@rebasepro/server-postgres 0.9.1-canary.b10dcdf → 0.9.1-canary.baa7a6b

package/dist/schema/doctor.d.ts

@@ -2,7 +2,7 @@ import { CollectionConfig, Property } from "@rebasepro/types";
 export type IssueSeverity = "error" | "warning" | "info";
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;

package/dist/security/policy-drift.d.ts

@@ -63,6 +63,36 @@ export declare function parseExpectedPolicies(ddl: string): PolicyRef[];
  * of reads. The same blindness would hide a policy that fails open.
  */
 export declare function checkPolicyDrift(client: Queryable, collections: CollectionConfig[]): Promise<PolicyDrift>;
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export declare function isGeneratedPolicyName(name: string, table: string): boolean;
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export declare function dropOrphanedPolicies(client: Queryable, drift: PolicyDrift, collections: CollectionConfig[]): Promise<OrphanCleanup>;
 export declare const hasDrift: (d: PolicyDrift) => boolean;
 /** Human-readable report; empty string when the database matches the config. */
 export declare function formatPolicyDrift(drift: PolicyDrift): string;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@rebasepro/server-postgres",
   "type": "module",
-  "version": "0.9.1-canary.b10dcdf",
+  "version": "0.9.1-canary.baa7a6b",
   "description": "PostgreSQL data source backend implementation for Rebase with Drizzle ORM",
   "funding": {
     "url": "https://github.com/sponsors/rebaseco"
@@ -71,14 +71,15 @@
     "execa": "^9.6.1",
     "pg": "^8.21.0",
     "ws": "^8.21.0",
-    "@rebasepro/codegen": "0.9.1-canary.b10dcdf",
-    "@rebasepro/common": "0.9.1-canary.b10dcdf",
-    "@rebasepro/server": "0.9.1-canary.b10dcdf",
-    "@rebasepro/types": "0.9.1-canary.b10dcdf",
-    "@rebasepro/utils": "0.9.1-canary.b10dcdf"
+    "@rebasepro/common": "0.9.1-canary.baa7a6b",
+    "@rebasepro/codegen": "0.9.1-canary.baa7a6b",
+    "@rebasepro/types": "0.9.1-canary.baa7a6b",
+    "@rebasepro/server": "0.9.1-canary.baa7a6b",
+    "@rebasepro/utils": "0.9.1-canary.baa7a6b"
   },
   "devDependencies": {
     "@hono/node-server": "^2.0.9",
+    "@jest/globals": "^30.4.1",
     "@types/jest": "^30.0.0",
     "@types/node": "^25.9.3",
     "@types/pg": "^8.20.0",

package/src/cli.ts

@@ -176,6 +176,7 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
+                await reconcilePolicies(databaseUrl, collectionsPath);
                 await ensureRlsUserRole(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
@@ -269,6 +270,65 @@ async function applyPolicies(databaseUrl: string): Promise<void> {
     }
 }
 
+/**
+ * Remove the policies an earlier push superseded but never dropped.
+ *
+ * `policies.sql` only DROPs the names it is about to CREATE, and a rule's
+ * generated name contains a hash of its own semantics — so editing a rule
+ * writes a *new* policy and abandons the old one. Postgres ORs PERMISSIVE
+ * policies together, which makes an abandoned grant outrank every tightening
+ * that replaced it, and push reported success the whole time.
+ *
+ * Runs after `applyPolicies` so the current policies are already in place: the
+ * drift check then sees exactly the set that should survive, and anything else
+ * on a managed table is by definition left over.
+ */
+async function reconcilePolicies(databaseUrl: string, collectionsPath: string): Promise<void> {
+    try {
+        const { checkPolicyDrift, dropOrphanedPolicies, formatPolicyDrift, hasDrift } =
+            await import("./security/policy-drift");
+        const { loadCollections } = await import("./schema/doctor");
+
+        const collections = await loadCollections(path.resolve(process.cwd(), collectionsPath));
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const drift = await checkPolicyDrift(client as never, collections);
+            const { dropped, kept } = await dropOrphanedPolicies(client as never, drift, collections);
+
+            for (const p of dropped) {
+                logger.info(chalk.gray(`  ✓ Dropped superseded policy "${p.name}" on ${p.schema}.${p.table}`));
+            }
+            if (dropped.length > 0) {
+                logger.info(chalk.green(`  ✓ Removed ${dropped.length} superseded RLS ${dropped.length === 1 ? "policy" : "policies"}.`));
+            }
+
+            // Custom-named orphans are indistinguishable from policies someone
+            // wrote in SQL deliberately, so they are reported, never dropped.
+            if (kept.length > 0) {
+                logger.warn(chalk.yellow("  ⚠️  Policies in the database that no collection describes:"));
+                for (const p of kept) {
+                    logger.warn(chalk.yellow(`       • ${p.schema}.${p.table} → "${p.name}" (${p.command} TO ${p.roles.join(", ")})`));
+                }
+                logger.warn(chalk.yellow("       These still grant access. Drop them by hand if they are stale."));
+            }
+
+            // Missing/diverged are not push's to fix, but staying silent about
+            // them is how a database ends up not matching its config.
+            const remaining = { ...drift, orphaned: kept };
+            if (hasDrift(remaining) && (remaining.missing.length > 0 || remaining.diverged.length > 0)) {
+                logger.warn(chalk.yellow("  ⚠️  RLS policies do not match your collections:"));
+                logger.warn(formatPolicyDrift({ ...remaining, orphaned: [] }));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Could not reconcile RLS policies: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 async function branchCommand(rawArgs: string[]): Promise<void> {
     const branchAction = rawArgs[2]; // create, list, delete, info
 

package/src/schema/doctor.ts

@@ -37,7 +37,7 @@ export type IssueSeverity = "error" | "warning" | "info";
 
 export interface DoctorIssue {
     severity: IssueSeverity;
-    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale";
+    category: "missing_table" | "missing_column" | "type_mismatch" | "missing_constraint" | "schema_stale" | "missing_enum" | "enum_value_mismatch" | "missing_foreign_key" | "sdk_stale" | "sdk_not_generated";
     table?: string;
     column?: string;
     expected?: string;
@@ -61,19 +61,29 @@ export function getExpectedColumnType(prop: Property): string | null {
             const sp = prop as StringProperty;
             if (sp.enum) return "USER-DEFINED"; // pgEnum → USER-DEFINED in information_schema
             if ("isId" in sp && sp.isId === "uuid") return "uuid";
-            if (sp.columnType === "text") return "text";
+            if (sp.columnType === "uuid") return "uuid";
+            // A markdown/multiline string compiles to `text`, not varchar — the
+            // generator treats those UI hints as column-type signals, so the
+            // expectation here must too or every such column reads as drift.
+            if (sp.columnType === "text" || sp.ui?.markdown || sp.ui?.multiline) return "text";
             if (sp.columnType === "char") return "character";
             return "character varying";
         }
         case "number": {
             const np = prop as NumberProperty;
-            if (np.columnType === "double precision") return "double precision";
-            if (np.columnType === "real") return "real";
-            if (np.columnType === "bigint") return "bigint";
-            if (np.columnType === "serial") return "integer"; // serial is integer under the hood
-            if (np.columnType === "bigserial") return "bigint";
-            if (np.columnType === "integer") return "integer";
-            if (np.columnType === "numeric") return "numeric";
+            if (np.columnType) {
+                // The generator passes any columnType straight through to drizzle,
+                // so mirror that rather than enumerating a subset (which reported
+                // drift for anything unlisted, e.g. smallint). Serial types are
+                // integers with a sequence default; information_schema reports the
+                // underlying width.
+                const serialWidths: Record<string, string> = {
+                    serial: "integer",
+                    bigserial: "bigint",
+                    smallserial: "smallint"
+                };
+                return serialWidths[np.columnType] ?? np.columnType;
+            }
             if (np.validation?.integer || ("isId" in np && np.isId)) return "integer";
             return "numeric";
         }
@@ -201,15 +211,18 @@ export async function checkCollectionsVsSdk(
 ): Promise<{ passed: boolean; issues: DoctorIssue[] }> {
     const issues: DoctorIssue[] = [];
 
-    // Check if SDK file exists
+    // The typed SDK is opt-in — nothing in a scaffolded project imports it until
+    // you choose to. A project that never generated one isn't drifting, so report
+    // it as information rather than a warning; otherwise `doctor` can never come
+    // back clean on a fresh project and users learn to ignore its output.
     if (!fs.existsSync(sdkFilePath)) {
         issues.push({
-            severity: "warning",
-            category: "sdk_stale",
-            message: `Generated SDK typedefs file does not exist at "${sdkFilePath}".`,
-            fix: "Run `rebase generate-sdk`"
+            severity: "info",
+            category: "sdk_not_generated",
+            message: "Typed SDK not generated (optional).",
+            fix: "Run `rebase generate-sdk` if you want typed collection access"
         });
-        return { passed: false,
+        return { passed: true,
 issues };
     }
 
@@ -631,11 +644,15 @@ export function renderReport(report: DoctorReport): void {
 }
 
 function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): void {
-    if (passed) {
+    const errorCount = issues.filter((i) => i.severity === "error").length;
+    const warnCount = issues.filter((i) => i.severity === "warning").length;
+    const infoIssues = issues.filter((i) => i.severity === "info");
+
+    // Informational notes don't make a phase unhealthy, so key the header off
+    // real problems rather than `passed` alone.
+    if (errorCount === 0 && warnCount === 0) {
         logger.info(`  ${chalk.green("✅")} ${label}: ${chalk.green("In sync")}`);
     } else {
-        const errorCount = issues.filter((i) => i.severity === "error").length;
-        const warnCount = issues.filter((i) => i.severity === "warning").length;
         const parts: string[] = [];
         if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
         if (warnCount > 0) parts.push(`${warnCount} warning${warnCount > 1 ? "s" : ""}`);
@@ -643,7 +660,14 @@ function renderPhase(label: string, passed: boolean, issues: DoctorIssue[]): voi
     }
     logger.info("");
 
-    for (const issue of issues) {
+    // Notes render as a quiet one-liner, not a full drift box.
+    for (const issue of infoIssues) {
+        const fixPart = issue.fix ? chalk.gray(` — ${issue.fix}`) : "";
+        logger.info(`  ${chalk.gray("ℹ")} ${chalk.gray(issue.message)}${fixPart}`);
+        logger.info("");
+    }
+
+    for (const issue of issues.filter((i) => i.severity !== "info")) {
         const severityIcon = issue.severity === "error" ? chalk.red("✗") : chalk.yellow("⚠");
         const categoryLabel = formatCategory(issue.category);
         logger.info(`  ${chalk.gray("┌─")} ${severityIcon} ${chalk.bold(categoryLabel)} ${chalk.gray("─".repeat(Math.max(0, 42 - categoryLabel.length)))}`);
@@ -674,7 +698,8 @@ function formatCategory(cat: DoctorIssue["category"]): string {
         missing_enum: "Missing Enum",
         enum_value_mismatch: "Enum Value Mismatch",
         missing_foreign_key: "Missing Foreign Key",
-        sdk_stale: "Stale SDK Types"
+        sdk_stale: "Stale SDK Types",
+        sdk_not_generated: "SDK Types Not Generated"
     };
     return labels[cat];
 }

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -154,3 +154,108 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
+
+describe("isGeneratedPolicyName", () => {
+    it("recognises the generator's own shape", () => {
+        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
+        // One rule spanning several operations appends the operation index.
+        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
+    });
+
+    it("does not claim names a human could have written", () => {
+        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
+        // Right shape, wrong table — belongs to something else.
+        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
+        // A digest is 7 lowercase hex characters, nothing else.
+        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
+    });
+});
+
+describe("dropOrphanedPolicies", () => {
+    /** Records the DDL issued so the test can assert on what was dropped. */
+    function recordingDb(rows: Record<string, unknown>[]) {
+        const executed: string[] = [];
+        const db: Queryable = {
+            query: async (text: string) => {
+                if (!/^SELECT/i.test(text)) executed.push(text);
+                return { rows: rows as never[] };
+            }
+        };
+        return { db, executed };
+    }
+
+    it("drops the policy a rule edit superseded", async () => {
+        // The reported failure: tightening a rule renames its policy, and the
+        // permissive original stays live and keeps ORing itself back in.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const stale = {
+            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
+            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
+        };
+        const live = [...expected.map((p) => liveRow(p)), stale];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(1);
+        expect(dropped[0].name).toBe("documents_insert_dead1ee");
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([
+            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
+        ]);
+    });
+
+    it("leaves a hand-written policy alone and reports it instead", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("never touches a table the collections do not describe", async () => {
+        // Another application sharing the schema owns this table; a
+        // generator-shaped name there is coincidence, not our leftover.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("does nothing when the database already matches", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([]);
+    });
+});

package/src/security/policy-drift.ts

@@ -192,6 +192,62 @@ export async function checkPolicyDrift(
     return drift;
 }
 
+/**
+ * Does this name look like one the generator produced for this table?
+ *
+ * Unnamed rules compile to `<table>_<op>_<sha1[0:7]>` (plus `_<idx>` when one
+ * rule spans several operations), and the hash covers the rule's semantics — so
+ * *editing* a rule renames its policy. The policy under the old name is left
+ * behind by `db push`, which only DROPs the names it is about to CREATE, and
+ * Postgres ORs PERMISSIVE policies together: a superseded `USING (true)` keeps
+ * granting everything no matter how tight its replacement is.
+ *
+ * Matching the shape is what makes dropping them safe. A hand-written policy
+ * would have to collide with a 7-hex digest to be mistaken for generated one;
+ * a policy named anything else is left alone and merely reported, because a
+ * custom name is indistinguishable from one someone wrote in SQL on purpose.
+ */
+export function isGeneratedPolicyName(name: string, table: string): boolean {
+    return new RegExp(`^${table.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}_(select|insert|update|delete|all)_[0-9a-f]{7}(_\\d+)?$`)
+        .test(name);
+}
+
+export interface OrphanCleanup {
+    /** Superseded generated policies that were dropped. */
+    dropped: PolicyRef[];
+    /** Orphans left in place because their names are not generator-shaped. */
+    kept: PolicyRef[];
+}
+
+/**
+ * Drop the policies an earlier push superseded but never removed.
+ *
+ * Only touches tables the collections describe — a table with no expected
+ * policy is not ours to reconcile, and scanning by schema alone would sweep up
+ * policies belonging to something else sharing the database.
+ */
+export async function dropOrphanedPolicies(
+    client: Queryable,
+    drift: PolicyDrift,
+    collections: CollectionConfig[]
+): Promise<OrphanCleanup> {
+    const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(collections));
+    const managed = new Set(expected.map((p) => `${p.schema}.${p.table}`));
+
+    const cleanup: OrphanCleanup = { dropped: [], kept: [] };
+    for (const p of drift.orphaned) {
+        if (!managed.has(`${p.schema}.${p.table}`) || !isGeneratedPolicyName(p.name, p.table)) {
+            cleanup.kept.push(p);
+            continue;
+        }
+        // Identifiers are quoted, and the name came from pg_policies rather than
+        // from user input, so it is already a valid identifier.
+        await client.query(`DROP POLICY IF EXISTS "${p.name}" ON "${p.schema}"."${p.table}"`);
+        cleanup.dropped.push(p);
+    }
+    return cleanup;
+}
+
 export const hasDrift = (d: PolicyDrift): boolean =>
     d.missing.length > 0 || d.orphaned.length > 0 || d.diverged.length > 0;
 

package/src/services/row-pipeline.ts

@@ -91,6 +91,30 @@ function coerceDeclaredNumbers(
 }
 
 /** Render one target row in the requested style. */
+/**
+ * Drop every column the collection marked `excludeFromApi`.
+ *
+ * Password hashes and verification tokens have to be readable server-side but
+ * must never reach a client — and "never" has to mean every exit from this
+ * pipeline, including relation targets, or a secret leaks through whichever
+ * path was overlooked. Keyed by both the property name and its column name,
+ * since a row can arrive keyed either way depending on the caller.
+ */
+function stripExcluded(
+    row: Record<string, unknown>,
+    collection: CollectionConfig
+): Record<string, unknown> {
+    const properties = collection.properties as Record<string, Property> | undefined;
+    if (!properties) return row;
+
+    for (const [key, property] of Object.entries(properties)) {
+        if (!property?.excludeFromApi) continue;
+        delete row[key];
+        if (property.columnName) delete row[property.columnName];
+    }
+    return row;
+}
+
 function renderTarget(
     targetRow: Record<string, unknown>,
     targetCollection: CollectionConfig,
@@ -100,7 +124,7 @@ function renderTarget(
     if (style === "inline") {
         // The target's columns, and only those: its address is the consumer's
         // to derive, and merging one in overwrites a real `id` column.
-        return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+        return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
     }
 
     const address = relationTargetAddress(targetRow, targetCollection, registry);
@@ -168,7 +192,7 @@ export function toCmsRow(
         }
     }
 
-    return normalized;
+    return stripExcluded(normalized, collection);
 }
 
 /**
@@ -211,5 +235,5 @@ export function toRestRow(
         }
     }
 
-    return flat;
+    return stripExcluded(flat, collection);
 }