@rebasepro/server-postgres 0.9.1-canary.f2f61da → 0.9.1-canary.fd3754b

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,6 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
-import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
+import { toSnakeCase } from "@rebasepro/utils";
+import { createHash } from "crypto";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 
 // --- Helper Functions ---
 
@@ -42,6 +44,22 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
+const getPolicyNameHash = (rule: SecurityRule): string => {
+    const data = JSON.stringify({
+        a: rule.access,
+        m: rule.mode,
+        op: rule.operation,
+        ops: rule.operations?.slice().sort(),
+        own: rule.ownerField,
+        rol: rule.roles?.slice().sort(),
+        pg: rule.pgRoles?.slice().sort(),
+        u: rule.using,
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
+    });
+    return createHash("sha1").update(data).digest("hex").substring(0, 7);
+};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -51,10 +69,14 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const policyNames = getPolicyNamesForRule(rule, tableName);
+    const ruleHash = getPolicyNameHash(rule);
 
     return ops.map((op, opIdx) => {
-        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
+        const policyName = rule.name
+            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
+            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
+
+        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
     }).join("");
 };
 
@@ -226,10 +248,6 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
-    // Junction policy derivation needs every declaring side of each junction,
-    // not just the first relation that reached it in the walk below.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -265,11 +283,6 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
-    // Policies are emitted after every CREATE TABLE, like the FK constraints:
-    // a policy may reference other tables (a junction's derived policies always
-    // reference both endpoints; `policy.existsIn` references a join table), and
-    // CREATE POLICY validates those relations at creation time.
-    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -302,25 +315,6 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
-
-            if (options.includePolicies) {
-                // Junction tables are generated tables like any other: locked by
-                // default, with derived policies — reads follow the endpoints'
-                // visibility, writes follow the declaring side's update rules.
-                // Without this they were the one kind of generated table with no
-                // RLS at all, readable and writable by every signed-in user.
-                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
-                ddl += `\n`;
-
-                const spec = junctionSpecs.get(baseTableName);
-                if (spec) {
-                    const junctionCollection = getJunctionCollectionConfig(spec);
-                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
-                    });
-                }
-            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -442,8 +436,9 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
+                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
                     });
+                    ddl += "\n";
                 }
             }
         }
@@ -454,12 +449,6 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
-    if (policyStatements.length > 0) {
-        ddl += "-- Row Level Security Policies\n";
-        ddl += policyStatements.join("");
-        ddl += "\n";
-    }
-
     return ddl;
 };
 
@@ -489,50 +478,13 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
-
             securityRules.forEach((rule: SecurityRule) => {
-                // Say which policies the author did not write. They are permissive,
-                // so they OR with the declared rules and widen the final ACL beyond
-                // what `securityRules` reads like — and re-appear after any manual
-                // DROP, because a push asserts the declared state.
-                if (rule.name && injectedNames.has(rule.name)) {
-                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
-                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
-                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";
         }
     }
 
-    // Junction tables are generated from `through` relations, not declared as
-    // collections, so the walk above never sees them. They get the same
-    // treatment as any generated table: locked by default, with derived
-    // policies — reads follow the endpoints, writes follow the declaring
-    // side's update rules.
-    const junctionSpecs = resolveJunctionSpecs(collections);
-    for (const spec of junctionSpecs.values()) {
-        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
-        ddl += `\n`;
-
-        const junctionRules = getJunctionSecurityRules(spec);
-        if (junctionRules.length === 0) continue;
-
-        const junctionCollection = getJunctionCollectionConfig(spec);
-        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
-        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
-
-        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
-        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
-        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
-        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
-        junctionRules.forEach((rule: SecurityRule) => {
-            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
-        });
-        ddl += "\n";
-    }
-
     return ddl;
 };
 

package/src/schema/introspect-db.ts

@@ -30,7 +30,6 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
-            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -167,14 +166,8 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--no-data-inference"]) {
-            runDataInference = false;
-        } else if (args["--data-inference"] !== undefined) {
+        if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
-        } else if (!process.stdin.isTTY) {
-            // No terminal to answer the question below (scaffolding scripts, CI,
-            // `rebase init --introspect`) — asking would hang forever.
-            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -243,17 +236,7 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                // --force replaces collections derived from the database, but the
-                // directory can also hold hand-written ones with no table in the
-                // introspected schema (the auth users collection lives in
-                // "rebase"). The backend discovers the whole directory, so an
-                // index listing only introspected tables would silently drop them
-                // from the admin UI while the API still served them.
-                const siblings = fs.readdirSync(outDir)
-                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
-                    .map(f => f.replace(/\.ts$/, ""));
-                const allFiles = [...new Set([...generatedFiles, ...siblings])];
-                const indexContent = generateIndexContent(allFiles);
+                const indexContent = generateIndexContent(generatedFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type PolicyRef, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -23,17 +23,6 @@ function dbWith(rows: Record<string, unknown>[]): Queryable {
     return { query: async () => ({ rows: rows as never[] }) };
 }
 
-/** A pg_policies row matching an expected policy, clauses and all. */
-function liveRow(p: PolicyRef, overrides: Record<string, unknown> = {}) {
-    return {
-        schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command,
-        // Postgres rewrites the text it stores; only presence is compared.
-        qual: p.hasUsing ? "(rewritten by postgres)" : null,
-        with_check: p.hasWithCheck ? "(rewritten by postgres)" : null,
-        ...overrides
-    };
-}
-
 describe("parseExpectedPolicies", () => {
     it("reads the DDL that db push actually applies", () => {
         const ddl = generatePostgresPoliciesDdl([collection("authors")]);
@@ -49,8 +38,11 @@ describe("checkPolicyDrift", () => {
     it("reports nothing when the database matches the collections", async () => {
         const cols = [collection("authors")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => ({
+            schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command
+        }));
 
-        const drift = await checkPolicyDrift(dbWith(expected.map((p) => liveRow(p))), cols);
+        const drift = await checkPolicyDrift(dbWith(live), cols);
 
         expect(hasDrift(drift)).toBe(false);
         expect(formatPolicyDrift(drift)).toBe("");
@@ -70,8 +62,8 @@ describe("checkPolicyDrift", () => {
         const cols = [collection("customers")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
         const live = [
-            ...expected.map((p) => liveRow(p)),
-            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL", qual: "true", with_check: null }
+            ...expected.map((p) => ({ schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command })),
+            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL" }
         ];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
@@ -84,8 +76,11 @@ describe("checkPolicyDrift", () => {
     it("flags a policy whose roles were changed underneath it as diverged", async () => {
         const cols = [collection("orders")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        // Someone re-granted it to a role requests never run as.
-        const live = expected.map((p) => liveRow(p, { roles: ["authenticated"] }));
+        const live = expected.map((p) => ({
+            schemaname: p.schema, tablename: p.table, policyname: p.name,
+            // Someone re-granted it to a role requests never run as.
+            roles: ["authenticated"], cmd: p.command
+        }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -94,38 +89,9 @@ describe("checkPolicyDrift", () => {
         expect(formatPolicyDrift(drift)).toContain("Diverged");
     });
 
-    it("flags a policy whose expression the database is missing entirely", async () => {
-        // A real production database had jobs.public_read_published stored as
-        // SELECT / {public} / USING NULL: every field this used to compare
-        // matched, drift reported zero, and the policy denied 100% of reads.
-        const cols = [collection("jobs")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const select = expected.find((p) => p.command === "SELECT" && p.roles.includes("public"))!;
-        const live = expected.map((p) => (p === select ? liveRow(p, { qual: null }) : liveRow(p)));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-
-        expect(drift.diverged).toHaveLength(1);
-        expect(drift.diverged[0].differences.join(" ")).toContain("USING: expected an expression, database has none");
-    });
-
-    it("does not mistake an expression Postgres rewrote for a missing one", async () => {
-        // The reason expression text is not compared: what comes back out of
-        // pg_policies never matches what went in.
-        const cols = [collection("posts")];
-        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => liveRow(p, {
-            qual: p.hasUsing ? "((auth.uid() IS NOT NULL) AND ((auth.uid())::text <> 'anonymous'::text))" : null
-        }));
-
-        const drift = await checkPolicyDrift(dbWith(live), cols);
-
-        expect(hasDrift(drift)).toBe(false);
-    });
-
     it("parses roles when the driver returns the raw {a,b} text form", async () => {
         const cols = [collection("tags")];
-        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL", qual: "true", with_check: null }];
+        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL" }];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -138,7 +104,7 @@ describe("checkPolicyDrift", () => {
         // Note a collection with no securityRules is NOT this case — it still
         // generates default (admin-only) policies.
         const drift = await checkPolicyDrift(
-            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }]),
+            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL" }]),
             []
         );
 

package/src/security/policy-drift.ts

@@ -25,10 +25,6 @@ export interface PolicyRef {
     roles: string[];
     /** SELECT / INSERT / UPDATE / DELETE / ALL. */
     command: string;
-    /** Whether a USING clause is present at all (not what it says). */
-    hasUsing: boolean;
-    /** Whether a WITH CHECK clause is present at all (not what it says). */
-    hasWithCheck: boolean;
 }
 
 export interface PolicyDrift {
@@ -44,57 +40,18 @@ export interface Queryable {
     query<R>(text: string, values?: unknown[]): Promise<{ rows: R[] }>;
 }
 
-// The trailing group captures whichever clause follows the TO list, which is
-// what tells us the clause is present.
-const CREATE_POLICY = /CREATE POLICY "([^"]+)" ON "([^"]+)"\."([^"]+)"\s+AS (\w+)\s+FOR (\w+)\s+TO ([^\n]+?)(\s+USING\s*\(|\s+WITH CHECK\s*\(|;)/gi;
-
-const WITH_CHECK_NEXT = /^\s+WITH CHECK\s*\(/i;
-
-/**
- * Index just past the `)` closing a clause whose `(` ends at `open`.
- *
- * Needed because a policy expression nests parens and can contain a quoted
- * literal holding either character, so "find the next `)`" would stop early and
- * miss the `WITH CHECK` that follows.
- */
-function clauseEnd(ddl: string, open: number): number {
-    let depth = 1;
-    let inQuote = false;
-    for (let i = open; i < ddl.length; i++) {
-        const c = ddl[i];
-        if (inQuote) {
-            // '' is an escaped quote inside a string, not a close.
-            if (c === "'") {
-                if (ddl[i + 1] === "'") i++;
-                else inQuote = false;
-            }
-            continue;
-        }
-        if (c === "'") inQuote = true;
-        else if (c === "(") depth++;
-        else if (c === ")" && --depth === 0) return i + 1;
-    }
-    return ddl.length;
-}
+const CREATE_POLICY = /CREATE POLICY "([^"]+)" ON "([^"]+)"\."([^"]+)"\s+AS (\w+)\s+FOR (\w+)\s+TO ([^\n]+?)(?:\s+USING|\s+WITH CHECK|;)/gi;
 
 /** Parse the generated DDL rather than rebuilding the shape by hand. */
 export function parseExpectedPolicies(ddl: string): PolicyRef[] {
     const found: PolicyRef[] = [];
     for (const m of ddl.matchAll(CREATE_POLICY)) {
-        const [, name, schema, table, , command, rolesRaw, clause] = m;
+        const [, name, schema, table, , command, rolesRaw] = m;
         const roles = rolesRaw
             .split(",")
             .map((r) => r.trim().replace(/^"|"$/g, ""))
             .filter(Boolean);
-
-        // The generator emits USING before WITH CHECK, so what follows the TO
-        // list settles USING; WITH CHECK is then whatever follows that clause.
-        const hasUsing = /USING/i.test(clause);
-        const hasWithCheck = hasUsing
-            ? WITH_CHECK_NEXT.test(ddl.slice(clauseEnd(ddl, m.index + m[0].length)))
-            : /WITH CHECK/i.test(clause);
-
-        found.push({ schema, table, name, roles, command: command.toUpperCase(), hasUsing, hasWithCheck });
+        found.push({ schema, table, name, roles, command: command.toUpperCase() });
     }
     return found;
 }
@@ -102,9 +59,8 @@ export function parseExpectedPolicies(ddl: string): PolicyRef[] {
 async function readLivePolicies(client: Queryable, schemas: string[]): Promise<PolicyRef[]> {
     const { rows } = await client.query<{
         schemaname: string; tablename: string; policyname: string; roles: string[] | string; cmd: string;
-        qual: string | null; with_check: string | null;
     }>(
-        `SELECT schemaname, tablename, policyname, roles, cmd, qual, with_check
+        `SELECT schemaname, tablename, policyname, roles, cmd
          FROM pg_policies
          WHERE schemaname = ANY($1)`,
         [schemas]
@@ -118,11 +74,7 @@ async function readLivePolicies(client: Queryable, schemas: string[]): Promise<P
         roles: Array.isArray(r.roles)
             ? r.roles
             : String(r.roles ?? "").replace(/^\{|\}$/g, "").split(",").filter(Boolean),
-        command: (r.cmd ?? "ALL").toUpperCase(),
-        // Presence only. Postgres rewrites the text, but it does not invent or
-        // drop a clause: NULL here means the policy genuinely has none.
-        hasUsing: r.qual != null,
-        hasWithCheck: r.with_check != null
+        command: (r.cmd ?? "ALL").toUpperCase()
     }));
 }
 
@@ -133,18 +85,11 @@ const sameRoles = (a: string[], b: string[]) =>
 /**
  * Diff expected against live.
  *
- * Compares names, roles, command, and whether each clause exists — all exact
- * values. Policy expression *text* is deliberately not compared: Postgres
- * rewrites `qual`/`with_check` when storing them (parenthesising, casting,
- * schema-qualifying), so text comparison reports drift that does not exist, and
- * a check that cries wolf gets ignored.
- *
- * Presence is not text, though. A NULL `qual` is not a rewrite of an
- * expression, it is the absence of one, and absence has no false-positive risk:
- * either the generator emitted a clause or it did not. That distinction is worth
- * the extra comparison — a production database was found with a SELECT policy
- * whose `qual` was NULL, matching on every field this checked and denying 100%
- * of reads. The same blindness would hide a policy that fails open.
+ * Compares names, roles and command only — all exact values. Policy
+ * *expressions* are deliberately not compared: Postgres rewrites `qual`/
+ * `with_check` when storing them (parenthesising, casting, schema-qualifying),
+ * so text comparison reports drift that does not exist, and a check that cries
+ * wolf gets ignored. Roles alone catch the failure this exists for.
  */
 export async function checkPolicyDrift(
     client: Queryable,
@@ -175,13 +120,6 @@ export async function checkPolicyDrift(
         if (want.command !== got.command) {
             differences.push(`command: expected ${want.command}, database has ${got.command}`);
         }
-        for (const clause of ["USING", "WITH CHECK"] as const) {
-            const key = clause === "USING" ? "hasUsing" : "hasWithCheck";
-            if (want[key] === got[key]) continue;
-            differences.push(want[key]
-                ? `${clause}: expected an expression, database has none — this policy matches no rows`
-                : `${clause}: expected none, database has an expression`);
-        }
         if (differences.length > 0) drift.diverged.push({ expected: want, actual: got, differences });
     }
 

package/src/security/rls-enforcement.ts

@@ -1,6 +1,4 @@
 import { sql as drizzleSql, SQL } from "drizzle-orm";
-import { ANONYMOUS_USER_ID, PolicyExpression, SecurityRule } from "@rebasepro/types";
-import { AnonymousGrantRisk, findAnonymousGrants, securityRuleToConditions } from "@rebasepro/common";
 import { logger } from "@rebasepro/server";
 
 /**
@@ -202,13 +200,11 @@ export async function ensureAppRole(run: RawSqlRunner, schemas: string[]): Promi
  * treat `auth.uid() IS NULL` as the trusted server context, and `auth.uid()`
  * is `NULLIF(current_setting('app.user_id'), '')` — so an EMPTY user id would
  * be read as NULL and silently escalate a user request to server privileges.
- * Coerce empty/blank ids to `ANONYMOUS_USER_ID` here, at the single chokepoint,
- * rather than trusting every caller (e.g. realtime subscription auth) to do it.
- * That sentinel is exported from `@rebasepro/types` because it leaks into rule
- * semantics: it is why `auth.uid() IS NOT NULL` is true for anonymous requests.
+ * Coerce empty/blank ids to a sentinel here, at the single chokepoint, rather
+ * than trusting every caller (e.g. realtime subscription auth) to do it.
  */
 export async function applyAuthContext(tx: SqlTx, auth: AuthContext, userRole?: string): Promise<void> {
-    const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : ANONYMOUS_USER_ID;
+    const userId = typeof auth.userId === "string" && auth.userId.trim() !== "" ? auth.userId : "anonymous";
     const normalizedRoles = auth.roles.map((r: unknown) =>
         typeof r === "string" ? r : (r as Record<string, unknown>)?.id ?? String(r)
     );
@@ -230,63 +226,6 @@ const FOREIGN_CONVENTION_ROLES: Record<string, string> = {
     service_role: "Supabase"
 };
 
-/**
- * Warn about rules that read as "signed-in users only" but admit anonymous
- * callers — `auth.uid() IS NOT NULL`, or a comparison against another
- * platform's magic user id such as `'anon'`.
- *
- * The sibling of {@link validatePolicyPgRoles}, for the more dangerous spelling
- * of the same habit. A foreign `pgRoles` value makes a policy unreachable and
- * the table reads empty — loud, and that guard throws. These do the opposite:
- * the rule compiles to a grant, and nothing looks wrong until the data is
- * already public.
- *
- * Warns rather than throws. Unlike an unreachable `pgRoles`, these rules are
- * serving traffic today: refusing to boot would take an app offline to report a
- * problem it already has, and on the read path it would take it offline
- * *because* its data was exposed. Rewriting the author's SQL is not an option
- * either — this is the escape hatch whose whole promise is that it means what it
- * says. So: say so, loudly, and leave the rule alone.
- */
-export function warnOnAnonymousGrants(
-    collections: { slug?: string; securityRules?: readonly SecurityRule[] }[]
-): void {
-    // Grouped by the mistake, not by the rule: one habit typically repeats
-    // across every collection an author wrote, and a per-rule list would repeat
-    // the same paragraph dozens of times and get skimmed.
-    const byRisk = new Map<string, { risk: AnonymousGrantRisk; sites: string[] }>();
-
-    for (const collection of collections) {
-        for (const rule of collection.securityRules ?? []) {
-            const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
-            const risks = [usingExpr, withCheckExpr]
-                .filter((e): e is PolicyExpression => e !== null)
-                .flatMap(findAnonymousGrants);
-
-            for (const risk of risks) {
-                const key = `${risk.pattern}:${risk.detail}`;
-                const site = `${collection.slug ?? "(unnamed)"} → "${rule.name ?? "(unnamed rule)"}"`;
-                const entry = byRisk.get(key) ?? { risk, sites: [] };
-                if (!entry.sites.includes(site)) entry.sites.push(site);
-                byRisk.set(key, entry);
-            }
-        }
-    }
-
-    if (byRisk.size === 0) return;
-
-    const problems = [...byRisk.values()].map(({ risk, sites }) =>
-        `  • ${risk.explanation}\n    ${sites.length} rule(s): ${sites.join(", ")}`
-    );
-
-    logger.warn(
-        `Security rules that read as a lockdown but grant access to anonymous requests. Every caller from a ` +
-        `client carries a user id ('${ANONYMOUS_USER_ID}' when nobody is signed in), so these clauses are ` +
-        `true for everyone:\n\n` +
-        problems.join("\n\n") + "\n"
-    );
-}
-
 /**
  * Reject `pgRoles` that this server can never satisfy.
  *

package/src/services/BranchService.ts

@@ -11,45 +11,10 @@ import { sql } from "drizzle-orm";
 import { BranchInfo } from "@rebasepro/types";
 import { DrizzleClient } from "../interfaces";
 import { DatabasePoolManager } from "../databasePoolManager";
-import { extractPgError, extractCauseMessage } from "../utils/pg-error-utils";
 
 /** Internal prefix applied to branch database names to avoid collisions. */
 const BRANCH_DB_PREFIX = "rb_";
 
-/** `duplicate_database` — the target database name is already taken. */
-const PG_DUPLICATE_DATABASE = "42P04";
-
-/** `object_in_use` — the database still has connections attached. */
-const PG_OBJECT_IN_USE = "55006";
-
-/**
- * Describe a failed branch DDL statement in terms a user can act on.
- *
- * Drizzle reports failures as `Failed query: <sql> params:` and hides the real
- * PostgreSQL error in the `cause` chain, so matching on `err.message` never sees
- * the actual problem. Match on the PG error code instead — it survives wrapping
- * and, unlike the message text, is not locale-dependent.
- */
-function describeBranchDdlError(err: unknown, fallbackContext: string): Error {
-    const pgError = extractPgError(err);
-
-    if (pgError?.code === PG_DUPLICATE_DATABASE) {
-        return new Error(`Database "${fallbackContext}" already exists on the server. Choose a different branch name.`);
-    }
-    if (pgError?.code === PG_OBJECT_IN_USE) {
-        return new Error(
-            `Cannot complete the operation: the database "${fallbackContext}" has active connections. ` +
-            "Close other clients or connections and try again."
-        );
-    }
-
-    // Unknown failure: surface the real PG message rather than the Drizzle
-    // wrapper, which would otherwise show the raw SQL and no reason at all.
-    const detail = pgError?.message ?? extractCauseMessage(err);
-    if (detail) return new Error(detail);
-    return err instanceof Error ? err : new Error(String(err));
-}
-
 /** Fully-qualified metadata table in the rebase schema. */
 const BRANCHES_TABLE = "rebase.branches";
 
@@ -144,15 +109,18 @@ export class BranchService {
                 sql.raw(`CREATE DATABASE "${safeDbName}" TEMPLATE "${safeSourceDb}"`)
             );
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
-                // The template — not the new database — is the one still in use.
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("already exists")) {
+                throw new Error(`Database "${dbName}" already exists on the server. Choose a different branch name.`);
+            }
+            // If template fails due to active connections, provide a helpful error
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot create branch: the source database "${sourceDb}" has active connections. ` +
                     "Close other clients or connections and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Record metadata in the default database
@@ -198,14 +166,14 @@ export class BranchService {
         try {
             await this.db.execute(sql.raw(`DROP DATABASE "${safeDbName}"`));
         } catch (err) {
-            const pgError = extractPgError(err);
-            if (pgError?.code === PG_OBJECT_IN_USE) {
+            const msg = err instanceof Error ? err.message : String(err);
+            if (msg.includes("being accessed by other users")) {
                 throw new Error(
                     `Cannot delete branch "${sanitizedName}": the database has active connections. ` +
                     "Close other clients and try again."
                 );
             }
-            throw describeBranchDdlError(err, dbName);
+            throw err;
         }
 
         // Remove metadata