@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.21

package/src/core/objects/rls-policy/changes/rls-policy.alter.test.ts

@@ -0,0 +1,283 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { diffRlsPolicies } from "../rls-policy.diff.ts";
+import { RlsPolicy, type RlsPolicyProps } from "../rls-policy.model.ts";
+import {
+  AlterRlsPolicySetRoles,
+  AlterRlsPolicySetUsingExpression,
+  AlterRlsPolicySetWithCheckExpression,
+} from "./rls-policy.alter.ts";
+import { CreateRlsPolicy } from "./rls-policy.create.ts";
+import { DropRlsPolicy } from "./rls-policy.drop.ts";
+
+describe.concurrent("rls-policy", () => {
+  describe("alter", () => {
+    test("change roles", async () => {
+      const props: Omit<RlsPolicyProps, "roles"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        roles: ["public"],
+      });
+
+      const change = new AlterRlsPolicySetRoles({
+        policy,
+        roles: ["role1", "role2"],
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table TO role1, role2",
+      );
+    });
+
+    test("change roles to PUBLIC (default)", async () => {
+      const props: Omit<RlsPolicyProps, "roles"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        using_expression: "expr",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        roles: ["role1"],
+      });
+
+      const change = new AlterRlsPolicySetRoles({
+        policy,
+        roles: ["public"],
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table TO PUBLIC",
+      );
+    });
+
+    test("drop + create rls policy when command changes", async () => {
+      const props: Omit<RlsPolicyProps, "command"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const main = new RlsPolicy({
+        ...props,
+        command: "r", // SELECT
+      });
+      const branch = new RlsPolicy({
+        ...props,
+        command: "w", // UPDATE
+      });
+
+      const changes = diffRlsPolicies(
+        { [main.stableId]: main },
+        { [branch.stableId]: branch },
+      );
+
+      expect(changes).toHaveLength(2);
+      expect(changes[0]).toBeInstanceOf(DropRlsPolicy);
+      expect(changes[1]).toBeInstanceOf(CreateRlsPolicy);
+      await assertValidSql(changes[0].serialize());
+      expect(changes[0].serialize()).toBe(
+        "DROP POLICY test_policy ON public.test_table",
+      );
+      await assertValidSql(changes[1].serialize());
+      expect(changes[1].serialize()).toBe(
+        "CREATE POLICY test_policy ON public.test_table FOR UPDATE USING (user_id = current_user_id())",
+      );
+    });
+
+    test("drop + create rls policy when permissive changes", async () => {
+      const props: Omit<RlsPolicyProps, "permissive"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        roles: ["public"],
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const main = new RlsPolicy({
+        ...props,
+        permissive: true,
+      });
+      const branch = new RlsPolicy({
+        ...props,
+        permissive: false,
+      });
+
+      const changes = diffRlsPolicies(
+        { [main.stableId]: main },
+        { [branch.stableId]: branch },
+      );
+
+      expect(changes).toHaveLength(2);
+      expect(changes[0]).toBeInstanceOf(DropRlsPolicy);
+      expect(changes[1]).toBeInstanceOf(CreateRlsPolicy);
+      await assertValidSql(changes[0].serialize());
+      expect(changes[0].serialize()).toBe(
+        "DROP POLICY test_policy ON public.test_table",
+      );
+      await assertValidSql(changes[1].serialize());
+      expect(changes[1].serialize()).toBe(
+        "CREATE POLICY test_policy ON public.test_table AS RESTRICTIVE FOR SELECT USING (user_id = current_user_id())",
+      );
+    });
+
+    test("alter using expression", async () => {
+      const props: Omit<RlsPolicyProps, "using_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        with_check_expression: null,
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        using_expression: "old_expr",
+      });
+
+      const change = new AlterRlsPolicySetUsingExpression({
+        policy,
+        usingExpression: "new_expr",
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table USING (new_expr)",
+      );
+    });
+
+    test("clear using expression -> USING (true)", async () => {
+      const props: Omit<RlsPolicyProps, "using_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        with_check_expression: null,
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        using_expression: "old_expr",
+      });
+
+      const change = new AlterRlsPolicySetUsingExpression({
+        policy,
+        usingExpression: null,
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table USING (true)",
+      );
+    });
+
+    test("alter with check expression", async () => {
+      const props: Omit<RlsPolicyProps, "with_check_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "expr",
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        with_check_expression: "old_check",
+      });
+
+      const change = new AlterRlsPolicySetWithCheckExpression({
+        policy,
+        withCheckExpression: "new_check",
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table WITH CHECK (new_check)",
+      );
+    });
+
+    test("clear with check expression -> WITH CHECK (true)", async () => {
+      const props: Omit<RlsPolicyProps, "with_check_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "expr",
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        with_check_expression: "old_check",
+      });
+
+      const change = new AlterRlsPolicySetWithCheckExpression({
+        policy,
+        withCheckExpression: null,
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table WITH CHECK (true)",
+      );
+    });
+  });
+});

package/src/core/objects/rls-policy/changes/rls-policy.alter.ts

@@ -0,0 +1,129 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+import { AlterRlsPolicyChange } from "./rls-policy.base.ts";
+
+/**
+ * Alter an RLS policy.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterpolicy.html
+ *
+ * Synopsis
+ * ```sql
+ * ALTER POLICY name ON table_name
+ *     [ TO { role_name | PUBLIC | CURRENT_ROLE | CURRENT_USER | SESSION_USER } [, ...] ]
+ *     [ USING ( using_expression ) ]
+ *     [ WITH CHECK ( with_check_expression ) ]
+ * ```
+ */
+
+export type AlterRlsPolicy =
+  | AlterRlsPolicySetRoles
+  | AlterRlsPolicySetUsingExpression
+  | AlterRlsPolicySetWithCheckExpression;
+
+/**
+ * ALTER POLICY ... TO roles ...
+ */
+export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly roles: string[];
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy; roles: string[] }) {
+    super();
+    this.policy = props.policy;
+    this.roles = props.roles;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const targetRoles = this.roles;
+    const toPublic =
+      targetRoles.length === 0 ||
+      (targetRoles.length === 1 && targetRoles[0].toLowerCase() === "public");
+    const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
+
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "TO",
+      rolesSql,
+    ].join(" ");
+  }
+}
+
+/**
+ * ALTER POLICY ... USING (...)
+ */
+export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly usingExpression: string | null;
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy; usingExpression: string | null }) {
+    super();
+    this.policy = props.policy;
+    this.usingExpression = props.usingExpression;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const expr = this.usingExpression ?? "true";
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "USING",
+      `(${expr})`,
+    ].join(" ");
+  }
+}
+
+/**
+ * ALTER POLICY ... WITH CHECK (...)
+ */
+export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly withCheckExpression: string | null;
+  public readonly scope = "object" as const;
+
+  constructor(props: {
+    policy: RlsPolicy;
+    withCheckExpression: string | null;
+  }) {
+    super();
+    this.policy = props.policy;
+    this.withCheckExpression = props.withCheckExpression;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const expr = this.withCheckExpression ?? "true";
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "WITH CHECK",
+      `(${expr})`,
+    ].join(" ");
+  }
+}
+
+/**
+ * Replace an RLS policy by dropping and recreating it.
+ * This is used when properties that cannot be altered via ALTER POLICY change.
+ */
+// NOTE: ReplaceRlsPolicy removed. Non-alterable changes are emitted as Drop + Create in rls-policy.diff.ts.

package/src/core/objects/rls-policy/changes/rls-policy.base.ts

@@ -0,0 +1,20 @@
+import { BaseChange } from "../../base.change.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+
+abstract class BaseRlsPolicyChange extends BaseChange {
+  abstract readonly policy: RlsPolicy;
+  abstract readonly scope: "object" | "comment";
+  readonly objectType: "rls_policy" = "rls_policy";
+}
+
+export abstract class CreateRlsPolicyChange extends BaseRlsPolicyChange {
+  readonly operation = "create" as const;
+}
+
+export abstract class AlterRlsPolicyChange extends BaseRlsPolicyChange {
+  readonly operation = "alter" as const;
+}
+
+export abstract class DropRlsPolicyChange extends BaseRlsPolicyChange {
+  readonly operation = "drop" as const;
+}

package/src/core/objects/rls-policy/changes/rls-policy.comment.ts

@@ -0,0 +1,70 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import { quoteLiteral } from "../../base.change.ts";
+import { stableId } from "../../utils.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+import {
+  CreateRlsPolicyChange,
+  DropRlsPolicyChange,
+} from "./rls-policy.base.ts";
+
+export type CommentRlsPolicy =
+  | CreateCommentOnRlsPolicy
+  | DropCommentOnRlsPolicy;
+
+export class CreateCommentOnRlsPolicy extends CreateRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly scope = "comment" as const;
+
+  constructor(props: { policy: RlsPolicy }) {
+    super();
+    this.policy = props.policy;
+  }
+
+  get creates() {
+    return [stableId.comment(this.policy.stableId)];
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return [
+      "COMMENT ON POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "IS",
+      // biome-ignore lint/style/noNonNullAssertion: rls policy comment is not nullable in this case
+      quoteLiteral(this.policy.comment!),
+    ].join(" ");
+  }
+}
+
+export class DropCommentOnRlsPolicy extends DropRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly scope = "comment" as const;
+
+  constructor(props: { policy: RlsPolicy }) {
+    super();
+    this.policy = props.policy;
+  }
+
+  get drops() {
+    return [stableId.comment(this.policy.stableId)];
+  }
+
+  get requires() {
+    return [stableId.comment(this.policy.stableId), this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return [
+      "COMMENT ON POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/rls-policy/changes/rls-policy.create.test.ts

@@ -0,0 +1,209 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { stableId } from "../../utils.ts";
+import { RlsPolicy } from "../rls-policy.model.ts";
+import { CreateRlsPolicy } from "./rls-policy.create.ts";
+
+describe("rls-policy", () => {
+  test("create minimal", async () => {
+    const policy = new RlsPolicy({
+      schema: "public",
+      name: "test_policy_min",
+      table_name: "test_table",
+      command: "*",
+      permissive: true,
+      roles: [],
+      using_expression: null,
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({
+      policy,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE POLICY test_policy_min ON public.test_table",
+    );
+  });
+
+  test("create", async () => {
+    const policy = new RlsPolicy({
+      schema: "public",
+      name: "test_policy",
+      table_name: "test_table",
+      command: "r",
+      permissive: true,
+      roles: ["public"],
+      using_expression: "user_id = current_user_id()",
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({
+      policy,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE POLICY test_policy ON public.test_table FOR SELECT USING (user_id = current_user_id())",
+    );
+  });
+
+  test("create with all options", async () => {
+    const policy = new RlsPolicy({
+      schema: "public",
+      name: "test_policy_all",
+      table_name: "test_table",
+      command: "w",
+      permissive: false,
+      roles: ["role1", "role2"],
+      using_expression: "expr1",
+      with_check_expression: "expr2",
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({
+      policy,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE POLICY test_policy_all ON public.test_table AS RESTRICTIVE FOR UPDATE TO role1, role2 USING (expr1) WITH CHECK (expr2)",
+    );
+  });
+
+  test("requires referenced relations reported by pg_depend", () => {
+    const policy = new RlsPolicy({
+      schema: "app",
+      name: "cross_relation_policy",
+      table_name: "accounts",
+      command: "r",
+      permissive: true,
+      roles: ["public"],
+      using_expression:
+        "(EXISTS (SELECT 1 FROM app.users) AND EXISTS (SELECT 1 FROM app.active_accounts))",
+      with_check_expression:
+        "(id IN (SELECT account_id FROM app.memberships WHERE active))",
+      owner: "test",
+      comment: null,
+      referenced_relations: [
+        { kind: "table", schema: "app", name: "users" },
+        { kind: "table", schema: "app", name: "memberships" },
+        { kind: "view", schema: "app", name: "active_accounts" },
+        { kind: "materialized_view", schema: "app", name: "account_stats" },
+        { kind: "foreign_table", schema: "app", name: "remote_profiles" },
+      ],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({ policy });
+
+    expect(change.requires).toContain(stableId.table("app", "users"));
+    expect(change.requires).toContain(stableId.table("app", "memberships"));
+    expect(change.requires).toContain(stableId.view("app", "active_accounts"));
+    expect(change.requires).toContain(
+      stableId.materializedView("app", "account_stats"),
+    );
+    expect(change.requires).toContain(
+      stableId.foreignTable("app", "remote_profiles"),
+    );
+  });
+
+  test("requires referenced procedures reported by pg_depend", () => {
+    const policy = new RlsPolicy({
+      schema: "app",
+      name: "function_guarded_policy",
+      table_name: "accounts",
+      command: "r",
+      permissive: true,
+      roles: ["public"],
+      using_expression: "public.is_admin()",
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [
+        { schema: "public", name: "is_admin", argument_types: [] },
+        {
+          schema: "public",
+          name: "has_role",
+          argument_types: ["text", "integer"],
+        },
+      ],
+    });
+
+    const change = new CreateRlsPolicy({ policy });
+
+    expect(change.requires).toContain(stableId.procedure("public", "is_admin"));
+    expect(change.requires).toContain(
+      stableId.procedure("public", "has_role", "text,integer"),
+    );
+  });
+
+  test("does not require additional objects when referenced lists are empty", () => {
+    const policy = new RlsPolicy({
+      schema: "app",
+      name: "simple_policy",
+      table_name: "accounts",
+      command: "*",
+      permissive: true,
+      roles: [],
+      using_expression: null,
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({ policy });
+
+    expect(change.requires).toEqual([
+      stableId.schema("app"),
+      stableId.table("app", "accounts"),
+      stableId.role("test"),
+    ]);
+  });
+
+  // Sequences referenced via nextval() are a known gap. pg_depend only
+  // records the sequence edge when the argument is written as a regclass
+  // literal (e.g. `nextval('app.seq'::regclass)`); bare string literals
+  // produce no pg_depend row. Tracked in
+  // https://github.com/supabase/pg-toolbelt/issues/220.
+  test.skip("requires referenced sequences (follow-up)", () => {
+    const policy = new RlsPolicy({
+      schema: "app",
+      name: "sequence_policy",
+      table_name: "accounts",
+      command: "r",
+      permissive: true,
+      roles: ["public"],
+      using_expression: "id < nextval('app.next_id'::regclass)",
+      with_check_expression: null,
+      owner: "test",
+      comment: null,
+      referenced_relations: [],
+      referenced_procedures: [],
+    });
+
+    const change = new CreateRlsPolicy({ policy });
+
+    // Expected once the gap is closed:
+    //   expect(change.requires).toContain(stableId.sequence("app", "next_id"));
+    expect(change.requires.length).toBeGreaterThan(0);
+  });
+});