@rebasepro/types 0.9.0 → 0.9.1-canary.0de22e0

package/src/types/policy.ts

@@ -27,9 +27,28 @@ export type PolicyExpression =
     | RolesOverlapPolicyExpression
     | RolesContainPolicyExpression
     | AuthenticatedPolicyExpression
+    | ServerContextPolicyExpression
     | ExistsInPolicyExpression
     | RawPolicyExpression;
 
+/**
+ * The id a request without a logged-in user reports as `auth.uid()`.
+ *
+ * A user-context request always sets `app.user_id`: blank would read back as
+ * `NULL`, and `NULL` is how the trusted server context is recognised, so an
+ * anonymous visitor would be promoted to server privileges. The driver
+ * therefore substitutes this sentinel at the single chokepoint where the GUC
+ * is set.
+ *
+ * The consequence for policy authors is that **`auth.uid() IS NOT NULL` is a
+ * tautology on the user path** — it is true for anonymous visitors too. Use
+ * {@link policy.authenticated} (or `auth.uid() <> 'anonymous'`) to mean "signed
+ * in", and {@link policy.serverContext} to mean "the trusted server context".
+ *
+ * @group Models
+ */
+export const ANONYMOUS_USER_ID = "anonymous";
+
 /** Always allows. Compiles to `true`. @group Models */
 export interface TruePolicyExpression {
     kind: "true";
@@ -93,13 +112,42 @@ export interface RolesContainPolicyExpression {
 }
 
 /**
- * True when there is an authenticated user (`auth.uid() IS NOT NULL`).
+ * True when a signed-in user is making the request. Compiles to
+ * `auth.uid() IS NOT NULL AND auth.uid() <> 'anonymous'`.
+ *
+ * Both halves are load-bearing. `IS NOT NULL` excludes the server context;
+ * the {@link ANONYMOUS_USER_ID} comparison excludes anonymous visitors, who
+ * *do* carry a non-null `auth.uid()`. Checking only `IS NOT NULL` grants to
+ * everyone — see {@link ANONYMOUS_USER_ID}.
+ *
+ * `policy.not(policy.authenticated())` therefore means "anonymous visitor or
+ * the server context". To single out the server context, use
+ * {@link ServerContextPolicyExpression}.
  * @group Models
  */
 export interface AuthenticatedPolicyExpression {
     kind: "authenticated";
 }
 
+/**
+ * True only in the trusted **server context** — the built-in flows that run
+ * without a user (signup, migrations, `dataAsAdmin`) set no user GUC, so
+ * `auth.uid()` is `NULL` for them and only for them. Compiles to
+ * `auth.uid() IS NULL`.
+ *
+ * This is what lets the owner connection satisfy a policy even under FORCE RLS.
+ * It is deliberately a primitive rather than `not(authenticated())`: the two
+ * meant the same thing while `authenticated` ignored {@link ANONYMOUS_USER_ID},
+ * and conflating them is what turns a server-only grant into an anonymous one.
+ *
+ * The JavaScript evaluator always returns `false` for this node — a client is
+ * never the server context.
+ * @group Models
+ */
+export interface ServerContextPolicyExpression {
+    kind: "serverContext";
+}
+
 /**
  * Membership / relational access: true when at least one row exists in another
  * collection (a join/membership table) matching `where`. This is what lets you
@@ -218,6 +266,7 @@ export const policy = {
     rolesOverlap: (roles: readonly string[]): RolesOverlapPolicyExpression => ({ kind: "rolesOverlap", roles: roles as string[] }),
     rolesContain: (roles: readonly string[]): RolesContainPolicyExpression => ({ kind: "rolesContain", roles: roles as string[] }),
     authenticated: (): AuthenticatedPolicyExpression => ({ kind: "authenticated" }),
+    serverContext: (): ServerContextPolicyExpression => ({ kind: "serverContext" }),
     existsIn: (args: { collection: string; where: PolicyExpression }): ExistsInPolicyExpression =>
         ({ kind: "existsIn", collection: args.collection, where: args.where }),
     raw: (sql: string): RawPolicyExpression => ({ kind: "raw", sql }),

package/src/types/properties.ts

@@ -231,6 +231,20 @@ export interface BaseProperty<CustomProps = unknown> {
      */
     validation?: PropertyValidationSchema;
 
+    /**
+     * Never include this column in an API response.
+     *
+     * For secrets the server must store and read but no client should ever
+     * receive — password hashes, verification tokens. The value is still
+     * written and queryable server-side; it is stripped from every row the API
+     * serves, for every caller, including admins and service keys.
+     *
+     * This is a server-side guarantee, unlike `ui.hideFromCollection`, which
+     * only stops the admin panel from *rendering* a field and leaves it in the
+     * JSON payload.
+     */
+    excludeFromApi?: boolean;
+
     // NOTE: `defaultValue` is intentionally NOT on BaseProperty.
     // Each concrete property type (StringProperty, NumberProperty, etc.)
     // defines its own typed `defaultValue` for compile-time safety.

package/src/types/translations.ts

@@ -7,7 +7,7 @@ export type DeepPartial<T> = T extends object
     : T;
 
 /**
- * All user-visible strings used internally by @rebasepro/core.
+ * All user-visible strings used internally by @rebasepro/app.
  * Pass a `DeepPartial<RebaseTranslations>` via the `translations` prop
  * on your Rebase entry-point component to override any key, or to add
  * a new locale.
@@ -549,6 +549,7 @@ export interface RebaseTranslations {
     invitation_sent_title?: string;
     temporary_password?: string;
     temporary_password_description?: string;
+    temporary_password_email_failed_description?: string;
     copy_password?: string;
     password_copied?: string;
 
@@ -560,6 +561,9 @@ export interface RebaseTranslations {
     reset_password?: string;
     reset_password_success?: string;
     reset_password_confirmation?: string;
+    reset_password_send_email?: string;
+    reset_password_set_manually?: string;
+    reset_password_set_manually_description?: string;
     error_resetting_password?: string;
 
     /** Permission-denied empty states */

package/src/types/user_management_delegate.ts

@@ -10,8 +10,14 @@ export interface UserCreationResult<USER extends User = User> {
     /** Whether an invitation email was sent to the user */
     invitationSent: boolean;
     /**
-     * Temporary password (only present when email service is not configured).
-     * This is returned one-time and should be shown to the admin to share manually.
+     * Temporary password, present when no invitation email could be delivered —
+     * either because no email service is configured, or because delivery failed
+     * (see `emailDeliveryFailed`). Returned one-time, to be shared manually.
      */
     temporaryPassword?: string;
+    /**
+     * Whether an email service was configured but delivery failed, causing the
+     * fallback to `temporaryPassword`. Absent when no email service is configured.
+     */
+    emailDeliveryFailed?: boolean;
 }

package/src/types/websockets.ts

@@ -12,12 +12,40 @@ export interface WebSocketMessage {
     rows?: Record<string, unknown>[];
     row?: Record<string, unknown> | null;
     error?: string;
+    /**
+     * Channel name, on broadcast and presence frames.
+     *
+     * These are addressed by channel rather than by `requestId` or
+     * `subscriptionId`, so this is the only field that routes them.
+     */
+    channel?: string;
 }
 
+/**
+ * The key columns a collection's rows are addressed by.
+ *
+ * A row is exactly its columns and carries no address, so a subscriber that has
+ * to recognise one — to patch it, or to keep its reference across a refetch —
+ * derives the address from these. The SDK is usable with no collections
+ * declared at all, so the server is the only side that knows them.
+ *
+ * Undefined when the server cannot resolve them: a table with no primary key
+ * and no `id` column has no address, and rows of it cannot be recognised by
+ * anyone.
+ */
+export type WirePrimaryKeys = { fieldName: string; type: "string" | "number"; isUUID?: boolean }[];
+
 export interface CollectionUpdateMessage extends WebSocketMessage {
     type: "collection_update";
     subscriptionId: string;
     rows: Record<string, unknown>[];
+    /**
+     * See {@link WirePrimaryKeys}. Sent with the rows themselves — and not only
+     * with a patch — because a CDC-originated change sends no patch at all: it
+     * invalidates and goes straight to a refetch, and the merge that preserves
+     * unchanged rows' references needs an address to match them by.
+     */
+    pks?: WirePrimaryKeys;
 }
 
 export interface SingleUpdateMessage extends WebSocketMessage {
@@ -35,9 +63,57 @@ export interface SingleUpdateMessage extends WebSocketMessage {
 export interface CollectionPatchMessage extends WebSocketMessage {
     type: "collection_patch";
     subscriptionId: string;
+    /** The address of the row this patch refers to — derived, never read off it. */
     id: string;
     /** The updated row, or null if deleted */
     row: Record<string, unknown> | null;
+    /** See {@link WirePrimaryKeys}: how the subscriber finds {@link id} in its cache. */
+    pks?: WirePrimaryKeys;
+}
+
+/**
+ * One retained broadcast, as it travels on the wire.
+ *
+ * `seq` is per-channel, dense and monotonically increasing — it is the only
+ * thing a reconnecting client needs to say where it got to. See
+ * {@link ChannelHistoryMessage}.
+ */
+export interface ChannelHistoryEntry {
+    seq: number;
+    event: string;
+    payload: unknown;
+    /**
+     * The server-side client id of whoever sent it, for information only.
+     *
+     * Deliberately not used to filter a client's own messages out of a replay:
+     * a reconnect assigns a brand-new client id, so the very case replay exists
+     * for is the case where this would fail to match. Consumers that cannot
+     * tolerate re-applying their own operations must make them idempotent.
+     */
+    senderId?: string;
+    /** When the server accepted it, ISO-8601. */
+    at: string;
+}
+
+/**
+ * Server → client: the retained messages a client missed.
+ *
+ * `retained: false` means the channel has no retention rule configured, so
+ * there is no history to replay and there never will be — an explicit answer
+ * rather than an empty one, so a client can tell "nothing missed" apart from
+ * "this channel does not keep history".
+ */
+export interface ChannelHistoryMessage extends WebSocketMessage {
+    type: "channel_history";
+    channel: string;
+    messages: ChannelHistoryEntry[];
+    retained: boolean;
+    /**
+     * The highest seq the server holds for this channel, whether or not it was
+     * returned. Lets a client that capped its request with `limit` see that it
+     * is still behind, and decide to resync wholesale instead of paging.
+     */
+    latestSeq?: number;
 }
 
 /**

package/src/users/user.ts

@@ -3,7 +3,7 @@
  * The canonical representation of an authenticated user in the Rebase ecosystem.
  *
  * Used by {@link AuthController}, collections, callbacks, and both the
- * `@rebasepro/client` and `@rebasepro/auth` packages. All other user types
+ * `@rebasepro/client` and `@rebasepro/app` packages. All other user types
  * (`RebaseUser`, `UserInfo`) are deprecated aliases of this type.
  *
  * **Backend-managed fields** (`uid`, `email`, `roles`, `metadata`, `createdAt`)