@rebasepro/server 0.12.0 → 0.12.1-canary.g35be8cb

package/dist/{src-CoOAMnBh.js → src-BjI5Wx_8.js}

@@ -1,8 +1,189 @@
 import { createRequire as __createRequire } from "module";
 import "process";
 __createRequire(import.meta.url);
-import { r as __require, t as __commonJSMin } from "./chunk-DSJWtz9O.js";
-import { S as toCanonicalOp, b as NULL_OPS, f as getDeclaredSubcollections, g as getDataSourceCapabilities, l as policy, m as isRelationalCollectionConfig, w as EntityRelation, x as REST_TO_CANONICAL, y as CANONICAL_TO_REST } from "./src-Ivjud8jD.js";
+import { r as __require, t as __commonJSMin } from "./rolldown-runtime-DSJWtz9O.js";
+import { c as NULL_OPS, i as isRelationalCollectionConfig, l as REST_TO_CANONICAL, n as getDeclaredSubcollections, o as getDataSourceCapabilities, r as isPostgresCollectionConfig, s as CANONICAL_TO_REST, u as toCanonicalOp } from "./src-_qQ3RNCK.js";
+//#region ../types/src/types/entities.ts
+/**
+* Class used to create a reference to a entity in a different path.
+*
+* @example
+* // Simple reference (most common case - single driver, single db)
+* new EntityReference({ id: "123", path: "users" })
+*
+* // Reference to a different driver (e.g., Firestore)
+* new EntityReference({ id: "123", path: "analytics", driver: "firestore" })
+*
+* // Reference to a specific database within a driver
+* new EntityReference({ id: "123", path: "orders", driver: "postgres", databaseId: "orders_db" })
+*/
+var EntityReference = class {
+	__type = "reference";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Which driver (e.g., 'postgres', 'firestore').
+	* Defaults to "(default)" if not specified.
+	*/
+	driver;
+	/**
+	* Which database within the driver.
+	* Defaults to "(default)" if not specified.
+	*/
+	databaseId;
+	/**
+	* Create a reference to a entity.
+	*
+	* @example
+	* // Simple reference (most common case)
+	* new EntityReference({ id: "123", path: "users" })
+	*
+	* // With driver
+	* new EntityReference({ id: "123", path: "analytics", driver: "firestore" })
+	*/
+	constructor(props) {
+		this.id = props.id;
+		this.path = props.path;
+		this.driver = props.driver;
+		this.databaseId = props.databaseId;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	/**
+	* Get the full path including driver and database prefixes if specified.
+	* For the common case (single driver, single db), this just returns pathWithId.
+	*/
+	get fullPath() {
+		const parts = [];
+		if (this.driver && this.driver !== "(default)") parts.push(this.driver);
+		if (this.databaseId && this.databaseId !== "(default)") parts.push(this.databaseId);
+		if (parts.length > 0) return `${parts.join(":")}:::${this.path}/${this.id}`;
+		return this.pathWithId;
+	}
+	isEntityReference() {
+		return true;
+	}
+};
+/**
+* Class used to create a reference to a entity in a different path
+*/
+var EntityRelation = class {
+	__type = "relation";
+	/**
+	* ID of the entity
+	*/
+	id;
+	/**
+	* A string representing the path of the referenced document (relative
+	* to the root of the database).
+	*/
+	path;
+	/**
+	* Pre-fetched data payload to eliminate N+1 queries.
+	* When present, clients can use this directly instead of fetching.
+	*/
+	data;
+	constructor(id, path, data) {
+		this.id = id;
+		this.path = path;
+		this.data = data;
+	}
+	get pathWithId() {
+		return `${this.path}/${this.id}`;
+	}
+	isEntityReference() {
+		return false;
+	}
+	isEntityRelation() {
+		return true;
+	}
+};
+var GeoPoint = class {
+	/**
+	* The latitude of this GeoPoint instance.
+	*/
+	latitude;
+	/**
+	* The longitude of this GeoPoint instance.
+	*/
+	longitude;
+	constructor(latitude, longitude) {
+		this.latitude = latitude;
+		this.longitude = longitude;
+	}
+};
+var Vector = class {
+	value;
+	constructor(value) {
+		this.value = value;
+	}
+};
+//#endregion
+//#region ../types/src/types/policy.ts
+/** @group Models */
+var policy = {
+	true: () => ({ kind: "true" }),
+	false: () => ({ kind: "false" }),
+	and: (...operands) => ({
+		kind: "and",
+		operands
+	}),
+	or: (...operands) => ({
+		kind: "or",
+		operands
+	}),
+	not: (operand) => ({
+		kind: "not",
+		operand
+	}),
+	compare: (left, op, right) => ({
+		kind: "compare",
+		op,
+		left,
+		right
+	}),
+	rolesOverlap: (roles) => ({
+		kind: "rolesOverlap",
+		roles
+	}),
+	rolesContain: (roles) => ({
+		kind: "rolesContain",
+		roles
+	}),
+	authenticated: () => ({ kind: "authenticated" }),
+	serverContext: () => ({ kind: "serverContext" }),
+	existsIn: (args) => ({
+		kind: "existsIn",
+		collection: args.collection,
+		where: args.where
+	}),
+	raw: (sql) => ({
+		kind: "raw",
+		sql
+	}),
+	field: (name) => ({
+		kind: "field",
+		name
+	}),
+	outerField: (name) => ({
+		kind: "outerField",
+		name
+	}),
+	literal: (value) => ({
+		kind: "literal",
+		value
+	}),
+	authUid: () => ({ kind: "authUid" }),
+	authRoles: () => ({ kind: "authRoles" })
+};
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(e) {
 		var t;
@@ -1381,7 +1562,105 @@ function getEntityChildViews(collection) {
 function getSubcollections(collection) {
 	return getEntityChildViews(collection).map((view) => view.collection);
 }
-policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+//#endregion
+//#region ../common/src/util/auth-default-policies.ts
+/**
+* Default RLS policies injected by the schema generator.
+*
+* Rebase's enforcement model is unified: authenticated (user-context) requests
+* run under the restricted `rebase_user` role, so Postgres RLS binds *every*
+* statement — reads and writes. A collection's `securityRules` are the whole
+* authorization model. The server context (auth flows, migrations,
+* `dataAsAdmin`) runs as the owner and bypasses RLS.
+*
+* Because RLS default-denies, every collection is **locked by default**: with
+* no rules, only the server context and admins can touch it. The generator
+* injects that safe baseline:
+*
+* **For every collection**
+*  1. A permissive **server-or-admin SELECT** grant.
+*  2. A permissive **server-or-admin write** grant (insert/update/delete).
+*
+* Author `securityRules` are permissive and OR together, so explicit rules only
+* *broaden* access from this locked baseline (e.g. "users read/write their own
+* rows").
+*
+* **For auth collections additionally**
+*  3. A permissive **self SELECT** grant (`id = auth.uid()`), so users can read
+*     their own row (profile, session bootstrap) without every app re-declaring
+*     it.
+*  4. A **restrictive** admin write gate. Restrictive policies are AND'd with
+*     every other policy, so a write is rejected unless the caller is an admin
+*     (or the server context) — even if the author also wrote a permissive rule
+*     such as "a user may edit their own row". Without this, a permissive owner
+*     rule would let a user change their own `roles`.
+*
+* The server context is recognised as `auth.uid() IS NULL` (`policy.serverContext()`)
+* — the built-in flows that run without a user (signup, migrations) set no user
+* GUC — which also lets the owner connection satisfy these policies even under
+* FORCE RLS. A *user* request never reaches that state: an anonymous one carries
+* `ANONYMOUS_USER_ID`, precisely so it cannot pass for the server here.
+*
+* Opt out with `disableDefaultPolicies: true` to take full responsibility for
+* the collection's RLS.
+*/
+var SERVER_OR_ADMIN_EXPR$1 = policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/** Write operations that must be admin-gated by default on auth collections. */
+var DEFAULT_GUARDED_OPS = [
+	"insert",
+	"update",
+	"delete"
+];
+/** Whether a collection is flagged as an authentication collection. */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	return auth === true || typeof auth === "object" && auth?.enabled === true;
+}
+/** The property marked as the row id (falls back to `id`). */
+function getIdPropertyName(collection) {
+	for (const [name, prop] of Object.entries(collection.properties ?? {})) if (prop && typeof prop === "object" && "isId" in prop && prop.isId) return name;
+	return "id";
+}
+/**
+* Returns the security rules that should be applied to a collection: the
+* author's explicit `securityRules` plus the framework defaults described in
+* the module doc (baseline server/admin read for all collections; self-read
+* and the admin write gate for auth collections).
+*
+* Collections that opt out via `disableDefaultPolicies` are returned unchanged.
+*/
+function getEffectiveSecurityRules(collection) {
+	const explicit = [...collection.securityRules ?? []];
+	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return explicit;
+	const tableName = getTableName(collection);
+	const injected = [];
+	injected.push({
+		name: `${tableName}_default_admin_read`,
+		operations: ["select"],
+		condition: SERVER_OR_ADMIN_EXPR$1
+	});
+	injected.push({
+		name: `${tableName}_default_admin_write`,
+		operations: [...DEFAULT_GUARDED_OPS],
+		condition: SERVER_OR_ADMIN_EXPR$1,
+		check: SERVER_OR_ADMIN_EXPR$1
+	});
+	if (isAuthCollection(collection)) {
+		injected.push({
+			name: `${tableName}_default_self_read`,
+			operations: ["select"],
+			condition: policy.compare(policy.field(getIdPropertyName(collection)), "eq", policy.authUid())
+		});
+		injected.push({
+			name: `${tableName}_require_admin_write`,
+			mode: "restrictive",
+			operations: [...DEFAULT_GUARDED_OPS],
+			condition: SERVER_OR_ADMIN_EXPR$1,
+			check: SERVER_OR_ADMIN_EXPR$1
+		});
+	}
+	return [...explicit, ...injected];
+}
 policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
@@ -1660,7 +1939,7 @@ policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 * Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
 */
 //#endregion
-//#region ../../node_modules/.pnpm/fast-equals@6.0.0/node_modules/fast-equals/dist/es/index.mjs
+//#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
 /**
@@ -1696,7 +1975,8 @@ function createIsCircular(areItemsEqual) {
 * not enumerable and symbol properties.
 */
 function getStrictProperties(object) {
-	return getOwnPropertyNames(object).concat(getOwnPropertySymbols(object));
+	const symbols = getOwnPropertySymbols(object);
+	return symbols.length ? getOwnPropertyNames(object).concat(symbols) : getOwnPropertyNames(object);
 }
 /**
 * Whether the object contains the property passed as an own property.
@@ -1769,7 +2049,7 @@ function areMapsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.entries();
 	let aResult;
 	let bResult;
@@ -1777,7 +2057,7 @@ function areMapsEqual(a, b, state) {
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.entries();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
@@ -1788,7 +2068,7 @@ function areMapsEqual(a, b, state) {
 			const aEntry = aResult.value;
 			const bEntry = bResult.value;
 			if (state.equals(aEntry[0], bEntry[0], index, matchIndex, a, b, state) && state.equals(aEntry[1], bEntry[1], aEntry[0], bEntry[0], a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -1846,19 +2126,19 @@ function areSetsEqual(a, b, state) {
 	const size = a.size;
 	if (size !== b.size) return false;
 	if (!size) return true;
-	const matchedIndices = new Array(size);
+	const matchedIndices = new Uint8Array(size);
 	const aIterable = a.values();
 	let aResult;
 	let bResult;
 	while (aResult = aIterable.next()) {
 		if (aResult.done) break;
 		const bIterable = b.values();
-		let hasMatch = false;
+		let hasMatch = 0;
 		let matchIndex = 0;
 		while (bResult = bIterable.next()) {
 			if (bResult.done) break;
 			if (!matchedIndices[matchIndex] && state.equals(aResult.value, bResult.value, aResult.value, bResult.value, a, b, state)) {
-				hasMatch = matchedIndices[matchIndex] = true;
+				hasMatch = matchedIndices[matchIndex] = 1;
 				break;
 			}
 			matchIndex++;
@@ -1871,8 +2151,8 @@ function areSetsEqual(a, b, state) {
 * Whether the TypedArray instances are equal in value.
 */
 function areTypedArraysEqual(a, b) {
-	let index = a.byteLength;
-	if (b.byteLength !== index || a.byteOffset !== b.byteOffset) return false;
+	let index = a.length;
+	if (b.length !== index || a.byteOffset !== b.byteOffset) return false;
 	while (index-- > 0) if (a[index] !== b[index]) return false;
 	return true;
 }
@@ -3306,57 +3586,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 	} });
 }
 //#endregion
-//#region ../common/src/data/sort-dialect.ts
-/**
-* Sort-order wire codec.
-*
-* This is the ONLY module that knows about the colon-delimited wire format
-* (`"field:direction"`) used in HTTP query parameters.
-* Everything else speaks {@link OrderByTuple} exclusively.
-*
-* Mirrors the filter architecture in `filter-dialect.ts`.
-*
-* @module
-*/
-/**
-* Serialize an {@link OrderByTuple} to the wire format `"field:direction"`.
-*
-* **Runtime tolerance:** if the input is already a well-formed wire string
-* (from an untyped JS caller), it is returned unchanged.
-* This is undocumented tolerance, not public API — don't rely on it.
-*
-* @param orderBy - A canonical `[field, direction]` tuple, or at runtime
-*   possibly a pre-serialized string (undocumented tolerance).
-* @returns The wire-format string, or `undefined` if the input is falsy.
-*
-* @remarks
-* Field names containing `:` are representable in the tuple form but
-* **not** on the wire — this is an inherent limitation of the colon-delimited
-* encoding and is not resolved here.
-*/
-function serializeOrderBy(orderBy) {
-	if (!orderBy) return void 0;
-	if (typeof orderBy === "string") return orderBy;
-	return `${orderBy[0]}:${orderBy[1]}`;
-}
-/**
-* Deserialize a wire-format `"field:direction"` string into an {@link OrderByTuple}.
-*
-* Lenient parsing (matches existing server behaviour):
-* - Bare field name (no colon): `"name"` → `["name", "asc"]`
-* - Unknown direction: `"name:foo"` → `["name", "asc"]`
-* - Empty / falsy input: → `undefined`
-*
-* @param raw - The wire-format string from an HTTP query parameter.
-* @returns The canonical tuple, or `undefined` if the input is empty/falsy.
-*/
-function deserializeOrderBy(raw) {
-	if (!raw) return void 0;
-	const idx = raw.indexOf(":");
-	if (idx === -1) return [raw, "asc"];
-	return [raw.slice(0, idx), raw.slice(idx + 1) === "desc" ? "desc" : "asc"];
-}
-//#endregion
-export { toSnakeCase as _, deserializeFilter as a, serializeLogicalCondition as c, CollectionRegistry as d, createDataSourceRegistry as f, buildCompositeId as g, resolveCollectionRelations as h, buildSdkData as i, collectAllPages as l, findRelation as m, serializeOrderBy as n, deserializeLogicalCondition as o, resolveDataSource as p, buildRoutedRebaseData as r, serializeFilter as s, deserializeOrderBy as t, paginateFind as u };
+export { EntityReference as _, serializeFilter as a, Vector as b, paginateFind as c, resolveDataSource as d, getEffectiveSecurityRules as f, toSnakeCase as g, buildCompositeId as h, deserializeLogicalCondition as i, CollectionRegistry as l, resolveCollectionRelations as m, buildSdkData as n, serializeLogicalCondition as o, findRelation as p, deserializeFilter as r, collectAllPages as s, buildRoutedRebaseData as t, createDataSourceRegistry as u, EntityRelation as v, GeoPoint as y };
 
-//# sourceMappingURL=src-CoOAMnBh.js.map
+//# sourceMappingURL=src-BjI5Wx_8.js.map