@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.4

package/src/core/objects/aggregate/aggregate.diff.test.ts

@@ -0,0 +1,215 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../base.default-privileges.ts";
+import { diffAggregates } from "./aggregate.diff.ts";
+import { Aggregate } from "./aggregate.model.ts";
+import { AlterAggregateChangeOwner } from "./changes/aggregate.alter.ts";
+import {
+  CreateCommentOnAggregate,
+  DropCommentOnAggregate,
+} from "./changes/aggregate.comment.ts";
+import { CreateAggregate } from "./changes/aggregate.create.ts";
+import { DropAggregate } from "./changes/aggregate.drop.ts";
+import {
+  GrantAggregatePrivileges,
+  RevokeAggregatePrivileges,
+  RevokeGrantOptionAggregatePrivileges,
+} from "./changes/aggregate.privilege.ts";
+
+type AggregateProps = ConstructorParameters<typeof Aggregate>[0];
+
+const base: AggregateProps = {
+  schema: "public",
+  name: "agg_sum",
+  identity_arguments: "integer",
+  kind: "a",
+  aggkind: "n",
+  num_direct_args: 0,
+  return_type: "integer",
+  return_type_schema: "pg_catalog",
+  parallel_safety: "u",
+  is_strict: false,
+  transition_function: "pg_catalog.int4pl(integer,integer)",
+  state_data_type: "integer",
+  state_data_type_schema: "pg_catalog",
+  state_data_space: 0,
+  final_function: null,
+  final_function_extra_args: false,
+  final_function_modify: null,
+  combine_function: null,
+  serial_function: null,
+  deserial_function: null,
+  initial_condition: null,
+  moving_transition_function: null,
+  moving_inverse_function: null,
+  moving_state_data_type: null,
+  moving_state_data_type_schema: null,
+  moving_state_data_space: null,
+  moving_final_function: null,
+  moving_final_function_extra_args: false,
+  moving_final_function_modify: null,
+  moving_initial_condition: null,
+  sort_operator: null,
+  argument_count: 1,
+  argument_default_count: 0,
+  argument_names: null,
+  argument_types: ["integer"],
+  all_argument_types: null,
+  argument_modes: null,
+  argument_defaults: null,
+  owner: "owner1",
+  comment: null,
+  privileges: [],
+};
+
+const makeAggregate = (override: Partial<AggregateProps> = {}) =>
+  new Aggregate({
+    ...base,
+    ...override,
+    privileges: override.privileges ?? [...base.privileges],
+  });
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("aggregate.diff", () => {
+  test("create and drop emit expected changes", () => {
+    const aggregate = makeAggregate({ comment: "sum comment" });
+    const created = diffAggregates(
+      testContext,
+      {},
+      { [aggregate.stableId]: aggregate },
+    );
+
+    expect(created[0]).toBeInstanceOf(CreateAggregate);
+    expect(
+      created.some((change) => change instanceof CreateCommentOnAggregate),
+    ).toBe(true);
+
+    const dropped = diffAggregates(
+      testContext,
+      { [aggregate.stableId]: aggregate },
+      {},
+    );
+
+    expect(dropped[0]).toBeInstanceOf(DropAggregate);
+  });
+
+  test("alter owner produces change owner statement", () => {
+    const main = makeAggregate();
+    const branch = makeAggregate({ owner: "owner2" });
+    const changes = diffAggregates(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+
+    expect(changes).toHaveLength(1);
+    expect(changes[0]).toBeInstanceOf(AlterAggregateChangeOwner);
+  });
+
+  test("comment changes emit create/drop comment statements", () => {
+    const main = makeAggregate();
+    const withComment = makeAggregate({ comment: "sum comment" });
+    const addComment = diffAggregates(
+      testContext,
+      { [main.stableId]: main },
+      { [withComment.stableId]: withComment },
+    );
+
+    expect(addComment[0]).toBeInstanceOf(CreateCommentOnAggregate);
+
+    const dropComment = diffAggregates(
+      testContext,
+      { [withComment.stableId]: withComment },
+      { [main.stableId]: main },
+    );
+
+    expect(dropComment[0]).toBeInstanceOf(DropCommentOnAggregate);
+  });
+
+  test("non-alterable changes force create or replace", () => {
+    const main = makeAggregate();
+    const branch = makeAggregate({ return_type: "text" });
+    const changes = diffAggregates(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+
+    expect(changes).toHaveLength(1);
+    expect(changes[0]).toBeInstanceOf(CreateAggregate);
+    expect((changes[0] as CreateAggregate).orReplace).toBe(true);
+  });
+
+  test("privilege diffs emit grant, revoke, and revoke grant option statements", () => {
+    const main = makeAggregate({
+      privileges: [
+        { grantee: "role_exec", privilege: "EXECUTE", grantable: false },
+        { grantee: "role_with_option", privilege: "EXECUTE", grantable: true },
+        { grantee: "role_removed", privilege: "EXECUTE", grantable: false },
+      ],
+    });
+    const branch = makeAggregate({
+      privileges: [
+        { grantee: "role_exec", privilege: "EXECUTE", grantable: true },
+        { grantee: "role_with_option", privilege: "EXECUTE", grantable: false },
+        { grantee: "role_new", privilege: "EXECUTE", grantable: false },
+      ],
+    });
+
+    const changes = diffAggregates(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+
+    expect(
+      changes.some((change) => change instanceof GrantAggregatePrivileges),
+    ).toBe(true);
+    expect(
+      changes.some((change) => change instanceof RevokeAggregatePrivileges),
+    ).toBe(true);
+    expect(
+      changes.some(
+        (change) => change instanceof RevokeGrantOptionAggregatePrivileges,
+      ),
+    ).toBe(true);
+
+    const grantBase = changes.find(
+      (change) =>
+        change instanceof GrantAggregatePrivileges &&
+        change.grantee === "role_with_option",
+    ) as GrantAggregatePrivileges | undefined;
+    expect(grantBase?.privileges).toEqual([
+      {
+        grantee: "role_with_option",
+        privilege: "EXECUTE",
+        grantable: false,
+      } as never,
+    ]);
+
+    const revokeGrantOption = changes.find(
+      (change) =>
+        change instanceof RevokeGrantOptionAggregatePrivileges &&
+        change.grantee === "role_with_option",
+    ) as RevokeGrantOptionAggregatePrivileges | undefined;
+    expect(revokeGrantOption?.privilegeNames).toEqual(["EXECUTE"]);
+
+    const revokePrivilege = changes.find(
+      (change) =>
+        change instanceof RevokeAggregatePrivileges &&
+        change.grantee === "role_removed",
+    ) as RevokeAggregatePrivileges | undefined;
+    expect(revokePrivilege?.privileges).toEqual([
+      {
+        grantee: "role_removed",
+        privilege: "EXECUTE",
+        grantable: false,
+      } as never,
+    ]);
+  });
+});

package/src/core/objects/aggregate/aggregate.diff.ts

@@ -0,0 +1,278 @@
+import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
+import { diffObjects } from "../base.diff.ts";
+import {
+  diffPrivileges,
+  filterPublicBuiltInDefaults,
+  groupPrivilegesByGrantable,
+} from "../base.privilege-diff.ts";
+import type { Role } from "../role/role.model.ts";
+import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
+import type { Aggregate } from "./aggregate.model.ts";
+import { AlterAggregateChangeOwner } from "./changes/aggregate.alter.ts";
+import {
+  CreateCommentOnAggregate,
+  DropCommentOnAggregate,
+} from "./changes/aggregate.comment.ts";
+import { CreateAggregate } from "./changes/aggregate.create.ts";
+import { DropAggregate } from "./changes/aggregate.drop.ts";
+import {
+  GrantAggregatePrivileges,
+  RevokeAggregatePrivileges,
+  RevokeGrantOptionAggregatePrivileges,
+} from "./changes/aggregate.privilege.ts";
+import type { AggregateChange } from "./changes/aggregate.types.ts";
+
+export function diffAggregates(
+  ctx: {
+    version: number;
+    currentUser: string;
+    defaultPrivilegeState: DefaultPrivilegeState;
+    mainRoles: Record<string, Role>;
+  },
+  main: Record<string, Aggregate>,
+  branch: Record<string, Aggregate>,
+): AggregateChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: AggregateChange[] = [];
+
+  for (const aggregateId of created) {
+    const aggregate = branch[aggregateId];
+    changes.push(new CreateAggregate({ aggregate }));
+
+    // OWNER: If the aggregate should be owned by someone other than the current user,
+    // emit ALTER AGGREGATE ... OWNER TO after creation
+    if (aggregate.owner !== ctx.currentUser) {
+      changes.push(
+        new AlterAggregateChangeOwner({
+          aggregate,
+          owner: aggregate.owner,
+        }),
+      );
+    }
+
+    if (aggregate.comment !== null) {
+      changes.push(new CreateCommentOnAggregate({ aggregate }));
+    }
+
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+      ctx.currentUser,
+      "aggregate",
+      aggregate.schema ?? "",
+    );
+    // Filter out PUBLIC's built-in default EXECUTE privilege (PostgreSQL grants it automatically)
+    // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
+    // This prevents generating unnecessary "GRANT EXECUTE TO PUBLIC" statements
+    const desiredPrivileges = filterPublicBuiltInDefaults(
+      "aggregate",
+      aggregate.privileges,
+    );
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the aggregate owner as the reference.
+    const privilegeResults = diffPrivileges(
+      effectiveDefaults,
+      desiredPrivileges,
+      aggregate.owner,
+      ctx.mainRoles,
+    );
+
+    // Generate grant changes
+    for (const [grantee, result] of privilegeResults) {
+      if (result.grants.length > 0) {
+        const grantGroups = groupPrivilegesByGrantable(result.grants);
+        for (const [, list] of grantGroups) {
+          changes.push(
+            new GrantAggregatePrivileges({
+              aggregate,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke changes
+      if (result.revokes.length > 0) {
+        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+        for (const [, list] of revokeGroups) {
+          changes.push(
+            new RevokeAggregatePrivileges({
+              aggregate,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke grant option changes
+      if (result.revokeGrantOption.length > 0) {
+        changes.push(
+          new RevokeGrantOptionAggregatePrivileges({
+            aggregate,
+            grantee,
+            privilegeNames: result.revokeGrantOption,
+            version: ctx.version,
+          }),
+        );
+      }
+    }
+  }
+
+  for (const aggregateId of dropped) {
+    changes.push(new DropAggregate({ aggregate: main[aggregateId] }));
+  }
+
+  for (const aggregateId of altered) {
+    const mainAggregate = main[aggregateId];
+    const branchAggregate = branch[aggregateId];
+
+    const NON_ALTERABLE_FIELDS: Array<keyof Aggregate> = [
+      "kind",
+      "aggkind",
+      "num_direct_args",
+      "return_type",
+      "return_type_schema",
+      "parallel_safety",
+      "is_strict",
+      "transition_function",
+      "state_data_type",
+      "state_data_type_schema",
+      "state_data_space",
+      "final_function",
+      "final_function_extra_args",
+      "final_function_modify",
+      "combine_function",
+      "serial_function",
+      "deserial_function",
+      "initial_condition",
+      "moving_transition_function",
+      "moving_inverse_function",
+      "moving_state_data_type",
+      "moving_state_data_type_schema",
+      "moving_state_data_space",
+      "moving_final_function",
+      "moving_final_function_extra_args",
+      "moving_final_function_modify",
+      "moving_initial_condition",
+      "sort_operator",
+      "argument_count",
+      "argument_default_count",
+      "argument_names",
+      "argument_types",
+      "all_argument_types",
+      "argument_modes",
+      "argument_defaults",
+      "identityArguments",
+    ];
+
+    const nonAlterableChanged = hasNonAlterableChanges(
+      mainAggregate,
+      branchAggregate,
+      NON_ALTERABLE_FIELDS,
+      {
+        argument_names: deepEqual,
+        argument_types: deepEqual,
+        all_argument_types: deepEqual,
+        argument_modes: deepEqual,
+      },
+    );
+
+    if (nonAlterableChanged) {
+      changes.push(
+        new CreateAggregate({ aggregate: branchAggregate, orReplace: true }),
+      );
+      continue;
+    }
+
+    if (mainAggregate.owner !== branchAggregate.owner) {
+      changes.push(
+        new AlterAggregateChangeOwner({
+          aggregate: mainAggregate,
+          owner: branchAggregate.owner,
+        }),
+      );
+    }
+
+    if (mainAggregate.comment !== branchAggregate.comment) {
+      if (branchAggregate.comment === null) {
+        changes.push(new DropCommentOnAggregate({ aggregate: mainAggregate }));
+      } else {
+        changes.push(
+          new CreateCommentOnAggregate({ aggregate: branchAggregate }),
+        );
+      }
+    }
+
+    // PRIVILEGES
+    // Filter out PUBLIC's built-in default EXECUTE privilege from main catalog
+    // (PostgreSQL grants it automatically, so we shouldn't compare it)
+    const mainPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "aggregate",
+      mainAggregate.privileges,
+    );
+    // Filter out PUBLIC's built-in default EXECUTE privilege from branch catalog
+    const branchPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "aggregate",
+      branchAggregate.privileges,
+    );
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use branch owner as the reference.
+    const privilegeResults = diffPrivileges(
+      mainPrivilegesFiltered,
+      branchPrivilegesFiltered,
+      branchAggregate.owner,
+      ctx.mainRoles,
+    );
+
+    for (const [grantee, result] of privilegeResults) {
+      if (result.grants.length > 0) {
+        const grantGroups = groupPrivilegesByGrantable(result.grants);
+        for (const [, list] of grantGroups) {
+          changes.push(
+            new GrantAggregatePrivileges({
+              aggregate: branchAggregate,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      if (result.revokes.length > 0) {
+        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+        for (const [, list] of revokeGroups) {
+          changes.push(
+            new RevokeAggregatePrivileges({
+              aggregate: mainAggregate,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      if (result.revokeGrantOption.length > 0) {
+        changes.push(
+          new RevokeGrantOptionAggregatePrivileges({
+            aggregate: mainAggregate,
+            grantee,
+            privilegeNames: result.revokeGrantOption,
+            version: ctx.version,
+          }),
+        );
+      }
+    }
+  }
+
+  return changes;
+}