@supabase/pg-delta 1.0.0-alpha.2 → 1.0.0-alpha.4

package/src/core/objects/sequence/changes/sequence.privilege.ts

@@ -0,0 +1,179 @@
+import {
+  formatObjectPrivilegeList,
+  getObjectKindPrefix,
+} from "../../base.privilege.ts";
+import { stableId } from "../../utils.ts";
+import type { Sequence } from "../sequence.model.ts";
+import { AlterSequenceChange } from "./sequence.base.ts";
+
+export type SequencePrivilege =
+  | GrantSequencePrivileges
+  | RevokeSequencePrivileges
+  | RevokeGrantOptionSequencePrivileges;
+
+/**
+ * Grant privileges on a sequence.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT { { USAGE | SELECT | UPDATE }
+ *     [, ...] | ALL [ PRIVILEGES ] }
+ *     ON { SEQUENCE sequence_name [, ...]
+ *          | ALL SEQUENCES IN SCHEMA schema_name [, ...] }
+ *     TO role_specification [, ...] [ WITH GRANT OPTION ]
+ *     [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantSequencePrivileges extends AlterSequenceChange {
+  public readonly sequence: Sequence;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    sequence: Sequence;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.sequence = props.sequence;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.sequence.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.sequence.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantSequencePrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const kindPrefix = getObjectKindPrefix("SEQUENCE");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SEQUENCE", list, this.version);
+    const sequenceName = `${this.sequence.schema}.${this.sequence.name}`;
+    return `GRANT ${privSql} ${kindPrefix} ${sequenceName} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+/**
+ * Revoke privileges on a sequence.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ GRANT OPTION FOR ]
+ *     { { USAGE | SELECT | UPDATE }
+ *     [, ...] | ALL [ PRIVILEGES ] }
+ *     ON { SEQUENCE sequence_name [, ...]
+ *          | ALL SEQUENCES IN SCHEMA schema_name [, ...] }
+ *     FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeSequencePrivileges extends AlterSequenceChange {
+  public readonly sequence: Sequence;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    sequence: Sequence;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.sequence = props.sequence;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    // Return ACL ID for dependency tracking, even though this is an ALTER operation
+    // Phase assignment now uses operation type, so this won't affect phase placement
+    return [stableId.acl(this.sequence.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.sequence.stableId, this.grantee),
+      this.sequence.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("SEQUENCE");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SEQUENCE", list, this.version);
+    const sequenceName = `${this.sequence.schema}.${this.sequence.name}`;
+    return `REVOKE ${privSql} ${kindPrefix} ${sequenceName} FROM ${this.grantee}`;
+  }
+}
+
+/**
+ * Revoke grant option for privileges on a sequence.
+ *
+ * This removes the ability to grant the privilege to others, but keeps the privilege itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeGrantOptionSequencePrivileges extends AlterSequenceChange {
+  public readonly sequence: Sequence;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    sequence: Sequence;
+    grantee: string;
+    privilegeNames: string[];
+    version?: number;
+  }) {
+    super();
+    this.sequence = props.sequence;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.sequence.stableId, this.grantee),
+      this.sequence.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const kindPrefix = getObjectKindPrefix("SEQUENCE");
+    const privSql = formatObjectPrivilegeList(
+      "SEQUENCE",
+      this.privilegeNames,
+      this.version,
+    );
+    const sequenceName = `${this.sequence.schema}.${this.sequence.name}`;
+    return `REVOKE GRANT OPTION FOR ${privSql} ${kindPrefix} ${sequenceName} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/sequence/changes/sequence.types.ts

@@ -0,0 +1,12 @@
+import type { AlterSequence } from "./sequence.alter.ts";
+import type { CommentSequence } from "./sequence.comment.ts";
+import type { CreateSequence } from "./sequence.create.ts";
+import type { DropSequence } from "./sequence.drop.ts";
+import type { SequencePrivilege } from "./sequence.privilege.ts";
+
+export type SequenceChange =
+  | AlterSequence
+  | CommentSequence
+  | CreateSequence
+  | DropSequence
+  | SequencePrivilege;

package/src/core/objects/sequence/sequence.diff.test.ts

@@ -0,0 +1,141 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../base.default-privileges.ts";
+import type { Table } from "../table/table.model.ts";
+import {
+  AlterSequenceSetOptions,
+  AlterSequenceSetOwnedBy,
+} from "./changes/sequence.alter.ts";
+import { CreateSequence } from "./changes/sequence.create.ts";
+import { DropSequence } from "./changes/sequence.drop.ts";
+import { diffSequences } from "./sequence.diff.ts";
+import { Sequence, type SequenceProps } from "./sequence.model.ts";
+
+const base: SequenceProps = {
+  schema: "public",
+  name: "seq1",
+  data_type: "bigint",
+  start_value: 1,
+  minimum_value: 1n,
+  maximum_value: 1000n,
+  increment: 1,
+  cycle_option: false,
+  cache_size: 1,
+  persistence: "p",
+  owned_by_schema: null,
+  owned_by_table: null,
+  owned_by_column: null,
+  comment: null,
+  privileges: [],
+  owner: "test",
+};
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("sequence.diff", () => {
+  test("create and drop", () => {
+    const s = new Sequence(base);
+    const created = diffSequences(testContext, {}, { [s.stableId]: s });
+    expect(created[0]).toBeInstanceOf(CreateSequence);
+    const dropped = diffSequences(testContext, { [s.stableId]: s }, {});
+    expect(dropped[0]).toBeInstanceOf(DropSequence);
+  });
+
+  test("alter owned by", () => {
+    const main = new Sequence(base);
+    const branch = new Sequence({
+      ...base,
+      owned_by_schema: "public",
+      owned_by_table: "t",
+      owned_by_column: "id",
+    });
+    const changes = diffSequences(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterSequenceSetOwnedBy);
+  });
+
+  test("alter options via diff", () => {
+    const main = new Sequence(base);
+    const branch = new Sequence({
+      ...base,
+      increment: 2,
+      minimum_value: 5n,
+      maximum_value: 500n,
+      start_value: 10,
+      cache_size: 3,
+      cycle_option: true,
+    });
+    const changes = diffSequences(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterSequenceSetOptions)).toBe(
+      true,
+    );
+  });
+
+  test("drop and create when non-alterable property changes", () => {
+    const main = new Sequence(base);
+    const branch = new Sequence({
+      ...base,
+      data_type: "integer",
+      persistence: "u",
+    });
+    const changes = diffSequences(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(DropSequence);
+    expect(changes[1]).toBeInstanceOf(CreateSequence);
+  });
+
+  test("skip DROP SEQUENCE when owned by table being dropped", () => {
+    const ownedSequence = new Sequence({
+      ...base,
+      owned_by_schema: "public",
+      owned_by_table: "users",
+      owned_by_column: "id",
+    });
+    // When the owning table is not in branch catalog (being dropped),
+    // DROP SEQUENCE should not be generated (PostgreSQL auto-drops it)
+    const changes = diffSequences(
+      testContext,
+      { [ownedSequence.stableId]: ownedSequence },
+      {}, // branch has no sequences (sequence was auto-dropped)
+      {}, // branch has no tables (table is being dropped)
+    );
+    // Should not generate DROP SEQUENCE since table is being dropped
+    expect(changes).toHaveLength(0);
+  });
+
+  test("generate DROP SEQUENCE when owned by table that still exists", () => {
+    const ownedSequence = new Sequence({
+      ...base,
+      owned_by_schema: "public",
+      owned_by_table: "users",
+      owned_by_column: "id",
+    });
+    // When the owning table still exists in branch catalog,
+    // DROP SEQUENCE should be generated
+    const changes = diffSequences(
+      testContext,
+      { [ownedSequence.stableId]: ownedSequence },
+      {}, // branch has no sequences
+      {
+        "table:public.users": {} as Table, // table still exists
+      },
+    );
+    // Should generate DROP SEQUENCE since table still exists
+    expect(changes).toHaveLength(1);
+    expect(changes[0]).toBeInstanceOf(DropSequence);
+  });
+});

package/src/core/objects/sequence/sequence.diff.ts

@@ -0,0 +1,359 @@
+import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
+import { diffObjects } from "../base.diff.ts";
+import {
+  diffPrivileges,
+  groupPrivilegesByGrantable,
+} from "../base.privilege-diff.ts";
+import type { Role } from "../role/role.model.ts";
+import type { Table } from "../table/table.model.ts";
+import { hasNonAlterableChanges } from "../utils.ts";
+import {
+  AlterSequenceSetOptions,
+  AlterSequenceSetOwnedBy,
+} from "./changes/sequence.alter.ts";
+import {
+  CreateCommentOnSequence,
+  DropCommentOnSequence,
+} from "./changes/sequence.comment.ts";
+import { CreateSequence } from "./changes/sequence.create.ts";
+import { DropSequence } from "./changes/sequence.drop.ts";
+import {
+  GrantSequencePrivileges,
+  RevokeGrantOptionSequencePrivileges,
+  RevokeSequencePrivileges,
+} from "./changes/sequence.privilege.ts";
+import type { SequenceChange } from "./changes/sequence.types.ts";
+import type { Sequence } from "./sequence.model.ts";
+
+/**
+ * Diff two sets of sequences from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The sequences in the main catalog.
+ * @param branch - The sequences in the branch catalog.
+ * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffSequences(
+  ctx: {
+    version: number;
+    currentUser: string;
+    defaultPrivilegeState: DefaultPrivilegeState;
+    mainRoles: Record<string, Role>;
+  },
+  main: Record<string, Sequence>,
+  branch: Record<string, Sequence>,
+  branchTables: Record<string, Table> = {},
+): SequenceChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: SequenceChange[] = [];
+
+  for (const sequenceId of created) {
+    const createdSeq = branch[sequenceId];
+    changes.push(new CreateSequence({ sequence: createdSeq }));
+    if (createdSeq.comment !== null) {
+      changes.push(new CreateCommentOnSequence({ sequence: createdSeq }));
+    }
+    // If the created sequence is OWNED BY a column, emit an ALTER to set it
+    if (
+      createdSeq.owned_by_schema !== null &&
+      createdSeq.owned_by_table !== null &&
+      createdSeq.owned_by_column !== null
+    ) {
+      changes.push(
+        new AlterSequenceSetOwnedBy({
+          sequence: createdSeq,
+          ownedBy: {
+            schema: createdSeq.owned_by_schema,
+            table: createdSeq.owned_by_table,
+            column: createdSeq.owned_by_column,
+          } as { schema: string; table: string; column: string },
+        }),
+      );
+    }
+
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+      ctx.currentUser,
+      "sequence",
+      createdSeq.schema ?? "",
+    );
+    const desiredPrivileges = createdSeq.privileges;
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the sequence owner as the reference.
+    // Superuser privileges are filtered inside diffPrivileges.
+    const privilegeResults = diffPrivileges(
+      effectiveDefaults,
+      desiredPrivileges,
+      createdSeq.owner,
+      ctx.mainRoles,
+    );
+
+    // Generate grant changes
+    for (const [grantee, result] of privilegeResults) {
+      if (result.grants.length > 0) {
+        const grantGroups = groupPrivilegesByGrantable(result.grants);
+        for (const [grantable, list] of grantGroups) {
+          void grantable;
+          changes.push(
+            new GrantSequencePrivileges({
+              sequence: createdSeq,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke changes
+      if (result.revokes.length > 0) {
+        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+        for (const [grantable, list] of revokeGroups) {
+          void grantable;
+          changes.push(
+            new RevokeSequencePrivileges({
+              sequence: createdSeq,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke grant option changes
+      if (result.revokeGrantOption.length > 0) {
+        changes.push(
+          new RevokeGrantOptionSequencePrivileges({
+            sequence: createdSeq,
+            grantee,
+            privilegeNames: result.revokeGrantOption,
+            version: ctx.version,
+          }),
+        );
+      }
+    }
+  }
+
+  for (const sequenceId of dropped) {
+    const sequence = main[sequenceId];
+    // Skip generating DROP SEQUENCE if the sequence is owned by a table that's being dropped.
+    // PostgreSQL automatically drops sequences owned by tables when the table is dropped,
+    // so generating DROP SEQUENCE would cause an error (sequence doesn't exist).
+    if (
+      sequence.owned_by_schema &&
+      sequence.owned_by_table &&
+      sequence.owned_by_column
+    ) {
+      const ownedByTableId = `table:${sequence.owned_by_schema}.${sequence.owned_by_table}`;
+      // If the owning table doesn't exist in branch catalog, it's being dropped
+      // and will auto-drop this sequence, so skip generating DROP SEQUENCE
+      if (!(ownedByTableId in branchTables)) {
+        continue;
+      }
+    }
+    changes.push(new DropSequence({ sequence }));
+  }
+
+  for (const sequenceId of altered) {
+    const mainSequence = main[sequenceId];
+    const branchSequence = branch[sequenceId];
+
+    // Check if non-alterable properties have changed
+    // These require dropping and recreating the sequence
+    const NON_ALTERABLE_FIELDS: Array<keyof Sequence> = [
+      "data_type",
+      "persistence",
+    ];
+    const nonAlterablePropsChanged = hasNonAlterableChanges(
+      mainSequence,
+      branchSequence,
+      NON_ALTERABLE_FIELDS,
+    );
+
+    if (nonAlterablePropsChanged) {
+      // Replace the entire sequence (drop + create)
+      changes.push(
+        new DropSequence({ sequence: mainSequence }),
+        new CreateSequence({ sequence: branchSequence }),
+      );
+      // Re-apply OWNED BY if present on branch
+      if (
+        branchSequence.owned_by_schema !== null &&
+        branchSequence.owned_by_table !== null &&
+        branchSequence.owned_by_column !== null
+      ) {
+        changes.push(
+          new AlterSequenceSetOwnedBy({
+            sequence: branchSequence,
+            ownedBy: {
+              schema: branchSequence.owned_by_schema,
+              table: branchSequence.owned_by_table,
+              column: branchSequence.owned_by_column,
+            } as { schema: string; table: string; column: string },
+          }),
+        );
+      } else if (
+        mainSequence.owned_by_schema !== null ||
+        mainSequence.owned_by_table !== null ||
+        mainSequence.owned_by_column !== null
+      ) {
+        // If main had ownership but branch removed it, emit OWNED BY NONE
+        changes.push(
+          new AlterSequenceSetOwnedBy({
+            sequence: mainSequence,
+            ownedBy: null,
+          }),
+        );
+      }
+    } else {
+      // Only alterable properties changed - emit ALTER for options/owner
+      const optionsChanged =
+        mainSequence.increment !== branchSequence.increment ||
+        mainSequence.minimum_value !== branchSequence.minimum_value ||
+        mainSequence.maximum_value !== branchSequence.maximum_value ||
+        mainSequence.start_value !== branchSequence.start_value ||
+        mainSequence.cache_size !== branchSequence.cache_size ||
+        mainSequence.cycle_option !== branchSequence.cycle_option;
+
+      if (optionsChanged) {
+        const options: string[] = [];
+        if (mainSequence.increment !== branchSequence.increment) {
+          options.push("INCREMENT BY", String(branchSequence.increment));
+        }
+        if (mainSequence.minimum_value !== branchSequence.minimum_value) {
+          const defaultMin = BigInt(1);
+          if (branchSequence.minimum_value === defaultMin) {
+            options.push("NO MINVALUE");
+          } else {
+            options.push("MINVALUE", branchSequence.minimum_value.toString());
+          }
+        }
+        if (mainSequence.maximum_value !== branchSequence.maximum_value) {
+          const defaultMax =
+            branchSequence.data_type === "integer"
+              ? BigInt("2147483647")
+              : BigInt("9223372036854775807");
+          if (branchSequence.maximum_value === defaultMax) {
+            options.push("NO MAXVALUE");
+          } else {
+            options.push("MAXVALUE", branchSequence.maximum_value.toString());
+          }
+        }
+        if (mainSequence.start_value !== branchSequence.start_value) {
+          options.push("START WITH", String(branchSequence.start_value));
+        }
+        if (mainSequence.cache_size !== branchSequence.cache_size) {
+          options.push("CACHE", String(branchSequence.cache_size));
+        }
+        if (mainSequence.cycle_option !== branchSequence.cycle_option) {
+          options.push(branchSequence.cycle_option ? "CYCLE" : "NO CYCLE");
+        }
+        changes.push(
+          new AlterSequenceSetOptions({ sequence: mainSequence, options }),
+        );
+      }
+
+      const ownedByChanged =
+        mainSequence.owned_by_schema !== branchSequence.owned_by_schema ||
+        mainSequence.owned_by_table !== branchSequence.owned_by_table ||
+        mainSequence.owned_by_column !== branchSequence.owned_by_column;
+
+      if (ownedByChanged) {
+        const ownedBy =
+          branchSequence.owned_by_schema &&
+          branchSequence.owned_by_table &&
+          branchSequence.owned_by_column
+            ? {
+                schema: branchSequence.owned_by_schema,
+                table: branchSequence.owned_by_table,
+                column: branchSequence.owned_by_column,
+              }
+            : null;
+        changes.push(
+          new AlterSequenceSetOwnedBy({ sequence: mainSequence, ownedBy }),
+        );
+      }
+
+      // COMMENT
+      if (mainSequence.comment !== branchSequence.comment) {
+        if (branchSequence.comment === null) {
+          changes.push(new DropCommentOnSequence({ sequence: mainSequence }));
+        } else {
+          changes.push(
+            new CreateCommentOnSequence({ sequence: branchSequence }),
+          );
+        }
+      }
+
+      // PRIVILEGES
+      // Filter out owner privileges - owner always has ALL privileges implicitly
+      // and shouldn't be compared. Use branch owner as the reference.
+      // Superuser privileges are filtered inside diffPrivileges.
+      const privilegeResults = diffPrivileges(
+        mainSequence.privileges,
+        branchSequence.privileges,
+        branchSequence.owner,
+        ctx.mainRoles,
+      );
+
+      for (const [grantee, result] of privilegeResults) {
+        // Generate grant changes
+        if (result.grants.length > 0) {
+          const grantGroups = groupPrivilegesByGrantable(result.grants);
+          for (const [grantable, list] of grantGroups) {
+            void grantable;
+            changes.push(
+              new GrantSequencePrivileges({
+                sequence: branchSequence,
+                grantee,
+                privileges: list,
+                version: ctx.version,
+              }),
+            );
+          }
+        }
+
+        // Generate revoke changes
+        if (result.revokes.length > 0) {
+          const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+          for (const [grantable, list] of revokeGroups) {
+            void grantable;
+            changes.push(
+              new RevokeSequencePrivileges({
+                sequence: mainSequence,
+                grantee,
+                privileges: list,
+                version: ctx.version,
+              }),
+            );
+          }
+        }
+
+        // Generate revoke grant option changes
+        if (result.revokeGrantOption.length > 0) {
+          changes.push(
+            new RevokeGrantOptionSequencePrivileges({
+              sequence: mainSequence,
+              grantee,
+              privilegeNames: result.revokeGrantOption,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
+      // But since our Sequence model uses 'name' as the identity field,
+      // a name change would be handled as drop + create by diffObjects()
+    }
+  }
+
+  return changes;
+}