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
                         const delegate = await getScopedDelegate();
@@ -594,14 +612,15 @@ colors: true }));
                     case "broadcast":
                     case "presence_track":
                     case "presence_untrack":
-                    case "presence_state": {
+                    case "presence_state":
+                    case "channel_history": {
                         wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
                         // Attach auth context from the WS session so RLS-aware refetches work
                         const session = clientSessions.get(clientId);
                         const authContext = session?.user
-                            ? { userId: session.user.userId,
+                            ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { userId: "anon",
+                            : { uid: "anon",
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {