@rebasepro/server-postgres 0.9.1-canary.c0d4c07 → 0.9.1-canary.d906fb7

package/dist/auth/services.d.ts

@@ -19,22 +19,6 @@ export declare class UserService implements UserRepository {
     private userIdentitiesTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
     private getQualifiedUsersTableName;
-    /**
-     * Run a privileged auth write with an explicitly cleared RLS context.
-     *
-     * The auth services run on the base/owner connection, which by design
-     * carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
-     * in the default policies applies. That NULL is normally guaranteed by
-     * `set_config(..., is_local = true)` resetting at transaction end — but a
-     * GUC that survives on a pooled connection (or a connection role that
-     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
-     * turns the trusted write into an RLS-scoped one and denies it with
-     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
-     * single chokepoint, makes the server context deterministic instead of
-     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
-     * NULL via NULLIF, so '' is the server context.
-     */
-    private withServerContext;
     private mapRowToUser;
     private mapPayload;
     createUser(data: CreateUserData): Promise<UserData>;

package/dist/connection.d.ts

@@ -19,27 +19,6 @@ export interface PostgresPoolConfig {
     /** Enable TCP keep-alive (default: true) */
     keepAlive?: boolean;
 }
-/**
- * Destroy pool clients that are released while still inside a transaction.
- *
- * pg-pool returns a client to the idle list whenever `release()` is called
- * without an error — even if the connection is still mid-transaction (status
- * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
- * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
- * (e.g. it was queued behind a statement that hit the client-side
- * query_timeout), the client goes back dirty. The next checkout then runs
- * its statements inside the zombie transaction — with the previous request's
- * `app.*` RLS GUCs still applied, which turns unrelated queries into
- * RLS-scoped ones (observed in production as registration failing with
- * SQLSTATE 42501 under a leaked anonymous context).
- *
- * pg-pool emits `release` before it consults its private `_expired` set, so
- * marking the client expired here makes `_release()` destroy it instead of
- * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
- * private APIs — feature-detect and fall back to loud logging so an upstream
- * change degrades to observability, never to silent corruption.
- */
-export declare function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void;
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.

package/dist/index.es.js

@@ -71,51 +71,16 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection,
-	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
+	createReadReplicaConnection: () => createReadReplicaConnection
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 6e4,
+	queryTimeout: 3e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
-/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
-var TX_IDLE = "I";
-/**
-* Destroy pool clients that are released while still inside a transaction.
-*
-* pg-pool returns a client to the idle list whenever `release()` is called
-* without an error — even if the connection is still mid-transaction (status
-* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
-* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
-* (e.g. it was queued behind a statement that hit the client-side
-* query_timeout), the client goes back dirty. The next checkout then runs
-* its statements inside the zombie transaction — with the previous request's
-* `app.*` RLS GUCs still applied, which turns unrelated queries into
-* RLS-scoped ones (observed in production as registration failing with
-* SQLSTATE 42501 under a leaked anonymous context).
-*
-* pg-pool emits `release` before it consults its private `_expired` set, so
-* marking the client expired here makes `_release()` destroy it instead of
-* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
-* private APIs — feature-detect and fall back to loud logging so an upstream
-* change degrades to observability, never to silent corruption.
-*/
-function guardPoolAgainstDirtyRelease(pool, label) {
-	pool.on("release", (err, client) => {
-		if (err) return;
-		const txStatus = client?._txStatus;
-		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
-		const expired = pool._expired;
-		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
-			expired.add(client);
-			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
-		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
-	});
-}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -147,7 +112,6 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -180,7 +144,6 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -210,7 +173,6 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
-	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -6524,27 +6486,8 @@ function coerceDeclaredNumbers(row, collection) {
 	return out;
 }
 /** Render one target row in the requested style. */
-/**
-* Drop every column the collection marked `excludeFromApi`.
-*
-* Password hashes and verification tokens have to be readable server-side but
-* must never reach a client — and "never" has to mean every exit from this
-* pipeline, including relation targets, or a secret leaks through whichever
-* path was overlooked. Keyed by both the property name and its column name,
-* since a row can arrive keyed either way depending on the caller.
-*/
-function stripExcluded(row, collection) {
-	const properties = collection.properties;
-	if (!properties) return row;
-	for (const [key, property] of Object.entries(properties)) {
-		if (!property?.excludeFromApi) continue;
-		delete row[key];
-		if (property.columnName) delete row[property.columnName];
-	}
-	return row;
-}
 function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
+	if (style === "inline") return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
 	const address = relationTargetAddress(targetRow, targetCollection, registry);
 	const path = targetCollection.slug;
 	return createRelationRefWithData(address, path, {
@@ -6586,7 +6529,7 @@ function toCmsRow(row, collection, registry) {
 			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
 		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return stripExcluded(normalized, collection);
+	return normalized;
 }
 /**
 * The row REST serves: every column under its own name, with the value Postgres
@@ -6611,7 +6554,7 @@ function toRestRow(row, collection, registry) {
 		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
 		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
 	}
-	return stripExcluded(flat, collection);
+	return flat;
 }
 //#endregion
 //#region src/services/FetchService.ts
@@ -9253,7 +9196,6 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
-		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -20814,22 +20756,14 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		for (const columnDef of [
-			"display_name VARCHAR(255)",
-			"photo_url VARCHAR(500)",
-			"roles TEXT[] DEFAULT '{}' NOT NULL",
-			"password_hash VARCHAR(255)",
-			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
-			"email_verification_token VARCHAR(255)",
-			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
-			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
-			"metadata JSONB DEFAULT '{}' NOT NULL",
-			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
-			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
-		]) await db.execute(sql`
-                ALTER TABLE ${sql.raw(usersTableName)}
-                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
-            `);
+		await db.execute(sql`
+            ALTER TABLE ${sql.raw(usersTableName)}
+            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
+        `);
+		await db.execute(sql`
+            ALTER TABLE ${sql.raw(usersTableName)}
+            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
+        `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20900,34 +20834,6 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
-		try {
-			const authTablePairs = [
-				[usersSchema, resolvedTable],
-				[authSchema, "user_identities"],
-				[authSchema, "refresh_tokens"],
-				[authSchema, "password_reset_tokens"],
-				[authSchema, "app_config"],
-				[authSchema, "mfa_factors"],
-				[authSchema, "mfa_challenges"],
-				[authSchema, "recovery_codes"]
-			];
-			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
-                    SELECT 1
-                    FROM pg_class c
-                    JOIN pg_namespace n ON n.oid = c.relnamespace
-                    WHERE n.nspname = ${schemaName}
-                      AND c.relname = ${tableName}
-                      AND c.relforcerowsecurity
-                `)).rows.length > 0) {
-				await db.execute(sql`
-                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
-                        NO FORCE ROW LEVEL SECURITY
-                    `);
-				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
-			}
-		} catch (rlsReconcileError) {
-			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
-		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20975,31 +20881,6 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
-	/**
-	* Run a privileged auth write with an explicitly cleared RLS context.
-	*
-	* The auth services run on the base/owner connection, which by design
-	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
-	* in the default policies applies. That NULL is normally guaranteed by
-	* `set_config(..., is_local = true)` resetting at transaction end — but a
-	* GUC that survives on a pooled connection (or a connection role that
-	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
-	* turns the trusted write into an RLS-scoped one and denies it with
-	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
-	* single chokepoint, makes the server context deterministic instead of
-	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
-	* NULL via NULLIF, so '' is the server context.
-	*/
-	async withServerContext(fn) {
-		return await this.db.transaction(async (tx) => {
-			await tx.execute(sql`
-                SELECT set_config('app.user_id', '', true),
-                       set_config('app.user_roles', '', true),
-                       set_config('app.jwt', '', true)
-            `);
-			return await fn(tx);
-		});
-	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -21097,7 +20978,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
+		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -21136,12 +21017,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
+		await this.db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -21149,13 +21030,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
+		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
+		await this.db.delete(this.usersTable).where(eq(idCol, id));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -21209,10 +21090,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Set email verification status
@@ -21223,11 +21104,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Set email verification token
@@ -21238,11 +21119,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.withServerContext(async (db) => db.update(this.usersTable).set({
+		await this.db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id)));
+		}).where(eq(idCol, id));
 	}
 	/**
 	* Find user by email verification token
@@ -21287,22 +21168,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.withServerContext(async (db) => db.execute(sql`
+		await this.db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `));
+        `);
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.withServerContext(async (db) => db.execute(sql`
+		await this.db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `));
+        `);
 	}
 	/**
 	* Get user with their roles
@@ -22952,6 +22833,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map