@astralarium/repo-postgres 0.0.0-stage → 0.2.0

package/scripts/dump-db.sh

@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# Usage: postgres-dump-db > data.sql
+# Data-only dump of the PG* database via the util image, rebuilt on each
+# run (layer-cached); the replica role prefix skips triggers and FK checks
+# on load.
+# Source connection via PGHOST/PGPORT/PGUSER/PGPASSWORD/PGDATABASE.
+# DB_NAME: the app's image base name (PostgresOptions.name); required.
+# DB_DUMP_EXCLUDE: schema-qualified pg_dump table patterns whose rows stay
+#   out of the dump, space-separated (`app.session`, `app.*_log`); a
+#   partitioned table covers its partitions.
+# CONTAINER_RUNTIME: container runtime (default podman).
+set -euo pipefail
+
+runtime=${CONTAINER_RUNTIME:-podman}
+name=${DB_NAME:?set to the app image base name (PostgresOptions.name)}
+read -ra patterns <<< "${DB_DUMP_EXCLUDE:-}"
+for pattern in ${patterns[@]+"${patterns[@]}"}; do
+    [[ $pattern == *.* ]] || { echo "postgres-dump-db: DB_DUMP_EXCLUDE pattern $pattern lacks a schema" >&2; exit 1; }
+done
+
+# Through the real path: a package manager's bin link sits outside the package.
+scripts=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
+bash "$scripts/build-images.sh" "$runtime" "" util
+
+"$runtime" run --rm --interactive \
+    --env PGHOST \
+    --env PGPORT \
+    --env PGUSER \
+    --env PGPASSWORD \
+    --env PGDATABASE \
+    --env DB_DUMP_EXCLUDE \
+    "$name-util" /entrypoint.d/dump-db.sh

package/sql/app/schema.sql

@@ -0,0 +1,8 @@
+-- The `app` schema: owned by app_admin, used by app_service.
+SET ROLE app_admin;
+
+CREATE SCHEMA app AUTHORIZATION app_admin;
+
+GRANT USAGE ON SCHEMA app TO app_service;
+
+SET ROLE NONE;

package/sql/bootstrap.sql

@@ -0,0 +1,27 @@
+-- Fresh remote (Neon) init: roles + app database + the app's schema.
+-- Local-container equivalent: container/init/entrypoint.d/init-db.sh (first boot).
+-- Run with psql from a staged schema directory (schema.sql beside sql/, as
+-- `@astralarium/repo-postgres/provision` stageSchema writes it), with -v pw=<app_service
+-- password>. With existing roles and database, use reset.sql.
+
+\i roles.sql
+-- app_service is the Hyperdrive origin login.
+ALTER USER app_service WITH PASSWORD :'pw';
+
+CREATE DATABASE app;
+
+-- Neon: extension objects are cloud_admin-owned, so the schema's per-object
+-- grants on them no-op. These stand in for them.
+DO $$
+BEGIN
+  IF to_regrole('neon_superuser') IS NOT NULL THEN
+    SET ROLE neon_superuser;
+    GRANT pg_read_all_data, pg_write_all_data TO app_admin;
+    RESET ROLE;
+  END IF;
+END $$;
+
+\connect app
+
+\i database-grants.sql
+\i schema.sql

package/sql/database-grants.sql

@@ -0,0 +1,3 @@
+-- Database grants of the app database psql is connected to.
+GRANT CREATE, CONNECT ON DATABASE :"DBNAME" TO app_admin;
+GRANT CONNECT ON DATABASE :"DBNAME" TO app_service;

package/sql/drop-schemas.sql

@@ -0,0 +1,11 @@
+-- Drops every schema the current role (app_admin, under reset.sql) owns.
+DO $$
+DECLARE
+  schema_name text;
+BEGIN
+  FOR schema_name IN
+    SELECT nspname FROM pg_namespace WHERE nspowner = to_regrole(current_user)
+  LOOP
+    EXECUTE format('DROP SCHEMA %I CASCADE', schema_name);
+  END LOOP;
+END $$;

package/sql/extensions/cron/schema.sql

@@ -0,0 +1,23 @@
+-- pg_cron in the database `cron.database_name` selects, with a daily
+-- `cron-history-ttl` deleting run history past 7 days. Skipped where
+-- pg_cron is not loaded: disposable instances run stock Postgres.
+DO $$
+BEGIN
+  IF current_setting('cron.database_name', true) IS NULL THEN
+    RAISE NOTICE 'pg_cron is not loaded; skipping';
+    RETURN;
+  END IF;
+
+  CREATE EXTENSION IF NOT EXISTS pg_cron;
+
+  PERFORM cron.schedule(
+    'cron-history-ttl',
+    '0 3 * * *',
+    $job$
+      SET statement_timeout = '30s';
+      DELETE FROM cron.job_run_details
+        WHERE end_time < CURRENT_TIMESTAMP - interval '7 days';
+    $job$
+  );
+END;
+$$;

package/sql/extensions/partman/before-reset.sql

@@ -0,0 +1,38 @@
+-- pg_partman outlives reset.sql's drop (cloud_admin-owned on Neon) and
+-- keeps what it owns: a surviving part_config row makes create_parent
+-- reject its parent on reload, and each parent's template table lives in
+-- partman's schema with its app-typed columns. Clears both for every
+-- schema the current role (app_admin, under reset.sql) owns, so the
+-- reload takes the new shape.
+DO $$
+DECLARE
+  partman text;
+  schema_name text;
+  template text;
+BEGIN
+  SELECT n.nspname INTO partman
+  FROM pg_extension e JOIN pg_namespace n ON n.oid = e.extnamespace
+  WHERE e.extname = 'pg_partman';
+
+  IF partman IS NULL THEN
+    RETURN;
+  END IF;
+
+  FOR schema_name IN
+    SELECT nspname FROM pg_namespace WHERE nspowner = to_regrole(current_user)
+  LOOP
+    FOR template IN
+      EXECUTE format(
+        'SELECT template_table FROM %I.part_config WHERE template_table IS NOT NULL AND split_part(parent_table, ''.'', 1) = %L',
+        partman, schema_name)
+    LOOP
+      EXECUTE format('DROP TABLE IF EXISTS %s', template);
+    END LOOP;
+    EXECUTE format(
+      'DELETE FROM %I.part_config_sub WHERE split_part(sub_parent, ''.'', 1) = %L',
+      partman, schema_name);
+    EXECUTE format(
+      'DELETE FROM %I.part_config WHERE split_part(parent_table, ''.'', 1) = %L',
+      partman, schema_name);
+  END LOOP;
+END $$;

package/sql/extensions/partman/schema.sql

@@ -0,0 +1,8 @@
+-- pg_partman in schema `partman`; app_admin creates and maintains parents.
+CREATE SCHEMA IF NOT EXISTS partman;
+CREATE EXTENSION IF NOT EXISTS pg_partman SCHEMA partman;
+
+GRANT USAGE, CREATE ON SCHEMA partman TO app_admin;
+GRANT EXECUTE ON ALL FUNCTIONS  IN SCHEMA partman TO app_admin;
+GRANT EXECUTE ON ALL PROCEDURES IN SCHEMA partman TO app_admin;
+GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA partman TO app_admin;

package/sql/extensions/trgm/schema.sql

@@ -0,0 +1 @@
+CREATE EXTENSION IF NOT EXISTS pg_trgm;

package/sql/reset.sql

@@ -0,0 +1,22 @@
+-- Drops every schema app_admin owns and reloads the app's schema, in one
+-- transaction. Roles, the `app` database and the app_service password
+-- survive, so the Hyperdrive origin keeps working.
+-- Run with psql from a staged schema directory (schema.sql beside sql/, as
+-- `@astralarium/repo-postgres/provision` stageSchema writes it).
+
+\connect app
+
+BEGIN;
+
+SET LOCAL ROLE app_admin;
+
+-- Each schema module's beforeReset, in load order.
+\i before-reset.sql
+
+\i drop-schemas.sql
+
+RESET ROLE;
+
+\i schema.sql
+
+COMMIT;

package/sql/roles.sql

@@ -0,0 +1,10 @@
+-- The app roles, ahead of the schema; they outlive reset.sql.
+-- Run by the image's init-db.sh and by bootstrap.sql.
+
+-- app_admin owns the schemas and is assumed via SET ROLE (NOLOGIN).
+CREATE ROLE app_admin NOLOGIN;
+-- app_service is the app's login.
+CREATE USER app_service;
+GRANT app_service TO app_admin;
+GRANT app_admin TO CURRENT_USER;
+ALTER ROLE app_service SET idle_in_transaction_session_timeout = '30s';

package/sql/slug/schema.sql

@@ -0,0 +1,25 @@
+-- `slug.slug(name)`: the URL slug of a name: lowercase letters and digits,
+-- spaces as `-`, other characters dropped. `O'Brien` → `obrien`;
+-- `Room 52` → `room-52`. Names normalize to NFC first: decomposed and
+-- composed spellings slug alike. Case and letter classes follow Unicode
+-- (`pg_c_utf8`), whatever the database's or argument's collation.
+SET ROLE app_admin;
+
+CREATE SCHEMA slug AUTHORIZATION app_admin;
+
+GRANT USAGE ON SCHEMA slug TO app_service;
+
+CREATE FUNCTION slug.slug(name text) RETURNS text
+LANGUAGE SQL IMMUTABLE PARALLEL SAFE
+RETURN replace(
+  regexp_replace(
+    lower(normalize(name, NFC) COLLATE pg_c_utf8),
+    '[^[:alnum:] ]',
+    '',
+    'g'
+  ),
+  ' ',
+  '-'
+);
+
+SET ROLE NONE;

package/sql/taskclaim/jobs/schema.sql

@@ -0,0 +1,19 @@
+-- taskclaim's pg_cron job: hourly `taskclaim.delete_expired()`. Skipped
+-- where pg_cron is not loaded.
+DO $$
+BEGIN
+  IF current_setting('cron.database_name', true) IS NULL THEN
+    RAISE NOTICE 'pg_cron is not loaded; skipping taskclaim jobs';
+    RETURN;
+  END IF;
+
+  PERFORM cron.schedule(
+    'taskclaim-ttl',
+    '15 * * * *',
+    $job$
+      SET statement_timeout = '30s';
+      SELECT taskclaim.delete_expired();
+    $job$
+  );
+END;
+$$;

package/sql/taskclaim/schema.sql

@@ -0,0 +1,41 @@
+-- Task claims in schema `taskclaim`: one row per task key, de-duplicating
+-- queued tasks (`@astralarium/repo-postgres/queue`), and expired-claim
+-- cleanup.
+SET ROLE app_admin;
+
+CREATE SCHEMA taskclaim AUTHORIZATION app_admin;
+
+GRANT USAGE ON SCHEMA taskclaim TO app_service;
+
+CREATE TABLE taskclaim.claim
+(
+  key        text PRIMARY KEY,
+  -- End of the claim; past it, a claim of the key replaces the row.
+  expires_at timestamptz NOT NULL,
+  -- Token of the claiming task, carried in its queue message.
+  token      uuid NOT NULL
+);
+CREATE INDEX claim_expires_at_idx ON taskclaim.claim (expires_at);
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON taskclaim.claim TO app_service;
+
+-- Deletes expired claims; their count. Reserved for the owner;
+-- `taskclaimJobs` schedules it.
+CREATE FUNCTION taskclaim.delete_expired()
+RETURNS bigint
+LANGUAGE plpgsql
+SET search_path = pg_catalog
+AS $$
+DECLARE
+  deleted bigint;
+BEGIN
+  DELETE FROM taskclaim.claim WHERE expires_at < CURRENT_TIMESTAMP;
+  GET DIAGNOSTICS deleted = ROW_COUNT;
+  RETURN deleted;
+END;
+$$;
+
+COMMENT ON FUNCTION taskclaim.delete_expired() IS 'Deletes expired claims.';
+REVOKE ALL ON FUNCTION taskclaim.delete_expired() FROM PUBLIC;
+
+SET ROLE NONE;

package/sql/taskclaim/scrub.sql

@@ -0,0 +1,3 @@
+-- Snapshot scrub: claims name tasks queued in the source environment; their
+-- messages stay behind there. taskclaim's `scrub`.
+TRUNCATE taskclaim.claim;