@rebasepro/server-postgres 0.9.1-canary.d906fb7 → 0.9.1-canary.e3f810f

package/dist/auth/services.d.ts

@@ -19,6 +19,22 @@ export declare class UserService implements UserRepository {
     private userIdentitiesTable;
     constructor(db: NodePgDatabase, tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>);
     private getQualifiedUsersTableName;
+    /**
+     * Run a privileged auth write with an explicitly cleared RLS context.
+     *
+     * The auth services run on the base/owner connection, which by design
+     * carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+     * in the default policies applies. That NULL is normally guaranteed by
+     * `set_config(..., is_local = true)` resetting at transaction end — but a
+     * GUC that survives on a pooled connection (or a connection role that
+     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+     * turns the trusted write into an RLS-scoped one and denies it with
+     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+     * single chokepoint, makes the server context deterministic instead of
+     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
+     * NULL via NULLIF, so '' is the server context.
+     */
+    private withServerContext;
     private mapRowToUser;
     private mapPayload;
     createUser(data: CreateUserData): Promise<UserData>;

package/dist/connection.d.ts

@@ -19,6 +19,27 @@ export interface PostgresPoolConfig {
     /** Enable TCP keep-alive (default: true) */
     keepAlive?: boolean;
 }
+/**
+ * Destroy pool clients that are released while still inside a transaction.
+ *
+ * pg-pool returns a client to the idle list whenever `release()` is called
+ * without an error — even if the connection is still mid-transaction (status
+ * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+ * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+ * (e.g. it was queued behind a statement that hit the client-side
+ * query_timeout), the client goes back dirty. The next checkout then runs
+ * its statements inside the zombie transaction — with the previous request's
+ * `app.*` RLS GUCs still applied, which turns unrelated queries into
+ * RLS-scoped ones (observed in production as registration failing with
+ * SQLSTATE 42501 under a leaked anonymous context).
+ *
+ * pg-pool emits `release` before it consults its private `_expired` set, so
+ * marking the client expired here makes `_release()` destroy it instead of
+ * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+ * private APIs — feature-detect and fall back to loud logging so an upstream
+ * change degrades to observability, never to silent corruption.
+ */
+export declare function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void;
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.

package/dist/index.es.js

@@ -71,16 +71,51 @@ var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require
 var connection_exports = /* @__PURE__ */ __exportAll({
 	createDirectDatabaseConnection: () => createDirectDatabaseConnection,
 	createPostgresDatabaseConnection: () => createPostgresDatabaseConnection,
-	createReadReplicaConnection: () => createReadReplicaConnection
+	createReadReplicaConnection: () => createReadReplicaConnection,
+	guardPoolAgainstDirtyRelease: () => guardPoolAgainstDirtyRelease
 });
 var DEFAULT_POOL = {
 	max: 20,
 	idleTimeoutMillis: 3e4,
 	connectionTimeoutMillis: 1e4,
-	queryTimeout: 3e4,
+	queryTimeout: 6e4,
 	statementTimeout: 3e4,
 	keepAlive: true
 };
+/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
+var TX_IDLE = "I";
+/**
+* Destroy pool clients that are released while still inside a transaction.
+*
+* pg-pool returns a client to the idle list whenever `release()` is called
+* without an error — even if the connection is still mid-transaction (status
+* `T`/`E`). That happens in practice: drizzle's pool transaction releases in
+* a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
+* (e.g. it was queued behind a statement that hit the client-side
+* query_timeout), the client goes back dirty. The next checkout then runs
+* its statements inside the zombie transaction — with the previous request's
+* `app.*` RLS GUCs still applied, which turns unrelated queries into
+* RLS-scoped ones (observed in production as registration failing with
+* SQLSTATE 42501 under a leaked anonymous context).
+*
+* pg-pool emits `release` before it consults its private `_expired` set, so
+* marking the client expired here makes `_release()` destroy it instead of
+* pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
+* private APIs — feature-detect and fall back to loud logging so an upstream
+* change degrades to observability, never to silent corruption.
+*/
+function guardPoolAgainstDirtyRelease(pool, label) {
+	pool.on("release", (err, client) => {
+		if (err) return;
+		const txStatus = client?._txStatus;
+		if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
+		const expired = pool._expired;
+		if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
+			expired.add(client);
+			logger.error(`[${label}] Client released back to the pool while still in a transaction (status '${txStatus}') — destroying it so the open transaction and its session state (RLS GUCs) cannot leak into the next request.`);
+		} else logger.error(`[${label}] Client released mid-transaction (status '${txStatus}') but the pool's internal expiry set is unavailable (pg-pool internals changed?). The connection may leak its open transaction into subsequent requests.`);
+	});
+}
 /**
 * Create a Drizzle-backed Postgres connection with a production-grade
 * connection pool.
@@ -112,6 +147,7 @@ function createPostgresDatabaseConnection(connectionString, schema, poolConfig)
 		logger.error("[pg-pool] Unexpected pool error", { detail: err.message });
 		if (err.message.includes("ETIMEDOUT")) logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -144,6 +180,7 @@ function createDirectDatabaseConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -173,6 +210,7 @@ function createReadReplicaConnection(connectionString, schema, poolConfig) {
 	pool.on("error", (err) => {
 		logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
 	});
+	guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 	return {
 		db: schema ? drizzle(pool, { schema }) : drizzle(pool),
 		pool,
@@ -6486,8 +6524,27 @@ function coerceDeclaredNumbers(row, collection) {
 	return out;
 }
 /** Render one target row in the requested style. */
+/**
+* Drop every column the collection marked `excludeFromApi`.
+*
+* Password hashes and verification tokens have to be readable server-side but
+* must never reach a client — and "never" has to mean every exit from this
+* pipeline, including relation targets, or a secret leaks through whichever
+* path was overlooked. Keyed by both the property name and its column name,
+* since a row can arrive keyed either way depending on the caller.
+*/
+function stripExcluded(row, collection) {
+	const properties = collection.properties;
+	if (!properties) return row;
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		delete row[key];
+		if (property.columnName) delete row[property.columnName];
+	}
+	return row;
+}
 function renderTarget(targetRow, targetCollection, style, registry) {
-	if (style === "inline") return coerceDeclaredNumbers({ ...targetRow }, targetCollection);
+	if (style === "inline") return stripExcluded(coerceDeclaredNumbers({ ...targetRow }, targetCollection), targetCollection);
 	const address = relationTargetAddress(targetRow, targetCollection, registry);
 	const path = targetCollection.slug;
 	return createRelationRefWithData(address, path, {
@@ -6529,7 +6586,7 @@ function toCmsRow(row, collection, registry) {
 			normalized[key] = relData.map((item) => renderTarget(isJunctionRelation(relation) ? unwrapJunctionRow(item) : item, targetCollection, "ref", registry));
 		} else if (relation.cardinality === "one" && typeof relData === "object" && !Array.isArray(relData)) normalized[key] = renderTarget(relData, relation.target(), "ref", registry);
 	}
-	return normalized;
+	return stripExcluded(normalized, collection);
 }
 /**
 * The row REST serves: every column under its own name, with the value Postgres
@@ -6554,7 +6611,7 @@ function toRestRow(row, collection, registry) {
 		else if (relation && typeof value === "object" && value !== null) flat[key] = renderTarget(value, relation.target(), "inline", registry);
 		else flat[key] = coerceDeclaredNumber(value, collection.properties?.[key]);
 	}
-	return flat;
+	return stripExcluded(flat, collection);
 }
 //#endregion
 //#region src/services/FetchService.ts
@@ -9196,6 +9253,7 @@ var DatabasePoolManager = class {
 		pool.on("error", (err) => {
 			logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
 		});
+		guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 		this.pools.set(databaseName, pool);
 		return pool;
 	}
@@ -20756,14 +20814,22 @@ async function ensureAuthTablesExist(db, collection) {
                 $$ LANGUAGE sql STABLE
             `);
 		});
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-		await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+		for (const columnDef of [
+			"display_name VARCHAR(255)",
+			"photo_url VARCHAR(500)",
+			"roles TEXT[] DEFAULT '{}' NOT NULL",
+			"password_hash VARCHAR(255)",
+			"email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+			"email_verification_token VARCHAR(255)",
+			"email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+			"is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+			"metadata JSONB DEFAULT '{}' NOT NULL",
+			"created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+			"updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+		]) await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
 		try {
 			if ((await db.execute(sql`
                 SELECT EXISTS (
@@ -20834,6 +20900,34 @@ async function ensureAuthTablesExist(db, collection) {
             CREATE INDEX IF NOT EXISTS idx_recovery_codes_user
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
+		try {
+			const authTablePairs = [
+				[usersSchema, resolvedTable],
+				[authSchema, "user_identities"],
+				[authSchema, "refresh_tokens"],
+				[authSchema, "password_reset_tokens"],
+				[authSchema, "app_config"],
+				[authSchema, "mfa_factors"],
+				[authSchema, "mfa_challenges"],
+				[authSchema, "recovery_codes"]
+			];
+			for (const [schemaName, tableName] of authTablePairs) if ((await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `)).rows.length > 0) {
+				await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+				logger.warn(`🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" (legacy RLS model — it binds the owner connection and breaks privileged auth writes)`);
+			}
+		} catch (rlsReconcileError) {
+			logger.warn(`⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`);
+		}
 		logger.info("✅ Auth tables ready");
 	} catch (error) {
 		logger.error("❌ Failed to create auth tables", { error });
@@ -20881,6 +20975,31 @@ var UserService = class {
 		const name = getTableName(this.usersTable);
 		return `"${getTableConfig(this.usersTable).schema || "public"}"."${name}"`;
 	}
+	/**
+	* Run a privileged auth write with an explicitly cleared RLS context.
+	*
+	* The auth services run on the base/owner connection, which by design
+	* carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+	* in the default policies applies. That NULL is normally guaranteed by
+	* `set_config(..., is_local = true)` resetting at transaction end — but a
+	* GUC that survives on a pooled connection (or a connection role that
+	* doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+	* turns the trusted write into an RLS-scoped one and denies it with
+	* SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+	* single chokepoint, makes the server context deterministic instead of
+	* trusting whatever state the pool hands us. `auth.uid()` reads '' as
+	* NULL via NULLIF, so '' is the server context.
+	*/
+	async withServerContext(fn) {
+		return await this.db.transaction(async (tx) => {
+			await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+			return await fn(tx);
+		});
+	}
 	mapRowToUser(row) {
 		if (!row) return row;
 		const id = row.id ?? row.uid;
@@ -20978,7 +21097,7 @@ var UserService = class {
 	}
 	async createUser(data) {
 		const payload = this.mapPayload(data);
-		const [row] = await this.db.insert(this.usersTable).values(payload).returning();
+		const [row] = await this.withServerContext(async (db) => await db.insert(this.usersTable).values(payload).returning());
 		return this.mapRowToUser(row);
 	}
 	async getUserById(id) {
@@ -21017,12 +21136,12 @@ var UserService = class {
 		}));
 	}
 	async linkUserIdentity(userId, provider, providerId, profileData) {
-		await this.db.insert(this.userIdentitiesTable).values({
+		await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
 			userId,
 			provider,
 			providerId,
 			profileData: profileData || null
-		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+		}).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
 	}
 	async updateUser(id, data) {
 		const idCol = getColumn(this.usersTable, "id");
@@ -21030,13 +21149,13 @@ var UserService = class {
 		const payload = this.mapPayload(data);
 		const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 		payload[updatedAtKey] = /* @__PURE__ */ new Date();
-		const [row] = await this.db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning();
+		const [row] = await this.withServerContext(async (db) => await db.update(this.usersTable).set(payload).where(eq(idCol, id)).returning());
 		return row ? this.mapRowToUser(row) : null;
 	}
 	async deleteUser(id) {
 		const idCol = getColumn(this.usersTable, "id");
 		if (!idCol) return;
-		await this.db.delete(this.usersTable).where(eq(idCol, id));
+		await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
 	}
 	async listUsers() {
 		return (await this.db.select().from(this.usersTable)).map((row) => this.mapRowToUser(row));
@@ -21090,10 +21209,10 @@ var UserService = class {
 		if (!idCol) return;
 		const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[passwordHashColKey]: passwordHash,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification status
@@ -21104,11 +21223,11 @@ var UserService = class {
 		const emailVerifiedColKey = getColumnKey(this.usersTable, "emailVerified", "email_verified") || "emailVerified";
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerifiedColKey]: verified,
 			[emailVerificationTokenColKey]: null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Set email verification token
@@ -21119,11 +21238,11 @@ var UserService = class {
 		const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
 		const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
 		const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
-		await this.db.update(this.usersTable).set({
+		await this.withServerContext(async (db) => db.update(this.usersTable).set({
 			[emailVerificationTokenColKey]: token,
 			[emailVerificationSentAtColKey]: token ? /* @__PURE__ */ new Date() : null,
 			[updatedAtColKey]: /* @__PURE__ */ new Date()
-		}).where(eq(idCol, id));
+		}).where(eq(idCol, id)));
 	}
 	/**
 	* Find user by email verification token
@@ -21168,22 +21287,22 @@ var UserService = class {
 	async setUserRoles(userId, roleIds) {
 		const usersTableName = this.getQualifiedUsersTableName();
 		const rolesArray = `{${roleIds.join(",")}}`;
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
 	}
 	/**
 	* Assign a specific role to new user (appends if not present)
 	*/
 	async assignDefaultRole(userId, roleId) {
 		const usersTableName = this.getQualifiedUsersTableName();
-		await this.db.execute(sql`
+		await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
 	}
 	/**
 	* Get user with their roles
@@ -22833,6 +22952,6 @@ function createPostgresAdapter(pgConfig) {
 	};
 }
 //#endregion
-export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
+export { AuthenticatedPostgresBackendDriver, BackupToolError, BranchService, DatabasePoolManager, DrizzleConditionBuilder, PostgresBackendDriver, PostgresCollectionRegistry, PostgresConditionBuilder, PostgresRealtimeProvider, RealtimeService, appConfig, backupCronConfigFromEnv, buildBackupFilename, buildPgDumpArgs, buildPgRestoreArgs, checkToolServerCompatibility, createAuthSchema, createBackupCron, createDirectDatabaseConnection, createDump, createPostgresAdapter, createPostgresBootstrapper, createPostgresDatabaseConnection, createPostgresWebSocket, createReadReplicaConnection, detectToolMajor, ensureDatabaseExists, generateSchema, getServerVersionMajor, guardPoolAgainstDirtyRelease, joinStorageKey, listBackups, magicLinkTokens, magicLinkTokensRelations, mfaChallenges, mfaChallengesRelations, mfaFactors, mfaFactorsRelations, parseBackupDestination, parseBackupTimestamp, parseDbNameFromUrl, parsePgToolMajor, passwordResetTokens, passwordResetTokensRelations, preflight, pruneBackups, recoveryCodes, recoveryCodesRelations, refreshTokens, refreshTokensRelations, resolveConnectionString, resolvePgBinary, restoreDump, selectBackupsToPrune, serverVersionNumToMajor, uploadBackup, userIdentities, userIdentitiesRelations, users, usersRelations, usersSchema, withDatabaseName };
 
 //# sourceMappingURL=index.es.js.map