@supabase/pg-delta 0.0.0 → 1.0.0-alpha.0

package/dist/core/objects/role/role.model.js

@@ -0,0 +1,312 @@
+import z from "zod";
+import { BasePgModel } from "../base.model.js";
+const membershipInfoSchema = z.object({
+    member: z.string(),
+    grantor: z.string(),
+    admin_option: z.boolean(),
+    inherit_option: z.boolean().nullish(),
+    set_option: z.boolean().nullish(),
+});
+const defaultPrivilegeSchema = z.object({
+    in_schema: z.string().nullable(),
+    objtype: z.enum(["r", "S", "f", "T", "n"]),
+    grantee: z.string(),
+    privileges: z.array(z.object({ privilege: z.string(), grantable: z.boolean() })),
+});
+const rolePropsSchema = z.object({
+    name: z.string(),
+    is_superuser: z.boolean(),
+    can_inherit: z.boolean(),
+    can_create_roles: z.boolean(),
+    can_create_databases: z.boolean(),
+    can_login: z.boolean(),
+    can_replicate: z.boolean(),
+    connection_limit: z.number().nullable(),
+    can_bypass_rls: z.boolean(),
+    config: z.array(z.string()).nullable(),
+    comment: z.string().nullable(),
+    members: z.array(membershipInfoSchema),
+    default_privileges: z.array(defaultPrivilegeSchema),
+});
+export class Role extends BasePgModel {
+    name;
+    is_superuser;
+    can_inherit;
+    can_create_roles;
+    can_create_databases;
+    can_login;
+    can_replicate;
+    connection_limit;
+    can_bypass_rls;
+    config;
+    comment;
+    members;
+    default_privileges;
+    constructor(props) {
+        super();
+        // Identity fields
+        this.name = props.name;
+        // Data fields
+        this.is_superuser = props.is_superuser;
+        this.can_inherit = props.can_inherit;
+        this.can_create_roles = props.can_create_roles;
+        this.can_create_databases = props.can_create_databases;
+        this.can_login = props.can_login;
+        this.can_replicate = props.can_replicate;
+        this.connection_limit = props.connection_limit;
+        this.can_bypass_rls = props.can_bypass_rls;
+        this.config = props.config;
+        this.comment = props.comment;
+        this.members = props.members;
+        this.default_privileges = props.default_privileges;
+    }
+    get stableId() {
+        return `role:${this.name}`;
+    }
+    get identityFields() {
+        return {
+            name: this.name,
+        };
+    }
+    get dataFields() {
+        const sortedMembers = [...this.members].sort((a, b) => {
+            return (a.member.localeCompare(b.member) ||
+                a.grantor.localeCompare(b.grantor) ||
+                Number(a.admin_option) - Number(b.admin_option) ||
+                Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
+                Number(a.set_option ?? false) - Number(b.set_option ?? false));
+        });
+        const sortedDefaultPrivs = [...this.default_privileges].map((dp) => ({
+            ...dp,
+            privileges: [...dp.privileges].sort((a, b) => {
+                return (a.privilege.localeCompare(b.privilege) ||
+                    Number(a.grantable) - Number(b.grantable));
+            }),
+        }));
+        sortedDefaultPrivs.sort((a, b) => {
+            return ((a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
+                a.objtype.localeCompare(b.objtype) ||
+                a.grantee.localeCompare(b.grantee));
+        });
+        return {
+            is_superuser: this.is_superuser,
+            can_inherit: this.can_inherit,
+            can_create_roles: this.can_create_roles,
+            can_create_databases: this.can_create_databases,
+            can_login: this.can_login,
+            can_replicate: this.can_replicate,
+            connection_limit: this.connection_limit,
+            can_bypass_rls: this.can_bypass_rls,
+            config: this.config,
+            comment: this.comment,
+            members: sortedMembers,
+            default_privileges: sortedDefaultPrivs,
+        };
+    }
+}
+export async function extractRoles(sql) {
+    return sql.begin(async (sql) => {
+        await sql `set search_path = ''`;
+        // Check PostgreSQL version capabilities for membership options
+        const [capabilities] = await sql `
+      select
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'inherit_option'
+        ) as has_inherit,
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'set_option'
+        ) as has_set
+    `;
+        const roleRows = capabilities?.has_inherit && capabilities?.has_set
+            ? await sql `
+          WITH role_memberships AS (
+            SELECT 
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',   m.rolname,
+                  'grantor',  g.rolname,
+                  'admin_option',   am.admin_option,
+                  'inherit_option', am.inherit_option,   -- PG16+
+                  'set_option',     am.set_option        -- PG16+
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper      AS is_superuser,
+            r.rolinherit    AS can_inherit,
+            r.rolcreaterole AS can_create_roles,
+            r.rolcreatedb   AS can_create_databases,
+            r.rolcanlogin   AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit  AS connection_limit,
+            r.rolbypassrls  AS can_bypass_rls,
+            r.rolconfig     AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            -- 1) drop built-in/internal roles (anything starting with pg_)
+            r.rolname !~ '^pg_'
+            -- 2) drop roles directly tracked as extension members in pg_shdepend (if any)
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1;
+      `
+            : await sql `
+          WITH role_memberships AS (
+            SELECT 
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',         m.rolname,
+                  'grantor',        g.rolname,
+                  'admin_option',   am.admin_option,
+                  -- PG15: these columns don't exist; emit them as nulls
+                  'inherit_option', NULL,
+                  'set_option',     NULL
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid       -- roles that are members of this role
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper       AS is_superuser,
+            r.rolinherit     AS can_inherit,
+            r.rolcreaterole  AS can_create_roles,
+            r.rolcreatedb    AS can_create_databases,
+            r.rolcanlogin    AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit   AS connection_limit,
+            r.rolbypassrls   AS can_bypass_rls,
+            r.rolconfig      AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            -- drop built-in/internal roles
+            r.rolname !~ '^pg_'
+            -- drop roles directly tracked as extension members in pg_shdepend (if any)
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1;
+      `;
+        // Validate and parse each row using the Zod schema
+        const validatedRows = roleRows.map((row) => rolePropsSchema.parse(row));
+        return validatedRows.map((row) => new Role(row));
+    });
+}

package/dist/core/objects/rule/changes/rule.alter.d.ts

@@ -0,0 +1,22 @@
+import type { Rule, RuleEnabledState } from "../rule.model.ts";
+import { AlterRuleChange } from "./rule.base.ts";
+export declare class ReplaceRule extends AlterRuleChange {
+    readonly rule: Rule;
+    readonly scope: "object";
+    constructor(props: {
+        rule: Rule;
+    });
+    get requires(): string[];
+    serialize(): string;
+}
+export declare class SetRuleEnabledState extends AlterRuleChange {
+    readonly rule: Rule;
+    readonly scope: "object";
+    readonly enabled: RuleEnabledState;
+    constructor(props: {
+        rule: Rule;
+        enabled?: RuleEnabledState;
+    });
+    get requires(): string[];
+    serialize(): string;
+}

package/dist/core/objects/rule/changes/rule.alter.js

@@ -0,0 +1,58 @@
+import { stableId } from "../../utils.js";
+import { AlterRuleChange } from "./rule.base.js";
+import { CreateRule } from "./rule.create.js";
+export class ReplaceRule extends AlterRuleChange {
+    rule;
+    scope = "object";
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+    }
+    get requires() {
+        return [
+            this.rule.stableId,
+            this.rule.relationStableId,
+            ...this.rule.columns.map((column) => stableId.column(this.rule.schema, this.rule.table_name, column)),
+        ];
+    }
+    serialize() {
+        return new CreateRule({ rule: this.rule, orReplace: true }).serialize();
+    }
+}
+export class SetRuleEnabledState extends AlterRuleChange {
+    rule;
+    scope = "object";
+    enabled;
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+        this.enabled = props.enabled ?? props.rule.enabled;
+    }
+    get requires() {
+        return [
+            this.rule.stableId,
+            this.rule.relationStableId,
+            ...this.rule.columns.map((column) => stableId.column(this.rule.schema, this.rule.table_name, column)),
+        ];
+    }
+    serialize() {
+        const clause = clauseForState(this.enabled);
+        return `ALTER TABLE ${this.rule.schema}.${this.rule.table_name} ${clause} ${this.rule.name}`;
+    }
+}
+function clauseForState(state) {
+    switch (state) {
+        case "O":
+            return "ENABLE RULE";
+        case "D":
+            return "DISABLE RULE";
+        case "R":
+            return "ENABLE REPLICA RULE";
+        case "A":
+            return "ENABLE ALWAYS RULE";
+        default: {
+            const _exhaustive = state;
+            return _exhaustive;
+        }
+    }
+}

package/dist/core/objects/rule/changes/rule.base.d.ts

@@ -0,0 +1,17 @@
+import { BaseChange } from "../../base.change.ts";
+import type { Rule } from "../rule.model.ts";
+declare abstract class BaseRuleChange extends BaseChange {
+    abstract readonly rule: Rule;
+    abstract readonly scope: "object" | "comment";
+    readonly objectType: "rule";
+}
+export declare abstract class CreateRuleChange extends BaseRuleChange {
+    readonly operation: "create";
+}
+export declare abstract class AlterRuleChange extends BaseRuleChange {
+    readonly operation: "alter";
+}
+export declare abstract class DropRuleChange extends BaseRuleChange {
+    readonly operation: "drop";
+}
+export {};

package/dist/core/objects/rule/changes/rule.base.js

@@ -0,0 +1,13 @@
+import { BaseChange } from "../../base.change.js";
+class BaseRuleChange extends BaseChange {
+    objectType = "rule";
+}
+export class CreateRuleChange extends BaseRuleChange {
+    operation = "create";
+}
+export class AlterRuleChange extends BaseRuleChange {
+    operation = "alter";
+}
+export class DropRuleChange extends BaseRuleChange {
+    operation = "drop";
+}

package/dist/core/objects/rule/changes/rule.comment.d.ts

@@ -0,0 +1,22 @@
+import type { Rule } from "../rule.model.ts";
+import { CreateRuleChange, DropRuleChange } from "./rule.base.ts";
+export declare class CreateCommentOnRule extends CreateRuleChange {
+    readonly rule: Rule;
+    readonly scope: "comment";
+    constructor(props: {
+        rule: Rule;
+    });
+    get creates(): `comment:${string}`[];
+    get requires(): `rule:${string}`[];
+    serialize(): string;
+}
+export declare class DropCommentOnRule extends DropRuleChange {
+    readonly rule: Rule;
+    readonly scope: "comment";
+    constructor(props: {
+        rule: Rule;
+    });
+    get drops(): `comment:${string}`[];
+    get requires(): (`comment:${string}` | `rule:${string}`)[];
+    serialize(): string;
+}

package/dist/core/objects/rule/changes/rule.comment.js

@@ -0,0 +1,51 @@
+import { quoteLiteral } from "../../base.change.js";
+import { stableId } from "../../utils.js";
+import { CreateRuleChange, DropRuleChange } from "./rule.base.js";
+export class CreateCommentOnRule extends CreateRuleChange {
+    rule;
+    scope = "comment";
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+    }
+    get creates() {
+        return [stableId.comment(this.rule.stableId)];
+    }
+    get requires() {
+        return [this.rule.stableId];
+    }
+    serialize() {
+        return [
+            "COMMENT ON RULE",
+            this.rule.name,
+            "ON",
+            `${this.rule.schema}.${this.rule.table_name}`,
+            "IS",
+            // biome-ignore lint/style/noNonNullAssertion: rule comment is not nullable in this case
+            quoteLiteral(this.rule.comment),
+        ].join(" ");
+    }
+}
+export class DropCommentOnRule extends DropRuleChange {
+    rule;
+    scope = "comment";
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+    }
+    get drops() {
+        return [stableId.comment(this.rule.stableId)];
+    }
+    get requires() {
+        return [stableId.comment(this.rule.stableId), this.rule.stableId];
+    }
+    serialize() {
+        return [
+            "COMMENT ON RULE",
+            this.rule.name,
+            "ON",
+            `${this.rule.schema}.${this.rule.table_name}`,
+            "IS NULL",
+        ].join(" ");
+    }
+}

package/dist/core/objects/rule/changes/rule.create.d.ts

@@ -0,0 +1,14 @@
+import type { Rule } from "../rule.model.ts";
+import { CreateRuleChange } from "./rule.base.ts";
+export declare class CreateRule extends CreateRuleChange {
+    readonly rule: Rule;
+    readonly scope: "object";
+    readonly orReplace?: boolean;
+    constructor(props: {
+        rule: Rule;
+        orReplace?: boolean;
+    });
+    get creates(): `rule:${string}`[];
+    get requires(): string[];
+    serialize(): string;
+}

package/dist/core/objects/rule/changes/rule.create.js

@@ -0,0 +1,28 @@
+import { stableId } from "../../utils.js";
+import { CreateRuleChange } from "./rule.base.js";
+export class CreateRule extends CreateRuleChange {
+    rule;
+    scope = "object";
+    orReplace;
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+        this.orReplace = props.orReplace;
+    }
+    get creates() {
+        return [this.rule.stableId];
+    }
+    get requires() {
+        return [
+            this.rule.relationStableId,
+            ...this.rule.columns.map((column) => stableId.column(this.rule.schema, this.rule.table_name, column)),
+        ];
+    }
+    serialize() {
+        let definition = this.rule.definition.trim();
+        definition = definition.replace(/^CREATE\s+(?:OR\s+REPLACE\s+)?/i, `CREATE ${this.orReplace ? "OR REPLACE " : ""}`);
+        // Remove trailing semicolons (pg_get_ruledef includes them, but we add our own)
+        definition = definition.replace(/;+\s*$/, "");
+        return definition;
+    }
+}

package/dist/core/objects/rule/changes/rule.drop.d.ts

@@ -0,0 +1,12 @@
+import type { Rule } from "../rule.model.ts";
+import { DropRuleChange } from "./rule.base.ts";
+export declare class DropRule extends DropRuleChange {
+    readonly rule: Rule;
+    readonly scope: "object";
+    constructor(props: {
+        rule: Rule;
+    });
+    get drops(): `rule:${string}`[];
+    get requires(): string[];
+    serialize(): string;
+}

package/dist/core/objects/rule/changes/rule.drop.js

@@ -0,0 +1,23 @@
+import { DropRuleChange } from "./rule.base.js";
+export class DropRule extends DropRuleChange {
+    rule;
+    scope = "object";
+    constructor(props) {
+        super();
+        this.rule = props.rule;
+    }
+    get drops() {
+        return [this.rule.stableId];
+    }
+    get requires() {
+        return [this.rule.stableId, this.rule.relationStableId];
+    }
+    serialize() {
+        return [
+            "DROP RULE",
+            this.rule.name,
+            "ON",
+            `${this.rule.schema}.${this.rule.table_name}`,
+        ].join(" ");
+    }
+}

package/dist/core/objects/rule/changes/rule.types.d.ts

@@ -0,0 +1,5 @@
+import type { ReplaceRule, SetRuleEnabledState } from "./rule.alter.ts";
+import type { CreateCommentOnRule, DropCommentOnRule } from "./rule.comment.ts";
+import type { CreateRule } from "./rule.create.ts";
+import type { DropRule } from "./rule.drop.ts";
+export type RuleChange = CreateRule | DropRule | ReplaceRule | SetRuleEnabledState | CreateCommentOnRule | DropCommentOnRule;

package/dist/core/objects/rule/changes/rule.types.js

@@ -0,0 +1 @@
+export {};

package/dist/core/objects/rule/rule.diff.d.ts

@@ -0,0 +1,3 @@
+import type { RuleChange } from "./changes/rule.types.ts";
+import type { Rule } from "./rule.model.ts";
+export declare function diffRules(main: Record<string, Rule>, branch: Record<string, Rule>): RuleChange[];

package/dist/core/objects/rule/rule.diff.js

@@ -0,0 +1,53 @@
+import { diffObjects } from "../base.diff.js";
+import { deepEqual, hasNonAlterableChanges } from "../utils.js";
+import { ReplaceRule, SetRuleEnabledState } from "./changes/rule.alter.js";
+import { CreateCommentOnRule, DropCommentOnRule, } from "./changes/rule.comment.js";
+import { CreateRule } from "./changes/rule.create.js";
+import { DropRule } from "./changes/rule.drop.js";
+export function diffRules(main, branch) {
+    const { created, dropped, altered } = diffObjects(main, branch);
+    const changes = [];
+    for (const id of created) {
+        const rule = branch[id];
+        changes.push(new CreateRule({ rule }));
+        if (rule.comment !== null) {
+            changes.push(new CreateCommentOnRule({ rule }));
+        }
+        if (rule.enabled !== "O") {
+            changes.push(new SetRuleEnabledState({ rule }));
+        }
+    }
+    for (const id of dropped) {
+        changes.push(new DropRule({ rule: main[id] }));
+    }
+    for (const id of altered) {
+        const mainRule = main[id];
+        const branchRule = branch[id];
+        const NON_ALTERABLE_FIELDS = [
+            "definition",
+            "event",
+            "is_instead",
+        ];
+        const shouldReplace = hasNonAlterableChanges(mainRule, branchRule, NON_ALTERABLE_FIELDS, { columns: deepEqual });
+        const replaced = shouldReplace;
+        if (shouldReplace) {
+            changes.push(new ReplaceRule({ rule: branchRule }));
+        }
+        if (mainRule.comment !== branchRule.comment) {
+            if (branchRule.comment === null) {
+                changes.push(new DropCommentOnRule({ rule: mainRule }));
+            }
+            else {
+                changes.push(new CreateCommentOnRule({ rule: branchRule }));
+            }
+        }
+        else if (replaced && branchRule.comment !== null) {
+            changes.push(new CreateCommentOnRule({ rule: branchRule }));
+        }
+        if (mainRule.enabled !== branchRule.enabled ||
+            (replaced && branchRule.enabled !== "O")) {
+            changes.push(new SetRuleEnabledState({ rule: branchRule }));
+        }
+    }
+    return changes;
+}