@rebasepro/server-postgres 0.9.1-canary.7ba0e49 → 0.9.1-canary.97e305f

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.7ba0e49",
+  "version": "0.9.1-canary.97e305f",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -71,11 +71,11 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.7ba0e49",
-    "@rebasepro/common": "0.9.1-canary.7ba0e49",
-    "@rebasepro/server": "0.9.1-canary.7ba0e49",
-    "@rebasepro/types": "0.9.1-canary.7ba0e49",
-    "@rebasepro/utils": "0.9.1-canary.7ba0e49"
+    "@rebasepro/codegen": "0.9.1-canary.97e305f",
+    "@rebasepro/common": "0.9.1-canary.97e305f",
+    "@rebasepro/server": "0.9.1-canary.97e305f",
+    "@rebasepro/types": "0.9.1-canary.97e305f",
+    "@rebasepro/utils": "0.9.1-canary.97e305f"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",

package/src/services/row-pipeline.ts

@@ -91,6 +91,30 @@ function coerceDeclaredNumbers(
 }
 
 /** Render one target row in the requested style. */
+/**
+ * Drop every column the collection marked `excludeFromApi`.
+ *
+ * Password hashes and verification tokens have to be readable server-side but
+ * must never reach a client — and "never" has to mean every exit from this
+ * pipeline, including relation targets, or a secret leaks through whichever
+ * path was overlooked. Keyed by both the property name and its column name,
+ * since a row can arrive keyed either way depending on the caller.
+ */
+function stripExcluded(
+    row: Record<string, unknown>,
+    collection: CollectionConfig
+): Record<string, unknown> {
+    const properties = collection.properties as Record<string, Property> | undefined;
+    if (!properties) return row;
+
+    for (const [key, property] of Object.entries(properties)) {
+        if (!property?.excludeFromApi) continue;
+        delete row[key];
+        if (property.columnName) delete row[property.columnName];
+    }
+    return row;
+}
+
 function renderTarget(
     targetRow: Record<string, unknown>,
     targetCollection: CollectionConfig,
@@ -100,7 +124,7 @@ function renderTarget(
     if (style === "inline") {
         // The target's columns, and only those: its address is the consumer's
         // to derive, and merging one in overwrites a real `id` column.
-        return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+        return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
     }
 
     const address = relationTargetAddress(targetRow, targetCollection, registry);
@@ -168,7 +192,7 @@ export function toCmsRow(
         }
     }
 
-    return normalized;
+    return stripExcluded(normalized, collection);
 }
 
 /**
@@ -211,5 +235,5 @@ export function toRestRow(
         }
     }
 
-    return flat;
+    return stripExcluded(flat, collection);
 }