@rebasepro/server-postgres 0.9.1-canary.ad25bc0 → 0.9.1-canary.ad870eb

package/src/services/FetchService.ts

@@ -154,16 +154,18 @@ export class FetchService {
     /**
      * Convert a db.query result row (with nested relation objects) to a flat row.
      * Handles:
+     * - Placing `id` at the top level as a string
      * - Type normalization (dates, numbers, NaN) via normalizeDbValues
      * - Converting nested relation objects to { id, path, __type: "relation" } for CMS
      * - Flattening junction-table many-to-many results
-     *
-     * The row's own address is not among them: it is derived by the consumer
-     * from the collection's primary keys.
      */
     private drizzleResultToRow<M extends Record<string, unknown>>(
         row: Record<string, unknown>,
-        collection: CollectionConfig
+        collection: CollectionConfig,
+        _collectionPath: string,
+        idInfo: { fieldName: string; type: "string" | "number" },
+        _databaseId?: string,
+        idInfoArray?: { fieldName: string; type: "string" | "number" }[]
     ): Record<string, unknown> {
         const resolvedRelations = resolveCollectionRelations(collection);
 
@@ -224,10 +226,11 @@ export class FetchService {
             }
         }
 
-        // A row is exactly its columns. The address is derived by the consumer
-        // from the collection's primary keys — writing it here would rename the
-        // key column (`sku` → `id`) and restringify it (`42` → `"42"`).
-        return normalizedValues;
+        return {
+            ...normalizedValues,
+            // Spread the canonical id last so it wins over a raw `id` column
+            id: (idInfoArray && idInfoArray.length > 1) ? buildCompositeId(row as Record<string, unknown>, idInfoArray) : String(row[idInfo.fieldName])
+        };
     }
 
     /**
@@ -402,39 +405,42 @@ export class FetchService {
     }
 
     /**
-     * Convert a db.query result row to a flat REST-style row with populated relations.
-     *
-     * Every column is copied through under its own name, with the value Postgres
-     * returned. This used to open with a synthesized `id` and then skip the key
-     * column, which renamed it (a `sku` primary key was served as `id`, and `sku`
-     * did not appear at all) and restringified it (`42` → `"42"`). Consumers that
-     * need an address derive it from the collection's primary keys.
+     * Convert a db.query result row to a flat REST-style object with populated relations.
      */
     private drizzleResultToRestRow(
         row: Record<string, unknown>,
-        collection: CollectionConfig
+        collection: CollectionConfig,
+        idInfo: { fieldName: string; type: "string" | "number" },
+        idInfoArray?: { fieldName: string; type: "string" | "number" }[]
     ): Record<string, unknown> {
-        const flat: Record<string, unknown> = {};
+        const flat: Record<string, unknown> = { id: (idInfoArray && idInfoArray.length > 1) ? buildCompositeId(row as Record<string, unknown>, idInfoArray) : String(row[idInfo.fieldName]) };
         const resolvedRelations = resolveCollectionRelations(collection);
 
         for (const [k, v] of Object.entries(row)) {
+            if (k === idInfo.fieldName) continue;
+
             const relation = findRelation(resolvedRelations, k);
             if (Array.isArray(v) && relation) {
-                // Many relation — inline each nested row, unwrapping junction rows
+                // Many relation — flatten each nested row, handling junction tables
                 flat[k] = v.map((item: Record<string, unknown>) => {
                     if (this.isJunctionRelation(relation, collection)) {
                         const nestedKey = Object.keys(item).find(
                             nk => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk])
                         );
                         if (nestedKey) {
-                            return { ...(item[nestedKey] as Record<string, unknown>) };
+                            const nested = item[nestedKey] as Record<string, unknown>;
+                            return { ...nested,
+id: String(nested.id ?? nested[Object.keys(nested)[0]]) };
                         }
                     }
-                    return { ...item };
+                    return { ...item,
+id: String(item.id ?? item[Object.keys(item)[0]]) };
                 });
             } else if (typeof v === "object" && v !== null && !Array.isArray(v) && relation) {
-                // One-to-one relation — inline the target's columns
-                flat[k] = { ...(v as Record<string, unknown>) };
+                // One-to-one relation — inline the object
+                const relObj = v as Record<string, unknown>;
+                flat[k] = { ...relObj,
+id: String(relObj.id ?? relObj[Object.keys(relObj)[0]]) };
             } else {
                 flat[k] = v;
             }
@@ -610,7 +616,7 @@ export class FetchService {
 
                 if (!row) return undefined;
 
-                const flatRow = this.drizzleResultToRow<M>(row, collection);
+                const flatRow = this.drizzleResultToRow<M>(row, collection, collectionPath, idInfo, databaseId, idInfoArray);
 
                 // Post-fetch joinPath relations that Drizzle's `with` can't express
                 await this.resolveJoinPathRelations<M>(flatRow, collection, collectionPath, parsedId, databaseId);
@@ -734,7 +740,7 @@ export class FetchService {
                 const results = await qb.findMany(queryOpts as Parameters<NonNullable<typeof qb>["findMany"]>[0]);
 
                 const rows = (results as Record<string, unknown>[]).map(row =>
-                    this.drizzleResultToRow<M>(row, collection)
+                    this.drizzleResultToRow<M>(row, collection, collectionPath, idInfo, options.databaseId, idInfoArray)
                 );
 
                 return rows;
@@ -858,9 +864,11 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         // relation type, avoiding the N+1 that plagued the old path.
         const parsedRows = await Promise.all(results.map(async (rawRow: Record<string, unknown>) => {
             const values = await parseDataFromServer(rawRow as M, collection) as Record<string, unknown>;
+            const id = (idInfoArray && idInfoArray.length > 1) ? buildCompositeId(rawRow as Record<string, unknown>, idInfoArray!) : String(rawRow[idInfo.fieldName]);
             return {
                 rawRow,
-                values
+                values,
+                id
             };
         }));
 
@@ -930,8 +938,10 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             }
         }
 
-        // Columns only — the address is the consumer's to derive.
-        return parsedRows.map(item => item.values);
+        return parsedRows.map(item => ({
+            ...item.values,
+            id: item.id
+        }));
     }
 
     /**
@@ -1225,7 +1235,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                 const results = await qb.findMany(queryOpts as Parameters<NonNullable<typeof qb>["findMany"]>[0]);
 
                 const restRows = (results as Record<string, unknown>[]).map(row =>
-                    this.drizzleResultToRestRow(row, collection)
+                    this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray)
                 );
 
                 // Drizzle relational query API doesn't resolve joinPath relations, fetch manually
@@ -1245,7 +1255,10 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
         const rows = await this.fetchRowsWithConditionsRaw<M>(collectionPath, options);
 
         if (!include || include.length === 0) {
-            return rows;
+            return rows.map(row => ({
+                ...row,
+                id: (idInfoArray.length > 1) ? buildCompositeId(row as Record<string, unknown>, idInfoArray) : String(row[idInfo.fieldName])
+            }));
         }
 
         // Fallback relation loading via batch
@@ -1266,7 +1279,8 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
                     const eid = row[idInfo.fieldName] as string | number;
                     const related = batchResults.get(String(eid));
                     if (related) {
-                        (row as Record<string, unknown>)[key] = { ...related.values };
+                        (row as Record<string, unknown>)[key] = { ...related.values,
+id: related.id };
                     }
                 }
             } catch (e) {
@@ -1290,7 +1304,10 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
             }
         }
 
-        return rows;
+        return rows.map(row => ({
+            ...row,
+            id: (idInfoArray.length > 1) ? buildCompositeId(row as Record<string, unknown>, idInfoArray) : String(row[idInfo.fieldName])
+        }));
     }
 
     /**
@@ -1330,7 +1347,7 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
 
                 if (!row) return null;
 
-                const restRow = this.drizzleResultToRestRow(row, collection);
+                const restRow = this.drizzleResultToRestRow(row, collection, idInfo, idInfoArray);
 
                 // Drizzle relational query API doesn't resolve joinPath relations, fetch manually
                 await this.resolveJoinPathRelationsBatchRest([restRow], collection, collectionPath, idInfoArray, include);
@@ -1354,7 +1371,9 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
 
         if (result.length === 0) return null;
 
-        const flatEntity: Record<string, unknown> = { ...(result[0] as Record<string, unknown>) };
+        const raw = result[0] as Record<string, unknown>;
+        const flatEntity: Record<string, unknown> = { ...raw,
+id: (idInfoArray.length > 1) ? buildCompositeId(raw as Record<string, unknown>, idInfoArray) : String(raw[idInfo.fieldName]) };
 
         if (!include || include.length === 0) {
             return flatEntity;
@@ -1562,24 +1581,31 @@ _distance: vectorMeta.distanceSelect }).from(table).$dynamic()
 
             const results = await queryTarget.findMany(queryOpts as Parameters<NonNullable<typeof queryTarget>["findMany"]>[0]);
 
-            // Inline the nested Drizzle results, columns only — no synthesized id.
+            // Flatten the nested Drizzle results into REST format
             return results.map((row: Record<string, unknown>) => {
-                const flat: Record<string, unknown> = {};
+                const flat: Record<string, unknown> = { id: (idInfoArray && idInfoArray.length > 1) ? buildCompositeId(row as Record<string, unknown>, idInfoArray) : String(row[idInfo.fieldName]) };
                 for (const [k, v] of Object.entries(row)) {
+                    if (k === idInfo.fieldName) continue;
                     if (Array.isArray(v)) {
-                        // Many relation — inline each nested row
+                        // Many relation — flatten each nested row
                         flat[k] = v.map((item: Record<string, unknown>) => {
-                            // Junction table rows may have the target nested, unwrap those
+                            // Junction table rows may have the target nested, flatten those
                             const keys = Object.keys(item);
+                            // If it looks like a junction row (only FKs + nested objects), extract nested
                             const nestedObj = keys.find(nk => typeof item[nk] === "object" && item[nk] !== null && !Array.isArray(item[nk]));
                             if (nestedObj && keys.length <= 3) {
-                                return { ...(item[nestedObj] as Record<string, unknown>) };
+                                const nested = item[nestedObj] as Record<string, unknown>;
+                                return { ...nested,
+id: String(nested.id ?? nested[Object.keys(nested)[0]]) };
                             }
-                            return { ...item };
+                            return { ...item,
+id: String(item.id ?? item[Object.keys(item)[0]]) };
                         });
                     } else if (typeof v === "object" && v !== null) {
-                        // One-to-one relation — inline the target's columns
-                        flat[k] = { ...(v as Record<string, unknown>) };
+                        // One-to-one relation — inline the object
+                        const relObj = v as Record<string, unknown>;
+                        flat[k] = { ...relObj,
+id: String(relObj.id ?? relObj[Object.keys(relObj)[0]]) };
                     } else {
                         flat[k] = v;
                     }

package/src/services/PersistService.ts

@@ -1,5 +1,5 @@
-import { eq, and, sql, SQL } from "drizzle-orm";
-import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
+import { eq, and } from "drizzle-orm";
+import { AnyPgColumn } from "drizzle-orm/pg-core";
 // import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { CollectionConfig, Properties, Relation } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
@@ -16,7 +16,7 @@ import { RelationService } from "./RelationService";
 import { FetchService } from "./FetchService";
 import { DrizzleClient } from "../interfaces";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
-import { ApiError, logger } from "@rebasepro/server";
+import { logger } from "@rebasepro/server";
 import { extractPgError, extractCauseMessage, pgErrorToFriendlyMessage } from "../utils/pg-error-utils";
 
 /**
@@ -33,49 +33,6 @@ export class PersistService {
     }
 
 
-    /**
-     * Explain a write that matched no rows.
-     *
-     * Row-level security filters UPDATE and DELETE through the policy's USING
-     * clause instead of raising: a denied write is reported by Postgres exactly
-     * like a successful one that happened to match nothing. Left unchecked, a
-     * caller cannot tell "denied" from "done" — the write returns 200/204 and
-     * the row is untouched.
-     *
-     * Re-reading the target over the *same* RLS-scoped handle separates the two
-     * cases. A visible row means the policy rejected the write (403); an
-     * invisible one means there is nothing there to write for this caller (404,
-     * matching what a GET would say). The re-read is bound by the caller's own
-     * policies, so it discloses nothing a plain read wouldn't.
-     *
-     * Only reached when zero rows matched, so the happy path pays nothing.
-     */
-    private async explainZeroRowWrite(
-        handle: DrizzleClient,
-        table: PgTable,
-        conditions: SQL[],
-        collectionPath: string,
-        id: string | number,
-        operation: "update" | "delete"
-    ): Promise<ApiError> {
-        const visible = await handle
-            .select({ present: sql<number>`1` })
-            .from(table)
-            .where(and(...conditions))
-            .limit(1);
-
-        if (visible.length > 0) {
-            return ApiError.forbidden(
-                `Not allowed to ${operation} "${id}" in "${collectionPath}": a row-level security policy rejected the write.`,
-                "WRITE_DENIED"
-            );
-        }
-
-        return ApiError.notFound(
-            `No row "${id}" in "${collectionPath}" to ${operation}.`
-        );
-    }
-
     /**
      * Delete an row by ID
      */
@@ -95,13 +52,9 @@ export class PersistService {
             conditions.push(eq(field, parsedIdObj[info.fieldName]));
         }
 
-        const result = await this.db
+        await this.db
             .delete(table)
             .where(and(...conditions));
-
-        if ((result.rowCount ?? 0) === 0) {
-            throw await this.explainZeroRowWrite(this.db, table, conditions, collectionPath, id, "delete");
-        }
     }
 
     /**
@@ -115,19 +68,12 @@ export class PersistService {
 
     /**
      * Save an row (create or update)
-     *
-     * With `options.upsert`, the row is written with INSERT ... ON CONFLICT DO
-     * UPDATE against the primary key rather than a plain UPDATE. That is one
-     * statement, so it cannot lose a race the way a read-then-write can, and it
-     * does not care whether the row already exists — which is what a re-runnable
-     * import needs.
      */
     async save<M extends Record<string, unknown>>(
         collectionPath: string,
         values: Partial<M>,
         id?: string | number,
-        databaseId?: string,
-        options?: { upsert?: boolean }
+        databaseId?: string
     ): Promise<Record<string, unknown>> {
         // If saving under a nested relation path, resolve the parent and inject FK
         let effectiveCollectionPath = collectionPath;
@@ -262,7 +208,7 @@ export class PersistService {
             savedId = await this.db.transaction(async (tx) => {
                 let currentId: string | number;
 
-                if (id && !options?.upsert) {
+                if (id) {
                     // Update existing row
                     currentId = id; // `id` is already the formatted composite or singular string
                     const idValues = parseIdValues(id, idInfoArray);
@@ -289,25 +235,11 @@ export class PersistService {
                             conditions.push(eq(field, idValues[info.fieldName]));
                         }
 
-                        const updateResult = await updateQuery.where(and(...conditions));
-
-                        // Throwing rolls the transaction back, so relation writes
-                        // already applied above do not survive a rejected update.
-                        if ((updateResult.rowCount ?? 0) === 0) {
-                            throw await this.explainZeroRowWrite(
-                                tx, table, conditions, effectiveCollectionPath, currentId, "update"
-                            );
-                        }
+                        await updateQuery.where(and(...conditions));
                     }
                 } else {
                     const dataForInsert = { ...(entityData as Record<string, unknown>) };
 
-                    // An explicit id given alongside upsert is the conflict target,
-                    // so fold it into the row before the empty-key strip below.
-                    if (id && options?.upsert) {
-                        Object.assign(dataForInsert, parseIdValues(id, idInfoArray));
-                    }
-
                     // Strip empty primary keys so the database defaults (e.g. uuid_gen(), auto-increment) can trigger
                     for (const info of idInfoArray) {
                         if (dataForInsert[info.fieldName] === "" || dataForInsert[info.fieldName] === null || dataForInsert[info.fieldName] === undefined) {
@@ -315,46 +247,13 @@ export class PersistService {
                         }
                     }
 
-                    const insertQuery = tx.insert(table).values(dataForInsert);
-
-                    // ON CONFLICT needs a real conflict target, and the only one
-                    // guaranteed to exist is the primary key. Without every key
-                    // column present there is nothing to match on, so the row is a
-                    // plain insert and a duplicate should still raise.
-                    const hasFullKey = idInfoArray.length > 0
-                        && idInfoArray.every((info) => dataForInsert[info.fieldName] !== undefined);
-
-                    let result;
-                    if (options?.upsert && hasFullKey) {
-                        const target = idInfoArray.map((info) => table[info.fieldName as keyof typeof table] as AnyPgColumn);
-                        const set = { ...dataForInsert };
-                        // Never reassign the key columns to themselves in the UPDATE
-                        // branch; Postgres rejects that against the conflict target.
-                        for (const info of idInfoArray) delete set[info.fieldName];
-
-                        result = Object.keys(set).length > 0
-                            ? await insertQuery.onConflictDoUpdate({ target, set }).returning(returningKeys)
-                            : await insertQuery.onConflictDoNothing({ target }).returning(returningKeys);
-                    } else {
-                        result = await insertQuery.returning(returningKeys);
-                    }
+                    const result = await tx
+                        .insert(table)
+                        .values(dataForInsert)
+                        .returning(returningKeys);
 
-                    // DO NOTHING returns no row when it skipped, and an upsert whose
-                    // UPDATE branch is filtered by RLS returns none either. Fall back
-                    // to the id we were given rather than reading undefined.
                     const resultRow = result[0];
-                    if (!resultRow) {
-                        if (id) {
-                            currentId = id;
-                        } else {
-                            throw ApiError.forbidden(
-                                `Not allowed to write to "${effectiveCollectionPath}": the row was rejected by a row-level security policy.`,
-                                "WRITE_DENIED"
-                            );
-                        }
-                    } else {
-                        currentId = buildCompositeId(resultRow, idInfoArray);
-                    }
+                    currentId = buildCompositeId(resultRow, idInfoArray);
 
                     // For inserts, apply joinPath after since the parent row didn't exist before
                     if (joinPathRelationUpdates.length > 0) {
@@ -407,14 +306,6 @@ export class PersistService {
      * Translate raw PostgreSQL / Drizzle errors into user-friendly messages.
      */
     private toUserFriendlyError(error: unknown, collectionSlug: string): Error {
-        // Deliberate API errors already carry their own status, code and wording.
-        // Re-wrapping one flattens it into a generic Error, and the status is lost
-        // on the way out — a policy rejection would surface as a 500. Matched by
-        // name as well as instance: a duplicated module copy breaks `instanceof`.
-        if (error instanceof ApiError || (error as Error)?.name === "ApiError") {
-            return error as Error;
-        }
-
         const pgError = extractPgError(error);
 
         if (pgError) {

package/src/services/collection-helpers.ts

@@ -3,13 +3,6 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
 import { getTableName } from "@rebasepro/common";
 
-// Row identity is derived on both sides of the wire — the driver parses an
-// incoming address into key columns, the admin derives one from a served row —
-// so the implementation lives in `common` and both agree by construction.
-export { buildCompositeId, parseIdValues, COMPOSITE_ID_SEPARATOR } from "@rebasepro/common";
-export type { PrimaryKeyInfo } from "@rebasepro/common";
-import type { PrimaryKeyInfo } from "@rebasepro/common";
-
 /**
  * Shared helper functions for row operations.
  * These are used by FetchService, PersistService, and RelationService.
@@ -56,7 +49,7 @@ export function getTableForCollection(collection: CollectionConfig, registry: Po
     return table;
 }
 
-export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): PrimaryKeyInfo[] {
+export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresCollectionRegistry): { fieldName: string; type: "string" | "number"; isUUID?: boolean }[] {
     const table = getTableForCollection(collection, registry);
 
     // Fallback to explicitly defined isId properties
@@ -75,7 +68,7 @@ export function getPrimaryKeys(collection: CollectionConfig, registry: PostgresC
     }
 
     // Otherwise infer from Drizzle schema
-    const keys: PrimaryKeyInfo[] = [];
+    const keys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[] = [];
     for (const [key, colRaw] of Object.entries(table)) {
         const col = colRaw as AnyPgColumn;
         if (col && typeof col === "object" && "primary" in col && col.primary) {
@@ -103,3 +96,56 @@ isUUID });
     return keys;
 }
 
+export function parseIdValues(idValue: string | number, primaryKeys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[]): Record<string, string | number> {
+    const result: Record<string, string | number> = {};
+
+    if (primaryKeys.length === 0) {
+        return result;
+    }
+
+    if (primaryKeys.length === 1) {
+        const pk = primaryKeys[0];
+        if (pk.type === "number" && !pk.isUUID) {
+            const parsed = typeof idValue === "number" ? idValue : parseInt(String(idValue), 10);
+            if (isNaN(parsed)) {
+                throw new Error(`Invalid numeric ID: ${idValue}`);
+            }
+            result[pk.fieldName] = parsed;
+        } else {
+            result[pk.fieldName] = String(idValue);
+        }
+        return result;
+    }
+
+    // Composite key - split by :::
+    const parts = String(idValue).split(":::");
+    if (parts.length !== primaryKeys.length) {
+        throw new Error(`Composite ID parts mismatch. Expected ${primaryKeys.length}, got ${parts.length} for ID: ${idValue}`);
+    }
+
+    for (let i = 0; i < primaryKeys.length; i++) {
+        const pk = primaryKeys[i];
+        const val = parts[i];
+        if (pk.type === "number" && !pk.isUUID) {
+            const parsed = parseInt(val, 10);
+            if (isNaN(parsed)) {
+                throw new Error(`Invalid numeric ID component: ${val}`);
+            }
+            result[pk.fieldName] = parsed;
+        } else {
+            result[pk.fieldName] = val;
+        }
+    }
+
+    return result;
+}
+
+export function buildCompositeId(values: Record<string, unknown>, primaryKeys: { fieldName: string; type: "string" | "number"; isUUID?: boolean }[]): string {
+    if (primaryKeys.length === 0) {
+        return "";
+    }
+    if (primaryKeys.length === 1) {
+        return String(values[primaryKeys[0].fieldName] ?? "");
+    }
+    return primaryKeys.map(pk => String(values[pk.fieldName] ?? "")).join(":::");
+}

package/src/services/dataService.ts

@@ -154,10 +154,9 @@ export class DataService implements DataRepository {
         collectionPath: string,
         values: Partial<M>,
         id?: string | number,
-        databaseId?: string,
-        options?: { upsert?: boolean }
+        databaseId?: string
     ): Promise<Record<string, unknown>> {
-        return this.persistService.save<M>(collectionPath, values, id, databaseId, options);
+        return this.persistService.save<M>(collectionPath, values, id, databaseId);
     }
 
     /**

package/src/websocket.ts

@@ -620,12 +620,9 @@ roles: ["anon"] };
                 if (error instanceof Error) {
                     logger.error("Stack trace", { detail: error.stack });
                 }
-                // Unwrap the cause chain: a Drizzle failure reports itself as
-                // "Failed query: <sql> params:", which tells the user nothing and
-                // echoes the statement back at them. The reason is in the cause.
                 const errorMessage = process.env.NODE_ENV === "production"
                     ? "An unexpected error occurred"
-                    : extractErrorMessage(error);
+                    : (error instanceof Error ? error.message : "An unexpected error occurred");
                 const errorResponse = {
                     type: "ERROR",
                     requestId,