@intentius/chant-lexicon-sql 0.115.0 → 0.117.0

package/src/postgres/plan/normalize.ts

@@ -27,7 +27,15 @@
  *   column's columns are `NOT NULL` whether or not that is written;
  * - an identity column's or a sequence's options at their defaults are left
  *   out; storage parameters compare as a map;
- * - an index's access method defaults to `btree`.
+ * - an index's access method defaults to `btree`;
+ * - a function's or procedure's parameter types drop their modifiers (the
+ *   catalog keeps none: `varchar(20)` is `character varying`), a parameter's
+ *   mode is `in` unless written, its attributes at their defaults (VOLATILE,
+ *   CALLED ON NULL INPUT, SECURITY INVOKER, PARALLEL UNSAFE, COST 100 or 1,
+ *   ROWS 1000 or 0) are left out, and its body is compared as written, since
+ *   the server keeps it verbatim;
+ * - a trigger's events compare as a set, `UPDATE OF` columns sorted, and its
+ *   arguments as the strings the catalog stores.
  *
  * What the rules cannot see (a view's `SELECT *`, which the server expands, or
  * an expression it parenthesizes) is asked of the live server itself when a
@@ -52,10 +60,19 @@ import type {
   IndexProps,
   KeyDef,
   SchemaProps,
+  DefaultPrivilegesProps,
+  GrantProps,
+  PolicyProps,
+  RoleProps,
+  RoutineProps,
   SequenceProps,
   TableProps,
+  TriggerProps,
   ViewProps,
 } from "../entities";
+import { stringValue } from "../entities";
+import { parseStatements } from "../parser";
+import type { RoutineNode } from "../parser";
 
 // ── Types ──────────────────────────────────────────────────────────────
 
@@ -178,7 +195,7 @@ function castEnd(sig: readonly Token[], i: number): { end: number; type: string
   return { end: j, type: words.join("").toLowerCase() };
 }
 
-const isLiteral = (t: Token | undefined): boolean => t !== undefined && (t.kind === "string" || t.kind === "number");
+const isLiteral = (t: Token | undefined): boolean => t !== undefined && (t.kind === "string" || t.kind === "number" || (t.kind === "ident" && t.text.toUpperCase() === "NULL"));
 
 /** One token's canonical text. */
 function tokenText(t: Token): string {
@@ -308,12 +325,40 @@ export interface CanonicalConstraint {
   comment?: string;
 }
 
-export type CanonicalKind = "schema" | "table" | "index" | "view" | "materializedView" | "sequence" | "enum" | "domain" | "extension";
+export type CanonicalKind =
+  | "schema"
+  | "table"
+  | "index"
+  | "view"
+  | "materializedView"
+  | "sequence"
+  | "enum"
+  | "domain"
+  | "extension"
+  | "function"
+  | "procedure"
+  | "trigger"
+  | "policy"
+  | "role"
+  | "grant"
+  | "defaultPrivileges";
+
+/** The kinds whose declarations are privileges, compared as the access they add up to (`../access/`), not one by one. */
+export const ACCESS_KINDS: ReadonlySet<CanonicalKind> = new Set(["grant", "defaultPrivileges"]);
+
+/** The kinds a profile manages only when it says so (`sql.profiles.<env>.access`). */
+export const ACCESS_MANAGED_KINDS: ReadonlySet<CanonicalKind> = new Set(["policy", "role", "grant", "defaultPrivileges"]);
 
 export interface CanonicalPgObject {
   kind: CanonicalKind;
   schema?: string;
   name: string;
+  /**
+   * What tells the object from another of the same name: a routine's input
+   * parameter types, `(integer,text)`; a trigger's table, ` ON app.users`.
+   * Written as SQL names the object after its name.
+   */
+  signature?: string;
   /** Everything else that is compared, by field, each field canonical. */
   fields: Record<string, unknown>;
   columns: CanonicalColumn[];
@@ -330,6 +375,13 @@ const kindOf: Record<string, CanonicalKind> = {
   "Postgres::Enum": "enum",
   "Postgres::Domain": "domain",
   "Postgres::Extension": "extension",
+  "Postgres::Function": "function",
+  "Postgres::Procedure": "procedure",
+  "Postgres::Trigger": "trigger",
+  "Postgres::Policy": "policy",
+  "Postgres::Role": "role",
+  "Postgres::Grant": "grant",
+  "Postgres::DefaultPrivileges": "defaultPrivileges",
 };
 
 const comment = (c: string | undefined): string | undefined => {
@@ -390,6 +442,159 @@ const keyBody = (kind: string, k: KeyDef) =>
     .filter(Boolean)
     .join(" ");
 
+/** The pseudo-types (`pg_type.typtype = 'p'`), in `pg_catalog`: a routine's parameter or result, never a column's. */
+const PSEUDO_TYPES = new Set([
+  "any", "anyarray", "anycompatible", "anycompatiblearray", "anycompatiblemultirange", "anycompatiblenonarray", "anycompatiblerange",
+  "anyelement", "anyenum", "anymultirange", "anynonarray", "anyrange", "cstring", "event_trigger", "fdw_handler", "index_am_handler",
+  "internal", "language_handler", "pg_ddl_command", "record", "table_am_handler", "trigger", "tsm_handler", "unknown", "void",
+]);
+
+/** A parameter's or result's type as the catalog keeps it: canonical, its modifiers dropped (`varchar(20)` is `character varying`). */
+export function canonicalArgType(text: string, defaultSchema: string): string {
+  const m = /^\s*(?:pg_catalog\s*\.\s*)?([A-Za-z_]+)\s*((?:\[\s*\]\s*)*)$/.exec(text);
+  if (m && PSEUDO_TYPES.has(m[1]!.toLowerCase())) return `${m[1]!.toLowerCase()}${"[]".repeat((m[2]!.match(/\[/g) ?? []).length)}`;
+  return canonicalType(text, defaultSchema)!.replace(/\([^()]*\)/g, "");
+}
+
+/** A routine's input parameters: those whose mode is `in`, `inout` or `variadic`. */
+const isInput = (a: { mode: string }) => a.mode !== "out";
+
+/** A routine's identity among its overloads: its input parameter types, `(integer,text)`. */
+export function routineSignature(p: Pick<RoutineProps, "args">, defaultSchema: string): string {
+  return `(${p.args.filter(isInput).map((a) => canonicalArgType(a.type, defaultSchema)).join(",")})`;
+}
+
+/** The result a function declares, or the one its OUT parameters give it: one OUT is its type, several are `record`. */
+function routineResult(p: RoutineProps, defaultSchema: string): string | undefined {
+  if (p.returnsTable) return `table(${p.returnsTable.map((c) => `${quoteIdent(c.name)} ${canonicalArgType(c.type, defaultSchema)}`).join(",")})`;
+  if (p.returns !== undefined) {
+    const m = /^setof\s+(.*)$/is.exec(p.returns.trim());
+    return m ? `setof ${canonicalArgType(m[1]!, defaultSchema)}` : canonicalArgType(p.returns, defaultSchema);
+  }
+  const outs = p.args.filter((a) => a.mode === "out" || a.mode === "inout");
+  if (outs.length === 1) return canonicalArgType(outs[0]!.type, defaultSchema);
+  if (outs.length > 1) return "record";
+  return undefined;
+}
+
+/** A `SET` value as compared: each item unquoted, a bare word folded, `TO` and `=` alike. */
+function canonicalSetting(value: string): string {
+  const items: string[] = [];
+  let tokens: Token[];
+  try {
+    tokens = tokenizeText(value, 0).filter((t) => !isTrivia(t));
+  } catch {
+    return value.trim();
+  }
+  let sign = "";
+  for (const t of tokens) {
+    if (t.kind === "punct" && t.text === ",") continue;
+    if (t.kind === "op" && (t.text === "-" || t.text === "+")) {
+      sign = t.text === "-" ? "-" : "";
+      continue;
+    }
+    if (t.kind === "string") items.push(stringValue(t.text) ?? t.text);
+    else if (t.kind === "qident") items.push(identValue(t));
+    else items.push(`${sign}${t.kind === "ident" ? t.text.toLowerCase() : t.text}`);
+    sign = "";
+  }
+  return items.join(", ");
+}
+
+/** The canonical fields of a function or procedure. */
+function routineFields(kind: "function" | "procedure", p: RoutineProps, defaultSchema: string, fields: Record<string, unknown>): void {
+  const lang = (p.language ?? "sql").toLowerCase();
+  fields.args = p.args.map((a) =>
+    [a.mode, a.name ? quoteIdent(a.name) : "", canonicalArgType(a.type, defaultSchema), a.default !== undefined ? `default ${canonicalExpr(a.default)}` : ""].filter(Boolean).join(" "),
+  );
+  fields.language = lang;
+  // Line endings aside, the body is what the server keeps and prints back.
+  fields.body = p.body.replace(/\r\n/g, "\n");
+  fields.link = p.link;
+  fields.securityDefiner = p.securityDefiner === true;
+  fields.set = p.set && Object.keys(p.set).length > 0
+    ? Object.fromEntries(Object.entries(p.set).map(([k, v]) => [k.toLowerCase(), canonicalSetting(v)]).sort(([a], [b]) => (a! < b! ? -1 : 1)))
+    : undefined;
+  fields.transform = p.transform ? canonicalExpr(p.transform) : undefined;
+  if (kind === "procedure") return;
+  const result = routineResult(p, defaultSchema);
+  const setReturning = result !== undefined && /^(setof |table\()/.test(result);
+  fields.returns = result;
+  fields.volatility = p.volatility && p.volatility !== "volatile" ? p.volatility : undefined;
+  fields.strict = p.strict === true;
+  fields.leakproof = p.leakproof === true;
+  fields.parallel = p.parallel && p.parallel !== "unsafe" ? p.parallel : undefined;
+  const defaultCost = lang === "c" || lang === "internal" ? 1 : 100;
+  fields.cost = p.cost !== undefined && Number(p.cost) !== defaultCost ? String(Number(p.cost)) : undefined;
+  const defaultRows = setReturning ? 1000 : 0;
+  fields.rows = p.rows !== undefined && Number(p.rows) !== defaultRows ? String(Number(p.rows)) : undefined;
+  fields.support = p.support ? canonicalName(p.support, "pg_catalog").replace(/^pg_catalog\./, "") : undefined;
+  fields.window = p.window === true;
+}
+
+/** A routine named with its parameters as a GRANT writes it (`app.f(int, text)`), as the target the catalog names: `app.f(integer,text)`. */
+export function canonicalRoutineTarget(text: string, defaultSchema: string): string {
+  const open = text.indexOf("(");
+  const name = canonicalName(open < 0 ? text : text.slice(0, open), defaultSchema);
+  if (open < 0) return name;
+  try {
+    // The parameter list read the way a CREATE FUNCTION reads it: modes, names and types.
+    const tokens = tokenizeText(`CREATE FUNCTION x${text.slice(open)} RETURNS void LANGUAGE sql AS ''`, 0);
+    const [node] = parseStatements(tokens);
+    const args = (node as RoutineNode).args.map((a) => ({ mode: (a.mode?.toLowerCase() ?? "in") as RoutineProps["args"][number]["mode"], type: tokens.slice(a.type.from, a.type.to).map((t) => t.text).join("") }));
+    return `${name}${routineSignature({ args }, defaultSchema)}`;
+  } catch {
+    return `${name}${text.slice(open).replace(/\s+/g, "")}`;
+  }
+}
+
+/** A role's attributes that differ from `CREATE ROLE`'s defaults (NOLOGIN, INHERIT and every other NO...), sorted. */
+const ROLE_DEFAULTS: Readonly<Record<string, boolean>> = { superuser: false, createdb: false, createrole: false, inherit: true, login: false, replication: false, bypassrls: false };
+
+export function canonicalRoleAttributes(options: readonly string[]): string[] {
+  const set: Record<string, boolean> = { ...ROLE_DEFAULTS };
+  for (const o of options) {
+    const word = o.toLowerCase();
+    if (word.startsWith("no") && word.slice(2) in ROLE_DEFAULTS) set[word.slice(2)] = false;
+    else if (word in ROLE_DEFAULTS) set[word] = true;
+  }
+  return Object.entries(set)
+    .filter(([k, v]) => ROLE_DEFAULTS[k] !== v)
+    .map(([k, v]) => (v ? k : `no${k}`))
+    .sort();
+}
+
+/** The order the catalog prints a trigger's events in. */
+const EVENT_ORDER = ["insert", "delete", "update", "truncate"];
+
+/** A trigger argument as the catalog stores it: a string. */
+function triggerArg(a: string): string {
+  const t = a.trim();
+  if (/^'/.test(t) || /^[Ee]'/.test(t) || /^\$/.test(t)) return stringValue(t) ?? t;
+  if (/^"/.test(t)) return identValue(t);
+  if (/^-?[0-9.]/.test(t)) return t.replace(/\s+/g, "");
+  return t.toLowerCase();
+}
+
+function triggerFields(p: TriggerProps, defaultSchema: string, fields: Record<string, unknown>): void {
+  fields.table = canonicalName(p.tableName, defaultSchema);
+  fields.constraint = p.constraint === true;
+  fields.timing = p.timing;
+  fields.events = [...p.events]
+    .sort((a, b) => EVENT_ORDER.indexOf(a.event) - EVENT_ORDER.indexOf(b.event))
+    .map((e) => (e.columns && e.columns.length > 0 ? `${e.event} of ${[...e.columns].sort().map(quoteIdent).join(",")}` : e.event));
+  fields.forEach = p.forEach;
+  fields.when = canonicalExpr(p.when);
+  fields.function = canonicalName(p.functionName, defaultSchema);
+  fields.args = p.args.length > 0 ? p.args.map(triggerArg) : undefined;
+  fields.from = p.from ? canonicalName(p.from, defaultSchema) : undefined;
+  fields.deferrable = p.deferrable === true;
+  fields.initiallyDeferred = p.initiallyDeferred === true;
+  fields.referencing = p.referencing && (p.referencing.old || p.referencing.new)
+    ? [p.referencing.old ? `old table as ${quoteIdent(p.referencing.old)}` : "", p.referencing.new ? `new table as ${quoteIdent(p.referencing.new)}` : ""].filter(Boolean).join(" ")
+    : undefined;
+}
+
 /**
  * A definition in canonical form. `props` is an entity's props, declared or
  * parsed from what the server printed; `defaultSchema` qualifies a bare name.
@@ -397,8 +602,8 @@ const keyBody = (kind: string, k: KeyDef) =>
 export function canonicalPgObject(entityType: string, props: Record<string, unknown>, defaultSchema = "public"): CanonicalPgObject {
   const kind = kindOf[entityType];
   if (!kind) throw new Error(`not a Postgres entity type: ${entityType}`);
-  const schemaOf = (p: { schema?: string }) => (kind === "schema" || kind === "extension" ? undefined : (p.schema ?? defaultSchema));
-  const base = { kind, schema: schemaOf(props as { schema?: string }), name: String(props.name) };
+  const schemaOf = (p: { schema?: string }) => (kind === "schema" || kind === "extension" || kind === "role" || ACCESS_KINDS.has(kind) ? undefined : (p.schema ?? defaultSchema));
+  const base: Pick<CanonicalPgObject, "kind" | "schema" | "name" | "signature"> = { kind, schema: schemaOf(props as { schema?: string }), name: String(props.name) };
   const fields: Record<string, unknown> = { comment: comment(props.comment as string | undefined) };
   const columns: CanonicalColumn[] = [];
   const constraints: CanonicalConstraint[] = [];
@@ -418,6 +623,66 @@ export function canonicalPgObject(entityType: string, props: Record<string, unkn
     case "enum":
       fields.labels = (props as unknown as EnumProps).labels;
       break;
+    case "function":
+    case "procedure": {
+      const p = props as unknown as RoutineProps;
+      base.signature = routineSignature(p, defaultSchema);
+      routineFields(kind, p, defaultSchema, fields);
+      break;
+    }
+    case "trigger": {
+      const p = props as unknown as TriggerProps;
+      triggerFields(p, defaultSchema, fields);
+      base.signature = ` ON ${String(fields.table)}`;
+      break;
+    }
+    case "policy": {
+      const p = props as unknown as PolicyProps;
+      fields.table = canonicalName(p.tableName, defaultSchema);
+      base.signature = ` ON ${String(fields.table)}`;
+      fields.restrictive = p.permissive === false;
+      fields.command = p.command && p.command !== "all" ? p.command : undefined;
+      const roles = [...new Set(p.roles.map((r) => r.toLowerCase() === "public" ? "public" : quoteIdent(r)))].sort();
+      fields.roles = roles.length === 1 && roles[0] === "public" ? undefined : roles;
+      fields.using = canonicalExpr(p.using);
+      fields.check = canonicalExpr(p.check);
+      break;
+    }
+    case "role": {
+      const p = props as unknown as RoleProps;
+      const attributes = canonicalRoleAttributes(p.options);
+      fields.attributes = attributes.length > 0 ? attributes : undefined;
+      fields.connectionLimit = p.connectionLimit !== undefined && Number(p.connectionLimit) !== -1 ? String(Number(p.connectionLimit)) : undefined;
+      break;
+    }
+    case "grant": {
+      const p = props as unknown as GrantProps;
+      const routine = p.on === "function" || p.on === "procedure" || p.on === "routine";
+      fields.grant = {
+        action: p.action,
+        on: p.on,
+        objects: p.objectNames.map((n) => (routine ? canonicalRoutineTarget(n, defaultSchema) : p.on === "schema" ? canonicalName(n) : canonicalName(n, defaultSchema))),
+        privileges: p.privileges.map((x) => ({ privilege: x.privilege.toLowerCase(), ...(x.columns ? { columns: x.columns } : {}) })),
+        grantees: p.grantees,
+        ...(p.withGrantOption ? { withGrantOption: true } : {}),
+        ...(p.grantOptionFor ? { grantOptionFor: true } : {}),
+      };
+      break;
+    }
+    case "defaultPrivileges": {
+      const p = props as unknown as DefaultPrivilegesProps;
+      fields.grant = {
+        action: p.action,
+        on: p.on,
+        privileges: p.privileges.map((x) => ({ privilege: x.toLowerCase() })),
+        grantees: p.grantees,
+        ...(p.forRoles ? { forRoles: p.forRoles } : {}),
+        ...(p.inSchemas ? { inSchemas: p.inSchemas } : {}),
+        ...(p.withGrantOption ? { withGrantOption: true } : {}),
+        ...(p.grantOptionFor ? { grantOptionFor: true } : {}),
+      };
+      break;
+    }
     case "domain": {
       const p = props as unknown as DomainProps;
       fields.dataType = canonicalType(p.dataType, defaultSchema);
@@ -527,6 +792,8 @@ export function canonicalPgObject(entityType: string, props: Record<string, unkn
       fields.using = p.using && p.using.toLowerCase() !== "heap" ? p.using.toLowerCase() : undefined;
       fields.with = canonicalOptions(p.with);
       fields.tablespace = p.tablespace;
+      fields.rowSecurity = p.rowSecurity === true;
+      fields.forceRowSecurity = p.forceRowSecurity === true;
       break;
     }
   }

package/src/postgres/plan/rules.ts

@@ -270,6 +270,86 @@ export const PG_CLASSIFIER_RULES = {
   ),
   SQLPG267: rule("SQLPG267", "metadata", "Change a schema's owner", "ALTER SCHEMA ... OWNER TO changes only the catalog.", `${DOCS}/sql-alterschema.html`),
   SQLPG268: rule("SQLPG268", "expand", "Change an object's kind", "A view and a materialized view, or a table and either, are different kinds of object: the old one is dropped and the new one created.", `${DOCS}/sql-createview.html`),
+  SQLPG280: rule(
+    "SQLPG280",
+    "metadata",
+    "Replace a function's or procedure's definition",
+    "CREATE OR REPLACE FUNCTION (or PROCEDURE) replaces the body and attributes in the catalog; it locks no table, and a call already running finishes with the old definition. The parameter types, the result and the input parameters' names have to stay the same.",
+    `${DOCS}/sql-createfunction.html`,
+  ),
+  SQLPG281: rule(
+    "SQLPG281",
+    "metadata",
+    "Drop and create a function or procedure",
+    "CREATE OR REPLACE refuses a change of the result type, the output parameters, an input parameter's name, a removed parameter default or the routine's kind: the routine is dropped and created in one transaction. Nothing on the server depends on it (a view, a trigger, a column default would make the DROP fail).",
+    `${DOCS}/sql-createfunction.html`,
+  ),
+  SQLPG282: rule(
+    "SQLPG282",
+    "expand",
+    "Change a function's result or parameters while other objects depend on it",
+    "DROP FUNCTION refuses while a view, a trigger, a column default or another routine depends on the function, and CREATE OR REPLACE cannot make this change. Create the new definition under a new name (or signature), move what depends on it, then drop the old.",
+    `${DOCS}/sql-dropfunction.html`,
+  ),
+  SQLPG283: rule(
+    "SQLPG283",
+    "metadata",
+    "Create a trigger on an existing table",
+    "CREATE TRIGGER takes SHARE ROW EXCLUSIVE on its table: writes and other schema changes to the table wait until the transaction commits, but no row is read. The applier's lock_timeout bounds the wait behind long-running transactions.",
+    `${DOCS}/sql-createtrigger.html`,
+  ),
+  SQLPG284: rule(
+    "SQLPG284",
+    "metadata",
+    "Change a trigger",
+    "CREATE OR REPLACE TRIGGER (14 and later) replaces the trigger under SHARE ROW EXCLUSIVE on its table. A constraint trigger has no OR REPLACE, and a trigger moved to another table is another trigger: each is dropped (ACCESS EXCLUSIVE, briefly) and created in one transaction.",
+    `${DOCS}/sql-createtrigger.html`,
+  ),
+  SQLPG285: rule("SQLPG285", "drop", "Drop a trigger", "DROP TRIGGER takes ACCESS EXCLUSIVE on its table, briefly; no row is read or lost, and the table's writes no longer fire it.", `${DOCS}/sql-droptrigger.html`),
+  SQLPG290: rule(
+    "SQLPG290",
+    "metadata",
+    "Create a policy on an existing table",
+    "CREATE POLICY takes ACCESS EXCLUSIVE on its table, briefly; no row is read. Where row-level security is on, the rows each role sees change when the transaction commits.",
+    `${DOCS}/sql-createpolicy.html`,
+  ),
+  SQLPG291: rule(
+    "SQLPG291",
+    "metadata",
+    "Change a policy",
+    "ALTER POLICY changes its roles, USING and WITH CHECK under ACCESS EXCLUSIVE on the table, briefly. Its command, AS RESTRICTIVE and table cannot be altered, nor an expression taken away: the policy is dropped and created in one transaction, so no session sees the table without it.",
+    `${DOCS}/sql-alterpolicy.html`,
+  ),
+  SQLPG292: rule("SQLPG292", "drop", "Drop a policy", "DROP POLICY takes ACCESS EXCLUSIVE on its table, briefly; the rows it let a role see are hidden from that role at once, or, if it was the last policy, every non-owner sees none.", `${DOCS}/sql-droppolicy.html`),
+  SQLPG293: rule(
+    "SQLPG293",
+    "metadata",
+    "Turn row-level security on or off, or force it on the owner",
+    "ALTER TABLE ... ENABLE, DISABLE, FORCE or NO FORCE ROW LEVEL SECURITY changes only the catalog, under ACCESS EXCLUSIVE, briefly. With it on and no policy that lets a role in, that role sees no rows; FORCE subjects the table's owner too.",
+    `${DOCS}/ddl-rowsecurity.html`,
+  ),
+  SQLPG294: rule("SQLPG294", "metadata", "Change a role's attributes", "ALTER ROLE changes the role in the cluster's catalog, for every database on the server, at once; sessions already open keep the attributes they started with until they reconnect.", `${DOCS}/sql-alterrole.html`),
+  SQLPG296: rule(
+    "SQLPG296",
+    "metadata",
+    "Grant a privilege",
+    "GRANT adds to the object's privileges in the catalog; no row is read and the role can use it from its next statement.",
+    `${DOCS}/sql-grant.html`,
+  ),
+  SQLPG297: rule(
+    "SQLPG297",
+    "metadata",
+    "Revoke a privilege",
+    "REVOKE removes from the object's privileges in the catalog. The role loses it at once: its next statement that needs it fails, so move every reader off it first.",
+    `${DOCS}/sql-revoke.html`,
+  ),
+  SQLPG298: rule(
+    "SQLPG298",
+    "metadata",
+    "Change default privileges",
+    "ALTER DEFAULT PRIVILEGES changes what objects created afterwards are given; objects that exist keep their privileges.",
+    `${DOCS}/sql-alterdefaultprivileges.html`,
+  ),
   SQLPG270: rule("SQLPG270", "drop", "Drop an object", "The object and, for a table, a materialized view or a sequence, its data are gone.", `${DOCS}/sql-droptable.html`),
 } as const satisfies Record<string, PgClassifierRule>;
 

package/src/postgres/plan/schema.ts

@@ -28,6 +28,8 @@ export interface PgDiffObject extends CanonicalPgObject {
   foreign?: string;
   /** The export name, against a server. */
   exportName?: string;
+  /** What depends on a routine on the server (a view, a trigger, a default), which a DROP FUNCTION would refuse. */
+  dependents?: string[];
 }
 
 export type PgSchemaObject = Keyed<PgDiffObject>;
@@ -94,10 +96,24 @@ export function pgSchemaFromBuildFile(path: string, defaultSchema = "public"): P
   return pgSchemaFromBuildOutput(readFileSync(path, "utf-8"), defaultSchema);
 }
 
-/** The identity an object has on a server: its kind's namespace and its qualified name. */
-export function qualifiedKey(o: { kind: string; schema?: string; name: string }): string {
-  const space = o.kind === "schema" ? "schema" : o.kind === "extension" ? "extension" : o.kind === "enum" || o.kind === "domain" ? "type" : "relation";
-  return `${space} ${o.schema ? `${o.schema}.` : ""}${o.name}`;
+/**
+ * The namespace an object's name is unique in: relations (tables, views,
+ * sequences, indexes) share one per schema, types and domains another,
+ * functions and procedures a third (told apart by their parameter types),
+ * a trigger's or a policy's name is unique on its table, and a role's in the
+ * cluster.
+ */
+export function pgNamespace(kind: string): string {
+  if (kind === "schema" || kind === "extension" || kind === "trigger" || kind === "policy" || kind === "role") return kind;
+  if (kind === "grant" || kind === "defaultPrivileges") return "grant";
+  if (kind === "enum" || kind === "domain") return "type";
+  if (kind === "function" || kind === "procedure") return "routine";
+  return "relation";
+}
+
+/** The identity an object has on a server: its kind's namespace, its qualified name, and its signature where it has one. */
+export function qualifiedKey(o: { kind: string; schema?: string; name: string; signature?: string }): string {
+  return `${pgNamespace(o.kind)} ${o.schema ? `${o.schema}.` : ""}${o.name}${o.signature ?? ""}`;
 }
 
 /** The declared objects re-keyed by qualified name, the only identity a server has. */
@@ -107,8 +123,13 @@ export function keyedByQualifiedName(objects: readonly PgSchemaObject[]): PgSche
 
 /** What a server holds, in the diff's form, keyed by qualified name. */
 export function pgSchemaFromLive(live: readonly LivePgObject[], defaultSchema: string): PgSchemaObject[] {
-  return live.map((o) => {
-    const canonical = { ...diffObject(o.type, o.statement, defaultSchema), ...(o.foreign ? { foreign: o.foreign } : {}) };
+  // A routine with a SQL-standard body is not one a declaration can hold (`../parser.ts`): never chant's, never compared.
+  return live.filter((o) => !o.unsupported).map((o) => {
+    const canonical = {
+      ...diffObject(o.type, o.statement, defaultSchema),
+      ...(o.foreign ? { foreign: o.foreign } : {}),
+      ...(o.dependents && o.dependents.length > 0 ? { dependents: o.dependents } : {}),
+    };
     return { key: qualifiedKey(canonical), canonical };
   });
 }

package/src/postgres/plan/server-normalize.ts

@@ -8,7 +8,10 @@
  * (`CREATE TEMP VIEW`, or a `CREATE TEMP TABLE` holding the columns' types,
  * defaults and generated expressions and the checks) inside a transaction
  * that is always rolled back, with a short `lock_timeout`, and read back with
- * the same printers the catalog read uses. Nothing is left behind: Postgres
+ * the same printers the catalog read uses. A trigger's `WHEN` and a policy's
+ * `USING` and `WITH CHECK`, which the server prints with the casts it
+ * resolved, are read back from a trigger or policy on a temporary copy of the
+ * table (`CREATE TEMP TABLE ... (LIKE table)`). Nothing is left behind: Postgres
  * DDL is transactional and a temporary object lives in the session's own
  * schema. A server that refuses (no TEMP privilege, a lock not granted in
  * time, an expression it rejects) leaves the rules' answer standing.
@@ -88,6 +91,47 @@ async function tableExpressions(client: PostgresClient, o: CanonicalPgObject, de
   });
 }
 
+/** A trigger's WHEN condition as the server prints it, canonical. */
+async function triggerWhen(client: PostgresClient, o: CanonicalPgObject, defaultSchema: string): Promise<string | undefined> {
+  const when = o.fields.when;
+  // An INSTEAD OF trigger, on a view, takes no WHEN.
+  if (typeof when !== "string" || o.fields.timing === "instead of") return undefined;
+  const events = ((o.fields.events as string[] | undefined) ?? []).map((e) => e.replace(/^(\w+)( of )?/, (_m, ev: string, of?: string) => `${ev.toUpperCase()}${of ? " OF " : ""}`));
+  return rolledBack(client, defaultSchema, async () => {
+    await client.query(`CREATE TEMP TABLE chant_normalize (LIKE ${String(o.fields.table)})`);
+    await client.query(`CREATE FUNCTION pg_temp.chant_normalize() RETURNS trigger LANGUAGE plpgsql AS 'BEGIN RETURN NULL; END'`);
+    await client.query(
+      `CREATE TRIGGER chant_normalize ${String(o.fields.timing).toUpperCase()} ${events.join(" OR ")} ON pg_temp.chant_normalize ` +
+        `FOR EACH ${o.fields.forEach === "row" ? "ROW" : "STATEMENT"} WHEN (${when}) EXECUTE FUNCTION pg_temp.chant_normalize()`,
+    );
+    await emptyPath(client);
+    const [row] = await client.query<Row>(`SELECT pg_catalog.pg_get_triggerdef(t.oid, true) AS def FROM pg_catalog.pg_trigger t WHERE t.tgrelid = 'pg_temp.chant_normalize'::pg_catalog.regclass`);
+    const m = / WHEN \((.*)\) EXECUTE (?:FUNCTION|PROCEDURE) /s.exec(String(row?.def ?? ""));
+    return m ? canonicalExpr(m[1]!) : undefined;
+  });
+}
+
+/** A policy's USING and WITH CHECK as the server prints them, canonical, from a policy on a temporary copy of its table. */
+async function policyExpressions(client: PostgresClient, o: CanonicalPgObject, defaultSchema: string): Promise<{ using?: string; check?: string } | undefined> {
+  const using = o.fields.using as string | undefined;
+  const check = o.fields.check as string | undefined;
+  if (using === undefined && check === undefined) return undefined;
+  return rolledBack(client, defaultSchema, async () => {
+    await client.query(`CREATE TEMP TABLE chant_normalize (LIKE ${String(o.fields.table)})`);
+    await client.query(
+      [`CREATE POLICY chant_normalize ON pg_temp.chant_normalize FOR ${String(o.fields.command ?? "all").toUpperCase()}`, using !== undefined ? `USING (${using})` : "", check !== undefined ? `WITH CHECK (${check})` : ""]
+        .filter(Boolean)
+        .join(" "),
+    );
+    await emptyPath(client);
+    const [row] = await client.query<Row>(
+      `SELECT pg_catalog.pg_get_expr(p.polqual, p.polrelid, true) AS qual, pg_catalog.pg_get_expr(p.polwithcheck, p.polrelid, true) AS withcheck
+       FROM pg_catalog.pg_policy p WHERE p.polrelid = 'pg_temp.chant_normalize'::pg_catalog.regclass`,
+    );
+    return { ...(row?.qual ? { using: canonicalExpr(String(row.qual)) } : {}), ...(row?.withcheck ? { check: canonicalExpr(String(row.withcheck)) } : {}) };
+  });
+}
+
 /**
  * The declared object with its expressions in the server's own printing,
  * when the server answers; the object unchanged otherwise. Only the
@@ -99,6 +143,14 @@ export async function serverNormalized<T extends CanonicalPgObject & { outputs?:
     // A declared column list names the outputs; otherwise the server's names do (`SELECT *` expanded).
     return q === undefined ? o : { ...o, fields: { ...o.fields, query: q.query }, ...(o.fields.columns === undefined ? { outputs: q.outputs } : {}) };
   }
+  if (o.kind === "policy") {
+    const e = await policyExpressions(client, o, defaultSchema);
+    return e === undefined ? o : { ...o, fields: { ...o.fields, ...e } };
+  }
+  if (o.kind === "trigger") {
+    const when = await triggerWhen(client, o, defaultSchema);
+    return when === undefined ? o : { ...o, fields: { ...o.fields, when } };
+  }
   if (o.kind === "table") {
     const e = await tableExpressions(client, o, defaultSchema);
     if (!e) return o;