@rebasepro/server-postgres 0.9.1-canary.fd3754b → 0.9.1-canary.ff338b5

package/src/PostgresBackendDriver.ts

@@ -17,6 +17,7 @@ import {
     RebaseData,
     RebaseSdkData,
     RestFetchService,
+    SaveManyProps,
     SaveProps,
     TableColumnInfo,
     TableForeignKeyInfo,
@@ -28,6 +29,7 @@ import {
 import { sql as drizzleSql } from "drizzle-orm";
 import { buildPropertyCallbacks, buildSdkData, resolveCollectionRelations, updateDateAutoValues } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
+import { deriveRowAddress } from "./services/collection-helpers";
 import { HistoryService } from "./history/HistoryService";
 import { mergeDeep } from "@rebasepro/utils";
 import { logger } from "@rebasepro/server";
@@ -532,7 +534,8 @@ export class PostgresBackendDriver implements DataDriver {
                                                             id,
                                                             values,
                                                             collection,
-                                                            status
+                                                            status,
+                                                            upsert
                                                         }: SaveProps<M>): Promise<Record<string, unknown>> {
 
         const {
@@ -545,13 +548,26 @@ export class PostgresBackendDriver implements DataDriver {
         let updatedValues = values;
         const contextForCallback = this.buildCallContext();
 
-        // Fetch previous values for callbacks AND history recording
+        // Fetch previous values for callbacks AND history recording. Same walk
+        // as the saved row the callbacks receive (`fetchOneForRest`), so
+        // `values` and `previousValues` compare like with like — a Date on one
+        // side and its ISO string on the other reads as a change that never
+        // happened.
         let previousValuesForHistory: Partial<M> | undefined;
         if (status === "existing" && id) {
-            const existing = await this.dataService.fetchOne<M>(path, id, resolvedCollection?.databaseId);
-            if (existing) {
-                const { id: _existingId, ...existingValues } = existing;
-                previousValuesForHistory = existingValues as Partial<M>;
+            try {
+                const existing = await this.dataService.getFetchService()
+                    .fetchOneForRest(path, id, undefined, resolvedCollection?.databaseId);
+                if (existing) {
+                    const { id: _existingId, ...existingValues } = existing;
+                    previousValuesForHistory = existingValues as Partial<M>;
+                }
+            } catch (err) {
+                // Best-effort enrichment: callbacks and history run without
+                // previous values rather than the save failing on a read the
+                // write itself does not need (e.g. a collection whose key the
+                // registry cannot resolve).
+                logger.debug(`[save] Could not fetch previous values for "${path}"`, { detail: err instanceof Error ? err.message : String(err) });
             }
         }
 
@@ -616,7 +632,8 @@ export class PostgresBackendDriver implements DataDriver {
                 path,
                 updatedValues,
                 id,
-                resolvedCollection?.databaseId
+                resolvedCollection?.databaseId,
+                { upsert }
             );
 
             if (savedRow && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
@@ -649,8 +666,19 @@ export class PostgresBackendDriver implements DataDriver {
                 }
             }
 
-            const savedId = savedRow.id as string | number;
-            const { id: _savedId, ...savedValues } = savedRow;
+            // The row is exactly its columns, so its address is derived, not read
+            // off it: `savedRow.id` is undefined for every table whose key is not
+            // literally named `id`, and is ordinary data for a table that has such
+            // a column without it being the key.
+            const savedId = deriveRowAddress(
+                savedRow,
+                (resolvedCollection ?? collection) as CollectionConfig,
+                this.registry
+            );
+            // `values` are the row's columns — all of them. For an `id`-keyed table
+            // that includes `id`, which used to be stripped here because it was the
+            // synthesized address rather than the column it now is.
+            const savedValues = savedRow;
 
             if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
                 // 1. Global callbacks first
@@ -695,7 +723,7 @@ export class PostgresBackendDriver implements DataDriver {
             if (this.historyService && resolvedCollection?.history) {
                 this.historyService.recordHistory({
                     tableName: path,
-                    id: savedId.toString(),
+                    id: savedId,
                     action: status === "new" ? "create" : "update",
                     values: savedValues as Record<string, unknown>,
                     previousValues: previousValuesForHistory as Record<string, unknown> | undefined,
@@ -707,14 +735,14 @@ export class PostgresBackendDriver implements DataDriver {
             if (this._deferNotifications) {
                 this._pendingNotifications.push({
                     path,
-                    id: savedId.toString(),
+                    id: savedId,
                     row: savedRow,
                     databaseId: resolvedCollection?.databaseId
                 });
             } else {
                 await this.realtimeService.notifyUpdate(
                     path,
-                    savedId.toString(),
+                    savedId,
                     savedRow,
                     resolvedCollection?.databaseId
                 );
@@ -764,13 +792,86 @@ export class PostgresBackendDriver implements DataDriver {
         }
     }
 
+    /**
+     * Write many rows through the same pipeline as {@link save}.
+     *
+     * The batch runs in one transaction of its own, so a failure part-way leaves
+     * nothing behind — the point of a batch is that a re-run starts from a known
+     * state. When this driver is already inside a transaction (the authenticated
+     * path, via `withTransaction`) the nested call becomes a savepoint, which is
+     * still atomic and still commits once.
+     *
+     * Rows are applied in order, so a batch that touches the same key twice ends
+     * with the last write winning, exactly as separate calls would.
+     */
+    async saveMany<M extends Record<string, unknown>>({
+                                                          path,
+                                                          rows,
+                                                          collection,
+                                                          upsert
+                                                      }: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
+        return this.db.transaction(async (tx) => {
+            // Bind the whole batch to the transaction handle. Without this the
+            // rows would be written through `this.db` and survive a rollback.
+            const txDriver = new PostgresBackendDriver(
+                tx, this.realtimeService, this.registry, this.user, this.poolManager, this.historyService
+            );
+            txDriver.dataService = new DataService(tx, this.registry);
+            txDriver.client = this.client;
+            // Carry the caller's notification batching through, so a bulk write
+            // nested in an outer transaction still holds its events until commit.
+            txDriver._deferNotifications = this._deferNotifications;
+            txDriver._pendingNotifications = this._pendingNotifications;
+
+            const saved: Record<string, unknown>[] = [];
+
+            for (let i = 0; i < rows.length; i++) {
+                const values = rows[i];
+                const id = (values as Record<string, unknown>)?.id as string | number | undefined;
+                try {
+                    saved.push(await txDriver.save<M>({
+                        path,
+                        values,
+                        // No `id` argument, deliberately: passing one selects the
+                        // UPDATE path, and an import's rows usually carry a natural
+                        // key for a row that does not exist yet — which would 404 on
+                        // every one. Leaving the key inside `values` is what
+                        // single-row `create(data, id)` does, and it inserts.
+                        // Callers who want existing rows overwritten pass `upsert`.
+                        collection,
+                        status: "new",
+                        upsert
+                    }));
+                } catch (error) {
+                    // One bad row in ten thousand is impossible to find from a
+                    // message that only says the batch failed. Say which row, and
+                    // keep the original error as the cause so its status survives.
+                    const label = id !== undefined ? `id ${JSON.stringify(id)}` : "no id";
+                    throw Object.assign(
+                        new Error(`Row ${i} of ${rows.length} (${label}) failed: ${(error as Error)?.message ?? error}`, { cause: error }),
+                        {
+                            statusCode: (error as { statusCode?: number })?.statusCode,
+                            code: (error as { code?: string })?.code,
+                            name: (error as Error)?.name
+                        }
+                    );
+                }
+            }
+
+            return saved;
+        });
+    }
+
     async delete<M extends Record<string, unknown>>({
                                                               row,
                                                               collection
                                                           }: DeleteProps<M>): Promise<void> {
 
         const targetPath = row.path;
-        const targetRow: Record<string, unknown> = { id: row.id, ...(row.values ?? {}) };
+        // The callbacks' `row` is the row: its columns, nothing else. The address
+        // travels beside it as `id`, so merging it in here only ever invented an
+        // `id` field for tables that have no such column.
+        const targetRow: Record<string, unknown> = { ...(row.values ?? {}) };
 
         // Resolve from backend registry to restore callbacks lost during WebSocket serialization
         const {
@@ -1362,6 +1463,19 @@ export class AuthenticatedPostgresBackendDriver implements DataDriver {
         return this.withTransaction((delegate) => delegate.save(props));
     }
 
+    /**
+     * One transaction for the whole batch, rather than one per row.
+     *
+     * This is the point of the method: `save` opens a transaction per call, so
+     * importing 10k rows through it means 10k transactions (and, over HTTP, 10k
+     * round trips). Here the RLS context is established once and every row lands
+     * or none does. Realtime notifications are already deferred to commit by
+     * `withTransaction`, so a batch does not flood subscribers mid-flight.
+     */
+    async saveMany<M extends Record<string, unknown>>(props: SaveManyProps<M>): Promise<Record<string, unknown>[]> {
+        return this.withTransaction((delegate) => delegate.saveMany(props));
+    }
+
     async delete<M extends Record<string, unknown>>(props: DeleteProps<M>): Promise<void> {
         return this.withTransaction((delegate) => delegate.delete(props));
     }

package/src/PostgresBootstrapper.ts

@@ -4,7 +4,7 @@
  * Implements the `BackendBootstrapper` interface for PostgreSQL.
  */
 
-import { getTableName, isTable, Relations, sql } from "drizzle-orm";
+import { Relations, sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { PgEnum, PgTable } from "drizzle-orm/pg-core";
 import type { RebasePgTable } from "./types";
@@ -21,6 +21,7 @@ import {
 } from "@rebasepro/types";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
 import { RealtimeService } from "./services/realtimeService";
+import { buildCollectionRegistry } from "./collections/buildRegistry";
 import { DatabasePoolManager } from "./databasePoolManager";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { createEmailService, type EmailConfig, type EmailService, logger } from "@rebasepro/server";
@@ -33,7 +34,7 @@ import { ensureHistoryTableExists } from "./history/ensure-history-table";
 import { patchPgArrayNullSafety } from "./utils/pg-array-null-patch";
 import { buildCollectionsFromSchema, introspectSchema, readRlsStatus } from "./schema/introspect-runtime";
 import { buildDrizzleTablesFromSchema, buildDrizzleRelationsFromSchema } from "./schema/dynamic-tables";
-import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
+import { detectConnectionPosture, ensureAppRole, validatePolicyPgRoles, warnOnAnonymousGrants, REBASE_USER_ROLE, type RawSqlRunner } from "./security/rls-enforcement";
 import { provisionTriggerCdc, type CdcTableRef } from "./services/cdc/trigger-cdc";
 
 export interface PostgresDriverConfig {
@@ -64,6 +65,15 @@ export interface PostgresDriverInternals {
     realtimeService: RealtimeService;
     driver: PostgresBackendDriver;
     poolManager?: DatabasePoolManager;
+    /**
+     * Attach CDC triggers to tables that did not exist when the driver
+     * bootstrapped. Only set when database-level capture is actually active.
+     *
+     * Auth owns its own tables and creates them later in boot, so at driver
+     * bootstrap they are legitimately missing and get skipped; without this
+     * they would stay uninstrumented until the next restart.
+     */
+    provisionCdcForTables?: (tables: CdcTableRef[]) => Promise<void>;
 }
 
 // Re-export from shared CLI error utilities
@@ -161,30 +171,17 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             }
 
             const activeCollections = introspectedCollections ?? collections;
-
-            // Create a fresh registry for this driver
-            const registry = new PostgresCollectionRegistry();
-            if (activeCollections) {
-                registry.registerMultiple(activeCollections);
-                logger.info(`📋 [PostgresRegistry] Registered ${registry.getCollections().length} collections: [${registry.getCollections().map(c => c.slug).join(", ")}]`);
-            }
-
             const schemaTables = introspectedTables ?? pgConfig.schema?.tables;
-
-            // Register tables
-            if (schemaTables) {
-                Object.values(schemaTables).forEach((table) => {
-                    if (isTable(table)) {
-                        const tableName = getTableName(table);
-                        registry.registerTable(table as PgTable, tableName);
-                    }
-                });
-            }
-
-            if (pgConfig.schema?.enums) registry.registerEnums(pgConfig.schema.enums as Record<string, PgEnum<[string, ...string[]]>>);
-
             const schemaRelations = introspectedRelations ?? (pgConfig.schema?.relations as Record<string, Relations> | undefined);
-            if (schemaRelations) registry.registerRelations(schemaRelations);
+
+            // Create a fresh registry for this driver. Registration order is
+            // load-bearing, so it lives in one place — see `buildCollectionRegistry`.
+            const registry = buildCollectionRegistry({
+                collections: activeCollections,
+                tables: schemaTables,
+                enums: pgConfig.schema?.enums as Record<string, PgEnum<[string, ...string[]]>> | undefined,
+                relations: schemaRelations
+            });
 
             // Patch Drizzle's PgArray columns to handle NULL values safely.
             // Drizzle's mapFromDriverValue crashes with "value.map is not a function"
@@ -303,6 +300,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     registry.getCollections() as never,
                     driver.rlsUserRole ?? posture.role
                 );
+
+                // The same habit one surface over, and the dangerous direction:
+                // a rule that reads as "signed in only" but is true for every
+                // caller grants the data away rather than hiding it.
+                warnOnAnonymousGrants(registry.getCollections() as never);
             }
 
             // Ensure branch metadata table exists when branching is available
@@ -341,6 +343,7 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
             const wantsCdc = cdcMode !== "off";
             const explicitCdc = cdcMode === "trigger" || cdcMode === "wal";
             let cdcEnabled = false;
+            let provisionCdcForTables: PostgresDriverInternals["provisionCdcForTables"];
 
             if (wantsCdc && !directUrl) {
                 const reason = "no direct database connection is available for the realtime LISTEN client (set DATABASE_DIRECT_URL)";
@@ -374,6 +377,11 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     await provisionTriggerCdc(cdcRunSql, cdcTables);
                     await realtimeService.enableCdc(directUrl);
                     cdcEnabled = true;
+                    // Boot steps that create their own tables (auth) run after
+                    // this one and use it to instrument what they just created.
+                    provisionCdcForTables = async (tables) => {
+                        await provisionTriggerCdc(cdcRunSql, tables);
+                    };
                     logger.info(
                         `📡 [CDC] Realtime source = database-level change capture (mode: ${cdcMode === "wal" ? "wal→trigger" : "trigger"}). ` +
                         `All writes now emit realtime events regardless of origin.`
@@ -424,6 +432,14 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                     );
                     const missing: Array<{ slug: string; table: string }> = [];
                     for (const col of registeredCollections) {
+                        // Auth owns its table and creates it later in this same
+                        // boot (initializeAuth → ensureAuthTablesExist), so it is
+                        // legitimately absent right now. Reporting it as drift
+                        // tells the user to `db:push` a table that is about to
+                        // exist — and on an introspected database, one that the
+                        // database was never supposed to hold.
+                        if ((col as { auth?: { enabled?: boolean } }).auth?.enabled) continue;
+
                         const schemaName = "schema" in col && col.schema ? col.schema : "public";
                         const tableName = registry.hasTableForCollection(
                             col.table ?? col.slug
@@ -438,8 +454,10 @@ export function createPostgresBootstrapper(pgConfig: PostgresDriverConfig): Back
                         const checkName = resolvedTable ?? tableName;
                         const fullCheckName = schemaName === "public" ? checkName : `${schemaName}.${checkName}`;
                         if (!dbTables.has(fullCheckName)) {
+                            // Report what was actually looked up: an unqualified
+                            // "users" sends people hunting for public.users.
                             missing.push({ slug: col.slug,
-table: checkName });
+table: fullCheckName });
                         }
                     }
                     if (missing.length > 0) {
@@ -473,7 +491,8 @@ table: checkName });
                 registry,
                 realtimeService,
                 driver,
-                poolManager
+                poolManager,
+                provisionCdcForTables
             };
 
             return {
@@ -502,6 +521,29 @@ table: checkName });
             // ensureAuthTablesExist works with the collection abstraction — no Drizzle leakage.
             await ensureAuthTablesExist(db, authCollection);
 
+            // The driver bootstrapped before these tables existed, so CDC skipped
+            // them. Instrument them now, or writes to the user table emit no
+            // realtime events until the next restart.
+            if (authCollection && internals.provisionCdcForTables) {
+                const authSchema = "schema" in authCollection && typeof authCollection.schema === "string"
+                    ? authCollection.schema
+                    : "rebase";
+                const authTable = "table" in authCollection && typeof authCollection.table === "string"
+                    ? authCollection.table
+                    : authCollection.slug;
+                if (authTable) {
+                    try {
+                        await internals.provisionCdcForTables([{ schema: authSchema, table: authTable }]);
+                    } catch (err) {
+                        logger.warn(
+                            `⚠️ [CDC] Could not attach change-capture to the auth table "${authSchema}.${authTable}" — ` +
+                            "writes to it won't emit database-level events.",
+                            { detail: err instanceof Error ? err.message : String(err) }
+                        );
+                    }
+                }
+            }
+
             let emailService: EmailService | undefined;
             if (authConfig.email) {
                 emailService = createEmailService(authConfig.email as EmailConfig);

package/src/auth/ensure-tables.ts

@@ -251,17 +251,32 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
         // Seed default roles if none exist
         // (no-op: roles are now stored inline on the users table)
 
-        // ── Migration: Add is_anonymous column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS is_anonymous BOOLEAN DEFAULT FALSE
-        `);
-
-        // ── Migration: Add inline roles column (safe for existing tables) ────
-        await db.execute(sql`
-            ALTER TABLE ${sql.raw(usersTableName)}
-            ADD COLUMN IF NOT EXISTS roles TEXT[] DEFAULT '{}' NOT NULL
-        `);
+        // ── Migration: reconcile the full users column set (safe for existing tables) ──
+        // CREATE TABLE IF NOT EXISTS never revisits an existing table, so a
+        // database provisioned by an older framework era is missing every
+        // column added since. Each column the auth services read or write must
+        // be back-filled here, or upgraded deployments break on the first
+        // statement that references it. `email` is deliberately absent: it has
+        // existed since the first era and cannot be added NOT NULL safely.
+        const userColumnBackfills = [
+            "display_name VARCHAR(255)",
+            "photo_url VARCHAR(500)",
+            "roles TEXT[] DEFAULT '{}' NOT NULL",
+            "password_hash VARCHAR(255)",
+            "email_verified BOOLEAN DEFAULT FALSE NOT NULL",
+            "email_verification_token VARCHAR(255)",
+            "email_verification_sent_at TIMESTAMP WITH TIME ZONE",
+            "is_anonymous BOOLEAN DEFAULT FALSE NOT NULL",
+            "metadata JSONB DEFAULT '{}' NOT NULL",
+            "created_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL",
+            "updated_at TIMESTAMP WITH TIME ZONE DEFAULT NOW() NOT NULL"
+        ];
+        for (const columnDef of userColumnBackfills) {
+            await db.execute(sql`
+                ALTER TABLE ${sql.raw(usersTableName)}
+                ADD COLUMN IF NOT EXISTS ${sql.raw(columnDef)}
+            `);
+        }
 
         // ── Migration: Copy roles from legacy junction table to inline column ──
         // If the old rebase.user_roles and rebase.roles tables exist, migrate
@@ -358,6 +373,53 @@ export async function ensureAuthTablesExist(db: NodePgDatabase, collection?: Col
             ON ${sql.raw(recoveryCodesTableName)}(user_id)
         `);
 
+        // ── Migration: clear stale FORCE ROW LEVEL SECURITY (older RLS model) ──
+        // The current model never emits FORCE: privileged auth writes run as
+        // the table owner and rely on the owner bypassing plain ENABLE RLS
+        // (see generate-postgres-ddl-logic). A table still carrying FORCE from
+        // an older framework era binds the owner too, so the first user
+        // registration after an upgrade fails with SQLSTATE 42501. Reconcile
+        // on boot; only tables actually flagged get the ALTER (and its lock).
+        try {
+            const authTablePairs: [string, string][] = [
+                [usersSchema, resolvedTable],
+                [authSchema, "user_identities"],
+                [authSchema, "refresh_tokens"],
+                [authSchema, "password_reset_tokens"],
+                [authSchema, "app_config"],
+                [authSchema, "mfa_factors"],
+                [authSchema, "mfa_challenges"],
+                [authSchema, "recovery_codes"]
+            ];
+            for (const [schemaName, tableName] of authTablePairs) {
+                const forced = await db.execute(sql`
+                    SELECT 1
+                    FROM pg_class c
+                    JOIN pg_namespace n ON n.oid = c.relnamespace
+                    WHERE n.nspname = ${schemaName}
+                      AND c.relname = ${tableName}
+                      AND c.relforcerowsecurity
+                `);
+                if (forced.rows.length > 0) {
+                    await db.execute(sql`
+                        ALTER TABLE ${sql.raw(`"${schemaName}"."${tableName}"`)}
+                        NO FORCE ROW LEVEL SECURITY
+                    `);
+                    logger.warn(
+                        `🔧 Cleared stale FORCE ROW LEVEL SECURITY on "${schemaName}"."${tableName}" ` +
+                        "(legacy RLS model — it binds the owner connection and breaks privileged auth writes)"
+                    );
+                }
+            }
+        } catch (rlsReconcileError: unknown) {
+            // Non-fatal: the connection may lack ownership on a pre-provisioned
+            // table; registration will still fail loudly (42501) if FORCE remains.
+            logger.warn(
+                `⚠️  Could not reconcile FORCE ROW LEVEL SECURITY on auth tables: ` +
+                `${rlsReconcileError instanceof Error ? rlsReconcileError.message : String(rlsReconcileError)}`
+            );
+        }
+
         logger.info("✅ Auth tables ready");
     } catch (error) {
         logger.error("❌ Failed to create auth tables", { error });

package/src/auth/services.ts

@@ -82,6 +82,32 @@ export class UserService implements UserRepository {
         return `"${schema}"."${name}"`;
     }
 
+    /**
+     * Run a privileged auth write with an explicitly cleared RLS context.
+     *
+     * The auth services run on the base/owner connection, which by design
+     * carries a NULL `app.user_id` so the `auth.uid() IS NULL` server-escape
+     * in the default policies applies. That NULL is normally guaranteed by
+     * `set_config(..., is_local = true)` resetting at transaction end — but a
+     * GUC that survives on a pooled connection (or a connection role that
+     * doesn't bypass RLS: FORCE ROW LEVEL SECURITY, or a non-owner role)
+     * turns the trusted write into an RLS-scoped one and denies it with
+     * SQLSTATE 42501. Clearing the GUCs here, transaction-locally at the
+     * single chokepoint, makes the server context deterministic instead of
+     * trusting whatever state the pool hands us. `auth.uid()` reads '' as
+     * NULL via NULLIF, so '' is the server context.
+     */
+    private async withServerContext<T>(fn: (db: NodePgDatabase) => Promise<T>): Promise<T> {
+        return await this.db.transaction(async (tx) => {
+            await tx.execute(sql`
+                SELECT set_config('app.user_id', '', true),
+                       set_config('app.user_roles', '', true),
+                       set_config('app.jwt', '', true)
+            `);
+            return await fn(tx as unknown as NodePgDatabase);
+        });
+    }
+
     private mapRowToUser(row: Record<string, unknown>): UserData {
         if (!row) return row as UserData;
 
@@ -200,7 +226,9 @@ export class UserService implements UserRepository {
 
     async createUser(data: CreateUserData): Promise<UserData> {
         const payload = this.mapPayload(data);
-        const [row] = (await this.db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db.insert(this.usersTable).values(payload).returning()) as Record<string, unknown>[]
+        );
         return this.mapRowToUser(row);
     }
 
@@ -255,12 +283,12 @@ export class UserService implements UserRepository {
     }
 
     async linkUserIdentity(userId: string, provider: string, providerId: string, profileData?: Record<string, unknown>): Promise<void> {
-        await this.db.insert(this.userIdentitiesTable).values({
+        await this.withServerContext(async (db) => db.insert(this.userIdentitiesTable).values({
             userId,
             provider,
             providerId,
             profileData: profileData || null
-        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] });
+        }).onConflictDoNothing({ target: [this.userIdentitiesTable.provider, this.userIdentitiesTable.providerId] }));
     }
 
     async updateUser(id: string, data: Partial<Omit<CreateUserData, "id">>): Promise<UserData | null> {
@@ -270,18 +298,20 @@ export class UserService implements UserRepository {
         const updatedAtKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
         payload[updatedAtKey] = new Date();
 
-        const [row] = (await this.db
-            .update(this.usersTable)
-            .set(payload)
-            .where(eq(idCol, id))
-            .returning()) as Record<string, unknown>[];
+        const [row] = await this.withServerContext(async (db) =>
+            (await db
+                .update(this.usersTable)
+                .set(payload)
+                .where(eq(idCol, id))
+                .returning()) as Record<string, unknown>[]
+        );
         return row ? this.mapRowToUser(row) : null;
     }
 
     async deleteUser(id: string): Promise<void> {
         const idCol = getColumn(this.usersTable, "id");
         if (!idCol) return;
-        await this.db.delete(this.usersTable).where(eq(idCol, id));
+        await this.withServerContext(async (db) => db.delete(this.usersTable).where(eq(idCol, id)));
     }
 
     async listUsers(): Promise<UserData[]> {
@@ -357,13 +387,13 @@ export class UserService implements UserRepository {
         const passwordHashColKey = getColumnKey(this.usersTable, "passwordHash", "password_hash") || "passwordHash";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [passwordHashColKey]: passwordHash,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -376,14 +406,14 @@ export class UserService implements UserRepository {
         const emailVerificationTokenColKey = getColumnKey(this.usersTable, "emailVerificationToken", "email_verification_token") || "emailVerificationToken";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerifiedColKey]: verified,
                 [emailVerificationTokenColKey]: null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -396,14 +426,14 @@ export class UserService implements UserRepository {
         const emailVerificationSentAtColKey = getColumnKey(this.usersTable, "emailVerificationSentAt", "email_verification_sent_at") || "emailVerificationSentAt";
         const updatedAtColKey = getColumnKey(this.usersTable, "updatedAt", "updated_at") || "updatedAt";
 
-        await this.db
+        await this.withServerContext(async (db) => db
             .update(this.usersTable)
             .set({
                 [emailVerificationTokenColKey]: token,
                 [emailVerificationSentAtColKey]: token ? new Date() : null,
                 [updatedAtColKey]: new Date()
             })
-            .where(eq(idCol, id));
+            .where(eq(idCol, id)));
     }
 
     /**
@@ -463,11 +493,11 @@ export class UserService implements UserRepository {
     async setUserRoles(userId: string, roleIds: string[]): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
         const rolesArray = `{${roleIds.join(",")}}`;
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = ${rolesArray}::text[], updated_at = NOW()
             WHERE id = ${userId}
-        `);
+        `));
     }
 
     /**
@@ -475,11 +505,11 @@ export class UserService implements UserRepository {
      */
     async assignDefaultRole(userId: string, roleId: string): Promise<void> {
         const usersTableName = this.getQualifiedUsersTableName();
-        await this.db.execute(sql`
+        await this.withServerContext(async (db) => db.execute(sql`
             UPDATE ${sql.raw(usersTableName)}
             SET roles = array_append(roles, ${roleId}), updated_at = NOW()
             WHERE id = ${userId} AND NOT (${roleId} = ANY(roles))
-        `);
+        `));
     }
 
     /**