@rebasepro/server-postgres 0.9.1-canary.f0ac103 → 0.9.1-canary.fd3754b

package/src/cli-helpers.ts

@@ -1,11 +1,29 @@
 import path from "path";
 import fs from "fs";
 import { execSync } from "child_process";
-import { pathToFileURL } from "url";
+import { fileURLToPath, pathToFileURL } from "url";
 import chalk from "chalk";
 import { logger } from "@rebasepro/server";
 import type { CollectionConfig, Relation } from "@rebasepro/types";
-import { moduleDir as __helpersDirname } from "./module-dir";
+
+const getHelpersDirname = () => {
+    try {
+        return eval("__dirname");
+    } catch {
+        const err = new Error();
+        const stackLine = err.stack?.split("\n")[1] || "";
+        const match = stackLine.match(/\((.*?):\d+:\d+\)/) || stackLine.match(/at (.*?):\d+:\d+/);
+        if (match && match[1]) {
+            let cleanPath = match[1];
+            if (cleanPath.startsWith("file://")) {
+                cleanPath = fileURLToPath(cleanPath);
+            }
+            return path.dirname(cleanPath);
+        }
+        return process.cwd();
+    }
+};
+const __helpersDirname = getHelpersDirname();
 
 
 

package/src/connection.ts

@@ -27,68 +27,11 @@ const DEFAULT_POOL: Required<PostgresPoolConfig> = {
     max: 20,
     idleTimeoutMillis: 30_000,
     connectionTimeoutMillis: 10_000,
-    // The client-side read timeout MUST be comfortably above the server-side
-    // statement_timeout. When the client timer fires first, node-postgres
-    // abandons the in-flight statement but keeps the connection — inside a
-    // transaction that leaves the tx open (and any pending ROLLBACK is
-    // spliced out of the client queue before it ever reaches the wire), so
-    // the pooled connection is returned still in-transaction with its RLS
-    // GUCs set. The server abort (SQLSTATE 57014) is the clean path; the
-    // client timeout is only a backstop for a dead network.
-    queryTimeout: 60_000,
+    queryTimeout: 30_000,
     statementTimeout: 30_000,
     keepAlive: true
 };
 
-/** ReadyForQuery status byte: `I` idle, `T` in transaction, `E` failed transaction. */
-const TX_IDLE = "I";
-
-/**
- * Destroy pool clients that are released while still inside a transaction.
- *
- * pg-pool returns a client to the idle list whenever `release()` is called
- * without an error — even if the connection is still mid-transaction (status
- * `T`/`E`). That happens in practice: drizzle's pool transaction releases in
- * a `finally` after attempting ROLLBACK, and if the ROLLBACK itself fails
- * (e.g. it was queued behind a statement that hit the client-side
- * query_timeout), the client goes back dirty. The next checkout then runs
- * its statements inside the zombie transaction — with the previous request's
- * `app.*` RLS GUCs still applied, which turns unrelated queries into
- * RLS-scoped ones (observed in production as registration failing with
- * SQLSTATE 42501 under a leaked anonymous context).
- *
- * pg-pool emits `release` before it consults its private `_expired` set, so
- * marking the client expired here makes `_release()` destroy it instead of
- * pooling it. Both `client._txStatus` (pg ≥ 8.16) and `pool._expired` are
- * private APIs — feature-detect and fall back to loud logging so an upstream
- * change degrades to observability, never to silent corruption.
- */
-export function guardPoolAgainstDirtyRelease(pool: Pool, label: string): void {
-    pool.on("release", (err: Error | undefined, client: unknown) => {
-        if (err) return; // errored clients are already destroyed by pg-pool
-        const txStatus = (client as { _txStatus?: string | null })?._txStatus;
-        if (typeof txStatus !== "string" || txStatus === TX_IDLE) return;
-
-        // pg-pool keeps expired clients in a WeakSet (a plain object works too
-        // if upstream ever changes it — duck-type on add/has).
-        const expired = (pool as unknown as { _expired?: { add(c: object): unknown; has(c: object): boolean } })._expired;
-        if (expired && typeof expired.add === "function" && typeof expired.has === "function" && client && typeof client === "object") {
-            expired.add(client);
-            logger.error(
-                `[${label}] Client released back to the pool while still in a transaction ` +
-                `(status '${txStatus}') — destroying it so the open transaction and its ` +
-                `session state (RLS GUCs) cannot leak into the next request.`
-            );
-        } else {
-            logger.error(
-                `[${label}] Client released mid-transaction (status '${txStatus}') but the ` +
-                `pool's internal expiry set is unavailable (pg-pool internals changed?). ` +
-                `The connection may leak its open transaction into subsequent requests.`
-            );
-        }
-    });
-}
-
 /**
  * Create a Drizzle-backed Postgres connection with a production-grade
  * connection pool.
@@ -132,7 +75,6 @@ export function createPostgresDatabaseConnection(
             logger.warn("[pg-pool] Connection timeout detected — pool will auto-retry");
         }
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-pool");
 
     // Create drizzle instance — pass schema when available to enable db.query relational API
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
@@ -176,7 +118,6 @@ export function createDirectDatabaseConnection(
     pool.on("error", (err) => {
         logger.error("[pg-direct-pool] Unexpected pool error", { detail: err.message });
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-direct-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 
@@ -216,7 +157,6 @@ export function createReadReplicaConnection(
     pool.on("error", (err) => {
         logger.error("[pg-replica-pool] Unexpected pool error", { detail: err.message });
     });
-    guardPoolAgainstDirtyRelease(pool, "pg-replica-pool");
 
     const db = schema ? drizzle(pool, { schema }) : drizzle(pool);
 

package/src/data-transformer.ts

@@ -20,19 +20,12 @@ import { logger } from "@rebasepro/server";
 export interface SerializedEntityData {
     /** Scalar column values ready for INSERT/UPDATE. */
     scalarData: Record<string, unknown>;
-    /**
-     * Inverse relation updates that must be applied to target tables.
-     *
-     * No address here: the row being written does not know its own. These are
-     * applied by `PersistService`, which addresses them with the id it holds —
-     * the one it was given for an update, or the one the INSERT returned — and
-     * that is the authority. This item used to carry a `currentId` derived from
-     * the *input* values, which nothing ever read.
-     */
+    /** Inverse relation updates that must be applied to target tables. */
     inverseRelationUpdates: Array<{
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }>;
     /** JoinPath relation updates that require multi-hop writes. */
     joinPathRelationUpdates: Array<{
@@ -112,6 +105,7 @@ joinPathRelationUpdates: [] };
         relationKey: string;
         relation: Relation;
         newValue: unknown;
+        currentId?: string | number;
     }> = [];
     const joinPathRelationUpdates: Array<{
         relationKey: string;
@@ -152,10 +146,12 @@ joinPathRelationUpdates: [] };
                 } else if (relation.direction === "inverse" && relation.foreignKeyOnTarget) {
                     // Inverse relation: Need to update the target table's FK
                     const serializedValue = serializePropertyToServer(effectiveValue, property);
+                    const pks = getPrimaryKeys(collection, registry!);
                     inverseRelationUpdates.push({
                         relationKey: key,
                         relation,
-                        newValue: serializedValue
+                        newValue: serializedValue,
+                        currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                     });
                     // Don't add the original relation property to the result
                     continue;
@@ -174,10 +170,12 @@ joinPathRelationUpdates: [] };
                         });
                     } else {
                         // Many inverse joinPath: capture as inverse relation update
+                        const pks = getPrimaryKeys(collection, registry!);
                         inverseRelationUpdates.push({
                             relationKey: key,
                             relation,
-                            newValue: serializedValue
+                            newValue: serializedValue,
+                            currentId: (row.id as string | number | undefined) || buildCompositeId(row, pks)
                         });
                     }
                     // Don't add the original relation property to the result

package/src/databasePoolManager.ts

@@ -2,7 +2,6 @@ import { Pool } from "pg";
 import { drizzle } from "drizzle-orm/node-postgres";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { logger } from "@rebasepro/server";
-import { guardPoolAgainstDirtyRelease } from "./connection";
 
 export class DatabasePoolManager {
     private pools: Map<string, Pool> = new Map();
@@ -51,7 +50,6 @@ export class DatabasePoolManager {
         pool.on("error", (err) => {
             logger.error(`[DatabasePoolManager] Unexpected error on idle client for db ${databaseName}`, { error: err });
         });
-        guardPoolAgainstDirtyRelease(pool, `pg-pool:${databaseName}`);
 
         this.pools.set(databaseName, pool);
         return pool;

package/src/schema/auth-default-policies.ts

@@ -0,0 +1,125 @@
+import { CollectionConfig, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollectionConfig, policy } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+
+/**
+ * Default RLS policies injected by the schema generator.
+ *
+ * Rebase's enforcement model is unified: authenticated (user-context) requests
+ * run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+ * statement — reads and writes. A collection's `securityRules` are the whole
+ * authorization model. The server context (auth flows, migrations,
+ * `dataAsAdmin`) runs as the owner and bypasses RLS.
+ *
+ * Because RLS default-denies, every collection is **locked by default**: with
+ * no rules, only the server context and admins can touch it. The generator
+ * injects that safe baseline:
+ *
+ * **For every collection**
+ *  1. A permissive **server-or-admin SELECT** grant.
+ *  2. A permissive **server-or-admin write** grant (insert/update/delete).
+ *
+ * Author `securityRules` are permissive and OR together, so explicit rules only
+ * *broaden* access from this locked baseline (e.g. "users read/write their own
+ * rows").
+ *
+ * **For auth collections additionally**
+ *  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+ *     their own row (profile, session bootstrap) without every app re-declaring
+ *     it.
+ *  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+ *     every other policy, so a write is rejected unless the caller is an admin
+ *     (or the server context) — even if the author also wrote a permissive rule
+ *     such as "a user may edit their own row". Without this, a permissive owner
+ *     rule would let a user change their own `roles`.
+ *
+ * The server context is recognised as `auth.uid() IS NULL` — the built-in flows
+ * that run without a user (signup, migrations) set no user GUC — which also
+ * lets the owner connection satisfy these policies even under FORCE RLS.
+ *
+ * Opt out with `disableDefaultPolicies: true` to take full responsibility for
+ * the collection's RLS.
+ */
+// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
+// exactly — the framework's most security-critical policies must be reflected
+// precisely, not left as un-evaluable raw clauses. Compiles to
+// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+const SERVER_OR_ADMIN_EXPR: PolicyExpression = policy.or(
+    policy.not(policy.authenticated()),
+    policy.rolesOverlap(["admin"])
+);
+
+/** Write operations that must be admin-gated by default on auth collections. */
+const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
+
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection: CollectionConfig): boolean {
+    const auth = collection.auth;
+    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
+}
+
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection: CollectionConfig): string {
+    for (const [name, prop] of Object.entries(collection.properties ?? {})) {
+        if (prop && typeof prop === "object" && "isId" in prop && (prop as { isId?: unknown }).isId) {
+            return name;
+        }
+    }
+    return "id";
+}
+
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules` plus the framework defaults described in
+ * the module doc (baseline server/admin read for all collections; self-read
+ * and the admin write gate for auth collections).
+ *
+ * Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+ */
+export function getEffectiveSecurityRules(collection: CollectionConfig): SecurityRule[] {
+    const explicit = [...((isPostgresCollectionConfig(collection) ? collection.securityRules : undefined) ?? [])];
+
+    if (collection.disableDefaultPolicies) {
+        return explicit;
+    }
+
+    const tableName = getTableName(collection);
+    const injected: SecurityRule[] = [];
+
+    // Baseline read + write: the server context and admins can always operate.
+    // RLS default-denies under the user role, so without these a rule-less
+    // collection would be locked to everyone — including the admin studio.
+    // Author rules are permissive and broaden access from here.
+    injected.push({
+        name: `${tableName}_default_admin_read`,
+        operations: ["select"],
+        condition: SERVER_OR_ADMIN_EXPR
+    });
+    injected.push({
+        name: `${tableName}_default_admin_write`,
+        operations: [...DEFAULT_GUARDED_OPS],
+        condition: SERVER_OR_ADMIN_EXPR,
+        check: SERVER_OR_ADMIN_EXPR
+    });
+
+    if (isAuthCollection(collection)) {
+        // Self-read: a user can always read their own row.
+        injected.push({
+            name: `${tableName}_default_self_read`,
+            operations: ["select"],
+            condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+        });
+
+        // Restrictive gate: AND'd with all other policies, so no permissive rule
+        // (e.g. an owner "edit your own row" rule) can let a non-admin change
+        // privileged columns like `roles`.
+        injected.push({
+            name: `${tableName}_require_admin_write`,
+            mode: "restrictive",
+            operations: [...DEFAULT_GUARDED_OPS],
+            condition: SERVER_OR_ADMIN_EXPR,
+            check: SERVER_OR_ADMIN_EXPR
+        });
+    }
+
+    return [...explicit, ...injected];
+}

package/src/schema/doctor-cli.ts

@@ -8,7 +8,7 @@ import chalk from "chalk";
 import fs from "fs";
 import { runDoctor, loadCollections } from "./doctor";
 import { checkPolicyDrift, formatPolicyDrift, hasDrift } from "../security/policy-drift";
-import { validatePolicyPgRoles, warnOnAnonymousGrants } from "../security/rls-enforcement";
+import { validatePolicyPgRoles } from "../security/rls-enforcement";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -41,10 +41,6 @@ async function runPolicyChecks(collectionsPath: string, databaseUrl?: string): P
             logger.error(chalk.red(err instanceof Error ? err.message : String(err)));
         }
 
-        // A rule that reads as a lockdown but is true for every caller compiles
-        // to a grant. Report it without booting a server.
-        warnOnAnonymousGrants(collections as never);
-
         const drift = await checkPolicyDrift(pool as never, collections);
         logger.info("");
         if (hasDrift(drift)) {

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,8 +1,10 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
 import { logger } from "@rebasepro/server";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -313,6 +315,22 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -333,11 +351,15 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 
@@ -545,10 +567,6 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -605,22 +623,9 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ([\n";
-            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
-
-            // Junctions are generated tables like any other: locked by default,
-            // with derived policies (reads follow the endpoints, writes follow
-            // the declaring side's update rules). RLS is enabled regardless of
-            // policy stripping — a bare junction must default-deny, not fail open.
-            const junctionSpec = junctionSpecs.get(baseTableName);
-            if (!stripPolicies && junctionSpec) {
-                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
-                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
-                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
-                });
-            }
-            schemaContent += "])).enableRLS();\n\n";
+            schemaContent += "}, (table) => ({\n";
+            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
+            schemaContent += "}));\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,6 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 
 // --- Helper Functions ---
 
@@ -42,6 +44,22 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -51,10 +69,14 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 
@@ -226,10 +248,6 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -265,11 +283,6 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
-    // Policies are emitted after every CREATE TABLE, like the FK constraints:
-    // a policy may reference other tables (a junction's derived policies always
-    // reference both endpoints; `policy.existsIn` references a join table), and
-    // CREATE POLICY validates those relations at creation time.
-    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -302,25 +315,6 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-
-            if (options.includePolicies) {
-                // Junction tables are generated tables like any other: locked by
-                // default, with derived policies — reads follow the endpoints'
-                // visibility, writes follow the declaring side's update rules.
-                // Without this they were the one kind of generated table with no
-                // RLS at all, readable and writable by every signed-in user.
-                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-                ddl += `\n`;
-
-                const spec = junctionSpecs.get(baseTableName);
-                if (spec) {
-                    const junctionCollection = getJunctionCollectionConfig(spec);
-                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-                    });
-                }
-            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -442,8 +436,9 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
                     });
+                    ddl += "\n";
                 }
             }
         }
@@ -454,12 +449,6 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
-    if (policyStatements.length > 0) {
-        ddl += "-- Row Level Security Policies\n";
-        ddl += policyStatements.join("");
-        ddl += "\n";
-    }
-
     return ddl;
 };
 
@@ -489,50 +478,13 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
-
             securityRules.forEach((rule: SecurityRule) => {
-                // Say which policies the author did not write. They are permissive,
-                // so they OR with the declared rules and widen the final ACL beyond
-                // what `securityRules` reads like — and re-appear after any manual
-                // DROP, because a push asserts the declared state.
-                if (rule.name && injectedNames.has(rule.name)) {
-                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
-                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
-                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";
         }
     }
 
-    // Junction tables are generated from `through` relations, not declared as
-    // collections, so the walk above never sees them. They get the same
-    // treatment as any generated table: locked by default, with derived
-    // policies — reads follow the endpoints, writes follow the declaring
-    // side's update rules.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-    for (const spec of junctionSpecs.values()) {
-        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-        ddl += `\n`;
-
-        const junctionRules = getJunctionSecurityRules(spec);
-        if (junctionRules.length === 0) continue;
-
-        const junctionCollection = getJunctionCollectionConfig(spec);
-        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
-
-        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-        junctionRules.forEach((rule: SecurityRule) => {
-            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-        });
-        ddl += "\n";
-    }
-
     return ddl;
 };
 

package/src/schema/introspect-db.ts

@@ -30,7 +30,6 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
-            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -167,14 +166,8 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--no-data-inference"]) {
-            runDataInference = false;
-        } else if (args["--data-inference"] !== undefined) {
+        if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
-        } else if (!process.stdin.isTTY) {
-            // No terminal to answer the question below (scaffolding scripts, CI,
-            // `rebase init --introspect`) — asking would hang forever.
-            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -243,17 +236,7 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                // --force replaces collections derived from the database, but the
-                // directory can also hold hand-written ones with no table in the
-                // introspected schema (the auth users collection lives in
-                // "rebase"). The backend discovers the whole directory, so an
-                // index listing only introspected tables would silently drop them
-                // from the admin UI while the API still served them.
-                const siblings = fs.readdirSync(outDir)
-                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
-                    .map(f => f.replace(/\.ts$/, ""));
-                const allFiles = [...new Set([...generatedFiles, ...siblings])];
-                const indexContent = generateIndexContent(allFiles);
+                const indexContent = generateIndexContent(generatedFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));