@supabase/pg-delta 1.0.0-alpha.21 → 1.0.0-alpha.23

package/src/core/objects/subscription/changes/subscription.security-label.ts

@@ -0,0 +1,95 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Subscription } from "../subscription.model.ts";
+import {
+  CreateSubscriptionChange,
+  DropSubscriptionChange,
+} from "./subscription.base.ts";
+
+export type SecurityLabelSubscription =
+  | CreateSecurityLabelOnSubscription
+  | DropSecurityLabelOnSubscription;
+
+export class CreateSecurityLabelOnSubscription extends CreateSubscriptionChange {
+  public readonly subscription: Subscription;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    subscription: Subscription;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.subscription = props.subscription;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(
+        this.subscription.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [this.subscription.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SUBSCRIPTION",
+      this.subscription.name,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnSubscription extends DropSubscriptionChange {
+  public readonly subscription: Subscription;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    subscription: Subscription;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.subscription = props.subscription;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(
+        this.subscription.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(
+        this.subscription.stableId,
+        this.securityLabel.provider,
+      ),
+      this.subscription.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SUBSCRIPTION",
+      this.subscription.name,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/subscription/changes/subscription.types.ts

@@ -9,6 +9,7 @@ import type {
 import type { CommentSubscription } from "./subscription.comment.ts";
 import type { CreateSubscription } from "./subscription.create.ts";
 import type { DropSubscription } from "./subscription.drop.ts";
+import type { SecurityLabelSubscription } from "./subscription.security-label.ts";
 
 /** Union of all subscription-related change variants (`objectType: "subscription"`). @category Change Types */
 export type SubscriptionChange =
@@ -20,4 +21,5 @@ export type SubscriptionChange =
   | AlterSubscriptionDisable
   | AlterSubscriptionSetOptions
   | AlterSubscriptionSetOwner
-  | CommentSubscription;
+  | CommentSubscription
+  | SecurityLabelSubscription;

package/src/core/objects/subscription/subscription.diff.ts

@@ -1,5 +1,6 @@
 import { diffObjects } from "../base.diff.ts";
 import type { ObjectDiffContext } from "../diff-context.ts";
+import { diffSecurityLabels } from "../security-label.types.ts";
 import { hasNonAlterableChanges } from "../utils.ts";
 import {
   AlterSubscriptionDisable,
@@ -15,6 +16,10 @@ import {
 } from "./changes/subscription.comment.ts";
 import { CreateSubscription } from "./changes/subscription.create.ts";
 import { DropSubscription } from "./changes/subscription.drop.ts";
+import {
+  CreateSecurityLabelOnSubscription,
+  DropSecurityLabelOnSubscription,
+} from "./changes/subscription.security-label.ts";
 import type { SubscriptionChange } from "./changes/subscription.types.ts";
 import type { Subscription } from "./subscription.model.ts";
 import type { SubscriptionSettableOption } from "./utils.ts";
@@ -61,6 +66,14 @@ export function diffSubscriptions(
     if (subscription.comment !== null) {
       changes.push(new CreateCommentOnSubscription({ subscription }));
     }
+    for (const label of subscription.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnSubscription({
+          subscription,
+          securityLabel: label,
+        }),
+      );
+    }
   }
 
   for (const id of dropped) {
@@ -236,6 +249,26 @@ export function diffSubscriptions(
         );
       }
     }
+
+    // SECURITY LABELS
+    changes.push(
+      ...diffSecurityLabels<
+        CreateSecurityLabelOnSubscription | DropSecurityLabelOnSubscription
+      >(
+        mainSubscription.security_labels,
+        branchSubscription.security_labels,
+        (securityLabel) =>
+          new CreateSecurityLabelOnSubscription({
+            subscription: branchSubscription,
+            securityLabel,
+          }),
+        (securityLabel) =>
+          new DropSecurityLabelOnSubscription({
+            subscription: mainSubscription,
+            securityLabel,
+          }),
+      ),
+    );
   }
 
   return changes;

package/src/core/objects/subscription/subscription.model.ts

@@ -2,6 +2,10 @@ import type { Pool } from "pg";
 import z from "zod";
 import { extractVersion } from "../../context.ts";
 import { BasePgModel } from "../base.model.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
 
 const subscriptionPropsSchema = z.object({
   name: z.string(),
@@ -23,6 +27,7 @@ const subscriptionPropsSchema = z.object({
   synchronous_commit: z.string(),
   publications: z.array(z.string()),
   origin: z.enum(["any", "none"]),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 
 export type SubscriptionProps = z.infer<typeof subscriptionPropsSchema>;
@@ -47,6 +52,7 @@ export class Subscription extends BasePgModel {
   public readonly synchronous_commit: SubscriptionProps["synchronous_commit"];
   public readonly publications: SubscriptionProps["publications"];
   public readonly origin: SubscriptionProps["origin"];
+  public readonly security_labels: SecurityLabelProps[];
 
   constructor(props: SubscriptionProps) {
     super();
@@ -72,6 +78,7 @@ export class Subscription extends BasePgModel {
       a.localeCompare(b),
     );
     this.origin = props.origin;
+    this.security_labels = props.security_labels ?? [];
   }
 
   get stableId(): `subscription:${string}` {
@@ -104,6 +111,7 @@ export class Subscription extends BasePgModel {
       synchronous_commit: this.synchronous_commit,
       publications: this.publications,
       origin: this.origin,
+      security_labels: this.security_labels,
     };
   }
 }
@@ -173,7 +181,20 @@ export async function extractSubscriptions(
           ),
           '[]'::json
         ) as publications,
-        ${originExpr} as origin
+        ${originExpr} as origin,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = s.oid
+              and sl.classoid = 'pg_subscription'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
       from scoped_subscriptions s
       left join pg_replication_slots r
         on r.slot_name = s.subslotname

package/src/core/objects/table/changes/table.alter.test.ts

@@ -343,7 +343,7 @@ describe.concurrent("table", () => {
       ).toBe("ALTER TABLE public.test_table REPLICA IDENTITY FULL");
     });
 
-    test("replica identity DEFAULT and INDEX fallback", async () => {
+    test("replica identity DEFAULT and USING INDEX", async () => {
       const baseProps: Omit<
         TableProps,
         "owner" | "options" | "replica_identity"
@@ -372,31 +372,23 @@ describe.concurrent("table", () => {
         options: null,
         replica_identity: "n",
       });
-      const toDefault = new Table({
-        ...baseProps,
-        owner: "o1",
-        options: null,
-        replica_identity: "d",
-      });
-      const toIndex = new Table({
-        ...baseProps,
-        owner: "o1",
-        options: null,
-        replica_identity: "i",
-      });
       expect(
         new AlterTableSetReplicaIdentity({
           table,
-          mode: toDefault.replica_identity,
-        }).serialize(),
-      ).toBe("ALTER TABLE public.test_table REPLICA IDENTITY DEFAULT");
-      // AlterTableSetReplicaIdentity of type "i" will not be emitted in diff, it is handled by index changes, we fallback to DEFAULT here
-      expect(
-        new AlterTableSetReplicaIdentity({
-          table,
-          mode: toIndex.replica_identity,
+          mode: "d",
         }).serialize(),
       ).toBe("ALTER TABLE public.test_table REPLICA IDENTITY DEFAULT");
+      const usingIndex = new AlterTableSetReplicaIdentity({
+        table,
+        mode: "i",
+        indexName: "test_table_pkey",
+      });
+      expect(usingIndex.serialize()).toBe(
+        "ALTER TABLE public.test_table REPLICA IDENTITY USING INDEX test_table_pkey",
+      );
+      expect(usingIndex.requires).toContain(
+        "index:public.test_table.test_table_pkey",
+      );
     });
 
     test("columns add/drop/alter", async () => {

package/src/core/objects/table/changes/table.alter.ts

@@ -462,20 +462,46 @@ export class AlterTableValidateConstraint extends AlterTableChange {
 
 /**
  * ALTER TABLE ... REPLICA IDENTITY ...
+ *
+ * When `mode === "i"` (USING INDEX), `indexName` is the name of the index to
+ * use. The extractor populates `Table.replica_identity_index` from
+ * `pg_index.indisreplident` whenever `Table.replica_identity` is `'i'`, so
+ * callers that source their props from a `Table` instance can rely on the
+ * pair being consistent. The non-null assertions in `requires` / `serialize`
+ * below are justified by that data invariant — the same pattern the FK
+ * branch of `AlterTableAddConstraint` uses for `foreign_key_columns!` /
+ * `foreign_key_table!` / `foreign_key_schema!`.
  */
 export class AlterTableSetReplicaIdentity extends AlterTableChange {
   public readonly table: Table;
   public readonly mode: "d" | "n" | "f" | "i";
+  public readonly indexName: string | null;
   public readonly scope = "object" as const;
 
-  constructor(props: { table: Table; mode: "d" | "n" | "f" | "i" }) {
+  constructor(props: {
+    table: Table;
+    mode: "d" | "n" | "f" | "i";
+    indexName?: string | null;
+  }) {
     super();
     this.table = props.table;
     this.mode = props.mode;
+    this.indexName = props.indexName ?? null;
   }
 
   get requires() {
-    return [this.table.stableId];
+    const reqs: string[] = [this.table.stableId];
+    if (this.mode === "i") {
+      reqs.push(
+        stableId.index(
+          this.table.schema,
+          this.table.name,
+          // biome-ignore lint/style/noNonNullAssertion: mode 'i' implies the extractor populated replica_identity_index
+          this.indexName!,
+        ),
+      );
+    }
+    return reqs;
   }
 
   serialize(_options?: SerializeOptions): string {
@@ -486,7 +512,8 @@ export class AlterTableSetReplicaIdentity extends AlterTableChange {
           ? "NOTHING"
           : this.mode === "f"
             ? "FULL"
-            : "DEFAULT"; // 'i' (USING INDEX) is handled via index changes; fallback to DEFAULT
+            : // biome-ignore lint/style/noNonNullAssertion: mode 'i' implies the extractor populated replica_identity_index
+              `USING INDEX ${this.indexName!}`;
     return [
       "ALTER TABLE",
       `${this.table.schema}.${this.table.name}`,

package/src/core/objects/table/changes/table.base.ts

@@ -3,7 +3,11 @@ import type { Table } from "../table.model.ts";
 
 abstract class BaseTableChange extends BaseChange {
   abstract readonly table: Table;
-  abstract readonly scope: "object" | "comment" | "privilege";
+  abstract readonly scope:
+    | "object"
+    | "comment"
+    | "privilege"
+    | "security_label";
   readonly objectType: "table" = "table";
 }
 

package/src/core/objects/table/changes/table.security-label.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import type { ColumnProps } from "../../base.model.ts";
+import { stableId } from "../../utils.ts";
+import { Table, type TableProps } from "../table.model.ts";
+import {
+  CreateSecurityLabelOnColumn,
+  CreateSecurityLabelOnTable,
+  DropSecurityLabelOnColumn,
+  DropSecurityLabelOnTable,
+} from "./table.security-label.ts";
+
+const makeColumn = (overrides: Partial<ColumnProps> = {}): ColumnProps => ({
+  name: "id",
+  position: 1,
+  data_type: "integer",
+  data_type_str: "integer",
+  is_custom_type: false,
+  custom_type_type: null,
+  custom_type_category: null,
+  custom_type_schema: null,
+  custom_type_name: null,
+  not_null: false,
+  is_identity: false,
+  is_identity_always: false,
+  is_generated: false,
+  collation: null,
+  default: null,
+  comment: null,
+  ...overrides,
+});
+
+const makeTable = (): Table =>
+  new Table({
+    schema: "public",
+    name: "users",
+    persistence: "p",
+    row_security: false,
+    force_row_security: false,
+    has_indexes: false,
+    has_rules: false,
+    has_triggers: false,
+    has_subclasses: false,
+    is_populated: true,
+    replica_identity: "d",
+    is_partition: false,
+    options: null,
+    partition_bound: null,
+    partition_by: null,
+    owner: "postgres",
+    comment: null,
+    parent_schema: null,
+    parent_name: null,
+    columns: [makeColumn({ name: "email" })],
+    privileges: [],
+    security_labels: [],
+  } as TableProps);
+
+describe("table.security-label", () => {
+  test("table create serializes and tracks dependencies", async () => {
+    const table = makeTable();
+    const change = new CreateSecurityLabelOnTable({
+      table,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+
+    expect(change.scope).toBe("security_label");
+    expect(change.objectType).toBe("table");
+    expect(change.operation).toBe("create");
+    expect(change.creates).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([table.stableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON TABLE public.users IS 'classified'",
+    );
+  });
+
+  test("table drop serializes to IS NULL", async () => {
+    const table = makeTable();
+    const change = new DropSecurityLabelOnTable({
+      table,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+    expect(change.drops).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+      table.stableId,
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON TABLE public.users IS NULL",
+    );
+  });
+
+  test("column create serializes and tracks dependencies", async () => {
+    const table = makeTable();
+    const column = makeColumn({ name: "email" });
+    const change = new CreateSecurityLabelOnColumn({
+      table,
+      column,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+
+    const colStableId = stableId.column(table.schema, table.name, column.name);
+    expect(change.creates).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([colStableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON COLUMN public.users.email IS 'classified'",
+    );
+  });
+
+  test("column drop serializes to IS NULL", async () => {
+    const table = makeTable();
+    const column = makeColumn({ name: "email" });
+    const change = new DropSecurityLabelOnColumn({
+      table,
+      column,
+      securityLabel: { provider: "dummy", label: "x" },
+    });
+    const colStableId = stableId.column(table.schema, table.name, column.name);
+    expect(change.drops).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+      colStableId,
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON COLUMN public.users.email IS NULL",
+    );
+  });
+});

package/src/core/objects/table/changes/table.security-label.ts

@@ -0,0 +1,183 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { ColumnProps } from "../../base.model.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Table } from "../table.model.ts";
+import { CreateTableChange, DropTableChange } from "./table.base.ts";
+
+export type SecurityLabelTable =
+  | CreateSecurityLabelOnTable
+  | DropSecurityLabelOnTable
+  | CreateSecurityLabelOnColumn
+  | DropSecurityLabelOnColumn;
+
+/**
+ * SECURITY LABEL FOR <provider> ON TABLE <schema>.<table> IS <literal>
+ */
+export class CreateSecurityLabelOnTable extends CreateTableChange {
+  public readonly table: Table;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { table: Table; securityLabel: SecurityLabelProps }) {
+    super();
+    this.table = props.table;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [this.table.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TABLE",
+      `${this.table.schema}.${this.table.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnTable extends DropTableChange {
+  public readonly table: Table;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { table: Table; securityLabel: SecurityLabelProps }) {
+    super();
+    this.table = props.table;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+      this.table.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TABLE",
+      `${this.table.schema}.${this.table.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}
+
+/**
+ * SECURITY LABEL FOR <provider> ON COLUMN <schema>.<table>.<column> IS <literal>
+ */
+export class CreateSecurityLabelOnColumn extends CreateTableChange {
+  public readonly table: Table;
+  public readonly column: ColumnProps;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    table: Table;
+    column: ColumnProps;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.table = props.table;
+    this.column = props.column;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.column(this.table.schema, this.table.name, this.column.name),
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON COLUMN",
+      `${this.table.schema}.${this.table.name}.${this.column.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnColumn extends DropTableChange {
+  public readonly table: Table;
+  public readonly column: ColumnProps;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    table: Table;
+    column: ColumnProps;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.table = props.table;
+    this.column = props.column;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+      columnStableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON COLUMN",
+      `${this.table.schema}.${this.table.name}.${this.column.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/table/changes/table.types.ts

@@ -3,6 +3,7 @@ import type { CommentTable } from "./table.comment.ts";
 import type { CreateTable } from "./table.create.ts";
 import type { DropTable } from "./table.drop.ts";
 import type { TablePrivilege } from "./table.privilege.ts";
+import type { SecurityLabelTable } from "./table.security-label.ts";
 
 /** Union of all table-related change variants (`objectType: "table"`). @category Change Types */
 export type TableChange =
@@ -10,4 +11,5 @@ export type TableChange =
   | CommentTable
   | CreateTable
   | DropTable
-  | TablePrivilege;
+  | TablePrivilege
+  | SecurityLabelTable;