@rebasepro/server-postgres 0.9.1-canary.fd3754b → 0.10.0

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,10 +1,8 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/collection-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -315,22 +313,6 @@ const wrapSql = (clause: string): string => `sql\`${clause}\``;
 /**
  * Generates a deterministic hash based on the rule configuration.
  */
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 /**
  * Generates Drizzle pgPolicy() calls from a declarative SecurityRule definition.
@@ -351,15 +333,11 @@ const generatePolicyCode = (collection: CollectionConfig, rule: SecurityRule, in
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     // Generate one pgPolicy per operation
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyCode(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyCode(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -567,6 +545,10 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
     });
     schemaContent += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     // 2. Identify all tables (collections and junction tables only)
     for (const collection of collections) {
         const tableName = getTableName(collection);
@@ -623,9 +605,22 @@ export const generateSchema = async (collections: CollectionConfig[], stripPolic
             schemaContent += `export const ${tableVarName} = ${tableCreator}(\"${baseTableName}\", {\n`;
             schemaContent += `    ${sourceColumn}: ${sourceColType}(\"${sourceColumn}\").notNull().references(() => ${getTableVarName(getTableName(sourceCollection))}.${sourceId}, ${refOptions}),\n`;
             schemaContent += `    ${targetColumn}: ${targetColType}(\"${targetColumn}\").notNull().references(() => ${getTableVarName(getTableName(targetCollection))}.${targetId}, ${refOptions}),\n`;
-            schemaContent += "}, (table) => ({\n";
-            schemaContent += `    pk: primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] })\n`;
-            schemaContent += "}));\n\n";
+            schemaContent += "}, (table) => ([\n";
+            schemaContent += `    primaryKey({ columns: [table.${sourceColumn}, table.${targetColumn}] }),\n`;
+
+            // Junctions are generated tables like any other: locked by default,
+            // with derived policies (reads follow the endpoints, writes follow
+            // the declaring side's update rules). RLS is enabled regardless of
+            // policy stripping — a bare junction must default-deny, not fail open.
+            const junctionSpec = junctionSpecs.get(baseTableName);
+            if (!stripPolicies && junctionSpec) {
+                const junctionCollection = getJunctionCollectionConfig(junctionSpec);
+                const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                getJunctionSecurityRules(junctionSpec).forEach((rule: SecurityRule, idx: number) => {
+                    schemaContent += generatePolicyCode(junctionCollection, rule, idx, resolveCollection);
+                });
+            }
+            schemaContent += "])).enableRLS();\n\n";
         } else if (!isJunction) {
             const schema = isPostgresCollectionConfig(collection) ? collection.schema : undefined;
             const tableCreator = schema ? `${schema}Schema.table` : "pgTable";

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,8 +1,6 @@
 import { CollectionConfig, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollectionConfig, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
-import { toSnakeCase } from "@rebasepro/utils";
-import { createHash } from "crypto";
-import { getEffectiveSecurityRules } from "./auth-default-policies";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres, getEffectiveSecurityRules, getInjectedSecurityRules, resolveJunctionSpecs, getJunctionSecurityRules, getJunctionCollectionConfig } from "@rebasepro/common";
+import { toSnakeCase, getPolicyNamesForRule } from "@rebasepro/utils";
 
 // --- Helper Functions ---
 
@@ -44,22 +42,6 @@ const isIdProperty = (propName: string, prop: Property, collection: CollectionCo
     return !hasExplicitId && propName === "id";
 };
 
-const getPolicyNameHash = (rule: SecurityRule): string => {
-    const data = JSON.stringify({
-        a: rule.access,
-        m: rule.mode,
-        op: rule.operation,
-        ops: rule.operations?.slice().sort(),
-        own: rule.ownerField,
-        rol: rule.roles?.slice().sort(),
-        pg: rule.pgRoles?.slice().sort(),
-        u: rule.using,
-        w: rule.withCheck,
-        c: rule.condition,
-        ch: rule.check
-    });
-    return createHash("sha1").update(data).digest("hex").substring(0, 7);
-};
 
 type ResolveCollection = (slug: string) => CollectionConfig | undefined;
 
@@ -69,14 +51,10 @@ const generatePolicyDdl = (collection: CollectionConfig, rule: SecurityRule, res
         ? rule.operations
         : [rule.operation ?? "all"];
 
-    const ruleHash = getPolicyNameHash(rule);
+    const policyNames = getPolicyNamesForRule(rule, tableName);
 
     return ops.map((op, opIdx) => {
-        const policyName = rule.name
-            ? (ops.length > 1 ? `${rule.name}_${op}` : rule.name)
-            : `${tableName}_${op}_${ruleHash}${ops.length > 1 ? `_${opIdx}` : ""}`;
-
-        return generateSinglePolicyDdl(collection, rule, op, policyName, resolveCollection);
+        return generateSinglePolicyDdl(collection, rule, op, policyNames[opIdx], resolveCollection);
     }).join("");
 };
 
@@ -248,6 +226,10 @@ export const generatePostgresDdl = async (
     });
     if (ddl.endsWith(";\n")) ddl += "\n";
 
+    // Junction policy derivation needs every declaring side of each junction,
+    // not just the first relation that reached it in the walk below.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+
     const allTablesToGenerate = new Map<string, {
         collection: CollectionConfig,
         isJunction?: boolean,
@@ -283,6 +265,11 @@ export const generatePostgresDdl = async (
 
     // 3. Generate tables
     const fkStatements: string[] = [];
+    // Policies are emitted after every CREATE TABLE, like the FK constraints:
+    // a policy may reference other tables (a junction's derived policies always
+    // reference both endpoints; `policy.existsIn` references a join table), and
+    // CREATE POLICY validates those relations at creation time.
+    const policyStatements: string[] = [];
     for (const [tableName, {
         collection,
         isJunction,
@@ -315,6 +302,25 @@ export const generatePostgresDdl = async (
 
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${sourceColumn}_fkey" FOREIGN KEY ("${sourceColumn}") REFERENCES "${sourceSchema}"."${sourceTable}" ("${sourceId}") ON DELETE ${onDelete.toUpperCase()};`);
             fkStatements.push(`ALTER TABLE "${schema}"."${baseTableName}" ADD CONSTRAINT "${baseTableName}_${targetColumn}_fkey" FOREIGN KEY ("${targetColumn}") REFERENCES "${targetSchema}"."${targetTable}" ("${targetId}") ON DELETE ${onDelete.toUpperCase()};`);
+
+            if (options.includePolicies) {
+                // Junction tables are generated tables like any other: locked by
+                // default, with derived policies — reads follow the endpoints'
+                // visibility, writes follow the declaring side's update rules.
+                // Without this they were the one kind of generated table with no
+                // RLS at all, readable and writable by every signed-in user.
+                ddl += `ALTER TABLE "${schema}"."${baseTableName}" ENABLE ROW LEVEL SECURITY;\n`;
+                ddl += `\n`;
+
+                const spec = junctionSpecs.get(baseTableName);
+                if (spec) {
+                    const junctionCollection = getJunctionCollectionConfig(spec);
+                    const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+                    getJunctionSecurityRules(spec).forEach((rule: SecurityRule) => {
+                        policyStatements.push(generatePolicyDdl(junctionCollection, rule, resolveCollection));
+                    });
+                }
+            }
         } else if (!isJunction) {
             ddl += `CREATE TABLE "${schema}"."${baseTableName}" (\n`;
             const columns: string[] = [];
@@ -436,9 +442,8 @@ export const generatePostgresDdl = async (
                 if (securityRules.length > 0) {
                     const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
                     securityRules.forEach((rule: SecurityRule) => {
-                        ddl += generatePolicyDdl(collection, rule, resolveCollection);
+                        policyStatements.push(generatePolicyDdl(collection, rule, resolveCollection));
                     });
-                    ddl += "\n";
                 }
             }
         }
@@ -449,6 +454,12 @@ export const generatePostgresDdl = async (
         ddl += fkStatements.join("\n") + "\n\n";
     }
 
+    if (policyStatements.length > 0) {
+        ddl += "-- Row Level Security Policies\n";
+        ddl += policyStatements.join("");
+        ddl += "\n";
+    }
+
     return ddl;
 };
 
@@ -478,13 +489,50 @@ export const generatePostgresPoliciesDdl = (collections: CollectionConfig[]): st
         const securityRules = getEffectiveSecurityRules(collection);
         if (securityRules.length > 0) {
             const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+            const injectedNames = new Set(getInjectedSecurityRules(collection).map((rule) => rule.name));
+
             securityRules.forEach((rule: SecurityRule) => {
+                // Say which policies the author did not write. They are permissive,
+                // so they OR with the declared rules and widen the final ACL beyond
+                // what `securityRules` reads like — and re-appear after any manual
+                // DROP, because a push asserts the declared state.
+                if (rule.name && injectedNames.has(rule.name)) {
+                    ddl += `-- Injected by Rebase (not from this collection's securityRules).\n`;
+                    ddl += `-- Set \`disableDefaultPolicies: true\` on "${collection.slug}" to drop these and own its RLS outright.\n`;
+                }
                 ddl += generatePolicyDdl(collection, rule, resolveCollection);
             });
             ddl += "\n";
         }
     }
 
+    // Junction tables are generated from `through` relations, not declared as
+    // collections, so the walk above never sees them. They get the same
+    // treatment as any generated table: locked by default, with derived
+    // policies — reads follow the endpoints, writes follow the declaring
+    // side's update rules.
+    const junctionSpecs = resolveJunctionSpecs(collections);
+    for (const spec of junctionSpecs.values()) {
+        ddl += `ALTER TABLE "${spec.schema}"."${spec.table}" ENABLE ROW LEVEL SECURITY;\n`;
+        ddl += `\n`;
+
+        const junctionRules = getJunctionSecurityRules(spec);
+        if (junctionRules.length === 0) continue;
+
+        const junctionCollection = getJunctionCollectionConfig(spec);
+        const resolveCollection: ResolveCollection = (slug) => collections.find(c => c.slug === slug || getTableName(c) === slug);
+        const declaringSlugs = spec.declaringSides.map(s => s.collection.slug).join('", "');
+
+        ddl += `-- Derived by Rebase for the junction "${spec.table}" (no collection declares it).\n`;
+        ddl += `-- Reads require both endpoint rows to be visible; writes follow the update\n`;
+        ddl += `-- rules of "${declaringSlugs}". Set \`disableDefaultPolicies: true\` on the\n`;
+        ddl += `-- declaring collection(s) to drop these and police the junction yourself.\n`;
+        junctionRules.forEach((rule: SecurityRule) => {
+            ddl += generatePolicyDdl(junctionCollection, rule, resolveCollection);
+        });
+        ddl += "\n";
+    }
+
     return ddl;
 };
 

package/src/schema/introspect-db-inference.ts

@@ -1,4 +1,4 @@
-import { humanize } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface InferenceResult {
     propType?: string; // If the inference changes the base type

package/src/schema/introspect-db-logic.ts

@@ -7,6 +7,7 @@
  * and consumed directly by tests.
  */
 import { inferPropertyFromData } from "./introspect-db-inference";
+import { humanize } from "./introspect-db-naming";
 
 // ── Typed interfaces for SQL query results ────────────────────────────
 
@@ -117,16 +118,6 @@ export function singularize(word: string): string {
     return word;
 }
 
-/**
- * Convert a snake_case name to a human-readable Title Case label.
- * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
- */
-export function humanize(snakeName: string): string {
-    return snakeName
-        .replace(/_/g, " ")
-        .replace(/\b\w/g, (c) => c.toUpperCase());
-}
-
 /**
  * Convert a snake_case table name to a camelCase + "Collection" variable name.
  * e.g. "company_token" -> "companyTokenCollection"

package/src/schema/introspect-db-naming.ts

@@ -0,0 +1,15 @@
+/**
+ * Naming helpers shared by the introspection modules. These live apart from
+ * `introspect-db-logic.ts` because the inference pass needs them too, and
+ * importing them from there would close a cycle back through this module.
+ */
+
+/**
+ * Convert a snake_case name to a human-readable Title Case label.
+ * e.g. "created_at" -> "Created At", "customer_id" -> "Customer Id"
+ */
+export function humanize(snakeName: string): string {
+    return snakeName
+        .replace(/_/g, " ")
+        .replace(/\b\w/g, (c) => c.toUpperCase());
+}

package/src/schema/introspect-db.ts

@@ -30,6 +30,7 @@ async function main() {
             "--force": Boolean,
             "--schema": String,
             "--data-inference": Boolean,
+            "--no-data-inference": Boolean,
             "-o": "--output",
             "-c": "--collections",
             "-f": "--force"
@@ -166,8 +167,14 @@ async function main() {
         logger.info(chalk.blue(`Found ${tablesMap.size} tables (including ${joinTables.size} detected join tables).`));
 
         let runDataInference = false;
-        if (args["--data-inference"] !== undefined) {
+        if (args["--no-data-inference"]) {
+            runDataInference = false;
+        } else if (args["--data-inference"] !== undefined) {
             runDataInference = args["--data-inference"];
+        } else if (!process.stdin.isTTY) {
+            // No terminal to answer the question below (scaffolding scripts, CI,
+            // `rebase init --introspect`) — asking would hang forever.
+            logger.info(chalk.gray("Skipping data inference (non-interactive run; pass --data-inference to enable)."));
         } else {
             const rl = readline.createInterface({
                 input: process.stdin,
@@ -236,7 +243,17 @@ async function main() {
                 const merged = mergeIndexContent(existing, generatedFiles);
                 fs.writeFileSync(indexPath, merged, "utf-8");
             } else {
-                const indexContent = generateIndexContent(generatedFiles);
+                // --force replaces collections derived from the database, but the
+                // directory can also hold hand-written ones with no table in the
+                // introspected schema (the auth users collection lives in
+                // "rebase"). The backend discovers the whole directory, so an
+                // index listing only introspected tables would silently drop them
+                // from the admin UI while the API still served them.
+                const siblings = fs.readdirSync(outDir)
+                    .filter(f => f.endsWith(".ts") && f !== "index.ts")
+                    .map(f => f.replace(/\.ts$/, ""));
+                const allFiles = [...new Set([...generatedFiles, ...siblings])];
+                const indexContent = generateIndexContent(allFiles);
                 fs.writeFileSync(indexPath, indexContent, "utf-8");
             }
             logger.info(chalk.green(`  ✓ ${indexPath}`));

package/src/schema/introspect-runtime.ts

@@ -23,11 +23,11 @@ import {
     buildTablesMap,
     buildEnumMap,
     identifyJoinTables,
-    humanize,
     singularize,
     mapPgType,
     getIconForTable
 } from "./introspect-db-logic";
+import { humanize } from "./introspect-db-naming";
 
 export interface IntrospectedSchema {
     tablesMap: Map<string, TableMeta>;

package/src/security/policy-drift.test.ts

@@ -1,7 +1,7 @@
 import { describe, expect, it } from "@jest/globals";
 import type { CollectionConfig } from "@rebasepro/types";
 
-import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, type Queryable } from "./policy-drift";
+import { checkPolicyDrift, parseExpectedPolicies, formatPolicyDrift, hasDrift, dropOrphanedPolicies, isGeneratedPolicyName, type PolicyRef, type Queryable } from "./policy-drift";
 import { generatePostgresPoliciesDdl } from "../schema/generate-postgres-ddl-logic";
 
 function collection(slug: string): CollectionConfig {
@@ -23,6 +23,17 @@ function dbWith(rows: Record<string, unknown>[]): Queryable {
     return { query: async () => ({ rows: rows as never[] }) };
 }
 
+/** A pg_policies row matching an expected policy, clauses and all. */
+function liveRow(p: PolicyRef, overrides: Record<string, unknown> = {}) {
+    return {
+        schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command,
+        // Postgres rewrites the text it stores; only presence is compared.
+        qual: p.hasUsing ? "(rewritten by postgres)" : null,
+        with_check: p.hasWithCheck ? "(rewritten by postgres)" : null,
+        ...overrides
+    };
+}
+
 describe("parseExpectedPolicies", () => {
     it("reads the DDL that db push actually applies", () => {
         const ddl = generatePostgresPoliciesDdl([collection("authors")]);
@@ -38,11 +49,8 @@ describe("checkPolicyDrift", () => {
     it("reports nothing when the database matches the collections", async () => {
         const cols = [collection("authors")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => ({
-            schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command
-        }));
 
-        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const drift = await checkPolicyDrift(dbWith(expected.map((p) => liveRow(p))), cols);
 
         expect(hasDrift(drift)).toBe(false);
         expect(formatPolicyDrift(drift)).toBe("");
@@ -62,8 +70,8 @@ describe("checkPolicyDrift", () => {
         const cols = [collection("customers")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
         const live = [
-            ...expected.map((p) => ({ schemaname: p.schema, tablename: p.table, policyname: p.name, roles: p.roles, cmd: p.command })),
-            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL" }
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "customers", policyname: "test_policy", roles: ["authenticated"], cmd: "ALL", qual: "true", with_check: null }
         ];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
@@ -76,11 +84,8 @@ describe("checkPolicyDrift", () => {
     it("flags a policy whose roles were changed underneath it as diverged", async () => {
         const cols = [collection("orders")];
         const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
-        const live = expected.map((p) => ({
-            schemaname: p.schema, tablename: p.table, policyname: p.name,
-            // Someone re-granted it to a role requests never run as.
-            roles: ["authenticated"], cmd: p.command
-        }));
+        // Someone re-granted it to a role requests never run as.
+        const live = expected.map((p) => liveRow(p, { roles: ["authenticated"] }));
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -89,9 +94,84 @@ describe("checkPolicyDrift", () => {
         expect(formatPolicyDrift(drift)).toContain("Diverged");
     });
 
+    it("flags a policy whose expression the database is missing entirely", async () => {
+        // A real production database had jobs.public_read_published stored as
+        // SELECT / {public} / USING NULL: every field this used to compare
+        // matched, drift reported zero, and the policy denied 100% of reads.
+        const cols = [collection("jobs")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const select = expected.find((p) => p.command === "SELECT" && p.roles.includes("public"))!;
+        const live = expected.map((p) => (p === select ? liveRow(p, { qual: null }) : liveRow(p)));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.diverged).toHaveLength(1);
+        expect(drift.diverged[0].differences.join(" ")).toContain("USING: expected an expression, database has none");
+    });
+
+    it("does not mistake an expression Postgres rewrote for a missing one", async () => {
+        // The reason expression text is not compared: what comes back out of
+        // pg_policies never matches what went in.
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p, {
+            qual: p.hasUsing ? "((auth.uid() IS NOT NULL) AND ((auth.uid())::text <> 'anonymous'::text))" : null
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(hasDrift(drift)).toBe(false);
+    });
+
+    it("flags the pre-fix permissive tautology that every other check misses", async () => {
+        // A database pushed before the `policy.authenticated()` fix carries
+        // `auth.uid() IS NOT NULL` — true for anonymous visitors. Its name,
+        // roles, command and clause presence all match the corrected policy, so
+        // this is the only signal that catches it.
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p, {
+            qual: p.hasUsing ? "(auth.uid() IS NOT NULL)" : null
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        expect(drift.insecure.length).toBeGreaterThan(0);
+        expect(hasDrift(drift)).toBe(true);
+        expect(drift.diverged).toHaveLength(0); // nothing else notices
+        expect(formatPolicyDrift(drift)).toContain("anonymous");
+        expect(formatPolicyDrift(drift)).toContain("db push");
+    });
+
+    it("clears the corrected expression, in either literal spelling", async () => {
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        for (const guard of ["<> 'anonymous'::text", "<> 'anonymous'", "!= 'anonymous'"]) {
+            const live = expected.map((p) => liveRow(p, {
+                qual: p.hasUsing ? `((auth.uid() IS NOT NULL) AND ((auth.uid())::text ${guard}))` : null
+            }));
+            const drift = await checkPolicyDrift(dbWith(live), cols);
+            expect(drift.insecure).toHaveLength(0);
+        }
+    });
+
+    it("also flags the tautology in a WITH CHECK clause", async () => {
+        const cols = [collection("posts")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p, {
+            with_check: p.hasWithCheck ? "(auth.uid() IS NOT NULL)" : null
+        }));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+
+        const flagged = drift.insecure.some((i) => /WITH CHECK/.test(i.reason));
+        // Only assert when the fixture actually had a WITH CHECK policy to carry it.
+        if (expected.some((p) => p.hasWithCheck)) expect(flagged).toBe(true);
+    });
+
     it("parses roles when the driver returns the raw {a,b} text form", async () => {
         const cols = [collection("tags")];
-        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL" }];
+        const live = [{ schemaname: "public", tablename: "tags", policyname: "test_policy", roles: "{authenticated,anon}", cmd: "ALL", qual: "true", with_check: null }];
 
         const drift = await checkPolicyDrift(dbWith(live), cols);
 
@@ -104,7 +184,7 @@ describe("checkPolicyDrift", () => {
         // Note a collection with no securityRules is NOT this case — it still
         // generates default (admin-only) policies.
         const drift = await checkPolicyDrift(
-            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL" }]),
+            dbWith([{ schemaname: "public", tablename: "x", policyname: "p", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }]),
             []
         );
 
@@ -120,3 +200,108 @@ describe("checkPolicyDrift", () => {
         expect(drift.missing.length).toBeGreaterThan(0);
     });
 });
+
+describe("isGeneratedPolicyName", () => {
+    it("recognises the generator's own shape", () => {
+        expect(isGeneratedPolicyName("documents_insert_a1b2c3d", "documents")).toBe(true);
+        // One rule spanning several operations appends the operation index.
+        expect(isGeneratedPolicyName("documents_update_a1b2c3d_1", "documents")).toBe(true);
+    });
+
+    it("does not claim names a human could have written", () => {
+        expect(isGeneratedPolicyName("owner_access", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_default_admin_read", "documents")).toBe(false);
+        // Right shape, wrong table — belongs to something else.
+        expect(isGeneratedPolicyName("teams_insert_a1b2c3d", "documents")).toBe(false);
+        // A digest is 7 lowercase hex characters, nothing else.
+        expect(isGeneratedPolicyName("documents_insert_notahex", "documents")).toBe(false);
+        expect(isGeneratedPolicyName("documents_grant_a1b2c3d", "documents")).toBe(false);
+    });
+});
+
+describe("dropOrphanedPolicies", () => {
+    /** Records the DDL issued so the test can assert on what was dropped. */
+    function recordingDb(rows: Record<string, unknown>[]) {
+        const executed: string[] = [];
+        const db: Queryable = {
+            query: async (text: string) => {
+                if (!/^SELECT/i.test(text)) executed.push(text);
+                return { rows: rows as never[] };
+            }
+        };
+        return { db, executed };
+    }
+
+    it("drops the policy a rule edit superseded", async () => {
+        // The reported failure: tightening a rule renames its policy, and the
+        // permissive original stays live and keeps ORing itself back in.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const stale = {
+            schemaname: "public", tablename: "documents", policyname: "documents_insert_dead1ee",
+            roles: ["public"], cmd: "INSERT", qual: null, with_check: "true"
+        };
+        const live = [...expected.map((p) => liveRow(p)), stale];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(1);
+        expect(dropped[0].name).toBe("documents_insert_dead1ee");
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([
+            'DROP POLICY IF EXISTS "documents_insert_dead1ee" ON "public"."documents"'
+        ]);
+    });
+
+    it("leaves a hand-written policy alone and reports it instead", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "documents", policyname: "ops_break_glass", roles: ["public"], cmd: "ALL", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["ops_break_glass"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("never touches a table the collections do not describe", async () => {
+        // Another application sharing the schema owns this table; a
+        // generator-shaped name there is coincidence, not our leftover.
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = [
+            ...expected.map((p) => liveRow(p)),
+            { schemaname: "public", tablename: "legacy", policyname: "legacy_select_a1b2c3d", roles: ["public"], cmd: "SELECT", qual: "true", with_check: null }
+        ];
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept.map((p) => p.name)).toEqual(["legacy_select_a1b2c3d"]);
+        expect(executed).toEqual([]);
+    });
+
+    it("does nothing when the database already matches", async () => {
+        const cols = [collection("documents")];
+        const expected = parseExpectedPolicies(generatePostgresPoliciesDdl(cols));
+        const live = expected.map((p) => liveRow(p));
+
+        const drift = await checkPolicyDrift(dbWith(live), cols);
+        const { db, executed } = recordingDb(live);
+        const { dropped, kept } = await dropOrphanedPolicies(db, drift, cols);
+
+        expect(dropped).toHaveLength(0);
+        expect(kept).toHaveLength(0);
+        expect(executed).toEqual([]);
+    });
+});