@supabase/pg-delta 1.0.0-alpha.0 → 1.0.0-alpha.10

package/src/core/objects/aggregate/changes/aggregate.privilege.test.ts

@@ -0,0 +1,136 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { stableId } from "../../utils.ts";
+import { Aggregate } from "../aggregate.model.ts";
+import {
+  GrantAggregatePrivileges,
+  RevokeAggregatePrivileges,
+  RevokeGrantOptionAggregatePrivileges,
+} from "./aggregate.privilege.ts";
+
+type AggregateProps = ConstructorParameters<typeof Aggregate>[0];
+
+const base: AggregateProps = {
+  schema: "public",
+  name: "agg_sum",
+  identity_arguments: "integer",
+  kind: "a",
+  aggkind: "n",
+  num_direct_args: 0,
+  return_type: "integer",
+  return_type_schema: "pg_catalog",
+  parallel_safety: "u",
+  is_strict: false,
+  transition_function: "pg_catalog.int4pl(integer,integer)",
+  state_data_type: "integer",
+  state_data_type_schema: "pg_catalog",
+  state_data_space: 0,
+  final_function: null,
+  final_function_extra_args: false,
+  final_function_modify: null,
+  combine_function: null,
+  serial_function: null,
+  deserial_function: null,
+  initial_condition: null,
+  moving_transition_function: null,
+  moving_inverse_function: null,
+  moving_state_data_type: null,
+  moving_state_data_type_schema: null,
+  moving_state_data_space: null,
+  moving_final_function: null,
+  moving_final_function_extra_args: false,
+  moving_final_function_modify: null,
+  moving_initial_condition: null,
+  sort_operator: null,
+  argument_count: 1,
+  argument_default_count: 0,
+  argument_names: null,
+  argument_types: ["integer"],
+  all_argument_types: null,
+  argument_modes: null,
+  argument_defaults: null,
+  owner: "owner1",
+  comment: null,
+  privileges: [],
+};
+
+describe("aggregate.privilege", () => {
+  test("grant privileges without grant option", async () => {
+    const aggregate = new Aggregate(base);
+    const change = new GrantAggregatePrivileges({
+      aggregate,
+      grantee: "role_exec",
+      privileges: [{ privilege: "EXECUTE", grantable: false }],
+      version: 170000,
+    });
+
+    expect(change.creates).toEqual([
+      stableId.acl(aggregate.stableId, "role_exec"),
+    ]);
+    expect(change.requires).toEqual([
+      aggregate.stableId,
+      stableId.role("role_exec"),
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "GRANT ALL ON FUNCTION public.agg_sum(integer) TO role_exec",
+    );
+  });
+
+  test("grant privileges with grant option", async () => {
+    const aggregate = new Aggregate(base);
+    const change = new GrantAggregatePrivileges({
+      aggregate,
+      grantee: "role_exec",
+      privileges: [{ privilege: "EXECUTE", grantable: true }],
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "GRANT ALL ON FUNCTION public.agg_sum(integer) TO role_exec WITH GRANT OPTION",
+    );
+  });
+
+  test("revoke privileges and grant option", async () => {
+    const aggregate = new Aggregate(base);
+    const revoke = new RevokeAggregatePrivileges({
+      aggregate,
+      grantee: "role_old",
+      privileges: [{ privilege: "EXECUTE", grantable: false }],
+      version: 170000,
+    });
+
+    expect(revoke.drops).toEqual([
+      stableId.acl(aggregate.stableId, "role_old"),
+    ]);
+    expect(revoke.requires).toEqual([
+      stableId.acl(aggregate.stableId, "role_old"),
+      aggregate.stableId,
+      stableId.role("role_old"),
+    ]);
+    await assertValidSql(revoke.serialize());
+    expect(revoke.serialize()).toBe(
+      "REVOKE ALL ON FUNCTION public.agg_sum(integer) FROM role_old",
+    );
+
+    const revokeGrantOption = new RevokeGrantOptionAggregatePrivileges({
+      aggregate,
+      grantee: "role_with_option",
+      // testing deduplication of privilege names
+      privilegeNames: ["EXECUTE", "EXECUTE"],
+      version: 170000,
+    });
+
+    expect(revokeGrantOption.privilegeNames).toEqual(["EXECUTE"]);
+    expect(revokeGrantOption.requires).toEqual([
+      stableId.acl(aggregate.stableId, "role_with_option"),
+      aggregate.stableId,
+      stableId.role("role_with_option"),
+    ]);
+    await assertValidSql(revokeGrantOption.serialize());
+    expect(revokeGrantOption.serialize()).toBe(
+      "REVOKE GRANT OPTION FOR ALL ON FUNCTION public.agg_sum(integer) FROM role_with_option",
+    );
+  });
+});

package/src/core/objects/aggregate/changes/aggregate.privilege.ts

@@ -0,0 +1,146 @@
+import {
+  formatObjectPrivilegeList,
+  getObjectKindPrefix,
+} from "../../base.privilege.ts";
+import { stableId } from "../../utils.ts";
+import type { Aggregate } from "../aggregate.model.ts";
+import { AlterAggregateChange } from "./aggregate.base.ts";
+
+export type AggregatePrivilege =
+  | GrantAggregatePrivileges
+  | RevokeAggregatePrivileges
+  | RevokeGrantOptionAggregatePrivileges;
+
+export class GrantAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.aggregate.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.aggregate.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantAggregatePrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("FUNCTION", list, this.version);
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `GRANT ${privSql} ${kindPrefix} ${qualified} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+export class RevokeAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    // Return ACL ID for dependency tracking, even though this is an ALTER operation
+    // Phase assignment now uses operation type, so this won't affect phase placement
+    return [stableId.acl(this.aggregate.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.aggregate.stableId, this.grantee),
+      this.aggregate.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("FUNCTION", list, this.version);
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `REVOKE ${privSql} ${kindPrefix} ${qualified} FROM ${this.grantee}`;
+  }
+}
+
+export class RevokeGrantOptionAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privilegeNames: string[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.aggregate.stableId, this.grantee),
+      this.aggregate.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const privSql = formatObjectPrivilegeList(
+      "FUNCTION",
+      this.privilegeNames,
+      this.version,
+    );
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `REVOKE GRANT OPTION FOR ${privSql} ${kindPrefix} ${qualified} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/aggregate/changes/aggregate.types.ts

@@ -0,0 +1,12 @@
+import type { AlterAggregate } from "./aggregate.alter.ts";
+import type { CommentAggregate } from "./aggregate.comment.ts";
+import type { CreateAggregate } from "./aggregate.create.ts";
+import type { DropAggregate } from "./aggregate.drop.ts";
+import type { AggregatePrivilege } from "./aggregate.privilege.ts";
+
+export type AggregateChange =
+  | AlterAggregate
+  | CommentAggregate
+  | CreateAggregate
+  | DropAggregate
+  | AggregatePrivilege;

package/src/core/objects/base.change.ts

@@ -0,0 +1,62 @@
+type ChangeOperation = "create" | "alter" | "drop";
+
+export abstract class BaseChange {
+  /**
+   * The operation of the change.
+   */
+  abstract readonly operation: ChangeOperation;
+  /**
+   * The type of the object targeted by the change.
+   */
+  abstract readonly objectType: string;
+  /**
+   * The scope of the change.
+   */
+  abstract readonly scope: string;
+
+  /**
+   * A unique identifier for the change.
+   */
+  get changeId(): string {
+    return `${this.operation}:${this.scope}:${this.objectType}:${this.serialize()}`;
+  }
+
+  /**
+   * Stable identifiers this change creates.
+   *
+   * Defaults to an empty array. Override in subclasses that create objects.
+   */
+  get creates(): string[] {
+    return [];
+  }
+
+  /**
+   * Stable identifiers this change drops.
+   *
+   * Defaults to an empty array. Override in subclasses that remove objects.
+   */
+  get drops(): string[] {
+    return [];
+  }
+
+  /**
+   * Stable identifiers this change requires to exist beforehand.
+   *
+   * Defaults to an empty array. Override in subclasses that have prerequisites.
+   */
+  get requires(): string[] {
+    return [];
+  }
+
+  /**
+   * Serialize the change into a single SQL statement.
+   */
+  abstract serialize(options?: Record<string, unknown>): string;
+}
+
+/**
+ * Port of string literal quoting: doubles single quotes inside and wraps with single quotes
+ */
+export function quoteLiteral(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}

package/src/core/objects/base.default-privileges.ts

@@ -0,0 +1,204 @@
+import type { PrivilegeProps } from "./base.privilege-diff.ts";
+import type { Role } from "./role/role.model.ts";
+
+/**
+ * Maps object type names to PostgreSQL default privilege objtype codes.
+ * Used to look up default privileges for different object types.
+ */
+function objectTypeToObjtype(objectType: string): string | null {
+  switch (objectType) {
+    case "table":
+      return "r"; // Relations (tables)
+    case "view":
+      return "r"; // Views are also relations
+    case "materialized_view":
+      return "r"; // Materialized views are also relations
+    case "sequence":
+      return "S"; // Sequences
+    case "procedure":
+    case "function":
+    case "aggregate":
+      return "f"; // Functions/routines
+    case "type":
+    case "domain":
+    case "enum":
+    case "range":
+    case "composite_type":
+      return "T"; // Types
+    case "schema":
+      return "n"; // Schemas
+    default:
+      return null;
+  }
+}
+
+/**
+ * Tracks the effective state of default privileges as changes are processed.
+ * This allows us to compute what default privileges would be in effect at any point
+ * in the migration script, accounting for ALTER DEFAULT PRIVILEGES statements.
+ */
+export class DefaultPrivilegeState {
+  private state: Map<
+    string,
+    Map<string, Map<string | null, Map<string, Set<string>>>>
+  > = new Map(); // role -> objtype -> schema -> grantee -> privileges
+
+  constructor(initialRoles: Record<string, Role>) {
+    // Initialize state from roles' default_privileges
+    for (const [_roleId, role] of Object.entries(initialRoles)) {
+      const roleName = role.name;
+      if (!this.state.has(roleName)) {
+        this.state.set(roleName, new Map());
+      }
+      // biome-ignore lint/style/noNonNullAssertion: roleName is guaranteed to be in the state
+      const roleState = this.state.get(roleName)!;
+
+      for (const defPriv of role.default_privileges) {
+        if (!roleState.has(defPriv.objtype)) {
+          roleState.set(defPriv.objtype, new Map());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: objtype is guaranteed to be in the state
+        const objtypeState = roleState.get(defPriv.objtype)!;
+
+        const schemaKey = defPriv.in_schema ?? null;
+        if (!objtypeState.has(schemaKey)) {
+          objtypeState.set(schemaKey, new Map());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: schemaKey is guaranteed to be in the state
+        const schemaState = objtypeState.get(schemaKey)!;
+
+        if (!schemaState.has(defPriv.grantee)) {
+          schemaState.set(defPriv.grantee, new Set());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: grantee is guaranteed to be in the state
+        const privileges = schemaState.get(defPriv.grantee)!;
+
+        for (const priv of defPriv.privileges) {
+          const key = `${priv.privilege}:${priv.grantable}`;
+          privileges.add(key);
+        }
+      }
+    }
+  }
+
+  /**
+   * Apply a GrantRoleDefaultPrivileges change to the state.
+   */
+  applyGrant(
+    roleName: string,
+    objtype: string,
+    inSchema: string | null,
+    grantee: string,
+    privileges: { privilege: string; grantable: boolean }[],
+  ): void {
+    if (!this.state.has(roleName)) {
+      this.state.set(roleName, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: roleName is guaranteed to be in the state
+    const roleState = this.state.get(roleName)!;
+
+    if (!roleState.has(objtype)) {
+      roleState.set(objtype, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: objtype is guaranteed to be in the state
+    const objtypeState = roleState.get(objtype)!;
+
+    const schemaKey = inSchema ?? null;
+    if (!objtypeState.has(schemaKey)) {
+      objtypeState.set(schemaKey, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: schemaKey is guaranteed to be in the state
+    const schemaState = objtypeState.get(schemaKey)!;
+
+    if (!schemaState.has(grantee)) {
+      schemaState.set(grantee, new Set());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: grantee is guaranteed to be in the state
+    const privilegesSet = schemaState.get(grantee)!;
+
+    for (const priv of privileges) {
+      const key = `${priv.privilege}:${priv.grantable}`;
+      privilegesSet.add(key);
+    }
+  }
+
+  /**
+   * Apply a RevokeRoleDefaultPrivileges change to the state.
+   */
+  applyRevoke(
+    roleName: string,
+    objtype: string,
+    inSchema: string | null,
+    grantee: string,
+    privileges: { privilege: string; grantable: boolean }[],
+  ): void {
+    const roleState = this.state.get(roleName);
+    if (!roleState) return;
+
+    const objtypeState = roleState.get(objtype);
+    if (!objtypeState) return;
+
+    const schemaKey = inSchema ?? null;
+    const schemaState = objtypeState.get(schemaKey);
+    if (!schemaState) return;
+
+    const privilegesSet = schemaState.get(grantee);
+    if (!privilegesSet) return;
+
+    for (const priv of privileges) {
+      const key = `${priv.privilege}:${priv.grantable}`;
+      privilegesSet.delete(key);
+      // Also remove base privilege if grantable was revoked
+      if (priv.grantable) {
+        const baseKey = `${priv.privilege}:false`;
+        privilegesSet.delete(baseKey);
+      }
+    }
+  }
+
+  /**
+   * Get effective default privileges for a given object creation.
+   */
+  getEffectiveDefaults(
+    currentUser: string,
+    objectType: string,
+    objectSchema: string,
+  ): PrivilegeProps[] {
+    const objtype = objectTypeToObjtype(objectType);
+    if (!objtype) return [];
+
+    const roleState = this.state.get(currentUser);
+    if (!roleState) return [];
+
+    const objtypeState = roleState.get(objtype);
+    if (!objtypeState) return [];
+
+    const defaultPrivs: PrivilegeProps[] = [];
+
+    // Check schema-specific first, then global (null schema)
+    const schemasToCheck = [objectSchema, null];
+    for (const schemaKey of schemasToCheck) {
+      const schemaState = objtypeState.get(schemaKey);
+      if (!schemaState) continue;
+
+      for (const [grantee, privilegesSet] of schemaState.entries()) {
+        for (const privKey of privilegesSet) {
+          const [privilege, grantableStr] = privKey.split(":");
+          const grantable = grantableStr === "true";
+          defaultPrivs.push({
+            grantee,
+            privilege,
+            grantable,
+            columns: null,
+          });
+        }
+      }
+      // Schema-specific takes precedence, so break after first match
+      if (schemaKey === objectSchema && schemaState.size > 0) {
+        break;
+      }
+    }
+
+    return defaultPrivs;
+  }
+}

package/src/core/objects/base.diff.ts

@@ -0,0 +1,20 @@
+import type { BasePgModel } from "./base.model.ts";
+
+export function diffObjects<T extends BasePgModel>(
+  main: Record<string, T>,
+  branch: Record<string, T>,
+) {
+  const mainIds = new Set(Object.keys(main));
+  const branchIds = new Set(Object.keys(branch));
+
+  const created = [...branchIds.difference(mainIds)];
+  const dropped = [...mainIds.difference(branchIds)];
+  const altered = [...mainIds.intersection(branchIds)].filter((id) => {
+    const mainModel = main[id];
+    const branchModel = branch[id];
+
+    return !mainModel.equals(branchModel);
+  });
+
+  return { created, dropped, altered };
+}

package/src/core/objects/base.model.ts

@@ -0,0 +1,82 @@
+import z from "zod";
+import { deepEqual } from "./utils.ts";
+
+export const columnPropsSchema = z.object({
+  name: z.string(),
+  position: z.number(),
+  data_type: z.string(),
+  data_type_str: z.string(),
+  is_custom_type: z.boolean(),
+  custom_type_type: z.string().nullable(),
+  custom_type_category: z.string().nullable(),
+  custom_type_schema: z.string().nullable(),
+  custom_type_name: z.string().nullable(),
+  not_null: z.boolean(),
+  is_identity: z.boolean(),
+  is_identity_always: z.boolean(),
+  is_generated: z.boolean(),
+  collation: z.string().nullable(),
+  default: z.string().nullable(),
+  comment: z.string().nullable(),
+});
+
+export type ColumnProps = z.infer<typeof columnPropsSchema>;
+
+export function normalizeColumns(columns: ColumnProps[]) {
+  return columns
+    .map((column) => {
+      const { position: _position, ...rest } = column;
+      return rest;
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Interface for table-like objects that have columns (tables, views, materialized views).
+ * In PostgreSQL, these are relations with relkind in ('r', 'p', 'v', 'm').
+ */
+export interface TableLikeObject {
+  readonly columns: ColumnProps[];
+}
+
+export abstract class BasePgModel {
+  /**
+   * Database-portable stable identifier for dependency resolution.
+   * This identifier remains constant across database dumps/restores and
+   * is used for cross-database dependency resolution.
+   */
+  abstract get stableId(): string;
+
+  /**
+   * Get all identity fields and their values.
+   * Subclasses should override this to return the identity fields.
+   */
+  abstract get identityFields(): Record<string, unknown>;
+
+  /**
+   * Get all data fields and their values.
+   * Subclasses should override this to return the data fields.
+   */
+  abstract get dataFields(): Record<string, unknown>;
+
+  /**
+   * Compare this object with another BasePgModel for equality based on stableId and dataFields.
+   */
+  equals(other: BasePgModel): boolean {
+    return (
+      this.stableId === other.stableId &&
+      deepEqual(this.dataFields, other.dataFields)
+    );
+  }
+
+  /**
+   * Stable representation used for equality/fingerprints.
+   * Subclasses can override to normalize unstable fields.
+   */
+  stableSnapshot() {
+    return {
+      identity: this.identityFields,
+      data: this.dataFields,
+    };
+  }
+}