@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core/common/persistence/sql/postgres/postgres-schema.compiler.d.ts

@@ -0,0 +1,42 @@
+import type { ModelDescriptor } from '../../model-descriptor.interface.js';
+export { LOCK_MODEL, shortName, tableName } from '../sql-schema.shared.js';
+export declare const RLS_VERSION = "lt:tenant:v1";
+export declare const TENANT_FILTER_FUNCTION = "lt_tenant_filter";
+export declare const TENANT_POLICY = "lt_tenant_isolation";
+export interface DesiredColumn {
+    default?: string;
+    type: string;
+    collation?: 'C';
+    name: string;
+    primaryKey: boolean;
+    renamedFrom?: string;
+}
+export interface DesiredIndex {
+    create: string;
+    name: string;
+    unique: boolean;
+}
+export interface DesiredCheck {
+    expression: string;
+    name: string;
+}
+export interface DesiredTable {
+    checks: DesiredCheck[];
+    columns: DesiredColumn[];
+    indexes: DesiredIndex[];
+    model: ModelDescriptor;
+    name: string;
+    notices: string[];
+    tenantIsolated: boolean;
+}
+export interface PostgresSchemaOptions {
+    appRole: string;
+    isTenantIsolated: (model: ModelDescriptor) => boolean;
+}
+export declare function desiredTable(model: ModelDescriptor, options: PostgresSchemaOptions): DesiredTable;
+export declare function createTableStatement(table: DesiredTable): string;
+export declare function columnDefinition(column: DesiredColumn): string;
+export declare function addCheckStatement(table: string, check: DesiredCheck): string;
+export declare function grantStatement(table: string, appRole: string): string;
+export declare function tenantFilterFunctionStatements(): string[];
+export declare function tenantPolicyStatements(table: string): string[];

package/dist/core/common/persistence/sql/postgres/postgres-schema.compiler.js

@@ -0,0 +1,220 @@
+import { UnsupportedQueryError } from '../sql-errors.js';
+import { columnName, quoteIdentifier, SqlLiterals, sqlLiteral } from '../sql-naming.js';
+import { schemaHash, shortName, tableName } from '../sql-schema.shared.js';
+import { compilePostgresWhere } from './postgres-where.compiler.js';
+export { LOCK_MODEL, shortName, tableName } from '../sql-schema.shared.js';
+const SYSTEM_ROLE_PATH = '$[*] ? (@.type() == "string" && @ like_regex "^\\\\s*s_" flag "i")';
+export const RLS_VERSION = 'lt:tenant:v1';
+export const TENANT_FILTER_FUNCTION = 'lt_tenant_filter';
+export const TENANT_POLICY = 'lt_tenant_isolation';
+export function desiredTable(model, options) {
+    const name = tableName(model);
+    const notices = [];
+    const columns = Object.values(model.fields).map((field) => desiredColumn(field));
+    if (!columns.some((column) => column.primaryKey)) {
+        columns.unshift({ name: 'id', primaryKey: true, type: 'text' });
+    }
+    const seen = new Map();
+    for (const field of Object.values(model.fields)) {
+        const column = columnName(field.name);
+        if (seen.has(column)) {
+            throw new UnsupportedQueryError(`${model.name}: "${seen.get(column)}" and "${field.name}" map to one column "${column}"`);
+        }
+        seen.set(column, field.name);
+    }
+    const checks = [];
+    const roles = model.fields.roles;
+    if (roles?.isArray && (roles.kind === 'string' || roles.kind === 'enum')) {
+        checks.push({
+            expression: `"roles" IS NULL OR NOT jsonb_path_exists("roles", ${sqlLiteral(SYSTEM_ROLE_PATH)}::jsonpath)`,
+            name: shortName('ck', name, ['roles', 'no_system_roles']),
+        });
+    }
+    const tenantIsolated = options.isTenantIsolated(model);
+    if (tenantIsolated && !model.fields.tenantId) {
+        throw new UnsupportedQueryError(`${model.name} is tenant-isolated but has no tenantId field`);
+    }
+    const indexes = [];
+    for (const index of model.indexes) {
+        const result = desiredIndex(model, name, index);
+        if (typeof result === 'string') {
+            notices.push(`${model.name}: index ${JSON.stringify(index.fields)} is not created on PostgreSQL (${result})`);
+        }
+        else {
+            indexes.push(result);
+        }
+    }
+    if (tenantIsolated && !indexes.some((index) => /\("tenant_id"/.test(index.create))) {
+        indexes.push(desiredIndex(model, name, { fields: { tenantId: 1 }, options: {} }));
+    }
+    return { checks, columns, indexes, model, name, notices, tenantIsolated };
+}
+function desiredColumn(field) {
+    const name = columnName(field.name);
+    if (name === 'id') {
+        return { name, primaryKey: true, type: 'text' };
+    }
+    const column = { ...columnType(field), name, primaryKey: false };
+    const fallback = field.isArray ? [] : undefined;
+    const value = 'default' in field ? field.default : fallback;
+    if (value !== undefined) {
+        column.default = defaultLiteral(column.type, value);
+    }
+    if (field.renamedFrom) {
+        column.renamedFrom = columnName(field.renamedFrom);
+    }
+    return column;
+}
+function columnType(field) {
+    if (field.isArray) {
+        return { type: 'jsonb' };
+    }
+    switch (field.kind) {
+        case 'bigint':
+            return { type: 'bigint' };
+        case 'boolean':
+            return { type: 'boolean' };
+        case 'buffer':
+            return { type: 'bytea' };
+        case 'date':
+            return { type: 'timestamp with time zone' };
+        case 'decimal':
+            return { type: 'numeric' };
+        case 'enum':
+            return field.enumBase === 'number' ? { type: 'double precision' } : { collation: 'C', type: 'text' };
+        case 'id':
+        case 'ref':
+            return { collation: 'C', type: 'text' };
+        case 'number':
+            return { type: 'double precision' };
+        case 'string':
+            return { collation: 'C', type: 'text' };
+        case 'uuid':
+            return { type: 'uuid' };
+        default:
+            return { type: 'jsonb' };
+    }
+}
+function defaultLiteral(type, value) {
+    if (value === null) {
+        return undefined;
+    }
+    if (type === 'jsonb') {
+        return `${sqlLiteral(JSON.stringify(value))}::jsonb`;
+    }
+    if (type === 'timestamp with time zone') {
+        return value instanceof Date ? `${sqlLiteral(value)}::timestamptz` : undefined;
+    }
+    if (typeof value === 'string' ||
+        typeof value === 'number' ||
+        typeof value === 'boolean' ||
+        typeof value === 'bigint') {
+        return sqlLiteral(value);
+    }
+    return undefined;
+}
+function desiredIndex(model, table, index) {
+    const entries = Object.entries(index.fields);
+    const special = entries.find(([, direction]) => typeof direction !== 'number');
+    if (special) {
+        return `${String(special[1])} indexes have no PostgreSQL counterpart`;
+    }
+    const unique = index.options.unique === true;
+    const sparse = index.options.sparse === true;
+    const partial = index.options.partialFilterExpression;
+    const parts = entries.map(([path, direction]) => indexPart(model, path, direction));
+    const gin = parts.filter((part) => part.gin);
+    if (gin.length && (entries.length > 1 || unique)) {
+        return 'a unique or compound index over an array or JSON field';
+    }
+    const name = shortName(unique ? 'ux' : 'ix', table, [
+        ...entries.map(([path]) => path.replace(/\./g, '_')),
+        schemaHash(JSON.stringify({ fields: index.fields, partial, sparse, unique })),
+    ]);
+    const conditions = [];
+    if (sparse) {
+        conditions.push(...parts.map((part) => `${part.expression} IS NOT NULL`));
+    }
+    if (partial) {
+        conditions.push(`(${compilePostgresWhere(model, partial, new SqlLiterals())})`);
+    }
+    const using = gin.length
+        ? ` USING gin (${gin[0].expression} jsonb_path_ops)`
+        : ` (${parts.map((part) => part.sql).join(', ')})`;
+    const nulls = unique && !conditions.length ? ' NULLS NOT DISTINCT' : '';
+    const where = conditions.length ? ` WHERE ${conditions.join(' AND ')}` : '';
+    return {
+        create: `CREATE ${unique ? 'UNIQUE ' : ''}INDEX ${quoteIdentifier(name)} ON ${quoteIdentifier(table)}${using}${nulls}${where}`,
+        name,
+        unique,
+    };
+}
+function indexPart(model, path, direction) {
+    const [head, ...rest] = path.split('.');
+    const field = model.fields[head === 'id' ? '_id' : head];
+    if (!field) {
+        throw new UnsupportedQueryError(`${model.name}: index on unknown field "${path}"`);
+    }
+    const column = quoteIdentifier(columnName(field.name));
+    const order = direction < 0 ? ' DESC' : '';
+    if (rest.length) {
+        const expression = `(${column} #>> ${sqlLiteral(rest)})`;
+        return { expression, gin: false, sql: `${expression}${order}` };
+    }
+    const json = columnType(field).type === 'jsonb';
+    return { expression: column, gin: json, sql: `${column}${order}` };
+}
+export function createTableStatement(table) {
+    const definitions = table.columns.map(columnDefinition);
+    for (const check of table.checks) {
+        definitions.push(`CONSTRAINT ${quoteIdentifier(check.name)} CHECK (${check.expression})`);
+    }
+    return `CREATE TABLE ${quoteIdentifier(table.name)} (\n  ${definitions.join(',\n  ')}\n)`;
+}
+export function columnDefinition(column) {
+    const collation = column.collation ? ` COLLATE "${column.collation}"` : '';
+    const key = column.primaryKey ? ' NOT NULL PRIMARY KEY' : '';
+    const fallback = column.default ? ` DEFAULT ${column.default}` : '';
+    return `${quoteIdentifier(column.name)} ${column.type}${collation}${key}${fallback}`;
+}
+export function addCheckStatement(table, check) {
+    return `ALTER TABLE ${quoteIdentifier(table)} ADD CONSTRAINT ${quoteIdentifier(check.name)} CHECK (${check.expression}) NOT VALID`;
+}
+export function grantStatement(table, appRole) {
+    return `GRANT SELECT, INSERT, UPDATE, DELETE ON ${quoteIdentifier(table)} TO ${quoteIdentifier(appRole)}`;
+}
+export function tenantFilterFunctionStatements() {
+    const fn = quoteIdentifier(TENANT_FILTER_FUNCTION);
+    return [
+        `CREATE OR REPLACE FUNCTION ${fn}() RETURNS text[]
+LANGUAGE plpgsql STABLE PARALLEL SAFE SET search_path = pg_catalog AS $lt$
+DECLARE
+  scope text := current_setting('app.tenant_scope', true);
+BEGIN
+  IF scope = 'system' THEN
+    RETURN NULL;
+  ELSIF scope = 'tenant' THEN
+    RETURN ARRAY[current_setting('app.tenant_id', true)];
+  ELSIF scope = 'tenants' THEN
+    RETURN ARRAY(SELECT jsonb_array_elements_text(current_setting('app.tenant_ids', true)::jsonb));
+  END IF;
+  RAISE EXCEPTION 'tenant-scoped data accessed without a tenant context' USING ERRCODE = 'insufficient_privilege';
+END
+$lt$`,
+        `COMMENT ON FUNCTION ${fn}() IS ${sqlLiteral(RLS_VERSION)}`,
+    ];
+}
+export function tenantPolicyStatements(table) {
+    const quoted = quoteIdentifier(table);
+    const policy = quoteIdentifier(TENANT_POLICY);
+    const filter = `(SELECT ${quoteIdentifier(TENANT_FILTER_FUNCTION)}())`;
+    const visible = `(${filter} IS NULL OR "tenant_id" = ANY (${filter}::text[]))`;
+    return [
+        `ALTER TABLE ${quoted} ENABLE ROW LEVEL SECURITY`,
+        `ALTER TABLE ${quoted} FORCE ROW LEVEL SECURITY`,
+        `DROP POLICY IF EXISTS ${policy} ON ${quoted}`,
+        `CREATE POLICY ${policy} ON ${quoted} FOR ALL USING ${visible} WITH CHECK ${visible}`,
+        `COMMENT ON POLICY ${policy} ON ${quoted} IS ${sqlLiteral(RLS_VERSION)}`,
+    ];
+}
+//# sourceMappingURL=postgres-schema.compiler.js.map

package/dist/core/common/persistence/sql/postgres/postgres-schema.compiler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-schema.compiler.js","sourceRoot":"","sources":["../../../../../../src/core/common/persistence/sql/postgres/postgres-schema.compiler.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAiB3E,MAAM,gBAAgB,GAAG,oEAAoE,CAAC;AAG9F,MAAM,CAAC,MAAM,WAAW,GAAG,cAAc,CAAC;AAC1C,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AACzD,MAAM,CAAC,MAAM,aAAa,GAAG,qBAAqB,CAAC;AA8CnD,MAAM,UAAU,YAAY,CAAC,KAAsB,EAAE,OAA8B;IACjF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,OAAO,GAAoB,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;QACjD,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,qBAAqB,CAC7B,GAAG,KAAK,CAAC,IAAI,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,KAAK,CAAC,IAAI,wBAAwB,MAAM,GAAG,CACzF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,MAAM,GAAmB,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;IACjC,IAAI,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;QAEzE,MAAM,CAAC,IAAI,CAAC;YACV,UAAU,EAAE,qDAAqD,UAAU,CAAC,gBAAgB,CAAC,aAAa;YAC1G,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;SAC1D,CAAC,CAAC;IACL,CAAC;IAED,MAAM,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvD,IAAI,cAAc,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,CAAC,IAAI,+CAA+C,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,kCAAkC,MAAM,GAAG,CAAC,CAAC;QAChH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,cAAc,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAEnF,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAiB,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,aAAa,CAAC,KAAsB;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAkB,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChD,MAAM,KAAK,GAAG,SAAS,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,CAAC,OAAO,GAAG,cAAc,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QACtB,MAAM,CAAC,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAsB;IACxC,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IACD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;QAC3B,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC;QAC9C,KAAK,SAAS;YACZ,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC7B,KAAK,MAAM;YACT,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvG,KAAK,IAAI,CAAC;QACV,KAAK,KAAK;YACR,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1C,KAAK,QAAQ;YACX,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC;QACtC,KAAK,QAAQ;YACX,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1C,KAAK,MAAM;YACT,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QAC1B;YACE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,KAAc;IAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,KAAK,0BAA0B,EAAE,CAAC;QACxC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,CAAC;IACD,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS;QAC1B,OAAO,KAAK,KAAK,QAAQ,EACzB,CAAC;QACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAGD,SAAS,YAAY,CAAC,KAAsB,EAAE,KAAa,EAAE,KAAsB;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,CAAC;QACZ,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,yCAAyC,CAAC;IACxE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC;IAC7C,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,uBAA8D,CAAC;IAE7F,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAmB,CAAC,CAAC,CAAC;IAC9F,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC;QACjD,OAAO,wDAAwD,CAAC;IAClE,CAAC;IAED,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE;QAClD,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACpD,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;KAC9E,CAAC,CAAC;IACH,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,MAAM,EAAE,CAAC;QACX,UAAU,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,cAAc,CAAC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,OAAO,EAAE,CAAC;QACZ,UAAU,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,WAAW,EAAE,CAAC,GAAG,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM;QACtB,CAAC,CAAC,eAAe,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,kBAAkB;QACpD,CAAC,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,OAAO;QACL,MAAM,EAAE,UAAU,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,eAAe,CAAC,IAAI,CAAC,OAAO,eAAe,CAAC,KAAK,CAAC,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,EAAE;QAC9H,IAAI;QACJ,MAAM;KACP,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAChB,KAAsB,EACtB,IAAY,EACZ,SAAiB;IAEjB,MAAM,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,qBAAqB,CAAC,GAAG,KAAK,CAAC,IAAI,6BAA6B,IAAI,GAAG,CAAC,CAAC;IACrF,CAAC;IACD,MAAM,MAAM,GAAG,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAEhB,MAAM,UAAU,GAAG,IAAI,MAAM,QAAQ,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QACzD,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,UAAU,GAAG,KAAK,EAAE,EAAE,CAAC;IAClE,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC;IAChD,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,KAAK,EAAE,EAAE,CAAC;AACrE,CAAC;AAID,MAAM,UAAU,oBAAoB,CAAC,KAAmB;IACtD,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,WAAW,CAAC,IAAI,CAAC,cAAc,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC;IAC5F,CAAC;IACD,OAAO,gBAAgB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;AAC5F,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpE,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,GAAG,SAAS,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,KAAmB;IAGlE,OAAO,eAAe,eAAe,CAAC,KAAK,CAAC,mBAAmB,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,UAAU,aAAa,CAAC;AACrI,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,OAAe;IAC3D,OAAO,2CAA2C,eAAe,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,OAAO,CAAC,EAAE,CAAC;AAC5G,CAAC;AAQD,MAAM,UAAU,8BAA8B;IAC5C,MAAM,EAAE,GAAG,eAAe,CAAC,sBAAsB,CAAC,CAAC;IACnD,OAAO;QACL,8BAA8B,EAAE;;;;;;;;;;;;;;KAc/B;QACD,uBAAuB,EAAE,SAAS,UAAU,CAAC,WAAW,CAAC,EAAE;KAC5D,CAAC;AACJ,CAAC;AAMD,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,WAAW,eAAe,CAAC,sBAAsB,CAAC,KAAK,CAAC;IAEvE,MAAM,OAAO,GAAG,IAAI,MAAM,kCAAkC,MAAM,YAAY,CAAC;IAC/E,OAAO;QACL,eAAe,MAAM,4BAA4B;QACjD,eAAe,MAAM,2BAA2B;QAChD,yBAAyB,MAAM,OAAO,MAAM,EAAE;QAC9C,iBAAiB,MAAM,OAAO,MAAM,kBAAkB,OAAO,eAAe,OAAO,EAAE;QACrF,qBAAqB,MAAM,OAAO,MAAM,OAAO,UAAU,CAAC,WAAW,CAAC,EAAE;KACzE,CAAC;AACJ,CAAC"}

package/dist/core/common/persistence/sql/postgres/postgres-schema.migrator.d.ts

@@ -0,0 +1,12 @@
+import type { ModelDescriptor } from '../../model-descriptor.interface.js';
+import type { SqlExecutor, SqlQueryResult, SqlStatement } from '../sql-executor.interface.js';
+import { type SchemaChange } from '../sql-schema.shared.js';
+import { type PostgresSchemaOptions } from './postgres-schema.compiler.js';
+export { type SchemaChange, type SchemaChangeKind, SchemaMigrationRequiredError, SchemaOutOfDateError, UnsafeDatabaseRoleError, } from '../sql-schema.shared.js';
+export declare const MIN_POSTGRES_VERSION = 150000;
+export declare const SCHEMA_LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtext('lenne.tech:schema'))";
+type Run = (statement: SqlStatement) => Promise<SqlQueryResult<any>>;
+export declare function applyPostgresSchema(owner: SqlExecutor, models: ModelDescriptor[], options: PostgresSchemaOptions): Promise<SchemaChange[]>;
+export declare function verifyPostgresSchema(app: SqlExecutor, models: ModelDescriptor[], options: PostgresSchemaOptions): Promise<SchemaChange[]>;
+export declare function planPostgresSchema(run: Run, models: ModelDescriptor[], options: PostgresSchemaOptions): Promise<SchemaChange[]>;
+export declare function assertSafeApplicationRole(app: SqlExecutor, tables: string[]): Promise<void>;

package/dist/core/common/persistence/sql/postgres/postgres-schema.migrator.js

@@ -0,0 +1,315 @@
+import { isForeignColumn } from '../../persistence-runtime.registry.js';
+import { quoteIdentifier } from '../sql-naming.js';
+import { LOCK_MODEL, SchemaMigrationRequiredError, SchemaOutOfDateError, UnsafeDatabaseRoleError, } from '../sql-schema.shared.js';
+import { addCheckStatement, columnDefinition, createTableStatement, desiredTable, grantStatement, RLS_VERSION, TENANT_FILTER_FUNCTION, TENANT_POLICY, tenantFilterFunctionStatements, tenantPolicyStatements, } from './postgres-schema.compiler.js';
+export { SchemaMigrationRequiredError, SchemaOutOfDateError, UnsafeDatabaseRoleError, } from '../sql-schema.shared.js';
+export const MIN_POSTGRES_VERSION = 150000;
+export const SCHEMA_LOCK_SQL = "SELECT pg_advisory_xact_lock(hashtext('lenne.tech:schema'))";
+const SYSTEM = { kind: 'system' };
+export async function applyPostgresSchema(owner, models, options) {
+    return owner.transaction(async (tx) => {
+        const run = (statement) => tx.run(statement, SYSTEM);
+        await run({ params: [], text: SCHEMA_LOCK_SQL });
+        const changes = await planPostgresSchema(run, models, options);
+        const migrations = changes.filter((change) => change.kind === 'migration');
+        if (migrations.length) {
+            throw new SchemaMigrationRequiredError(migrations);
+        }
+        for (const change of changes) {
+            if (change.kind === 'automatic') {
+                for (const text of change.statements) {
+                    await run({ params: [], text });
+                }
+            }
+        }
+        return changes;
+    });
+}
+export async function verifyPostgresSchema(app, models, options) {
+    const changes = await planPostgresSchema((statement) => app.run(statement, SYSTEM), models, options);
+    const pending = changes.filter((change) => change.kind !== 'notice');
+    if (pending.length) {
+        throw new SchemaOutOfDateError(pending);
+    }
+    return changes;
+}
+export async function planPostgresSchema(run, models, options) {
+    const all = models.some((model) => model.name === LOCK_MODEL.name) ? models : [...models, LOCK_MODEL];
+    const tables = all.map((model) => desiredTable(model, options));
+    const catalog = await readCatalog(run, tables.map((table) => table.name), options.appRole);
+    const changes = [];
+    if (tables.some((table) => table.tenantIsolated) && catalog.functionVersion !== RLS_VERSION) {
+        changes.push({
+            description: `${catalog.functionVersion ? 'update' : 'create'} the tenant guard function ${TENANT_FILTER_FUNCTION}()`,
+            kind: 'automatic',
+            statements: tenantFilterFunctionStatements(),
+        });
+    }
+    if (tables.length && !catalog.schemaUsage) {
+        changes.push({
+            description: `let ${options.appRole} use schema ${catalog.schema}`,
+            kind: 'automatic',
+            statements: [`GRANT USAGE ON SCHEMA ${quoteIdentifier(catalog.schema)} TO ${quoteIdentifier(options.appRole)}`],
+        });
+    }
+    for (const table of tables) {
+        for (const notice of table.notices) {
+            changes.push({ description: notice, kind: 'notice', statements: [], table: table.name });
+        }
+        const existing = catalog.tables.get(table.name);
+        changes.push(...(existing ? planExistingTable(table, existing, options) : planNewTable(table, options)));
+    }
+    return changes;
+}
+function planNewTable(table, options) {
+    return [
+        {
+            description: `create table ${table.name} (${table.model.name})`,
+            kind: 'automatic',
+            statements: [
+                createTableStatement(table),
+                ...table.indexes.map((index) => index.create),
+                ...(table.tenantIsolated ? tenantPolicyStatements(table.name) : []),
+                grantStatement(table.name, options.appRole),
+            ],
+            table: table.name,
+        },
+    ];
+}
+function planExistingTable(table, existing, options) {
+    const changes = [];
+    const name = table.name;
+    const quoted = quoteIdentifier(name);
+    const declared = new Set();
+    for (const column of table.columns) {
+        declared.add(column.name);
+        const current = existing.columns.get(column.name);
+        if (!current) {
+            const previous = column.renamedFrom ? existing.columns.get(column.renamedFrom) : undefined;
+            if (previous) {
+                declared.add(column.renamedFrom);
+                changes.push({
+                    description: `rename ${name}.${column.renamedFrom} to ${column.name} (declared renamedFrom)`,
+                    kind: 'automatic',
+                    statements: [
+                        `ALTER TABLE ${quoted} RENAME COLUMN ${quoteIdentifier(column.renamedFrom)} TO ${quoteIdentifier(column.name)}`,
+                    ],
+                    table: name,
+                });
+                if (!sameType(column, previous)) {
+                    changes.push(typeChange(name, column, previous));
+                }
+                continue;
+            }
+            changes.push({
+                description: `add column ${name}.${column.name}`,
+                kind: 'automatic',
+                statements: [`ALTER TABLE ${quoted} ADD COLUMN ${columnDefinition({ ...column, primaryKey: false })}`],
+                table: name,
+            });
+            continue;
+        }
+        if (column.renamedFrom && existing.columns.has(column.renamedFrom)) {
+            declared.add(column.renamedFrom);
+            changes.push({
+                description: `${name}.${column.name} is declared as renamed from ${column.renamedFrom}, but both columns exist — move the data and drop the old column in a migration`,
+                kind: 'migration',
+                statements: [],
+                table: name,
+            });
+        }
+        if (!sameType(column, current)) {
+            changes.push(typeChange(name, column, current));
+        }
+    }
+    for (const column of existing.columns.keys()) {
+        if (!declared.has(column) && !isForeignColumn(name, column)) {
+            changes.push({
+                description: `${name}.${column} is no longer declared; the column is kept until a migration drops it`,
+                kind: 'notice',
+                statements: [],
+                table: name,
+            });
+        }
+    }
+    for (const check of table.checks) {
+        if (!existing.constraints.has(check.name)) {
+            changes.push({
+                description: `add check ${check.name} on ${name}`,
+                kind: 'automatic',
+                statements: [addCheckStatement(name, check)],
+                table: name,
+            });
+        }
+    }
+    const wanted = new Set(table.indexes.map((index) => index.name));
+    for (const index of table.indexes) {
+        if (existing.indexes.has(index.name)) {
+            continue;
+        }
+        changes.push({
+            description: `create ${index.unique ? 'unique ' : ''}index ${index.name} on ${name}`,
+            kind: index.unique ? 'migration' : 'automatic',
+            statements: [index.create],
+            table: name,
+        });
+    }
+    for (const [index] of existing.indexes) {
+        if (!wanted.has(index)) {
+            changes.push({
+                description: `index ${index} on ${name} is no longer declared; it is kept until a migration drops it`,
+                kind: 'notice',
+                statements: [],
+                table: name,
+            });
+        }
+    }
+    if (table.tenantIsolated && (!existing.rls || !existing.forced || existing.policyVersion !== RLS_VERSION)) {
+        changes.push({
+            description: `apply row-level security to ${name}`,
+            kind: 'automatic',
+            statements: tenantPolicyStatements(name),
+            table: name,
+        });
+    }
+    if (!table.tenantIsolated && existing.policyVersion) {
+        changes.push({
+            description: `${name} is no longer tenant-isolated, but its row-level security is still in place — remove it in a migration if that is intended`,
+            kind: 'migration',
+            statements: [
+                `DROP POLICY IF EXISTS ${quoteIdentifier(TENANT_POLICY)} ON ${quoted}`,
+                `ALTER TABLE ${quoted} NO FORCE ROW LEVEL SECURITY`,
+                `ALTER TABLE ${quoted} DISABLE ROW LEVEL SECURITY`,
+            ],
+            table: name,
+        });
+    }
+    if (!existing.granted) {
+        changes.push({
+            description: `grant ${options.appRole} access to ${name}`,
+            kind: 'automatic',
+            statements: [grantStatement(name, options.appRole)],
+            table: name,
+        });
+    }
+    return changes;
+}
+function sameType(column, current) {
+    return column.type === current.type && (column.collation ?? null) === current.collation;
+}
+function typeChange(table, column, current) {
+    const wanted = `${column.type}${column.collation ? ` COLLATE "${column.collation}"` : ''}`;
+    const found = `${current.type}${current.collation ? ` COLLATE "${current.collation}"` : ''}`;
+    return {
+        description: `${table}.${column.name} is ${found}, the model asks for ${wanted}`,
+        kind: 'migration',
+        statements: [
+            `ALTER TABLE ${quoteIdentifier(table)} ALTER COLUMN ${quoteIdentifier(column.name)} TYPE ${wanted} USING ${quoteIdentifier(column.name)}::${column.type}`,
+        ],
+        table,
+    };
+}
+async function readCatalog(run, tables, appRole) {
+    const schemaResult = await run({
+        params: [appRole],
+        text: "SELECT current_schema() AS schema, has_schema_privilege($1, current_schema(), 'USAGE') AS usage",
+    });
+    const tableResult = await run({
+        params: [tables, appRole],
+        text: `SELECT c.relname AS name, c.relrowsecurity AS rls, c.relforcerowsecurity AS forced,
+        has_table_privilege($2, c.oid, 'SELECT') AND has_table_privilege($2, c.oid, 'INSERT')
+          AND has_table_privilege($2, c.oid, 'UPDATE') AND has_table_privilege($2, c.oid, 'DELETE') AS granted,
+        (SELECT d.description FROM pg_policy p JOIN pg_description d ON d.objoid = p.oid AND d.classoid = 'pg_policy'::regclass
+          WHERE p.polrelid = c.oid AND p.polname = '${TENANT_POLICY}') AS policy_version
+      FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = current_schema() AND c.relkind IN ('r', 'p') AND c.relname = ANY($1)`,
+    });
+    const columnResult = await run({
+        params: [tables],
+        text: `SELECT c.relname AS table, a.attname AS name, format_type(a.atttypid, a.atttypmod) AS type,
+        CASE WHEN a.attcollation <> 0 AND a.attcollation <> t.typcollation THEN co.collname END AS collation
+      FROM pg_attribute a JOIN pg_class c ON c.oid = a.attrelid JOIN pg_namespace n ON n.oid = c.relnamespace
+        JOIN pg_type t ON t.oid = a.atttypid LEFT JOIN pg_collation co ON co.oid = a.attcollation
+      WHERE n.nspname = current_schema() AND c.relname = ANY($1) AND a.attnum > 0 AND NOT a.attisdropped`,
+    });
+    const indexResult = await run({
+        params: [tables],
+        text: `SELECT t.relname AS table, i.relname AS name, x.indisunique AS unique
+      FROM pg_index x JOIN pg_class i ON i.oid = x.indexrelid JOIN pg_class t ON t.oid = x.indrelid
+        JOIN pg_namespace n ON n.oid = t.relnamespace
+      WHERE n.nspname = current_schema() AND t.relname = ANY($1) AND (i.relname LIKE 'ix\\_%' OR i.relname LIKE 'ux\\_%')`,
+    });
+    const constraintResult = await run({
+        params: [tables],
+        text: `SELECT c.relname AS table, k.conname AS name
+      FROM pg_constraint k JOIN pg_class c ON c.oid = k.conrelid JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE n.nspname = current_schema() AND c.relname = ANY($1) AND k.contype = 'c'`,
+    });
+    const functionResult = await run({
+        params: [TENANT_FILTER_FUNCTION],
+        text: `SELECT obj_description(p.oid, 'pg_proc') AS version
+      FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = current_schema() AND p.proname = $1 AND p.pronargs = 0`,
+    });
+    const catalog = {
+        functionVersion: functionResult.rows[0]?.version ?? null,
+        schema: schemaResult.rows[0].schema,
+        schemaUsage: schemaResult.rows[0].usage,
+        tables: new Map(),
+    };
+    for (const row of tableResult.rows) {
+        catalog.tables.set(row.name, {
+            columns: new Map(),
+            constraints: new Set(),
+            forced: row.forced,
+            granted: row.granted,
+            indexes: new Map(),
+            policyVersion: row.policy_version ?? null,
+            rls: row.rls,
+        });
+    }
+    for (const row of columnResult.rows) {
+        catalog.tables.get(row.table)?.columns.set(row.name, { collation: row.collation ?? null, type: row.type });
+    }
+    for (const row of indexResult.rows) {
+        catalog.tables.get(row.table)?.indexes.set(row.name, row.unique);
+    }
+    for (const row of constraintResult.rows) {
+        catalog.tables.get(row.table)?.constraints.add(row.name);
+    }
+    return catalog;
+}
+export async function assertSafeApplicationRole(app, tables) {
+    const { rows } = await app.run({
+        params: [tables],
+        text: `SELECT current_user AS role, r.rolsuper AS superuser, r.rolbypassrls AS bypassrls,
+          current_setting('server_version_num')::int AS version,
+          (SELECT array_agg(c.relname::text ORDER BY c.relname) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+            WHERE n.nspname = current_schema() AND c.relname = ANY($1) AND pg_has_role(current_user, c.relowner, 'USAGE')) AS owned,
+          (SELECT array_agg(c.relname::text ORDER BY c.relname) FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+            WHERE n.nspname = current_schema() AND c.relname = ANY($1) AND has_table_privilege(c.oid, 'TRUNCATE')) AS truncate
+        FROM pg_roles r WHERE r.rolname = current_user`,
+    }, SYSTEM);
+    const role = rows[0];
+    if (role.version < MIN_POSTGRES_VERSION) {
+        throw new UnsafeDatabaseRoleError(`PostgreSQL ${Math.floor(role.version / 10000)} is not supported; version 15 or newer is required`);
+    }
+    const problems = [];
+    if (role.superuser) {
+        problems.push('is a superuser');
+    }
+    if (role.bypassrls) {
+        problems.push('has BYPASSRLS');
+    }
+    if (role.owned?.length) {
+        problems.push(`owns (or inherits the owner of) ${role.owned.join(', ')}`);
+    }
+    if (role.truncate?.length) {
+        problems.push(`may TRUNCATE ${role.truncate.join(', ')}`);
+    }
+    if (problems.length) {
+        throw new UnsafeDatabaseRoleError(`The application role "${role.role}" ${problems.join(', ')}. Row-level security cannot protect tenant data from ` +
+            'such a role. Connect `database.url` as a role that owns nothing, and give the owner role to `database.ownerUrl`.');
+    }
+}
+//# sourceMappingURL=postgres-schema.migrator.js.map

package/dist/core/common/persistence/sql/postgres/postgres-schema.migrator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"postgres-schema.migrator.js","sourceRoot":"","sources":["../../../../../../src/core/common/persistence/sql/postgres/postgres-schema.migrator.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAExE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EACL,UAAU,EAEV,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EAEpB,YAAY,EACZ,cAAc,EAEd,WAAW,EACX,sBAAsB,EACtB,aAAa,EACb,8BAA8B,EAC9B,sBAAsB,GACvB,MAAM,+BAA+B,CAAC;AAgBvC,OAAO,EAGL,4BAA4B,EAC5B,oBAAoB,EACpB,uBAAuB,GACxB,MAAM,yBAAyB,CAAC;AAGjC,MAAM,CAAC,MAAM,oBAAoB,GAAG,MAAM,CAAC;AAE3C,MAAM,CAAC,MAAM,eAAe,GAAG,6DAA6D,CAAC;AAC7F,MAAM,MAAM,GAAmB,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;AAwBlD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,KAAkB,EAClB,MAAyB,EACzB,OAA8B;IAE9B,OAAO,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;QACpC,MAAM,GAAG,GAAQ,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC1D,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QACjD,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QAC/D,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC;QAC3E,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,4BAA4B,CAAC,UAAU,CAAC,CAAC;QACrD,CAAC;QACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;oBACrC,MAAM,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;AACL,CAAC;AAGD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,GAAgB,EAChB,MAAyB,EACzB,OAA8B;IAE9B,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IACrG,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAQ,EACR,MAAyB,EACzB,OAA8B;IAG9B,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,EAAE,UAAU,CAAC,CAAC;IACtG,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,GAAG,EACH,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EACjC,OAAO,CAAC,OAAO,CAChB,CAAC;IACF,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,eAAe,KAAK,WAAW,EAAE,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,8BAA8B,sBAAsB,IAAI;YACrH,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,8BAA8B,EAAE;SAC7C,CAAC,CAAC;IACL,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,OAAO,OAAO,CAAC,OAAO,eAAe,OAAO,CAAC,MAAM,EAAE;YAClE,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,CAAC,yBAAyB,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;SAChH,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YACnC,OAAO,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,KAAmB,EAAE,OAA8B;IACvE,OAAO;QACL;YACE,WAAW,EAAE,gBAAgB,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG;YAC/D,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE;gBACV,oBAAoB,CAAC,KAAK,CAAC;gBAC3B,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC7C,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,cAAc,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;aAC5C;YACD,KAAK,EAAE,KAAK,CAAC,IAAI;SAClB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAmB,EACnB,QAAsB,EACtB,OAA8B;IAE9B,MAAM,OAAO,GAAmB,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAEnC,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3F,IAAI,QAAQ,EAAE,CAAC;gBACb,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC;oBACX,WAAW,EAAE,UAAU,IAAI,IAAI,MAAM,CAAC,WAAW,OAAO,MAAM,CAAC,IAAI,yBAAyB;oBAC5F,IAAI,EAAE,WAAW;oBACjB,UAAU,EAAE;wBACV,eAAe,MAAM,kBAAkB,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;qBAChH;oBACD,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;oBAChC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;gBACnD,CAAC;gBACD,SAAS;YACX,CAAC;YACD,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,cAAc,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE;gBAChD,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,CAAC,eAAe,MAAM,eAAe,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;gBACtG,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;YACnE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,gCAAgC,MAAM,CAAC,WAAW,iFAAiF;gBACtK,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IACD,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,GAAG,IAAI,IAAI,MAAM,uEAAuE;gBACrG,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,aAAa,KAAK,CAAC,IAAI,OAAO,IAAI,EAAE;gBACjD,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC5C,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,UAAU,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,KAAK,CAAC,IAAI,OAAO,IAAI,EAAE;YAEpF,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW;YAC9C,UAAU,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;YAC1B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,CAAC,IAAI,CAAC;gBACX,WAAW,EAAE,SAAS,KAAK,OAAO,IAAI,+DAA+D;gBACrG,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,aAAa,KAAK,WAAW,CAAC,EAAE,CAAC;QAC1G,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,+BAA+B,IAAI,EAAE;YAClD,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,sBAAsB,CAAC,IAAI,CAAC;YACxC,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QAGpD,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,GAAG,IAAI,4HAA4H;YAChJ,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE;gBACV,yBAAyB,eAAe,CAAC,aAAa,CAAC,OAAO,MAAM,EAAE;gBACtE,eAAe,MAAM,8BAA8B;gBACnD,eAAe,MAAM,6BAA6B;aACnD;YACD,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC;YACX,WAAW,EAAE,SAAS,OAAO,CAAC,OAAO,cAAc,IAAI,EAAE;YACzD,IAAI,EAAE,WAAW;YACjB,UAAU,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACnD,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,QAAQ,CACf,MAAuC,EACvC,OAAmD;IAEnD,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,OAAO,CAAC,SAAS,CAAC;AAC1F,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,MAAuC,EACvC,OAAmD;IAEnD,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC3F,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;IAC7F,OAAO;QACL,WAAW,EAAE,GAAG,KAAK,IAAI,MAAM,CAAC,IAAI,OAAO,KAAK,wBAAwB,MAAM,EAAE;QAChF,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE;YACV,eAAe,eAAe,CAAC,KAAK,CAAC,iBAAiB,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,MAAM,UAAU,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC,IAAI,EAAE;SAC1J;QACD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAQ,EAAE,MAAgB,EAAE,OAAe;IAEpE,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC;QAC7B,MAAM,EAAE,CAAC,OAAO,CAAC;QACjB,IAAI,EAAE,iGAAiG;KACxG,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,MAAM,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACzB,IAAI,EAAE;;;;sDAI4C,aAAa;;6FAE0B;KAC1F,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE;;;;yGAI+F;KACtG,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,GAAG,CAAC;QAC5B,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE;;;0HAGgH;KACvH,CAAC,CAAC;IACH,MAAM,gBAAgB,GAAG,MAAM,GAAG,CAAC;QACjC,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE;;qFAE2E;KAClF,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,GAAG,CAAC;QAC/B,MAAM,EAAE,CAAC,sBAAsB,CAAC;QAChC,IAAI,EAAE;;+EAEqE;KAC5E,CAAC,CAAC;IAEH,MAAM,OAAO,GAAY;QACvB,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI;QACxD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM;QACnC,WAAW,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK;QACvC,MAAM,EAAE,IAAI,GAAG,EAAE;KAClB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE;YAC3B,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,WAAW,EAAE,IAAI,GAAG,EAAE;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,OAAO,EAAE,IAAI,GAAG,EAAE;YAClB,aAAa,EAAE,GAAG,CAAC,cAAc,IAAI,IAAI;YACzC,GAAG,EAAE,GAAG,CAAC,GAAG;SACb,CAAC,CAAC;IACL,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC;QACpC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7G,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACnC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACnE,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,gBAAgB,CAAC,IAAI,EAAE,CAAC;QACxC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,GAAgB,EAAE,MAAgB;IAChF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,GAAG,CAQ5B;QACE,MAAM,EAAE,CAAC,MAAM,CAAC;QAChB,IAAI,EAAE;;;;;;uDAM2C;KAClD,EACD,MAAM,CACP,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACrB,IAAI,IAAI,CAAC,OAAO,GAAG,oBAAoB,EAAE,CAAC;QACxC,MAAM,IAAI,uBAAuB,CAC/B,cAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,oDAAoD,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,QAAQ,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CAAC,mCAAmC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,MAAM,IAAI,uBAAuB,CAC/B,yBAAyB,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,uDAAuD;YAC/G,kHAAkH,CACrH,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/common/persistence/sql/postgres/postgres-update.compiler.d.ts

@@ -0,0 +1,5 @@
+import type { DataStoreUpdate } from '../../data-store.interface.js';
+import type { ModelDescriptor } from '../../model-descriptor.interface.js';
+import { type SqlParamSink } from '../sql-naming.js';
+export declare function compilePostgresUpdate(model: ModelDescriptor, update: DataStoreUpdate, params: SqlParamSink): string[];
+export declare function pullExpression(model: ModelDescriptor, field: string, current: string, condition: unknown, params: SqlParamSink): string;