@rebasepro/server-postgresql 0.6.0 → 0.7.0

package/src/schema/auth-default-policies.ts

@@ -0,0 +1,90 @@
+import { EntityCollection, SecurityRule, SecurityOperation, AuthCollectionConfig, isPostgresCollection } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+
+/**
+ * Default RLS for authentication collections.
+ *
+ * Users are persisted through the same write path as any other collection —
+ * the only thing that distinguishes them is the `auth` flag. That means
+ * privileged columns (most importantly `roles`) would be editable by any
+ * authenticated user unless the collection author remembers to write a correct
+ * admin-only write policy.
+ *
+ * To make this safe by default, the schema generator injects two policies for
+ * every write operation on an auth collection. Enforcement lives in the
+ * database (RLS), so it applies to every write path — REST, WebSocket, and any
+ * internal caller — not just one entry point:
+ *
+ *  1. A **restrictive** admin gate. Restrictive policies are AND'd with every
+ *     other policy, so this guarantees a write is rejected unless the caller is
+ *     an admin (or the trusted server context) — even if the author also wrote
+ *     a permissive rule such as "a user may edit their own row". Without this,
+ *     a permissive owner rule would let a user change their own `roles`.
+ *
+ *  2. A **permissive** admin grant. Restrictive policies only constrain; at
+ *     least one permissive policy must also pass for the write to be allowed.
+ *     This grants the baseline write so admins (and the server context) can
+ *     manage users even when the collection has no other permissive write rule.
+ *
+ * Both mirror the framework's trusted-server convention: the write is allowed
+ * when there is no authenticated user context (`auth.uid() IS NULL`, used by
+ * the built-in auth flows that run as the service role) OR the caller holds the
+ * `admin` role. Net effect: only admins (or the server) can write the row, and
+ * therefore only admins can change privileged columns like `roles`.
+ *
+ * Author-provided write rules are preserved but cannot loosen this guarantee —
+ * a non-admin write is always blocked by the restrictive gate. To take full
+ * control of an auth collection's write authorization, set
+ * `disableDefaultAuthPolicies: true` on the collection.
+ */
+const ADMIN_WRITE_EXPR = "auth.uid() IS NULL OR string_to_array(auth.roles(), ',') && ARRAY['admin']";
+
+/** Write operations that must be admin-gated by default on auth collections. */
+const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
+
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection: EntityCollection): boolean {
+    const auth = collection.auth;
+    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
+}
+
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules`, plus, for auth collections, an
+ * auto-injected restrictive admin gate and permissive admin grant on every
+ * write operation. Together these guarantee only admins (or the trusted server
+ * context) can write the row.
+ *
+ * Non-auth collections, and auth collections that opt out via
+ * `disableDefaultAuthPolicies`, are returned unchanged.
+ */
+export function getEffectiveSecurityRules(collection: EntityCollection): SecurityRule[] {
+    const explicit = (isPostgresCollection(collection) ? collection.securityRules : undefined) ?? [];
+
+    if (!isAuthCollection(collection) || collection.disableDefaultAuthPolicies) {
+        return explicit;
+    }
+
+    const tableName = getTableName(collection);
+
+    // Restrictive gate: AND'd with all other policies, so no permissive rule
+    // (e.g. an owner "edit your own row" rule) can let a non-admin through.
+    const requireAdminGate: SecurityRule = {
+        name: `${tableName}_require_admin_write`,
+        mode: "restrictive",
+        operations: [...DEFAULT_GUARDED_OPS],
+        using: ADMIN_WRITE_EXPR,
+        withCheck: ADMIN_WRITE_EXPR
+    };
+
+    // Permissive grant: a restrictive policy alone denies everything, so this
+    // grants the baseline write to admins / the server context.
+    const allowAdminWrite: SecurityRule = {
+        name: `${tableName}_default_admin_write`,
+        operations: [...DEFAULT_GUARDED_OPS],
+        using: ADMIN_WRITE_EXPR,
+        withCheck: ADMIN_WRITE_EXPR
+    };
+
+    return [...explicit, allowAdminWrite, requireAdminGate];
+}

package/src/schema/auth-schema.ts

@@ -118,6 +118,18 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         createdAt: timestamp("created_at").defaultNow().notNull()
     });
 
+    /**
+     * Magic link tokens for passwordless email login
+     */
+    const magicLinkTokens = tableCreator("magic_link_tokens", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        expiresAt: timestamp("expires_at").notNull(),
+        usedAt: timestamp("used_at"),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    });
+
     return {
         usersSchema,
         users,
@@ -127,7 +139,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         userIdentities,
         mfaFactors,
         mfaChallenges,
-        recoveryCodes
+        recoveryCodes,
+        magicLinkTokens
     };
 }
 
@@ -144,6 +157,7 @@ export const userIdentities = defaultAuthSchema.userIdentities;
 export const mfaFactors = defaultAuthSchema.mfaFactors;
 export const mfaChallenges = defaultAuthSchema.mfaChallenges;
 export const recoveryCodes = defaultAuthSchema.recoveryCodes;
+export const magicLinkTokens = defaultAuthSchema.magicLinkTokens;
 
 // Relations
 export const usersRelations = relations(users, ({ many }) => ({
@@ -151,7 +165,8 @@ export const usersRelations = relations(users, ({ many }) => ({
     passwordResetTokens: many(passwordResetTokens),
     userIdentities: many(userIdentities),
     mfaFactors: many(mfaFactors),
-    recoveryCodes: many(recoveryCodes)
+    recoveryCodes: many(recoveryCodes),
+    magicLinkTokens: many(magicLinkTokens)
 }));
 
 export const refreshTokensRelations = relations(refreshTokens, ({ one }) => ({
@@ -197,6 +212,13 @@ export const recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({
     })
 }));
 
+export const magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({
+    user: one(users, {
+        fields: [magicLinkTokens.userId],
+        references: [users.id]
+    })
+}));
+
 // Type exports
 export type User = typeof users.$inferSelect;
 export type NewUser = typeof users.$inferInsert;
@@ -208,3 +230,4 @@ export type NewUserIdentity = typeof userIdentities.$inferInsert;
 export type MfaFactorRow = typeof mfaFactors.$inferSelect;
 export type MfaChallengeRow = typeof mfaChallenges.$inferSelect;
 export type RecoveryCodeRow = typeof recoveryCodes.$inferSelect;
+export type MagicLinkToken = typeof magicLinkTokens.$inferSelect;

package/src/schema/doctor.ts

@@ -143,8 +143,7 @@ export async function loadCollections(collectionsPath: string): Promise<EntityCo
                 const filePath = path.join(resolvedPath, file);
                 try {
                     const fileUrl = pathToFileURL(filePath).href;
-                    const dynamicImport = new Function("url", "return import(url)");
-                    const mod = await dynamicImport(fileUrl);
+                    const mod = await import(fileUrl);
                     if (mod?.default) {
                         collections.push(mod.default);
                     }
@@ -156,8 +155,7 @@ export async function loadCollections(collectionsPath: string): Promise<EntityCo
         }
     } else {
         const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
-        const dynamicImport = new Function("url", "return import(url)");
-        const imported = await dynamicImport(fileUrl);
+        const imported = await import(fileUrl);
         const loaded = imported.backendCollections || imported.collections;
         if (Array.isArray(loaded)) {
             collections.push(...loaded);

package/src/schema/generate-drizzle-schema-logic.ts

@@ -4,6 +4,7 @@ import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelatio
 import { toSnakeCase } from "@rebasepro/utils";
 import { createHash } from "crypto";
 import { logger } from "@rebasepro/server-core";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -98,7 +99,7 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: EntityCo
                 columnDefinition = `uuid("${colName}")`;
             } else if (stringProp.columnType === "uuid") {
                 columnDefinition = `uuid("${colName}")`;
-            } else if (stringProp.columnType === "text") {
+            } else if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) {
                 columnDefinition = `text("${colName}")`;
             } else if (stringProp.columnType === "char") {
                 columnDefinition = `char("${colName}")`;
@@ -707,8 +708,8 @@ export const generateSchema = async (collections: EntityCollection[], stripPolic
 
             schemaContent += `${Array.from(columns).join(",\n")}`;
 
-            const securityRules = isPostgresCollection(collection) ? collection.securityRules : undefined;
-            if (!stripPolicies && securityRules && securityRules.length > 0) {
+            const securityRules = getEffectiveSecurityRules(collection);
+            if (!stripPolicies && securityRules.length > 0) {
                 schemaContent += "\n}, (table) => ([\n";
                 securityRules.forEach((rule: SecurityRule, idx: number) => {
                     schemaContent += generatePolicyCode(collection, rule, idx);

package/src/schema/generate-drizzle-schema.ts

@@ -68,8 +68,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
                     const filePath = path.join(resolvedPath, file);
                     try {
                         const fileUrl = pathToFileURL(filePath).href;
-                        const dynamicImport = new Function("url", "return import(url)");
-                        const module = await dynamicImport(fileUrl);
+                        const module = await import(fileUrl);
                         if (module && module.default) {
                             collections.push(module.default);
                         }
@@ -81,8 +80,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
             }
         } else {
             const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
-            const dynamicImport = new Function("url", "return import(url)");
-            const imported = await dynamicImport(fileUrl);
+            const imported = await import(fileUrl);
             collections = imported.backendCollections || imported.collections;
         }
 
@@ -101,7 +99,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
             const outputDir = path.dirname(outputPath);
             await fsPromises.mkdir(outputDir, { recursive: true });
             await fsPromises.writeFile(outputPath, schemaContent);
-            logger.info("✅ Drizzle schema generated successfully at", { detail: outputPath });
+            logger.info(`✅ Drizzle schema generated successfully at ${outputPath}`);
         } else {
             logger.info("✅ Drizzle schema generated successfully.");
             logger.info(String(schemaContent));