@supabase/pg-delta 1.0.0-alpha.1 → 1.0.0-alpha.11

package/src/core/objects/aggregate/changes/aggregate.privilege.ts

@@ -0,0 +1,146 @@
+import {
+  formatObjectPrivilegeList,
+  getObjectKindPrefix,
+} from "../../base.privilege.ts";
+import { stableId } from "../../utils.ts";
+import type { Aggregate } from "../aggregate.model.ts";
+import { AlterAggregateChange } from "./aggregate.base.ts";
+
+export type AggregatePrivilege =
+  | GrantAggregatePrivileges
+  | RevokeAggregatePrivileges
+  | RevokeGrantOptionAggregatePrivileges;
+
+export class GrantAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.aggregate.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.aggregate.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantAggregatePrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("FUNCTION", list, this.version);
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `GRANT ${privSql} ${kindPrefix} ${qualified} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+export class RevokeAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    // Return ACL ID for dependency tracking, even though this is an ALTER operation
+    // Phase assignment now uses operation type, so this won't affect phase placement
+    return [stableId.acl(this.aggregate.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.aggregate.stableId, this.grantee),
+      this.aggregate.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("FUNCTION", list, this.version);
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `REVOKE ${privSql} ${kindPrefix} ${qualified} FROM ${this.grantee}`;
+  }
+}
+
+export class RevokeGrantOptionAggregatePrivileges extends AlterAggregateChange {
+  public readonly aggregate: Aggregate;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    aggregate: Aggregate;
+    grantee: string;
+    privilegeNames: string[];
+    version?: number;
+  }) {
+    super();
+    this.aggregate = props.aggregate;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.aggregate.stableId, this.grantee),
+      this.aggregate.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("FUNCTION");
+    const privSql = formatObjectPrivilegeList(
+      "FUNCTION",
+      this.privilegeNames,
+      this.version,
+    );
+    const aggregateName = `${this.aggregate.schema}.${this.aggregate.name}`;
+    const signature = this.aggregate.identityArguments;
+    const qualified = `${aggregateName}(${signature})`;
+    return `REVOKE GRANT OPTION FOR ${privSql} ${kindPrefix} ${qualified} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/aggregate/changes/aggregate.types.ts

@@ -0,0 +1,13 @@
+import type { AlterAggregate } from "./aggregate.alter.ts";
+import type { CommentAggregate } from "./aggregate.comment.ts";
+import type { CreateAggregate } from "./aggregate.create.ts";
+import type { DropAggregate } from "./aggregate.drop.ts";
+import type { AggregatePrivilege } from "./aggregate.privilege.ts";
+
+/** Union of all aggregate-related change variants (`objectType: "aggregate"`). @category Change Types */
+export type AggregateChange =
+  | AlterAggregate
+  | CommentAggregate
+  | CreateAggregate
+  | DropAggregate
+  | AggregatePrivilege;

package/src/core/objects/base.change.ts

@@ -0,0 +1,72 @@
+type ChangeOperation = "create" | "alter" | "drop";
+
+/**
+ * Abstract base class for all change objects.
+ *
+ * Every concrete change (e.g. `CreateTable`, `AlterView`) extends this class and
+ * provides an `operation`, `objectType`, and `scope`. The filter DSL flattens
+ * these properties — along with the model sub-object — into path/value pairs
+ * for pattern matching.
+ *
+ * @category Base
+ */
+export abstract class BaseChange {
+  /**
+   * The operation of the change.
+   */
+  abstract readonly operation: ChangeOperation;
+  /**
+   * The type of the object targeted by the change.
+   */
+  abstract readonly objectType: string;
+  /**
+   * The scope of the change.
+   */
+  abstract readonly scope: string;
+
+  /**
+   * A unique identifier for the change.
+   */
+  get changeId(): string {
+    return `${this.operation}:${this.scope}:${this.objectType}:${this.serialize()}`;
+  }
+
+  /**
+   * Stable identifiers this change creates.
+   *
+   * Defaults to an empty array. Override in subclasses that create objects.
+   */
+  get creates(): string[] {
+    return [];
+  }
+
+  /**
+   * Stable identifiers this change drops.
+   *
+   * Defaults to an empty array. Override in subclasses that remove objects.
+   */
+  get drops(): string[] {
+    return [];
+  }
+
+  /**
+   * Stable identifiers this change requires to exist beforehand.
+   *
+   * Defaults to an empty array. Override in subclasses that have prerequisites.
+   */
+  get requires(): string[] {
+    return [];
+  }
+
+  /**
+   * Serialize the change into a single SQL statement.
+   */
+  abstract serialize(options?: Record<string, unknown>): string;
+}
+
+/**
+ * Port of string literal quoting: doubles single quotes inside and wraps with single quotes
+ */
+export function quoteLiteral(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}

package/src/core/objects/base.default-privileges.ts

@@ -0,0 +1,204 @@
+import type { PrivilegeProps } from "./base.privilege-diff.ts";
+import type { Role } from "./role/role.model.ts";
+
+/**
+ * Maps object type names to PostgreSQL default privilege objtype codes.
+ * Used to look up default privileges for different object types.
+ */
+function objectTypeToObjtype(objectType: string): string | null {
+  switch (objectType) {
+    case "table":
+      return "r"; // Relations (tables)
+    case "view":
+      return "r"; // Views are also relations
+    case "materialized_view":
+      return "r"; // Materialized views are also relations
+    case "sequence":
+      return "S"; // Sequences
+    case "procedure":
+    case "function":
+    case "aggregate":
+      return "f"; // Functions/routines
+    case "type":
+    case "domain":
+    case "enum":
+    case "range":
+    case "composite_type":
+      return "T"; // Types
+    case "schema":
+      return "n"; // Schemas
+    default:
+      return null;
+  }
+}
+
+/**
+ * Tracks the effective state of default privileges as changes are processed.
+ * This allows us to compute what default privileges would be in effect at any point
+ * in the migration script, accounting for ALTER DEFAULT PRIVILEGES statements.
+ */
+export class DefaultPrivilegeState {
+  private state: Map<
+    string,
+    Map<string, Map<string | null, Map<string, Set<string>>>>
+  > = new Map(); // role -> objtype -> schema -> grantee -> privileges
+
+  constructor(initialRoles: Record<string, Role>) {
+    // Initialize state from roles' default_privileges
+    for (const [_roleId, role] of Object.entries(initialRoles)) {
+      const roleName = role.name;
+      if (!this.state.has(roleName)) {
+        this.state.set(roleName, new Map());
+      }
+      // biome-ignore lint/style/noNonNullAssertion: roleName is guaranteed to be in the state
+      const roleState = this.state.get(roleName)!;
+
+      for (const defPriv of role.default_privileges) {
+        if (!roleState.has(defPriv.objtype)) {
+          roleState.set(defPriv.objtype, new Map());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: objtype is guaranteed to be in the state
+        const objtypeState = roleState.get(defPriv.objtype)!;
+
+        const schemaKey = defPriv.in_schema ?? null;
+        if (!objtypeState.has(schemaKey)) {
+          objtypeState.set(schemaKey, new Map());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: schemaKey is guaranteed to be in the state
+        const schemaState = objtypeState.get(schemaKey)!;
+
+        if (!schemaState.has(defPriv.grantee)) {
+          schemaState.set(defPriv.grantee, new Set());
+        }
+        // biome-ignore lint/style/noNonNullAssertion: grantee is guaranteed to be in the state
+        const privileges = schemaState.get(defPriv.grantee)!;
+
+        for (const priv of defPriv.privileges) {
+          const key = `${priv.privilege}:${priv.grantable}`;
+          privileges.add(key);
+        }
+      }
+    }
+  }
+
+  /**
+   * Apply a GrantRoleDefaultPrivileges change to the state.
+   */
+  applyGrant(
+    roleName: string,
+    objtype: string,
+    inSchema: string | null,
+    grantee: string,
+    privileges: { privilege: string; grantable: boolean }[],
+  ): void {
+    if (!this.state.has(roleName)) {
+      this.state.set(roleName, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: roleName is guaranteed to be in the state
+    const roleState = this.state.get(roleName)!;
+
+    if (!roleState.has(objtype)) {
+      roleState.set(objtype, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: objtype is guaranteed to be in the state
+    const objtypeState = roleState.get(objtype)!;
+
+    const schemaKey = inSchema ?? null;
+    if (!objtypeState.has(schemaKey)) {
+      objtypeState.set(schemaKey, new Map());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: schemaKey is guaranteed to be in the state
+    const schemaState = objtypeState.get(schemaKey)!;
+
+    if (!schemaState.has(grantee)) {
+      schemaState.set(grantee, new Set());
+    }
+    // biome-ignore lint/style/noNonNullAssertion: grantee is guaranteed to be in the state
+    const privilegesSet = schemaState.get(grantee)!;
+
+    for (const priv of privileges) {
+      const key = `${priv.privilege}:${priv.grantable}`;
+      privilegesSet.add(key);
+    }
+  }
+
+  /**
+   * Apply a RevokeRoleDefaultPrivileges change to the state.
+   */
+  applyRevoke(
+    roleName: string,
+    objtype: string,
+    inSchema: string | null,
+    grantee: string,
+    privileges: { privilege: string; grantable: boolean }[],
+  ): void {
+    const roleState = this.state.get(roleName);
+    if (!roleState) return;
+
+    const objtypeState = roleState.get(objtype);
+    if (!objtypeState) return;
+
+    const schemaKey = inSchema ?? null;
+    const schemaState = objtypeState.get(schemaKey);
+    if (!schemaState) return;
+
+    const privilegesSet = schemaState.get(grantee);
+    if (!privilegesSet) return;
+
+    for (const priv of privileges) {
+      const key = `${priv.privilege}:${priv.grantable}`;
+      privilegesSet.delete(key);
+      // Also remove base privilege if grantable was revoked
+      if (priv.grantable) {
+        const baseKey = `${priv.privilege}:false`;
+        privilegesSet.delete(baseKey);
+      }
+    }
+  }
+
+  /**
+   * Get effective default privileges for a given object creation.
+   */
+  getEffectiveDefaults(
+    currentUser: string,
+    objectType: string,
+    objectSchema: string,
+  ): PrivilegeProps[] {
+    const objtype = objectTypeToObjtype(objectType);
+    if (!objtype) return [];
+
+    const roleState = this.state.get(currentUser);
+    if (!roleState) return [];
+
+    const objtypeState = roleState.get(objtype);
+    if (!objtypeState) return [];
+
+    const defaultPrivs: PrivilegeProps[] = [];
+
+    // Check schema-specific first, then global (null schema)
+    const schemasToCheck = [objectSchema, null];
+    for (const schemaKey of schemasToCheck) {
+      const schemaState = objtypeState.get(schemaKey);
+      if (!schemaState) continue;
+
+      for (const [grantee, privilegesSet] of schemaState.entries()) {
+        for (const privKey of privilegesSet) {
+          const [privilege, grantableStr] = privKey.split(":");
+          const grantable = grantableStr === "true";
+          defaultPrivs.push({
+            grantee,
+            privilege,
+            grantable,
+            columns: null,
+          });
+        }
+      }
+      // Schema-specific takes precedence, so break after first match
+      if (schemaKey === objectSchema && schemaState.size > 0) {
+        break;
+      }
+    }
+
+    return defaultPrivs;
+  }
+}

package/src/core/objects/base.diff.ts

@@ -0,0 +1,20 @@
+import type { BasePgModel } from "./base.model.ts";
+
+export function diffObjects<T extends BasePgModel>(
+  main: Record<string, T>,
+  branch: Record<string, T>,
+) {
+  const mainIds = new Set(Object.keys(main));
+  const branchIds = new Set(Object.keys(branch));
+
+  const created = [...branchIds.difference(mainIds)];
+  const dropped = [...mainIds.difference(branchIds)];
+  const altered = [...mainIds.intersection(branchIds)].filter((id) => {
+    const mainModel = main[id];
+    const branchModel = branch[id];
+
+    return !mainModel.equals(branchModel);
+  });
+
+  return { created, dropped, altered };
+}

package/src/core/objects/base.model.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { BasePgModel } from "./base.model.ts";
+
+class NormalizedTestModel extends BasePgModel {
+  private readonly id: string;
+  private readonly values: string[];
+
+  constructor(id: string, values: string[]) {
+    super();
+    this.id = id;
+    this.values = values;
+  }
+
+  get stableId() {
+    return this.id;
+  }
+
+  get identityFields() {
+    return { id: this.id };
+  }
+
+  get dataFields() {
+    return { values: this.values };
+  }
+
+  override stableSnapshot() {
+    return {
+      identity: this.identityFields,
+      data: {
+        values: [...this.values].sort(),
+      },
+    };
+  }
+}
+
+describe("BasePgModel.equals", () => {
+  test("uses stable snapshots for normalized equality", () => {
+    const main = new NormalizedTestModel("same", ["b", "a"]);
+    const branch = new NormalizedTestModel("same", ["a", "b"]);
+
+    expect(main.equals(branch)).toBe(true);
+  });
+});

package/src/core/objects/base.model.ts

@@ -0,0 +1,85 @@
+import z from "zod";
+import { deepEqual } from "./utils.ts";
+
+export const columnPropsSchema = z.object({
+  name: z.string(),
+  position: z.number(),
+  data_type: z.string(),
+  data_type_str: z.string(),
+  is_custom_type: z.boolean(),
+  custom_type_type: z.string().nullable(),
+  custom_type_category: z.string().nullable(),
+  custom_type_schema: z.string().nullable(),
+  custom_type_name: z.string().nullable(),
+  not_null: z.boolean(),
+  is_identity: z.boolean(),
+  is_identity_always: z.boolean(),
+  is_generated: z.boolean(),
+  collation: z.string().nullable(),
+  default: z.string().nullable(),
+  comment: z.string().nullable(),
+});
+
+export type ColumnProps = z.infer<typeof columnPropsSchema>;
+
+export function normalizeColumns(columns: ColumnProps[]) {
+  return columns
+    .map((column) => {
+      const { position: _position, ...rest } = column;
+      return rest;
+    })
+    .sort((a, b) => a.name.localeCompare(b.name));
+}
+
+/**
+ * Interface for table-like objects that have columns (tables, views, materialized views).
+ * In PostgreSQL, these are relations with relkind in ('r', 'p', 'v', 'm').
+ */
+export interface TableLikeObject {
+  readonly columns: ColumnProps[];
+}
+
+export abstract class BasePgModel {
+  /**
+   * Database-portable stable identifier for dependency resolution.
+   * This identifier remains constant across database dumps/restores and
+   * is used for cross-database dependency resolution.
+   */
+  abstract get stableId(): string;
+
+  /**
+   * Get all identity fields and their values.
+   * Subclasses should override this to return the identity fields.
+   */
+  abstract get identityFields(): Record<string, unknown>;
+
+  /**
+   * Get all data fields and their values.
+   * Subclasses should override this to return the data fields.
+   */
+  abstract get dataFields(): Record<string, unknown>;
+
+  /**
+   * Compare this object with another BasePgModel for equality based on the stableId and
+   * the data portion of the stable snapshot. By default, the snapshot's `data` comes
+   * from {@link dataFields}, but subclasses may override {@link stableSnapshot} to
+   * normalize or otherwise transform the data used for equality.
+   */
+  equals(other: BasePgModel): boolean {
+    return (
+      this.stableId === other.stableId &&
+      deepEqual(this.stableSnapshot().data, other.stableSnapshot().data)
+    );
+  }
+
+  /**
+   * Stable representation used for equality/fingerprints.
+   * Subclasses can override to normalize unstable fields.
+   */
+  stableSnapshot() {
+    return {
+      identity: this.identityFields,
+      data: this.dataFields,
+    };
+  }
+}