@rebasepro/server-postgres 0.9.1-canary.ad25bc0 → 0.9.1-canary.b10dcdf

package/src/auth/ensure-tables.ts

@@ -251,17 +251,32 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Seed default roles if none exist
         // (no-op: roles are now stored inline on the users table)
 
-        // ── Migration: Add is_anonymous column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-
-        // ── Migration: Add inline roles column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+        // ── Migration: reconcile the full users column set (safe for existing tables) ──
+        // CREATE TABLE IF NOT EXISTS never revisits an existing table, so a
+        // database provisioned by an older framework era is missing every
+        // column added since. Each column the auth services read or write must
+        // be back-filled here, or upgraded deployments break on the first
+        // statement that references it. `email` is deliberately absent: it has
+        // existed since the first era and cannot be added NOT NULL safely.
+        const userColumnBackfills = [
+            "display_name VARCHAR(255)",
+            "photo_url VARCHAR(500)",
+            "roles TEXT[] DEFAULT '{}' NOT NULL",
+            "password_hash VARCHAR(255)",
+            "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+            "email_verification_token VARCHAR(255)",
+            "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+            "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+            "metadata JSONB DEFAULT '{}' NOT NULL",
+            "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+            "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+        ];
+        for (const columnDef of userColumnBackfills) {
+            await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
+        }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
@@ -358,6 +373,53 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
 
+        // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──
+        // The current model never emits FORCE: privileged auth writes run as
+        // the table owner and rely on the owner bypassing plain ENABLE RLS
+        // (see generate-postgres-ddl-logic). A table still carrying FORCE from
+        // an older framework era binds the owner too, so the first user
+        // registration after an upgrade fails with SQLSTATE 42501. Reconcile
+        // on boot; only tables actually flagged get the ALTER (and its lock).
+        try {
+            const authTablePairs: [string, string][] = [
+                [usersSchema, resolvedTable],
+                [authSchema, "user_identities"],
+                [authSchema, "refresh_tokens"],
+                [authSchema, "password_reset_tokens"],
+                [authSchema, "app_config"],
+                [authSchema, "mfa_factors"],
+                [authSchema, "mfa_challenges"],
+                [authSchema, "recovery_codes"]
+            ];
+            for (const [schemaName, tableName] of authTablePairs) {
+                const forced = await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `);
+                if (forced.rows.length > 0) {
+                    await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+                    logger.warn(
+                        `🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" ` +
+                        "(legacy RLS model — it binds the owner connection and breaks privileged auth writes)"
+                    );
+                }
+            }
+        } catch (rlsReconcileError: unknown) {
+            // Non-fatal: the connection may lack ownership on a pre-provisioned
+            // table; registration will still fail loudly (42501) if FORCE remains.
+            logger.warn(
+                `⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ` +
+                `${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`
+            );
+        }
+
         logger.info("✅ Auth tables ready");
     } catch (error) {
         logger.error("❌ Failed to create auth tables", { error });

package/src/auth/services.ts

@@ -82,6 +82,32 @@ export class UserService implements UserRepository {
         return `"${schema}"."${name}"`;
     }
 
+    /**
+     * Run a privileged auth write with an explicitly cleared RLS context.
+     *
+     * The auth services run on the base/owner connection, which by design
+     * carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+     * in the default policies applies. That NULL is normally guaranteed by
+     * `set_config(..., is_local = true)` resetting at transaction end — but a
+     * GUC that survives on a pooled connection (or a connection role that
+     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+     * turns the trusted write into an RLS-scoped one and denies it with
+     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+     * single chokepoint, makes the server context deterministic instead of
+     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
+     * NULL via NULLIF, so '' is the server context.
+     */
+    private async withServerContext<T>(fn: (db: NodePgDatabase) => Promise<T>): Promise<T> {
+        return await this.db.transaction(async (tx) => {
+            await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+            return await fn(tx as unknown as NodePgDatabase);
+        });
+    }
+
     private mapRowToUser(row: Record<string, unknown>): UserData {
         if (!row) return row as UserData;
 
@@ -200,7 +226,9 @@ export class UserService implements UserRepository {
 
     async createUser(data: CreateUserData): Promise<UserData> {
         const payload = this.mapPayload(data);
-        const [row] = (await this.db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[]
+        );
         return this.mapRowToUser(row);
     }
 
@@ -255,12 +283,12 @@ export class UserService implements UserRepository {
     }
 
     async linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void> {
-        await this.db.insert(this.userIdentitiesTable).values({
+        await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
             userId,
             provider,
             providerId,
             profileData: profileData || null
-        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
     }
 
     async updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null> {
@@ -270,18 +298,20 @@ export class UserService implements UserRepository {
         const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
         payload[updatedAtKey] = new Date();
 
-        const [row] = (await this.db
-            .update(this.usersTable)
-            .set(payload)
-            .where(eq(idCol, id))
-            .returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db
+                .update(this.usersTable)
+                .set(payload)
+                .where(eq(idCol, id))
+                .returning()) as Record<string, unknown>[]
+        );
         return row ? this.mapRowToUser(row) : null;
     }
 
     async deleteUser(id: string): Promise<void> {
         const idCol = getColumn(this.usersTable, "id");
         if (!idCol) return;
-        await this.db.delete(this.usersTable).where(eq(idCol, id));
+        await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
     }
 
     async listUsers(): Promise<UserData[]> {
@@ -357,13 +387,13 @@ export class UserService implements UserRepository {
         const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [passwordHashColKey]: passwordHash,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -376,14 +406,14 @@ export class UserService implements UserRepository {
         const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerifiedColKey]: verified,
                 [emailVerificationTokenColKey]: null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -396,14 +426,14 @@ export class UserService implements UserRepository {
         const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerificationTokenColKey]: token,
                 [emailVerificationSentAtColKey]: token ? new Date() : null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -463,11 +493,11 @@ export class UserService implements UserRepository {
     async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
         const rolesArray = `{${roleIds.join(",")}}`;
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
     }
 
     /**
@@ -475,11 +505,11 @@ export class UserService implements UserRepository {
      */
     async assignDefaultRole(userId: string, roleId: string): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
     }
 
     /**

package/src/collections/buildRegistry.ts

@@ -0,0 +1,59 @@
+import { isTable, getTableName, Relations } from "drizzle-orm";
+import { PgEnum, PgTable } from "drizzle-orm/pg-core";
+import { CollectionConfig } from "@rebasepro/types";
+import { logger } from "@rebasepro/server";
+import { PostgresCollectionRegistry } from "./PostgresCollectionRegistry";
+import { warnOnKeysTheAdminCannotResolve } from "../services/collection-helpers";
+
+/**
+ * Everything a registry is built from: the collections, and the drizzle schema
+ * they are backed by. In BaaS mode all of it is introspected from the live
+ * database; in CMS mode it comes from the config and the generated schema.
+ */
+export interface RegistrySchema {
+    collections?: CollectionConfig[];
+    tables?: Record<string, unknown>;
+    enums?: Record<string, PgEnum<[string, ...string[]]>>;
+    relations?: Record<string, Relations>;
+}
+
+/**
+ * Build the collection registry for a driver.
+ *
+ * The order matters and is the reason this is one function rather than a run of
+ * statements in the bootstrapper. Keys are resolved from the drizzle schema, so
+ * anything that inspects them has to run *after* the tables are registered —
+ * and `warnOnKeysTheAdminCannotResolve` fails open if it does not, because a
+ * collection whose table it cannot look up is one it has nothing to say about.
+ * Warned too early, it would skip every collection and report nothing, which
+ * reads exactly like having nothing to report.
+ */
+export function buildCollectionRegistry(schema: RegistrySchema): PostgresCollectionRegistry {
+    const registry = new PostgresCollectionRegistry();
+
+    if (schema.collections) {
+        registry.registerMultiple(schema.collections);
+        logger.info(
+            `📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: ` +
+            `[${registry.getCollections().map(c => c.slug).join(", ")}]`
+        );
+    }
+
+    if (schema.tables) {
+        Object.values(schema.tables).forEach((table) => {
+            if (isTable(table)) {
+                registry.registerTable(table as PgTable, getTableName(table));
+            }
+        });
+    }
+
+    if (schema.enums) registry.registerEnums(schema.enums);
+    if (schema.relations) registry.registerRelations(schema.relations);
+
+    // Now that the keys resolve: say which of them the admin cannot see. It
+    // compiles the same collection files into its bundle but never the drizzle
+    // schema, and nothing serves it one, so only an edit to the config fixes it.
+    warnOnKeysTheAdminCannotResolve(registry.getCollections(), registry);
+
+    return registry;
+}

package/src/connection.ts

@@ -27,11 +27,68 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
-    queryTimeout: 30_000,
+    // The client-side read timeout MUST be comfortably above the server-side
+    // statement_timeout. When the client timer fires first, node-postgres
+    // abandons the in-flight statement but keeps the connection — inside a
+    // transaction that leaves the tx open (and any pending ROLLBACK is
+    // spliced out of the client queue before it ever reaches the wire), so
+    // the pooled connection is returned still in-transaction with its RLS
+    // GUCs set. The server abort (SQLSTATE 57014) is the clean path; the
+    // client timeout is only a backstop for a dead network.
+    queryTimeout: 60_000,
     statementTimeout: 30_000,
     keepAlive: true
 };
 
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+const TX_IDLE = "I";
+
+/**
+ * Destroy pool clients that are released while still inside a transaction.
+ *
+ * pg-pool returns a client to the idle list whenever `release()` is called
+ * without an error — even if the connection is still mid-transaction (status
+ * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+ * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+ * (e.g. it was queued behind a statement that hit the client-side
+ * query_timeout), the client goes back dirty. The next checkout then runs
+ * its statements inside the zombie transaction — with the previous request's
+ * `app.*` RLS GUCs still applied, which turns unrelated queries into
+ * RLS-scoped ones (observed in production as registration failing with
+ * SQLSTATE 42501 under a leaked anonymous context).
+ *
+ * pg-pool emits `release` before it consults its private `_expired` set, so
+ * marking the client expired here makes `_release()` destroy it instead of
+ * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+ * private APIs — feature-detect and fall back to loud logging so an upstream
+ * change degrades to observability, never to silent corruption.
+ */
+export function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void {
+    pool.on("release", (err: Error | undefined, client: unknown) => {
+        if (err) return; // errored clients are already destroyed by pg-pool
+        const txStatus = (client as { _txStatus?: string | null })?._txStatus;
+        if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+
+        // pg-pool keeps expired clients in a WeakSet (a plain object works too
+        // if upstream ever changes it — duck-type on add/has).
+        const expired = (pool as unknown as { _expired?: { add(c: object): unknown; has(c: object): boolean } })._expired;
+        if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+            expired.add(client);
+            logger.error(
+                `[${label}] Client released back to the pool while still in a transaction ` +
+                `(status '${txStatus}') — destroying it so the open transaction and its ` +
+                `session state (RLS GUCs) cannot leak into the next request.`
+            );
+        } else {
+            logger.error(
+                `[${label}] Client released mid-transaction (status '${txStatus}') but the ` +
+                `pool's internal expiry set is unavailable (pg-pool internals changed?). ` +
+                `The connection may leak its open transaction into subsequent requests.`
+            );
+        }
+    });
+}
+
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.
@@ -75,6 +132,7 @@ export function createPostgresDatabaseConnection(
             logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
         }
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-pool");
 
     // Create drizzle instance — pass schema when available to enable db.query relational API
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
@@ -118,6 +176,7 @@ export function createDirectDatabaseConnection(
     pool.on("error", (err) => {
         logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 
@@ -157,6 +216,7 @@ export function createReadReplicaConnection(
     pool.on("error", (err) => {
         logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
     });
+    guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 

package/src/data-transformer.ts

@@ -20,12 +20,19 @@ import { logger } from "@rebasepro/server";
 export interface SerializedEntityData {
     /** Scalar column values ready for INSERT/UPDATE. */
     scalarData: Record<string, unknown>;
-    /** Inverse relation updates that must be applied to target tables. */
+    /**
+     * Inverse relation updates that must be applied to target tables.
+     *
+     * No address here: the row being written does not know its own. These are
+     * applied by `PersistService`, which addresses them with the id it holds —
+     * the one it was given for an update, or the one the INSERT returned — and
+     * that is the authority. This item used to carry a `currentId` derived from
+     * the *input* values, which nothing ever read.
+     */
     inverseRelationUpdates: Array<{
         relationKey: string;
         relation: Relation;
         newValue: unknown;
-        currentId?: string | number;
     }>;
     /** JoinPath relation updates that require multi-hop writes. */
     joinPathRelationUpdates: Array<{
@@ -105,7 +112,6 @@ joinPathRelationUpdates: [] };
         relationKey: string;
         relation: Relation;
         newValue: unknown;
-        currentId?: string | number;
     }> = [];
     const joinPathRelationUpdates: Array<{
         relationKey: string;
@@ -146,12 +152,10 @@ joinPathRelationUpdates: [] };
                 } else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
                     // Inverse relation: Need to update the target table's FK
                     const serializedValue = serializePropertyToServer(effectiveValue, property);
-                    const pks = getPrimaryKeys(collection, registry!);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
-                        newValue: serializedValue,
-                        currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
+                        newValue: serializedValue
                     });
                     // Don't add the original relation property to the result
                     continue;
@@ -170,12 +174,10 @@ joinPathRelationUpdates: [] };
                         });
                     } else {
                         // Many inverse joinPath: capture as inverse relation update
-                        const pks = getPrimaryKeys(collection, registry!);
                         inverseRelationUpdates.push({
                             relationKey: key,
                             relation,
-                            newValue: serializedValue,
-                            currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
+                            newValue: serializedValue
                         });
                     }
                     // Don't add the original relation property to the result

package/src/databasePoolManager.ts

@@ -2,6 +2,7 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
+import { guardPoolAgainstDirtyRelease } from "./connection";
 
 export class DatabasePoolManager {
     private pools: Map<string, Pool> = new Map();
@@ -50,6 +51,7 @@ export class DatabasePoolManager {
         pool.on("error", (err) => {
             logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
         });
+        guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 
         this.pools.set(databaseName, pool);
         return pool;

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
 // --- Helper Functions ---
@@ -545,6 +545,10 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -601,9 +605,22 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ({\n";
-            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-            schemaContent += "}));\n\n";
+            schemaContent += "}, (table) => ([\n";
+            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+
+            // Junctions are generated tables like any other: locked by default,
+            // with derived policies (reads follow the endpoints, writes follow
+            // the declaring side's update rules). RLS is enabled regardless of
+            // policy stripping — a bare junction must default-deny, not fail open.
+            const junctionSpec = junctionSpecs.get(baseTableName);
+            if (!stripPolicies && junctionSpec) {
+                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
+                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+                });
+            }
+            schemaContent += "])).enableRLS();\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
 import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
@@ -226,6 +226,10 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -261,6 +265,11 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
+    // Policies are emitted after every CREATE TABLE, like the FK constraints:
+    // a policy may reference other tables (a junction's derived policies always
+    // reference both endpoints; `policy.existsIn` references a join table), and
+    // CREATE POLICY validates those relations at creation time.
+    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -293,6 +302,25 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+
+            if (options.includePolicies) {
+                // Junction tables are generated tables like any other: locked by
+                // default, with derived policies — reads follow the endpoints'
+                // visibility, writes follow the declaring side's update rules.
+                // Without this they were the one kind of generated table with no
+                // RLS at all, readable and writable by every signed-in user.
+                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+                ddl += `\n`;
+
+                const spec = junctionSpecs.get(baseTableName);
+                if (spec) {
+                    const junctionCollection = getJunctionCollectionConfig(spec);
+                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
+                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+                    });
+                }
+            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -414,9 +442,8 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
+                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
                     });
-                    ddl += "\n";
                 }
             }
         }
@@ -427,6 +454,12 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
+    if (policyStatements.length > 0) {
+        ddl += "-- Row Level Security Policies\n";
+        ddl += policyStatements.join("");
+        ddl += "\n";
+    }
+
     return ddl;
 };
 
@@ -473,6 +506,33 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         }
     }
 
+    // Junction tables are generated from `through` relations, not declared as
+    // collections, so the walk above never sees them. They get the same
+    // treatment as any generated table: locked by default, with derived
+    // policies — reads follow the endpoints, writes follow the declaring
+    // side's update rules.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+    for (const spec of junctionSpecs.values()) {
+        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+        ddl += `\n`;
+
+        const junctionRules = getJunctionSecurityRules(spec);
+        if (junctionRules.length === 0) continue;
+
+        const junctionCollection = getJunctionCollectionConfig(spec);
+        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
+
+        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+        junctionRules.forEach((rule: SecurityRule) => {
+            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+        });
+        ddl += "\n";
+    }
+
     return ddl;
 };