@rebasepro/server-postgres 0.9.1-canary.73476f2 → 0.9.1-canary.74adfbe

package/src/websocket.ts

@@ -27,7 +27,7 @@ interface WsAuthConfig {
  * Normalized user identity for WebSocket sessions.
  */
 interface WsUserIdentity {
-    userId: string;
+    uid: string;
     roles: string[];
     isAdmin: boolean;
 }
@@ -183,7 +183,7 @@ code } }
 
                             if (adapterUser) {
                                 verifiedUser = {
-                                    userId: adapterUser.uid,
+                                    uid: adapterUser.uid,
                                     roles: adapterUser.roles,
                                     isAdmin: adapterUser.isAdmin
                                 };
@@ -195,13 +195,13 @@ code } }
                         // Service key: a static secret, not a JWT. Checked
                         // before verification, mirroring the HTTP middleware —
                         // verifying it as a JWT can only ever fail.
-                        verifiedUser = { userId: "service", roles: ["admin"], isAdmin: true };
+                        verifiedUser = { uid: "service", roles: ["admin"], isAdmin: true };
                     } else {
                         // Standard JWT path
                         const jwtPayload = extractUserFromToken(token);
                         if (jwtPayload) {
                             verifiedUser = {
-                                userId: jwtPayload.userId,
+                                uid: jwtPayload.uid,
                                 roles: jwtPayload.roles ?? [],
                                 isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin")
                             };
@@ -218,10 +218,10 @@ code } }
                         ws.send(JSON.stringify({
                             type: "AUTH_SUCCESS",
                             requestId,
-                            payload: { userId: verifiedUser.userId,
+                            payload: { uid: verifiedUser.uid,
 roles: verifiedUser.roles }
                         }));
-                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
+                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.uid}`);
                     } else {
                         wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -272,7 +272,7 @@ roles: verifiedUser.roles }
                         try {
                             const userForAuth: User = session?.user
                                 ? {
-                                    uid: session.user.userId,
+                                    uid: session.user.uid,
                                     displayName: null,
                                     email: null,
                                     photoURL: null,
@@ -421,7 +421,7 @@ colors: true }));
                                 sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
                                 options,
                                 resultRows: Array.isArray(result) ? result.length : "unknown",
-                                userId: auditSession?.user?.userId ?? "unknown",
+                                uid: auditSession?.user?.uid ?? "unknown",
                                 roles: auditSession?.user?.roles ?? [],
                                 isAdmin: auditSession?.user?.isAdmin ?? false,
                             }));
@@ -476,6 +476,24 @@ colors: true }));
                     }
                         break;
 
+                    case "FETCH_APPLICATION_ROLES": {
+                        wsDebug("👤 [WebSocket Server] Processing FETCH_APPLICATION_ROLES request");
+                        const delegate = await getScopedDelegate();
+                        const admin = delegate.admin;
+                        let roles: string[] = [];
+                        if (isSQLAdmin(admin) && admin.fetchApplicationRoles) {
+                            roles = await admin.fetchApplicationRoles();
+                        }
+                        wsDebug(`👤 [WebSocket Server] Fetched ${roles.length} application roles.`);
+                        const response = {
+                            type: "FETCH_APPLICATION_ROLES_SUCCESS",
+                            payload: { roles },
+                            requestId
+                        };
+                        ws.send(JSON.stringify(response));
+                    }
+                        break;
+
                     case "FETCH_CURRENT_DATABASE": {
                         wsDebug("📚 [WebSocket Server] Processing FETCH_CURRENT_DATABASE request");
                         const delegate = await getScopedDelegate();
@@ -594,14 +612,15 @@ colors: true }));
                     case "broadcast":
                     case "presence_track":
                     case "presence_untrack":
-                    case "presence_state": {
+                    case "presence_state":
+                    case "channel_history": {
                         wsDebug("🔄 [WebSocket Server] Routing realtime message to RealtimeService:", type);
                         // Attach auth context from the WS session so RLS-aware refetches work
                         const session = clientSessions.get(clientId);
                         const authContext = session?.user
-                            ? { userId: session.user.userId,
+                            ? { uid: session.user.uid,
 roles: session.user.roles ?? [] }
-                            : { userId: "anon",
+                            : { uid: "anon",
 roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {
@@ -620,9 +639,12 @@ roles: ["anon"] };
                 if (error instanceof Error) {
                     logger.error("Stack trace", { detail: error.stack });
                 }
+                // Unwrap the cause chain: a Drizzle failure reports itself as
+                // "Failed query: <sql> params:", which tells the user nothing and
+                // echoes the statement back at them. The reason is in the cause.
                 const errorMessage = process.env.NODE_ENV === "production"
                     ? "An unexpected error occurred"
-                    : (error instanceof Error ? error.message : "An unexpected error occurred");
+                    : extractErrorMessage(error);
                 const errorResponse = {
                     type: "ERROR",
                     requestId,

package/dist/schema/auth-default-policies.d.ts

@@ -1,10 +0,0 @@
-import { CollectionConfig, SecurityRule } from "@rebasepro/types";
-/**
- * Returns the security rules that should be applied to a collection: the
- * author's explicit `securityRules` plus the framework defaults described in
- * the module doc (baseline server/admin read for all collections; self-read
- * and the admin write gate for auth collections).
- *
- * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
- */
-export declare function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[];

package/src/schema/auth-default-policies.ts

@@ -1,132 +0,0 @@
-import { CollectionConfig, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollectionConfig, policy } from "@rebasepro/types";
-import { getTableName } from "@rebasepro/common";
-
-/**
- * Default RLS policies injected by the schema generator.
- *
- * Rebase's enforcement model is unified: authenticated (user-context) requests
- * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
- * statement — reads and writes. A collection's `securityRules` are the whole
- * authorization model. The server context (auth flows, migrations,
- * `dataAsAdmin`) runs as the owner and bypasses RLS.
- *
- * Because RLS default-denies, every collection is **locked by default**: with
- * no rules, only the server context and admins can touch it. The generator
- * injects that safe baseline:
- *
- * **For every collection**
- *  1. A permissive **server-or-admin SELECT** grant.
- *  2. A permissive **server-or-admin write** grant (insert/update/delete).
- *
- * Author `securityRules` are permissive and OR together, so explicit rules only
- * *broaden* access from this locked baseline (e.g. "users read/write their own
- * rows").
- *
- * **For auth collections additionally**
- *  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
- *     their own row (profile, session bootstrap) without every app re-declaring
- *     it.
- *  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
- *     every other policy, so a write is rejected unless the caller is an admin
- *     (or the server context) — even if the author also wrote a permissive rule
- *     such as "a user may edit their own row". Without this, a permissive owner
- *     rule would let a user change their own `roles`.
- *
- * The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
- * — the built-in flows that run without a user (signup, migrations) set no user
- * GUC — which also lets the owner connection satisfy these policies even under
- * FORCE RLS. A *user* request never reaches that state: an anonymous one carries
- * `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
- *
- * Opt out with `disableDefaultPolicies: true` to take full responsibility for
- * the collection's RLS.
- */
-// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
-// exactly — the framework's most security-critical policies must be reflected
-// precisely, not left as un-evaluable raw clauses. Compiles to
-// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
-//
-// `serverContext()`, emphatically not `not(authenticated())`: the server arm of
-// this grant must match the server context and nothing else. Anonymous visitors
-// are not signed in either, so a negated `authenticated()` would hand them the
-// server-or-admin grant on every collection's default policy.
-const SERVER_OR_ADMIN_EXPR: PolicyExpression = policy.or(
-    policy.serverContext(),
-    policy.rolesOverlap(["admin"])
-);
-
-/** Write operations that must be admin-gated by default on auth collections. */
-const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
-
-/** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection: CollectionConfig): boolean {
-    const auth = collection.auth;
-    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
-}
-
-/** The property marked as the row id (falls back to `id`). */
-function getIdPropertyName(collection: CollectionConfig): string {
-    for (const [name, prop] of Object.entries(collection.properties ?? {})) {
-        if (prop && typeof prop === "object" && "isId" in prop && (prop as { isId?: unknown }).isId) {
-            return name;
-        }
-    }
-    return "id";
-}
-
-/**
- * Returns the security rules that should be applied to a collection: the
- * author's explicit `securityRules` plus the framework defaults described in
- * the module doc (baseline server/admin read for all collections; self-read
- * and the admin write gate for auth collections).
- *
- * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
- */
-export function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[] {
-    const explicit = [...((isPostgresCollectionConfig(collection) ? collection.securityRules : undefined) ?? [])];
-
-    if (collection.disableDefaultPolicies) {
-        return explicit;
-    }
-
-    const tableName = getTableName(collection);
-    const injected: SecurityRule[] = [];
-
-    // Baseline read + write: the server context and admins can always operate.
-    // RLS default-denies under the user role, so without these a rule-less
-    // collection would be locked to everyone — including the admin studio.
-    // Author rules are permissive and broaden access from here.
-    injected.push({
-        name: `${tableName}_default_admin_read`,
-        operations: ["select"],
-        condition: SERVER_OR_ADMIN_EXPR
-    });
-    injected.push({
-        name: `${tableName}_default_admin_write`,
-        operations: [...DEFAULT_GUARDED_OPS],
-        condition: SERVER_OR_ADMIN_EXPR,
-        check: SERVER_OR_ADMIN_EXPR
-    });
-
-    if (isAuthCollection(collection)) {
-        // Self-read: a user can always read their own row.
-        injected.push({
-            name: `${tableName}_default_self_read`,
-            operations: ["select"],
-            condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
-        });
-
-        // Restrictive gate: AND'd with all other policies, so no permissive rule
-        // (e.g. an owner "edit your own row" rule) can let a non-admin change
-        // privileged columns like `roles`.
-        injected.push({
-            name: `${tableName}_require_admin_write`,
-            mode: "restrictive",
-            operations: [...DEFAULT_GUARDED_OPS],
-            condition: SERVER_OR_ADMIN_EXPR,
-            check: SERVER_OR_ADMIN_EXPR
-        });
-    }
-
-    return [...explicit, ...injected];
-}