@rebasepro/server-postgres 0.9.1-canary.29ed165 → 0.9.1-canary.437af5f

package/dist/security/policy-drift.d.ts

@@ -26,14 +26,6 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
-    /**
-     * The live clause text, when read from `pg_policies`. Present only for live
-     * policies (the expected side is parsed from DDL and does not carry it).
-     * Used solely for the insecure-tautology scan, not for divergence — Postgres
-     * rewrites this text, so it is not safe to diff against expected.
-     */
-    qual?: string | null;
-    withCheck?: string | null;
 }
 export interface PolicyDrift {
     /** Described by the collections, absent from the database. */
@@ -46,22 +38,6 @@ export interface PolicyDrift {
         actual: PolicyRef;
         differences: string[];
     }[];
-    /**
-     * A live policy whose expression is the known-permissive tautology
-     * `auth.uid() IS NOT NULL` — true for anonymous visitors too, because the
-     * user path coerces a blank id to the `'anonymous'` sentinel. This is what
-     * `policy.authenticated()` used to compile to, so a database pushed before
-     * that fix carries it, and neither the name, roles, command nor clause
-     * *presence* differs from the corrected policy — the only thing that changed
-     * is the expression text, which this checker otherwise (correctly) ignores.
-     * So it is the one drift that hides from every other check here.
-     *
-     * @see reason  a sentence naming the clause and what to do.
-     */
-    insecure: {
-        policy: PolicyRef;
-        reason: string;
-    }[];
 }
 export interface Queryable {
     query<R>(text: string, values?: unknown[]): Promise<{

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.29ed165",
+  "version": "0.9.1-canary.437af5f",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -47,11 +47,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/common": "0.9.1-canary.29ed165",
-    "@rebasepro/server": "0.9.1-canary.29ed165",
-    "@rebasepro/codegen": "0.9.1-canary.29ed165",
-    "@rebasepro/utils": "0.9.1-canary.29ed165",
-    "@rebasepro/types": "0.9.1-canary.29ed165"
+    "@rebasepro/common": "0.9.1-canary.437af5f",
+    "@rebasepro/server": "0.9.1-canary.437af5f",
+    "@rebasepro/types": "0.9.1-canary.437af5f",
+    "@rebasepro/utils": "0.9.1-canary.437af5f",
+    "@rebasepro/codegen": "0.9.1-canary.437af5f"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",

package/src/security/policy-drift.test.ts

@@ -123,52 +123,6 @@ describe("checkPolicyDrift", () => {
         expect(hasDrift(drift)).toBe(false);
     });
 
-    it("flags the pre-fix permissive tautology that every other check misses", async () => {
-        // A database pushed before the `policy.authenticated()` fix carries
-        // `auth.uid() IS NOT NULL` — true for anonymous visitors. Its name,
-        // roles, command and clause presence all match the corrected policy, so
-        // this is the only signal that catches it.
-        const cols = [collection("posts")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p, {
-            qual: p.hasUsing ? "(auth.uid() IS NOT NULL)" : null
-        }));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-
-        expect(drift.insecure.length).toBeGreaterThan(0);
-        expect(hasDrift(drift)).toBe(true);
-        expect(drift.diverged).toHaveLength(0); // nothing else notices
-        expect(formatPolicyDrift(drift)).toContain("anonymous");
-        expect(formatPolicyDrift(drift)).toContain("db push");
-    });
-
-    it("clears the corrected expression, in either literal spelling", async () => {
-        const cols = [collection("posts")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        for (const guard of ["<> 'anonymous'::text", "<> 'anonymous'", "!= 'anonymous'"]) {
-            const live = expected.map((p) => liveRow(p, {
-                qual: p.hasUsing ? `((auth.uid() IS NOT NULL) AND ((auth.uid())::text ${guard}))` : null
-            }));
-            const drift = await checkPolicyDrift(dbWith(live), cols);
-            expect(drift.insecure).toHaveLength(0);
-        }
-    });
-
-    it("also flags the tautology in a WITH CHECK clause", async () => {
-        const cols = [collection("posts")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p, {
-            with_check: p.hasWithCheck ? "(auth.uid() IS NOT NULL)" : null
-        }));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-
-        const flagged = drift.insecure.some((i) => /WITH CHECK/.test(i.reason));
-        // Only assert when the fixture actually had a WITH CHECK policy to carry it.
-        if (expected.some((p) => p.hasWithCheck)) expect(flagged).toBe(true);
-    });
-
     it("parses roles when the driver returns the raw {a,b} text form", async () => {
         const cols = [collection("tags")];
         const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL", qual: "true", with_check: null }];

package/src/security/policy-drift.ts

@@ -29,14 +29,6 @@ export interface PolicyRef {
     hasUsing: boolean;
     /** Whether a WITH CHECK clause is present at all (not what it says). */
     hasWithCheck: boolean;
-    /**
-     * The live clause text, when read from `pg_policies`. Present only for live
-     * policies (the expected side is parsed from DDL and does not carry it).
-     * Used solely for the insecure-tautology scan, not for divergence — Postgres
-     * rewrites this text, so it is not safe to diff against expected.
-     */
-    qual?: string | null;
-    withCheck?: string | null;
 }
 
 export interface PolicyDrift {
@@ -46,19 +38,6 @@ export interface PolicyDrift {
     orphaned: PolicyRef[];
     /** Same policy name, different roles or command. */
     diverged: { expected: PolicyRef; actual: PolicyRef; differences: string[] }[];
-    /**
-     * A live policy whose expression is the known-permissive tautology
-     * `auth.uid() IS NOT NULL` — true for anonymous visitors too, because the
-     * user path coerces a blank id to the `'anonymous'` sentinel. This is what
-     * `policy.authenticated()` used to compile to, so a database pushed before
-     * that fix carries it, and neither the name, roles, command nor clause
-     * *presence* differs from the corrected policy — the only thing that changed
-     * is the expression text, which this checker otherwise (correctly) ignores.
-     * So it is the one drift that hides from every other check here.
-     *
-     * @see reason  a sentence naming the clause and what to do.
-     */
-    insecure: { policy: PolicyRef; reason: string }[];
 }
 
 export interface Queryable {
@@ -143,30 +122,10 @@ async function readLivePolicies(client: Queryable, schemas: string[]): Promise<P
         // Presence only. Postgres rewrites the text, but it does not invent or
         // drop a clause: NULL here means the policy genuinely has none.
         hasUsing: r.qual != null,
-        hasWithCheck: r.with_check != null,
-        qual: r.qual,
-        withCheck: r.with_check
+        hasWithCheck: r.with_check != null
     }));
 }
 
-/**
- * The permissive tautology `auth.uid() IS NOT NULL`, without the
- * `<> 'anonymous'` guard that makes it mean "signed in".
- *
- * Whitespace varies with Postgres's rewrite, so match on a collapsed form. The
- * guard clause (`<> 'anonymous'`, in any spelling) is what distinguishes the
- * corrected policy from the stale one, so its presence clears the text.
- */
-function isPermissiveAuthTautology(clause: string | null | undefined): boolean {
-    if (!clause) return false;
-    const flat = clause.toLowerCase().replace(/\s+/g, " ");
-    if (!/auth\.uid\(\)\s*is not null/.test(flat)) return false;
-    // The fix appends `AND auth.uid() <> 'anonymous'`; Postgres may store the
-    // literal as `'anonymous'::text`. Either spelling means it is the corrected
-    // policy, not the tautology.
-    return !/<>\s*'anonymous'/.test(flat) && !/!=\s*'anonymous'/.test(flat);
-}
-
 const keyOf = (p: PolicyRef) => `${p.schema}.${p.table}.${p.name}`;
 const sameRoles = (a: string[], b: string[]) =>
     a.length === b.length && [...a].sort().join(",") === [...b].sort().join(",");
@@ -195,31 +154,13 @@ export async function checkPolicyDrift(
     const schemas = [...new Set(expected.map((p) => p.schema))];
     // Nothing expected means nothing to reconcile against; scanning every
     // schema would report the whole database as orphaned.
-    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [], insecure: [] };
+    if (schemas.length === 0) return { missing: [], orphaned: [], diverged: [] };
 
     const live = await readLivePolicies(client, schemas);
     const liveByKey = new Map(live.map((p) => [keyOf(p), p]));
     const expectedByKey = new Map(expected.map((p) => [keyOf(p), p]));
 
-    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [], insecure: [] };
-
-    // Scan every live policy for the permissive tautology. This is deliberately
-    // independent of the name-keyed diff below: a database pushed before the
-    // `authenticated()` fix matches its expected policy on name, roles, command
-    // and clause presence, so nothing else here would flag it.
-    for (const p of live) {
-        const clause = isPermissiveAuthTautology(p.qual)
-            ? "USING"
-            : isPermissiveAuthTautology(p.withCheck) ? "WITH CHECK" : null;
-        if (clause) {
-            drift.insecure.push({
-                policy: p,
-                reason: `${clause} is \`auth.uid() IS NOT NULL\`, which is true for anonymous ` +
-                    `visitors too — this grants access to signed-out requests. It predates the ` +
-                    `\`policy.authenticated()\` fix; re-run \`rebase db push\` to tighten it.`
-            });
-        }
-    }
+    const drift: PolicyDrift = { missing: [], orphaned: [], diverged: [] };
 
     for (const [key, want] of expectedByKey) {
         const got = liveByKey.get(key);
@@ -308,7 +249,7 @@ export async function dropOrphanedPolicies(
 }
 
 export const hasDrift = (d: PolicyDrift): boolean =>
-    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0 || d.insecure.length > 0;
+    d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 
 /** Human-readable report; empty string when the database matches the config. */
 export function formatPolicyDrift(drift: PolicyDrift): string {
@@ -332,12 +273,5 @@ export function formatPolicyDrift(drift: PolicyDrift): string {
             for (const diff of d.differences) lines.push(`        ${diff}`);
         }
     }
-    if (drift.insecure.length > 0) {
-        lines.push("  Insecure — a live policy grants access it should not:");
-        for (const i of drift.insecure) {
-            lines.push(`    • ${i.policy.schema}.${i.policy.table} → "${i.policy.name}"`);
-            lines.push(`        ${i.reason}`);
-        }
-    }
     return lines.join("\n");
 }