@supabase/pg-delta 1.0.0-alpha.21 → 1.0.0-alpha.23

package/src/core/objects/security-label.types.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, test } from "bun:test";
+import {
+  diffSecurityLabels,
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "./security-label.types.ts";
+
+describe("securityLabelPropsSchema", () => {
+  test("parses valid props", () => {
+    const parsed = securityLabelPropsSchema.parse({
+      provider: "p",
+      label: "l",
+    });
+    expect(parsed).toEqual({ provider: "p", label: "l" });
+  });
+
+  test("rejects null provider", () => {
+    expect(() =>
+      securityLabelPropsSchema.parse({ provider: null, label: "l" }),
+    ).toThrow();
+  });
+
+  test("rejects null label", () => {
+    expect(() =>
+      securityLabelPropsSchema.parse({ provider: "p", label: null }),
+    ).toThrow();
+  });
+});
+
+describe("diffSecurityLabels", () => {
+  type Change = { kind: "create" | "drop" } & SecurityLabelProps;
+  const makeCreate = (p: SecurityLabelProps): Change => ({
+    kind: "create",
+    ...p,
+  });
+  const makeDrop = (p: SecurityLabelProps): Change => ({
+    kind: "drop",
+    ...p,
+  });
+
+  test("both empty → no changes", () => {
+    expect(diffSecurityLabels([], [], makeCreate, makeDrop)).toEqual([]);
+  });
+
+  test("added providers emit create", () => {
+    expect(
+      diffSecurityLabels(
+        [],
+        [{ provider: "a", label: "x" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "create", provider: "a", label: "x" }]);
+  });
+
+  test("removed providers emit drop", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "x" }],
+        [],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "drop", provider: "a", label: "x" }]);
+  });
+
+  test("changed label emits create (overwrite semantics)", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "old" }],
+        [{ provider: "a", label: "new" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "create", provider: "a", label: "new" }]);
+  });
+
+  test("unchanged label emits nothing", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "x" }],
+        [{ provider: "a", label: "x" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([]);
+  });
+
+  test("mixed add/remove/change/unchanged across providers, sorted by provider", () => {
+    const main = [
+      { provider: "a", label: "stay" },
+      { provider: "b", label: "old" },
+      { provider: "c", label: "remove" },
+    ];
+    const branch = [
+      { provider: "a", label: "stay" },
+      { provider: "b", label: "new" },
+      { provider: "d", label: "add" },
+    ];
+    expect(diffSecurityLabels(main, branch, makeCreate, makeDrop)).toEqual([
+      { kind: "create", provider: "b", label: "new" },
+      { kind: "drop", provider: "c", label: "remove" },
+      { kind: "create", provider: "d", label: "add" },
+    ]);
+  });
+});

package/src/core/objects/security-label.types.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+
+export const securityLabelPropsSchema = z.object({
+  provider: z.string(),
+  label: z.string(),
+});
+
+export type SecurityLabelProps = z.infer<typeof securityLabelPropsSchema>;
+
+export function normalizeSecurityLabels(
+  labels: readonly SecurityLabelProps[],
+): SecurityLabelProps[] {
+  return [...labels].sort((a, b) => a.provider.localeCompare(b.provider));
+}
+
+/**
+ * Pure helper: compares two arrays of security labels keyed by provider and
+ * returns a deterministic list of create/drop changes.
+ *
+ * - Labels present only on `branch` → emit create (via makeCreate).
+ * - Labels present only on `main` → emit drop (via makeDrop).
+ * - Labels with differing `label` under the same provider → emit create
+ *   (PostgreSQL's SECURITY LABEL … IS '…' overwrites, so no separate alter).
+ * - Unchanged labels → nothing.
+ *
+ * Output order: by provider ascending.
+ */
+export function diffSecurityLabels<C>(
+  main: readonly SecurityLabelProps[],
+  branch: readonly SecurityLabelProps[],
+  makeCreate: (props: SecurityLabelProps) => C,
+  makeDrop: (props: SecurityLabelProps) => C,
+): C[] {
+  const mainByProvider = new Map(main.map((l) => [l.provider, l.label]));
+  const branchByProvider = new Map(branch.map((l) => [l.provider, l.label]));
+
+  const providers = new Set<string>([
+    ...mainByProvider.keys(),
+    ...branchByProvider.keys(),
+  ]);
+  const sortedProviders = [...providers].sort();
+
+  const out: C[] = [];
+  for (const provider of sortedProviders) {
+    const mainLabel = mainByProvider.get(provider);
+    const branchLabel = branchByProvider.get(provider);
+
+    if (mainLabel === undefined && branchLabel !== undefined) {
+      out.push(makeCreate({ provider, label: branchLabel }));
+    } else if (mainLabel !== undefined && branchLabel === undefined) {
+      out.push(makeDrop({ provider, label: mainLabel }));
+    } else if (
+      mainLabel !== undefined &&
+      branchLabel !== undefined &&
+      mainLabel !== branchLabel
+    ) {
+      out.push(makeCreate({ provider, label: branchLabel }));
+    }
+  }
+  return out;
+}

package/src/core/objects/sequence/changes/sequence.base.ts

@@ -3,7 +3,11 @@ import type { Sequence } from "../sequence.model.ts";
 
 abstract class BaseSequenceChange extends BaseChange {
   abstract readonly sequence: Sequence;
-  abstract readonly scope: "object" | "comment" | "privilege";
+  abstract readonly scope:
+    | "object"
+    | "comment"
+    | "privilege"
+    | "security_label";
   readonly objectType: "sequence" = "sequence";
 }
 

package/src/core/objects/sequence/changes/sequence.security-label.test.ts

@@ -0,0 +1,58 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { stableId } from "../../utils.ts";
+import { Sequence, type SequenceProps } from "../sequence.model.ts";
+import {
+  CreateSecurityLabelOnSequence,
+  DropSecurityLabelOnSequence,
+} from "./sequence.security-label.ts";
+
+const makeSequence = (): Sequence =>
+  new Sequence({
+    schema: "public",
+    name: "s1",
+    data_type: "bigint",
+    start_value: 1,
+    minimum_value: BigInt(1),
+    maximum_value: BigInt("9223372036854775807"),
+    increment: 1,
+    cycle_option: false,
+    cache_size: 1,
+    persistence: "p",
+    owned_by_schema: null,
+    owned_by_table: null,
+    owned_by_column: null,
+    comment: null,
+    privileges: [],
+    owner: "postgres",
+  } as SequenceProps);
+
+describe("sequence.security-label", () => {
+  test("create serializes", async () => {
+    const sequence = makeSequence();
+    const change = new CreateSecurityLabelOnSequence({
+      sequence,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+    expect(change.scope).toBe("security_label");
+    expect(change.creates).toEqual([
+      stableId.securityLabel(sequence.stableId, "dummy"),
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON SEQUENCE public.s1 IS 'classified'",
+    );
+  });
+
+  test("drop serializes to IS NULL", async () => {
+    const sequence = makeSequence();
+    const change = new DropSecurityLabelOnSequence({
+      sequence,
+      securityLabel: { provider: "dummy", label: "x" },
+    });
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON SEQUENCE public.s1 IS NULL",
+    );
+  });
+});

package/src/core/objects/sequence/changes/sequence.security-label.ts

@@ -0,0 +1,92 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Sequence } from "../sequence.model.ts";
+import { CreateSequenceChange, DropSequenceChange } from "./sequence.base.ts";
+
+export type SecurityLabelSequence =
+  | CreateSecurityLabelOnSequence
+  | DropSecurityLabelOnSequence;
+
+export class CreateSecurityLabelOnSequence extends CreateSequenceChange {
+  public readonly sequence: Sequence;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    sequence: Sequence;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.sequence = props.sequence;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(
+        this.sequence.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [this.sequence.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SEQUENCE",
+      `${this.sequence.schema}.${this.sequence.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnSequence extends DropSequenceChange {
+  public readonly sequence: Sequence;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    sequence: Sequence;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.sequence = props.sequence;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(
+        this.sequence.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(
+        this.sequence.stableId,
+        this.securityLabel.provider,
+      ),
+      this.sequence.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SEQUENCE",
+      `${this.sequence.schema}.${this.sequence.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/sequence/changes/sequence.types.ts

@@ -3,6 +3,7 @@ import type { CommentSequence } from "./sequence.comment.ts";
 import type { CreateSequence } from "./sequence.create.ts";
 import type { DropSequence } from "./sequence.drop.ts";
 import type { SequencePrivilege } from "./sequence.privilege.ts";
+import type { SecurityLabelSequence } from "./sequence.security-label.ts";
 
 /** Union of all sequence-related change variants (`objectType: "sequence"`). @category Change Types */
 export type SequenceChange =
@@ -10,4 +11,5 @@ export type SequenceChange =
   | CommentSequence
   | CreateSequence
   | DropSequence
-  | SequencePrivilege;
+  | SequencePrivilege
+  | SecurityLabelSequence;

package/src/core/objects/sequence/sequence.diff.test.ts

@@ -327,6 +327,93 @@ describe.concurrent("sequence.diff", () => {
     expect(changes).toHaveLength(0);
   });
 
+  test("recreate same-name sequence when owning table is renamed away", () => {
+    // Reproduces issue #228 case 1: a SERIAL column's table is renamed
+    // (`old_table` → `new_table`). The sequence keeps the same name
+    // (`old_table_id_seq`) but its OWNED BY now points at `new_table.id`.
+    // PostgreSQL cascade-drops the sequence with the old table, so a later
+    // CREATE TABLE that references `old_table_id_seq` fails. The diff must
+    // emit CreateSequence (and skip the explicit DropSequence to avoid an
+    // unbreakable cycle with the DropTable).
+    const tableColumn = {
+      name: "id",
+      position: 1,
+      data_type: "integer",
+      data_type_str: "integer",
+      is_custom_type: false,
+      custom_type_type: null,
+      custom_type_category: null,
+      custom_type_schema: null,
+      custom_type_name: null,
+      not_null: true,
+      is_identity: false,
+      is_identity_always: false,
+      is_generated: false,
+      collation: null,
+      default: "nextval('public.old_table_id_seq'::regclass)",
+      comment: null,
+    };
+    const tableBaseProps = {
+      schema: "public",
+      persistence: "p" as const,
+      row_security: false,
+      force_row_security: false,
+      has_indexes: false,
+      has_rules: false,
+      has_triggers: false,
+      has_subclasses: false,
+      is_populated: true,
+      replica_identity: "d" as const,
+      is_partition: false,
+      options: null,
+      partition_bound: null,
+      partition_by: null,
+      owner: "test",
+      comment: null,
+      parent_schema: null,
+      parent_name: null,
+      privileges: [],
+    };
+    const oldTable = new Table({
+      ...tableBaseProps,
+      name: "old_table",
+      columns: [tableColumn],
+    });
+    const newTable = new Table({
+      ...tableBaseProps,
+      name: "new_table",
+      columns: [tableColumn],
+    });
+    const mainSequence = new Sequence({
+      ...base,
+      name: "old_table_id_seq",
+      owned_by_schema: "public",
+      owned_by_table: "old_table",
+      owned_by_column: "id",
+    });
+    const branchSequence = new Sequence({
+      ...base,
+      name: "old_table_id_seq",
+      owned_by_schema: "public",
+      owned_by_table: "new_table",
+      owned_by_column: "id",
+    });
+
+    const changes = diffSequences(
+      testContext,
+      { [mainSequence.stableId]: mainSequence },
+      { [branchSequence.stableId]: branchSequence },
+      { [newTable.stableId]: newTable },
+      { [oldTable.stableId]: oldTable },
+    );
+
+    expect(changes.some((c) => c instanceof DropSequence)).toBe(false);
+    expect(changes.some((c) => c instanceof CreateSequence)).toBe(true);
+    expect(changes.some((c) => c instanceof AlterSequenceSetOwnedBy)).toBe(
+      true,
+    );
+  });
+
   test("create with comment emits CreateCommentOnSequence", () => {
     const s = new Sequence({ ...base, comment: "my seq" });
     const changes = diffSequences(testContext, {}, { [s.stableId]: s });

package/src/core/objects/sequence/sequence.diff.ts

@@ -4,6 +4,7 @@ import {
   emitObjectPrivilegeChanges,
 } from "../base.privilege-diff.ts";
 import type { ObjectDiffContext } from "../diff-context.ts";
+import { diffSecurityLabels } from "../security-label.types.ts";
 import { AlterTableAlterColumnSetDefault } from "../table/changes/table.alter.ts";
 import type { Table } from "../table/table.model.ts";
 import { hasNonAlterableChanges } from "../utils.ts";
@@ -22,6 +23,10 @@ import {
   RevokeGrantOptionSequencePrivileges,
   RevokeSequencePrivileges,
 } from "./changes/sequence.privilege.ts";
+import {
+  CreateSecurityLabelOnSequence,
+  DropSecurityLabelOnSequence,
+} from "./changes/sequence.security-label.ts";
 import type { SequenceChange } from "./changes/sequence.types.ts";
 import type { Sequence } from "./sequence.model.ts";
 
@@ -36,6 +41,7 @@ type SequenceOrColumnSetDefaultChange =
  * @param main - The sequences in the main catalog.
  * @param branch - The sequences in the branch catalog.
  * @param branchTables - The tables in the branch catalog (used to check if owning tables are being dropped).
+ * @param mainTables - The tables in the main catalog (used to detect when a same-name sequence will be cascade-dropped because its main-side owning table is going away).
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffSequences(
@@ -46,6 +52,7 @@ export function diffSequences(
   main: Record<string, Sequence>,
   branch: Record<string, Sequence>,
   branchTables: Record<string, Table> = {},
+  mainTables: Record<string, Table> = {},
 ): SequenceOrColumnSetDefaultChange[] {
   const { created, dropped, altered } = diffObjects(main, branch);
 
@@ -57,6 +64,14 @@ export function diffSequences(
     if (createdSeq.comment !== null) {
       changes.push(new CreateCommentOnSequence({ sequence: createdSeq }));
     }
+    for (const label of createdSeq.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnSequence({
+          sequence: createdSeq,
+          securityLabel: label,
+        }),
+      );
+    }
     // If the created sequence is OWNED BY a column, emit an ALTER to set it
     if (
       createdSeq.owned_by_schema !== null &&
@@ -157,12 +172,35 @@ export function diffSequences(
       NON_ALTERABLE_FIELDS,
     );
 
-    if (nonAlterablePropsChanged) {
-      // Replace the entire sequence (drop + create)
-      changes.push(
-        new DropSequence({ sequence: mainSequence }),
-        new CreateSequence({ sequence: branchSequence }),
-      );
+    // A sequence kept the same name (so it's "altered" in catalog terms),
+    // but its main-side owning table is going away from the plan (renamed
+    // away or simply dropped). PostgreSQL will cascade-drop the sequence
+    // alongside the table, leaving any later CREATE TABLE / column-default
+    // that depends on the sequence name pointing at nothing. Treat this
+    // like a non-alterable change so we recreate the sequence after the
+    // owning table is dropped.
+    const mainOwnedByTableId =
+      mainSequence.owned_by_schema && mainSequence.owned_by_table
+        ? `table:${mainSequence.owned_by_schema}.${mainSequence.owned_by_table}`
+        : null;
+    const cascadeOrphanedByOwningTable =
+      mainOwnedByTableId !== null &&
+      mainTables[mainOwnedByTableId] !== undefined &&
+      branchTables[mainOwnedByTableId] === undefined;
+
+    if (nonAlterablePropsChanged || cascadeOrphanedByOwningTable) {
+      // When the owning table is going away in this plan, PostgreSQL will
+      // cascade-drop the sequence as part of the DROP TABLE. Emitting an
+      // explicit DROP SEQUENCE here would (a) introduce an unbreakable
+      // DropSequence ↔ DropTable cycle on the catalog edges between the
+      // sequence and the dropped column, and (b) be redundant with the
+      // cascade. The CreateSequence below restores the sequence under its
+      // original name so any same-name reference in a later CREATE TABLE
+      // resolves correctly.
+      if (!cascadeOrphanedByOwningTable) {
+        changes.push(new DropSequence({ sequence: mainSequence }));
+      }
+      changes.push(new CreateSequence({ sequence: branchSequence }));
       // Re-apply OWNED BY if present on branch
       if (
         branchSequence.owned_by_schema !== null &&
@@ -300,6 +338,26 @@ export function diffSequences(
         }
       }
 
+      // SECURITY LABELS
+      changes.push(
+        ...diffSecurityLabels<
+          CreateSecurityLabelOnSequence | DropSecurityLabelOnSequence
+        >(
+          mainSequence.security_labels,
+          branchSequence.security_labels,
+          (securityLabel) =>
+            new CreateSecurityLabelOnSequence({
+              sequence: branchSequence,
+              securityLabel,
+            }),
+          (securityLabel) =>
+            new DropSecurityLabelOnSequence({
+              sequence: mainSequence,
+              securityLabel,
+            }),
+        ),
+      );
+
       // PRIVILEGES
       // Filter out owner privileges - owner always has ALL privileges implicitly
       // and shouldn't be compared. Use branch owner as the reference.

package/src/core/objects/sequence/sequence.model.ts

@@ -6,6 +6,10 @@ import {
   type PrivilegeProps,
   privilegePropsSchema,
 } from "../base.privilege-diff.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
 
 const sequencePropsSchema = z.object({
   schema: z.string(),
@@ -24,6 +28,7 @@ const sequencePropsSchema = z.object({
   comment: z.string().nullable(),
   privileges: z.array(privilegePropsSchema),
   owner: z.string(),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 
 type SequencePrivilegeProps = PrivilegeProps;
@@ -46,6 +51,7 @@ export class Sequence extends BasePgModel {
   public readonly comment: SequenceProps["comment"];
   public readonly privileges: SequencePrivilegeProps[];
   public readonly owner: SequenceProps["owner"];
+  public readonly security_labels: SecurityLabelProps[];
 
   constructor(props: SequenceProps) {
     super();
@@ -69,6 +75,7 @@ export class Sequence extends BasePgModel {
     this.comment = props.comment;
     this.privileges = props.privileges;
     this.owner = props.owner;
+    this.security_labels = props.security_labels ?? [];
   }
 
   get stableId(): `sequence:${string}` {
@@ -98,6 +105,7 @@ export class Sequence extends BasePgModel {
       comment: this.comment,
       privileges: this.privileges,
       owner: this.owner,
+      security_labels: this.security_labels,
     };
   }
 }
@@ -151,7 +159,20 @@ select
       from lateral aclexplode(COALESCE(c.relacl, acldefault('S', c.relowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges,
-  c.relowner::regrole::text as owner
+  c.relowner::regrole::text as owner,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = c.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   pg_catalog.pg_class c
   inner join pg_catalog.pg_sequence s on s.seqrelid = c.oid

package/src/core/objects/subscription/changes/subscription.base.ts

@@ -3,7 +3,7 @@ import type { Subscription } from "../subscription.model.ts";
 
 abstract class BaseSubscriptionChange extends BaseChange {
   abstract readonly subscription: Subscription;
-  abstract readonly scope: "object" | "comment";
+  abstract readonly scope: "object" | "comment" | "security_label";
   readonly objectType = "subscription" as const;
 }