@rebasepro/server-postgres 0.9.1-canary.1d2d8b5 → 0.9.1-canary.29ed165

package/src/security/rls-enforcement.ts

@@ -59,7 +59,7 @@ export interface ConnectionPosture {
 }
 
 export interface AuthContext {
-    userId: string;
+    uid: string;
     /** Raw roles as carried on the user (strings or `{ id }` objects). */
     roles: unknown[];
 }
@@ -200,7 +200,7 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * SECURITY: this function is only ever called on the **user** path (the server
  * context uses the base/owner driver and never calls it). The default policies
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
- * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
+ * is `NULLIF(current_setting('app.uid'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
  * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
  * rather than trusting every caller (e.g. realtime subscription auth) to do it.
@@ -208,15 +208,21 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
  */
 export async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {
-    const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : ANONYMOUS_USER_ID;
+    const uid = typeof auth.uid === "string" && auth.uid.trim() !== "" ? auth.uid : ANONYMOUS_USER_ID;
     const normalizedRoles = auth.roles.map((r: unknown) =>
         typeof r === "string" ? r : (r as Record<string, unknown>)?.id ?? String(r)
     );
+    // `app.user_id` is the pre-rename spelling, still written because policies
+    // are data: a database provisioned before the rename holds rules compiled
+    // to `current_setting('app.user_id')`, and those predicates would evaluate
+    // to NULL — failing open or locking out — if we stopped setting it. Drop
+    // the alias only once no live database carries a legacy policy.
     await tx.execute(drizzleSql`
         SELECT
-            set_config('app.user_id', ${userId}, true),
+            set_config('app.uid', ${uid}, true),
+            set_config('app.user_id', ${uid}, true),
             set_config('app.user_roles', ${normalizedRoles.join(",")}, true),
-            set_config('app.jwt', ${JSON.stringify({ sub: userId, roles: auth.roles })}, true)
+            set_config('app.jwt', ${JSON.stringify({ sub: uid, roles: auth.roles })}, true)
     `);
     if (userRole) {
         await tx.execute(drizzleSql.raw(`SET LOCAL ROLE ${quoteIdent(userRole)}`));

package/src/services/BranchService.ts

@@ -11,10 +11,45 @@ import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
+import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
 
 /** Internal prefix applied to branch database names to avoid collisions. */
 const BRANCH_DB_PREFIX = "rb_";
 
+/** `duplicate_database` — the target database name is already taken. */
+const PG_DUPLICATE_DATABASE = "42P04";
+
+/** `object_in_use` — the database still has connections attached. */
+const PG_OBJECT_IN_USE = "55006";
+
+/**
+ * Describe a failed branch DDL statement in terms a user can act on.
+ *
+ * Drizzle reports failures as `Failed query: <sql> params:` and hides the real
+ * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
+ * the actual problem. Match on the PG error code instead — it survives wrapping
+ * and, unlike the message text, is not locale-dependent.
+ */
+function describeBranchDdlError(err: unknown, fallbackContext: string): Error {
+    const pgError = extractPgError(err);
+
+    if (pgError?.code === PG_DUPLICATE_DATABASE) {
+        return new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
+    }
+    if (pgError?.code === PG_OBJECT_IN_USE) {
+        return new Error(
+            `Cannot complete the operation: the database "${fallbackContext}" has active connections. ` +
+            "Close other clients or connections and try again."
+        );
+    }
+
+    // Unknown failure: surface the real PG message rather than the Drizzle
+    // wrapper, which would otherwise show the raw SQL and no reason at all.
+    const detail = pgError?.message ?? extractCauseMessage(err);
+    if (detail) return new Error(detail);
+    return err instanceof Error ? err : new Error(String(err));
+}
+
 /** Fully-qualified metadata table in the rebase schema. */
 const BRANCHES_TABLE = "rebase.branches";
 
@@ -109,18 +144,15 @@ export class BranchService {
                 sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`)
             );
         } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (msg.includes("already exists")) {
-                throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
-            }
-            // If template fails due to active connections, provide a helpful error
-            if (msg.includes("being accessed by other users")) {
+            const pgError = extractPgError(err);
+            if (pgError?.code === PG_OBJECT_IN_USE) {
+                // The template — not the new database — is the one still in use.
                 throw new Error(
                     `Cannot create branch: the source database "${sourceDb}" has active connections. ` +
                     "Close other clients or connections and try again."
                 );
             }
-            throw err;
+            throw describeBranchDdlError(err, dbName);
         }
 
         // Record metadata in the default database
@@ -166,14 +198,14 @@ export class BranchService {
         try {
             await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
         } catch (err) {
-            const msg = err instanceof Error ? err.message : String(err);
-            if (msg.includes("being accessed by other users")) {
+            const pgError = extractPgError(err);
+            if (pgError?.code === PG_OBJECT_IN_USE) {
                 throw new Error(
                     `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
-            throw err;
+            throw describeBranchDdlError(err, dbName);
         }
 
         // Remove metadata