@rebasepro/server-postgres 0.9.1-canary.73476f2 → 0.9.1-canary.7ba0e49

package/src/services/PersistService.ts

@@ -1,5 +1,5 @@
-import { eq, and } from "drizzle-orm";
-import { AnyPgColumn } from "drizzle-orm/pg-core";
+import { eq, and, sql, SQL } from "drizzle-orm";
+import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { CollectionConfig, Properties, Relation } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
@@ -16,7 +16,7 @@ import { RelationService } from "./RelationService";
 import { FetchService } from "./FetchService";
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-import { logger } from "@rebasepro/server";
+import { ApiError, logger } from "@rebasepro/server";
 import { extractPgError, extractCauseMessage, pgErrorToFriendlyMessage } from "../utils/pg-error-utils";
 
 /**
@@ -33,6 +33,49 @@ export class PersistService {
     }
 
 
+    /**
+     * Explain a write that matched no rows.
+     *
+     * Row-level security filters UPDATE and DELETE through the policy's USING
+     * clause instead of raising: a denied write is reported by Postgres exactly
+     * like a successful one that happened to match nothing. Left unchecked, a
+     * caller cannot tell "denied" from "done" — the write returns 200/204 and
+     * the row is untouched.
+     *
+     * Re-reading the target over the *same* RLS-scoped handle separates the two
+     * cases. A visible row means the policy rejected the write (403); an
+     * invisible one means there is nothing there to write for this caller (404,
+     * matching what a GET would say). The re-read is bound by the caller's own
+     * policies, so it discloses nothing a plain read wouldn't.
+     *
+     * Only reached when zero rows matched, so the happy path pays nothing.
+     */
+    private async explainZeroRowWrite(
+        handle: DrizzleClient,
+        table: PgTable,
+        conditions: SQL[],
+        collectionPath: string,
+        id: string | number,
+        operation: "update" | "delete"
+    ): Promise<ApiError> {
+        const visible = await handle
+            .select({ present: sql<number>`1` })
+            .from(table)
+            .where(and(...conditions))
+            .limit(1);
+
+        if (visible.length > 0) {
+            return ApiError.forbidden(
+                `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`,
+                "WRITE_DENIED"
+            );
+        }
+
+        return ApiError.notFound(
+            `No row "${id}" in "${collectionPath}" to ${operation}.`
+        );
+    }
+
     /**
      * Delete an row by ID
      */
@@ -52,9 +95,13 @@ export class PersistService {
             conditions.push(eq(field, parsedIdObj[info.fieldName]));
         }
 
-        await this.db
+        const result = await this.db
             .delete(table)
             .where(and(...conditions));
+
+        if ((result.rowCount ?? 0) === 0) {
+            throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
+        }
     }
 
     /**
@@ -68,12 +115,19 @@ export class PersistService {
 
     /**
      * Save an row (create or update)
+     *
+     * With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
+     * UPDATE against the primary key rather than a plain UPDATE. That is one
+     * statement, so it cannot lose a race the way a read-then-write can, and it
+     * does not care whether the row already exists — which is what a re-runnable
+     * import needs.
      */
     async save<M extends Record<string, unknown>>(
         collectionPath: string,
         values: Partial<M>,
         id?: string | number,
-        databaseId?: string
+        databaseId?: string,
+        options?: { upsert?: boolean }
     ): Promise<Record<string, unknown>> {
         // If saving under a nested relation path, resolve the parent and inject FK
         let effectiveCollectionPath = collectionPath;
@@ -208,7 +262,7 @@ export class PersistService {
             savedId = await this.db.transaction(async (tx) => {
                 let currentId: string | number;
 
-                if (id) {
+                if (id && !options?.upsert) {
                     // Update existing row
                     currentId = id; // `id` is already the formatted composite or singular string
                     const idValues = parseIdValues(id, idInfoArray);
@@ -235,11 +289,25 @@ export class PersistService {
                             conditions.push(eq(field, idValues[info.fieldName]));
                         }
 
-                        await updateQuery.where(and(...conditions));
+                        const updateResult = await updateQuery.where(and(...conditions));
+
+                        // Throwing rolls the transaction back, so relation writes
+                        // already applied above do not survive a rejected update.
+                        if ((updateResult.rowCount ?? 0) === 0) {
+                            throw await this.explainZeroRowWrite(
+                                tx, table, conditions, effectiveCollectionPath, currentId, "update"
+                            );
+                        }
                     }
                 } else {
                     const dataForInsert = { ...(entityData as Record<string, unknown>) };
 
+                    // An explicit id given alongside upsert is the conflict target,
+                    // so fold it into the row before the empty-key strip below.
+                    if (id && options?.upsert) {
+                        Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
+                    }
+
                     // Strip empty primary keys so the database defaults (e.g. uuid_gen(), auto-increment) can trigger
                     for (const info of idInfoArray) {
                         if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === undefined) {
@@ -247,13 +315,46 @@ export class PersistService {
                         }
                     }
 
-                    const result = await tx
-                        .insert(table)
-                        .values(dataForInsert)
-                        .returning(returningKeys);
+                    const insertQuery = tx.insert(table).values(dataForInsert);
+
+                    // ON CONFLICT needs a real conflict target, and the only one
+                    // guaranteed to exist is the primary key. Without every key
+                    // column present there is nothing to match on, so the row is a
+                    // plain insert and a duplicate should still raise.
+                    const hasFullKey = idInfoArray.length > 0
+                        && idInfoArray.every((info) => dataForInsert[info.fieldName] !== undefined);
+
+                    let result;
+                    if (options?.upsert && hasFullKey) {
+                        const target = idInfoArray.map((info) => table[info.fieldName as keyof typeof table] as AnyPgColumn);
+                        const set = { ...dataForInsert };
+                        // Never reassign the key columns to themselves in the UPDATE
+                        // branch; Postgres rejects that against the conflict target.
+                        for (const info of idInfoArray) delete set[info.fieldName];
+
+                        result = Object.keys(set).length > 0
+                            ? await insertQuery.onConflictDoUpdate({ target, set }).returning(returningKeys)
+                            : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
+                    } else {
+                        result = await insertQuery.returning(returningKeys);
+                    }
 
+                    // DO NOTHING returns no row when it skipped, and an upsert whose
+                    // UPDATE branch is filtered by RLS returns none either. Fall back
+                    // to the id we were given rather than reading undefined.
                     const resultRow = result[0];
-                    currentId = buildCompositeId(resultRow, idInfoArray);
+                    if (!resultRow) {
+                        if (id) {
+                            currentId = id;
+                        } else {
+                            throw ApiError.forbidden(
+                                `Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`,
+                                "WRITE_DENIED"
+                            );
+                        }
+                    } else {
+                        currentId = buildCompositeId(resultRow, idInfoArray);
+                    }
 
                     // For inserts, apply joinPath after since the parent row didn't exist before
                     if (joinPathRelationUpdates.length > 0) {
@@ -282,8 +383,15 @@ export class PersistService {
             throw this.toUserFriendlyError(error, collection.slug);
         }
 
-        // Fetch the updated/created row to return with proper relation objects
-        const finalEntity = await this.fetchService.fetchOne<M>(collection.slug, savedId, databaseId);
+        // Fetch the saved row back through the same walk `GET /:id` serves, so a
+        // write's answer is the read that follows it. This used to be `fetchOne`
+        // — the admin view-model walk — whose `__type: "relation"` refs then
+        // leaked into REST responses, afterSave callbacks, history records and
+        // app-level realtime payloads, none of which see that shape from any
+        // read path. The admin does not need them here either: its rows arrive
+        // over the realtime subscription refetch, which still serves the
+        // view-model walk.
+        const finalEntity = await this.fetchService.fetchOneForRest(collection.slug, savedId, undefined, databaseId);
         if (!finalEntity) throw new Error("Could not fetch row after save.");
         return finalEntity;
     }
@@ -306,6 +414,14 @@ export class PersistService {
      * Translate raw PostgreSQL / Drizzle errors into user-friendly messages.
      */
     private toUserFriendlyError(error: unknown, collectionSlug: string): Error {
+        // Deliberate API errors already carry their own status, code and wording.
+        // Re-wrapping one flattens it into a generic Error, and the status is lost
+        // on the way out — a policy rejection would surface as a 500. Matched by
+        // name as well as instance: a duplicated module copy breaks `instanceof`.
+        if (error instanceof ApiError || (error as Error)?.name === "ApiError") {
+            return error as Error;
+        }
+
         const pgError = extractPgError(error);
 
         if (pgError) {