@rebasepro/types 0.12.1-canary.gf5f1d39 → 0.13.0

package/src/types/database_adapter.ts

@@ -82,14 +82,55 @@ export interface DatabaseAdapter {
 
     /**
      * Initialize WebSocket server for realtime operations.
+     *
+     * `adapter` is the configured AuthAdapter, if any. It is what makes the
+     * socket secure by default: an implementation that receives one requires
+     * authentication regardless of whether a local `jwtSecret` exists. The
+     * parameter was missing from this signature while the caller in `init.ts`
+     * already passed it, so it was dropped at every adapter that routed through
+     * here — turning an adapter-authenticated server's socket into one that
+     * accepted every client as already authenticated.
      */
     initializeWebsockets?(
         server: unknown,
         realtimeService: RealtimeProvider,
         driver: DataDriver,
         config?: unknown,
+        adapter?: import("./auth_adapter").AuthAdapter,
     ): Promise<void> | void;
 
+    /**
+     * Bring the database's collection tables up to date, additively — the boot
+     * companion to `db push`. See `BackendBootstrapper.ensureCollectionSchema`
+     * for the contract (create-only; never drop, narrow, or rewrite).
+     *
+     * Optional, and MUST be forwarded by any wrapper that turns this adapter
+     * into a `BackendBootstrapper`: the runtime calls it through the bootstrapper
+     * at boot, and a wrapper that silently omits it leaves a managed tenant
+     * 500ing every data route with no create step ever having run.
+     */
+    ensureCollectionSchema?(
+        collections: unknown[],
+        driverResult: InitializedDriver,
+        log?: (message: string) => void,
+    ): Promise<{ applied: number }>;
+
+    /**
+     * Apply the collections' RLS policies (ENABLE ROW LEVEL SECURITY + the
+     * `securityRules` compiled to `CREATE POLICY`) — the boot companion to the
+     * policy half of `db push`. Idempotent; see
+     * `BackendBootstrapper.ensureCollectionPolicies`.
+     *
+     * Same forwarding requirement as `ensureCollectionSchema`: without the
+     * policies, tables exist but every user-context read is denied (a public
+     * collection answers 401).
+     */
+    ensureCollectionPolicies?(
+        collections: unknown[],
+        driverResult: InitializedDriver,
+        log?: (message: string) => void,
+    ): Promise<{ applied: number }>;
+
     /**
      * Return admin capabilities for this database (SQL editor, schema browser, branching).
      */

package/src/types/policy.ts

@@ -42,13 +42,49 @@ export type PolicyExpression =
  *
  * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
  * tautology on the user path** — it is true for anonymous visitors too. Use
- * {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
- * in", and {@link policy.serverContext} to mean "the trusted server context".
+ * {@link policy.authenticated} to mean "signed in", and
+ * {@link policy.serverContext} to mean "the trusted server context". Do not
+ * hand-write the comparison: see {@link ANONYMOUS_USER_IDS} for why one
+ * literal is not enough.
  *
  * @group Models
  */
 export const ANONYMOUS_USER_ID = "anonymous";
 
+/**
+ * Every uid that has ever meant "nobody is signed in" — newest first.
+ *
+ * There are two because there were two. The types, the policy compiler, the
+ * JavaScript evaluator and the linter were all built on
+ * {@link ANONYMOUS_USER_ID}, while the request path scoped unauthenticated
+ * callers as `'anon'` — so `policy.authenticated()`, which compiled to
+ * `auth.uid() <> 'anonymous'`, was *true* for an anonymous visitor. The
+ * sanctioned way to write "signed in" granted to everyone, and the linter
+ * flagged the spelling that actually worked as a foreign convention.
+ *
+ * The request path now reports {@link ANONYMOUS_USER_ID}. `'anon'` stays here
+ * because policies outlive the server that generated them: a database still
+ * holding policies from before the fix, or a project whose server has not been
+ * upgraded yet, must not become a grant in either direction. Compile against
+ * this list, not against a single literal.
+ *
+ * No real user id is ever one of these, so a match is always "not signed in".
+ *
+ * @group Models
+ */
+export const ANONYMOUS_USER_IDS: readonly string[] = [ANONYMOUS_USER_ID, "anon"];
+
+/**
+ * Whether a uid stands for "no one is signed in", in any spelling rebase has
+ * used. `null`/`undefined` is the trusted server context, not an anonymous
+ * caller, and is therefore **not** anonymous — see {@link ANONYMOUS_USER_ID}.
+ *
+ * @group Models
+ */
+export function isAnonymousUid(uid: string | null | undefined): boolean {
+    return typeof uid === "string" && ANONYMOUS_USER_IDS.includes(uid);
+}
+
 /** Always allows. Compiles to `true`. @group Models */
 export interface TruePolicyExpression {
     kind: "true";

package/src/types/project_manifest.ts

@@ -200,6 +200,21 @@ export interface RebaseProjectManifest {
      * common project and must not be required to say so.
      */
     storage?: Record<string, RebaseStorageSourceConfig>;
+    /**
+     * Repository-wide opt-out from anonymous CLI usage sharing.
+     *
+     * **Only `false` does anything.** It suppresses sharing for everyone who
+     * clones this repository, overriding each developer's own opt-in — an
+     * organisation setting policy for work done on its behalf, the same shape
+     * as a committed `.npmrc`.
+     *
+     * `true` is deliberately ignored, and the CLI says so rather than obeying
+     * quietly. This file is committed, so a `true` here would be one developer
+     * answering a privacy question for every colleague who later clones the
+     * repo — consent by proxy, which is the exact thing opt-in exists to
+     * prevent. Individuals opt in with `rebase telemetry enable`.
+     */
+    telemetry?: boolean;
 }
 
 /**

package/src/types/relations.ts

@@ -82,6 +82,15 @@ export interface HasOneRelation extends RelationBase {
      * Defaults to `<thisCollection>_id`.
      */
     foreignKeyOnTarget?: string;
+    /**
+     * Column on **this** collection's table whose value `foreignKeyOnTarget`
+     * holds. Defaults to this collection's primary key.
+     *
+     * Set it when the two sides are joined on a natural key rather than on the
+     * row id — an external identity id, a SKU, a tenant slug. See
+     * {@link HasManyRelation.sourceKey}, which this mirrors.
+     */
+    sourceKey?: string;
 }
 
 /**
@@ -100,6 +109,30 @@ export interface HasManyRelation extends RelationBase {
      * Defaults to `<thisCollection>_id`.
      */
     foreignKeyOnTarget?: string;
+    /**
+     * Column on **this** collection's table whose value `foreignKeyOnTarget`
+     * holds. Defaults to this collection's primary key.
+     *
+     * The mirror of `localKey` on {@link BelongsToRelation}: that one names the
+     * column this side reads from, this one names the column the other side
+     * points at. Without it the pair can only be joined on the row id, which
+     * makes a natural-key link — `auth_user_id ↔ auth_user_id`, a SKU, a tenant
+     * slug — inexpressible as `hasMany`, and it has to drop to the read-only
+     * `via`.
+     *
+     * The column must be unique: the link addresses one source row per value,
+     * and Postgres will not accept a foreign key against a non-unique column.
+     *
+     * ```ts
+     * applications: {
+     *     kind: "hasMany",
+     *     target: () => talentApplications,
+     *     sourceKey: "auth_user_id",
+     *     foreignKeyOnTarget: "auth_user_id"
+     * }
+     * ```
+     */
+    sourceKey?: string;
 }
 
 /**
@@ -248,6 +281,8 @@ export interface ResolvedHasOne extends ResolvedRelationBase {
     shared: false;
     /** Column on the target's table. */
     foreignKeyOnTarget: string;
+    /** @see ResolvedHasMany.sourceKey */
+    sourceKey?: string;
 }
 
 /** @group Models */
@@ -258,6 +293,22 @@ export interface ResolvedHasMany extends ResolvedRelationBase {
     shared: false;
     /** Column on the target's table. */
     foreignKeyOnTarget: string;
+    /**
+     * Column on the source's table that `foreignKeyOnTarget` points at, or
+     * `undefined` for the source's primary key.
+     *
+     * The one optional field on a resolved relation, and deliberately so. Every
+     * other default is filled in here because it can be: a table name and a
+     * column name are derivable from the relation and its two endpoints alone.
+     * The primary key is not — this driver resolves it from `isId`, then the
+     * Drizzle schema, then a column named `id`, and the middle tier does not
+     * exist at resolution time.
+     *
+     * So `undefined` is a sentinel with exactly one meaning, not a field a
+     * consumer is invited to guess at. Read it through `sourceKeyField()`,
+     * which is the only place that turns it into a column name.
+     */
+    sourceKey?: string;
 }
 
 /** @group Models */

package/src/users/user.ts

@@ -3,8 +3,8 @@
  * The canonical representation of an authenticated user in the Rebase ecosystem.
  *
  * Used by {@link AuthController}, collections, callbacks, and both the
- * `@rebasepro/client` and `@rebasepro/app` packages. All other user types
- * (`RebaseUser`, `UserInfo`) are deprecated aliases of this type.
+ * `@rebasepro/client` and `@rebasepro/app` packages. It is the only user type
+ * those packages export — the `RebaseUser` / `UserInfo` aliases are gone.
  *
  * **Backend-managed fields** (`uid`, `email`, `roles`, `metadata`, `createdAt`)
  * are populated by the server. **Client-visible fields** (`displayName`,