@rebasepro/server-postgresql 0.1.2 → 0.2.3

package/src/services/realtimeService.ts

@@ -23,6 +23,10 @@ export interface SubscriptionAuthContext {
     roles: string[];
 }
 
+interface DataDriverWithData extends DataDriver {
+    data: unknown;
+}
+
 type RealTimeListenCollectionProps = ListenCollectionProps & {
     subscriptionId: string
 };
@@ -283,29 +287,18 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
             });
 
             // Send initial data
-            let entities;
-            if (this.driver) {
-                entities = await this.driver.fetchCollection({
-                    path: request.path,
-                    collection: collection,
-                    filter: request.filter,
-                    orderBy: request.orderBy,
-                    order: request.order,
-                    limit: request.limit,
-                    startAfter: request.startAfter,
-                    searchString: request.searchString
-                });
-            } else {
-                entities = await this.entityService.fetchCollection(request.path, {
+            const entities = await this.fetchCollectionWithAuth(
+                request.path,
+                {
                     filter: request.filter,
                     orderBy: request.orderBy,
                     order: request.order,
                     limit: request.limit,
                     startAfter: request.startAfter as Record<string, unknown> | undefined,
-                    databaseId: request.collection?.databaseId,
                     searchString: request.searchString
-                });
-            }
+                },
+                authContext
+            );
 
             this.sendCollectionUpdate(clientId, subscriptionId, entities);
 
@@ -338,20 +331,11 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
             });
 
             // Send initial data
-            let entity;
-            if (this.driver) {
-                entity = await this.driver.fetchEntity({
-                    path: request.path,
-                    entityId: request.entityId,
-                    collection: collection
-                });
-            } else {
-                entity = await this.entityService.fetchEntity(
-                    request.path,
-                    request.entityId,
-                    request.collection?.databaseId
-                );
-            }
+            const entity = await this.fetchEntityWithAuth(
+                request.path,
+                String(request.entityId),
+                authContext
+            );
 
             this.sendEntityUpdate(clientId, subscriptionId, entity || null);
 
@@ -565,29 +549,28 @@ export class RealtimeService extends EventEmitter implements RealtimeProvider {
                 searchString: collectionRequest.searchString
             });
 
-            // If we have auth context, wrap in a transaction with session vars
-            if (authContext) {
-                return await this.db.transaction(async (tx) => {
-                    await tx.execute(drizzleSql`SELECT set_config('app.user_id', ${authContext.userId}, true)`);
-                    await tx.execute(drizzleSql`SELECT set_config('app.user_roles', ${authContext.roles.join(",")}, true)`);
-                    await tx.execute(drizzleSql`SELECT set_config('app.jwt', ${JSON.stringify({ sub: authContext.userId,
-roles: authContext.roles })}, true)`);
-                    const txEntityService = new EntityService(tx, this.registry);
-                    let fetchedEntities;
-                    if (collectionRequest.searchString) {
-                        fetchedEntities = await txEntityService.searchEntities(
-                            notifyPath,
-                            collectionRequest.searchString,
-                            {
+            // Always wrap in a transaction with session vars, defaulting to anonymous context if missing
+            const activeAuth = authContext || { userId: "anon", roles: ["anon"] };
+            return await this.db.transaction(async (tx) => {
+                await tx.execute(drizzleSql`SELECT set_config('app.user_id', ${activeAuth.userId}, true)`);
+                await tx.execute(drizzleSql`SELECT set_config('app.user_roles', ${activeAuth.roles.join(",")}, true)`);
+                await tx.execute(drizzleSql`SELECT set_config('app.jwt', ${JSON.stringify({ sub: activeAuth.userId, roles: activeAuth.roles })}, true)`);
+                const txEntityService = new EntityService(tx, this.registry);
+                let fetchedEntities;
+                if (collectionRequest.searchString) {
+                    fetchedEntities = await txEntityService.searchEntities(
+                        notifyPath,
+                        collectionRequest.searchString,
+                        {
                             filter: collectionRequest.filter as FilterValues<string>,
                             orderBy: collectionRequest.orderBy,
                             order: collectionRequest.order,
                             limit: collectionRequest.limit,
                             databaseId: collectionRequest.databaseId
                         }
-                        );
-                    } else {
-                        fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
+                    );
+                } else {
+                    fetchedEntities = await txEntityService.fetchCollection(notifyPath, {
                         filter: collectionRequest.filter as FilterValues<string>,
                         orderBy: collectionRequest.orderBy,
                         order: collectionRequest.order,
@@ -596,52 +579,48 @@ roles: authContext.roles })}, true)`);
                         startAfter: collectionRequest.startAfter,
                         databaseId: collectionRequest.databaseId
                     });
-                    }
+                }
 
-                    // Re-apply `afterRead` lifecycle hooks to ensure consistent data structures
-                    // between the initial driver fetch and this RLS-bound refetch.
-                    const registryCollection = this.registry.getCollectionByPath(notifyPath);
-                    const resolvedCollection = collection ? { ...collection,
+                // Re-apply `afterRead` lifecycle hooks to ensure consistent data structures
+                // between the initial driver fetch and this RLS-bound refetch.
+                const registryCollection = this.registry.getCollectionByPath(notifyPath);
+                const resolvedCollection = collection ? { ...collection,
 ...registryCollection } as EntityCollection : registryCollection as EntityCollection;
 
-                    const callbacks = resolvedCollection?.callbacks;
-                    const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
-
-                    if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
-                        const contextForCallback = {
-                            user: { uid: authContext.userId,
-roles: authContext.roles },
-                            driver: this.driver,
-                            data: this.driver ? (this.driver as unknown as Record<string, unknown>).data : undefined
-                        } as unknown as RebaseCallContext;
-
-                        return await Promise.all(fetchedEntities.map(async (entity) => {
-                            let processedEntity = entity;
-                            if (callbacks?.afterRead) {
-                                processedEntity = await callbacks.afterRead({
-                                    collection: resolvedCollection,
-                                    path: notifyPath,
-                                    entity: processedEntity,
-                                    context: contextForCallback
-                                }) ?? processedEntity;
-                            }
-                            if (propertyCallbacks?.afterRead) {
-                                processedEntity = await propertyCallbacks.afterRead({
-                                    collection: resolvedCollection,
-                                    path: notifyPath,
-                                    entity: processedEntity,
-                                    context: contextForCallback
-                                }) ?? processedEntity;
-                            }
-                            return processedEntity;
-                        }));
-                    }
-
-                    return fetchedEntities;
-                });
-            }
+                const callbacks = resolvedCollection?.callbacks;
+                const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
+
+                if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+                    const contextForCallback = {
+                        user: { uid: activeAuth.userId, roles: activeAuth.roles },
+                        driver: this.driver,
+                        data: (this.driver && "data" in this.driver) ? (this.driver as DataDriverWithData).data : undefined
+                    } as unknown as RebaseCallContext;
+
+                    return await Promise.all(fetchedEntities.map(async (entity) => {
+                        let processedEntity = entity;
+                        if (callbacks?.afterRead) {
+                            processedEntity = await callbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
+                        }
+                        if (propertyCallbacks?.afterRead) {
+                            processedEntity = await propertyCallbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
+                        }
+                        return processedEntity;
+                    }));
+                }
 
-            return fetchFn();
+                return fetchedEntities;
+            });
         }
 
         // No driver — use entityService directly (no auth wrapping possible)
@@ -726,7 +705,7 @@ roles: authContext.roles },
      */
     private async fetchEntityWithAuth(
         notifyPath: string,
-        entityId: string,
+        entityId: string | number,
         authContext?: SubscriptionAuthContext
     ): Promise<Entity | undefined> {
         if (this.driver) {
@@ -737,56 +716,51 @@ roles: authContext.roles },
                 collection
             });
 
-            // If we have auth context, wrap in a transaction with session vars
-            if (authContext) {
-                return await this.db.transaction(async (tx) => {
-                    await tx.execute(drizzleSql`SELECT set_config('app.user_id', ${authContext.userId}, true)`);
-                    await tx.execute(drizzleSql`SELECT set_config('app.user_roles', ${authContext.roles.join(",")}, true)`);
-                    await tx.execute(drizzleSql`SELECT set_config('app.jwt', ${JSON.stringify({ sub: authContext.userId,
-roles: authContext.roles })}, true)`);
-                    const txEntityService = new EntityService(tx, this.registry);
-                    let processedEntity = await txEntityService.fetchEntity(notifyPath, entityId, collection?.databaseId);
-
-                    if (processedEntity) {
-                        const registryCollection = this.registry.getCollectionByPath(notifyPath);
-                        const resolvedCollection = collection ? { ...collection,
+            // Always wrap in a transaction with session vars, defaulting to anonymous context if missing
+            const activeAuth = authContext || { userId: "anon", roles: ["anon"] };
+            return await this.db.transaction(async (tx) => {
+                await tx.execute(drizzleSql`SELECT set_config('app.user_id', ${activeAuth.userId}, true)`);
+                await tx.execute(drizzleSql`SELECT set_config('app.user_roles', ${activeAuth.roles.join(",")}, true)`);
+                await tx.execute(drizzleSql`SELECT set_config('app.jwt', ${JSON.stringify({ sub: activeAuth.userId, roles: activeAuth.roles })}, true)`);
+                const txEntityService = new EntityService(tx, this.registry);
+                let processedEntity = await txEntityService.fetchEntity(notifyPath, entityId, collection?.databaseId);
+
+                if (processedEntity) {
+                    const registryCollection = this.registry.getCollectionByPath(notifyPath);
+                    const resolvedCollection = collection ? { ...collection,
 ...registryCollection } as EntityCollection : registryCollection as EntityCollection;
 
-                        const callbacks = resolvedCollection?.callbacks;
-                        const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
-
-                        if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
-                            const contextForCallback = {
-                                user: { uid: authContext.userId,
-roles: authContext.roles },
-                                driver: this.driver,
-                                data: this.driver ? (this.driver as unknown as Record<string, unknown>).data : undefined
-                            } as unknown as RebaseCallContext;
-
-                            if (callbacks?.afterRead) {
-                                processedEntity = await callbacks.afterRead({
-                                    collection: resolvedCollection,
-                                    path: notifyPath,
-                                    entity: processedEntity,
-                                    context: contextForCallback
-                                }) ?? processedEntity;
-                            }
-                            if (propertyCallbacks?.afterRead) {
-                                processedEntity = await propertyCallbacks.afterRead({
-                                    collection: resolvedCollection,
-                                    path: notifyPath,
-                                    entity: processedEntity,
-                                    context: contextForCallback
-                                }) ?? processedEntity;
-                            }
+                    const callbacks = resolvedCollection?.callbacks;
+                    const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
+
+                    if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+                        const contextForCallback = {
+                            user: { uid: activeAuth.userId, roles: activeAuth.roles },
+                            driver: this.driver,
+                            data: (this.driver && "data" in this.driver) ? (this.driver as DataDriverWithData).data : undefined
+                        } as unknown as RebaseCallContext;
+
+                        if (callbacks?.afterRead) {
+                            processedEntity = await callbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
+                        }
+                        if (propertyCallbacks?.afterRead) {
+                            processedEntity = await propertyCallbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
                         }
                     }
+                }
 
-                    return processedEntity;
-                });
-            }
-
-            return fetchFn();
+                return processedEntity;
+            });
         }
 
         return await this.entityService.fetchEntity(notifyPath, entityId);
@@ -865,6 +839,41 @@ roles: authContext.roles },
 
         return parentPaths;
     }
+    // =============================================================================
+    // Lifecycle / Cleanup
+    // =============================================================================
+
+    /**
+     * Gracefully tear down all realtime resources.
+     *
+     * This MUST be called during process shutdown, **before** `pool.end()`.
+     * It ensures:
+     *  1. All debounced refetch timers are cancelled (prevents queries after pool closes).
+     *  2. All subscription state and callbacks are cleared.
+     *  3. The dedicated LISTEN client (outside the pool) is disconnected.
+     *  4. All WebSocket clients are removed (but not forcefully closed — the
+     *     HTTP server close will handle that).
+     */
+    async destroy(): Promise<void> {
+        // 1. Cancel every pending debounced refetch timer
+        for (const [key, timer] of this.refetchTimers) {
+            clearTimeout(timer);
+            this.refetchTimers.delete(key);
+        }
+
+        // 2. Clear subscriptions and callbacks
+        this._subscriptions.clear();
+        this.subscriptionCallbacks.clear();
+
+        // 3. Disconnect the dedicated LISTEN client
+        await this.stopListening();
+
+        // 4. Drop client references (don't close — server.close drains them)
+        this.clients.clear();
+
+        this.debugLog("🧹 [RealtimeService] destroy() complete — all resources released.");
+    }
+
     // =============================================================================
     // Cross-Instance LISTEN/NOTIFY
     // =============================================================================

package/src/utils/drizzle-conditions.ts

@@ -1,5 +1,5 @@
 import { and, eq, or, sql, SQL, ilike, inArray } from "drizzle-orm";
-import { AnyPgColumn, PgTable } from "drizzle-orm/pg-core";
+import { AnyPgColumn, PgTable, PgVarchar, PgText, PgChar } from "drizzle-orm/pg-core";
 import { FilterValues, WhereFilterOp, Relation, JoinStep } from "@rebasepro/types";
 import { getColumnName, resolveCollectionRelations } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "../collections/PostgresCollectionRegistry";
@@ -64,8 +64,14 @@ export class DrizzleConditionBuilder {
     ): SQL | null {
         switch (op) {
             case "==":
+                if (value === null || value === undefined) {
+                    return sql`${column} IS NULL`;
+                }
                 return eq(column, value);
             case "!=":
+                if (value === null || value === undefined) {
+                    return sql`${column} IS NOT NULL`;
+                }
                 return sql`${column} != ${value}`;
             case ">":
                 return sql`${column} > ${value}`;
@@ -647,7 +653,15 @@ export class DrizzleConditionBuilder {
             if (p.type === "string" && !p.enum && p.isId !== "uuid") {
                 const fieldColumn = table[key as keyof typeof table] as AnyPgColumn;
                 if (fieldColumn) {
-                    searchConditions.push(ilike(fieldColumn, `%${searchString}%`));
+                    // Verify that the underlying database column supports string pattern-matching
+                    const supportsILike = 
+                        fieldColumn instanceof PgVarchar || 
+                        fieldColumn instanceof PgText || 
+                        fieldColumn instanceof PgChar ||
+                        (fieldColumn && typeof fieldColumn === "object" && !("columnType" in fieldColumn));
+                    if (supportsILike) {
+                        searchConditions.push(ilike(fieldColumn, `%${searchString}%`));
+                    }
                 }
             }
         }

package/src/websocket.ts

@@ -1,6 +1,6 @@
 import { RealtimeService } from "./services/realtimeService";
 import { PostgresBackendDriver } from "./PostgresBackendDriver";
-import { DataDriver, DeleteEntityProps, FetchCollectionProps, FetchEntityProps, SaveEntityProps, TableMetadata, BranchInfo, isSQLAdmin, isSchemaAdmin } from "@rebasepro/types";
+import { DataDriver, DeleteEntityProps, FetchCollectionProps, FetchEntityProps, SaveEntityProps, TableMetadata, BranchInfo, isSQLAdmin, isSchemaAdmin, AuthAdapter } from "@rebasepro/types";
 import { WebSocketServer, WebSocket } from "ws";
 import { Server } from "http";
 import { inspect } from "util";
@@ -9,9 +9,18 @@ import { extractUserFromToken, AccessTokenPayload } from "@rebasepro/server-core
 // @ts-ignore
 import { AuthConfig } from "@rebasepro/server-core";
 
+/**
+ * Normalized user identity for WebSocket sessions.
+ */
+interface WsUserIdentity {
+    userId: string;
+    roles: string[];
+    isAdmin: boolean;
+}
+
 interface ClientSession {
     ws: WebSocket;
-    user?: AccessTokenPayload;
+    user?: WsUserIdentity;
     authenticated: boolean;
     /** Sliding window message counter for rate limiting */
     messageCount: number;
@@ -38,11 +47,31 @@ const ADMIN_ONLY_TYPES = new Set([
     "LIST_BRANCHES"
 ]);
 
+/**
+ * Recursively extract the deepest error message from an error's cause chain (e.g., Drizzle wrapping a PG error).
+ */
+function extractErrorMessage(error: unknown): string {
+    if (!error) return "Unknown error";
+    if (typeof error === "object") {
+        const err = error as Record<string, unknown> & { cause?: unknown; message?: string };
+        if (err.cause) {
+            return extractErrorMessage(err.cause);
+        }
+        if (typeof err.message === "string") {
+            return err.message;
+        }
+    }
+    return String(error);
+}
+
 /**
  * Check if the current session belongs to an admin user.
  */
 function isAdminSession(session: ClientSession | undefined): boolean {
-    if (!session?.user?.roles) return false;
+    if (!session?.user) return false;
+    // Fast path: new adapter-aware sessions set isAdmin directly
+    if (session.user.isAdmin) return true;
+    if (!session.user.roles) return false;
     return session.user.roles.some((r: unknown) => {
         if (typeof r === "string") return r === "admin";
         if (r && typeof r === "object" && "isAdmin" in r) return (r as { isAdmin: boolean }).isAdmin;
@@ -55,7 +84,8 @@ export function createPostgresWebSocket(
     server: Server,
     realtimeService: RealtimeService,
     driver: PostgresBackendDriver,
-    authConfig?: AuthConfig
+    authConfig?: AuthConfig,
+    authAdapter?: AuthAdapter
 ) {
     const isProduction = process.env.NODE_ENV === "production";
     /** Debug logger that is suppressed in production to prevent PII/data leaks */
@@ -74,7 +104,11 @@ export function createPostgresWebSocket(
         console.error("❌ [WebSocket Server] Error:", err);
     });
 
-    const requireAuth = authConfig?.requireAuth !== false && authConfig?.jwtSecret;
+    // Auth is required when either: an adapter is present (secure by default),
+    // OR the config has a jwtSecret and requireAuth !== false.
+    const requireAuth = authAdapter
+        ? true
+        : (authConfig?.requireAuth !== false && !!authConfig?.jwtSecret);
 
     wss.on("connection", (ws) => {
         const clientId = `client_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
@@ -123,21 +157,53 @@ code } }
                         return;
                     }
 
-                    const user = extractUserFromToken(token);
-                    if (user) {
+                    // Use the auth adapter when available (custom auth, Clerk, etc.)
+                    // Fall back to JWT extraction otherwise.
+                    let verifiedUser: WsUserIdentity | null = null;
+
+                    if (authAdapter) {
+                        try {
+                            const adapterUser = authAdapter.verifyToken
+                                ? await authAdapter.verifyToken(token)
+                                : await authAdapter.verifyRequest(new Request("http://localhost/_ws_auth", {
+                                    headers: { Authorization: `Bearer ${token}` },
+                                }));
+
+                            if (adapterUser) {
+                                verifiedUser = {
+                                    userId: adapterUser.uid,
+                                    roles: adapterUser.roles,
+                                    isAdmin: adapterUser.isAdmin,
+                                };
+                            }
+                        } catch {
+                            // Adapter threw — treat as invalid token
+                        }
+                    } else {
+                        // Standard JWT path
+                        const jwtPayload = extractUserFromToken(token);
+                        if (jwtPayload) {
+                            verifiedUser = {
+                                userId: jwtPayload.userId,
+                                roles: jwtPayload.roles ?? [],
+                                isAdmin: (jwtPayload.roles ?? []).some((r: string) => r === "admin"),
+                            };
+                        }
+                    }
+
+                    if (verifiedUser) {
                         const session = clientSessions.get(clientId);
                         if (session) {
-                            session.user = user;
+                            session.user = verifiedUser;
                             session.authenticated = true;
                         }
                         wsDebug(`[WS] replying AUTH_SUCCESS for requestId ${requestId}`);
                         ws.send(JSON.stringify({
                             type: "AUTH_SUCCESS",
                             requestId,
-                            payload: { userId: user.userId,
-roles: user.roles }
+                            payload: { userId: verifiedUser.userId, roles: verifiedUser.roles }
                         }));
-                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${user.userId}`);
+                        wsDebug(`🔐 [WebSocket Server] Client ${clientId} authenticated as ${verifiedUser.userId}`);
                     } else {
                         wsDebug(`[WS] replying AUTH_ERROR for requestId ${requestId} (invalid token)`);
                         sendError("AUTH_ERROR", "INVALID_TOKEN", "Invalid or expired token");
@@ -183,17 +249,21 @@ roles: user.roles }
                 // Helper to get correctly scoped delegate for the current request
                 const getScopedDelegate = async (): Promise<DataDriver> => {
                     const session = clientSessions.get(clientId);
-                    if (session?.user && "withAuth" in driver && typeof (driver as unknown as Record<string, unknown>).withAuth === "function") {
+                    if ("withAuth" in driver && typeof (driver as unknown as Record<string, unknown>).withAuth === "function") {
                         try {
-                            // Map AccessTokenPayload back to User interface for withAuth (roles are already string IDs from JWT)
-                            const userForAuth: Record<string, unknown> = {
-                                uid: session.user.userId,
-                                roles: session.user.roles ?? []
-                            };
+                            const userForAuth = session?.user
+                                ? {
+                                    uid: session.user.userId,
+                                    roles: session.user.roles ?? []
+                                }
+                                : {
+                                    uid: "anon",
+                                    roles: ["anon"]
+                                };
                             return await (driver as unknown as { withAuth: (user: Record<string, unknown>) => Promise<DataDriver> }).withAuth(userForAuth);
                         } catch (e) {
-                            console.error("Failed to create authenticated delegate for WS request", e);
-                            return driver;
+                            console.error("Failed to create RLS scoped delegate for WS request", e);
+                            throw new Error("Internal authentication error");
                         }
                     }
                     return driver;
@@ -306,22 +376,29 @@ colors: true }));
 
                     case "EXECUTE_SQL": {
                         const { sql, options } = payload;
-                        const delegate = await getScopedDelegate();
-                        const admin = delegate.admin;
-                        if (!isSQLAdmin(admin)) {
-                            sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
-                            break;
-                        }
-                        const result = await admin.executeSql(sql, options);
-                        if (process.env.NODE_ENV !== "production") {
-                            wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+                        try {
+                            const delegate = await getScopedDelegate();
+                            const admin = delegate.admin;
+                            if (!isSQLAdmin(admin)) {
+                                sendError("ERROR", "NOT_SUPPORTED", "SQL execution is not available for this driver.");
+                                break;
+                            }
+                            const result = await admin.executeSql(sql, options);
+                            if (process.env.NODE_ENV !== "production") {
+                                wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
+                            }
+                            const response = {
+                                type: "EXECUTE_SQL_SUCCESS",
+                                payload: { result },
+                                requestId
+                            };
+                            ws.send(JSON.stringify(response));
+                        } catch (sqlError: unknown) {
+                            // This is a query execution error (e.g., syntax error, permission denied).
+                            // We return it cleanly to the client without logging a server stack trace.
+                            const errMsg = extractErrorMessage(sqlError);
+                            sendError("ERROR", "SQL_ERROR", errMsg);
                         }
-                        const response = {
-                            type: "EXECUTE_SQL_SUCCESS",
-                            payload: { result },
-                            requestId
-                        };
-                        ws.send(JSON.stringify(response));
                     }
                         break;
 
@@ -478,9 +555,8 @@ colors: true }));
                         // Attach auth context from the WS session so RLS-aware refetches work
                         const session = clientSessions.get(clientId);
                         const authContext = session?.user
-                            ? { userId: session.user.userId,
-roles: session.user.roles ?? [] }
-                            : undefined;
+                            ? { userId: session.user.userId, roles: session.user.roles ?? [] }
+                            : { userId: "anon", roles: ["anon"] };
                         // Let RealtimeService handle these messages
                         await realtimeService.handleClientMessage(clientId, {
                             type,