@homeflare/alchemy 0.46.0 → 0.46.1

package/src/postgres/schema-test-kit.ts

@@ -11,6 +11,7 @@
  *   branch's marker and matches its own.
  */
 import type { PsqlRunner } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
 
 export const ok = (stdout: string) => Promise.resolve({ code: 0, stdout, stderr: '' });
@@ -29,9 +30,12 @@ export interface RouteAnswers {
 
 /** Route one stdin to its answer by the markers above, `undefined` when no branch matches. */
 export const route = (stdin: string, answers: RouteAnswers): string | undefined => {
+  // The atomic drop (`schema-drop-sql.ts`) quotes every marker below inside its body: it answers
+  // nothing, and a refusal is injected by `runnerWith`'s `failOn`, never routed.
+  if (stdin.startsWith('DO ')) return undefined;
   if (stdin.includes('AS empty')) return answers.empty;
-  if (stdin.includes('FROM pg_namespace')) return answers.schema;
-  if (stdin.includes('FROM pg_database')) return answers.probe;
+  if (stdin.includes('FROM pg_catalog.pg_namespace')) return answers.schema;
+  if (stdin.includes('FROM pg_catalog.pg_database')) return answers.probe;
   if (stdin.includes('current_database()')) return answers.proof;
   return undefined;
 };
@@ -46,14 +50,24 @@ export const router = (answers: RouteAnswers) => (stdin: string) => route(stdin,
  */
 export const runnerWith = (
   answers: (stdin: string) => string,
+  /** The `psql` stderr a statement fails with (exit 3), or `undefined` to answer normally. */
+  failOn: (stdin: string) => string | undefined = () => undefined,
 ): { run: PsqlRunner; stdins: string[]; argvs: Array<readonly string[]> } => {
   const stdins: string[] = [];
   const argvs: Array<readonly string[]> = [];
   return {
-    run: ({ stdin, argv }) => {
+    // The pin prefix (`search-path.ts`) is stripped: these tests assert the STATEMENT. The pin
+    // itself is asserted once, on the raw stdin, in `search-path.test.ts`.
+    run: ({ stdin: raw, argv }) => {
+      const stdin = stripPin(raw);
       stdins.push(stdin);
       argvs.push(argv);
-      return Promise.resolve({ code: 0, stdout: answers(stdin), stderr: '' });
+      const stderr = failOn(stdin);
+      return Promise.resolve(
+        stderr === undefined
+          ? { code: 0, stdout: answers(stdin), stderr: '' }
+          : { code: 3, stdout: '', stderr },
+      );
     },
     stdins,
     argvs,

package/src/postgres/search-path.test.ts

@@ -0,0 +1,100 @@
+/**
+ * The `search_path` pin (`search-path.ts`): every session this family opens starts with
+ * `SET search_path = pg_catalog, pg_temp`, on both transports, and the SQL builders only name
+ * catalogs as `pg_catalog.*`. The Opus read of PR 334 (2026-10-02) found that a role allowed to
+ * create objects in a schema on the path could forge `pg_namespace` and fake the delete proof.
+ */
+import { readFileSync, readdirSync } from 'node:fs';
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { currentDatabase } from './schema-sql.ts';
+import { makePsqlExecutor } from './psql-executor.ts';
+import { PIN_SCRIPT_PREFIX, PIN_SEARCH_PATH_SQL } from './search-path.ts';
+
+describe('runner transport', () => {
+  const target = { database: 'postgres', username: 'postgres' };
+  const record = () => {
+    const stdins: string[] = [];
+    const run = ({ stdin }: { stdin: string }) => {
+      stdins.push(stdin);
+      return Promise.resolve({ code: 0, stdout: '[]', stderr: '' });
+    };
+    return { stdins, run };
+  };
+
+  test('a read starts with the pin, in the same psql session as the statement', async () => {
+    const { stdins, run } = record();
+    await Effect.runPromise(currentDatabase(makePsqlExecutor(run, target)));
+    expect(stdins).toHaveLength(1);
+    expect(stdins[0]?.startsWith('SET search_path = pg_catalog, pg_temp;\n')).toBe(true);
+    expect(stdins[0]?.startsWith(PIN_SCRIPT_PREFIX)).toBe(true);
+  });
+
+  test('a write and a transaction start with the pin too', async () => {
+    const { stdins, run } = record();
+    const pg = makePsqlExecutor(run, target);
+    await Effect.runPromise(pg.unsafe('COMMENT ON SCHEMA "a" IS E\'b\''));
+    await Effect.runPromise(pg.transaction(['CREATE ROLE "r"']));
+    expect(stdins).toHaveLength(2);
+    for (const stdin of stdins) expect(stdin.startsWith(PIN_SCRIPT_PREFIX)).toBe(true);
+    // The pin comes BEFORE `BEGIN`: it is a session setting, not part of the transaction.
+    expect(stdins[1]).toBe(`${PIN_SCRIPT_PREFIX}BEGIN;\nCREATE ROLE "r";\nCOMMIT;`);
+  });
+
+  test('the pin is the one statement text both transports share', () => {
+    expect(PIN_SEARCH_PATH_SQL).toBe('SET search_path = pg_catalog, pg_temp');
+  });
+});
+
+/** Every hand-written SQL builder in this family. The `*errors.ts` files are excluded: they name
+ * catalogs in error-message PROSE, which no server ever parses. The fakes match on the qualified
+ * text the builders emit, so their own tests pin them. */
+const sources = readdirSync(import.meta.dir).filter(
+  (f) =>
+    f.endsWith('.ts') &&
+    !f.endsWith('.test.ts') &&
+    !f.startsWith('fake-') &&
+    !/errors?\.ts$/.test(f),
+);
+const CATALOGS =
+  /(?<![\w.])(pg_(?:namespace|class|proc|type|operator|roles|authid|auth_members|database|tablespace|attribute|default_acl|depend|constraint|trigger|rewrite|attrdef|policy))\b/g;
+
+describe('catalog references', () => {
+  test('no SQL builder names a catalog without the pg_catalog. qualifier', () => {
+    const offenders: string[] = [];
+    for (const file of sources) {
+      const text = readFileSync(`${import.meta.dir}/${file}`, 'utf8');
+      // Only template/quoted SQL is judged: skip comment lines and `'pg_namespace'` literals
+      // (an `obj_description` class argument is a string, not a relation reference).
+      for (const [index, line] of text.split('\n').entries()) {
+        const trimmed = line.trim();
+        if (/^(\/\/|\*|\/\*)/.test(trimmed)) continue;
+        for (const match of line.matchAll(CATALOGS)) {
+          const before = line[(match.index ?? 0) - 1];
+          if (before === "'" || before === '`') continue;
+          offenders.push(`${file}:${String(index + 1)} ${match[1] ?? ''}`);
+        }
+      }
+    }
+    expect(offenders).toEqual([]);
+  });
+
+  test('the scan sees the catalogs it is meant to police', () => {
+    const joined = sources.map((f) => readFileSync(`${import.meta.dir}/${f}`, 'utf8')).join('\n');
+    for (const needle of [
+      'pg_catalog.pg_namespace',
+      'pg_catalog.pg_class',
+      'pg_catalog.pg_depend',
+      'pg_catalog.pg_roles',
+      'pg_catalog.pg_database',
+    ]) {
+      expect(joined).toContain(needle);
+    }
+  });
+
+  test('the scan itself fails on an unqualified reference', () => {
+    const bad = '  FROM pg_namespace n\n  JOIN pg_catalog.pg_class c ON true';
+    const hits = [...bad.matchAll(CATALOGS)].map((m) => m[1]);
+    expect(hits).toEqual(['pg_namespace']);
+  });
+});

package/src/postgres/search-path.ts

@@ -0,0 +1,62 @@
+/**
+ * The session setup every `Postgres.*` connection runs first: `search_path = pg_catalog, pg_temp`.
+ *
+ * ⛔ AN UNPINNED SESSION READS ITS OWN CATALOGS THROUGH `search_path`. Postgres searches
+ *   `pg_catalog` first only while the path does not NAME it (ddl.sgml 5.10.3); a role- or
+ *   database-level `ALTER … SET search_path = public, pg_catalog` (or a path naming any schema
+ *   another role may create in) puts a writable schema ahead of it, and a `public.pg_namespace`
+ *   TABLE then answers the delete proof's `oid`/`owner` re-read. Found by the Opus read of PR 334
+ *   (2026-10-02). The pin makes the order ours whatever the role, database or server says; the SQL
+ *   builders ALSO write `pg_catalog.<name>` (`catalog-qualified.test.ts` greps for it), so no
+ *   single layer is the whole defence.
+ * ★ `pg_temp` goes LAST on purpose: unnamed, it is searched FIRST for relations.
+ * ★ TWO TRANSPORTS, TWO MECHANISMS. The runner path prefixes the stdin script: `psql` argv is
+ *   the consumer's to join into a remote command, and a value with a space would split. The
+ *   socket path pins the ONE connection an operation reserves, because the driver's startup
+ *   message carries user, database and application_name only (`PgConnection.ts`, 4.0.0-rc.115)
+ *   and a pool hands each statement a different, unpinned connection.
+ */
+import type { PgClient } from '@effect/sql-pg/PgClient';
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+
+export const PIN_SEARCH_PATH_SQL = 'SET search_path = pg_catalog, pg_temp';
+
+/** The runner path's script prefix. */
+export const PIN_SCRIPT_PREFIX = `${PIN_SEARCH_PATH_SQL};\n`;
+
+/** A runner stdin without its pin — for tests that assert the statement that follows it. */
+export const stripPin = (stdin: string): string =>
+  stdin.startsWith(PIN_SCRIPT_PREFIX) ? stdin.slice(PIN_SCRIPT_PREFIX.length) : stdin;
+
+/**
+ * A `PgExecutor` over ONE reserved, pinned connection, for the life of the surrounding scope.
+ * `unsafe` runs on it (the client routes any statement under `transactionService` to that
+ * connection, so spans and error classification stay the driver's); `transaction` is a plain
+ * `BEGIN` … `COMMIT` on it — `withTransaction` would open a SAVEPOINT, because the service is
+ * already provided. A failure rolls back, and the pin is re-asserted by the next operation's own
+ * reservation, never assumed to survive one.
+ */
+export const pinnedSocketExecutor = (
+  pg: PgClient,
+): Effect.Effect<PgExecutor, SqlError, Scope.Scope> =>
+  Effect.gen(function* () {
+    const connection = yield* pg.reserve;
+    const run = <A extends object>(sql: string, params?: ReadonlyArray<unknown>) =>
+      Effect.provideService(pg.unsafe<A>(sql, params), pg.transactionService, [connection, 0]);
+    yield* run(PIN_SEARCH_PATH_SQL);
+    return {
+      unsafe: run,
+      transaction: (statements) =>
+        Effect.gen(function* () {
+          yield* run('BEGIN');
+          for (const sql of statements) yield* run(sql);
+          yield* run('COMMIT');
+        }).pipe(
+          Effect.onError(() => run('ROLLBACK').pipe(Effect.ignore)),
+          Effect.asVoid,
+        ),
+    };
+  });