pg_sql_triggers 1.3.0 → 1.5.0

data/lib/pg_sql_triggers/migrator.rb

@@ -8,7 +8,9 @@ require_relative "migrator/pre_apply_diff_reporter"
 require_relative "migrator/safety_validator"
 
 module PgSqlTriggers
-  # rubocop:disable Metrics/ClassLength
+  # rubocop:disable Metrics/ClassLength -- singleton orchestrator for migration discovery,
+  # safety validation, pre-apply comparison, application, and registry cleanup.
+  # The class-method API is the public surface; splitting into collaborators would break callers.
   class Migrator
     MIGRATIONS_TABLE_NAME = "trigger_migrations"
 
@@ -162,112 +164,110 @@ module PgSqlTriggers
         end
       end
 
-      # rubocop:disable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
       def run_migration(migration, direction)
         require migration.path
+        migration_class = resolve_migration_class(migration.name)
 
-        # Extract class name from migration name
-        # e.g., "posts_comment_count_validation" -> "PostsCommentCountValidation"
-        base_class_name = migration.name.camelize
-
-        # Try to find the class, trying multiple patterns:
-        # 1. Direct name (for backwards compatibility)
-        # 2. With "Add" prefix (for new migrations following Rails conventions)
-        # 3. With PgSqlTriggers namespace
-        migration_class = begin
-          base_class_name.constantize
-        rescue NameError
-          begin
-            # Try with "Add" prefix (Rails migration naming convention)
-            "Add#{base_class_name}".constantize
-          rescue NameError
-            begin
-              # Try with PgSqlTriggers namespace
-              "PgSqlTriggers::#{base_class_name}".constantize
-            rescue NameError
-              # Try with both Add prefix and PgSqlTriggers namespace
-              "PgSqlTriggers::Add#{base_class_name}".constantize
-            end
-          end
+        # Capture SQL once from a single inspection instance so that both the
+        # safety validator and comparator work from the same snapshot without
+        # running the migration code a second time.
+        captured_sql = capture_migration_sql(migration_class.new, direction)
+
+        perform_safety_validation(captured_sql, migration)
+        perform_pre_apply_comparison(captured_sql, migration)
+        apply_migration(migration_class, migration, direction)
+        enforce_disabled_triggers if direction == :up
+      rescue LoadError => e
+        raise StandardError, "Error loading trigger migration #{migration.filename}: #{e.message}"
+      rescue StandardError => e
+        raise StandardError,
+              "Error running trigger migration #{migration.filename}: #{e.message}\n#{e.backtrace.first(5).join("\n")}"
+      end
+
+      # Resolve the migration class from its snake_case filename. Tries several naming patterns
+      # so migrations can use plain CamelCase, "Add" prefix, or be nested under PgSqlTriggers.
+      def resolve_migration_class(migration_name)
+        base_class_name = migration_name.camelize
+        candidates = [
+          base_class_name,
+          "Add#{base_class_name}",
+          "PgSqlTriggers::#{base_class_name}",
+          "PgSqlTriggers::Add#{base_class_name}"
+        ]
+        last_error = nil
+        candidates.each do |candidate|
+          return candidate.constantize
+        rescue NameError => e
+          last_error = e
         end
+        raise last_error
+      end
 
-        # Perform safety validation (prevent unsafe DROP + CREATE operations)
-        validation_instance = migration_class.new
-        begin
-          allow_unsafe = ENV["ALLOW_UNSAFE_MIGRATIONS"] == "true" ||
-                         (defined?(PgSqlTriggers) && PgSqlTriggers.allow_unsafe_migrations == true)
-
-          SafetyValidator.validate!(validation_instance, direction: direction, allow_unsafe: allow_unsafe)
-        rescue SafetyValidator::UnsafeOperationError => e
-          # Safety validation failed - block the migration
-          error_msg = "\n#{e.message}\n\n"
-          Rails.logger.error(error_msg) if defined?(Rails.logger)
-          Rails.logger.debug error_msg if ENV["VERBOSE"] != "false" || defined?(Rails::Console)
-          raise StandardError, "Migration blocked due to unsafe DROP + CREATE operations. " \
-                               "Review the errors above and set ALLOW_UNSAFE_MIGRATIONS=true if you must proceed."
-        rescue StandardError => e
-          # Don't fail the migration if validation fails for other reasons - just log it
-          if defined?(Rails.logger)
-            Rails.logger.warn("Safety validation failed for migration #{migration.name}: #{e.message}")
-          end
+      # Run the safety validator against captured SQL and translate any
+      # UnsafeOperationError into a generic StandardError that halts the migration.
+      def perform_safety_validation(captured_sql, migration)
+        allow_unsafe = ENV["ALLOW_UNSAFE_MIGRATIONS"] == "true" ||
+                       (defined?(PgSqlTriggers) && PgSqlTriggers.allow_unsafe_migrations == true)
+        SafetyValidator.validate_sql!(captured_sql, allow_unsafe: allow_unsafe)
+      rescue SafetyValidator::UnsafeOperationError => e
+        error_msg = "\n#{e.message}\n\n"
+        Rails.logger.error(error_msg) if defined?(Rails.logger)
+        Rails.logger.debug error_msg if ENV["VERBOSE"] != "false" || defined?(Rails::Console)
+        raise StandardError, "Migration blocked due to unsafe DROP + CREATE operations. " \
+                             "Review the errors above and set ALLOW_UNSAFE_MIGRATIONS=true if you must proceed."
+      rescue StandardError => e
+        # Don't fail the migration if validation fails for other reasons – just log it
+        return unless defined?(Rails.logger)
+
+        Rails.logger.warn("Safety validation failed for migration #{migration.name}: #{e.message}")
+      end
+
+      # Run the pre-apply comparator and log the results.
+      # Any failure in the comparator itself is swallowed and logged to avoid
+      # breaking migrations that are otherwise safe.
+      def perform_pre_apply_comparison(captured_sql, migration)
+        diff_result = PreApplyComparator.compare_sql(captured_sql)
+
+        if diff_result[:has_differences]
+          log_pre_apply_differences(diff_result, migration)
+        elsif defined?(Rails.logger)
+          Rails.logger.info("Pre-apply comparison: No differences detected for migration #{migration.name}")
         end
+      rescue StandardError => e
+        return unless defined?(Rails.logger)
 
-        # Perform pre-apply comparison (diff expected vs actual)
-        # Create a separate instance for comparison to avoid side effects
-        comparison_instance = migration_class.new
-        begin
-          diff_result = PreApplyComparator.compare(comparison_instance, direction: direction)
-
-          # Log the comparison result
-          if diff_result[:has_differences]
-            diff_report = PreApplyDiffReporter.format(diff_result, migration_name: migration.name)
-            if defined?(Rails.logger)
-              Rails.logger.warn("Pre-apply comparison for migration #{migration.name}:\n#{diff_report}")
-            end
-
-            # In verbose mode or when called from console, print the diff
-            if ENV["VERBOSE"] != "false" || defined?(Rails::Console)
-              Rails.logger.debug { "\n#{PreApplyDiffReporter.format_summary(diff_result)}\n" }
-            end
-          elsif defined?(Rails.logger)
-            Rails.logger.info(
-              "Pre-apply comparison: No differences detected for migration #{migration.name}"
-            )
-          end
-        rescue StandardError => e
-          # Don't fail the migration if comparison fails - just log it
-          if defined?(Rails.logger)
-            Rails.logger.warn("Pre-apply comparison failed for migration #{migration.name}: #{e.message}")
-          end
+        Rails.logger.warn("Pre-apply comparison failed for migration #{migration.name}: #{e.message}")
+      end
+
+      def log_pre_apply_differences(diff_result, migration)
+        diff_report = PreApplyDiffReporter.format(diff_result, migration_name: migration.name)
+        if defined?(Rails.logger)
+          msg = "Pre-apply comparison for migration #{migration.name}:\n#{diff_report}"
+          Rails.logger.warn(msg)
         end
+        return unless ENV["VERBOSE"] != "false" || defined?(Rails::Console)
 
-        ActiveRecord::Base.transaction do
-          # Create a fresh instance for actual execution
-          migration_instance = migration_class.new
-          migration_instance.public_send(direction)
+        Rails.logger.debug { "\n#{PreApplyDiffReporter.format_summary(diff_result)}\n" }
+      end
 
-          connection = ActiveRecord::Base.connection
-          version_str = connection.quote(migration.version.to_s)
+      # Execute the migration inside a transaction and record the version change.
+      def apply_migration(migration_class, migration, direction)
+        ActiveRecord::Base.transaction do
+          migration_class.new.public_send(direction)
+          record_migration_version(migration.version, direction)
+          cleanup_orphaned_registry_entries if direction == :down
+        end
+      end
 
-          if direction == :up
-            connection.execute(
-              "INSERT INTO #{MIGRATIONS_TABLE_NAME} (version) VALUES (#{version_str})"
-            )
-          else
-            connection.execute(
-              "DELETE FROM #{MIGRATIONS_TABLE_NAME} WHERE version = #{version_str}"
-            )
-            # Clean up registry entries for triggers that no longer exist in database
-            cleanup_orphaned_registry_entries
-          end
+      def record_migration_version(version, direction)
+        connection = ActiveRecord::Base.connection
+        version_str = connection.quote(version.to_s)
+        if direction == :up
+          connection.execute("INSERT INTO #{MIGRATIONS_TABLE_NAME} (version) VALUES (#{version_str})")
+        else
+          connection.execute("DELETE FROM #{MIGRATIONS_TABLE_NAME} WHERE version = #{version_str}")
         end
-      rescue LoadError => e
-        raise StandardError, "Error loading trigger migration #{migration.filename}: #{e.message}"
-      rescue StandardError => e
-        raise StandardError,
-              "Error running trigger migration #{migration.filename}: #{e.message}\n#{e.backtrace.first(5).join("\n")}"
       end
-      # rubocop:enable Metrics/AbcSize, Metrics/CyclomaticComplexity, Metrics/MethodLength, Metrics/PerceivedComplexity
 
       def status
         ensure_migrations_table!
@@ -295,6 +295,49 @@ module PgSqlTriggers
         current_version
       end
 
+      private
+
+      # Capture the SQL statements a migration would execute for a given direction
+      # without committing any side effects.  The migration's +execute+ method is
+      # overridden on the singleton so raw SQL strings are intercepted, and the
+      # whole run is wrapped in a transaction that is always rolled back so that
+      # any ActiveRecord migration helpers (add_column, create_table, …) don't
+      # persist their effects during the inspection phase.
+      def capture_migration_sql(migration_instance, direction)
+        captured = []
+
+        migration_instance.define_singleton_method(:execute) do |sql|
+          captured << sql.to_s.strip
+        end
+
+        ActiveRecord::Base.transaction do
+          migration_instance.public_send(direction)
+          raise ActiveRecord::Rollback
+        end
+
+        captured
+      end
+
+      def enforce_disabled_triggers
+        return unless ActiveRecord::Base.connection.table_exists?("pg_sql_triggers_registry")
+
+        introspection = PgSqlTriggers::DatabaseIntrospection.new
+        PgSqlTriggers::TriggerRegistry.disabled.each do |registry|
+          next unless introspection.trigger_exists?(registry.trigger_name)
+
+          conn           = ActiveRecord::Base.connection
+          quoted_table   = conn.quote_table_name(registry.table_name.to_s)
+          quoted_trigger = conn.quote_table_name(registry.trigger_name.to_s)
+          conn.execute("ALTER TABLE #{quoted_table} DISABLE TRIGGER #{quoted_trigger};")
+        rescue StandardError => e
+          if defined?(Rails.logger)
+            Rails.logger.warn("[MIGRATOR] Could not disable trigger #{registry.trigger_name}: #{e.message}")
+          end
+        end
+      end
+
+      public
+
       # Clean up registry entries for triggers that no longer exist in the database
       # This is called after rolling back migrations to keep the registry in sync
       def cleanup_orphaned_registry_entries

data/lib/pg_sql_triggers/permissions/checker.rb

@@ -17,24 +17,21 @@ module PgSqlTriggers
         true
       end
 
-      # rubocop:disable Naming/PredicateMethod
       def self.check!(actor, action, environment: nil)
-        unless can?(actor, action, environment: environment)
-          action_sym = action.to_sym
-          required_level = Permissions::ACTIONS[action_sym] || "unknown"
-          message = "Permission denied: #{action_sym} requires #{required_level} level access"
-          recovery = "Contact your administrator to request #{required_level} level access for this operation."
+        return true if can?(actor, action, environment: environment)
 
-          raise PgSqlTriggers::PermissionError.new(
-            message,
-            error_code: "PERMISSION_DENIED",
-            recovery_suggestion: recovery,
-            context: { action: action_sym, required_role: required_level, environment: environment }
-          )
-        end
-        true
+        action_sym = action.to_sym
+        required_level = Permissions::ACTIONS[action_sym] || "unknown"
+        message = "Permission denied: #{action_sym} requires #{required_level} level access"
+        recovery = "Contact your administrator to request #{required_level} level access for this operation."
+
+        raise PgSqlTriggers::PermissionError.new(
+          message,
+          error_code: "PERMISSION_DENIED",
+          recovery_suggestion: recovery,
+          context: { action: action_sym, required_role: required_level, environment: environment }
+        )
       end
-      # rubocop:enable Naming/PredicateMethod
     end
   end
 end

data/lib/pg_sql_triggers/permissions.rb

@@ -20,6 +20,7 @@ module PgSqlTriggers
       generate_trigger: OPERATOR,
       test_trigger: OPERATOR,
       drop_trigger: ADMIN,
+      # Admin-level SQL; for host `permission_checker` / custom tooling (not used by built-in UI)
       execute_sql: ADMIN,
       override_drift: ADMIN
     }.freeze

data/lib/pg_sql_triggers/rake_development_boot.rb

@@ -0,0 +1,65 @@
+# frozen_string_literal: true
+
+require "rails"
+require "active_record"
+require "logger"
+
+# Minimal Rails app for running engine Rake tasks from the gem repo (see +rakelib/+).
+module PgSqlTriggersRakeDevApp
+  class Application < ::Rails::Application
+    config.root = Pathname.new(Dir.pwd)
+    config.eager_load = false
+    config.active_support.deprecation = :stderr
+    config.secret_key_base = "rake_dev_secret_for_pg_sql_triggers_gem"
+    config.logger = Logger.new($stdout, level: Logger::ERROR)
+  end
+end
+
+# Boots a minimal Rails app and ActiveRecord so engine +lib/tasks+ Rake tasks work when
+# +bundle exec rake trigger:*+ is run from the gem repository (no host application).
+module PgSqlTriggers
+  module RakeDevelopmentBoot
+    module_function
+
+    def boot!
+      return if @booted
+
+      ENV["RAILS_ENV"] ||= "development"
+
+      require_relative "../pg_sql_triggers"
+
+      unless Rails.application
+        PgSqlTriggersRakeDevApp::Application.config.paths["app/views"] <<
+          PgSqlTriggers::Engine.root.join("app/views").to_s
+        PgSqlTriggersRakeDevApp::Application.initialize!
+      end
+
+      establish_connection_from_env!
+      load_engine_models
+      @booted = true
+    end
+
+    def establish_connection_from_env!
+      return if ::ActiveRecord::Base.connected?
+
+      test_db_config = ENV["DATABASE_URL"] || {
+        adapter: "postgresql",
+        database: ENV["TEST_DATABASE"] || "pg_sql_triggers_test",
+        username: ENV["TEST_DB_USER"] || "postgres",
+        password: ENV["TEST_DB_PASSWORD"] || "",
+        host: ENV["TEST_DB_HOST"] || "localhost"
+      }
+
+      ::ActiveRecord::Base.establish_connection(test_db_config)
+      ::ActiveRecord::Base.connection
+    rescue StandardError => e
+      warn "PgSqlTriggers: could not connect to PostgreSQL for Rake tasks: #{e.message}"
+      raise
+    end
+
+    def load_engine_models
+      engine_root = PgSqlTriggers::Engine.root
+      Dir[engine_root.join("app/models/**/*.rb")].each { |f| require f }
+    end
+  end
+end

data/lib/pg_sql_triggers/registry/manager.rb

@@ -3,15 +3,19 @@
 module PgSqlTriggers
   module Registry
     class Manager
+      REGISTRY_CACHE_MUTEX = Mutex.new
+      private_constant :REGISTRY_CACHE_MUTEX
+
       class << self
-        # Request-level cache to avoid N+1 queries when loading multiple trigger files
-        # This cache is cleared after each request/transaction to ensure data consistency
+        # Request-level cache to avoid N+1 queries when loading multiple trigger files.
+        # Access to @_registry_cache is guarded by REGISTRY_CACHE_MUTEX so that
+        # concurrent threads cannot observe a partially-initialised hash.
         def _registry_cache
-          @_registry_cache ||= {}
+          REGISTRY_CACHE_MUTEX.synchronize { @_registry_cache ||= {} }
         end
 
         def _clear_registry_cache
-          @_registry_cache = {}
+          REGISTRY_CACHE_MUTEX.synchronize { @_registry_cache = {} }
         end
 
         # Batch load existing triggers into cache to avoid N+1 queries
@@ -43,23 +47,14 @@ module PgSqlTriggers
 
           # Calculate checksum using field-concatenation (consistent with TriggerRegistry model)
           checksum = calculate_checksum(definition)
-
-          attributes = {
-            trigger_name: definition.name,
-            table_name: definition.table_name,
-            version: definition.version,
-            enabled: definition.enabled,
-            source: "dsl",
-            environment: definition.environments.join(","),
-            definition: definition.to_h.to_json,
-            checksum: checksum
-          }
+          attributes = registration_attributes(definition, checksum)
 
           if existing
             # Check if attributes have actually changed to avoid unnecessary queries
             attributes_changed = attributes.any? do |key, value|
               existing.send(key) != value
             end
+            enabled_changed = existing.enabled != definition.enabled
 
             if attributes_changed
               begin
@@ -67,6 +62,9 @@ module PgSqlTriggers
                 # Update cache with the modified record (reload to get fresh data)
                 reloaded = existing.reload
                 _registry_cache[trigger_name] = reloaded
+                if enabled_changed
+                  sync_postgresql_enabled_state(existing.trigger_name, existing.table_name, definition.enabled)
+                end
                 reloaded
               rescue ActiveRecord::RecordNotFound
                 # Cached record was deleted, create a new one
@@ -82,6 +80,9 @@ module PgSqlTriggers
             new_record = PgSqlTriggers::TriggerRegistry.create!(attributes)
             # Cache the newly created record
             _registry_cache[trigger_name] = new_record
+            unless definition.enabled
+              sync_postgresql_enabled_state(new_record.trigger_name, new_record.table_name, definition.enabled)
+            end
             new_record
           end
         end
@@ -126,23 +127,61 @@ module PgSqlTriggers
 
         private
 
+        def registration_attributes(definition, checksum)
+          {
+            trigger_name: definition.name,
+            table_name: definition.table_name,
+            version: definition.version,
+            enabled: definition.enabled,
+            source: "dsl",
+            environment: definition.environments.join(","),
+            definition: definition.to_h.to_json,
+            checksum: checksum,
+            for_each: definition.for_each || "row",
+            constraint_trigger: definition.respond_to?(:constraint_trigger) && definition.constraint_trigger,
+            deferrable: definition.respond_to?(:deferrable) ? definition.deferrable&.to_s.presence : nil,
+            initially: definition.respond_to?(:initially) ? definition.initially&.to_s.presence : nil
+          }
+        end
+
         def calculate_checksum(definition)
-          # DSL definitions don't have function_body, so use placeholder
-          # Generator forms have function_body, so calculate real checksum
           function_body_value = definition.respond_to?(:function_body) ? definition.function_body : nil
-          return "placeholder" if function_body_value.blank?
 
-          # Use field-concatenation algorithm (consistent with TriggerRegistry#calculate_checksum)
+          # Use field-concatenation algorithm (consistent with TriggerRegistry#calculate_checksum).
+          # DSL definitions have no function_body — use "" so the checksum is real and comparable
+          # with what Drift::Detector#calculate_db_checksum computes for DSL-source triggers.
           require "digest"
+          deferral = PgSqlTriggers::DeferralChecksum.parts(
+            constraint_trigger: definition.respond_to?(:constraint_trigger) && definition.constraint_trigger,
+            deferrable: definition.respond_to?(:deferrable) ? definition.deferrable : nil,
+            initially: definition.respond_to?(:initially) ? definition.initially : nil
+          )
+          events_segment = PgSqlTriggers::EventsChecksum.canonical_from_definition(definition.to_h)
           Digest::SHA256.hexdigest([
             definition.name,
             definition.table_name,
             definition.version,
-            function_body_value,
+            function_body_value || "",
             definition.condition || "",
-            definition.timing || "before"
+            definition.timing || "before",
+            definition.for_each || "row",
+            events_segment,
+            *deferral
           ].join)
         end
+
+        def sync_postgresql_enabled_state(trigger_name, table_name, enabled)
+          introspection = PgSqlTriggers::DatabaseIntrospection.new
+          return unless introspection.trigger_exists?(trigger_name)
+
+          conn           = ActiveRecord::Base.connection
+          quoted_table   = conn.quote_table_name(table_name.to_s)
+          quoted_trigger = conn.quote_table_name(trigger_name.to_s)
+          verb           = enabled ? "ENABLE" : "DISABLE"
+          conn.execute("ALTER TABLE #{quoted_table} #{verb} TRIGGER #{quoted_trigger};")
+        rescue StandardError => e
+          Rails.logger.warn("[REGISTER] Could not sync trigger enabled state: #{e.message}") if defined?(Rails.logger)
+        end
       end
     end
   end