@intentius/chant-lexicon-sql 0.124.31 → 0.124.33

package/dist/postgres/access/import.js

@@ -0,0 +1,61 @@
+/**
+ * Import's access (#3681): the privileges on the imported objects, and the
+ * default privileges of the role that reads, as `grant` declarations. Each
+ * is the GRANT, REVOKE or ALTER DEFAULT PRIVILEGES that takes what Postgres
+ * gives a new object (EXECUTE to PUBLIC on a routine, nothing on the rest) to
+ * what the server holds, one per object and grantee, so the import plans as
+ * no change.
+ */
+import { POSTGRES_ENTITY_TYPES } from "../entity-types.js";
+import { quoteIdent } from "../keywords.js";
+import { builtinEntries, diffAccess, entryKey, targetKey } from "./acl.js";
+import { readLiveAccess } from "./live.js";
+/** The access targets of imported objects, named as the catalog read names them. */
+function targetsOf(objects) {
+    const out = [];
+    for (const o of objects) {
+        const name = `${o.schema ? `${quoteIdent(o.schema)}.` : ""}${quoteIdent(o.name)}`;
+        if (o.type === POSTGRES_ENTITY_TYPES.schema)
+            out.push({ kind: "schema", name: quoteIdent(o.name) });
+        else if (o.type === POSTGRES_ENTITY_TYPES.table || o.type === POSTGRES_ENTITY_TYPES.view || o.type === POSTGRES_ENTITY_TYPES.materializedView)
+            out.push({ kind: "table", name });
+        else if (o.type === POSTGRES_ENTITY_TYPES.sequence)
+            out.push({ kind: "sequence", name });
+        else if (o.type === POSTGRES_ENTITY_TYPES.function || o.type === POSTGRES_ENTITY_TYPES.procedure) {
+            out.push({ kind: o.type === POSTGRES_ENTITY_TYPES.function ? "function" : "procedure", name: `${name}${o.signature ?? ""}` });
+        }
+    }
+    return out;
+}
+const word = (s) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "");
+export async function importedAccess(client, objects, schemas) {
+    const targets = targetsOf(objects);
+    const live = await readLiveAccess(client, targets, schemas ? { schemas } : {});
+    // What a new object is given: the starting point each declaration takes to the server's.
+    const baseline = new Map();
+    for (const t of targets) {
+        for (const b of builtinEntries(t.kind))
+            baseline.set(entryKey(t, b.grantee), { target: t, grantee: b.grantee, privileges: new Map([[b.privilege, false]]) });
+    }
+    for (const e of live.state.values()) {
+        if (e.target.kind !== "default" || e.target.schema !== undefined)
+            continue;
+        for (const b of builtinEntries(e.target.objects)) {
+            const k = entryKey(e.target, b.grantee);
+            if (!baseline.has(k))
+                baseline.set(k, { target: e.target, grantee: b.grantee, privileges: new Map([[b.privilege, false]]) });
+        }
+    }
+    // Only global default rows that exist on the server are compared from Postgres's own defaults.
+    const globalRows = new Set([...live.state.values()].filter((e) => e.target.kind === "default").map((e) => targetKey(e.target)));
+    const from = new Map([...baseline].filter(([, e]) => e.target.kind !== "default" || globalRows.has(targetKey(e.target))));
+    return diffAccess(from, live.state).flatMap((c) => c.sql.map((sql, i) => {
+        const defaults = c.target.kind === "default";
+        const on = defaults ? `default_${c.target.schema ?? "all"}_${c.target.objects}` : c.target.name.replace(/\(.*$/, "").split(".").pop();
+        return {
+            type: defaults ? POSTGRES_ENTITY_TYPES.defaultPrivileges : POSTGRES_ENTITY_TYPES.grant,
+            name: word(`${/^REVOKE|^ALTER DEFAULT PRIVILEGES.* REVOKE /.test(sql) ? "revoke" : "grant"}_${on}${c.target.column ? `_${c.target.column}` : ""}_${c.grantee}${i > 0 ? `_${i}` : ""}`),
+            ddl: sql,
+        };
+    }));
+}

package/dist/postgres/access/live.js

@@ -0,0 +1,96 @@
+/**
+ * Reading access from a live server (#3681): each target's access control
+ * list, exploded into one entry per grantee (`aclexplode`, with
+ * `acldefault` where the list is NULL, which means Postgres's own defaults),
+ * the owner's own privileges left out; every column's list of a relation
+ * read; and the default privileges (`pg_default_acl`) of the role that runs
+ * the read and of the roles the declarations name with `FOR ROLE`, globally
+ * and in the schemas in scope.
+ */
+import { addEntry, APPLYING_ROLE, builtinEntries, targetKey } from "./acl.js";
+const OBJTYPE = { r: "tables", S: "sequences", f: "functions", T: "types", n: "schemas" };
+const GRANTEE = "CASE WHEN a.grantee = 0 THEN 'public' ELSE pg_catalog.pg_get_userbyid(a.grantee) END";
+/** The access the server holds on `targets`, and the default privileges in scope. */
+export async function readLiveAccess(client, targets, scope = {}) {
+    const state = new Map();
+    const present = new Set();
+    const [me] = await client.query("SELECT current_user AS self");
+    const self = String(me?.self ?? "");
+    const entry = (t, r) => addEntry(state, t, String(r.grantee), String(r.privilege).toLowerCase(), r.grantable === true);
+    const names = (kinds) => [...new Set(targets.filter((t) => kinds.includes(t.kind)).map((t) => t.name))];
+    const schemas = names(["schema"]);
+    if (schemas.length > 0) {
+        const rows = await client.query(`SELECT x AS target, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_namespace n ON n.oid = pg_catalog.to_regnamespace(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(n.nspacl, pg_catalog.acldefault('n'::"char", n.nspowner))) a ON a.grantee <> n.nspowner`, [schemas]);
+        for (const r of rows) {
+            const t = { kind: "schema", name: String(r.target) };
+            present.add(targetKey(t));
+            if (r.privilege !== null)
+                entry(t, r);
+        }
+    }
+    const relations = names(["table", "sequence", "column"]);
+    if (relations.length > 0) {
+        const rows = await client.query(`SELECT x AS target, c.relkind AS kind, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_class c ON c.oid = pg_catalog.to_regclass(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(c.relacl, pg_catalog.acldefault((CASE WHEN c.relkind = 'S' THEN 's' ELSE 'r' END)::"char", c.relowner))) a ON a.grantee <> c.relowner`, [relations]);
+        for (const r of rows) {
+            const t = { kind: r.kind === "S" ? "sequence" : "table", name: String(r.target) };
+            present.add(targetKey(t));
+            if (r.privilege !== null)
+                entry(t, r);
+        }
+        const columns = await client.query(`SELECT x AS target, att.attname AS column, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_class c ON c.oid = pg_catalog.to_regclass(x)
+       JOIN pg_catalog.pg_attribute att ON att.attrelid = c.oid AND att.attnum > 0 AND NOT att.attisdropped AND att.attacl IS NOT NULL
+       CROSS JOIN LATERAL pg_catalog.aclexplode(att.attacl) a
+       WHERE a.grantee <> c.relowner`, [relations]);
+        for (const r of columns)
+            entry({ kind: "column", name: String(r.target), column: String(r.column) }, r);
+    }
+    const routines = names(["function", "procedure"]);
+    if (routines.length > 0) {
+        const rows = await client.query(`SELECT x AS target, p.prokind AS kind, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(p.proacl, pg_catalog.acldefault('f'::"char", p.proowner))) a ON a.grantee <> p.proowner`, [routines]);
+        for (const r of rows) {
+            const t = { kind: r.kind === "p" ? "procedure" : "function", name: String(r.target) };
+            present.add(targetKey(t));
+            if (r.privilege !== null)
+                entry(t, r);
+        }
+    }
+    // Default privileges: the reading role's (written as the role that applies) and the FOR ROLE ones.
+    const roles = [self, ...(scope.forRoles ?? [])];
+    const defaults = await client.query(`SELECT pg_catalog.pg_get_userbyid(d.defaclrole) AS role, n.nspname AS schema, d.defaclobjtype AS objtype,
+            ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+     FROM pg_catalog.pg_default_acl d LEFT JOIN pg_catalog.pg_namespace n ON n.oid = d.defaclnamespace
+     LEFT JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) a ON a.grantee <> d.defaclrole
+     WHERE pg_catalog.pg_get_userbyid(d.defaclrole) = ANY($1::text[])
+       AND (d.defaclnamespace = 0${scope.schemas ? " OR n.nspname = ANY($2::text[])" : ""})`, scope.schemas ? [roles, [...scope.schemas]] : [roles]);
+    const globalRows = new Set();
+    const globalDefaults = new Set();
+    for (const r of defaults) {
+        const objects = OBJTYPE[String(r.objtype)];
+        if (!objects)
+            continue;
+        const role = String(r.role) === self ? APPLYING_ROLE : String(r.role);
+        const t = { kind: "default", name: "", role, ...(r.schema !== null && r.schema !== undefined ? { schema: String(r.schema) } : {}), objects };
+        if (t.schema === undefined) {
+            globalRows.add(targetKey(t));
+            if (role === APPLYING_ROLE)
+                globalDefaults.add(objects);
+        }
+        if (r.privilege !== null)
+            entry(t, r);
+    }
+    // A global default the declarations decide with no row on the server is Postgres's own.
+    for (const t of scope.declaredDefaults ?? []) {
+        if (t.kind !== "default" || t.schema !== undefined || globalRows.has(targetKey(t)))
+            continue;
+        for (const b of builtinEntries(t.objects))
+            addEntry(state, t, b.grantee, b.privilege, false);
+    }
+    return { state, present, globalDefaults, self };
+}