@everystack/cli 0.4.29 → 0.4.30

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.29",
+  "version": "0.4.30",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/authz-reconcile.ts

@@ -90,6 +90,38 @@ export function emitReconcileSql(declared: AuthzContract, live: AuthzContract):
   return sql;
 }
 
+/**
+ * Emit authz for a freshly-landed swap schema, idempotent against authz the DATA
+ * ARTIFACT already carries. This is db:swap's re-apply step, and it differs from
+ * `emitReconcileSql(declared, {tables:[]})` in one load-bearing way: it drops each
+ * declared policy before creating it.
+ *
+ * Why: db:export dumps with `pg_dump --no-privileges`, which strips GRANTs but NOT
+ * RLS policies (there is no pg_dump flag for that, and the `-Fc` archive can't be
+ * text-filtered). So the restored `<schema>_incoming` arrives with the declared
+ * policies ALREADY present. A bare `CREATE POLICY` then fails "policy ... already
+ * exists" and rolls the whole atomic swap back — the collision GridironDB hit on
+ * every stats table with RLS. Drop-then-create makes the re-apply overwrite
+ * whatever the artifact carried, keeping the declared Model the single source of
+ * truth. RLS enable/force and GRANT are idempotent already (ENABLE RLS on an
+ * already-enabled table is a no-op; the dump carried no grants).
+ */
+export function emitSwapAuthzSql(declared: AuthzContract): string[] {
+  const sql: string[] = [];
+  for (const d of declared.tables) {
+    const table = quoteQualified(d.table);
+    if (d.rls.enabled) sql.push(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`);
+    if (d.rls.forced) sql.push(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;`);
+    for (const p of d.policies) {
+      sql.push(policyDropSql(table, p.name)); // idempotent against the policy the dump restored
+      sql.push(policyCreateSql(table, p));
+    }
+    reconcileGrants(table, d, undefined, sql);
+    reconcileColumnGrants(table, d, undefined, sql);
+  }
+  return sql;
+}
+
 function reconcileRls(table: string, d: TableContract, l: TableContract | undefined, out: string[]): void {
   if (d.rls.enabled && !l?.rls.enabled) out.push(`ALTER TABLE ${table} ENABLE ROW LEVEL SECURITY;`);
   if (d.rls.forced && !l?.rls.forced) out.push(`ALTER TABLE ${table} FORCE ROW LEVEL SECURITY;`);

package/src/cli/schema-swap.ts

@@ -19,9 +19,12 @@
  *      ADD CONSTRAINT, the whole transaction rolls back, and the swap is refused — the
  *      cross-schema integrity gate, for free.
  *   4. RE-APPLY the schema's authz (RLS, policies, grants) from the declared descriptors. The
- *      incoming schema was restored `--no-owner --no-privileges`, so it carries no grants;
+ *      incoming schema was restored `--no-owner --no-privileges`, so it carries no grants — but
+ *      pg_dump does NOT strip RLS policies, so the declared policies arrive already present.
+ *      The re-apply drops-then-creates each declared policy (idempotent — a bare CREATE POLICY
+ *      would collide and roll the swap back) so declared stays the single source of truth.
  *      GRANT/POLICY are transactional, so they ride the same transaction — there is no
- *      committed instant where the new schema serves with absent or stale grants.
+ *      committed instant where the new schema serves with absent or stale authz.
  *
  * No REFRESH anywhere: the artifact ships computed rows as tables (defineMaterializedTable),
  * so the swap is a pointer flip, never a recompute.
@@ -30,7 +33,7 @@
 import type { ModelDescriptor } from '@everystack/model';
 import { modelForeignKeys, qualifiedTable } from './schema-compile.js';
 import { compileTableContract } from './authz-compile.js';
-import { emitReconcileSql } from './authz-reconcile.js';
+import { emitSwapAuthzSql } from './authz-reconcile.js';
 import { schemaOf } from './schema-fingerprint.js';
 
 const SAFE_SCHEMA = /^[a-z_][a-z0-9_$]*$/;
@@ -122,12 +125,15 @@ export function renderSchemaSwap(models: ModelDescriptor[], opts: SwapOptions):
   assertSafeSchema(retiring);
 
   const fks = crossSchemaForeignKeys(models, schema);
-  // Full authz for the swapped-in schema, from scratch (live side empty = every declared grant
-  // is a create) — the incoming schema was restored with privileges stripped.
+  // Re-apply the swapped-in schema's authz from the declared descriptors. The incoming schema
+  // was restored `--no-privileges` (no grants), but pg_dump does NOT strip RLS policies — the
+  // restore leaves the declared policies already present — so this drops-then-creates each
+  // declared policy to stay idempotent against them (a bare CREATE POLICY would collide and roll
+  // the swap back). Declared stays the single source of truth. See emitSwapAuthzSql.
   const statsContracts = models
     .filter((m) => (m.schema || 'public') === schema)
     .map((m) => compileTableContract(m));
-  const authz = emitReconcileSql({ tables: statsContracts, functions: [] }, { tables: [], functions: [] });
+  const authz = emitSwapAuthzSql({ tables: statsContracts, functions: [] });
 
   const statements = [
     ...fks.map((f) => f.dropSql),