@intentius/chant-lexicon-sql 0.116.0 → 0.117.0

package/src/postgres/access/access.e2e.test.ts

@@ -0,0 +1,191 @@
+/**
+ * Access against a live server (#3681): a declared role, a table with
+ * row-level security and a policy, grants on a schema, a table, a column and
+ * a function, a revoke from PUBLIC, and default privileges, applied where the
+ * profile manages access; then a grant and a revoke made by hand are drift
+ * the plan reports and an apply undoes; a profile that does not manage access
+ * plans none of it; and an import writes the access back as declarations.
+ *
+ * The server: `CHANT_SQL_E2E_POSTGRES_URL` (a `postgres://user@host:port/db`
+ * URL, with `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names a running one, such as
+ * the one `chant emulator up --lexicon sql` starts. Without it, a throwaway
+ * server at the pin, skipped cleanly when Docker is not available. The test
+ * writes only to the schema `chant_e2e_3681` and the roles
+ * `chant_e2e_3681_reader` and `chant_e2e_3681_writer`, all dropped afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../live/client";
+import { readLiveSchema } from "../live/catalog";
+import { planPgAgainstServer } from "../plan/commands";
+import { postgresApply } from "../../op/activities/postgres-apply";
+import { objectsToIR } from "../import/ir";
+import { PostgresGenerator } from "../import/generator";
+import { importedAccess } from "./import";
+
+const S = "chant_e2e_3681";
+const READER = "chant_e2e_3681_reader";
+const WRITER = "chant_e2e_3681_writer";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-access-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+
+const cleanup = async () => {
+  await admin.query(`DROP SCHEMA IF EXISTS ${S} CASCADE`);
+  for (const r of [READER, WRITER]) await admin.query(`DROP ROLE IF EXISTS ${r}`);
+};
+
+beforeAll(async () => {
+  if (!enabled) return;
+  if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+  else {
+    server = await startTestPostgres();
+    endpoint = server.endpoint();
+  }
+  admin = await connectPostgres(endpoint);
+  await cleanup();
+  // The writer is the environment's: provisioned outside the declarations, only named in them.
+  await admin.query(`CREATE ROLE ${WRITER} NOLOGIN`);
+}, 600_000);
+
+afterAll(async () => {
+  if (enabled) {
+    await cleanup().catch(() => undefined);
+    await admin?.end();
+  }
+  await server?.stop();
+  rmSync(dir, { recursive: true, force: true });
+});
+
+const MARKER = { stack: "e2e3681", env: "test" };
+const profile = (access: boolean) => ({
+  config: { ownership: MARKER, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_PASSWORD" }, schemas: [S], ...(access ? { access: true } : {}) } } } },
+  env: { PG_E2E_PASSWORD: endpoint.password ?? "" },
+});
+
+interface Obj {
+  export: string;
+  type: string;
+  ddl: string;
+  dependsOn?: string[];
+}
+
+const OBJECTS: Obj[] = [
+  { export: "app", type: "Postgres::Schema", ddl: `CREATE SCHEMA ${S}` },
+  { export: "reader", type: "Postgres::Role", ddl: `CREATE ROLE ${READER} NOLOGIN` },
+  {
+    export: "orders",
+    type: "Postgres::Table",
+    dependsOn: ["app"],
+    ddl: `CREATE TABLE ${S}.orders (id bigint PRIMARY KEY, tenant text NOT NULL, note varchar(40));\nALTER TABLE ${S}.orders ENABLE ROW LEVEL SECURITY`,
+  },
+  {
+    export: "ordersTenant",
+    type: "Postgres::Policy",
+    dependsOn: ["orders", "reader"],
+    ddl: `CREATE POLICY orders_tenant ON ${S}.orders FOR SELECT TO ${READER} USING (tenant = current_setting('app.tenant', true) AND note <> 'hidden')`,
+  },
+  { export: "total", type: "Postgres::Function", dependsOn: ["app"], ddl: `CREATE FUNCTION ${S}.total() RETURNS bigint LANGUAGE sql AS 'SELECT 1::bigint'` },
+  { export: "useApp", type: "Postgres::Grant", dependsOn: ["app", "reader"], ddl: `GRANT USAGE ON SCHEMA ${S} TO ${READER}` },
+  { export: "readOrders", type: "Postgres::Grant", dependsOn: ["orders", "reader"], ddl: `GRANT SELECT ON ${S}.orders TO ${READER}` },
+  { export: "writeNote", type: "Postgres::Grant", dependsOn: ["orders"], ddl: `GRANT UPDATE (note) ON ${S}.orders TO ${WRITER}` },
+  { export: "totalPrivate", type: "Postgres::Grant", dependsOn: ["total"], ddl: `REVOKE EXECUTE ON FUNCTION ${S}.total() FROM PUBLIC` },
+  { export: "totalReader", type: "Postgres::Grant", dependsOn: ["total", "reader"], ddl: `GRANT EXECUTE ON FUNCTION ${S}.total() TO ${READER}` },
+  { export: "readNewTables", type: "Postgres::DefaultPrivileges", dependsOn: ["app", "reader"], ddl: `ALTER DEFAULT PRIVILEGES IN SCHEMA ${S} GRANT SELECT ON TABLES TO ${READER}` },
+];
+
+function writeBuild(file: string, objects: Obj[]): string {
+  const path = join(dir, file);
+  writeFileSync(path, JSON.stringify({ dialect: "postgres", postgresMajor: 18, objects: objects.map((o) => ({ dependsOn: [], ...o })) }));
+  return path;
+}
+
+const apply = (path: string, access = true) => postgresApply({ buildPath: path, environment: "e2e" }, undefined, { ...profile(access), log: () => undefined });
+const plan = (path: string, access = true) => planPgAgainstServer("e2e", path, profile(access));
+const rules = async (path: string) => (await plan(path)).changes.map((c) => [c.object, c.rule]);
+
+describe.skipIf(!enabled)("access on a live server", () => {
+  test("applied, then drift by hand reported and undone, unmanaged left alone, imported back", async () => {
+    const build = writeBuild("v1.json", OBJECTS);
+
+    // A profile that does not manage access: the access declarations are filtered, the table is created without row-level security.
+    const off = await apply(build, false);
+    expect(off.failed).toEqual([]);
+    expect(off.notAttempted.map((n) => n.reason)).toEqual(Array(8).fill("filtered"));
+    expect(off.notAttempted).toHaveLength(8);
+    expect((await admin.query<{ rls: boolean }>(`SELECT relrowsecurity AS rls FROM pg_class WHERE oid = '${S}.orders'::regclass`))[0]!.rls).toBe(false);
+    const unmanaged = await plan(build, false);
+    expect(unmanaged.changes).toEqual([]);
+    expect(unmanaged.hints.join(" ")).toContain("9 access declarations are not planned");
+
+    // Managed: every access declaration applied.
+    expect(await rules(build)).toEqual([
+      [`reader (${READER})`, "SQLPG200"],
+      [`orders (${S}.orders)`, "SQLPG293"],
+      [`ordersTenant (${S}.orders_tenant ON ${S}.orders)`, "SQLPG290"],
+      [`default privileges in ${S} on tables TO ${READER}`, "SQLPG298"],
+      [`relation ${S}.orders (note) TO ${WRITER}`, "SQLPG296"],
+      [`relation ${S}.orders TO ${READER}`, "SQLPG296"],
+      [`routine ${S}.total() TO PUBLIC`, "SQLPG297"],
+      [`routine ${S}.total() TO ${READER}`, "SQLPG296"],
+      [`schema ${S} TO ${READER}`, "SQLPG296"],
+    ]);
+    const on = await apply(build);
+    expect(on.failed).toEqual([]);
+    expect(on.applied.map((a) => [a.name, a.action])).toEqual([
+      [S, "unchanged"],
+      [`${S}.total()`, "unchanged"],
+      [READER, "created"],
+      [`${S}.orders`, "updated"],
+      [`orders_tenant ON ${S}.orders`, "created"],
+      [`grant usage on schema ${S} to ${READER}`, "updated"],
+      [`grant select on table ${S}.orders to ${READER}`, "updated"],
+      [`grant update(note) on table ${S}.orders to ${WRITER}`, "updated"],
+      [`revoke execute on function ${S}.total() from public`, "updated"],
+      [`grant execute on function ${S}.total() to ${READER}`, "updated"],
+      [`default privileges grant select on tables in ${S} to ${READER}`, "updated"],
+    ]);
+    expect(await rules(build)).toEqual([]);
+    const can = async (sql: string) => (await admin.query<{ ok: boolean }>(sql))[0]!.ok;
+    expect(await can(`SELECT has_table_privilege('${READER}', '${S}.orders', 'SELECT') AS ok`)).toBe(true);
+    expect(await can(`SELECT has_column_privilege('${WRITER}', '${S}.orders', 'note', 'UPDATE') AS ok`)).toBe(true);
+    expect(await can(`SELECT has_function_privilege('public', '${S}.total()', 'EXECUTE') AS ok`)).toBe(false);
+    expect(await can(`SELECT relrowsecurity AS ok FROM pg_class WHERE oid = '${S}.orders'::regclass`)).toBe(true);
+
+    // By hand: a grant nobody declared, and a declared grant revoked. The plan reports both; an apply undoes both.
+    await admin.query(`GRANT INSERT ON ${S}.orders TO ${WRITER}`);
+    await admin.query(`REVOKE SELECT ON ${S}.orders FROM ${READER}`);
+    expect(await rules(build)).toEqual([
+      [`relation ${S}.orders TO ${READER}`, "SQLPG296"],
+      [`relation ${S}.orders TO ${WRITER}`, "SQLPG297"],
+    ]);
+    const undo = await apply(build);
+    expect(undo.failed).toEqual([]);
+    expect(undo.statements.map((s) => s.sql)).toEqual(expect.arrayContaining([`GRANT SELECT ON TABLE ${S}.orders TO ${READER}`, `REVOKE INSERT ON TABLE ${S}.orders FROM ${WRITER}`]));
+    expect(await rules(build)).toEqual([]);
+
+    // A policy changed by hand is drift too.
+    await admin.query(`ALTER POLICY orders_tenant ON ${S}.orders USING (true)`);
+    expect(await rules(build)).toEqual([[`ordersTenant (${S}.orders_tenant ON ${S}.orders)`, "SQLPG291"]]);
+    await apply(build);
+    expect(await rules(build)).toEqual([]);
+
+    // Import: the policy and the row-level security with the table, the privileges as grant declarations.
+    const live = await readLiveSchema(admin, { schemas: [S], access: true });
+    const access = await importedAccess(admin, live, [S]);
+    const [file] = new PostgresGenerator().generate(objectsToIR([...live.map((o) => ({ type: o.type, schema: o.schema, name: o.name, ddl: o.statement })), ...access]));
+    expect(file!.content).toContain("export const ordersTenant = policy`");
+    expect(file!.content).toContain(`ALTER TABLE \${chantE2e3681Schema}.orders ENABLE ROW LEVEL SECURITY`);
+    expect(file!.content).toContain(`GRANT SELECT ON TABLE \${orders} TO ${READER}`);
+    expect(file!.content).toContain(`REVOKE EXECUTE ON FUNCTION \${total}() FROM PUBLIC`);
+    expect(file!.content).toContain(`ALTER DEFAULT PRIVILEGES IN SCHEMA \${chantE2e3681Schema} GRANT SELECT ON TABLES TO ${READER}`);
+    expect(file!.content).toContain(`GRANT USAGE ON SCHEMA \${chantE2e3681Schema} TO ${READER}`);
+  }, 600_000);
+});

package/src/postgres/access/access.test.ts

@@ -0,0 +1,147 @@
+/**
+ * Row-level security, roles, grants and default privileges (#3681): what the
+ * tags parse and refuse, how the declarations add up to access, and how a
+ * change is classified and made.
+ */
+
+import { describe, expect, test } from "vitest";
+import { func, grant, policy, role, schema, table } from "../entities";
+import { diffObject, keyedByQualifiedName, pgSchemaFromLive, type PgSchemaObject } from "../plan/schema";
+import { diffPgSchemas, matchPgObjects } from "../plan/diff";
+import { accessScoped } from "../plan/commands";
+import { alterSteps } from "../apply/statements";
+import { declaredObjects } from "../apply/apply";
+import type { LivePgObject } from "../live/catalog";
+import { declaredAccess, diffAccess } from "./acl";
+
+const app = schema`CREATE SCHEMA app`;
+const reader = role`CREATE ROLE app_reader NOLOGIN`;
+const orders = table`
+  CREATE TABLE ${app}.orders (id bigint PRIMARY KEY, tenant text NOT NULL, note text);
+  ALTER TABLE ${app}.orders ENABLE ROW LEVEL SECURITY;
+  ALTER TABLE ${app}.orders FORCE ROW LEVEL SECURITY`;
+
+describe("the tags", () => {
+  test("a table's row-level security, a policy, a role", () => {
+    expect(orders.props).toMatchObject({ rowSecurity: true, forceRowSecurity: true });
+    const p = policy`CREATE POLICY tenant_rows ON ${orders} AS RESTRICTIVE FOR SELECT TO ${reader}, PUBLIC USING (${orders.columns.tenant} = current_setting('app.tenant'))`;
+    expect(p.entityType).toBe("Postgres::Policy");
+    expect(p.props).toMatchObject({ schema: "app", name: "tenant_rows", tableName: "app.orders", permissive: false, command: "select", roles: ["app_reader", "public"], using: "tenant = current_setting('app.tenant')" });
+    expect(p.dependsOn).toEqual(expect.arrayContaining([orders, reader]));
+    expect(reader.props).toMatchObject({ name: "app_reader", options: ["nologin"] });
+  });
+
+  test("grants on a schema, a table's columns and a routine, a revoke, default privileges", () => {
+    const f = func`CREATE FUNCTION ${app}.total(n int) RETURNS bigint LANGUAGE sql AS 'select 1'`;
+    expect(grant`GRANT USAGE ON SCHEMA ${app} TO ${reader}`.props).toMatchObject({ action: "grant", on: "schema", objectNames: ["app"], grantees: ["app_reader"] });
+    expect(grant`GRANT SELECT, UPDATE (note) ON ${orders} TO writer WITH GRANT OPTION`.props).toMatchObject({
+      on: "table",
+      privileges: [{ privilege: "select" }, { privilege: "update", columns: ["note"] }],
+      withGrantOption: true,
+    });
+    expect(grant`REVOKE EXECUTE ON FUNCTION ${f} FROM PUBLIC`.props).toMatchObject({ action: "revoke", objectNames: ["app.total(int)"], grantees: ["public"] });
+    const d = grant`ALTER DEFAULT PRIVILEGES IN SCHEMA ${app} GRANT SELECT ON TABLES TO ${reader}`;
+    expect(d.entityType).toBe("Postgres::DefaultPrivileges");
+    expect(d.props).toMatchObject({ inSchemas: ["app"], on: "tables", privileges: ["select"] });
+  });
+
+  test("secrets, memberships, ALL ... IN SCHEMA and an unnamed overload are refused", () => {
+    expect(() => role`CREATE ROLE r LOGIN PASSWORD 'x'`).toThrow(/environment's secret/);
+    expect(() => role`CREATE ROLE r IN ROLE admins`).toThrow(/environment's/);
+    expect(() => grant`GRANT admins TO r`).toThrow(/membership/);
+    expect(() => grant`GRANT SELECT ON ALL TABLES IN SCHEMA app TO r`).toThrow(/ALTER DEFAULT PRIVILEGES/);
+    expect(() => grant`GRANT EXECUTE ON FUNCTION app.f TO r`).toThrow(/parameter types/);
+    expect(() => table`ALTER TABLE app.t ENABLE ROW LEVEL SECURITY`).toThrow(/after the table's CREATE TABLE/);
+  });
+});
+
+// ── Access ─────────────────────────────────────────────────────────────
+
+const decl = (type: string, ddl: string, key = ddl): PgSchemaObject => ({ key, canonical: { ...diffObject(type, ddl, "public"), exportName: key } });
+const T = (ddl: string) => decl("Postgres::Table", ddl);
+const F = (ddl: string) => decl("Postgres::Function", ddl);
+const G = (ddl: string) => decl("Postgres::Grant", ddl);
+const D = (ddl: string) => decl("Postgres::DefaultPrivileges", ddl);
+
+const entries = (objects: PgSchemaObject[]) =>
+  Object.fromEntries([...declaredAccess(objects, { major: 18 }).state].map(([k, e]) => [k, [...e.privileges].map(([p, g]) => `${p}${g ? "*" : ""}`).sort().join(",")]));
+
+describe("the access declarations add up to", () => {
+  test("a routine's EXECUTE to PUBLIC unless revoked; grants added, revokes taken away, in order", () => {
+    expect(entries([F("CREATE FUNCTION app.f() RETURNS int LANGUAGE sql AS 'select 1'")])).toEqual({ "routine app.f() TO PUBLIC": "execute" });
+    expect(
+      entries([
+        F("CREATE FUNCTION app.f() RETURNS int LANGUAGE sql AS 'select 1'"),
+        T("CREATE TABLE app.t (a int, b int)"),
+        G("REVOKE EXECUTE ON FUNCTION app.f() FROM PUBLIC"),
+        G("GRANT ALL ON app.t TO r WITH GRANT OPTION"),
+        G("REVOKE GRANT OPTION FOR DELETE ON app.t FROM r"),
+        G("REVOKE TRUNCATE, MAINTAIN ON app.t FROM r"),
+        G("GRANT SELECT (b) ON app.t TO s"),
+      ]),
+    ).toEqual({ "relation app.t TO r": "delete,insert*,references*,select*,trigger*,update*", "relation app.t (b) TO s": "select" });
+  });
+
+  test("default privileges are compared themselves, and given to the objects chant creates", () => {
+    expect(
+      entries([
+        T("CREATE TABLE app.t (a int)"),
+        D("ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT ON TABLES TO r"),
+        D("ALTER DEFAULT PRIVILEGES REVOKE EXECUTE ON FUNCTIONS FROM PUBLIC"),
+        F("CREATE FUNCTION app.f() RETURNS int LANGUAGE sql AS 'select 1'"),
+      ]),
+    ).toEqual({ "default privileges in app on tables TO r": "select", "relation app.t TO r": "select" });
+  });
+
+  test("a change is a GRANT, a REVOKE, or ALTER DEFAULT PRIVILEGES", () => {
+    const before = declaredAccess([T("CREATE TABLE app.t (a int)"), G("GRANT SELECT, INSERT ON app.t TO r")], { major: 18 });
+    const after = declaredAccess([T("CREATE TABLE app.t (a int)"), G("GRANT SELECT ON app.t TO r WITH GRANT OPTION"), G("GRANT USAGE ON SCHEMA app TO r"), D("ALTER DEFAULT PRIVILEGES FOR ROLE owner IN SCHEMA app GRANT SELECT ON TABLES TO r")], { major: 18 });
+    expect(diffAccess(before.state, after.state).map((c) => [c.change.object, c.change.rule, c.sql])).toEqual([
+      ["acl default privileges for owner in app on tables TO r", "SQLPG298", ["ALTER DEFAULT PRIVILEGES FOR ROLE owner IN SCHEMA app GRANT SELECT ON TABLES TO r"]],
+      ["acl relation app.t TO r", "SQLPG296", ["REVOKE INSERT ON TABLE app.t FROM r", "GRANT SELECT ON TABLE app.t TO r WITH GRANT OPTION"]],
+      ["acl schema app TO r", "SQLPG296", ["GRANT USAGE ON SCHEMA app TO r"]],
+    ]);
+  });
+
+  test("between two builds, a new function's EXECUTE to PUBLIC is not a change", () => {
+    const f = "CREATE FUNCTION app.f() RETURNS int LANGUAGE sql AS 'select 1'";
+    expect(diffPgSchemas([], [F(f)]).changes.map((c) => c.rule)).toEqual(["SQLPG200"]);
+    expect(diffPgSchemas([], [F(f), G("REVOKE EXECUTE ON FUNCTION app.f() FROM PUBLIC")]).changes.map((c) => [c.object, c.rule])).toEqual([
+      [f, "SQLPG200"],
+      ["acl routine app.f() TO PUBLIC", "SQLPG297"],
+    ]);
+  });
+
+  test("a profile that does not manage access leaves out the access declarations and a table's row-level security", () => {
+    const { kept, unmanaged } = accessScoped(keyedByQualifiedName([T("CREATE TABLE app.t (a int);\nALTER TABLE app.t ENABLE ROW LEVEL SECURITY"), G("GRANT SELECT ON app.t TO r")]), false);
+    expect(unmanaged).toBe(2);
+    expect(kept.map((o) => [o.canonical.kind, o.canonical.fields.rowSecurity])).toEqual([["table", undefined]]);
+  });
+});
+
+// ── Policies, row-level security, roles ────────────────────────────────
+
+const live = (type: string, statement: string) => pgSchemaFromLive([{ type, statement, name: "", oid: "1" } as LivePgObject], "public");
+function steps(type: string, liveDdl: string, declaredDdl: string): string[] {
+  const [obj] = declaredObjects(JSON.stringify({ dialect: "postgres", objects: [{ export: "x", type, ddl: declaredDdl, dependsOn: [] }] }));
+  const after = keyedByQualifiedName([{ key: "x", canonical: obj!.canonical }]);
+  const before = live(type, liveDdl);
+  const m = matchPgObjects(before, after).find((x) => x.kind === "matched")!;
+  return alterSteps(obj!, m.before!.canonical, diffPgSchemas(before, after).changes, { major: 18 }).steps.map((s) => s.sql);
+}
+
+describe("the classifier and the statements", () => {
+  const P = "Postgres::Policy";
+  test("a policy's roles and expressions are ALTER POLICY; its command is a drop and a create", () => {
+    const p1 = "CREATE POLICY p ON app.t FOR SELECT TO r USING (a > 0)";
+    expect(steps(P, p1, "CREATE POLICY p ON app.t FOR SELECT TO r, s USING (a > 1)")).toEqual(["ALTER POLICY p ON app.t TO r, s USING (a > 1)"]);
+    expect(steps(P, p1, "CREATE POLICY p ON app.t FOR UPDATE TO r USING (a > 0)").slice(0, 2)).toEqual(["DROP POLICY p ON app.t", "CREATE POLICY p ON app.t FOR UPDATE TO r USING (a > 0)"]);
+    expect(diffPgSchemas([], keyedByQualifiedName([decl(P, p1)])).changes.map((c) => c.rule)).toEqual(["SQLPG290"]);
+    expect(diffPgSchemas(live(P, p1), []).changes.map((c) => c.rule)).toEqual(["SQLPG292"]);
+  });
+
+  test("row-level security toggled, and a role's attributes changed", () => {
+    expect(steps("Postgres::Table", "CREATE TABLE app.t (a int)", "CREATE TABLE app.t (a int);\nALTER TABLE app.t ENABLE ROW LEVEL SECURITY")).toEqual(["ALTER TABLE app.t ENABLE ROW LEVEL SECURITY"]);
+    expect(steps("Postgres::Role", "CREATE ROLE r", "CREATE ROLE r LOGIN NOINHERIT CONNECTION LIMIT 5")).toEqual(["ALTER ROLE r WITH LOGIN NOINHERIT CONNECTION LIMIT 5"]);
+  });
+});