@rebasepro/server-postgresql 0.6.1 → 0.8.0

package/src/data-transformer.ts

@@ -1,7 +1,7 @@
 import { eq, SQL } from "drizzle-orm";
 import { AnyPgColumn } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CollectionWithRelations, EntityCollection, Properties, Property, Relation, RelationProperty, Vector, BinaryProperty } from "@rebasepro/types";
+import { EntityCollection, Properties, Property, Relation, RelationProperty, Vector, BinaryProperty } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { DrizzleConditionBuilder } from "./utils/drizzle-conditions";
@@ -551,7 +551,7 @@ export function parsePropertyFromServer(value: unknown, property: Property, coll
                     relationDef = findRelation(resolvedRelations, propertyKey);
                 }
                 if (!relationDef) {
-                    relationDef = (collection as CollectionWithRelations).relations?.find((rel: Relation) => rel.relationName === (property as RelationProperty).relationName);
+                    relationDef = collection.relations?.find((rel: Relation) => rel.relationName === (property as RelationProperty).relationName);
                 }
 
                 if (!relationDef) {

package/src/schema/auth-default-policies.ts

@@ -0,0 +1,97 @@
+import { EntityCollection, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollection, policy } from "@rebasepro/types";
+import { getTableName } from "@rebasepro/common";
+
+/**
+ * Default RLS for authentication collections.
+ *
+ * Users are persisted through the same write path as any other collection —
+ * the only thing that distinguishes them is the `auth` flag. That means
+ * privileged columns (most importantly `roles`) would be editable by any
+ * authenticated user unless the collection author remembers to write a correct
+ * admin-only write policy.
+ *
+ * To make this safe by default, the schema generator injects two policies for
+ * every write operation on an auth collection. Enforcement lives in the
+ * database (RLS), so it applies to every write path — REST, WebSocket, and any
+ * internal caller — not just one entry point:
+ *
+ *  1. A **restrictive** admin gate. Restrictive policies are AND'd with every
+ *     other policy, so this guarantees a write is rejected unless the caller is
+ *     an admin (or the trusted server context) — even if the author also wrote
+ *     a permissive rule such as "a user may edit their own row". Without this,
+ *     a permissive owner rule would let a user change their own `roles`.
+ *
+ *  2. A **permissive** admin grant. Restrictive policies only constrain; at
+ *     least one permissive policy must also pass for the write to be allowed.
+ *     This grants the baseline write so admins (and the server context) can
+ *     manage users even when the collection has no other permissive write rule.
+ *
+ * Both mirror the framework's trusted-server convention: the write is allowed
+ * when there is no authenticated user context (`auth.uid() IS NULL`, used by
+ * the built-in auth flows that run as the service role) OR the caller holds the
+ * `admin` role. Net effect: only admins (or the server) can write the row, and
+ * therefore only admins can change privileged columns like `roles`.
+ *
+ * Author-provided write rules are preserved but cannot loosen this guarantee —
+ * a non-admin write is always blocked by the restrictive gate. To take full
+ * control of an auth collection's write authorization, set
+ * `disableDefaultAuthPolicies: true` on the collection.
+ */
+// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
+// exactly — the framework's most security-critical policy must be reflected
+// precisely, not left as an un-evaluable raw clause. Compiles to
+// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+const ADMIN_WRITE_EXPR: PolicyExpression = policy.or(
+    policy.not(policy.authenticated()),
+    policy.rolesOverlap(["admin"])
+);
+
+/** Write operations that must be admin-gated by default on auth collections. */
+const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
+
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection: EntityCollection): boolean {
+    const auth = collection.auth;
+    return auth === true || (typeof auth === "object" && (auth as AuthCollectionConfig)?.enabled === true);
+}
+
+/**
+ * Returns the security rules that should be applied to a collection: the
+ * author's explicit `securityRules`, plus, for auth collections, an
+ * auto-injected restrictive admin gate and permissive admin grant on every
+ * write operation. Together these guarantee only admins (or the trusted server
+ * context) can write the row.
+ *
+ * Non-auth collections, and auth collections that opt out via
+ * `disableDefaultAuthPolicies`, are returned unchanged.
+ */
+export function getEffectiveSecurityRules(collection: EntityCollection): SecurityRule[] {
+    const explicit = (isPostgresCollection(collection) ? collection.securityRules : undefined) ?? [];
+
+    if (!isAuthCollection(collection) || collection.disableDefaultAuthPolicies) {
+        return explicit;
+    }
+
+    const tableName = getTableName(collection);
+
+    // Restrictive gate: AND'd with all other policies, so no permissive rule
+    // (e.g. an owner "edit your own row" rule) can let a non-admin through.
+    const requireAdminGate: SecurityRule = {
+        name: `${tableName}_require_admin_write`,
+        mode: "restrictive",
+        operations: [...DEFAULT_GUARDED_OPS],
+        condition: ADMIN_WRITE_EXPR,
+        check: ADMIN_WRITE_EXPR
+    };
+
+    // Permissive grant: a restrictive policy alone denies everything, so this
+    // grants the baseline write to admins / the server context.
+    const allowAdminWrite: SecurityRule = {
+        name: `${tableName}_default_admin_write`,
+        operations: [...DEFAULT_GUARDED_OPS],
+        condition: ADMIN_WRITE_EXPR,
+        check: ADMIN_WRITE_EXPR
+    };
+
+    return [...explicit, allowAdminWrite, requireAdminGate];
+}

package/src/schema/auth-schema.ts

@@ -118,6 +118,18 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         createdAt: timestamp("created_at").defaultNow().notNull()
     });
 
+    /**
+     * Magic link tokens for passwordless email login
+     */
+    const magicLinkTokens = tableCreator("magic_link_tokens", {
+        id: uuid("id").defaultRandom().primaryKey(),
+        userId: uuid("user_id").notNull().references(() => users.id, { onDelete: "cascade" }),
+        tokenHash: varchar("token_hash", { length: 255 }).notNull().unique(),
+        expiresAt: timestamp("expires_at").notNull(),
+        usedAt: timestamp("used_at"),
+        createdAt: timestamp("created_at").defaultNow().notNull()
+    });
+
     return {
         usersSchema,
         users,
@@ -127,7 +139,8 @@ export function createAuthSchema(usersSchemaName = "rebase") {
         userIdentities,
         mfaFactors,
         mfaChallenges,
-        recoveryCodes
+        recoveryCodes,
+        magicLinkTokens
     };
 }
 
@@ -144,6 +157,7 @@ export const userIdentities = defaultAuthSchema.userIdentities;
 export const mfaFactors = defaultAuthSchema.mfaFactors;
 export const mfaChallenges = defaultAuthSchema.mfaChallenges;
 export const recoveryCodes = defaultAuthSchema.recoveryCodes;
+export const magicLinkTokens = defaultAuthSchema.magicLinkTokens;
 
 // Relations
 export const usersRelations = relations(users, ({ many }) => ({
@@ -151,7 +165,8 @@ export const usersRelations = relations(users, ({ many }) => ({
     passwordResetTokens: many(passwordResetTokens),
     userIdentities: many(userIdentities),
     mfaFactors: many(mfaFactors),
-    recoveryCodes: many(recoveryCodes)
+    recoveryCodes: many(recoveryCodes),
+    magicLinkTokens: many(magicLinkTokens)
 }));
 
 export const refreshTokensRelations = relations(refreshTokens, ({ one }) => ({
@@ -197,6 +212,13 @@ export const recoveryCodesRelations = relations(recoveryCodes, ({ one }) => ({
     })
 }));
 
+export const magicLinkTokensRelations = relations(magicLinkTokens, ({ one }) => ({
+    user: one(users, {
+        fields: [magicLinkTokens.userId],
+        references: [users.id]
+    })
+}));
+
 // Type exports
 export type User = typeof users.$inferSelect;
 export type NewUser = typeof users.$inferInsert;
@@ -208,3 +230,4 @@ export type NewUserIdentity = typeof userIdentities.$inferInsert;
 export type MfaFactorRow = typeof mfaFactors.$inferSelect;
 export type MfaChallengeRow = typeof mfaChallenges.$inferSelect;
 export type RecoveryCodeRow = typeof recoveryCodes.$inferSelect;
+export type MagicLinkToken = typeof magicLinkTokens.$inferSelect;

package/src/schema/doctor.ts

@@ -143,8 +143,7 @@ export async function loadCollections(collectionsPath: string): Promise<EntityCo
                 const filePath = path.join(resolvedPath, file);
                 try {
                     const fileUrl = pathToFileURL(filePath).href;
-                    const dynamicImport = new Function("url", "return import(url)");
-                    const mod = await dynamicImport(fileUrl);
+                    const mod = await import(fileUrl);
                     if (mod?.default) {
                         collections.push(mod.default);
                     }
@@ -156,8 +155,7 @@ export async function loadCollections(collectionsPath: string): Promise<EntityCo
         }
     } else {
         const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
-        const dynamicImport = new Function("url", "return import(url)");
-        const imported = await dynamicImport(fileUrl);
+        const imported = await import(fileUrl);
         const loaded = imported.backendCollections || imported.collections;
         if (Array.isArray(loaded)) {
             collections.push(...loaded);

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,9 +1,10 @@
 import { EntityCollection, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollection, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/entity-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { createHash } from "crypto";
 import { logger } from "@rebasepro/server-core";
+import { getEffectiveSecurityRules } from "./auth-default-policies";
 // --- Helper Functions ---
 
 /**
@@ -98,7 +99,7 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: EntityCo
                 columnDefinition = `uuid("${colName}")`;
             } else if (stringProp.columnType === "uuid") {
                 columnDefinition = `uuid("${colName}")`;
-            } else if (stringProp.columnType === "text") {
+            } else if (stringProp.columnType === "text" || stringProp.ui?.markdown || stringProp.ui?.multiline) {
                 columnDefinition = `text("${colName}")`;
             } else if (stringProp.columnType === "char") {
                 columnDefinition = `char("${colName}")`;
@@ -307,62 +308,9 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: EntityCo
 };
 
 /**
- * Resolves a raw SQL string, replacing `{column_name}` with `${table.column_name}`.
- * The result is wrapped in a Drizzle sql`` template literal.
+ * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
  */
-const resolveRawSql = (expression: string): string => {
-    // Replace {column_name} with column_name directly (so Drizzle-kit can parse it as a static string)
-    const resolved = expression.replace(/\{(\w+)\}/g, (_, col) => col);
-    return `sql\`${resolved}\``;
-};
-
-/**
- * Wraps a SQL clause with a role check using AND.
- * Generates: `(<clause>) AND (string_to_array(auth.roles(), ',') && ARRAY['<role1>','<role2>'])`
- */
-const wrapWithRoleCheck = (clause: string, roles: string[]): string => {
-    const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-    const roleCondition = `string_to_array(auth.roles(), ',') && ${rolesArrayString}`;
-    return `sql\`(${unwrapSql(clause)}) AND (${roleCondition})\``;
-};
-
-/**
- * Extracts the inner expression from a `sql\`...\`` wrapper.
- */
-const unwrapSql = (sqlExpr: string): string => {
-    const match = sqlExpr.match(/^sql`(.*)`$/s);
-    return match ? match[1] : sqlExpr;
-};
-
-/**
- * Builds the USING clause for a policy based on shortcuts or raw SQL.
- */
-const buildUsingClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.using) {
-        return resolveRawSql(rule.using);
-    }
-    if (rule.access === "public") {
-        return "sql`true`";
-    }
-    if (rule.ownerField) {
-        const prop = collection.properties?.[rule.ownerField];
-        const colName = resolveColumnName(rule.ownerField, prop);
-        return `sql\`${colName} = auth.uid()\``;
-    }
-    return null;
-};
-
-/**
- * Builds the WITH CHECK clause for a policy based on shortcuts or raw SQL.
- * Falls back to the USING clause if not explicitly provided.
- */
-const buildWithCheckClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.withCheck) {
-        return resolveRawSql(rule.withCheck);
-    }
-    // For insert/update/all, fall back to using clause if withCheck not specified
-    return buildUsingClause(rule, collection);
-};
+const wrapSql = (clause: string): string => `sql\`${clause}\``;
 
 /**
  * Generates a deterministic hash based on the rule configuration.
@@ -377,7 +325,9 @@ const getPolicyNameHash = (rule: SecurityRule): string => {
         rol: rule.roles?.slice().sort(),
         pg: rule.pgRoles?.slice().sort(),
         u: rule.using,
-        w: rule.withCheck
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
     });
     return createHash("sha1").update(data).digest("hex").substring(0, 7);
 };
@@ -416,7 +366,6 @@ const generatePolicyCode = (collection: EntityCollection, rule: SecurityRule, in
  */
 const generateSinglePolicyCode = (collection: EntityCollection, rule: SecurityRule, operation: SecurityOperation, policyName: string): string => {
     const mode = rule.mode ?? "permissive";
-    const roles = rule.roles ? [...rule.roles].sort() : undefined;
 
     // Determine which clauses this operation needs:
     // SELECT, DELETE → USING only
@@ -425,26 +374,13 @@ const generateSinglePolicyCode = (collection: EntityCollection, rule: SecurityRu
     const needsUsing = operation !== "insert";
     const needsWithCheck = operation !== "select" && operation !== "delete";
 
-    let usingClause = needsUsing ? buildUsingClause(rule, collection) : null;
-    let withCheckClause = needsWithCheck ? buildWithCheckClause(rule, collection) : null;
-
-    // If roles are specified, wrap existing clauses with role check,
-    // or generate a roles-only clause.
-    if (roles && roles.length > 0) {
-        if (usingClause) {
-            usingClause = wrapWithRoleCheck(usingClause, roles);
-        } else if (needsUsing) {
-            // Roles-only rule (e.g. { operation: "select", roles: ["admin"] })
-            const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-            usingClause = `sql\`string_to_array(auth.roles(), ',') && ${rolesArrayString}\``;
-        }
-        if (withCheckClause) {
-            withCheckClause = wrapWithRoleCheck(withCheckClause, roles);
-        } else if (needsWithCheck) {
-            const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-            withCheckClause = `sql\`string_to_array(auth.roles(), ',') && ${rolesArrayString}\``;
-        }
-    }
+    // Desugar the rule (access / ownerField / roles / structured condition / raw
+    // SQL) into the shared PolicyExpression model, then compile to SQL — the same
+    // normalization the DDL generator and the client-side evaluator use.
+    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+
+    let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection)) : null;
+    let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection)) : null;
 
     // Fallback: if we still have no clauses, deny all (safety net)
     if (!usingClause && needsUsing) {
@@ -616,7 +552,9 @@ export const generateSchema = async (collections: EntityCollection[], stripPolic
                 const enumVarName = getEnumVarName(collectionPath, propName);
                 const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
                 const values = Array.isArray(prop.enum)
-                    ? prop.enum.map(v => String(v.id ?? v))
+                    ? (prop.enum as (string | number | { id: string | number })[]).map((v: string | number | { id: string | number }) =>
+                        String(typeof v === "object" && v !== null && "id" in v ? v.id : v)
+                    )
                     : Object.keys(prop.enum);
                 if (values.length > 0) {
                     schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map(v => `'${v}'`).join(", ")}]);\n`;
@@ -707,8 +645,8 @@ export const generateSchema = async (collections: EntityCollection[], stripPolic
 
             schemaContent += `${Array.from(columns).join(",\n")}`;
 
-            const securityRules = isPostgresCollection(collection) ? collection.securityRules : undefined;
-            if (!stripPolicies && securityRules && securityRules.length > 0) {
+            const securityRules = getEffectiveSecurityRules(collection);
+            if (!stripPolicies && securityRules.length > 0) {
                 schemaContent += "\n}, (table) => ([\n";
                 securityRules.forEach((rule: SecurityRule, idx: number) => {
                     schemaContent += generatePolicyCode(collection, rule, idx);

package/src/schema/generate-drizzle-schema.ts

@@ -68,8 +68,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
                     const filePath = path.join(resolvedPath, file);
                     try {
                         const fileUrl = pathToFileURL(filePath).href;
-                        const dynamicImport = new Function("url", "return import(url)");
-                        const module = await dynamicImport(fileUrl);
+                        const module = await import(fileUrl);
                         if (module && module.default) {
                             collections.push(module.default);
                         }
@@ -81,8 +80,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
             }
         } else {
             const fileUrl = pathToFileURL(resolvedPath).href + `?t=${Date.now()}`;
-            const dynamicImport = new Function("url", "return import(url)");
-            const imported = await dynamicImport(fileUrl);
+            const imported = await import(fileUrl);
             collections = imported.backendCollections || imported.collections;
         }
 
@@ -101,7 +99,7 @@ const runGeneration = async (collectionsFilePath?: string, outputPath?: string)
             const outputDir = path.dirname(outputPath);
             await fsPromises.mkdir(outputDir, { recursive: true });
             await fsPromises.writeFile(outputPath, schemaContent);
-            logger.info("✅ Drizzle schema generated successfully at", { detail: outputPath });
+            logger.info(`✅ Drizzle schema generated successfully at ${outputPath}`);
         } else {
             logger.info("✅ Drizzle schema generated successfully.");
             logger.info(String(schemaContent));