@rebasepro/server-postgres 0.9.1-canary.a639738 → 0.9.1-canary.ad870eb

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -154,108 +154,3 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
-
-describe("isGeneratedPolicyName", () => {
-    it("recognises the generator's own shape", () => {
-        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
-        // One rule spanning several operations appends the operation index.
-        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
-    });
-
-    it("does not claim names a human could have written", () => {
-        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
-        // Right shape, wrong table — belongs to something else.
-        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
-        // A digest is 7 lowercase hex characters, nothing else.
-        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
-        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
-    });
-});
-
-describe("dropOrphanedPolicies", () => {
-    /** Records the DDL issued so the test can assert on what was dropped. */
-    function recordingDb(rows: Record<string, unknown>[]) {
-        const executed: string[] = [];
-        const db: Queryable = {
-            query: async (text: string) => {
-                if (!/^SELECT/i.test(text)) executed.push(text);
-                return { rows: rows as never[] };
-            }
-        };
-        return { db, executed };
-    }
-
-    it("drops the policy a rule edit superseded", async () => {
-        // The reported failure: tightening a rule renames its policy, and the
-        // permissive original stays live and keeps ORing itself back in.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const stale = {
-            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
-            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
-        };
-        const live = [...expected.map((p) => liveRow(p)), stale];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(1);
-        expect(dropped[0].name).toBe("documents_insert_dead1ee");
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([
-            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
-        ]);
-    });
-
-    it("leaves a hand-written policy alone and reports it instead", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("never touches a table the collections do not describe", async () => {
-        // Another application sharing the schema owns this table; a
-        // generator-shaped name there is coincidence, not our leftover.
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
-        ];
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
-        expect(executed).toEqual([]);
-    });
-
-    it("does nothing when the database already matches", async () => {
-        const cols = [collection("documents")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-        const { db, executed } = recordingDb(live);
-        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
-
-        expect(dropped).toHaveLength(0);
-        expect(kept).toHaveLength(0);
-        expect(executed).toEqual([]);
-    });
-});

package/src/security/policy-drift.ts

@@ -192,62 +192,6 @@ export async function checkPolicyDrift(
     return drift;
 }
 
-/**
- * Does this name look like one the generator produced for this table?
- *
- * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
- * rule spans several operations), and the hash covers the rule's semantics — so
- * *editing* a rule renames its policy. The policy under the old name is left
- * behind by `db push`, which only DROPs the names it is about to CREATE, and
- * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
- * granting everything no matter how tight its replacement is.
- *
- * Matching the shape is what makes dropping them safe. A hand-written policy
- * would have to collide with a 7-hex digest to be mistaken for generated one;
- * a policy named anything else is left alone and merely reported, because a
- * custom name is indistinguishable from one someone wrote in SQL on purpose.
- */
-export function isGeneratedPolicyName(name: string, table: string): boolean {
-    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
-        .test(name);
-}
-
-export interface OrphanCleanup {
-    /** Superseded generated policies that were dropped. */
-    dropped: PolicyRef[];
-    /** Orphans left in place because their names are not generator-shaped. */
-    kept: PolicyRef[];
-}
-
-/**
- * Drop the policies an earlier push superseded but never removed.
- *
- * Only touches tables the collections describe — a table with no expected
- * policy is not ours to reconcile, and scanning by schema alone would sweep up
- * policies belonging to something else sharing the database.
- */
-export async function dropOrphanedPolicies(
-    client: Queryable,
-    drift: PolicyDrift,
-    collections: CollectionConfig[]
-): Promise<OrphanCleanup> {
-    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
-    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
-
-    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
-    for (const p of drift.orphaned) {
-        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
-            cleanup.kept.push(p);
-            continue;
-        }
-        // Identifiers are quoted, and the name came from pg_policies rather than
-        // from user input, so it is already a valid identifier.
-        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
-        cleanup.dropped.push(p);
-    }
-    return cleanup;
-}
-
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 

package/src/services/BranchService.ts

@@ -11,45 +11,10 @@ import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
-import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
 
 /** Internal prefix applied to branch database names to avoid collisions. */
 const BRANCH_DB_PREFIX = "rb_";
 
-/** `duplicate_database` — the target database name is already taken. */
-const PG_DUPLICATE_DATABASE = "42P04";
-
-/** `object_in_use` — the database still has connections attached. */
-const PG_OBJECT_IN_USE = "55006";
-
-/**
- * Describe a failed branch DDL statement in terms a user can act on.
- *
- * Drizzle reports failures as `Failed query: <sql> params:` and hides the real
- * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
- * the actual problem. Match on the PG error code instead — it survives wrapping
- * and, unlike the message text, is not locale-dependent.
- */
-function describeBranchDdlError(err: unknown, fallbackContext: string): Error {
-    const pgError = extractPgError(err);
-
-    if (pgError?.code === PG_DUPLICATE_DATABASE) {
-        return new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
-    }
-    if (pgError?.code === PG_OBJECT_IN_USE) {
-        return new Error(
-            `Cannot complete the operation: the database "${fallbackContext}" has active connections. ` +
-            "Close other clients or connections and try again."
-        );
-    }
-
-    // Unknown failure: surface the real PG message rather than the Drizzle
-    // wrapper, which would otherwise show the raw SQL and no reason at all.
-    const detail = pgError?.message ?? extractCauseMessage(err);
-    if (detail) return new Error(detail);
-    return err instanceof Error ? err : new Error(String(err));
-}
-
 /** Fully-qualified metadata table in the rebase schema. */
 const BRANCHES_TABLE = "rebase.branches";
 
@@ -144,15 +109,18 @@ export class BranchService {
                 sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`)
             );
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
-                // The template — not the new database — is the one still in use.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("already exists")) {
+                throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
+            }
+            // If template fails due to active connections, provide a helpful error
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot create branch: the source database "${sourceDb}" has active connections. ` +
                     "Close other clients or connections and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Record metadata in the default database
@@ -198,14 +166,14 @@ export class BranchService {
         try {
             await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Remove metadata