@rebasepro/server 0.21.2-canary.g1ea48be → 0.23.0

package/dist/{src-BYax9_rm.js → src-pmvW7BFx.js}

@@ -3,7 +3,7 @@ import __rebaseProcess from "process";
 globalThis.process ??= __rebaseProcess;
 __rebaseCreateRequire(import.meta.url);
 import { r as __require, t as __commonJSMin } from "./rolldown-runtime-dW7B1o5h.js";
-import { A as LIST_OPS, C as getDeclaredSubcollections, D as getDataSourceCapabilities, F as sortKeyToString, I as toCanonicalOp, M as REST_TO_CANONICAL, N as isRelationAggregateSort, O as ALL_WHERE_FILTER_OPS, T as isRelationalCollectionConfig, j as NULL_OPS, k as CANONICAL_TO_REST, p as resolveResourceRefs, w as isPostgresCollectionConfig, x as rewriteLegacyRlsFunctions } from "./src-Br6ARbs6.js";
+import { A as NULL_OPS, C as isPostgresCollectionConfig, D as ALL_WHERE_FILTER_OPS, E as getDataSourceCapabilities, F as toCanonicalOp, M as isRelationAggregateSort, O as CANONICAL_TO_REST, P as sortKeyToString, S as getDeclaredSubcollections, b as rewriteLegacyRlsFunctions, f as resolveResourceRefs, j as REST_TO_CANONICAL, k as LIST_OPS, w as isRelationalCollectionConfig } from "./src-vkcwKXbT.js";
 //#region ../types/src/errors.ts
 /**
 * The single error type thrown across the entire Rebase client surface —
@@ -261,6 +261,10 @@ var Vector = class {
 */
 var JUNCTION_PIVOT_KEY = "_pivot";
 /** @group Models */
+function hasForeignKeyOnTarget(relation) {
+	return relation.kind === "hasOne" || relation.kind === "hasMany";
+}
+/** @group Models */
 function isManyToMany(relation) {
 	return relation.kind === "manyToMany";
 }
@@ -1528,6 +1532,42 @@ function suggestNearMiss(known, key) {
 	return known.find((candidate) => isNearMiss(candidate, key));
 }
 /**
+* The terms a user meant when they typed into a search box.
+*
+* A search box is not a substring box. Typing `sebastian melendez` on a
+* collection whose name is split across `first_name` and `last_name` has to
+* find the row, and matching the whole string against each field separately
+* cannot: no single column holds both words. Splitting on whitespace and
+* requiring *every* term to match *some* field is what does, and it is what
+* `websearch_to_tsquery` already does for collections that declared a `search`
+* block — so this is also what keeps the two search paths answering the same
+* question.
+*
+* It fixes the trailing space too: `sebastian ` matched nothing at all, because
+* the space was part of the pattern.
+*
+* A double-quoted run is one term, again matching the full-text path, so a
+* caller who really does want the phrase can ask for it. An unbalanced quote is
+* stripped rather than honoured — the alternative is that everything after a
+* stray `"` silently becomes one long term that matches nothing.
+*
+* Returns an empty array for a string with no terms in it at all (whitespace,
+* or nothing but quotes); the caller decides what an empty search means, since
+* only it knows whether "no constraint" or "no rows" is the safe reading.
+*/
+function splitSearchTerms(searchString, maxTerms = 8) {
+	const terms = [];
+	const pattern = /"([^"]*)"|(\S+)/g;
+	let match;
+	while ((match = pattern.exec(searchString)) !== null) {
+		const term = (match[1] ?? match[2].replace(/"/g, "")).trim();
+		if (!term) continue;
+		terms.push(term);
+		if (terms.length >= maxTerms) break;
+	}
+	return terms;
+}
+/**
 * Deep clone a value, preserving function references and class instances.
 * Unlike structuredClone, this handles objects that contain functions
 * (e.g. CollectionConfig with target(), childCollections(), callbacks).
@@ -3230,6 +3270,7 @@ var REBASE_INTERNAL_TABLES = [
 	"api_keys",
 	"cron_logs",
 	"cron_claims",
+	"cron_job_state",
 	"jobs",
 	"rate_limit_hits",
 	"idempotency_keys",
@@ -4190,6 +4231,37 @@ var CollectionRegistry = class {
 		};
 	}
 };
+//#endregion
+//#region ../common/src/collections/engine-support.ts
+/**
+* Refuse a `beforeQuery` hook on a collection Postgres does not serve.
+*
+* `beforeQuery` narrows a read *before it is compiled*, which means compiling
+* a declarative filter into the query the engine is about to run. Only
+* `@rebasepro/server-postgres` does that today. On any other engine the hook
+* would look configured and do nothing — and for a hook whose whole purpose is
+* to restrict which rows come back, "nothing" means every row served to
+* everybody.
+*
+* So it is a boot failure, named. The alternative — declaring the hook only on
+* `PostgresCollectionConfig`, the way `search` is — is not available:
+* `callbacks` is one engine-agnostic type shared by every collection, and
+* splitting it would fork `afterRead` and the five write hooks along with it.
+*
+* Lives here rather than in either driver because both have to run it: the
+* Postgres schema planner sees every collection in a mixed app, and a
+* Mongo-only app never boots a Postgres planner at all.
+*
+* Called with *every* collection, before an engine filters any out.
+*/
+var assertBeforeQueryIsPostgresOnly = (collections) => {
+	for (const collection of collections) {
+		if (isPostgresCollectionConfig(collection)) continue;
+		if (!collection.callbacks?.beforeQuery) continue;
+		const engine = collection.engine ?? "non-postgres";
+		throw new Error(`${collection.slug}.callbacks.beforeQuery: narrowing a read before it is compiled is a Postgres feature, and this collection is served by \`${engine}\`. Remove the hook — it would otherwise look configured while every read kept returning every row the engine allows. Redaction that works on every engine is \`afterRead\`.`);
+	}
+};
 /**
 * What a property's access rules actually are, with `excludeFromApi` expanded.
 *
@@ -4250,18 +4322,36 @@ function canWriteField(property, viewer) {
 * who knows the table can send `password_hash` as readily as `passwordHash`, and
 * a rule that only knew the wire name would be one rename away from useless.
 *
+* A restricted to-one relation takes its foreign key with it. `bandId: 7` names
+* the band exactly as `band: { id: 7 }` does, and the row carries the column
+* beside the relation — so a rule on the relation that left the key alone
+* withheld the value from the row and still let `?bandId=7` ask for it.
+*
 * `kind` picks which half of the rule is read; nothing else differs.
 */
 function restrictedFieldNames(collection, viewer, kind) {
 	const declared = [];
 	const refused = /* @__PURE__ */ new Set();
 	const allowed = kind === "read" ? canReadField : canWriteField;
-	for (const [name, property] of Object.entries(collection.properties ?? {})) {
-		if (allowed(property, viewer)) continue;
-		declared.push(name);
+	const properties = collection.properties ?? {};
+	let relations;
+	const restrict = (name) => {
+		if (name in properties && !declared.includes(name)) declared.push(name);
 		refused.add(name);
+	};
+	for (const [name, property] of Object.entries(properties)) {
+		if (allowed(property, viewer)) continue;
+		restrict(name);
 		const columnName = property.columnName;
 		if (columnName) refused.add(columnName);
+		if (property.type === "relation") {
+			relations ??= resolveCollectionRelations(collection);
+			const relation = findRelation(relations, name);
+			if (relation?.kind === "belongsTo") {
+				restrict(fieldKeyForColumn(collection, relation.localKey));
+				refused.add(relation.localKey);
+			}
+		}
 	}
 	return {
 		declared,
@@ -5027,19 +5117,23 @@ function normalizeMaxRows(raw) {
 * @param label  the collection name, so an error says which walk failed
 */
 async function* paginateFind(find, params, label = "collection") {
-	const { pageSize, cursor, maxPages, ...rest } = params ?? {};
+	const { pageSize, cursor, maxPages, after: startAfter, offset: startOffset, page: startPage, ...rest } = params ?? {};
 	const findParams = { ...rest };
 	const size = normalizePageSize(pageSize);
 	const pageCap = normalizeMaxPages(maxPages);
-	const seekRequested = cursor !== void 0 && cursor !== null;
-	if (seekRequested) {
+	const seekRequested = cursor !== void 0 && cursor !== null || !!startAfter;
+	if (cursor !== void 0 && cursor !== null) {
 		const field = typeof cursor === "string" ? cursor : cursor.field;
 		const requested = typeof cursor === "object" && cursor !== null ? cursor.direction : void 0;
 		if (!normalizeOrderBy(findParams.orderBy)) findParams.orderBy = [field, requested ?? "asc"];
 	}
-	let offset = 0;
+	let offset = resolveFindWindow({
+		limit: size,
+		offset: startOffset,
+		page: startPage
+	}).offset;
 	let pages = 0;
-	let after;
+	let after = startAfter || void 0;
 	for (;;) {
 		if (pages >= pageCap) throw new RebasePaginationError("max-pages", `Iterating "${label}" made ${pages} requests without the server reporting the end of the collection. Stopping rather than looping forever — raise \`maxPages\` if the walk is genuinely this long, or check that the backend sets \`meta.hasMore\`.`);
 		const pageParams = {
@@ -5104,9 +5198,16 @@ async function collectAllPages(find, params, label = "collection") {
 * Relation values (`EntityRelation` instances or `{ __type: "relation", id, path }`
 * objects) are serialized as their raw id — the wire format only carries the
 * value to compare against the FK column.
+*
+* A `Date` is its ISO 8601 instant — what JSON makes of it on the socket and
+* in-process, so one filter names one instant through every door. `String()`
+* gave the viewer's local zone, no milliseconds and a parenthesised zone name
+* Postgres cannot parse. An invalid date keeps its "Invalid Date" spelling for
+* the server to refuse, rather than throwing a `RangeError` from here.
 */
 function stringifyValue(value) {
 	if (value === null) return "null";
+	if (value instanceof Date && !Number.isNaN(value.getTime())) return value.toISOString();
 	const relation = normalizeToEntityRelation(value);
 	if (relation) return String(relation.id);
 	return String(value);
@@ -5164,6 +5265,41 @@ function unescapeWireValue(value) {
 	return result;
 }
 /**
+* Whether a scalar, sent raw as a query parameter's operand, would be read
+* back as something other than itself.
+*
+* A query parameter owns its whole value, so its scalar goes out unescaped —
+* `eq.a,b`, `eq.C:\x` — and the decoder returns it verbatim. Two shapes break
+* that. A parenthesised operand is a list for every operator (so that
+* `["==", ["a","b"]]` on an array column stays a list), so raw, the scalar
+* `"(deleted)"` would arrive as `["deleted"]`: an `==` matching nothing, a
+* `!=` returning the very rows it excludes. Such a scalar is sent escaped,
+* `eq.\(deleted\)`. And that spelling has to be told apart from a raw value
+* that looks the same, so a scalar of *that* shape is escaped in turn.
+*
+* Everything else stays raw, so a value an older client sends decodes as it
+* always has — unless it is exactly the escaped spelling of such a scalar,
+* which decodes to the scalar it spells.
+*/
+function scalarNeedsEscape(value) {
+	if (value.startsWith("(") && value.endsWith(")")) return true;
+	return decodeEscapedScalar(value) !== void 0;
+}
+/**
+* The scalar an operand is the escaped spelling of, when it is one.
+*
+* Exact on purpose: only an operand that {@link escapeWireValue} produces from
+* a scalar that {@link scalarNeedsEscape} is decoded. Any other operand —
+* including a raw backslash an older client sent, like `\\server\share` — is
+* left verbatim. Terminates because an operand that matches contains an
+* escape pair, so the value is strictly shorter than it.
+*/
+function decodeEscapedScalar(operand) {
+	if (!operand.startsWith("\\")) return void 0;
+	const value = unescapeWireValue(operand);
+	return escapeWireValue(value) === operand && scalarNeedsEscape(value) ? value : void 0;
+}
+/**
 * Split a parenthesized list string on unescaped commas.
 * Input is the content between `(` and `)`.
 *
@@ -5408,6 +5544,42 @@ function readTuple(field, raw) {
 	if (isOperatorShaped(op)) throw new UnknownFilterOperatorError(field, op);
 }
 /**
+* The query-parameter names a REST listing reads as something other than a
+* field filter: pagination, sorting, includes, projection, search, the logical
+* groups, the JSON `where` dialect, an aggregate's `select`/`groupBy`, and the
+* soft-delete switches.
+*
+* One list for both ends. The server skips these names when it collects
+* `?<field>=<op>.<value>` filters, and the SDK sends a filter on a column with
+* one of these names inside `?where=` instead — a collection is free to have a
+* `page`, `select` or `hard` column, and a filter on it sent as its own
+* parameter was read as the parameter and never applied.
+*/
+var RESERVED_QUERY_KEYS = /* @__PURE__ */ new Set([
+	"limit",
+	"offset",
+	"page",
+	"after",
+	"orderBy",
+	"include",
+	"fields",
+	"distinct",
+	"searchString",
+	"searchExplain",
+	"vector_search",
+	"vector",
+	"vector_distance",
+	"vector_threshold",
+	"or",
+	"and",
+	"not",
+	"where",
+	"select",
+	"groupBy",
+	"deleted",
+	"hard"
+]);
+/**
 * Encode the `<op>.<value>` half of a wire condition.
 *
 * This is the single leaf encoder. Both wire positions that carry a condition
@@ -5435,7 +5607,7 @@ function serializeOperatorAndValue(op, value, { escapeScalar, where }) {
 		return `${restOp}.(${value.map((v) => escapeWireValue(stringifyValue(v))).join(",")})`;
 	}
 	const scalar = stringifyValue(value);
-	return `${restOp}.${escapeScalar ? escapeWireValue(scalar) : scalar}`;
+	return `${restOp}.${escapeScalar || !LIST_OPS.has(op) && scalarNeedsEscape(scalar) ? escapeWireValue(scalar) : scalar}`;
 }
 /**
 * Serialize a single canonical condition tuple to a PostgREST dot-string.
@@ -5531,7 +5703,10 @@ var NULL_OPERANDS = /* @__PURE__ */ new Set([
 *   operand: only {@link NULL_OPERANDS}. `notnull.reason` is the value
 *   `"notnull.reason"`, not "reason is not null".
 * - **Everything else** takes one scalar, and any remainder is one — including
-*   the empty string, so `eq.` really is "equals the empty string".
+*   the empty string, so `eq.` really is "equals the empty string". A
+*   parenthesised remainder is a list for these too (`eq.(a,b)` is array
+*   equality); a scalar that is itself parenthesised arrives escaped,
+*   `eq.\(none\)`, and is decoded here — see {@link scalarNeedsEscape}.
 *
 * ### The one ambiguity that remains, and how to write past it
 *
@@ -5566,7 +5741,7 @@ function deserializeSingle(raw) {
 		return [canonicalOp, inner === EMPTY_LIST_TOKEN ? [] : splitListItems(inner)];
 	}
 	if (LIST_OPS.has(canonicalOp)) return ["==", raw];
-	return [canonicalOp, rest];
+	return [canonicalOp, decodeEscapedScalar(rest) ?? rest];
 }
 /**
 * Convert a PostgREST-style querystring record to `FilterValues`.
@@ -6508,6 +6683,6 @@ function buildRoutedRebaseData({ defaultData, sources, resolveKey }) {
 }
 new Set(REBASE_INTERNAL_TABLES);
 //#endregion
-export { resolveClientListLimit as $, isRelationalCollection as A, findRelation as B, decodeCursor as C, restrictedFieldNames as D, effectiveAccess as E, getJunctionConfigForRelation as F, buildCompositeId as G, isRelationRequired as H, getEffectiveSecurityRules as I, suggestNearMiss as J, resolvePrimaryKeys as K, getTenantConfig as L, authSecretsMissingExclusion as M, REBASE_USER_ROLE as N, CollectionRegistry as O, revokeInternalTableSql as P, MAX_LIST_LIMIT as Q, securityRuleToConditions as R, cursorToStartAfter as S, canWriteField as T, resolveCollectionRelations as U, getTableName as V, enumToObjectEntries as W, unref as X, toSnakeCase as Y, ListLimitError as Z, OrderBySpecError as _, deserializeLogicalCondition as a, isAnonymousUid as at, CursorError as b, collectAllPages as c, isToMany as ct, IncludeSpecError as d, GeoPoint as dt, BATCH_REF_KEY as et, deserializeInclude as f, Vector as ft, topLevelIncludeNames as g, unsupportedMethod as gt, serializeInclude as h, isUnsupported as ht, deserializeFilter as i, ANONYMOUS_USER_ID as it, resolveDataSource as j, createDataSourceRegistry as k, paginateFind as l, EntityReference as lt, normalizeInclude as m, RebaseClientError as mt, buildSdkData as n, hasFieldOperation as nt, serializeFilter as o, JUNCTION_PIVOT_KEY as ot, mergeIncludeSpecs as p, RebaseApiError as pt, hydrateRegExp as q, UnknownFilterOperatorError as r, isFieldOperation as rt, serializeLogicalCondition as s, isManyToMany as st, buildRoutedRebaseData as t, FIELD_OPERATORS as tt, resolveFindWindow as u, EntityRelation as ut, normalizeOrderBy as v, reconcileCursorOrder as w, CursorMismatchError as x, serializeOrderBy as y, fieldKeyForColumn as z };
+export { toSnakeCase as $, createDataSourceRegistry as A, fieldKeyForColumn as B, cursorToStartAfter as C, restrictedFieldNames as D, effectiveAccess as E, revokeInternalTableSql as F, resolveCollectionRelations as G, getTableName as H, getJunctionConfigForRelation as I, resolvePrimaryKeys as J, enumToObjectEntries as K, getEffectiveSecurityRules as L, resolveDataSource as M, authSecretsMissingExclusion as N, assertBeforeQueryIsPostgresOnly as O, REBASE_USER_ROLE as P, suggestNearMiss as Q, getTenantConfig as R, CursorMismatchError as S, reconcileCursorOrder as T, isRelationRequired as U, findRelation as V, relationDeclaringProperty as W, isObject as X, hydrateRegExp as Y, splitSearchTerms as Z, topLevelIncludeNames as _, Vector as _t, deserializeFilter as a, FIELD_OPERATORS as at, serializeOrderBy as b, isUnsupported as bt, serializeLogicalCondition as c, ANONYMOUS_USER_ID as ct, resolveFindWindow as d, hasForeignKeyOnTarget as dt, unref as et, IncludeSpecError as f, isManyToMany as ft, serializeInclude as g, GeoPoint as gt, normalizeInclude as h, EntityRelation as ht, UnknownFilterOperatorError as i, BATCH_REF_KEY as it, isRelationalCollection as j, CollectionRegistry as k, collectAllPages as l, isAnonymousUid as lt, mergeIncludeSpecs as m, EntityReference as mt, buildSdkData as n, MAX_LIST_LIMIT as nt, deserializeLogicalCondition as o, hasFieldOperation as ot, deserializeInclude as p, isToMany as pt, buildCompositeId as q, RESERVED_QUERY_KEYS as r, resolveClientListLimit as rt, serializeFilter as s, isFieldOperation as st, buildRoutedRebaseData as t, ListLimitError as tt, paginateFind as u, JUNCTION_PIVOT_KEY as ut, OrderBySpecError as v, RebaseApiError as vt, decodeCursor as w, CursorError as x, unsupportedMethod as xt, normalizeOrderBy as y, RebaseClientError as yt, securityRuleToConditions as z };
 
-//# sourceMappingURL=src-BYax9_rm.js.map
+//# sourceMappingURL=src-pmvW7BFx.js.map