@rebasepro/server 0.9.1-canary.d906fb7 → 0.9.1-canary.e2fc7b6

package/dist/index.es.js

@@ -3502,6 +3502,21 @@ function createRoutedRealtimeService(opts) {
 //#region src/api/errors.ts
 /** Tracks whether we've already shown the doctor hint (once per process). */
 var _schemaDriftHinted = false;
+/** 5-character SQLSTATE, e.g. `42501`, `23505`. */
+var SQLSTATE_RE = /^[0-9A-Z]{5}$/;
+/**
+* Walk the cause chain for the underlying database error, identified by a
+* 5-char SQLSTATE `code`. Drizzle wraps the pg error in `.cause`, and route
+* code sometimes wraps drizzle again, so the real error may sit several
+* levels down.
+*/
+function extractDbError(error, depth = 0) {
+	if (!error || typeof error !== "object" || depth > 8) return null;
+	const e = error;
+	if (typeof e.code === "string" && SQLSTATE_RE.test(e.code)) return e;
+	if (e.cause && typeof e.cause === "object") return extractDbError(e.cause, depth + 1);
+	return null;
+}
 /**
 * Extract the missing table or column name from a PG error.
 * PG 42P01 messages look like: 'relation "my_table" does not exist'
@@ -3586,26 +3601,31 @@ var errorHandler = (err, c) => {
 		if (cause.code === "ECONNREFUSED" && !cause.address && Array.isArray(cause.errors)) resolvedCause = cause.errors.find((e) => e.address) || cause;
 		else resolvedCause = cause;
 	}
-	if (resolvedCause) {
+	const dbError = extractDbError(error);
+	if (resolvedCause && (resolvedCause.code === "ENETUNREACH" || resolvedCause.code === "ECONNREFUSED")) {
 		const cause = resolvedCause;
 		if (cause.code === "ENETUNREACH") logMessage = `Network unreachable. Cannot connect to database at ${cause.address}:${cause.port}.`;
-		else if (cause.code === "ECONNREFUSED") logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
-		else if (cause.code === "42703" || cause.code === "42P01") {
-			code = "SCHEMA_DRIFT";
-			logMessage = `Schema drift: ${cause.code === "42703" ? "column" : "table"} "${cause.table || cause.column || extractMissingIdentifier(cause.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
-		}
+		else logMessage = `Connection refused to database at ${cause.address}:${cause.port}. Is PostgreSQL running?`;
 	} else if ("code" in error && error.code === "ENETUNREACH") {
 		const netErr = error;
 		logMessage = `Network unreachable. Cannot connect to service at ${netErr.address}:${netErr.port}.`;
-	} else if ("code" in error && (error.code === "42703" || error.code === "42P01")) {
+	} else if (dbError && (dbError.code === "42703" || dbError.code === "42P01")) {
 		code = "SCHEMA_DRIFT";
-		const issue = error.code === "42703" ? "column" : "table";
-		const pgErr = error;
-		logMessage = `Schema drift: ${issue} "${pgErr.table || pgErr.column || extractMissingIdentifier(error.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
-	}
-	const causePg = error.cause && typeof error.cause === "object" ? error.cause : void 0;
-	const pgErrorCode = causePg?.code || error.code;
-	const isDbSchemaMismatch = code === "SCHEMA_DRIFT" || pgErrorCode === "42703" || pgErrorCode === "42P01";
+		logMessage = `Schema drift: ${dbError.code === "42703" ? "column" : "table"} "${dbError.table || dbError.column || extractMissingIdentifier(dbError.message) || "unknown"}" does not exist in the database. Run \`pnpm db:push\` to sync your schema, or \`pnpm db:migrate\` to apply pending migrations.`;
+	} else if (dbError) {
+		const parts = [`[PG ${dbError.code}] ${dbError.message}`];
+		if (dbError.detail) parts.push(`Detail: ${dbError.detail}`);
+		if (dbError.hint) parts.push(`Hint: ${dbError.hint}`);
+		if (dbError.table) parts.push(`Table: ${dbError.table}`);
+		if (dbError.column) parts.push(`Column: ${dbError.column}`);
+		if (dbError.constraint) parts.push(`Constraint: ${dbError.constraint}`);
+		if (dbError.code === "42501") {
+			code = "DB_PERMISSION_DENIED";
+			parts.push(`The database rejected the statement for lack of privilege — usually a row-level security policy${dbError.table ? ` on "${dbError.table}"` : ""} denying this role, or a stale FORCE ROW LEVEL SECURITY flag binding the owner connection.`);
+		}
+		logMessage = parts.join(". ");
+	}
+	const isDbSchemaMismatch = code === "SCHEMA_DRIFT";
 	if (isDbSchemaMismatch) {
 		logger.warn(`⚠️ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
 		if (!_schemaDriftHinted && process.env.NODE_ENV !== "production") {
@@ -3624,18 +3644,27 @@ var errorHandler = (err, c) => {
 			].join("\n"));
 		}
 	} else logger.error(`❌ [API] ${c.req.method} ${c.req.path} → ${statusCode} ${code}: ${logMessage}` + (reqId ? ` [${reqId}]` : ""));
-	if (!(isDbSchemaMismatch || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
+	if (!(isDbSchemaMismatch || dbError !== null || statusCode < 500 && code === "BAD_REQUEST")) logger.error(String(error.stack || error));
 	let clientMessage = "An unexpected error occurred";
 	if (statusCode < 500 && error.message) clientMessage = error.message;
 	else if (error instanceof ApiError || error.name === "ApiError") clientMessage = error.message;
 	else if (code === "SCHEMA_DRIFT") {
-		const pgErr = causePg || error;
-		clientMessage = `Schema drift: ${pgErr.code === "42703" || pgErrorCode === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
-	} else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
+		const pgErr = dbError || error;
+		clientMessage = `Schema drift: ${pgErr.code === "42703" ? "column" : "table"} "${pgErr.table || pgErr.column || extractMissingIdentifier(pgErr.message || error.message) || "unknown"}" does not exist. Run \`pnpm db:push\` to sync your schema.`;
+	} else if (code === "DB_PERMISSION_DENIED") clientMessage = `Permission denied by the database${dbError?.table ? ` on "${dbError.table}"` : ""} (row-level security). Check the RLS policies for this table.`;
+	else if (code === "INTERNAL_ERROR") clientMessage = "Internal Server Error";
+	const dbDetails = dbError ? {
+		dbCode: dbError.code,
+		...process.env.NODE_ENV !== "production" && {
+			dbMessage: dbError.message,
+			...dbError.detail && { detail: dbError.detail },
+			...dbError.hint && { hint: dbError.hint }
+		}
+	} : void 0;
 	return c.json({ error: {
 		message: clientMessage,
 		code,
-		...error.details !== void 0 && { details: error.details },
+		...error.details !== void 0 ? { details: error.details } : dbDetails !== void 0 ? { details: dbDetails } : {},
 		...reqId && { requestId: reqId }
 	} }, statusCode);
 };
@@ -3657,6 +3686,7 @@ function codeToStatus(code) {
 		EMAIL_EXISTS: 409,
 		ROLE_EXISTS: 409,
 		SCHEMA_DRIFT: 500,
+		DB_PERMISSION_DENIED: 500,
 		INTERNAL_ERROR: 500,
 		NOT_CONFIGURED: 503,
 		SERVICE_UNAVAILABLE: 503