@coffre/db 0.1.3 → 0.1.5

package/dist/migrate.d.ts

@@ -1,5 +1,8 @@
 import { Engine } from "./dialect.js";
+import { PoolClient } from "pg";
 //#region src/migrate.d.ts
+/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+export declare function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void>;
 /**
  * Beside this module: src/migrations in the workspace, and dist/migrations
  * in the built package, where the build copies them.

package/dist/migrate.js

@@ -15,6 +15,15 @@ import { fileURLToPath } from "node:url";
 * whole run. Restricted runtime roles are Postgres-only (baseline/postgres.sql).
 */
 const MIGRATION_LOCK_KEY = "7165058122361679213";
+/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+async function restrictDatabase(client) {
+	await client.query(`DO $$ BEGIN
+    EXECUTE format(
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+      current_database()
+    );
+  END $$`);
+}
 /**
 * Beside this module: src/migrations in the workspace, and dist/migrations
 * in the built package, where the build copies them.
@@ -72,14 +81,7 @@ async function postgresMigrator(url) {
 			await client.query("SELECT pg_advisory_unlock($1::bigint)", [MIGRATION_LOCK_KEY]);
 		},
 		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
-		async restrict() {
-			await client.query(`DO $$ BEGIN
-        EXECUTE format(
-          'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
-          current_database()
-        );
-      END $$`);
-		},
+		restrict: () => restrictDatabase(client),
 		async close() {
 			client.release();
 			await pool.end();
@@ -136,4 +138,4 @@ async function migrateDatabase(url, onPlan) {
 	}
 }
 //#endregion
-export { migrateDatabase, migrationsFolder };
+export { migrateDatabase, migrationsFolder, restrictDatabase };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -74,7 +74,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.1.3"
+    "@coffre/core": "0.1.5"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/migrate.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import { readFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
+import type { PoolClient } from 'pg';
 
 import { engineOfUrl } from './connect.ts';
 import type { Engine } from './dialect.ts';
@@ -19,6 +20,16 @@ import { postgresConnection } from './postgres.ts';
 
 const MIGRATION_LOCK_KEY = '7165058122361679213';
 
+/** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
+export async function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void> {
+  await client.query(`DO $$ BEGIN
+    EXECUTE format(
+      'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
+      current_database()
+    );
+  END $$`);
+}
+
 interface JournalEntry {
   idx: number;
   when: number;
@@ -140,15 +151,7 @@ async function postgresMigrator(url: string): Promise<Migrator> {
       await client.query('SELECT pg_advisory_unlock($1::bigint)', [MIGRATION_LOCK_KEY]);
     },
     migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
-    async restrict() {
-      // pg_dump carries table privileges, but not privileges on the database itself.
-      await client.query(`DO $$ BEGIN
-        EXECUTE format(
-          'REVOKE CREATE, TEMPORARY ON DATABASE %I FROM PUBLIC, coffre_app, coffre_runtime, coffre_vault, coffre_vault_runtime',
-          current_database()
-        );
-      END $$`);
-    },
+    restrict: () => restrictDatabase(client),
     async close() {
       client.release();
       await pool.end();