Security RLS by artemdemo · Pull Request #481 · base44/cli

artemdemo · 2026-04-15T11:04:24Z

Note

Description

This PR implements Row-Level Security (RLS) and Field-Level Security (FLS) for the local dev server's entity API. All CRUD endpoints now decode the JWT from incoming requests to identify the current user, then enforce access control rules defined in the entity schema before reading or writing records. A Windows-compatible fix for function process cleanup is also included.

Related Issue

None

Type of Change

Bug fix (non-breaking change which fixes an issue)
New feature (non-breaking change which adds functionality)
Breaking change (fix or feature that would cause existing functionality to not work as expected)
Documentation update
Refactoring (no functional changes)
Other (please describe):

Changes Made

Added packages/cli/src/cli/dev/dev-server/db/rls.ts — pure RLS/FLS engine supporting $or, $and, $nor, $in, $nin, $ne, $all operators and {{user.*}} template variables
Updated entities-router.ts to decode the Bearer JWT on every request, look up the current user from the users collection, and enforce schema.rls.{read,create,update,delete} and per-field rls.{read,write} on all CRUD endpoints
Auto-populates created_by / created_by_id fields from the authenticated user on create
Added Database.getSchema() helper to expose entity schemas to the router
Fixed FunctionManager.stopAll() to await process exit and use taskkill on Windows for reliable subprocess cleanup
Randomised dev-server port in test mode (IS_TEST=true) to prevent parallel-test port collisions
Added comprehensive test suites (dev-security*.spec.ts) covering $in, $nin, $nor, $ne, and basic RLS scenarios

Testing

I have tested these changes locally
I have added/updated tests as needed
All tests pass (npm test)

Checklist

My code follows the project's style guidelines
I have performed a self-review of my own code
I have commented my code, particularly in hard-to-understand areas
I have made corresponding changes to the documentation (if applicable)
My changes generate no new warnings
I have updated docs/ (AGENTS.md) if I made architectural changes

Additional Notes

RLS denials on read/update/delete return 404 (not 403) to avoid leaking record existence. Create and bulk-create return 403 on denial since no record ID is involved.

_{🤖 Generated by Claude | 2026-04-20 11:50 UTC | 74f9319}

github-actions · 2026-04-15T11:04:57Z

🚀 Package Preview Available!

Install this PR's preview build with npm:

npm i @base44-preview/cli@0.0.50-pr.481.74f9319

Prefer not to change any import paths? Install using npm alias so your code still imports base44:

npm i "base44@npm:@base44-preview/cli@0.0.50-pr.481.74f9319"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "base44": "npm:@base44-preview/cli@0.0.50-pr.481.74f9319"
  }
}

📦 Preview Package: @base44-preview/cli@0.0.50-pr.481.74f9319
🔗 View this commit on GitHub

_{Preview published to npm registry — try new features instantly!}

artemdemo · 2026-04-16T11:30:43Z

+    const authData = await readJsonFile(getAuthFilePath());
+    const result = AuthDataSchema.safeParse(authData);


Not related to PR.
I just think this is better naming

artemdemo · 2026-04-16T11:31:30Z

+      outdent`
+        Deno.serve((req: Request) =>
+          Response.json({
+            authorization: req.headers.get("authorization"),
+            serviceAuthorization: req.headers.get("base44-service-authorization"),
+          }),
+        );
+      `,


Not related to PR.
Adding outdent for better formatting

artemdemo · 2026-04-20T12:03:11Z

+  async stopAll(): Promise<void> {
+    await Promise.all(
+      Array.from(this.running, ([name, { process: proc }]) => {
+        this.logger.log(`Stopping function: ${name}`);
+        const exited = new Promise<void>((r) => proc.once("exit", () => r()));
+        if (process.platform === "win32" && proc.pid) {
+          spawn("taskkill", ["/pid", String(proc.pid), "/T", "/F"]);
+        } else {
+          proc.kill();
+        }
+        return exited;
+      }),
+    );


Not related to PR, but this fixes flakines (I hope) on windows.
What was happening:
Test in tests/cli/dev.spec.ts was failing - this one: "forwards the service token header from Authorization to local functions"

After investigation with AI we assumed following root cause:

RunLiveHandle.stop() calls child.kill("SIGINT") (CLITestkit.ts:252). Windows doesn't support POSIX signals — Node translates this to abrupt termination, so the CLI's SIGINT→shutdown() handler in main.ts:235 never runs and functionManager.stopAll() is skipped.

The spawned Deno process (function-manager.ts:118) is not in a process group on Windows, so it's orphaned with open handles on .deno/dep_analysis_cache_v2.

tmp-promise's unsafeCleanup then tries to delete <tempDir>/.deno/... → EBUSY.

Why .deno lands in the temp dir: testkit sets HOME=tempDir (CLITestkit.ts:76), so Deno defaults DENO_DIR to <tempDir>/.deno.

Solution - to kill process "the windows way"

Very cool investigation, Did this came up from tests / you checked this on windows?

artemdemo · 2026-04-20T12:09:30Z

+        const inserted = applyFLS(
+          stripInternalFields(await collection.insertAsync(record)),
+          schema,
+          currentUser,
+          "read",


Here and in all cases below - applying FLS check for "read" because at this point I'm returning data to the user.
So I first create - it's one permission, but when I return, I actually read and it's a different permission, so I need to verify again.
I think this only makes sense of FLS (field level security), but there is no reason to do RLS for that object, since user actually created it.
I only need to make sure that user is not getting technical fields that are not related to him.
Not that important for local dev though, but just in case

kfirstri

Went over all files other then rls.ts, need to finish going over it

kfirstri · 2026-04-26T14:34:05Z

+  async stopAll(): Promise<void> {
+    await Promise.all(
+      Array.from(this.running, ([name, { process: proc }]) => {
+        this.logger.log(`Stopping function: ${name}`);
+        const exited = new Promise<void>((r) => proc.once("exit", () => r()));
+        if (process.platform === "win32" && proc.pid) {
+          spawn("taskkill", ["/pid", String(proc.pid), "/T", "/F"]);
+        } else {
+          proc.kill();
+        }
+        return exited;
+      }),
+    );


Very cool investigation, Did this came up from tests / you checked this on windows?

kfirstri · 2026-04-26T14:37:30Z

+      let currentUser: UserDocument | undefined;
+      try {
+        const auth = req.headers.authorization || "";
+        const { payload } =
+          jwt.decode(auth.replace("Bearer ", ""), { complete: true }) ?? {};
+        currentUser = await db
+          .getCollection(USER_COLLECTION)
+          ?.findOneAsync<UserDocument>({ email: payload?.sub });
+      } catch {}


nit: extract user fetching to another function, not really related to "withCollection"

kfirstri · 2026-04-26T14:41:46Z

@@ -147,7 +223,7 @@ export async function createEntityRoutes(
  router.post(
    "/:entityName/bulk",


Simplification - should maybe the logic for /:entityName and /:entityName/bulk be the same at this point?
It's same logic maintained twice for 1/N items, i guess the 1 item case can use the same bulk function

kfirstri · 2026-04-26T14:43:51Z

+          }
+
+          let filteredRecord = db.prepareRecord(entityName, record);
+          if (schema) {


I dont understand something - why do we check if "schema" exists before applyFLS? schema is always defined AFAIU, maybe you mean if(schema.fls) or something?

kfirstri · 2026-04-26T14:46:33Z

          ?.findOneAsync({ email: payload?.sub });

-        if (!result) {
+        if (!currentUser) {


Maybe we can make this withAuth be a shared util and will be used in both routers? currently this logic is implemented inside the withCollection

kfirstri · 2026-04-26T14:50:49Z

+  user: Record<string, unknown>,
+): boolean {
+  for (const [key, expected] of Object.entries(condition)) {
+    const userValue = key.startsWith("data.") ? user[key.slice(5)] : user[key];


isn't this what resolveTemplate does?

artemdemo force-pushed the security-rls branch from 8b3e592 to 6cfcd7b Compare April 16, 2026 10:33

Base automatically changed from auth-and-stuff to main April 16, 2026 11:28

artemdemo added 4 commits April 16, 2026 14:28

Security RLS

2517f6b

RLS as claude sees is

562b2da

writing tests

e6103a3

upd

9eb33a1

artemdemo force-pushed the security-rls branch from 6cfcd7b to 9eb33a1 Compare April 16, 2026 11:29

artemdemo commented Apr 16, 2026

View reviewed changes

artemdemo added 7 commits April 16, 2026 15:26

upd tests

99dfcf3

fix

d3e3d2d

upd

5889358

upd

9114b7b

upd

bd67b0d

upd

d2de803

upd

b2141f6

base44 deleted a comment from claude Bot Apr 16, 2026

upd

b365641

base44 deleted a comment from claude Bot Apr 19, 2026

upd

1ed71a6

base44 deleted a comment from claude Bot Apr 20, 2026

artemdemo added 3 commits April 20, 2026 09:49

wip

f2037e7

upd

0525037

upd tests

5040ca5

base44 deleted a comment from claude Bot Apr 20, 2026

fix

945281d

base44 deleted a comment from claude Bot Apr 20, 2026

deno fix on windows

a37a180

artemdemo commented Apr 20, 2026

View reviewed changes

artemdemo marked this pull request as ready for review April 20, 2026 12:04

artemdemo commented Apr 20, 2026

View reviewed changes

kfirstri reviewed Apr 26, 2026

View reviewed changes

		const authData = await readJsonFile(getAuthFilePath());
		const result = AuthDataSchema.safeParse(authData);

		@@ -147,7 +223,7 @@ export async function createEntityRoutes(
		router.post(
		"/:entityName/bulk",

Conversation

artemdemo commented Apr 15, 2026 • edited by claude Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Related Issue

Type of Change

Changes Made

Testing

Checklist

Additional Notes

Uh oh!

github-actions Bot commented Apr 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🚀 Package Preview Available!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

kfirstri left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

artemdemo commented Apr 15, 2026 •

edited by claude Bot

Loading

github-actions Bot commented Apr 15, 2026 •

edited

Loading