@rebasepro/server-postgresql 0.7.0 → 0.8.0

package/src/PostgresBackendDriver.ts

@@ -133,6 +133,7 @@ export class PostgresBackendDriver implements DataDriver {
         if (!collection && !path) return {
             collection: undefined,
             callbacks: undefined,
+            globalCallbacks: undefined,
             propertyCallbacks: undefined
         };
         const registryCollection = this.registry?.getCollectionByPath(path);
@@ -144,6 +145,7 @@ export class PostgresBackendDriver implements DataDriver {
             : collection as EntityCollection<M>;
 
         const callbacks = resolvedCollection?.callbacks;
+        const globalCallbacks = this.registry?.getGlobalCallbacks();
         const properties = resolvedCollection?.properties;
         let propertyCallbacks;
         if (properties) {
@@ -152,6 +154,7 @@ export class PostgresBackendDriver implements DataDriver {
         return {
             collection: resolvedCollection,
             callbacks,
+            globalCallbacks,
             propertyCallbacks
         };
     }
@@ -184,13 +187,24 @@ export class PostgresBackendDriver implements DataDriver {
         const {
             collection: resolvedCollection,
             callbacks,
+            globalCallbacks,
             propertyCallbacks
         } = this.resolveCollectionCallbacks(collection, path);
 
-        if (callbacks?.afterRead || propertyCallbacks?.afterRead) {
+        if (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead) {
             const contextForCallback = this.buildCallContext();
             return Promise.all(entities.map(async (entity) => {
                 let fetched = entity;
+                // 1. Global callbacks first
+                if (globalCallbacks?.afterRead) {
+                    fetched = await globalCallbacks.afterRead({
+                        collection: resolvedCollection as unknown as EntityCollection,
+                        path,
+                        entity: fetched as unknown as Entity<Record<string, unknown>>,
+                        context: contextForCallback
+                    }) as unknown as Entity<M>;
+                }
+                // 2. Collection callbacks second
                 if (callbacks?.afterRead) {
                     fetched = await callbacks.afterRead({
                         collection: resolvedCollection as EntityCollection<M>,
@@ -199,13 +213,14 @@ export class PostgresBackendDriver implements DataDriver {
                         context: contextForCallback
                     }) ?? fetched;
                 }
+                // 3. Property callbacks third
                 if (propertyCallbacks?.afterRead) {
                     fetched = await propertyCallbacks.afterRead({
-                        collection: resolvedCollection as EntityCollection<M>,
+                        collection: resolvedCollection as unknown as EntityCollection,
                         path,
-                        entity: fetched,
+                        entity: fetched as unknown as Entity<Record<string, unknown>>,
                         context: contextForCallback
-                    }) as Entity<M> ?? fetched;
+                    }) as unknown as Entity<M>;
                 }
                 return fetched;
             }));
@@ -293,26 +308,38 @@ export class PostgresBackendDriver implements DataDriver {
         const {
             collection: resolvedCollection,
             callbacks,
+            globalCallbacks,
             propertyCallbacks
         } = this.resolveCollectionCallbacks(collection, path);
 
-        if (entity && (callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+        if (entity && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
             const contextForCallback = this.buildCallContext();
+            // 1. Global callbacks first
+            if (globalCallbacks?.afterRead) {
+                entity = await globalCallbacks.afterRead({
+                    collection: resolvedCollection as unknown as EntityCollection,
+                    path,
+                    entity: entity as unknown as Entity<Record<string, unknown>>,
+                    context: contextForCallback
+                }) as unknown as Entity<M>;
+            }
+            // 2. Collection callbacks second
             if (callbacks?.afterRead) {
                 entity = await callbacks.afterRead({
                     collection: resolvedCollection as EntityCollection<M>,
                     path,
-                    entity,
+                    entity: entity!,
                     context: contextForCallback
-                }) ?? entity;
+                });
             }
+            // 3. Property callbacks third
             if (propertyCallbacks?.afterRead) {
                 entity = await propertyCallbacks.afterRead({
-                    collection: resolvedCollection as EntityCollection<M>,
+                    collection: resolvedCollection as unknown as EntityCollection,
                     path,
-                    entity,
+                    entity: entity as unknown as Entity<Record<string, unknown>>,
                     context: contextForCallback
-                }) as Entity<M> ?? entity;
+                }) as unknown as Entity<M>;
             }
         }
 
@@ -375,6 +402,7 @@ export class PostgresBackendDriver implements DataDriver {
         const {
             collection: resolvedCollection,
             callbacks,
+            globalCallbacks,
             propertyCallbacks
         } = this.resolveCollectionCallbacks(collection, path);
 
@@ -390,7 +418,22 @@ export class PostgresBackendDriver implements DataDriver {
             }
         }
 
-        if (callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+        if (globalCallbacks?.beforeSave || callbacks?.beforeSave || propertyCallbacks?.beforeSave) {
+            // 1. Global callbacks first
+            if (globalCallbacks?.beforeSave) {
+                const result = await globalCallbacks.beforeSave({
+                    collection: resolvedCollection as unknown as EntityCollection,
+                    path,
+                    entityId,
+                    values: updatedValues,
+                    previousValues: previousValuesForHistory,
+                    status,
+                    context: contextForCallback
+                });
+                if (result) updatedValues = mergeDeep(updatedValues, result);
+            }
+
+            // 2. Collection callbacks second
             if (callbacks?.beforeSave) {
                 const result = await callbacks.beforeSave({
                     collection: resolvedCollection as EntityCollection<M>,
@@ -404,9 +447,10 @@ export class PostgresBackendDriver implements DataDriver {
                 if (result) updatedValues = mergeDeep(updatedValues, result);
             }
 
+            // 3. Property callbacks third
             if (propertyCallbacks?.beforeSave) {
                 const result = await propertyCallbacks.beforeSave({
-                    collection: resolvedCollection as EntityCollection<M>,
+                    collection: resolvedCollection as unknown as EntityCollection,
                     path,
                     entityId,
                     values: updatedValues,
@@ -438,7 +482,17 @@ export class PostgresBackendDriver implements DataDriver {
                 resolvedCollection?.databaseId
             );
 
-            if (savedEntity && (callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+            if (savedEntity && (globalCallbacks?.afterRead || callbacks?.afterRead || propertyCallbacks?.afterRead)) {
+                // 1. Global callbacks first
+                if (globalCallbacks?.afterRead) {
+                    savedEntity = await globalCallbacks.afterRead({
+                        collection: resolvedCollection as unknown as EntityCollection,
+                        path,
+                        entity: savedEntity as unknown as Entity<Record<string, unknown>>,
+                        context: contextForCallback
+                    }) as unknown as Entity<M>;
+                }
+                // 2. Collection callbacks second
                 if (callbacks?.afterRead) {
                     savedEntity = await callbacks.afterRead({
                         collection: resolvedCollection as EntityCollection<M>,
@@ -447,17 +501,31 @@ export class PostgresBackendDriver implements DataDriver {
                         context: contextForCallback
                     }) ?? savedEntity;
                 }
+                // 3. Property callbacks third
                 if (propertyCallbacks?.afterRead) {
                     savedEntity = await propertyCallbacks.afterRead({
-                        collection: resolvedCollection as EntityCollection<M>,
+                        collection: resolvedCollection as unknown as EntityCollection,
                         path,
-                        entity: savedEntity,
+                        entity: savedEntity as unknown as Entity<Record<string, unknown>>,
                         context: contextForCallback
-                    }) as Entity<M> ?? savedEntity;
+                    }) as unknown as Entity<M>;
                 }
             }
 
-            if (callbacks?.afterSave || propertyCallbacks?.afterSave) {
+            if (globalCallbacks?.afterSave || callbacks?.afterSave || propertyCallbacks?.afterSave) {
+                // 1. Global callbacks first
+                if (globalCallbacks?.afterSave) {
+                    await globalCallbacks.afterSave({
+                        collection: resolvedCollection as unknown as EntityCollection,
+                        path,
+                        entityId: savedEntity.id,
+                        values: savedEntity.values,
+                        previousValues: previousValuesForHistory,
+                        status,
+                        context: contextForCallback
+                    });
+                }
+                // 2. Collection callbacks second
                 if (callbacks?.afterSave) {
                     await callbacks.afterSave({
                         collection: resolvedCollection as EntityCollection<M>,
@@ -469,9 +537,10 @@ export class PostgresBackendDriver implements DataDriver {
                         context: contextForCallback
                     });
                 }
+                // 3. Property callbacks third
                 if (propertyCallbacks?.afterSave) {
                     await propertyCallbacks.afterSave({
-                        collection: resolvedCollection as EntityCollection<M>,
+                        collection: resolvedCollection as unknown as EntityCollection,
                         path,
                         entityId: savedEntity.id,
                         values: savedEntity.values,
@@ -513,7 +582,20 @@ export class PostgresBackendDriver implements DataDriver {
 
             return savedEntity;
         } catch (error) {
-            if (callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+            if (globalCallbacks?.afterSaveError || callbacks?.afterSaveError || propertyCallbacks?.afterSaveError) {
+                // 1. Global callbacks first
+                if (globalCallbacks?.afterSaveError) {
+                    await globalCallbacks.afterSaveError({
+                        collection: resolvedCollection as unknown as EntityCollection,
+                        path,
+                        entityId: entityId || "unknown",
+                        values: updatedValues,
+                        previousValues: undefined,
+                        status,
+                        context: contextForCallback
+                    });
+                }
+                // 2. Collection callbacks second
                 if (callbacks?.afterSaveError) {
                     await callbacks.afterSaveError({
                         collection: resolvedCollection as EntityCollection<M>,
@@ -525,9 +607,10 @@ export class PostgresBackendDriver implements DataDriver {
                         context: contextForCallback
                     });
                 }
+                // 3. Property callbacks third
                 if (propertyCallbacks?.afterSaveError) {
                     await propertyCallbacks.afterSaveError({
-                        collection: resolvedCollection as EntityCollection<M>,
+                        collection: resolvedCollection as unknown as EntityCollection,
                         path,
                         entityId: entityId || "unknown",
                         values: updatedValues,
@@ -550,13 +633,28 @@ export class PostgresBackendDriver implements DataDriver {
         const {
             collection: resolvedCollection,
             callbacks,
+            globalCallbacks,
             propertyCallbacks
         } = this.resolveCollectionCallbacks(collection, entity.path);
 
         const contextForCallback = this.buildCallContext();
 
-        if (callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
+        if (globalCallbacks?.beforeDelete || callbacks?.beforeDelete || propertyCallbacks?.beforeDelete) {
             let preventDefault = false;
+            // 1. Global callbacks first
+            if (globalCallbacks?.beforeDelete) {
+                const result = await globalCallbacks.beforeDelete({
+                    collection: resolvedCollection as unknown as EntityCollection,
+                    path: entity.path,
+                    entityId: entity.id,
+                    entity,
+                    context: contextForCallback
+                });
+                if (result === false) {
+                    preventDefault = true;
+                }
+            }
+            // 2. Collection callbacks second
             if (callbacks?.beforeDelete) {
                 const result = await callbacks.beforeDelete({
                     collection: resolvedCollection as EntityCollection<M>,
@@ -569,9 +667,10 @@ export class PostgresBackendDriver implements DataDriver {
                     preventDefault = true;
                 }
             }
+            // 3. Property callbacks third
             if (propertyCallbacks?.beforeDelete) {
                 const result = await propertyCallbacks.beforeDelete({
-                    collection: resolvedCollection as EntityCollection<M>,
+                    collection: resolvedCollection as unknown as EntityCollection,
                     path: entity.path,
                     entityId: entity.id,
                     entity,
@@ -592,7 +691,18 @@ export class PostgresBackendDriver implements DataDriver {
             entity.databaseId || resolvedCollection?.databaseId
         );
 
-        if (callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+        if (globalCallbacks?.afterDelete || callbacks?.afterDelete || propertyCallbacks?.afterDelete) {
+            // 1. Global callbacks first
+            if (globalCallbacks?.afterDelete) {
+                await globalCallbacks.afterDelete({
+                    collection: resolvedCollection as unknown as EntityCollection,
+                    path: entity.path,
+                    entityId: entity.id,
+                    entity,
+                    context: contextForCallback
+                });
+            }
+            // 2. Collection callbacks second
             if (callbacks?.afterDelete) {
                 await callbacks.afterDelete({
                     collection: resolvedCollection as EntityCollection<M>,
@@ -602,9 +712,10 @@ export class PostgresBackendDriver implements DataDriver {
                     context: contextForCallback
                 });
             }
+            // 3. Property callbacks third
             if (propertyCallbacks?.afterDelete) {
                 await propertyCallbacks.afterDelete({
-                    collection: resolvedCollection as EntityCollection<M>,
+                    collection: resolvedCollection as unknown as EntityCollection,
                     path: entity.path,
                     entityId: entity.id,
                     entity,

package/src/cli.ts

@@ -18,7 +18,36 @@ const __cliDirname = path.dirname(fileURLToPath(import.meta.url));
 
 
 
+async function loadEnv(): Promise<void> {
+    try {
+        const dotenv = await import("dotenv");
+        const envPaths = [
+            process.env.DOTENV_CONFIG_PATH,
+            path.resolve(process.cwd(), ".env"),
+            path.resolve(process.cwd(), "../.env"),
+            path.resolve(process.cwd(), "../../.env")
+        ].filter(Boolean) as string[];
+
+        for (const p of envPaths) {
+            if (fs.existsSync(p)) {
+                const parsed = dotenv.config({ path: p });
+                if (parsed.parsed) {
+                    for (const [key, val] of Object.entries(parsed.parsed)) {
+                        if (process.env[key] === undefined) {
+                            process.env[key] = val;
+                        }
+                    }
+                    break;
+                }
+            }
+        }
+    } catch {
+        // ignore
+    }
+}
+
 export async function runPluginCommand(args: string[]) {
+    await loadEnv();
     const domain = args[0]; // "db" or "schema"
     const subcommand = args[1];
 
@@ -126,16 +155,23 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
             logger.info("");
             logger.info(chalk.gray("  Step 2/3: Pushing schema to database with Atlas..."));
             logger.info("");
+            const databaseUrl = process.env.DATABASE_URL;
+            if (databaseUrl) {
+                await ensureAuthSchemaAndFunctions(databaseUrl);
+            }
             await runAtlas("schema", ["apply", "--to", "file://drizzle/schema.sql", "--auto-approve"], collectionsPath);
             logger.info("");
             
-            const databaseUrl = process.env.DATABASE_URL;
             if (databaseUrl) {
                 await applyPolicies(databaseUrl);
             } else {
                 logger.warn(chalk.yellow("  ⚠️  DATABASE_URL not found in environment, skipping RLS policies application."));
             }
         } else if (subcommand === "migrate") {
+            const databaseUrl = process.env.DATABASE_URL;
+            if (databaseUrl) {
+                await ensureAuthSchemaAndFunctions(databaseUrl);
+            }
             const extraArgs = argsList._.filter(arg => arg !== "migrate");
             await runAtlas("migrate", ["apply", "--dir", "file://drizzle/migrations", ...extraArgs], collectionsPath);
         }
@@ -146,6 +182,39 @@ async function dbCommand(subcommand: string, rawArgs: string[]): Promise<void> {
     }
 }
 
+async function ensureAuthSchemaAndFunctions(databaseUrl: string): Promise<void> {
+    try {
+        const { Client } = await import("pg");
+        const client = new Client({ connectionString: databaseUrl });
+        await client.connect();
+        try {
+            await client.query(`
+                CREATE SCHEMA IF NOT EXISTS auth;
+                CREATE SCHEMA IF NOT EXISTS rebase;
+
+                CREATE OR REPLACE FUNCTION auth.uid() RETURNS text AS $$
+                    SELECT NULLIF(current_setting('app.user_id', true), '');
+                $$ LANGUAGE sql STABLE;
+
+                CREATE OR REPLACE FUNCTION auth.jwt() RETURNS jsonb AS $$
+                    SELECT COALESCE(
+                        NULLIF(current_setting('app.jwt', true), ''),
+                        '{}'
+                    )::jsonb;
+                $$ LANGUAGE sql STABLE;
+
+                CREATE OR REPLACE FUNCTION auth.roles() RETURNS text AS $$
+                    SELECT COALESCE(NULLIF(current_setting('app.user_roles', true), ''), '');
+                $$ LANGUAGE sql STABLE;
+            `);
+        } finally {
+            await client.end();
+        }
+    } catch (err) {
+        logger.warn(chalk.yellow(`  ⚠️  Failed to bootstrap auth schema and helper functions: ${err instanceof Error ? err.message : String(err)}`));
+    }
+}
+
 async function applyPolicies(databaseUrl: string): Promise<void> {
     try {
         const policiesPath = path.resolve(process.cwd(), "drizzle", "policies.sql");
@@ -426,6 +495,9 @@ async function runAtlas(domain: "schema" | "migrate", args: string[], collection
             atlasArgs.push("--dev-url", devDatabaseUrl);
         } else if (args.includes("apply") || args.includes("status")) {
             atlasArgs.push("--url", databaseUrl, "--revisions-schema", "rebase");
+            if (args.includes("apply")) {
+                atlasArgs.push("--allow-dirty");
+            }
         }
     }
 

package/src/collections/PostgresCollectionRegistry.ts

@@ -1,5 +1,5 @@
 import { CollectionRegistry } from "@rebasepro/common";
-import { type CollectionWithRelations, type EntityCollection, type Relation, getDataSourceCapabilities } from "@rebasepro/types";
+import { type EntityCollection, type Relation, getDataSourceCapabilities } from "@rebasepro/types";
 import { PgEnum, PgTable } from "drizzle-orm/pg-core";
 import { Relations } from "drizzle-orm";
 import { CollectionRegistryInterface } from "../interfaces";
@@ -40,11 +40,11 @@ export class PostgresCollectionRegistry extends CollectionRegistry implements Co
     }
 
     /**
-     * Finds collections assigned to a specific driver that do not have a registered table.
+     * Finds collections assigned to a specific data source that do not have a registered table.
      */
-    getCollectionsWithoutTables(driverId = "(default)"): EntityCollection[] {
+    getCollectionsWithoutTables(dataSourceKey = "(default)"): EntityCollection[] {
         const collections = this.getCollections().filter(
-            c => c.driver === driverId || (!c.driver && driverId === "(default)")
+            c => c.dataSource === dataSourceKey || (!c.dataSource && dataSourceKey === "(default)")
         );
         return collections.filter(c => !this.tables.has(getTableName(c)));
     }
@@ -95,8 +95,8 @@ export class PostgresCollectionRegistry extends CollectionRegistry implements Co
      */
     getRelationKeysForCollection(collectionPath: string): string[] {
         const collection = this.getCollectionByPath(collectionPath);
-        if (!collection || !getDataSourceCapabilities(collection.driver).supportsRelations || !(collection as CollectionWithRelations).relations) return [];
-        return (collection as CollectionWithRelations).relations!.map((r: Relation) => r.relationName || r.localKey || "").filter(Boolean);
+        if (!collection || !getDataSourceCapabilities(collection.engine).supportsRelations || !collection.relations) return [];
+        return collection.relations!.map((r: Relation) => r.relationName || r.localKey || "").filter(Boolean);
     }
 
 }

package/src/data-transformer.ts

@@ -1,7 +1,7 @@
 import { eq, SQL } from "drizzle-orm";
 import { AnyPgColumn } from "drizzle-orm/pg-core";
 import { NodePgDatabase } from "drizzle-orm/node-postgres";
-import { CollectionWithRelations, EntityCollection, Properties, Property, Relation, RelationProperty, Vector, BinaryProperty } from "@rebasepro/types";
+import { EntityCollection, Properties, Property, Relation, RelationProperty, Vector, BinaryProperty } from "@rebasepro/types";
 import { getTableName, resolveCollectionRelations, findRelation, createRelationRef, DEFAULT_ONE_OF_TYPE, DEFAULT_ONE_OF_VALUE } from "@rebasepro/common";
 import { PostgresCollectionRegistry } from "./collections/PostgresCollectionRegistry";
 import { DrizzleConditionBuilder } from "./utils/drizzle-conditions";
@@ -551,7 +551,7 @@ export function parsePropertyFromServer(value: unknown, property: Property, coll
                     relationDef = findRelation(resolvedRelations, propertyKey);
                 }
                 if (!relationDef) {
-                    relationDef = (collection as CollectionWithRelations).relations?.find((rel: Relation) => rel.relationName === (property as RelationProperty).relationName);
+                    relationDef = collection.relations?.find((rel: Relation) => rel.relationName === (property as RelationProperty).relationName);
                 }
 
                 if (!relationDef) {

package/src/schema/auth-default-policies.ts

@@ -1,4 +1,4 @@
-import { EntityCollection, SecurityRule, SecurityOperation, AuthCollectionConfig, isPostgresCollection } from "@rebasepro/types";
+import { EntityCollection, SecurityRule, SecurityOperation, AuthCollectionConfig, PolicyExpression, isPostgresCollection, policy } from "@rebasepro/types";
 import { getTableName } from "@rebasepro/common";
 
 /**
@@ -37,7 +37,14 @@ import { getTableName } from "@rebasepro/common";
  * control of an auth collection's write authorization, set
  * `disableDefaultAuthPolicies: true` on the collection.
  */
-const ADMIN_WRITE_EXPR = "auth.uid() IS NULL OR string_to_array(auth.roles(), ',') && ARRAY['admin']";
+// Expressed structurally (not as raw SQL) so the admin UI can evaluate it
+// exactly — the framework's most security-critical policy must be reflected
+// precisely, not left as an un-evaluable raw clause. Compiles to
+// `auth.uid() IS NULL OR (string_to_array(auth.roles(), ',') && ARRAY['admin'])`.
+const ADMIN_WRITE_EXPR: PolicyExpression = policy.or(
+    policy.not(policy.authenticated()),
+    policy.rolesOverlap(["admin"])
+);
 
 /** Write operations that must be admin-gated by default on auth collections. */
 const DEFAULT_GUARDED_OPS: SecurityOperation[] = ["insert", "update", "delete"];
@@ -73,8 +80,8 @@ export function getEffectiveSecurityRules(collection: EntityCollection): Securit
         name: `${tableName}_require_admin_write`,
         mode: "restrictive",
         operations: [...DEFAULT_GUARDED_OPS],
-        using: ADMIN_WRITE_EXPR,
-        withCheck: ADMIN_WRITE_EXPR
+        condition: ADMIN_WRITE_EXPR,
+        check: ADMIN_WRITE_EXPR
     };
 
     // Permissive grant: a restrictive policy alone denies everything, so this
@@ -82,8 +89,8 @@ export function getEffectiveSecurityRules(collection: EntityCollection): Securit
     const allowAdminWrite: SecurityRule = {
         name: `${tableName}_default_admin_write`,
         operations: [...DEFAULT_GUARDED_OPS],
-        using: ADMIN_WRITE_EXPR,
-        withCheck: ADMIN_WRITE_EXPR
+        condition: ADMIN_WRITE_EXPR,
+        check: ADMIN_WRITE_EXPR
     };
 
     return [...explicit, allowAdminWrite, requireAdminGate];