@rebasepro/server 0.21.1 → 0.22.0

package/dist/{src-Caz7nREj.js → src-1vL-I1Po.js}

@@ -1528,6 +1528,42 @@ function suggestNearMiss(known, key) {
 	return known.find((candidate) => isNearMiss(candidate, key));
 }
 /**
+* The terms a user meant when they typed into a search box.
+*
+* A search box is not a substring box. Typing `sebastian melendez` on a
+* collection whose name is split across `first_name` and `last_name` has to
+* find the row, and matching the whole string against each field separately
+* cannot: no single column holds both words. Splitting on whitespace and
+* requiring *every* term to match *some* field is what does, and it is what
+* `websearch_to_tsquery` already does for collections that declared a `search`
+* block — so this is also what keeps the two search paths answering the same
+* question.
+*
+* It fixes the trailing space too: `sebastian ` matched nothing at all, because
+* the space was part of the pattern.
+*
+* A double-quoted run is one term, again matching the full-text path, so a
+* caller who really does want the phrase can ask for it. An unbalanced quote is
+* stripped rather than honoured — the alternative is that everything after a
+* stray `"` silently becomes one long term that matches nothing.
+*
+* Returns an empty array for a string with no terms in it at all (whitespace,
+* or nothing but quotes); the caller decides what an empty search means, since
+* only it knows whether "no constraint" or "no rows" is the safe reading.
+*/
+function splitSearchTerms(searchString, maxTerms = 8) {
+	const terms = [];
+	const pattern = /"([^"]*)"|(\S+)/g;
+	let match;
+	while ((match = pattern.exec(searchString)) !== null) {
+		const term = (match[1] ?? match[2].replace(/"/g, "")).trim();
+		if (!term) continue;
+		terms.push(term);
+		if (terms.length >= maxTerms) break;
+	}
+	return terms;
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -2739,7 +2775,7 @@ var DEFAULT_GUARDED_OPS = [
 	"delete"
 ];
 /** Whether a collection is flagged as an authentication collection. */
-function isAuthCollection(collection) {
+function isAuthCollection$1(collection) {
 	const auth = collection.auth;
 	return auth === true || typeof auth === "object" && auth?.enabled === true;
 }
@@ -2792,7 +2828,7 @@ function getEffectiveSecurityRules(collection) {
 	if (isPostgresCollectionConfig(collection) && collection.disableDefaultPolicies) return [
 		...explicit,
 		...tenantRule(collection),
-		...isAuthCollection(collection) ? [adminWriteGate(tableName)] : []
+		...isAuthCollection$1(collection) ? [adminWriteGate(tableName)] : []
 	];
 	injected.push({
 		name: `${tableName}_default_admin_read`,
@@ -2805,7 +2841,7 @@ function getEffectiveSecurityRules(collection) {
 		condition: SERVER_OR_ADMIN_EXPR$1,
 		check: SERVER_OR_ADMIN_EXPR$1
 	});
-	if (isAuthCollection(collection)) {
+	if (isAuthCollection$1(collection)) {
 		injected.push({
 			name: `${tableName}_default_self_read`,
 			operations: ["select"],
@@ -3295,6 +3331,165 @@ function revokeInternalTableSql(schema, table) {
     `.trim();
 }
 //#endregion
+//#region ../common/src/collections/default-collections.ts
+/**
+* Default users collection.
+*
+* Prepended to the developer's collections array by the admin and server.
+* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
+* override by defining their own collection with `slug: "users"`.
+*
+* Schema only — no `admin` block. This package is on the backend's dependency path,
+* where that field does not exist: `@rebasepro/cms-types` adds it by declaration
+* merging, and a BaaS install never installs that. The scaffolded
+* `config/collections/users.ts` carries the presentation for projects that want this
+* collection in their panel, which is also where it is editable.
+*/
+var defaultUsersCollection = defineCollection({
+	name: "Users",
+	singularName: "User",
+	slug: "users",
+	auth: true,
+	table: "users",
+	schema: "rebase",
+	securityRules: [{
+		operation: "select",
+		roles: ["admin"]
+	}, {
+		operations: [
+			"insert",
+			"update",
+			"delete"
+		],
+		roles: ["admin"]
+	}],
+	properties: {
+		id: {
+			name: "ID",
+			type: "string",
+			isId: "uuid"
+		},
+		email: {
+			name: "Email",
+			type: "string",
+			validation: {
+				required: true,
+				unique: true
+			}
+		},
+		displayName: {
+			name: "Name",
+			type: "string",
+			columnName: "display_name",
+			validation: { required: true }
+		},
+		photoURL: {
+			name: "Photo URL",
+			type: "string",
+			columnName: "photo_url"
+		},
+		roles: {
+			name: "Roles",
+			type: "array",
+			columnType: "text[]",
+			of: {
+				name: "Role",
+				type: "string",
+				enum: {
+					admin: "Admin",
+					editor: "Editor",
+					viewer: "Viewer"
+				}
+			}
+		},
+		passwordHash: {
+			name: "Password Hash",
+			type: "string",
+			columnName: "password_hash",
+			excludeFromApi: true
+		},
+		emailVerified: {
+			name: "Email Verified",
+			type: "boolean",
+			columnName: "email_verified",
+			defaultValue: false
+		},
+		emailVerificationToken: {
+			name: "Email Verification Token",
+			type: "string",
+			columnName: "email_verification_token",
+			excludeFromApi: true
+		},
+		emailVerificationSentAt: {
+			name: "Email Verification Sent At",
+			type: "date",
+			columnName: "email_verification_sent_at"
+		},
+		metadata: {
+			name: "Metadata",
+			type: "map",
+			keyValue: true,
+			properties: {},
+			defaultValue: {}
+		},
+		createdAt: {
+			name: "Created At",
+			type: "date",
+			columnName: "created_at",
+			autoValue: "on_create"
+		},
+		updatedAt: {
+			name: "Updated At",
+			type: "date",
+			columnName: "updated_at",
+			autoValue: "on_update"
+		}
+	}
+});
+//#endregion
+//#region ../common/src/collections/auth-secrets.ts
+/** Is this collection the one the auth subsystem stores users in? */
+function isAuthCollection(collection) {
+	const auth = collection.auth;
+	if (auth === true) return true;
+	return typeof auth === "object" && auth !== null && "enabled" in auth && auth.enabled === true;
+}
+/**
+* The column names, and property keys, the default users collection marks
+* `excludeFromApi`.
+*
+* Both spellings, because a redeclaration is free to rename the property: one
+* project's copy says `password_hash` where the default says `passwordHash`, and
+* the column is the same either way. Read off {@link defaultUsersCollection}, so
+* a secret added there is covered on the same commit.
+*/
+function defaultSecretNames() {
+	const properties = defaultUsersCollection.properties;
+	const names = /* @__PURE__ */ new Set();
+	for (const [key, property] of Object.entries(properties)) {
+		if (!property?.excludeFromApi) continue;
+		names.add(key);
+		if (property.columnName) names.add(property.columnName);
+	}
+	return names;
+}
+/**
+* The keys of the properties on `collection` that hold an auth secret and do not
+* carry `excludeFromApi`. Empty for any collection that is not the user store: a
+* `password_hash` column elsewhere — a CRM importing hashes, say — is that
+* project's data, not this rule's business.
+*/
+function authSecretsMissingExclusion(collection) {
+	if (!collection.properties || !isAuthCollection(collection)) return [];
+	const secrets = defaultSecretNames();
+	const missing = [];
+	for (const [key, property] of Object.entries(collection.properties)) {
+		if (!property || property.excludeFromApi) continue;
+		if (secrets.has(key) || secrets.has(property.columnName ?? key)) missing.push(key);
+	}
+	return missing;
+}
+//#endregion
 //#region ../../node_modules/.pnpm/fast-equals@6.0.2/node_modules/fast-equals/dist/es/index.mjs
 var { getOwnPropertyNames, getOwnPropertySymbols } = Object;
 var { hasOwnProperty } = Object.prototype;
@@ -3912,7 +4107,9 @@ var CollectionRegistry = class {
 			if (!result.dataSource) result.dataSource = resolved.key;
 			if (!result.engine) result.engine = resolved.engine;
 		}
-		result.properties = this.normalizeProperties(result.properties, result);
+		const properties = this.normalizeProperties(result.properties, result);
+		result.properties = properties;
+		for (const key of authSecretsMissingExclusion(result)) properties[key].excludeFromApi = true;
 		return result;
 	}
 	normalizeProperties(properties, collection) {
@@ -4030,121 +4227,36 @@ var CollectionRegistry = class {
 	}
 };
 //#endregion
-//#region ../common/src/collections/default-collections.ts
-/**
-* Default users collection.
-*
-* Prepended to the developer's collections array by the admin and server.
-* Slug-based dedup (Map keyed by slug, last-write-wins) lets developers
-* override by defining their own collection with `slug: "users"`.
-*
-* Schema only — no `admin` block. This package is on the backend's dependency path,
-* where that field does not exist: `@rebasepro/cms-types` adds it by declaration
-* merging, and a BaaS install never installs that. The scaffolded
-* `config/collections/users.ts` carries the presentation for projects that want this
-* collection in their panel, which is also where it is editable.
-*/
-var defaultUsersCollection = defineCollection({
-	name: "Users",
-	singularName: "User",
-	slug: "users",
-	auth: true,
-	table: "users",
-	schema: "rebase",
-	securityRules: [{
-		operation: "select",
-		roles: ["admin"]
-	}, {
-		operations: [
-			"insert",
-			"update",
-			"delete"
-		],
-		roles: ["admin"]
-	}],
-	properties: {
-		id: {
-			name: "ID",
-			type: "string",
-			isId: "uuid"
-		},
-		email: {
-			name: "Email",
-			type: "string",
-			validation: {
-				required: true,
-				unique: true
-			}
-		},
-		displayName: {
-			name: "Name",
-			type: "string",
-			columnName: "display_name",
-			validation: { required: true }
-		},
-		photoURL: {
-			name: "Photo URL",
-			type: "string",
-			columnName: "photo_url"
-		},
-		roles: {
-			name: "Roles",
-			type: "array",
-			columnType: "text[]",
-			of: {
-				name: "Role",
-				type: "string",
-				enum: {
-					admin: "Admin",
-					editor: "Editor",
-					viewer: "Viewer"
-				}
-			}
-		},
-		passwordHash: {
-			name: "Password Hash",
-			type: "string",
-			columnName: "password_hash",
-			excludeFromApi: true
-		},
-		emailVerified: {
-			name: "Email Verified",
-			type: "boolean",
-			columnName: "email_verified",
-			defaultValue: false
-		},
-		emailVerificationToken: {
-			name: "Email Verification Token",
-			type: "string",
-			columnName: "email_verification_token",
-			excludeFromApi: true
-		},
-		emailVerificationSentAt: {
-			name: "Email Verification Sent At",
-			type: "date",
-			columnName: "email_verification_sent_at"
-		},
-		metadata: {
-			name: "Metadata",
-			type: "map",
-			keyValue: true,
-			properties: {},
-			defaultValue: {}
-		},
-		createdAt: {
-			name: "Created At",
-			type: "date",
-			columnName: "created_at",
-			autoValue: "on_create"
-		},
-		updatedAt: {
-			name: "Updated At",
-			type: "date",
-			columnName: "updated_at",
-			autoValue: "on_update"
-		}
+//#region ../common/src/collections/engine-support.ts
+/**
+* Refuse a `beforeQuery` hook on a collection Postgres does not serve.
+*
+* `beforeQuery` narrows a read *before it is compiled*, which means compiling
+* a declarative filter into the query the engine is about to run. Only
+* `@rebasepro/server-postgres` does that today. On any other engine the hook
+* would look configured and do nothing — and for a hook whose whole purpose is
+* to restrict which rows come back, "nothing" means every row served to
+* everybody.
+*
+* So it is a boot failure, named. The alternative — declaring the hook only on
+* `PostgresCollectionConfig`, the way `search` is — is not available:
+* `callbacks` is one engine-agnostic type shared by every collection, and
+* splitting it would fork `afterRead` and the five write hooks along with it.
+*
+* Lives here rather than in either driver because both have to run it: the
+* Postgres schema planner sees every collection in a mixed app, and a
+* Mongo-only app never boots a Postgres planner at all.
+*
+* Called with *every* collection, before an engine filters any out.
+*/
+var assertBeforeQueryIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.callbacks?.beforeQuery) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new Error(`${collection.slug}.callbacks.beforeQuery: narrowing a read before it is compiled is a Postgres feature, and this collection is served by \`${engine}\`. Remove the hook — it would otherwise look configured while every read kept returning every row the engine allows. Redaction that works on every engine is \`afterRead\`.`);
 	}
-});
+};
 /**
 * What a property's access rules actually are, with `excludeFromApi` expanded.
 *
@@ -6463,6 +6575,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 }
 new Set(REBASE_INTERNAL_TABLES);
 //#endregion
-export { resolveClientListLimit as $, createDataSourceRegistry as A, findRelation as B, decodeCursor as C, restrictedFieldNames as D, effectiveAccess as E, getJunctionConfigForRelation as F, buildCompositeId as G, isRelationRequired as H, getEffectiveSecurityRules as I, suggestNearMiss as J, resolvePrimaryKeys as K, getTenantConfig as L, resolveDataSource as M, REBASE_USER_ROLE as N, defaultUsersCollection as O, revokeInternalTableSql as P, MAX_LIST_LIMIT as Q, securityRuleToConditions as R, cursorToStartAfter as S, canWriteField as T, resolveCollectionRelations as U, getTableName as V, enumToObjectEntries as W, unref as X, toSnakeCase as Y, ListLimitError as Z, OrderBySpecError as _, deserializeLogicalCondition as a, isAnonymousUid as at, CursorError as b, collectAllPages as c, isToMany as ct, IncludeSpecError as d, GeoPoint as dt, BATCH_REF_KEY as et, deserializeInclude as f, Vector as ft, topLevelIncludeNames as g, unsupportedMethod as gt, serializeInclude as h, isUnsupported as ht, deserializeFilter as i, ANONYMOUS_USER_ID as it, isRelationalCollection as j, CollectionRegistry as k, paginateFind as l, EntityReference as lt, normalizeInclude as m, RebaseClientError as mt, buildSdkData as n, hasFieldOperation as nt, serializeFilter as o, JUNCTION_PIVOT_KEY as ot, mergeIncludeSpecs as p, RebaseApiError as pt, hydrateRegExp as q, UnknownFilterOperatorError as r, isFieldOperation as rt, serializeLogicalCondition as s, isManyToMany as st, buildRoutedRebaseData as t, FIELD_OPERATORS as tt, resolveFindWindow as u, EntityRelation as ut, normalizeOrderBy as v, reconcileCursorOrder as w, CursorMismatchError as x, serializeOrderBy as y, fieldKeyForColumn as z };
+export { ListLimitError as $, createDataSourceRegistry as A, fieldKeyForColumn as B, decodeCursor as C, restrictedFieldNames as D, effectiveAccess as E, revokeInternalTableSql as F, enumToObjectEntries as G, getTableName as H, getJunctionConfigForRelation as I, hydrateRegExp as J, buildCompositeId as K, getEffectiveSecurityRules as L, resolveDataSource as M, authSecretsMissingExclusion as N, assertBeforeQueryIsPostgresOnly as O, REBASE_USER_ROLE as P, unref as Q, getTenantConfig as R, cursorToStartAfter as S, canWriteField as T, isRelationRequired as U, findRelation as V, resolveCollectionRelations as W, suggestNearMiss as X, splitSearchTerms as Y, toSnakeCase as Z, OrderBySpecError as _, isUnsupported as _t, deserializeLogicalCondition as a, isFieldOperation as at, CursorError as b, collectAllPages as c, JUNCTION_PIVOT_KEY as ct, IncludeSpecError as d, EntityReference as dt, MAX_LIST_LIMIT as et, deserializeInclude as f, EntityRelation as ft, topLevelIncludeNames as g, RebaseClientError as gt, serializeInclude as h, RebaseApiError as ht, deserializeFilter as i, hasFieldOperation as it, isRelationalCollection as j, CollectionRegistry as k, paginateFind as l, isManyToMany as lt, normalizeInclude as m, Vector as mt, buildSdkData as n, BATCH_REF_KEY as nt, serializeFilter as o, ANONYMOUS_USER_ID as ot, mergeIncludeSpecs as p, GeoPoint as pt, resolvePrimaryKeys as q, UnknownFilterOperatorError as r, FIELD_OPERATORS as rt, serializeLogicalCondition as s, isAnonymousUid as st, buildRoutedRebaseData as t, resolveClientListLimit as tt, resolveFindWindow as u, isToMany as ut, normalizeOrderBy as v, unsupportedMethod as vt, reconcileCursorOrder as w, CursorMismatchError as x, serializeOrderBy as y, securityRuleToConditions as z };
 
-//# sourceMappingURL=src-Caz7nREj.js.map
+//# sourceMappingURL=src-1vL-I1Po.js.map