@rebasepro/server-postgresql 0.6.0 → 0.7.0

package/src/services/EntityPersistService.ts

@@ -40,19 +40,21 @@ export class EntityPersistService {
         const collection = getCollectionByPath(collectionPath, this.registry);
         const table = getTableForCollection(collection, this.registry);
         const idInfoArray = getPrimaryKeys(collection, this.registry);
-        const idInfo = idInfoArray[0];
-        const idField = table[idInfo.fieldName as keyof typeof table] as AnyPgColumn;
-
-        if (!idField) {
-            throw new Error(`ID field '${idInfo.fieldName}' not found in table for collection '${collectionPath}'`);
-        }
 
         const parsedIdObj = parseIdValues(entityId, idInfoArray);
-        const parsedId = parsedIdObj[idInfo.fieldName];
+
+        const conditions = [];
+        for (const info of idInfoArray) {
+            const field = table[info.fieldName as keyof typeof table] as AnyPgColumn;
+            if (!field) {
+                throw new Error(`ID field '${info.fieldName}' not found in table for collection '${collectionPath}'`);
+            }
+            conditions.push(eq(field, parsedIdObj[info.fieldName]));
+        }
 
         await this.db
             .delete(table)
-            .where(eq(idField, parsedId));
+            .where(and(...conditions));
     }
 
     /**
@@ -192,17 +194,17 @@ export class EntityPersistService {
             }
         }
 
-        // Transform relations to IDs, then sanitize
-        const serializedResult = serializeDataToServer(otherValues as M, collection.properties as Properties, collection, this.registry);
+        let savedId: string | number;
+        try {
+            // Transform relations to IDs, then sanitize
+            const serializedResult = serializeDataToServer(otherValues as M, collection.properties as Properties, collection, this.registry);
 
-        // Extract relation updates from the typed result
-        const inverseRelationUpdates = serializedResult.inverseRelationUpdates;
-        const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
+            // Extract relation updates from the typed result
+            const inverseRelationUpdates = serializedResult.inverseRelationUpdates;
+            const joinPathRelationUpdates = serializedResult.joinPathRelationUpdates;
 
-        const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
+            const entityData = sanitizeAndConvertDates(serializedResult.scalarData);
 
-        let savedId: string | number;
-        try {
             savedId = await this.db.transaction(async (tx) => {
                 let currentId: string | number;
 

package/src/services/entityService.ts

@@ -180,12 +180,37 @@ export class EntityService implements EntityRepository {
     /**
      * Execute raw SQL
      */
-    async executeSql(sqlText: string): Promise<Record<string, unknown>[]> {
+    async executeSql(sqlText: string, params?: unknown[]): Promise<Record<string, unknown>[]> {
         if (process.env.NODE_ENV !== "production") {
-            console.debug("Executing raw SQL:", sqlText);
+            console.debug("Executing raw SQL:", sqlText, params?.length ? `with ${params.length} params` : "");
         }
         const { sql } = await import("drizzle-orm");
-        const result = await this.db.execute(sql.raw(sqlText));
+
+        let result;
+        if (params && params.length > 0) {
+            // Build a parameterized query using Drizzle's sql tagged template.
+            // Split the SQL text on $1, $2, … placeholders and interleave
+            // with sql.param() calls so the underlying pg driver binds them safely.
+            const parts = sqlText.split(/\$(\d+)/);
+            const chunks: ReturnType<typeof sql.raw | typeof sql.param>[] = [];
+            for (let i = 0; i < parts.length; i++) {
+                if (i % 2 === 0) {
+                    // Literal SQL text fragment
+                    if (parts[i].length > 0) {
+                        chunks.push(sql.raw(parts[i]));
+                    }
+                } else {
+                    // Parameter reference — $N (1-indexed)
+                    const paramIndex = Number(parts[i]) - 1;
+                    chunks.push(sql.param(params[paramIndex]));
+                }
+            }
+            const query = sql.join(chunks, sql.raw(""));
+            result = await this.db.execute(query);
+        } else {
+            result = await this.db.execute(sql.raw(sqlText));
+        }
+
         const rows = result.rows;
         if (process.env.NODE_ENV !== "production") {
             console.debug(`SQL executed successfully. Returned ${Array.isArray(rows) ? rows.length : "non-array"} rows.`);

package/src/utils/pg-array-null-patch.ts

@@ -0,0 +1,42 @@
+import { getTableColumns } from "drizzle-orm";
+import { PgArray, PgTable } from "drizzle-orm/pg-core";
+import { logger } from "@rebasepro/server-core";
+
+/**
+ * Patches all PgArray columns on the given tables to handle NULL values safely.
+ *
+ * Drizzle ORM's `PgArray.mapFromDriverValue` calls `value.map(...)` without
+ * guarding against `null`. When a PostgreSQL native array column (`text[]`,
+ * `integer[]`, etc.) contains NULL, the pg driver returns `null` in JavaScript,
+ * and `null.map(...)` throws `TypeError: value.map is not a function`.
+ *
+ * This function walks every column of every registered table and, for any
+ * `PgArray` column, wraps its `mapFromDriverValue` to return `null` when the
+ * database value is nullish.
+ *
+ * This is a workaround for a known Drizzle ORM issue. Should be removed once
+ * Drizzle handles nullable arrays natively.
+ */
+export function patchPgArrayNullSafety(tables: Record<string, unknown>): void {
+    let patchedCount = 0;
+
+    for (const tableOrRelation of Object.values(tables)) {
+        if (!(tableOrRelation instanceof PgTable)) continue;
+
+        const columns = getTableColumns(tableOrRelation);
+        for (const column of Object.values(columns)) {
+            if (column instanceof PgArray) {
+                const original = column.mapFromDriverValue.bind(column);
+                column.mapFromDriverValue = function (value: unknown) {
+                    if (value == null) return null;
+                    return original(value as string | unknown[]);
+                };
+                patchedCount++;
+            }
+        }
+    }
+
+    if (patchedCount > 0) {
+        logger.debug(`[PgArray] Patched ${patchedCount} array column(s) for null-safety`);
+    }
+}

package/src/utils/pg-error-utils.ts

@@ -68,6 +68,22 @@ export function extractCauseMessage(error: unknown): string | null {
     return null;
 }
 
+/**
+ * Detect whether an error is specifically a role-switching permission failure
+ * (e.g. "permission denied to set role" or "must be member of role"),
+ * as opposed to a table-level permission denial.
+ *
+ * This is used by the backend driver to auto-disable role switching when the
+ * connection user lacks SET ROLE privileges, rather than surfacing a confusing
+ * error to the Studio SQL Editor user.
+ */
+export function isRoleSwitchingPermissionError(error: unknown): boolean {
+    const pgError = extractPgError(error);
+    if (!pgError || pgError.code !== "42501") return false;
+    const msg = pgError.message.toLowerCase();
+    return msg.includes("set role") || msg.includes("member of role");
+}
+
 /**
  * Translate a raw PostgreSQL error into a user-friendly message.
  *

package/src/utils/table-classification.ts

@@ -0,0 +1,16 @@
+/**
+ * Table Classification Utility
+ *
+ * Re-exports shared classification logic from @rebasepro/common.
+ * This module exists for backward compatibility — prefer importing directly
+ * from @rebasepro/common in new code.
+ */
+export {
+  type TableCategory,
+  REBASE_INTERNAL_SCHEMAS,
+  REBASE_INTERNAL_PREFIXES,
+  classifyTable,
+  isRebaseInternalTable,
+  detectJunctionTables,
+  JUNCTION_TABLES_SQL,
+} from "@rebasepro/common";

package/src/websocket.ts

@@ -403,6 +403,15 @@ colors: true }));
                             if (process.env.NODE_ENV !== "production") {
                                 wsDebug(`⚡ [WebSocket Server] SQL executed. Returned ${Array.isArray(result) ? result.length : "non-array"} rows.`);
                             }
+                            const auditSession = clientSessions.get(clientId);
+                            console.log("[SQL Audit] WebSocket SQL execution", JSON.stringify({
+                                sql: typeof sql === "string" ? sql.substring(0, 500) : sql,
+                                options,
+                                resultRows: Array.isArray(result) ? result.length : "unknown",
+                                userId: auditSession?.user?.userId ?? "unknown",
+                                roles: auditSession?.user?.roles ?? [],
+                                isAdmin: auditSession?.user?.isAdmin ?? false,
+                            }));
                             const response = {
                                 type: "EXECUTE_SQL_SUCCESS",
                                 payload: { result },

package/test/array-null-safety.test.ts

@@ -0,0 +1,335 @@
+import { describe, it, expect } from "@jest/globals";
+import {
+    serializePropertyToServer,
+    parsePropertyFromServer,
+    serializeDataToServer
+} from "../src/data-transformer";
+import type { Property, Properties, EntityCollection } from "@rebasepro/types";
+
+// ─────────────────────────────────────────────────────────────
+// Fixture helpers
+// ─────────────────────────────────────────────────────────────
+function makeCollection(slug: string, properties: Properties): EntityCollection {
+    return {
+        name: slug,
+        slug,
+        path: slug,
+        collectionType: "postgres",
+        tableName: slug,
+        properties
+    } as unknown as EntityCollection;
+}
+
+// ─────────────────────────────────────────────────────────────
+// Property fixtures
+// ─────────────────────────────────────────────────────────────
+const arrayOfStringsProp: Property = {
+    type: "array",
+    name: "Tags",
+    of: { type: "string", name: "Tag" }
+} as Property;
+
+const arrayOfNumbersProp: Property = {
+    type: "array",
+    name: "Scores",
+    of: { type: "number", name: "Score" }
+} as Property;
+
+const arrayOfMapsProp: Property = {
+    type: "array",
+    name: "Addresses",
+    of: {
+        type: "map",
+        name: "Address",
+        properties: {
+            street: { type: "string", name: "Street" },
+            city: { type: "string", name: "City" }
+        }
+    }
+} as Property;
+
+const arrayOneOfProp: Property = {
+    type: "array",
+    name: "Blocks",
+    oneOf: {
+        typeField: "type",
+        valueField: "value",
+        properties: {
+            text: { type: "string", name: "Text" } as Property,
+            number: { type: "number", name: "Number" } as Property
+        }
+    }
+} as Property;
+
+const arrayOfRelationsProp: Property = {
+    type: "array",
+    name: "Authors",
+    of: { type: "relation", name: "Author" }
+} as Property;
+
+// A bare array property without `of` or `oneOf`
+const bareArrayProp: Property = {
+    type: "array",
+    name: "RawArray"
+} as Property;
+
+// ─────────────────────────────────────────────────────────────
+// 1. serializePropertyToServer — array null safety
+// ─────────────────────────────────────────────────────────────
+describe("serializePropertyToServer — array null safety", () => {
+
+    // ── Null / undefined early return ──
+    it("returns null when value is null with array-of-strings property", () => {
+        expect(serializePropertyToServer(null, arrayOfStringsProp)).toBeNull();
+    });
+
+    it("returns undefined when value is undefined with array-of-strings property", () => {
+        expect(serializePropertyToServer(undefined, arrayOfStringsProp)).toBeUndefined();
+    });
+
+    // ── Empty array ──
+    it("returns [] when value is an empty array", () => {
+        expect(serializePropertyToServer([], arrayOfStringsProp)).toEqual([]);
+    });
+
+    // ── Null with different sub-types ──
+    it("returns null when value is null with array-of-numbers property", () => {
+        expect(serializePropertyToServer(null, arrayOfNumbersProp)).toBeNull();
+    });
+
+    it("returns null when value is null with array-of-maps property", () => {
+        expect(serializePropertyToServer(null, arrayOfMapsProp)).toBeNull();
+    });
+
+    it("returns null when value is null with array oneOf property", () => {
+        expect(serializePropertyToServer(null, arrayOneOfProp)).toBeNull();
+    });
+
+    // ── Non-array values (coerced to empty array) ──
+    it("coerces a non-array string to empty array for array property", () => {
+        expect(serializePropertyToServer("not-an-array", arrayOfStringsProp)).toEqual([]);
+    });
+
+    it("coerces a non-array number to empty array for array property", () => {
+        expect(serializePropertyToServer(42, arrayOfStringsProp)).toEqual([]);
+    });
+
+    it("coerces a non-array object to empty array for bare array property", () => {
+        const obj = { a: 1 };
+        expect(serializePropertyToServer(obj, bareArrayProp)).toEqual([]);
+    });
+
+    it("coerces a boolean to empty array for array property", () => {
+        expect(serializePropertyToServer(true, arrayOfStringsProp)).toEqual([]);
+        expect(serializePropertyToServer(false, arrayOfStringsProp)).toEqual([]);
+    });
+
+    // ── Arrays with null / undefined elements ──
+    it("handles array with null elements by passing each through sub-serialization", () => {
+        const result = serializePropertyToServer([null, "a", null], arrayOfStringsProp);
+        expect(result).toEqual([null, "a", null]);
+    });
+
+    it("handles array with undefined elements by passing each through sub-serialization", () => {
+        const result = serializePropertyToServer([undefined, "a"], arrayOfStringsProp);
+        expect(result).toEqual([undefined, "a"]);
+    });
+
+    // ── Array of relation objects with null entries ──
+    it("serializes array of relation objects with null entries correctly", () => {
+        const value = [{ id: "1" }, null, { id: "2" }];
+        const result = serializePropertyToServer(value, arrayOfRelationsProp);
+        // null entries pass through serializePropertyToServer for the sub-property
+        // which returns null for null values
+        expect(result).toEqual(["1", null, "2"]);
+    });
+
+    // ── Array of maps where some entries are null ──
+    it("handles array of maps where some entries are null gracefully", () => {
+        const value = [
+            { street: "123 Main", city: "NYC" },
+            null,
+            { street: "456 Oak", city: "LA" }
+        ];
+        const result = serializePropertyToServer(value, arrayOfMapsProp);
+        expect(result).toEqual([
+            { street: "123 Main", city: "NYC" },
+            null,
+            { street: "456 Oak", city: "LA" }
+        ]);
+    });
+
+    // ── Empty array with oneOf property ──
+    it("returns [] when value is an empty array with oneOf property", () => {
+        expect(serializePropertyToServer([], arrayOneOfProp)).toEqual([]);
+    });
+
+    // ── Nested array of arrays (unusual) ──
+    it("returns nested array of arrays as-is for bare array property", () => {
+        const nested = [["a", "b"], ["c"]];
+        // Without `of` or `oneOf`, the array case falls through to `return value`
+        expect(serializePropertyToServer(nested, bareArrayProp)).toEqual([["a", "b"], ["c"]]);
+    });
+});
+
+// ─────────────────────────────────────────────────────────────
+// 2. parsePropertyFromServer — array null safety
+// ─────────────────────────────────────────────────────────────
+describe("parsePropertyFromServer — array null safety", () => {
+    const dummyCollection = makeCollection("items", {
+        tags: arrayOfStringsProp
+    });
+
+    // ── Null / undefined early return ──
+    it("returns null when value is null with array property", () => {
+        expect(parsePropertyFromServer(null, arrayOfStringsProp, dummyCollection)).toBeNull();
+    });
+
+    it("returns undefined when value is undefined with array property", () => {
+        expect(parsePropertyFromServer(undefined, arrayOfStringsProp, dummyCollection)).toBeUndefined();
+    });
+
+    // ── Empty array ──
+    it("returns [] when value is an empty array with array-of-strings", () => {
+        expect(parsePropertyFromServer([], arrayOfStringsProp, dummyCollection)).toEqual([]);
+    });
+
+    // ── Non-array values (coerced to array) ──
+    it("coerces a non-array string to single-element array for array property", () => {
+        expect(parsePropertyFromServer("not-an-array", arrayOfStringsProp, dummyCollection)).toEqual(["not-an-array"]);
+    });
+
+    it("coerces a non-array number to empty array for array property", () => {
+        expect(parsePropertyFromServer(99, arrayOfStringsProp, dummyCollection)).toEqual([]);
+    });
+
+    // ── Null with oneOf ──
+    it("returns null when value is null with array oneOf property", () => {
+        expect(parsePropertyFromServer(null, arrayOneOfProp, dummyCollection)).toBeNull();
+    });
+
+    // ── Array with null elements ──
+    it("handles array with null elements for parsing gracefully", () => {
+        const result = parsePropertyFromServer([null, "a", null], arrayOfStringsProp, dummyCollection);
+        expect(result).toEqual([null, "a", null]);
+    });
+
+    // ── Falsy non-null values (coerced to array) ──
+    it("coerces falsy number 0 to empty array for array property", () => {
+        expect(parsePropertyFromServer(0, arrayOfStringsProp, dummyCollection)).toEqual([]);
+    });
+
+    it("coerces false to empty array for array property", () => {
+        expect(parsePropertyFromServer(false, arrayOfStringsProp, dummyCollection)).toEqual([]);
+    });
+
+    it("coerces empty string to single-element array for array property", () => {
+        expect(parsePropertyFromServer("", arrayOfStringsProp, dummyCollection)).toEqual([""]);
+    });
+});
+
+// ─────────────────────────────────────────────────────────────
+// 3. serializeDataToServer — entity with null array fields
+// ─────────────────────────────────────────────────────────────
+describe("serializeDataToServer — entity with null array fields", () => {
+    const tagsProperty: Property = {
+        type: "array",
+        name: "Tags",
+        of: { type: "string", name: "Tag" }
+    } as Property;
+
+    const categoriesProperty: Property = {
+        type: "array",
+        name: "Categories",
+        of: { type: "string", name: "Category" }
+    } as Property;
+
+    const metadataProperty: Property = {
+        type: "map",
+        name: "Metadata",
+        properties: {
+            labels: {
+                type: "array",
+                name: "Labels",
+                of: { type: "string", name: "Label" }
+            } as Property
+        }
+    } as Property;
+
+    const properties: Properties = {
+        tags: tagsProperty
+    };
+
+    // ── Null array field ──
+    it("serializes entity with tags: null — scalarData.tags should be null", () => {
+        const result = serializeDataToServer(
+            { tags: null },
+            properties
+        );
+        expect(result.scalarData.tags).toBeNull();
+    });
+
+    // ── Undefined array field ──
+    it("serializes entity with tags: undefined — tags value should be undefined in scalarData", () => {
+        const result = serializeDataToServer(
+            { tags: undefined },
+            properties
+        );
+        // Object.entries iterates keys even when value is undefined,
+        // and serializePropertyToServer returns undefined for undefined input
+        expect(result.scalarData.tags).toBeUndefined();
+    });
+
+    // ── Empty array field ──
+    it("serializes entity with tags: [] — scalarData.tags should be []", () => {
+        const result = serializeDataToServer(
+            { tags: [] },
+            properties
+        );
+        expect(result.scalarData.tags).toEqual([]);
+    });
+
+    // ── Multiple array fields, mixed null / populated ──
+    it("handles entity with multiple array fields, some null, some populated", () => {
+        const multiProperties: Properties = {
+            tags: tagsProperty,
+            categories: categoriesProperty
+        };
+
+        const result = serializeDataToServer(
+            { tags: null, categories: ["cat-a", "cat-b"] },
+            multiProperties
+        );
+        expect(result.scalarData.tags).toBeNull();
+        expect(result.scalarData.categories).toEqual(["cat-a", "cat-b"]);
+    });
+
+    // ── Nested map containing null array ──
+    it("handles entity with nested map containing array field that is null", () => {
+        const nestedProperties: Properties = {
+            metadata: metadataProperty
+        };
+
+        const result = serializeDataToServer(
+            { metadata: { labels: null } },
+            nestedProperties
+        );
+        // The map serializer recurses into sub-properties; the inner array gets null-checked
+        expect(result.scalarData.metadata).toEqual({ labels: null });
+    });
+
+    // ── All array fields null ──
+    it("handles entity with only array fields, all null — scalarData should have all null values", () => {
+        const allArrayProperties: Properties = {
+            tags: tagsProperty,
+            categories: categoriesProperty
+        };
+
+        const result = serializeDataToServer(
+            { tags: null, categories: null },
+            allArrayProperties
+        );
+        expect(result.scalarData.tags).toBeNull();
+        expect(result.scalarData.categories).toBeNull();
+    });
+});

package/test/auth-default-policies.test.ts

@@ -0,0 +1,89 @@
+import { EntityCollection, PostgresCollection } from "@rebasepro/types";
+import { generatePostgresPoliciesDdl } from "../src/schema/generate-postgres-ddl-logic";
+import { getEffectiveSecurityRules } from "../src/schema/auth-default-policies";
+
+describe("auth collection default RLS policies", () => {
+    const adminWrite = "string_to_array(auth.roles(), ',') && ARRAY['admin']";
+
+    it("injects admin write policies (permissive grant + restrictive gate) when an auth collection has no security rules", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            properties: {
+                id: { type: "string", isId: "uuid" },
+                roles: { type: "array", columnType: "text[]", of: { type: "string" } }
+            }
+        };
+
+        const ddl = generatePostgresPoliciesDdl([collection]);
+
+        expect(ddl).toContain("FORCE ROW LEVEL SECURITY");
+        // Restrictive gate exists for every write op.
+        expect(ddl).toContain("AS RESTRICTIVE FOR INSERT");
+        expect(ddl).toContain("AS RESTRICTIVE FOR UPDATE");
+        expect(ddl).toContain("AS RESTRICTIVE FOR DELETE");
+        expect(ddl).toContain(adminWrite);
+    });
+
+    it("keeps an author's permissive owner write rule but the restrictive gate still blocks non-admins", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            properties: {
+                id: { type: "string", isId: "uuid" },
+                roles: { type: "array", columnType: "text[]", of: { type: "string" } }
+            },
+            // The dangerous case: author lets users edit their own row.
+            securityRules: [
+                { name: "edit_own", operation: "update", ownerField: "id" }
+            ]
+        };
+
+        const rules = getEffectiveSecurityRules(collection);
+        const gate = rules.find(r => r.name === "users_require_admin_write");
+        const grant = rules.find(r => r.name === "users_default_admin_write");
+
+        // Author rule preserved.
+        expect(rules.find(r => r.name === "edit_own")).toBeDefined();
+        // Restrictive gate added covering all write ops.
+        expect(gate).toBeDefined();
+        expect(gate?.mode).toBe("restrictive");
+        expect(gate?.operations).toEqual(["insert", "update", "delete"]);
+        // Permissive grant added.
+        expect(grant).toBeDefined();
+        expect(grant?.mode).toBeUndefined();
+
+        // The generated SQL AND's the restrictive gate, so a self-update by a
+        // non-admin cannot pass — only admins/server can write.
+        const ddl = generatePostgresPoliciesDdl([collection]);
+        expect(ddl).toContain("AS RESTRICTIVE FOR UPDATE");
+    });
+
+    it("can be opted out with disableDefaultAuthPolicies", () => {
+        const collection: PostgresCollection = {
+            slug: "users",
+            table: "users",
+            name: "Users",
+            auth: true,
+            disableDefaultAuthPolicies: true,
+            properties: { id: { type: "string", isId: "uuid" } }
+        };
+
+        expect(getEffectiveSecurityRules(collection)).toHaveLength(0);
+    });
+
+    it("leaves non-auth collections untouched", () => {
+        const collection: EntityCollection = {
+            slug: "products",
+            table: "products",
+            name: "Products",
+            properties: { name: { type: "string" } }
+        };
+
+        expect(getEffectiveSecurityRules(collection)).toHaveLength(0);
+    });
+});