@prisma-next/target-postgres 0.14.0-dev.8 → 0.14.0-dev.80

package/src/core/migrations/operations/rls.ts

@@ -0,0 +1,187 @@
+import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
+import { ifDefined } from '@prisma-next/utils/defined';
+import { rlsEnabledAst, rlsPolicyExistsAst } from '../../../contract-free/checks';
+import {
+  alterPolicyRename,
+  createPolicy,
+  disableRowLevelSecurity as disableRowLevelSecurityDdl,
+  dropPolicy,
+} from '../../../contract-free/ddl';
+import type { PostgresRlsPolicy } from '../../postgres-rls-policy';
+import { qualifyTableName } from '../planner-sql-checks';
+import { type Op, step, targetDetails } from './shared';
+
+const PLAIN_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_$]*$/;
+
+function validateRoleName(role: string): string {
+  if (!PLAIN_IDENTIFIER.test(role)) {
+    throw new Error(
+      `Invalid role name ${JSON.stringify(role)}: role names must be plain SQL identifiers matching ^[A-Za-z_][A-Za-z0-9_$]*$`,
+    );
+  }
+  return role;
+}
+
+export async function createRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policy: PostgresRlsPolicy,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const validatedRoles = policy.roles.map(validateRoleName);
+  const ddlNode = createPolicy({
+    schema: schemaName,
+    table: tableName,
+    name: policy.name,
+    permissive: policy.permissive,
+    operation: policy.operation,
+    roles: validatedRoles,
+    ...ifDefined('using', policy.using),
+    ...ifDefined('withCheck', policy.withCheck),
+  });
+  const checks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: policy.name,
+  });
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policy.name}`,
+    label: `Create RLS policy "${policy.name}" on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rlsPolicy', policy.name, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${policy.name}" does not exist`, absent.sql, absent.params),
+    ],
+    execute: [step(`create RLS policy "${policy.name}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policy.name}" exists`, present.sql, present.params)],
+  };
+}
+
+export async function dropRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  policyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = dropPolicy({ schema: schemaName, table: tableName, name: policyName });
+  const checks = rlsPolicyExistsAst({ schema: schemaName, table: tableName, policyName });
+  const present = await lowerer.lowerToExecuteRequest(checks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const absent = await lowerer.lowerToExecuteRequest(checks.policyAbsent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${policyName}.drop`,
+    label: `Drop RLS policy "${policyName}" on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rlsPolicy', policyName, schemaName, tableName),
+    precheck: [step(`ensure RLS policy "${policyName}" exists`, present.sql, present.params)],
+    execute: [step(`drop RLS policy "${policyName}"`, execute.sql, execute.params)],
+    postcheck: [step(`verify RLS policy "${policyName}" is absent`, absent.sql, absent.params)],
+  };
+}
+
+export async function enableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}`,
+    label: `Enable row-level security on "${tableName}"`,
+    operationClass: 'additive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is not already enabled on "${tableName}"`, disabled.sql, disabled.params),
+    ],
+    execute: [
+      step(
+        `enable row-level security on "${tableName}"`,
+        `ALTER TABLE ${qualifyTableName(schemaName, tableName)} ENABLE ROW LEVEL SECURITY`,
+      ),
+    ],
+    postcheck: [
+      step(`verify row-level security is enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+  };
+}
+
+export async function disableRowLevelSecurity(
+  schemaName: string,
+  tableName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = disableRowLevelSecurityDdl({ schema: schemaName, table: tableName });
+  const checks = rlsEnabledAst(schemaName, tableName);
+  const enabled = await lowerer.lowerToExecuteRequest(checks.rlsEnabled());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const disabled = await lowerer.lowerToExecuteRequest(checks.rlsDisabled());
+  return {
+    id: `rowLevelSecurity.${schemaName}.${tableName}.disable`,
+    label: `Disable row-level security on "${tableName}"`,
+    operationClass: 'destructive',
+    target: targetDetails('rowLevelSecurity', tableName, schemaName),
+    precheck: [
+      step(`check RLS is currently enabled on "${tableName}"`, enabled.sql, enabled.params),
+    ],
+    execute: [step(`disable row-level security on "${tableName}"`, execute.sql, execute.params)],
+    postcheck: [
+      step(
+        `verify row-level security is disabled on "${tableName}"`,
+        disabled.sql,
+        disabled.params,
+      ),
+    ],
+  };
+}
+
+export async function renameRlsPolicy(
+  schemaName: string,
+  tableName: string,
+  oldPolicyName: string,
+  newPolicyName: string,
+  lowerer: ExecuteRequestLowerer,
+): Promise<Op> {
+  const ddlNode = alterPolicyRename({
+    schema: schemaName,
+    table: tableName,
+    name: oldPolicyName,
+    newName: newPolicyName,
+  });
+  const oldChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: oldPolicyName,
+  });
+  const newChecks = rlsPolicyExistsAst({
+    schema: schemaName,
+    table: tableName,
+    policyName: newPolicyName,
+  });
+  const oldPresent = await lowerer.lowerToExecuteRequest(oldChecks.policyPresent());
+  const execute = await lowerer.lowerToExecuteRequest(ddlNode);
+  const newPresent = await lowerer.lowerToExecuteRequest(newChecks.policyPresent());
+  return {
+    id: `rlsPolicy.${schemaName}.${tableName}.${oldPolicyName}.rename`,
+    label: `Rename RLS policy "${oldPolicyName}" to "${newPolicyName}" on "${tableName}"`,
+    operationClass: 'widening',
+    target: targetDetails('rlsPolicy', newPolicyName, schemaName, tableName),
+    precheck: [
+      step(`ensure RLS policy "${oldPolicyName}" exists`, oldPresent.sql, oldPresent.params),
+    ],
+    execute: [
+      step(
+        `rename RLS policy "${oldPolicyName}" to "${newPolicyName}"`,
+        execute.sql,
+        execute.params,
+      ),
+    ],
+    postcheck: [
+      step(`verify RLS policy "${newPolicyName}" exists`, newPresent.sql, newPresent.params),
+    ],
+  };
+}

package/src/core/migrations/operations/shared.ts

@@ -1,30 +1,10 @@
 import type { SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ReferentialAction } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
-import { quoteIdentifier } from '../../sql-utils';
 import type { OperationClass, PostgresPlanTargetDetails } from '../planner-target-details';
 
 export type Op = SqlMigrationPlanOperation<PostgresPlanTargetDetails>;
 
-/**
- * Literal-args shape for a column definition consumed by `addColumn` and
- * similar operations. Fully materialized: codec expansion and default
- * rendering have already happened in the wrapper.
- *
- * - `typeSql` is the column's DDL type string (e.g. `"integer"`, `"SERIAL"`,
- *   `"varchar(100)"`), already produced by `buildColumnTypeSql` in the
- *   call-factory wrapper.
- * - `defaultSql` is the full `DEFAULT …` clause (e.g. `"DEFAULT 42"`) or an
- *   empty string when the column has no default, matching
- *   `buildColumnDefaultSql`'s output.
- */
-export interface ColumnSpec {
-  readonly name: string;
-  readonly typeSql: string;
-  readonly defaultSql: string;
-  readonly nullable: boolean;
-}
-
 /**
  * Literal-args shape for a foreign key definition. `references.schema`
  * carries the target table's namespace (schema) coordinate so the rendered
@@ -57,13 +37,3 @@ export function targetDetails(
     details: { schema, objectType, name, ...ifDefined('table', table) },
   };
 }
-
-export function renderColumnDefinition(column: ColumnSpec): string {
-  const parts = [
-    quoteIdentifier(column.name),
-    column.typeSql,
-    column.defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
-}

package/src/core/migrations/planner-ddl-builders.ts

@@ -1,43 +1,10 @@
 import type { CodecControlHooks } from '@prisma-next/family-sql/control';
-import type {
-  StorageColumn,
-  StorageTable,
-  StorageTypeInstance,
-} from '@prisma-next/sql-contract/types';
+import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
 import { ifDefined } from '@prisma-next/utils/defined';
-import { escapeLiteral, quoteIdentifier } from '../sql-utils';
+import { escapeLiteral, quoteIdentifier, quoteQualifiedName } from '../sql-utils';
 import type { PostgresColumnDefault } from '../types';
 import { resolveColumnTypeMetadata } from './planner-type-resolution';
 
-export function buildCreateTableSql(
-  qualifiedTableName: string,
-  table: StorageTable,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const columnDefinitions = Object.entries(table.columns).map(
-    ([columnName, column]: [string, StorageColumn]) => {
-      const parts = [
-        quoteIdentifier(columnName),
-        buildColumnTypeSql(column, codecHooks, storageTypes),
-        buildColumnDefaultSql(column.default, column),
-        column.nullable ? '' : 'NOT NULL',
-      ].filter(Boolean);
-      return parts.join(' ');
-    },
-  );
-
-  const constraintDefinitions: string[] = [];
-  if (table.primaryKey) {
-    constraintDefinitions.push(
-      `PRIMARY KEY (${table.primaryKey.columns.map(quoteIdentifier).join(', ')})`,
-    );
-  }
-
-  const allDefinitions = [...columnDefinitions, ...constraintDefinitions];
-  return `CREATE TABLE ${qualifiedTableName} (\n  ${allDefinitions.join(',\n  ')}\n)`;
-}
-
 /**
  * Pattern for safe PostgreSQL type names.
  * Allows letters, digits, underscores, spaces (for "double precision", "character varying"),
@@ -98,17 +65,28 @@ export function buildColumnTypeSql(
     }
   }
 
+  // A column whose codec supplied a `typeParams.typeName` references a named
+  // database type (e.g. a native enum), not a parameterized builtin: render it
+  // as its quoted, schema-qualified type-name identifier. DDL-render only — the
+  // verify comparison value (`resolvedNativeType`) stays the bare name the
+  // family expander produces, matching introspection.
+  if (typeof resolved.typeParams?.['typeName'] === 'string') {
+    const quoted = quoteQualifiedName(resolved.nativeType);
+    return column.many ? `${quoted}[]` : quoted;
+  }
+
   const expanded = expandParameterizedTypeSql(resolved, codecHooks);
   if (expanded !== null) {
-    return expanded;
+    return column.many ? `${expanded}[]` : expanded;
   }
 
   if (column.typeRef) {
-    return quoteIdentifier(resolved.nativeType);
+    const base = quoteQualifiedName(resolved.nativeType);
+    return column.many ? `${base}[]` : base;
   }
 
   assertSafeNativeType(resolved.nativeType);
-  return resolved.nativeType;
+  return column.many ? `${resolved.nativeType}[]` : resolved.nativeType;
 }
 
 function expandParameterizedTypeSql(
@@ -150,7 +128,7 @@ function expandParameterizedTypeSql(
 /** Autoincrement columns use SERIAL types, so this returns empty for them. */
 export function buildColumnDefaultSql(
   columnDefault: PostgresColumnDefault | undefined,
-  column?: StorageColumn,
+  column?: Pick<StorageColumn, 'many' | 'nativeType'>,
 ): string {
   if (!columnDefault) {
     return '';
@@ -171,9 +149,16 @@ export function buildColumnDefaultSql(
   }
 }
 
-export function renderDefaultLiteral(value: unknown, column?: StorageColumn): string {
+export function renderDefaultLiteral(
+  value: unknown,
+  column?: Pick<StorageColumn, 'many' | 'nativeType'>,
+): string {
   const isJsonColumn = column?.nativeType === 'json' || column?.nativeType === 'jsonb';
 
+  if (column?.many && Array.isArray(value)) {
+    return renderArrayLiteralDefault(value);
+  }
+
   if (value instanceof Date) {
     return `'${escapeLiteral(value.toISOString())}'`;
   }
@@ -193,23 +178,10 @@ export function renderDefaultLiteral(value: unknown, column?: StorageColumn): st
   return `'${escapeLiteral(json)}'`;
 }
 
-export function buildAddColumnSql(
-  qualifiedTableName: string,
-  columnName: string,
-  column: StorageColumn,
-  codecHooks: ReadonlyMap<string, CodecControlHooks>,
-  temporaryDefault?: string | null,
-  storageTypes: Record<string, StorageTypeInstance> = {},
-): string {
-  const typeSql = buildColumnTypeSql(column, codecHooks, storageTypes);
-  const defaultSql =
-    buildColumnDefaultSql(column.default, column) ||
-    (temporaryDefault ? `DEFAULT ${temporaryDefault}` : '');
-  const parts = [
-    `ALTER TABLE ${qualifiedTableName}`,
-    `ADD COLUMN ${quoteIdentifier(columnName)} ${typeSql}`,
-    defaultSql,
-    column.nullable ? '' : 'NOT NULL',
-  ].filter(Boolean);
-  return parts.join(' ');
+function renderArrayLiteralDefault(elements: unknown[]): string {
+  if (elements.length === 0) {
+    return "'{}'";
+  }
+  const rendered = elements.map((el) => renderDefaultLiteral(el)).join(', ');
+  return `ARRAY[${rendered}]`;
 }

package/src/core/migrations/planner-identity-values.ts

@@ -9,7 +9,7 @@ import { ifDefined } from '@prisma-next/utils/defined';
  */
 export function resolveIdentityValue(
   column: StorageColumn,
-  codecHooks: Map<string, CodecControlHooks>,
+  codecHooks: ReadonlyMap<string, CodecControlHooks>,
   storageTypes: Record<string, StorageTypeInstance> = {},
 ): string | null {
   const referencedType = column.typeRef ? storageTypes[column.typeRef] : undefined;

package/src/core/migrations/planner-recipes.ts

@@ -1,15 +1,18 @@
 import type { CodecControlHooks, SqlMigrationPlanOperation } from '@prisma-next/family-sql/control';
 import type { ExecuteRequestLowerer } from '@prisma-next/family-sql/control-adapter';
 import type { StorageColumn, StorageTypeInstance } from '@prisma-next/sql-contract/types';
+import { FunctionColumnDefault } from '@prisma-next/sql-relational-core/ast';
+import { col } from '@prisma-next/sql-relational-core/contract-free';
+import { ifDefined } from '@prisma-next/utils/defined';
 import {
   columnDefaultAst,
   columnExistsAst,
   columnNullabilityAst,
 } from '../../contract-free/checks';
-import { quoteIdentifier } from '../sql-utils';
+import * as contractFreeDdl from '../../contract-free/ddl';
+import { boundSchema } from './bound-schema';
 import { step } from './operations/shared';
-import { buildAddColumnSql } from './planner-ddl-builders';
-import { qualifyTableName } from './planner-sql-checks';
+import { buildColumnTypeSql } from './planner-ddl-builders';
 import { buildTargetDetails, type PostgresPlanTargetDetails } from './planner-target-details';
 
 export function buildAddColumnOperationIdentity(
@@ -51,7 +54,29 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     temporaryDefault,
     lowerer,
   } = options;
-  const qualified = qualifyTableName(schema, tableName);
+
+  // The recipe handles NOT NULL columns that carry no contract default, so the
+  // temporary backfill value is the only default. It is a pre-rendered SQL
+  // fragment (e.g. `''`, `0`, `'{}'::jsonb`), carried verbatim as a
+  // `FunctionColumnDefault` so the adapter emits it as a `DEFAULT (...)` clause.
+  const ddlColumn = col(columnName, buildColumnTypeSql(column, codecHooks, storageTypes), {
+    notNull: true,
+    default: new FunctionColumnDefault(temporaryDefault),
+  });
+  const addColumn = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.addColumnAction(ddlColumn)],
+    }),
+  );
+  const dropTempDefault = await lowerer.lowerToExecuteRequest(
+    contractFreeDdl.alterTable({
+      ...ifDefined('schema', boundSchema(schema)),
+      table: tableName,
+      actions: [contractFreeDdl.dropDefaultAction(columnName)],
+    }),
+  );
 
   const absent = await lowerer.lowerToExecuteRequest(
     columnExistsAst({ schema, table: tableName, column: columnName }).columnAbsent(),
@@ -73,18 +98,11 @@ export async function buildAddNotNullColumnWithTemporaryDefaultOperation(options
     execute: [
       {
         description: `add column "${columnName}"`,
-        sql: buildAddColumnSql(
-          qualified,
-          columnName,
-          column,
-          codecHooks,
-          temporaryDefault,
-          storageTypes,
-        ),
+        sql: addColumn.sql,
       },
       {
         description: `drop temporary default from column "${columnName}"`,
-        sql: `ALTER TABLE ${qualified} ALTER COLUMN ${quoteIdentifier(columnName)} DROP DEFAULT`,
+        sql: dropTempDefault.sql,
       },
     ],
     postcheck: [

package/src/core/migrations/planner-sql-checks.ts

@@ -145,7 +145,7 @@ function formatUserDefinedTypeName(identifier: string): string {
 
 export function buildExpectedFormatType(
   column: StorageColumn,
-  codecHooks: Map<string, CodecControlHooks>,
+  codecHooks: ReadonlyMap<string, CodecControlHooks>,
   storageTypes: Record<string, StorageTypeInstance> = {},
 ): string {
   const resolved = resolveColumnTypeMetadata(column, storageTypes);