@rebasepro/server 0.21.1 → 0.22.0

package/dist/index.es.js

@@ -2,16 +2,16 @@ import { createRequire as __rebaseCreateRequire } from "module";
 import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
-import { A as createDataSourceRegistry, B as findRelation, D as restrictedFieldNames, E as effectiveAccess, F as getJunctionConfigForRelation, G as buildCompositeId, I as getEffectiveSecurityRules, J as suggestNearMiss, K as resolvePrimaryKeys, M as resolveDataSource, O as defaultUsersCollection, P as revokeInternalTableSql, R as securityRuleToConditions, S as cursorToStartAfter, T as canWriteField, U as resolveCollectionRelations, V as getTableName, W as enumToObjectEntries, X as unref, Y as toSnakeCase, c as collectAllPages, dt as GeoPoint, et as BATCH_REF_KEY, ft as Vector, g as topLevelIncludeNames, gt as unsupportedMethod, h as serializeInclude, ht as isUnsupported, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as EntityReference, mt as RebaseClientError, n as buildSdkData, nt as hasFieldOperation, o as serializeFilter, ot as JUNCTION_PIVOT_KEY, p as mergeIncludeSpecs, pt as RebaseApiError, q as hydrateRegExp, rt as isFieldOperation, s as serializeLogicalCondition, st as isManyToMany, t as buildRoutedRebaseData, tt as FIELD_OPERATORS, u as resolveFindWindow, ut as EntityRelation, v as normalizeOrderBy, y as serializeOrderBy, z as fieldKeyForColumn } from "./src-Caz7nREj.js";
+import { A as createDataSourceRegistry, B as fieldKeyForColumn, D as restrictedFieldNames, E as effectiveAccess, F as revokeInternalTableSql, G as enumToObjectEntries, H as getTableName, I as getJunctionConfigForRelation, J as hydrateRegExp, K as buildCompositeId, L as getEffectiveSecurityRules, M as resolveDataSource, N as authSecretsMissingExclusion, O as assertBeforeQueryIsPostgresOnly, Q as unref, S as cursorToStartAfter, T as canWriteField, V as findRelation, W as resolveCollectionRelations, X as suggestNearMiss, Y as splitSearchTerms, Z as toSnakeCase, _t as isUnsupported, at as isFieldOperation, c as collectAllPages, ct as JUNCTION_PIVOT_KEY, dt as EntityReference, ft as EntityRelation, g as topLevelIncludeNames, gt as RebaseClientError, h as serializeInclude, ht as RebaseApiError, it as hasFieldOperation, j as isRelationalCollection, k as CollectionRegistry, l as paginateFind, lt as isManyToMany, mt as Vector, n as buildSdkData, nt as BATCH_REF_KEY, o as serializeFilter, p as mergeIncludeSpecs, pt as GeoPoint, q as resolvePrimaryKeys, rt as FIELD_OPERATORS, s as serializeLogicalCondition, t as buildRoutedRebaseData, u as resolveFindWindow, v as normalizeOrderBy, vt as unsupportedMethod, y as serializeOrderBy, z as securityRuleToConditions } from "./src-1vL-I1Po.js";
 import { E as DEFAULT_DATA_SOURCE_KEY, F as sortKeyToString, I as toCanonicalOp, P as parseRelationAggregateSort, S as getCollectionDataPath, _ as resourceKinds, a as resourceToStorageSource, b as RLS_UID_SQL, c as DEFAULT_STORAGE_SOURCE_KEY, d as DEFAULT_RESOURCE_KEY, f as buildResourceGraph, g as resourceKind, h as resourceKeyOf, i as resourceToDataSource, l as findStorageSuffixCollision, m as resourceEnvSuffix, n as declaredQueueConsumers, o as setQueueRuntime, p as resolveResourceRefs, r as declaredSubscriptions, s as setTopicRuntime, u as storageEnvSuffix, v as RLS_JWT_SQL, w as isPostgresCollectionConfig, y as RLS_ROLES_SQL } from "./src-Br6ARbs6.js";
 import { n as ADMIN_PROPERTY_KEYS, t as ADMIN_COLLECTION_KEYS } from "./admin_block-DxKLmdiv.js";
 import { a as isDuplicateObjectRace, i as isConcurrentDdlRace, n as createDdlBootstrapper, o as isSQLAdmin, s as isSchemaEditingAdmin, t as CONCURRENT_DDL_SQLSTATES } from "./ddl-bootstrap-CfNvxMuK.js";
 import { i as parseEnvBoolean, r as validateCronExpression, t as CronScheduler } from "./cron-scheduler-COPQxlEq.js";
 import { i as SCHEMA_VERSION_HEADER, n as createContractRoutes, r as computeSchemaVersion } from "./contract-routes-eLxV0le1.js";
-import { $ as requireAdmin, A as defaultAuthLimiter, B as resolveEmailLinkBase, C as providerVerifiedEmail, Ct as raw, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, Dt as isPublicStoragePath, E as isBootstrapWindowOpen, Et as PUBLIC_STORAGE_PREFIX, F as extractLinks, G as createAdapterAuthMiddleware, H as hashPassword, I as registerDevEmailSink, J as extractUserFromToken, K as createAuthMiddleware, L as SMTPEmailService, M as activeDevEmailSink, N as clearActiveDevEmailSink, O as createDataRateLimiter, P as createDevEmailSink, Q as queryTokenAuth, R as createEmailService, S as pkceTokenParams, St as html, T as createBuiltinAuthAdapter, Tt as isOperationAllowed, U as validatePasswordStrength, V as resolveAuthHooks, W as verifyPassword, X as optionalAuth, Y as fileTokenAuth, Z as publicObjectAuth, _ as verifyOidcIdToken, _t as getUserInvitationTemplate, a as resolveRateLimitStoreKind, at as validateApiKey, b as createGoogleProvider, bt as RawHtml, c as createSlackProvider, ct as SERVICE_IDENTITY, d as createDiscordProvider, dt as completeUserCreation, et as requireAuth, f as createTwitterProvider, ft as generateSecurePassword, g as tryVerifyOidcIdToken, gt as getPasswordResetTemplate, h as createMicrosoftProvider, ht as getMagicLinkTemplate, i as createApiKeyStore, it as isApiKeyToken, j as MemoryRateLimitStore, k as createRateLimiter, l as createBitbucketProvider, lt as scopeDataDriver, m as createAppleProvider, mt as getEmailVerificationTemplate, n as createCustomAuthAdapter, nt as createFunctionApiKeyGuard, o as createSqlRateLimitStore, ot as extractBearerToken, p as createFacebookProvider, pt as getEmailOtpTemplate, q as createRequireAuth, r as createApiKeyRoutes, rt as createStorageApiKeyGuard, s as createSpotifyProvider, st as safeCompare, tt as createApiKeyPreAuth, u as createGitLabProvider, ut as supportsRlsScoping, v as createGitHubProvider, vt as getWelcomeEmailTemplate, w as createJwksRoutes, wt as httpMethodToOperation, x as oauthCodeFlowSchema, xt as escapeHtml, y as createLinkedinProvider, yt as resolveEmailBranding, z as assertEmailLinkBases } from "./auth-BS4WBA10.js";
+import { $ as requireAdmin, A as defaultAuthLimiter, B as resolveEmailLinkBase, C as providerVerifiedEmail, Ct as raw, D as DEFAULT_FUNCTIONS_ANONYMOUS_LIMIT, Dt as isPublicStoragePath, E as isBootstrapWindowOpen, Et as PUBLIC_STORAGE_PREFIX, F as extractLinks, G as createAdapterAuthMiddleware, H as hashPassword, I as registerDevEmailSink, J as extractUserFromToken, K as createAuthMiddleware, L as SMTPEmailService, M as activeDevEmailSink, N as clearActiveDevEmailSink, O as createDataRateLimiter, P as createDevEmailSink, Q as queryTokenAuth, R as createEmailService, S as pkceTokenParams, St as html, T as createBuiltinAuthAdapter, Tt as isOperationAllowed, U as validatePasswordStrength, V as resolveAuthHooks, W as verifyPassword, X as optionalAuth, Y as fileTokenAuth, Z as publicObjectAuth, _ as verifyOidcIdToken, _t as getUserInvitationTemplate, a as resolveRateLimitStoreKind, at as validateApiKey, b as createGoogleProvider, bt as RawHtml, c as createSlackProvider, ct as SERVICE_IDENTITY, d as createDiscordProvider, dt as completeUserCreation, et as requireAuth, f as createTwitterProvider, ft as generateSecurePassword, g as tryVerifyOidcIdToken, gt as getPasswordResetTemplate, h as createMicrosoftProvider, ht as getMagicLinkTemplate, i as createApiKeyStore, it as isApiKeyToken, j as MemoryRateLimitStore, k as createRateLimiter, l as createBitbucketProvider, lt as scopeDataDriver, m as createAppleProvider, mt as getEmailVerificationTemplate, n as createCustomAuthAdapter, nt as createFunctionApiKeyGuard, o as createSqlRateLimitStore, ot as extractBearerToken, p as createFacebookProvider, pt as getEmailOtpTemplate, q as createRequireAuth, r as createApiKeyRoutes, rt as createStorageApiKeyGuard, s as createSpotifyProvider, st as safeCompare, tt as createApiKeyPreAuth, u as createGitLabProvider, ut as supportsRlsScoping, v as createGitHubProvider, vt as getWelcomeEmailTemplate, w as createJwksRoutes, wt as httpMethodToOperation, x as oauthCodeFlowSchema, xt as escapeHtml, y as createLinkedinProvider, yt as resolveEmailBranding, z as assertEmailLinkBases } from "./auth-CCDpk2rn.js";
 import { i as rawQueryLoggingEnabled, n as describeCauseChain, o as setLogLevel, r as logger, s as hostEnv } from "./logger-DO2PZc4i.js";
 import { i as schemaDriftRemedy, n as declaredErrorAnswer, r as errorHandler, t as ApiError } from "./errors-DWsX4yTd.js";
-import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-C-rl30ce.js";
+import { a as resolveListLimitParam, c as HARD_DELETE_QUERY_PARAM, i as parseQueryOptions, l as parseHardDelete, n as parseAggregateSelect, o as assertReadableFields, r as parseGroupBy, s as requestViewer, t as orderByEntriesToTuples } from "./query-parser-BleZmY18.js";
 import { D as sha256Bytes, O as sha256Hex, S as normalizePemFromEnv, T as randomHex, _ as verifyAccessToken, a as generateMcpAccessToken, f as hasAsymmetricSigningKey, g as signPurposeToken, i as generateDownloadToken, l as getJwks, m as isJwtConfigured, n as configureJwt, w as constantTimeEqual, x as verifyPurposeToken, y as verifyMcpAccessToken } from "./jwt-C4OW-DNq.js";
 import { a as canonicalStorageKey, i as canonicalStorageId, n as InvalidStorageKeyError, r as canonicalStorageBucket, t as InvalidStorageBucketError } from "./keys-Qfc4XieN.js";
 import { t as logMiddleware } from "./logs-routes-3EEzPjhl.js";
@@ -24,11 +24,11 @@ import "./proxy-Czngl3p9.js";
 import "./request-timeout-C_4C2BeR.js";
 import { t as FunctionSelectionError } from "./selection-CRpqKUbt.js";
 import { n as loadCronJobsFromDirectory, r as loadCronJobsWithDiagnostics } from "./cron-loader-CQjvjpEw.js";
-import { t as createCronRoutes } from "./cron-routes-B_wlLybo.js";
-import { t as createCronStore } from "./cron-store-Dp0X7zRB.js";
+import { t as createCronRoutes } from "./cron-routes-B7CRGfiq.js";
+import { t as createCronStore } from "./cron-store-BYGZFNWk.js";
 import { a as parseBackupTimestamp, i as parseBackupDestination, n as createBackupRoutes, o as readBackupBytes, r as listBackupObjects } from "./backup-DzI9jLwc.js";
-import { a as currentAmbientTransaction, i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-1IkI4Lle.js";
-import { t as METRIC_SERIES } from "./history-store-By2R_G1b.js";
+import { a as currentAmbientTransaction, i as createJobStore, n as createJobQueue, r as defaultBackoff } from "./jobs-Bjr8DZAi.js";
+import { t as METRIC_SERIES } from "./history-store-CetkrBBD.js";
 import { createHash, createSign, randomBytes } from "node:crypto";
 import * as fs$3 from "fs";
 import fs, { existsSync } from "fs";
@@ -7379,7 +7379,7 @@ async function mountOpenApiDocs(app, basePath, enableSwagger, serverCollections,
 		basePath,
 		requireAuth
 	}));
-	const { generateOpenApiSpec } = await import("./openapi-generator-BDpoKZQ9.js");
+	const { generateOpenApiSpec } = await import("./openapi-generator-D8uFz-LW.js");
 	generateOpenApiSpecFn = generateOpenApiSpec;
 	if (isPublic) app.get(`${basePath}/docs`, (c) => spec(c));
 	else app.get(`${basePath}/docs`, createRequireAuth({}), requireAdmin, (c) => spec(c));
@@ -8834,6 +8834,33 @@ function injectCallbackClient(results, client) {
 	return injected;
 }
 //#endregion
+//#region src/init/global-callbacks.ts
+/**
+* Hand the backend's global callbacks to one driver.
+*
+* `initializeRebaseBackend({ callbacks })` is declared once, on the backend,
+* but no driver resolves callbacks from the backend's `collectionRegistry`:
+* each builds a registry of its own in `initializeDriver` and reads global
+* callbacks from that. So they are given to each driver here, by the
+* coordinator, rather than left for every driver to remember to ask for.
+*
+* Refuses rather than skipping, in two cases.
+*
+* - **A registry that cannot take them.** Every collection that driver serves
+*   would run with the global hooks off, an `afterRead` that masks PII among
+*   them, and nothing would say so.
+* - **A global `beforeQuery` on a driver that does not compile one.** Only
+*   `@rebasepro/server-postgres` narrows a read before running it. Anywhere
+*   else the hook is a row filter that filters nothing, which is the refusal
+*   `assertBeforeQueryIsPostgresOnly` makes for a collection's own hook.
+*/
+function handGlobalCallbacksTo(driverId, engine, driverResult, callbacks) {
+	if (callbacks.beforeQuery && engine !== "postgres") throw new Error(`callbacks.beforeQuery: a global \`beforeQuery\` narrows every collection's reads before they are compiled, which is a Postgres feature, and data source "${driverId}" is served by \`${engine}\`. Its collections would keep returning every row the engine allows. Declare the hook on the Postgres collections that need it instead. Redaction that works on every engine is \`afterRead\`.`);
+	const registry = driverResult.collectionRegistry;
+	if (!registry?.setGlobalCallbacks) throw new Error(`callbacks: data source "${driverId}" (\`${engine}\`) returned no collection registry that accepts global callbacks, so the ones declared on \`initializeRebaseBackend({ callbacks })\` would not run on any of its collections. Return a \`collectionRegistry\` implementing \`setGlobalCallbacks\` from the adapter's \`initializeDriver\`, or move the hooks onto each collection's \`callbacks\`.`);
+	registry.setGlobalCallbacks(callbacks);
+}
+//#endregion
 //#region src/init/process-safety.ts
 /**
 * Installed once per process. The singleton is process-global for the same
@@ -10685,57 +10712,31 @@ function warnOnAuthCollectionDataCallbacks(collection) {
 * So the framework restates it. Not by rejecting the collection — a boot failure
 * over a field a developer never thought about is a bad trade, and an existing
 * deployment would stop rather than start protecting itself — but by adding the
-* flag and saying so. Which columns count is not a second list to maintain: it
-* is read off {@link defaultUsersCollection}, so a secret added there is covered
-* here on the same commit.
-*/
-/**
-* The column names the default users collection marks `excludeFromApi`.
-*
-* Keyed by *column*, not by property name, because the whole point is to match a
-* redeclaration that chose different property names — the control plane's copy
-* spelled them `password_hash` and `email_verification_token` where the default
-* says `passwordHash` and `emailVerificationToken`.
+* flag and saying so. Which columns count is decided once, by
+* {@link authSecretsMissingExclusion} in `@rebasepro/common`, and every
+* `CollectionRegistry` applies the same rule to the copies it makes — which is
+* how the panel, building its registry from the project's file as written,
+* agrees with the server.
 */
-function defaultExcludedColumns() {
-	const properties = defaultUsersCollection.properties ?? {};
-	const columns = /* @__PURE__ */ new Set();
-	for (const [key, property] of Object.entries(properties)) {
-		if (!property?.excludeFromApi) continue;
-		columns.add(property.columnName ?? key);
-		columns.add(key);
-	}
-	return columns;
-}
-/** Is this collection the one the auth subsystem stores users in? */
-function isAuthCollection(collection) {
-	const auth = collection.auth;
-	if (auth === true) return true;
-	return Boolean(auth && typeof auth === "object" && auth.enabled === true);
-}
 /**
 * Force `excludeFromApi` onto the auth collection's secret columns.
 *
-* Mutates in place and must therefore run BEFORE the collections are registered:
-* each registry re-normalizes what it is given, and a flag set afterwards
-* reaches whichever copy happened to be mutated and no others.
+* Mutates in place, for what reads the collection configs directly rather than a
+* registry's normalized copies. Run it before the collections are handed on, so
+* those readers never see a config without the flag.
 *
 * @returns the columns it had to fix, per collection — for the caller to log and
 *          for tests to assert on.
 */
 function enforceAuthSecretExclusion(collections) {
-	const secrets = defaultExcludedColumns();
 	const fixed = [];
 	for (const raw of collections) {
 		const collection = raw;
-		if (!collection?.properties || !isAuthCollection(collection)) continue;
-		const columns = [];
-		for (const [key, property] of Object.entries(collection.properties)) {
-			if (!property || property.excludeFromApi) continue;
-			const column = property.columnName ?? key;
-			if (!secrets.has(column) && !secrets.has(key)) continue;
-			property.excludeFromApi = true;
-			columns.push(key);
+		if (!collection?.properties) continue;
+		const columns = authSecretsMissingExclusion(collection);
+		for (const key of columns) {
+			const property = collection.properties[key];
+			if (property) property.excludeFromApi = true;
 		}
 		if (columns.length > 0) fixed.push({
 			slug: collection.slug ?? "(unnamed)",
@@ -15475,16 +15476,23 @@ function matchesLogical(row, condition) {
 * cached row does not carry — a local list may therefore be missing rows the
 * server would have returned, which is why {@link isExactlyEvaluable} refuses
 * to call a search query exact.
+*
+* Every term has to match, but they may match different fields — the same rule
+* both drivers apply, and the one that finds `sebastian melendez` on a row that
+* keeps the two halves of a name in separate fields. Matching the typed string
+* as a whole found neither that row nor, because the space was part of the
+* needle, anything at all for `sebastian `.
 */
 function matchesSearch(row, searchString) {
 	if (!searchString) return true;
-	const needle = searchString.trim().toLowerCase();
-	if (!needle) return true;
-	for (const value of Object.values(row)) {
-		if (typeof value === "string" && value.toLowerCase().includes(needle)) return true;
-		if (typeof value === "number" && String(value).includes(needle)) return true;
-	}
-	return false;
+	const terms = splitSearchTerms(searchString).map((term) => term.toLowerCase());
+	if (terms.length === 0) return true;
+	const values = Object.values(row);
+	return terms.every((term) => values.some((value) => {
+		if (typeof value === "string") return value.toLowerCase().includes(term);
+		if (typeof value === "number") return String(value).includes(term);
+		return false;
+	}));
 }
 /** Does this row belong in the result set for `params`, ignoring pagination? */
 function matchesParams(row, params) {
@@ -18932,6 +18940,7 @@ async function _initializeRebaseBackend(config) {
 				provision: config.provisionSchema ?? true
 			}
 		});
+		if (config.callbacks) handGlobalCallbacksTo(b.id || bootstrapper.type, bootstrapper.type, driverResult, config.callbacks);
 		delegates[b.id || bootstrapper.type] = driverResult.driver;
 		driverResults.set(bootstrapper, driverResult);
 		if (introspectCollections) {
@@ -19171,7 +19180,7 @@ async function _initializeRebaseBackend(config) {
 			]) {
 				const providerConfig = safeAuthConfig[key];
 				if (providerConfig && requiredFields.every((f) => Boolean(providerConfig[f]))) {
-					const createFn = (await import("./auth-BS4WBA10.js").then((n) => n.t))[factory];
+					const createFn = (await import("./auth-CCDpk2rn.js").then((n) => n.t))[factory];
 					oauthProviders.push(createFn(providerConfig));
 				}
 			}
@@ -19676,8 +19685,8 @@ async function _initializeRebaseBackend(config) {
 	if (surfaces.cron || config.cronsDir && ownership.cronScheduler) {
 		const { loadCronJobsWithDiagnostics } = await import("./cron-loader-CQjvjpEw.js").then((n) => n.t);
 		const { CronScheduler } = await import("./cron-scheduler-COPQxlEq.js").then((n) => n.n);
-		const { createCronRoutes } = await import("./cron-routes-B_wlLybo.js").then((n) => n.n);
-		const { createCronStore } = await import("./cron-store-Dp0X7zRB.js").then((n) => n.n);
+		const { createCronRoutes } = await import("./cron-routes-B7CRGfiq.js").then((n) => n.n);
+		const { createCronStore } = await import("./cron-store-BYGZFNWk.js").then((n) => n.n);
 		const { jobs: loadedCronJobs, problems: cronProblems } = config.cronsDir ? await loadCronJobsWithDiagnostics(config.cronsDir) : {
 			jobs: [],
 			problems: []
@@ -19734,7 +19743,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let metricsHistory;
 	try {
-		const { createMetricsHistory } = await import("./history-recorder-5VKT7nss.js");
+		const { createMetricsHistory } = await import("./history-recorder-BQmB0P_j.js");
 		metricsHistory = createMetricsHistory(defaultDriver);
 		if (metricsHistory) {
 			await metricsHistory.ensure();
@@ -19746,7 +19755,7 @@ async function _initializeRebaseBackend(config) {
 	}
 	let jobQueue;
 	if (config.jobs?.enabled) {
-		const { createJobStore, createJobQueue } = await import("./jobs-1IkI4Lle.js").then((n) => n.t);
+		const { createJobStore, createJobQueue } = await import("./jobs-Bjr8DZAi.js").then((n) => n.t);
 		const store = createJobStore(defaultDriver);
 		if (store) {
 			await store.ensureTable();
@@ -19885,6 +19894,11 @@ Use a driver that supports the job queue, or remove the declarations. Refusing t
 		return targets;
 	};
 	const setCollectionCallbacks = (slug, callbacks) => {
+		const declared = collectionRegistry.get(slug);
+		if (declared) assertBeforeQueryIsPostgresOnly([{
+			...declared,
+			callbacks
+		}]);
 		let attached = 0;
 		const replaced = /* @__PURE__ */ new Set();
 		for (const registry of callbackTargets()) {