@rebasepro/server-postgres 0.9.1-canary.a639738 → 0.9.1-canary.ad25bc0

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 // --- Helper Functions ---
@@ -545,10 +545,6 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -605,22 +601,9 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ([\n";
-            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-
-            // Junctions are generated tables like any other: locked by default,
-            // with derived policies (reads follow the endpoints, writes follow
-            // the declaring side's update rules). RLS is enabled regardless of
-            // policy stripping — a bare junction must default-deny, not fail open.
-            const junctionSpec = junctionSpecs.get(baseTableName);
-            if (!stripPolicies && junctionSpec) {
-                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
-                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-                });
-            }
-            schemaContent += "])).enableRLS();\n\n";
+            schemaContent += "}, (table) => ({\n";
+            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
+            schemaContent += "}));\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -226,10 +226,6 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -265,11 +261,6 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
-    // Policies are emitted after every CREATE TABLE, like the FK constraints:
-    // a policy may reference other tables (a junction's derived policies always
-    // reference both endpoints; `policy.existsIn` references a join table), and
-    // CREATE POLICY validates those relations at creation time.
-    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -302,25 +293,6 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-
-            if (options.includePolicies) {
-                // Junction tables are generated tables like any other: locked by
-                // default, with derived policies — reads follow the endpoints'
-                // visibility, writes follow the declaring side's update rules.
-                // Without this they were the one kind of generated table with no
-                // RLS at all, readable and writable by every signed-in user.
-                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-                ddl += `\n`;
-
-                const spec = junctionSpecs.get(baseTableName);
-                if (spec) {
-                    const junctionCollection = getJunctionCollectionConfig(spec);
-                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-                    });
-                }
-            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -442,8 +414,9 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
                     });
+                    ddl += "\n";
                 }
             }
         }
@@ -454,12 +427,6 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
-    if (policyStatements.length > 0) {
-        ddl += "-- Row Level Security Policies\n";
-        ddl += policyStatements.join("");
-        ddl += "\n";
-    }
-
     return ddl;
 };
 
@@ -506,33 +473,6 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         }
     }
 
-    // Junction tables are generated from `through` relations, not declared as
-    // collections, so the walk above never sees them. They get the same
-    // treatment as any generated table: locked by default, with derived
-    // policies — reads follow the endpoints, writes follow the declaring
-    // side's update rules.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-    for (const spec of junctionSpecs.values()) {
-        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-        ddl += `\n`;
-
-        const junctionRules = getJunctionSecurityRules(spec);
-        if (junctionRules.length === 0) continue;
-
-        const junctionCollection = getJunctionCollectionConfig(spec);
-        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
-
-        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-        junctionRules.forEach((rule: SecurityRule) => {
-            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-        });
-        ddl += "\n";
-    }
-
     return ddl;
 };
 

package/src/schema/introspect-db.ts

@@ -30,7 +30,6 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
-            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -167,14 +166,8 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--no-data-inference"]) {
-            runDataInference = false;
-        } else if (args["--data-inference"] !== undefined) {
+        if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
-        } else if (!process.stdin.isTTY) {
-            // No terminal to answer the question below (scaffolding scripts, CI,
-            // `rebase init --introspect`) — asking would hang forever.
-            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -243,17 +236,7 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                // --force replaces collections derived from the database, but the
-                // directory can also hold hand-written ones with no table in the
-                // introspected schema (the auth users collection lives in
-                // "rebase"). The backend discovers the whole directory, so an
-                // index listing only introspected tables would silently drop them
-                // from the admin UI while the API still served them.
-                const siblings = fs.readdirSync(outDir)
-                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
-                    .map(f => f.replace(/\.ts$/, ""));
-                const allFiles = [...new Set([...generatedFiles, ...siblings])];
-                const indexContent = generateIndexContent(allFiles);
+                const indexContent = generateIndexContent(generatedFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -154,108 +154,3 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
-
-describe("isGeneratedPolicyName", () => {
-    it("recognises the generator's own shape", () => {
-        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
-        // One rule spanning several operations appends the operation index.
-        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
-    });
-
-    it("does not claim names a human could have written", () => {
-        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
-        // Right shape, wrong table — belongs to something else.
-        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
-        // A digest is 7 lowercase hex characters, nothing else.
-        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
-    });
-});
-
-describe("dropOrphanedPolicies", () => {
-    /** Records the DDL issued so the test can assert on what was dropped. */
-    function recordingDb(rows: Record<string, unknown>[]) {
-        const executed: string[] = [];
-        const db: Queryable = {
-            query: async (text: string) => {
-                if (!/^SELECT/i.test(text)) executed.push(text);
-                return { rows: rows as never[] };
-            }
-        };
-        return { db, executed };
-    }
-
-    it("drops the policy a rule edit superseded", async () => {
-        // The reported failure: tightening a rule renames its policy, and the
-        // permissive original stays live and keeps ORing itself back in.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const stale = {
-            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
-            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
-        };
-        const live = [...expected.map((p) => liveRow(p)), stale];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(1);
-        expect(dropped[0].name).toBe("documents_insert_dead1ee");
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([
-            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
-        ]);
-    });
-
-    it("leaves a hand-written policy alone and reports it instead", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("never touches a table the collections do not describe", async () => {
-        // Another application sharing the schema owns this table; a
-        // generator-shaped name there is coincidence, not our leftover.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("does nothing when the database already matches", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([]);
-    });
-});

package/src/security/policy-drift.ts

@@ -192,62 +192,6 @@ export async function checkPolicyDrift(
     return drift;
 }
 
-/**
- * Does this name look like one the generator produced for this table?
- *
- * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
- * rule spans several operations), and the hash covers the rule's semantics — so
- * *editing* a rule renames its policy. The policy under the old name is left
- * behind by `db push`, which only DROPs the names it is about to CREATE, and
- * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
- * granting everything no matter how tight its replacement is.
- *
- * Matching the shape is what makes dropping them safe. A hand-written policy
- * would have to collide with a 7-hex digest to be mistaken for generated one;
- * a policy named anything else is left alone and merely reported, because a
- * custom name is indistinguishable from one someone wrote in SQL on purpose.
- */
-export function isGeneratedPolicyName(name: string, table: string): boolean {
-    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
-        .test(name);
-}
-
-export interface OrphanCleanup {
-    /** Superseded generated policies that were dropped. */
-    dropped: PolicyRef[];
-    /** Orphans left in place because their names are not generator-shaped. */
-    kept: PolicyRef[];
-}
-
-/**
- * Drop the policies an earlier push superseded but never removed.
- *
- * Only touches tables the collections describe — a table with no expected
- * policy is not ours to reconcile, and scanning by schema alone would sweep up
- * policies belonging to something else sharing the database.
- */
-export async function dropOrphanedPolicies(
-    client: Queryable,
-    drift: PolicyDrift,
-    collections: CollectionConfig[]
-): Promise<OrphanCleanup> {
-    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
-    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
-
-    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
-    for (const p of drift.orphaned) {
-        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
-            cleanup.kept.push(p);
-            continue;
-        }
-        // Identifiers are quoted, and the name came from pg_policies rather than
-        // from user input, so it is already a valid identifier.
-        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
-        cleanup.dropped.push(p);
-    }
-    return cleanup;
-}
-
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;