@rebasepro/server-postgresql 0.6.1 → 0.8.0

package/src/auth/services.ts

@@ -2,7 +2,7 @@ import { eq, getTableName, sql } from "drizzle-orm";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
 import { getTableConfig } from "drizzle-orm/pg-core";
 import type { RebasePgTable } from "../types";
-import { users, refreshTokens, passwordResetTokens, userIdentities } from "../schema/auth-schema";
+import { users, refreshTokens, passwordResetTokens, userIdentities, magicLinkTokens } from "../schema/auth-schema";
 import {
     UserRepository,
     RoleRepository,
@@ -15,6 +15,7 @@ import {
     CreateRoleData,
     RefreshTokenInfo,
     PasswordResetTokenInfo,
+    MagicLinkTokenInfo,
     UserIdentityData,
     ListUsersOptions,
     PaginatedUsersResult,
@@ -693,6 +694,68 @@ export class PasswordResetTokenService {
     }
 }
 
+/**
+ * Magic link token service.
+ * Handles magic link token storage for passwordless email login.
+ */
+export class MagicLinkTokenService {
+    private magicLinkTokensTable: RebasePgTable;
+
+    constructor(
+        private db: NodePgDatabase,
+        tableOrTables?: RebasePgTable | Partial<AuthSchemaTables>
+    ) {
+        this.magicLinkTokensTable = (magicLinkTokens as unknown as RebasePgTable);
+    }
+
+    private getQualifiedTableName(): string {
+        const name = getTableName(this.magicLinkTokensTable);
+        const schema = getTableConfig(this.magicLinkTokensTable).schema || "public";
+        return `"${schema}"."${name}"`;
+    }
+
+    async createToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void> {
+        // Delete any existing unused tokens for this user
+        const tableName = this.getQualifiedTableName();
+        await this.db.execute(sql`
+            DELETE FROM ${sql.raw(tableName)} 
+            WHERE user_id = ${userId} AND used_at IS NULL
+        `);
+
+        await this.db.insert(this.magicLinkTokensTable).values({
+            userId,
+            tokenHash,
+            expiresAt
+        });
+    }
+
+    async findValidByHash(tokenHash: string): Promise<MagicLinkTokenInfo | null> {
+        const tableName = this.getQualifiedTableName();
+        const result = await this.db.execute(sql`
+            SELECT user_id, expires_at 
+            FROM ${sql.raw(tableName)} 
+            WHERE token_hash = ${tokenHash} 
+              AND used_at IS NULL 
+              AND expires_at > NOW()
+        `);
+
+        if (result.rows.length === 0) return null;
+
+        const row = result.rows[0] as { user_id: string; expires_at: string | number | Date };
+        return {
+            userId: row.user_id,
+            expiresAt: new Date(row.expires_at)
+        };
+    }
+
+    async markAsUsed(tokenHash: string): Promise<void> {
+        await this.db
+            .update(this.magicLinkTokensTable)
+            .set({ usedAt: new Date() })
+            .where(eq(this.magicLinkTokensTable.tokenHash, tokenHash));
+    }
+}
+
 /**
  * PostgreSQL implementation of TokenRepository.
  * Combines refresh token and password reset token operations.
@@ -700,6 +763,7 @@ export class PasswordResetTokenService {
 export class PostgresTokenRepository implements TokenRepository {
     private refreshTokenService: RefreshTokenService;
     private passwordResetTokenService: PasswordResetTokenService;
+    private magicLinkTokenService: MagicLinkTokenService;
 
     constructor(
         private db: NodePgDatabase,
@@ -707,6 +771,7 @@ export class PostgresTokenRepository implements TokenRepository {
     ) {
         this.refreshTokenService = new RefreshTokenService(db, tableOrTables);
         this.passwordResetTokenService = new PasswordResetTokenService(db, tableOrTables);
+        this.magicLinkTokenService = new MagicLinkTokenService(db, tableOrTables);
     }
 
     // Refresh token operations
@@ -756,6 +821,20 @@ export class PostgresTokenRepository implements TokenRepository {
     async deleteExpiredTokens(): Promise<void> {
         await this.passwordResetTokenService.deleteExpired();
     }
+
+    // Magic link token operations
+
+    async createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void> {
+        await this.magicLinkTokenService.createToken(userId, tokenHash, expiresAt);
+    }
+
+    async findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null> {
+        return this.magicLinkTokenService.findValidByHash(tokenHash);
+    }
+
+    async markMagicLinkTokenUsed(tokenHash: string): Promise<void> {
+        await this.magicLinkTokenService.markAsUsed(tokenHash);
+    }
 }
 
 /**
@@ -955,6 +1034,20 @@ collectionPermissions: null }
         await this.tokenRepository.deleteExpiredTokens();
     }
 
+    // Magic link token operations
+
+    async createMagicLinkToken(userId: string, tokenHash: string, expiresAt: Date): Promise<void> {
+        await this.tokenRepository.createMagicLinkToken(userId, tokenHash, expiresAt);
+    }
+
+    async findValidMagicLinkToken(tokenHash: string): Promise<MagicLinkTokenInfo | null> {
+        return this.tokenRepository.findValidMagicLinkToken(tokenHash);
+    }
+
+    async markMagicLinkTokenUsed(tokenHash: string): Promise<void> {
+        await this.tokenRepository.markMagicLinkTokenUsed(tokenHash);
+    }
+
     // MFA operations (delegate to MfaService)
 
     private _mfaService: MfaService | null = null;

package/src/cli-errors.ts

@@ -0,0 +1,162 @@
+import chalk from "chalk";
+import { logger } from "@rebasepro/server-core";
+
+/**
+ * Detect whether an error (or AggregateError wrapping multiple attempts)
+ * represents an ECONNREFUSED — i.e. the database is simply not running.
+ *
+ * Handles:
+ * - Direct `{ code: "ECONNREFUSED" }` errors from Node `net`
+ * - `AggregateError` from dual-stack IPv4+IPv6 connection attempts
+ * - Drizzle's `cause`-wrapped pg errors
+ */
+export function isEconnrefused(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { code?: string; cause?: unknown; errors?: unknown[] };
+    if (e.code === "ECONNREFUSED") return true;
+    // AggregateError from Node net (dual-stack IPv4 + IPv6)
+    if (Array.isArray(e.errors)) {
+        return e.errors.some(inner =>
+            inner && typeof inner === "object" && (inner as { code?: string }).code === "ECONNREFUSED"
+        );
+    }
+    // Drizzle wraps the pg error in `cause`
+    if (e.cause && typeof e.cause === "object") {
+        return isEconnrefused(e.cause);
+    }
+    return false;
+}
+
+/**
+ * Detect PostgreSQL authentication failures.
+ * PG error codes: 28P01 (invalid_password), 28000 (invalid_authorization_specification)
+ */
+export function isAuthFailure(err: unknown): boolean {
+    if (!err || typeof err !== "object") return false;
+    const e = err as { code?: string; cause?: unknown };
+    if (e.code === "28P01" || e.code === "28000") return true;
+    if (e.cause && typeof e.cause === "object") {
+        return isAuthFailure(e.cause);
+    }
+    // Also check the message for common pg auth failure text
+    if ("message" in e && typeof (e as { message?: string }).message === "string") {
+        const msg = (e as { message: string }).message.toLowerCase();
+        if (msg.includes("password authentication failed") || msg.includes("no pg_hba.conf entry")) {
+            return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Parse host:port from a DATABASE_URL for display purposes.
+ */
+function parseHostInfo(databaseUrl: string): string {
+    try {
+        const parsed = new URL(databaseUrl);
+        return `${parsed.hostname}:${parsed.port || 5432}`;
+    } catch {
+        return "unknown";
+    }
+}
+
+/**
+ * Format a diagnostic banner for ECONNREFUSED errors.
+ */
+function formatConnectionRefusedBanner(databaseUrl: string): string {
+    const hostInfo = parseHostInfo(databaseUrl);
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  Cannot connect to PostgreSQL at ${hostInfo}\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  The database server is not running or is not accepting\n` +
+        `  connections. Common fixes:\n` +
+        `\n` +
+        `    • brew services start postgresql@18\n` +
+        `    • docker compose up -d postgres\n` +
+        `    • Verify DATABASE_URL in your .env file\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Format a diagnostic banner for authentication failures.
+ */
+function formatAuthFailureBanner(databaseUrl: string): string {
+    const hostInfo = parseHostInfo(databaseUrl);
+    let username = "unknown";
+    try {
+        username = new URL(databaseUrl).username || "unknown";
+    } catch { /* ignore */ }
+
+    return (
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `  ❌  Authentication failed for user "${username}" at ${hostInfo}\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n` +
+        `\n` +
+        `  PostgreSQL rejected the credentials. Common fixes:\n` +
+        `\n` +
+        `    • Check the username and password in DATABASE_URL\n` +
+        `    • Verify the user exists:  psql -c "\\du"\n` +
+        `    • Reset the password:  ALTER USER ${username} PASSWORD 'new_password';\n` +
+        `\n` +
+        `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`
+    );
+}
+
+/**
+ * Pre-flight check: verify that the database is reachable before running
+ * a heavy subprocess (Atlas, migrations, etc.).
+ *
+ * Exits with code 1 and a friendly banner on known failure modes.
+ * On unknown errors, logs a warning and allows the caller to proceed.
+ */
+export async function checkDatabaseConnectivity(databaseUrl: string): Promise<void> {
+    let client: import("pg").Client | undefined;
+    try {
+        const { Client } = await import("pg");
+        client = new Client({
+            connectionString: databaseUrl,
+            connectionTimeoutMillis: 5000
+        });
+        await client.connect();
+        await client.query("SELECT 1");
+    } catch (err: unknown) {
+        if (isEconnrefused(err)) {
+            logger.error(formatConnectionRefusedBanner(databaseUrl));
+            process.exit(1);
+        }
+        if (isAuthFailure(err)) {
+            logger.error(formatAuthFailureBanner(databaseUrl));
+            process.exit(1);
+        }
+        // Unknown error — warn but don't block; let the downstream tool surface details
+        logger.warn(chalk.yellow(`  ⚠  Could not verify database connectivity: ${err instanceof Error ? err.message : String(err)}`));
+        logger.warn(chalk.gray("    Proceeding anyway — the command may fail if the database is unreachable."));
+    } finally {
+        try {
+            await client?.end();
+        } catch {
+            // ignore cleanup errors
+        }
+    }
+}
+
+/**
+ * Post-hoc error diagnosis for direct database operations (e.g. applyPolicies).
+ * Returns a formatted diagnostic string if the error matches a known pattern,
+ * or null if unrecognized.
+ */
+export function diagnoseDbError(err: unknown, databaseUrl?: string): string | null {
+    if (isEconnrefused(err)) {
+        return formatConnectionRefusedBanner(databaseUrl || "");
+    }
+    if (isAuthFailure(err)) {
+        return formatAuthFailureBanner(databaseUrl || "");
+    }
+    return null;
+}

package/src/cli-helpers.ts

@@ -0,0 +1,183 @@
+import path from "path";
+import fs from "fs";
+import { execSync } from "child_process";
+import { fileURLToPath, pathToFileURL } from "url";
+import chalk from "chalk";
+import { logger } from "@rebasepro/server-core";
+import type { EntityCollection, Relation } from "@rebasepro/types";
+
+const getHelpersDirname = () => {
+    try {
+        return eval("__dirname");
+    } catch {
+        const err = new Error();
+        const stackLine = err.stack?.split("\n")[1] || "";
+        const match = stackLine.match(/\((.*?):\d+:\d+\)/) || stackLine.match(/at (.*?):\d+:\d+/);
+        if (match && match[1]) {
+            let cleanPath = match[1];
+            if (cleanPath.startsWith("file://")) {
+                cleanPath = fileURLToPath(cleanPath);
+            }
+            return path.dirname(cleanPath);
+        }
+        return process.cwd();
+    }
+};
+const __helpersDirname = getHelpersDirname();
+
+
+
+export function resolveLocalBin(binName: string): string | null {
+    // Try to find node_modules/.bin upwards from __helpersDirname first (package-relative)
+    let dir = __helpersDirname;
+    while (true) {
+        const candidate = path.join(dir, "node_modules", ".bin", binName);
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(dir);
+        if (parent === dir) break;
+        dir = parent;
+    }
+
+    let cwd = process.cwd();
+    // Try to find node_modules/.bin upwards from process.cwd()
+    while (true) {
+        const candidate = path.join(cwd, "node_modules", ".bin", binName);
+        if (fs.existsSync(candidate)) return candidate;
+        const parent = path.dirname(cwd);
+        if (parent === cwd) break;
+        cwd = parent;
+    }
+    // Fall back to globally installed binary via which/where
+    try {
+        const cmd = process.platform === "win32" ? `where ${binName}` : `which ${binName}`;
+        const globalPath = execSync(cmd, { encoding: "utf-8" }).trim().split("\n")[0].trim();
+        if (globalPath && fs.existsSync(globalPath)) return globalPath;
+    } catch {
+        // not found globally
+    }
+    return null;
+}
+
+export async function getTableIncludesFromCollections(collections: EntityCollection[]): Promise<string[]> {
+    const { getTableName, resolveCollectionRelations } = await import("@rebasepro/common");
+    const { isPostgresCollection } = await import("@rebasepro/types");
+
+    const includes: string[] = [];
+    for (const col of collections) {
+        const tableName = getTableName(col);
+        const schema = isPostgresCollection(col) && col.schema ? col.schema : "public";
+        if (tableName) {
+            includes.push(`${schema}.${tableName}`);
+        }
+
+        const resolvedRelations = resolveCollectionRelations(col);
+        for (const relation of Object.values(resolvedRelations) as Relation[]) {
+            if (relation.through) {
+                const junctionTableName = relation.through.table;
+                const targetCollection = relation.target();
+                const targetSchema = isPostgresCollection(targetCollection) && targetCollection.schema ? targetCollection.schema : "public";
+                includes.push(`${targetSchema}.${junctionTableName}`);
+            }
+        }
+    }
+    
+    return Array.from(new Set(includes));
+}
+
+export async function getTableIncludes(collectionsPath: string): Promise<string[]> {
+    const resolvedPath = path.resolve(collectionsPath);
+    const collections: EntityCollection[] = [];
+    if (fs.existsSync(resolvedPath)) {
+        const stats = fs.statSync(resolvedPath);
+        if (stats.isDirectory()) {
+            const files = fs.readdirSync(resolvedPath);
+            for (const file of files) {
+                if ((file.endsWith(".ts") || file.endsWith(".js")) &&
+                    !file.includes(".test.") &&
+                    !file.endsWith(".d.ts") &&
+                    file !== "index.ts" && file !== "index.js") {
+                    try {
+                        const filePath = path.join(resolvedPath, file);
+                        const fileUrl = pathToFileURL(filePath).href;
+                        const module = await import(fileUrl);
+                        if (module && module.default) {
+                            collections.push(module.default);
+                        }
+                    } catch {
+                        // ignore
+                    }
+                }
+            }
+        }
+    }
+
+    return getTableIncludesFromCollections(collections);
+}
+
+export function getDevDatabaseUrl(databaseUrl: string): string {
+    try {
+        const parsed = new URL(databaseUrl);
+        const dbName = parsed.pathname.slice(1);
+        parsed.pathname = `/${dbName}_dev_diff`;
+        return parsed.toString();
+    } catch {
+        return databaseUrl + "_dev_diff";
+    }
+}
+
+export async function ensureDevDatabaseExists(databaseUrl: string, devDatabaseUrl: string) {
+    try {
+        const { Client } = await import("pg");
+        const parsed = new URL(databaseUrl);
+        const devDbName = new URL(devDatabaseUrl).pathname.slice(1);
+        
+        parsed.pathname = "/postgres";
+        const client = new Client({ connectionString: parsed.toString() });
+        await client.connect();
+        try {
+            const res = await client.query("SELECT 1 FROM pg_database WHERE datname = $1", [devDbName]);
+            if (res.rowCount === 0) {
+                await client.query(`CREATE DATABASE "${devDbName}"`);
+                logger.info(chalk.gray(`  ✓ Created validation database "${devDbName}"`));
+            }
+        } finally {
+            await client.end();
+        }
+    } catch {
+        // Ignore, let Atlas handle connection failures
+    }
+}
+
+export async function getTableExcludes(databaseUrl: string, collectionsPath: string): Promise<string[]> {
+    const includes = await getTableIncludes(collectionsPath);
+    const excludes: string[] = ["atlas_schema_revisions.*", "auth.*"];
+    
+    try {
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            const res = await client.query(`
+                SELECT table_schema || '.' || table_name AS full_name
+                FROM information_schema.tables
+                WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+                  AND table_type IN ('BASE TABLE', 'VIEW');
+            `);
+            
+            const existingTables = res.rows.map((row: { full_name: string }) => row.full_name);
+            
+            for (const table of existingTables) {
+                if (!includes.includes(table)) {
+                    excludes.push(table);
+                }
+            }
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Failed to query database for unmapped tables: ${err instanceof Error ? err.message : String(err)}`));
+    }
+    
+    return excludes;
+}
+