@rebasepro/server 0.20.0 → 0.21.0

package/dist/{src-DqZ9YiGA.js → src-DW1cQ_28.js}

@@ -87,21 +87,6 @@ var RebaseClientError = class extends RebaseApiError {
 * agree about it, and a module-local symbol would not.
 */
 var UNSUPPORTED_METHOD = Symbol.for("rebase.unsupportedMethod");
-/**
-* Build the stub a client installs for a contract method it cannot serve.
-*
-* `listen`, `listenById` and `count` are part of `SDKCollectionClient`, not
-* optional extras — a caller should be able to write
-* `client.data.posts.count()` without asking first, and a transport that cannot
-* serve it should answer with a sentence naming the configuration that would,
-* rather than with `undefined is not a function` at the call site. Where the
-* transport genuinely cannot (a client built with `realtime: false`, a driver
-* with no `listenCollection`), it installs one of these instead of omitting the
-* method.
-*
-* @param message What to tell the caller, naming the fix.
-* @group Errors
-*/
 function unsupportedMethod(message) {
 	const stub = () => {
 		throw new RebaseClientError(message, { code: "REALTIME_DISABLED" });
@@ -256,6 +241,34 @@ var Vector = class {
 	}
 };
 //#endregion
+//#region ../types/src/types/relations.ts
+/**
+* The key a junction row's own columns are carried under, in both directions.
+*
+* A read that includes a `manyToMany` relation serves each related row with its
+* link's columns nested here — `{ id: 5, name: "ts", _pivot: { role: "owner" } }`
+* — and a membership write may name the same key on an element to state what
+* the link should hold. One constant because the two have to be the same word:
+* a wire name that differs between the read and the write it round-trips
+* through is a shape no client can echo back.
+*
+* Leading underscore, like `_matches`: it reads as metadata about the row
+* rather than as one of its columns. A payload property may not be named
+* `_pivot` either — `checkJunctionPayload` refuses it — so the key means one
+* thing wherever it appears.
+*
+* @group Models
+*/
+var JUNCTION_PIVOT_KEY = "_pivot";
+/** @group Models */
+function isManyToMany(relation) {
+	return relation.kind === "manyToMany";
+}
+/** @group Models */
+function isToMany(relation) {
+	return relation.cardinality === "many";
+}
+//#endregion
 //#region ../types/src/types/policy.ts
 /**
 * The id a request without a logged-in user reports as `rebase.uid()`.
@@ -1761,6 +1774,35 @@ function toWireKey(columnName) {
 	if (segments.length <= 1) return columnName;
 	return segments.map((segment, index) => index === 0 ? segment.charAt(0).toLowerCase() + segment.slice(1) : segment.charAt(0).toUpperCase() + segment.slice(1)).join("");
 }
+/**
+* Release a Node handle's hold on the event loop, where the runtime has one.
+*
+* `unref` is Node's, not the web platform's. Node ref-counts the handles that
+* can keep a process alive — timers, `BroadcastChannel`, sockets — and gives
+* each an `unref()` that says "you are still live, but do not be the reason
+* this process refuses to exit". The browser's equivalents have no such method:
+* `setTimeout` there returns a plain number, and nothing is holding a page open
+* in the first place.
+*
+* So the call is genuinely conditional at runtime, in every package that runs
+* in both places. Spelled out at the call site it came to
+* `(handle as unknown as { unref?: () => void }).unref?.()` — a double cast,
+* because where the DOM declaration of `setTimeout` wins the handle is a
+* `number`, and `number` does not overlap an object type, so a single `as` is
+* refused. The `unknown` in the middle was there to make the refusal go away,
+* and it also discarded the check on the member's name and signature. There
+* were seven copies, which is seven chances to get one of those wrong.
+*
+* Takes `unknown` on purpose: the argument's type is exactly what is not known
+* here, and narrowing it to a timer would be a claim this cannot make about a
+* `BroadcastChannel`. A no-op on a browser handle, on `null`/`undefined`, and
+* on a Node timer that has already fired.
+*/
+function unref(handle) {
+	if (handle === null || typeof handle !== "object") return;
+	const fn = handle.unref;
+	if (typeof fn === "function") fn.call(handle);
+}
 //#endregion
 //#region ../common/src/util/entities.ts
 /**
@@ -2775,6 +2817,43 @@ function getEffectiveSecurityRules(collection) {
 	return [...explicit, ...injected];
 }
 policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
+/**
+* The same synthetic collection, reached from a resolved relation rather than
+* from a spec.
+*
+* The spec is built by walking every collection, which the schema planner does
+* once at boot and no request path can afford. A read or a write already holds
+* the relation, and a relation's `through` carries the table, both key columns
+* and the payload — everything the config is made of. One builder underneath
+* both, so the shape the planner emitted columns from is the shape the write
+* path validates a `_pivot` against and the read path strips it with.
+*/
+function getJunctionConfigForRelation(through) {
+	return buildJunctionCollectionConfig({
+		table: through.table.includes(".") ? through.table.split(".").pop() : through.table,
+		schema: "public",
+		keyColumns: [through.sourceColumn, through.targetColumn],
+		properties: through.properties
+	});
+}
+function buildJunctionCollectionConfig(args) {
+	const properties = {};
+	for (const column of args.keyColumns) properties[column] = {
+		type: "string",
+		columnName: column
+	};
+	for (const [key, property] of Object.entries(args.properties)) {
+		if (key === "_pivot" || key in properties) continue;
+		properties[key] = property;
+	}
+	return {
+		slug: args.table,
+		name: args.table,
+		table: args.table,
+		schema: args.schema,
+		properties
+	};
+}
 (/* @__PURE__ */ __commonJSMin(((exports, module) => {
 	(function(root, factory) {
 		if (typeof define === "function" && define.amd) define(factory);
@@ -3052,6 +3131,170 @@ policy.or(policy.serverContext(), policy.rolesOverlap(["admin"]));
 * Apply PropertyConditions to a resolved property, evaluating all JSON Logic rules.
 */
 //#endregion
+//#region ../common/src/util/internal-tables.ts
+/**
+* The tables Rebase creates for its own bookkeeping, and the SQL that keeps the
+* end-user role away from them.
+*
+* ## Why this exists
+*
+* Authenticated requests run as {@link REBASE_USER_ROLE}, and the boot-time role
+* provisioning grants that role `SELECT, INSERT, UPDATE, DELETE` on every table
+* in the schemas a project uses — including `rebase`, because a project's own
+* collections are allowed to live there (the scaffold puts `users` there). It
+* also sets `ALTER DEFAULT PRIVILEGES`, so a table created *later* by the
+* migrating role inherits the same grant.
+*
+* Every framework-internal table is created later: auth's tables come up during
+* `initializeAuth`, `api_keys` during route mounting, `cron_logs` when the first
+* job registers, `idempotency_keys` on the first request that carries a key. So
+* they all inherited full DML for the end-user role — and none of them enables
+* row-level security, because none of them is a collection with
+* `securityRules`. Measured on a freshly provisioned database, `SET ROLE
+* rebase_user` could read `rebase.refresh_tokens` (session token hashes),
+* `rebase.mfa_factors` (`secret_encrypted`), `rebase.recovery_codes`, and
+* `rebase.api_keys` (including its `admin` flag), and insert into
+* `rebase.app_config`.
+*
+* Nothing routes a user-context query at those tables today, so this was not
+* reachable over the API. That is the wrong thing to depend on: the documented
+* model is that RLS is the authorization boundary, and these tables sat outside
+* it. The boundary is now a privilege boundary instead — the role simply cannot
+* address them.
+*
+* ## Why REVOKE rather than ENABLE ROW LEVEL SECURITY
+*
+* RLS with no policy denies every row, which is the same outcome, but it is the
+* *weaker* statement: it leaves the grant in place, so a later policy — or a
+* `FORCE` flag cleared by some future migration — reopens the table. There is no
+* row of `refresh_tokens` any end user should ever reach, so the honest encoding
+* is "this role has no privilege here at all". It also keeps the owner
+* connection (which auth actually runs on) completely unaffected.
+*
+* ## Keeping it true
+*
+* `packages/rls-check` scans the `rebase` schema — it used to skip it as a
+* "platform" schema — and its `rls-disabled` check fires on exactly the
+* condition this module removes: RLS off *and* a DML grant to a reachable role.
+* So a table added here without a revoke is caught by `pnpm rls:check`, not by
+* someone re-reading this file.
+*/
+/**
+* The Postgres role authenticated requests run as.
+*
+* Defined here rather than in the Postgres driver because both the driver (which
+* provisions the role) and this module (which revokes on its behalf) need it,
+* and a second spelling of a role name is a silent no-op waiting to happen.
+*/
+var REBASE_USER_ROLE = "rebase_user";
+/**
+* Framework-internal table names, unqualified.
+*
+* Deliberately NOT including `users`: the auth user table is also a collection,
+* with `securityRules`, RLS enabled and policies applied. Users read their own
+* row through it — revoking there would break sign-in. `revokeInternalTableSql`
+* now skips any table with RLS enabled, so that exception is enforced rather
+* than merely remembered — and so is the same hazard for every other name here,
+* any of which a project may legitimately use for a collection of its own.
+*
+* `atlas_schema_revisions` is Atlas's migration ledger, which lands in `rebase`
+* because `db migrate apply` passes `--revisions-schema rebase`.
+*
+* Every entry here must also be revoked by whatever creates it, and vice versa:
+* the creation-time revoke fires once, on the boot that first makes the table,
+* so it cannot help a database provisioned before that revoke existed. This
+* list is what the boot-time sweep in `ensureAppRole` iterates, and the sweep
+* is the only thing that can repair an already-granted table. A table revoked
+* at creation but missing here is therefore permanently stranded on any
+* database that predates its revoke.
+*
+* These names are unqualified, and the boot-time sweep applies them to every
+* schema a project uses — so an entry here is a claim on that name in `public`
+* as much as in `rebase`. `jobs` is Rebase's queue at `rebase.jobs` AND a
+* perfectly ordinary collection name, and revoking `public.jobs` from a project
+* that owns it leaves every read failing 42501 with correct policies applied
+* and nothing in the RLS logs to explain it. The `relrowsecurity` guard in
+* `revokeInternalTableSql` is what makes a common noun safe here — it is not a
+* licence to claim more of them.
+*/
+var REBASE_INTERNAL_TABLES = [
+	"user_identities",
+	"refresh_tokens",
+	"password_reset_tokens",
+	"magic_link_tokens",
+	"mfa_factors",
+	"mfa_challenges",
+	"recovery_codes",
+	"app_config",
+	"schema_meta",
+	"api_keys",
+	"cron_logs",
+	"cron_claims",
+	"jobs",
+	"rate_limit_hits",
+	"idempotency_keys",
+	"entity_history",
+	"branches",
+	"metric_samples",
+	"channel_messages",
+	"channel_cursors",
+	"channel_presence",
+	"atlas_schema_revisions"
+];
+/** Postgres identifiers this module is willing to interpolate. */
+var SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+/**
+* A single statement that takes every privilege on `schema.table` away from the
+* end-user role.
+*
+* Wrapped in a `DO` block guarded on `pg_roles` for two reasons, both of which
+* happen in practice:
+*
+*  - the role does not exist when the connection is unprivileged (Rebase then
+*    relies on native RLS rather than a role switch), and a bare `REVOKE` on a
+*    missing role is an error, not a no-op;
+*  - the table may not exist yet — `cron_logs` never appears in a project with
+*    no cron jobs — and `to_regclass` returning NULL has to be tolerated too.
+*
+* The third guard is the one that decides whether the *right* table is being
+* revoked. The names in {@link REBASE_INTERNAL_TABLES} are unqualified, and the
+* boot-time sweep in `ensureAppRole` applies all of them to every schema a
+* project uses — including the schema its own collections live in. A project is
+* free to call a collection `jobs`, `branches` or `api_keys`, and when it does,
+* the sweep was revoking `rebase_user`'s DML on the project's table on every
+* single boot. That is not a subtle degradation: the collection's whole API
+* answers 500 `permission denied for table …` from then on, which is what
+* happened to a public job board whose vacancies live in `public.jobs`.
+*
+* `relrowsecurity` separates the two cleanly, and it is the same fact this
+* module already relies on. Framework-internal tables carry no RLS — that is the
+* premise stated at the top of this file, and the reason a revoke is needed at
+* all. Every collection table has it enabled, because that is how Rebase
+* enforces `securityRules`. So "RLS is off" is exactly "this is not somebody's
+* collection", and the guard also subsumes the hand-carved `users` exception:
+* the auth user table is a collection, has RLS, and would now be skipped on its
+* own merits rather than by being kept off a list.
+*
+* One command, so it is safe on handles that speak the extended query protocol
+* and reject multi-statement strings.
+*/
+function revokeInternalTableSql(schema, table) {
+	if (!SAFE_IDENTIFIER.test(schema)) throw new Error(`Refusing to build SQL with an unsafe schema name: ${JSON.stringify(schema)}`);
+	if (!SAFE_IDENTIFIER.test(table)) throw new Error(`Refusing to build SQL with an unsafe table name: ${JSON.stringify(table)}`);
+	const qualified = `"${schema}"."${table}"`;
+	return `
+        DO $rebase_revoke$
+        BEGIN
+            IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '${REBASE_USER_ROLE}')
+               AND to_regclass('${qualified}') IS NOT NULL
+               AND NOT (SELECT relrowsecurity FROM pg_class WHERE oid = to_regclass('${qualified}')) THEN
+                EXECUTE 'REVOKE ALL ON ${qualified} FROM ${REBASE_USER_ROLE}';
+            END IF;
+        END
+        $rebase_revoke$;
+    `.trim();
+}
+//#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
@@ -6219,7 +6462,8 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 		return getAccessor(toSnakeCase(prop));
 	} });
 }
+new Set(REBASE_INTERNAL_TABLES);
 //#endregion
-export { isFieldOperation as $, createDataSourceRegistry as A, resolveCollectionRelations as B, decodeCursor as C, restrictedFieldNames as D, effectiveAccess as E, securityRuleToConditions as F, suggestNearMiss as G, buildCompositeId as H, fieldKeyForColumn as I, MAX_LIST_LIMIT as J, toSnakeCase as K, findRelation as L, resolveDataSource as M, getEffectiveSecurityRules as N, defaultUsersCollection as O, getTenantConfig as P, hasFieldOperation as Q, getTableName as R, cursorToStartAfter as S, canWriteField as T, resolvePrimaryKeys as U, enumToObjectEntries as V, hydrateRegExp as W, BATCH_REF_KEY as X, resolveClientListLimit as Y, FIELD_OPERATORS as Z, OrderBySpecError as _, deserializeLogicalCondition as a, Vector as at, CursorError as b, collectAllPages as c, isUnsupported as ct, IncludeSpecError as d, ANONYMOUS_USER_ID as et, deserializeInclude as f, topLevelIncludeNames as g, serializeInclude as h, deserializeFilter as i, GeoPoint as it, isRelationalCollection as j, CollectionRegistry as k, paginateFind as l, unsupportedMethod as lt, normalizeInclude as m, buildSdkData as n, EntityReference as nt, serializeFilter as o, RebaseApiError as ot, mergeIncludeSpecs as p, ListLimitError as q, UnknownFilterOperatorError as r, EntityRelation as rt, serializeLogicalCondition as s, RebaseClientError as st, buildRoutedRebaseData as t, isAnonymousUid as tt, resolveFindWindow as u, normalizeOrderBy as v, reconcileCursorOrder as w, CursorMismatchError as x, serializeOrderBy as y, isRelationRequired as z };
+export { resolveClientListLimit as $, createDataSourceRegistry as A, findRelation as B, decodeCursor as C, restrictedFieldNames as D, effectiveAccess as E, getJunctionConfigForRelation as F, buildCompositeId as G, isRelationRequired as H, getEffectiveSecurityRules as I, suggestNearMiss as J, resolvePrimaryKeys as K, getTenantConfig as L, resolveDataSource as M, REBASE_USER_ROLE as N, defaultUsersCollection as O, revokeInternalTableSql as P, MAX_LIST_LIMIT as Q, securityRuleToConditions as R, cursorToStartAfter as S, canWriteField as T, resolveCollectionRelations as U, getTableName as V, enumToObjectEntries as W, unref as X, toSnakeCase as Y, ListLimitError as Z, OrderBySpecError as _, deserializeLogicalCondition as a, isAnonymousUid as at, CursorError as b, collectAllPages as c, isToMany as ct, IncludeSpecError as d, GeoPoint as dt, BATCH_REF_KEY as et, deserializeInclude as f, Vector as ft, topLevelIncludeNames as g, unsupportedMethod as gt, serializeInclude as h, isUnsupported as ht, deserializeFilter as i, ANONYMOUS_USER_ID as it, isRelationalCollection as j, CollectionRegistry as k, paginateFind as l, EntityReference as lt, normalizeInclude as m, RebaseClientError as mt, buildSdkData as n, hasFieldOperation as nt, serializeFilter as o, JUNCTION_PIVOT_KEY as ot, mergeIncludeSpecs as p, RebaseApiError as pt, hydrateRegExp as q, UnknownFilterOperatorError as r, isFieldOperation as rt, serializeLogicalCondition as s, isManyToMany as st, buildRoutedRebaseData as t, FIELD_OPERATORS as tt, resolveFindWindow as u, EntityRelation as ut, normalizeOrderBy as v, reconcileCursorOrder as w, CursorMismatchError as x, serializeOrderBy as y, fieldKeyForColumn as z };
 
-//# sourceMappingURL=src-DqZ9YiGA.js.map
+//# sourceMappingURL=src-DW1cQ_28.js.map