@rebasepro/server-postgresql 0.7.0 → 0.8.0

package/src/schema/generate-drizzle-schema-logic.ts

@@ -1,6 +1,6 @@
 import { EntityCollection, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollection, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
 import { getPrimaryKeys } from "../services/entity-helpers";
-import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getEnumVarName, getTableName, getTableVarName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { createHash } from "crypto";
 import { logger } from "@rebasepro/server-core";
@@ -308,62 +308,9 @@ const getDrizzleColumn = (propName: string, prop: Property, collection: EntityCo
 };
 
 /**
- * Resolves a raw SQL string, replacing `{column_name}` with `${table.column_name}`.
- * The result is wrapped in a Drizzle sql`` template literal.
+ * Wraps a compiled SQL clause in a Drizzle `sql\`...\`` template literal.
  */
-const resolveRawSql = (expression: string): string => {
-    // Replace {column_name} with column_name directly (so Drizzle-kit can parse it as a static string)
-    const resolved = expression.replace(/\{(\w+)\}/g, (_, col) => col);
-    return `sql\`${resolved}\``;
-};
-
-/**
- * Wraps a SQL clause with a role check using AND.
- * Generates: `(<clause>) AND (string_to_array(auth.roles(), ',') && ARRAY['<role1>','<role2>'])`
- */
-const wrapWithRoleCheck = (clause: string, roles: string[]): string => {
-    const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-    const roleCondition = `string_to_array(auth.roles(), ',') && ${rolesArrayString}`;
-    return `sql\`(${unwrapSql(clause)}) AND (${roleCondition})\``;
-};
-
-/**
- * Extracts the inner expression from a `sql\`...\`` wrapper.
- */
-const unwrapSql = (sqlExpr: string): string => {
-    const match = sqlExpr.match(/^sql`(.*)`$/s);
-    return match ? match[1] : sqlExpr;
-};
-
-/**
- * Builds the USING clause for a policy based on shortcuts or raw SQL.
- */
-const buildUsingClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.using) {
-        return resolveRawSql(rule.using);
-    }
-    if (rule.access === "public") {
-        return "sql`true`";
-    }
-    if (rule.ownerField) {
-        const prop = collection.properties?.[rule.ownerField];
-        const colName = resolveColumnName(rule.ownerField, prop);
-        return `sql\`${colName} = auth.uid()\``;
-    }
-    return null;
-};
-
-/**
- * Builds the WITH CHECK clause for a policy based on shortcuts or raw SQL.
- * Falls back to the USING clause if not explicitly provided.
- */
-const buildWithCheckClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.withCheck) {
-        return resolveRawSql(rule.withCheck);
-    }
-    // For insert/update/all, fall back to using clause if withCheck not specified
-    return buildUsingClause(rule, collection);
-};
+const wrapSql = (clause: string): string => `sql\`${clause}\``;
 
 /**
  * Generates a deterministic hash based on the rule configuration.
@@ -378,7 +325,9 @@ const getPolicyNameHash = (rule: SecurityRule): string => {
         rol: rule.roles?.slice().sort(),
         pg: rule.pgRoles?.slice().sort(),
         u: rule.using,
-        w: rule.withCheck
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
     });
     return createHash("sha1").update(data).digest("hex").substring(0, 7);
 };
@@ -417,7 +366,6 @@ const generatePolicyCode = (collection: EntityCollection, rule: SecurityRule, in
  */
 const generateSinglePolicyCode = (collection: EntityCollection, rule: SecurityRule, operation: SecurityOperation, policyName: string): string => {
     const mode = rule.mode ?? "permissive";
-    const roles = rule.roles ? [...rule.roles].sort() : undefined;
 
     // Determine which clauses this operation needs:
     // SELECT, DELETE → USING only
@@ -426,26 +374,13 @@ const generateSinglePolicyCode = (collection: EntityCollection, rule: SecurityRu
     const needsUsing = operation !== "insert";
     const needsWithCheck = operation !== "select" && operation !== "delete";
 
-    let usingClause = needsUsing ? buildUsingClause(rule, collection) : null;
-    let withCheckClause = needsWithCheck ? buildWithCheckClause(rule, collection) : null;
-
-    // If roles are specified, wrap existing clauses with role check,
-    // or generate a roles-only clause.
-    if (roles && roles.length > 0) {
-        if (usingClause) {
-            usingClause = wrapWithRoleCheck(usingClause, roles);
-        } else if (needsUsing) {
-            // Roles-only rule (e.g. { operation: "select", roles: ["admin"] })
-            const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-            usingClause = `sql\`string_to_array(auth.roles(), ',') && ${rolesArrayString}\``;
-        }
-        if (withCheckClause) {
-            withCheckClause = wrapWithRoleCheck(withCheckClause, roles);
-        } else if (needsWithCheck) {
-            const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-            withCheckClause = `sql\`string_to_array(auth.roles(), ',') && ${rolesArrayString}\``;
-        }
-    }
+    // Desugar the rule (access / ownerField / roles / structured condition / raw
+    // SQL) into the shared PolicyExpression model, then compile to SQL — the same
+    // normalization the DDL generator and the client-side evaluator use.
+    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
+
+    let usingClause = needsUsing && usingExpr ? wrapSql(policyToPostgres(usingExpr, collection)) : null;
+    let withCheckClause = needsWithCheck && withCheckExpr ? wrapSql(policyToPostgres(withCheckExpr, collection)) : null;
 
     // Fallback: if we still have no clauses, deny all (safety net)
     if (!usingClause && needsUsing) {
@@ -617,7 +552,9 @@ export const generateSchema = async (collections: EntityCollection[], stripPolic
                 const enumVarName = getEnumVarName(collectionPath, propName);
                 const enumDbName = `${collectionPath}_${resolveColumnName(propName, prop)}`;
                 const values = Array.isArray(prop.enum)
-                    ? prop.enum.map(v => String(v.id ?? v))
+                    ? (prop.enum as (string | number | { id: string | number })[]).map((v: string | number | { id: string | number }) =>
+                        String(typeof v === "object" && v !== null && "id" in v ? v.id : v)
+                    )
                     : Object.keys(prop.enum);
                 if (values.length > 0) {
                     schemaContent += `export const ${enumVarName} = pgEnum(\"${enumDbName}\", [${values.map(v => `'${v}'`).join(", ")}]);\n`;

package/src/schema/generate-postgres-ddl-logic.ts

@@ -1,5 +1,5 @@
 import { EntityCollection, NumberProperty, Property, Relation, RelationProperty, SecurityOperation, SecurityRule, StringProperty, isPostgresCollection, DateProperty, ArrayProperty, MapProperty, ReferenceProperty, VectorProperty, BinaryProperty } from "@rebasepro/types";
-import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation } from "@rebasepro/common";
+import { getEnumVarName, getTableName, resolveCollectionRelations, findRelation, securityRuleToConditions, policyToPostgres } from "@rebasepro/common";
 import { toSnakeCase } from "@rebasepro/utils";
 import { createHash } from "crypto";
 import { getEffectiveSecurityRules } from "./auth-default-policies";
@@ -44,36 +44,6 @@ const isIdProperty = (propName: string, prop: Property, collection: EntityCollec
     return !hasExplicitId && propName === "id";
 };
 
-const resolveRawSql = (expression: string): string => {
-    return expression.replace(/\{(\w+)\}/g, (_, col) => col);
-};
-
-const unwrapSql = (sqlExpr: string): string => {
-    return sqlExpr;
-};
-
-const buildUsingClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.using) {
-        return resolveRawSql(rule.using);
-    }
-    if (rule.access === "public") {
-        return "true";
-    }
-    if (rule.ownerField) {
-        const prop = collection.properties?.[rule.ownerField];
-        const colName = resolveColumnName(rule.ownerField, prop);
-        return `${colName} = auth.uid()`;
-    }
-    return null;
-};
-
-const buildWithCheckClause = (rule: SecurityRule, collection: EntityCollection): string | null => {
-    if (rule.withCheck) {
-        return resolveRawSql(rule.withCheck);
-    }
-    return buildUsingClause(rule, collection);
-};
-
 const getPolicyNameHash = (rule: SecurityRule): string => {
     const data = JSON.stringify({
         a: rule.access,
@@ -84,7 +54,9 @@ const getPolicyNameHash = (rule: SecurityRule): string => {
         rol: rule.roles?.slice().sort(),
         pg: rule.pgRoles?.slice().sort(),
         u: rule.using,
-        w: rule.withCheck
+        w: rule.withCheck,
+        c: rule.condition,
+        ch: rule.check
     });
     return createHash("sha1").update(data).digest("hex").substring(0, 7);
 };
@@ -111,29 +83,18 @@ const generateSinglePolicyDdl = (collection: EntityCollection, rule: SecurityRul
     const tableName = getTableName(collection);
     const mode = (rule.mode ?? "permissive").toUpperCase();
     const operationUpper = operation.toUpperCase();
-    const roles = rule.roles ? [...rule.roles].sort() : undefined;
     const pgRoles = rule.pgRoles ? [...rule.pgRoles].sort() : ["public"];
 
     const needsUsing = operation !== "insert";
     const needsWithCheck = operation !== "select" && operation !== "delete";
 
-    let usingClause = needsUsing ? buildUsingClause(rule, collection) : null;
-    let withCheckClause = needsWithCheck ? buildWithCheckClause(rule, collection) : null;
+    // Desugar the rule (access / ownerField / roles / structured condition / raw
+    // SQL) into the shared PolicyExpression model, then compile to SQL. This is
+    // the same normalization the client-side evaluator uses, so DDL and UI agree.
+    const { usingExpr, withCheckExpr } = securityRuleToConditions(rule);
 
-    if (roles && roles.length > 0) {
-        const rolesArrayString = `ARRAY[${roles.map(r => `'${r}'`).join(",")}]`;
-        const roleCondition = `string_to_array(auth.roles(), ',') && ${rolesArrayString}`;
-        if (usingClause) {
-            usingClause = `(${usingClause}) AND (${roleCondition})`;
-        } else if (needsUsing) {
-            usingClause = roleCondition;
-        }
-        if (withCheckClause) {
-            withCheckClause = `(${withCheckClause}) AND (${roleCondition})`;
-        } else if (needsWithCheck) {
-            withCheckClause = roleCondition;
-        }
-    }
+    let usingClause = needsUsing && usingExpr ? policyToPostgres(usingExpr, collection) : null;
+    let withCheckClause = needsWithCheck && withCheckExpr ? policyToPostgres(withCheckExpr, collection) : null;
 
     if (!usingClause && needsUsing) {
         usingClause = "false";
@@ -273,7 +234,9 @@ export const generatePostgresDdl = async (
             if (("enum" in prop) && (prop.type === "string" || prop.type === "number") && prop.enum) {
                 const enumDbName = `${collectionTable}_${resolveColumnName(propName, prop)}`;
                 const values = Array.isArray(prop.enum)
-                    ? prop.enum.map(v => String(v.id ?? v))
+                    ? (prop.enum as (string | number | { id: string | number })[]).map((v: string | number | { id: string | number }) =>
+                        String(typeof v === "object" && v !== null && "id" in v ? v.id : v)
+                    )
                     : Object.keys(prop.enum);
                 if (values.length > 0) {
                     ddl += `CREATE TYPE "${schema}"."${enumDbName}" AS ENUM (${values.map(v => `'${v}'`).join(", ")});\n`;
@@ -421,7 +384,7 @@ export const generatePostgresDdl = async (
                         colDef += " PRIMARY KEY";
                     }
 
-                    if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true) {
+                    if ("isId" in prop && prop.isId !== "manual" && prop.isId !== true && prop.isId !== "increment") {
                         if (prop.isId === "uuid") {
                             colDef += " DEFAULT gen_random_uuid()";
                         } else if (prop.isId === "cuid") {

package/src/services/realtimeService.ts

@@ -651,9 +651,10 @@ roles: activeAuth.roles })}, true)`);
 ...registryCollection } as EntityCollection : registryCollection as EntityCollection;
 
                 const callbacks = resolvedCollection?.callbacks;
+                const globalCallbacks = this.registry?.getGlobalCallbacks();
                 const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
 
-                if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+                if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
                     const contextForCallback = {
                         user: { uid: activeAuth.userId,
 roles: activeAuth.roles },
@@ -663,6 +664,16 @@ roles: activeAuth.roles },
 
                     return await Promise.all(fetchedEntities.map(async (entity) => {
                         let processedEntity = entity;
+                        // 1. Global callbacks first
+                        if (globalCallbacks?.afterRead) {
+                            processedEntity = await globalCallbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
+                        }
+                        // 2. Collection callbacks second
                         if (callbacks?.afterRead) {
                             processedEntity = await callbacks.afterRead({
                                 collection: resolvedCollection,
@@ -671,6 +682,7 @@ roles: activeAuth.roles },
                                 context: contextForCallback
                             }) ?? processedEntity;
                         }
+                        // 3. Property callbacks third
                         if (propertyCallbacks?.afterRead) {
                             processedEntity = await propertyCallbacks.afterRead({
                                 collection: resolvedCollection,
@@ -797,9 +809,10 @@ roles: activeAuth.roles })}, true)`);
 ...registryCollection } as EntityCollection : registryCollection as EntityCollection;
 
                     const callbacks = resolvedCollection?.callbacks;
+                    const globalCallbacks = this.registry?.getGlobalCallbacks();
                     const propertyCallbacks = resolvedCollection?.properties ? buildPropertyCallbacks(resolvedCollection.properties) : undefined;
 
-                    if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+                    if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
                         const contextForCallback = {
                             user: { uid: activeAuth.userId,
 roles: activeAuth.roles },
@@ -807,6 +820,16 @@ roles: activeAuth.roles },
                             data: (this.driver && "data" in this.driver) ? (this.driver as DataDriverWithData).data : undefined
                         } as unknown as RebaseCallContext;
 
+                        // 1. Global callbacks first
+                        if (globalCallbacks?.afterRead) {
+                            processedEntity = await globalCallbacks.afterRead({
+                                collection: resolvedCollection,
+                                path: notifyPath,
+                                entity: processedEntity,
+                                context: contextForCallback
+                            }) ?? processedEntity;
+                        }
+                        // 2. Collection callbacks second
                         if (callbacks?.afterRead) {
                             processedEntity = await callbacks.afterRead({
                                 collection: resolvedCollection,
@@ -815,6 +838,7 @@ roles: activeAuth.roles },
                                 context: contextForCallback
                             }) ?? processedEntity;
                         }
+                        // 3. Property callbacks third
                         if (propertyCallbacks?.afterRead) {
                             processedEntity = await propertyCallbacks.afterRead({
                                 collection: resolvedCollection,

package/test/entity-callbacks-redaction.test.ts

@@ -0,0 +1,86 @@
+import { describe, it, expect } from "@jest/globals";
+import type { Entity, EntityAfterReadProps, EntityCallbacks } from "@rebasepro/types";
+
+/**
+ * Regression guard for the PII-redaction pattern.
+ *
+ * PII masking is defined in per-collection {@link EntityCallbacks.afterRead},
+ * which runs inside the DataDriver on every read path — REST, server-side
+ * `rebase.data`, and realtime.
+ *
+ * This suite proves the redaction contract:
+ *   1. the `afterRead` masker redacts values (and does not mutate the source), and
+ *   2. it is assignable to `EntityCallbacks.afterRead`, i.e. it is a valid
+ *      driver/realtime callback.
+ *
+ * That the driver invokes `afterRead` on `fetchCollection` (REST list /
+ * `rebase.data.find`) and `fetchEntity` (REST get / `rebase.data.findById`) is
+ * already covered by the "storageSource in Callbacks" suite in
+ * `postgresDataDriver.test.ts`; the realtime refetch invokes the identical
+ * callback in `realtimeService.ts` (`fetchCollectionWithAuth` /
+ * `fetchEntityWithAuth`).
+ */
+
+interface CustomerValues extends Record<string, unknown> {
+    email: string;
+    first_name: string;
+    phone: string;
+}
+
+const maskEmail = (email: string): string => {
+    const [local, domain] = email.split("@");
+    return local && domain ? `${local[0]}***@${domain}` : email;
+};
+
+/**
+ * A representative per-collection redactor. Typed to require only `entity`
+ * (a supertype of the full props), so it is assignable to
+ * `EntityCallbacks.afterRead` yet callable in isolation without constructing a
+ * full `RebaseCallContext`.
+ */
+const redactCustomer = (
+    { entity }: Pick<EntityAfterReadProps<CustomerValues>, "entity">
+): Entity<CustomerValues> => ({
+    ...entity,
+    values: {
+        ...entity.values,
+        email: maskEmail(entity.values.email),
+        phone: "***"
+    }
+});
+
+// Compile-time proof: the redactor is a valid EntityCallbacks.afterRead, so the
+// driver and realtime service accept and invoke it on every read path.
+const customerCallbacks: EntityCallbacks<CustomerValues> = { afterRead: redactCustomer };
+void customerCallbacks;
+
+describe("EntityCallbacks.afterRead PII redaction contract", () => {
+
+    const customer: Entity<CustomerValues> = {
+        id: "c1",
+        path: "customers",
+        values: { email: "jane.doe@acme.com", first_name: "Jane", phone: "+15551234567" }
+    };
+
+    it("masks redacted fields in the returned entity", () => {
+        const result = redactCustomer({ entity: customer });
+
+        expect(result.values.email).toBe("j***@acme.com");
+        expect(result.values.phone).toBe("***");
+    });
+
+    it("leaves non-redacted fields untouched", () => {
+        const result = redactCustomer({ entity: customer });
+
+        expect(result.values.first_name).toBe("Jane");
+        expect(result.id).toBe("c1");
+        expect(result.path).toBe("customers");
+    });
+
+    it("does not mutate the source entity", () => {
+        redactCustomer({ entity: customer });
+
+        expect(customer.values.email).toBe("jane.doe@acme.com");
+        expect(customer.values.phone).toBe("+15551234567");
+    });
+});

package/test/postgresDataDriver.test.ts

@@ -39,7 +39,8 @@ describe("PostgresBackendDriver", () => {
             getCollectionByPath: jest.fn().mockReturnValue({ slug: "test_coll",
 properties: {} }),
             getCollections: jest.fn().mockReturnValue([]),
-            getTable: jest.fn().mockReturnValue({})
+            getTable: jest.fn().mockReturnValue({}),
+            getGlobalCallbacks: jest.fn().mockReturnValue(undefined)
         } as any;
         delegate = new PostgresBackendDriver(mockDb, mockRealtimeService, mockRegistry);
     });