@supabase/pg-delta 1.0.0-alpha.21 → 1.0.0-alpha.23

package/src/core/objects/trigger/trigger.model.test.ts

@@ -0,0 +1,113 @@
+import { describe, expect, test } from "bun:test";
+import type { Pool } from "pg";
+import { extractTriggers, Trigger } from "./trigger.model.ts";
+
+const baseRow = {
+  schema: "public",
+  table_name: '"users"',
+  table_relkind: "r" as const,
+  function_schema: "public",
+  function_name: '"my_fn"',
+  trigger_type: 7,
+  enabled: "O" as const,
+  is_internal: false,
+  deferrable: false,
+  initially_deferred: false,
+  argument_count: 0,
+  column_numbers: null,
+  arguments: [] as string[],
+  when_condition: null,
+  old_table: null,
+  new_table: null,
+  is_partition_clone: false,
+  parent_trigger_name: null,
+  parent_table_schema: null,
+  parent_table_name: null,
+  is_on_partitioned_table: false,
+  owner: "postgres",
+  comment: null,
+};
+
+const mockPool = (rows: unknown[]): Pool =>
+  ({ query: async () => ({ rows }) }) as unknown as Pool;
+
+const mockPoolSequence = (...attempts: unknown[][]): Pool => {
+  let i = 0;
+  return {
+    query: async () => ({
+      rows: attempts[Math.min(i++, attempts.length - 1)],
+    }),
+  } as unknown as Pool;
+};
+
+const NO_BACKOFF = { backoffMs: 0 } as const;
+
+describe("extractTriggers", () => {
+  test("skips rows where pg_get_triggerdef returned NULL after exhausting retries", async () => {
+    const triggers = await extractTriggers(
+      mockPool([
+        {
+          ...baseRow,
+          name: '"good_trg"',
+          definition:
+            "CREATE TRIGGER good_trg BEFORE INSERT ON users FOR EACH ROW EXECUTE FUNCTION my_fn()",
+        },
+        { ...baseRow, name: '"orphan_trg"', definition: null },
+      ]),
+      NO_BACKOFF,
+    );
+
+    expect(triggers).toHaveLength(1);
+    expect(triggers[0]).toBeInstanceOf(Trigger);
+    expect(triggers[0]?.name).toBe('"good_trg"');
+  });
+
+  test("does not throw ZodError when the only row has a null definition", async () => {
+    await expect(
+      extractTriggers(
+        mockPool([{ ...baseRow, name: '"orphan"', definition: null }]),
+        NO_BACKOFF,
+      ),
+    ).resolves.toEqual([]);
+  });
+
+  test("returns all triggers when every row has a valid definition", async () => {
+    const triggers = await extractTriggers(
+      mockPool([
+        {
+          ...baseRow,
+          name: '"a"',
+          definition:
+            "CREATE TRIGGER a BEFORE INSERT ON users FOR EACH ROW EXECUTE FUNCTION my_fn()",
+        },
+        {
+          ...baseRow,
+          name: '"b"',
+          definition:
+            "CREATE TRIGGER b AFTER UPDATE ON users FOR EACH ROW EXECUTE FUNCTION my_fn()",
+        },
+      ]),
+      NO_BACKOFF,
+    );
+    expect(triggers.map((t) => t.name)).toEqual(['"a"', '"b"']);
+  });
+
+  test("recovers when pg_get_triggerdef is NULL on first attempt but resolved on retry", async () => {
+    const triggers = await extractTriggers(
+      mockPoolSequence(
+        [{ ...baseRow, name: '"racy_trg"', definition: null }],
+        [
+          {
+            ...baseRow,
+            name: '"racy_trg"',
+            definition:
+              "CREATE TRIGGER racy_trg BEFORE INSERT ON users FOR EACH ROW EXECUTE FUNCTION my_fn()",
+          },
+        ],
+      ),
+      { retries: 2, backoffMs: 0 },
+    );
+    expect(triggers).toHaveLength(1);
+    expect(triggers[0]?.name).toBe('"racy_trg"');
+  });
+});

package/src/core/objects/trigger/trigger.model.ts

@@ -2,6 +2,10 @@ import { sql } from "@ts-safeql/sql-tag";
 import type { Pool } from "pg";
 import z from "zod";
 import { BasePgModel } from "../base.model.ts";
+import {
+  type ExtractRetryOptions,
+  extractWithDefinitionRetry,
+} from "../extract-with-retry.ts";
 
 const TriggerEnabledSchema = z.enum([
   "O", // ORIGIN - trigger fires in "origin" and "local" replica modes
@@ -46,6 +50,15 @@ const triggerPropsSchema = z.object({
   comment: z.string().nullable(),
 });
 
+// pg_get_triggerdef(oid, pretty) can return NULL when the trigger (its
+// pg_trigger row) is dropped between catalog scan and resolution, or under
+// transient catalog state. An unreadable trigger cannot be diffed, so we
+// accept NULL here and filter the row out at extraction time rather than
+// crashing the whole catalog parse with a ZodError.
+const triggerRowSchema = triggerPropsSchema.extend({
+  definition: z.string().nullable(),
+});
+
 export type TriggerProps = z.infer<typeof triggerPropsSchema>;
 
 export class Trigger extends BasePgModel {
@@ -154,8 +167,16 @@ export class Trigger extends BasePgModel {
   }
 }
 
-export async function extractTriggers(pool: Pool): Promise<Trigger[]> {
-  const { rows: triggerRows } = await pool.query<TriggerProps>(sql`
+export async function extractTriggers(
+  pool: Pool,
+  options?: ExtractRetryOptions,
+): Promise<Trigger[]> {
+  const triggerRows = await extractWithDefinitionRetry({
+    label: "triggers",
+    options,
+    hasNullDefinition: (row) => row.definition === null,
+    query: async () => {
+      const result = await pool.query<TriggerProps>(sql`
       with extension_trigger_oids as (
         select objid
         from pg_depend d
@@ -260,9 +281,11 @@ export async function extractTriggers(pool: Pool): Promise<Trigger[]> {
 
       order by 1, 2
   `);
-  // Validate and parse each row using the Zod schema
-  const validatedRows = triggerRows.map((row: unknown) =>
-    triggerPropsSchema.parse(row),
+      return result.rows.map((row: unknown) => triggerRowSchema.parse(row));
+    },
+  });
+  const validatedRows = triggerRows.filter(
+    (row): row is TriggerProps => row.definition !== null,
   );
   return validatedRows.map((row: TriggerProps) => new Trigger(row));
 }

package/src/core/objects/type/composite-type/changes/composite-type.base.ts

@@ -3,7 +3,11 @@ import type { CompositeType } from "../composite-type.model.ts";
 
 abstract class BaseCompositeTypeChange extends BaseChange {
   abstract readonly compositeType: CompositeType;
-  abstract readonly scope: "object" | "comment" | "privilege";
+  abstract readonly scope:
+    | "object"
+    | "comment"
+    | "privilege"
+    | "security_label";
   readonly objectType: "composite_type" = "composite_type";
 }
 

package/src/core/objects/type/composite-type/changes/composite-type.security-label.ts

@@ -0,0 +1,95 @@
+import { quoteLiteral } from "../../../base.change.ts";
+import type { SecurityLabelProps } from "../../../security-label.types.ts";
+import { stableId } from "../../../utils.ts";
+import type { CompositeType } from "../composite-type.model.ts";
+import {
+  CreateCompositeTypeChange,
+  DropCompositeTypeChange,
+} from "./composite-type.base.ts";
+
+export type SecurityLabelCompositeType =
+  | CreateSecurityLabelOnCompositeType
+  | DropSecurityLabelOnCompositeType;
+
+export class CreateSecurityLabelOnCompositeType extends CreateCompositeTypeChange {
+  public readonly compositeType: CompositeType;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    compositeType: CompositeType;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.compositeType = props.compositeType;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(
+        this.compositeType.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [this.compositeType.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TYPE",
+      `${this.compositeType.schema}.${this.compositeType.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnCompositeType extends DropCompositeTypeChange {
+  public readonly compositeType: CompositeType;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    compositeType: CompositeType;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.compositeType = props.compositeType;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(
+        this.compositeType.stableId,
+        this.securityLabel.provider,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(
+        this.compositeType.stableId,
+        this.securityLabel.provider,
+      ),
+      this.compositeType.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TYPE",
+      `${this.compositeType.schema}.${this.compositeType.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/type/composite-type/changes/composite-type.types.ts

@@ -3,6 +3,7 @@ import type { CommentCompositeType } from "./composite-type.comment.ts";
 import type { CreateCompositeType } from "./composite-type.create.ts";
 import type { DropCompositeType } from "./composite-type.drop.ts";
 import type { CompositeTypePrivilege } from "./composite-type.privilege.ts";
+import type { SecurityLabelCompositeType } from "./composite-type.security-label.ts";
 
 /** Union of all composite-type-related change variants (`objectType: "composite_type"`). @category Change Types */
 export type CompositeTypeChange =
@@ -10,4 +11,5 @@ export type CompositeTypeChange =
   | CommentCompositeType
   | CreateCompositeType
   | DropCompositeType
-  | CompositeTypePrivilege;
+  | CompositeTypePrivilege
+  | SecurityLabelCompositeType;

package/src/core/objects/type/composite-type/composite-type.diff.ts

@@ -5,6 +5,7 @@ import {
   filterPublicBuiltInDefaults,
 } from "../../base.privilege-diff.ts";
 import type { ObjectDiffContext } from "../../diff-context.ts";
+import { diffSecurityLabels } from "../../security-label.types.ts";
 import { deepEqual, hasNonAlterableChanges } from "../../utils.ts";
 import {
   AlterCompositeTypeAddAttribute,
@@ -25,6 +26,10 @@ import {
   RevokeCompositeTypePrivileges,
   RevokeGrantOptionCompositeTypePrivileges,
 } from "./changes/composite-type.privilege.ts";
+import {
+  CreateSecurityLabelOnCompositeType,
+  DropSecurityLabelOnCompositeType,
+} from "./changes/composite-type.security-label.ts";
 import type { CompositeTypeChange } from "./changes/composite-type.types.ts";
 import type { CompositeType } from "./composite-type.model.ts";
 
@@ -67,6 +72,14 @@ export function diffCompositeTypes(
     if (ct.comment !== null) {
       changes.push(new CreateCommentOnCompositeType({ compositeType: ct }));
     }
+    for (const label of ct.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnCompositeType({
+          compositeType: ct,
+          securityLabel: label,
+        }),
+      );
+    }
     // Attribute comments on creation
     for (const attr of ct.columns) {
       if (attr.comment !== null) {
@@ -189,6 +202,26 @@ export function diffCompositeTypes(
         }
       }
 
+      // SECURITY LABELS
+      changes.push(
+        ...diffSecurityLabels<
+          CreateSecurityLabelOnCompositeType | DropSecurityLabelOnCompositeType
+        >(
+          mainCompositeType.security_labels,
+          branchCompositeType.security_labels,
+          (securityLabel) =>
+            new CreateSecurityLabelOnCompositeType({
+              compositeType: branchCompositeType,
+              securityLabel,
+            }),
+          (securityLabel) =>
+            new DropSecurityLabelOnCompositeType({
+              compositeType: mainCompositeType,
+              securityLabel,
+            }),
+        ),
+      );
+
       // ATTRIBUTE diffs
       const mainAttrs = new Map(
         mainCompositeType.columns.map((c) => [c.name, c]),

package/src/core/objects/type/composite-type/composite-type.model.ts

@@ -10,6 +10,11 @@ import {
   type PrivilegeProps,
   privilegePropsSchema,
 } from "../../base.privilege-diff.ts";
+import {
+  normalizeSecurityLabels,
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../../security-label.types.ts";
 import { ReplicaIdentitySchema } from "../../table/table.model.ts";
 
 const compositeTypePropsSchema = z.object({
@@ -30,6 +35,7 @@ const compositeTypePropsSchema = z.object({
   comment: z.string().nullable(),
   columns: z.array(columnPropsSchema),
   privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 
 type CompositeTypePrivilegeProps = PrivilegeProps;
@@ -53,6 +59,7 @@ export class CompositeType extends BasePgModel implements TableLikeObject {
   public readonly comment: CompositeTypeProps["comment"];
   public readonly columns: CompositeTypeProps["columns"];
   public readonly privileges: CompositeTypePrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
 
   constructor(props: CompositeTypeProps) {
     super();
@@ -77,6 +84,7 @@ export class CompositeType extends BasePgModel implements TableLikeObject {
     this.comment = props.comment;
     this.columns = props.columns;
     this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
   }
 
   get stableId(): `type:${string}` {
@@ -107,6 +115,7 @@ export class CompositeType extends BasePgModel implements TableLikeObject {
       comment: this.comment,
       columns: this.columns,
       privileges: this.privileges,
+      security_labels: this.security_labels,
     };
   }
 
@@ -131,6 +140,7 @@ export class CompositeType extends BasePgModel implements TableLikeObject {
       data: {
         ...this.dataFields,
         columns: normalizeColumns(),
+        security_labels: normalizeSecurityLabels(this.security_labels),
       },
     };
   }
@@ -165,7 +175,8 @@ export async function extractCompositeTypes(
           obj_description(c.reltype, 'pg_type') AS comment,
           c.relacl                            AS relacl,    -- used by privileges LATERAL
           c.relowner                          AS relowner,
-          c.oid                                AS oid
+          c.oid                                AS oid,
+          c.reltype                            AS reltype
         FROM pg_catalog.pg_class c
         LEFT JOIN extension_oids e ON c.reltype = e.objid
         WHERE NOT c.relnamespace::regnamespace::text LIKE ANY (ARRAY['pg\\_%', 'information\\_schema'])
@@ -189,7 +200,20 @@ export async function extractCompositeTypes(
         ct.owner,
         ct.comment,
         COALESCE(priv.privileges, '[]') AS privileges,
-        COALESCE(cols.columns, '[]')    AS columns
+        COALESCE(cols.columns, '[]')    AS columns,
+        COALESCE(
+          (
+            SELECT json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              ORDER BY sl.provider
+            )
+            FROM pg_catalog.pg_seclabel sl
+            WHERE sl.objoid = ct.reltype
+              AND sl.classoid = 'pg_type'::regclass
+              AND sl.objsubid = 0
+          ),
+          '[]'::json
+        ) AS security_labels
       FROM composite_types ct
 
       -- privileges as a per-row LATERAL subquery

package/src/core/objects/type/enum/changes/enum.base.ts

@@ -3,7 +3,11 @@ import type { Enum } from "../enum.model.ts";
 
 abstract class BaseEnumChange extends BaseChange {
   abstract readonly enum: Enum;
-  abstract readonly scope: "object" | "comment" | "privilege";
+  abstract readonly scope:
+    | "object"
+    | "comment"
+    | "privilege"
+    | "security_label";
   readonly objectType: "enum" = "enum";
 }
 

package/src/core/objects/type/enum/changes/enum.security-label.ts

@@ -0,0 +1,77 @@
+import { quoteLiteral } from "../../../base.change.ts";
+import type { SecurityLabelProps } from "../../../security-label.types.ts";
+import { stableId } from "../../../utils.ts";
+import type { Enum } from "../enum.model.ts";
+import { CreateEnumChange, DropEnumChange } from "./enum.base.ts";
+
+export type SecurityLabelEnum =
+  | CreateSecurityLabelOnEnum
+  | DropSecurityLabelOnEnum;
+
+export class CreateSecurityLabelOnEnum extends CreateEnumChange {
+  public readonly enum: Enum;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { enum: Enum; securityLabel: SecurityLabelProps }) {
+    super();
+    this.enum = props.enum;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(this.enum.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [this.enum.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TYPE",
+      `${this.enum.schema}.${this.enum.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnEnum extends DropEnumChange {
+  public readonly enum: Enum;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { enum: Enum; securityLabel: SecurityLabelProps }) {
+    super();
+    this.enum = props.enum;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(this.enum.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(this.enum.stableId, this.securityLabel.provider),
+      this.enum.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TYPE",
+      `${this.enum.schema}.${this.enum.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/type/enum/changes/enum.types.ts

@@ -3,6 +3,7 @@ import type { CommentEnum } from "./enum.comment.ts";
 import type { CreateEnum } from "./enum.create.ts";
 import type { DropEnum } from "./enum.drop.ts";
 import type { EnumPrivilege } from "./enum.privilege.ts";
+import type { SecurityLabelEnum } from "./enum.security-label.ts";
 
 /** Union of all enum-related change variants (`objectType: "enum"`). @category Change Types */
 export type EnumChange =
@@ -10,4 +11,5 @@ export type EnumChange =
   | CommentEnum
   | CreateEnum
   | DropEnum
-  | EnumPrivilege;
+  | EnumPrivilege
+  | SecurityLabelEnum;

package/src/core/objects/type/enum/enum.diff.ts

@@ -5,6 +5,7 @@ import {
   filterPublicBuiltInDefaults,
 } from "../../base.privilege-diff.ts";
 import type { ObjectDiffContext } from "../../diff-context.ts";
+import { diffSecurityLabels } from "../../security-label.types.ts";
 import {
   AlterEnumAddValue,
   AlterEnumChangeOwner,
@@ -20,6 +21,10 @@ import {
   RevokeEnumPrivileges,
   RevokeGrantOptionEnumPrivileges,
 } from "./changes/enum.privilege.ts";
+import {
+  CreateSecurityLabelOnEnum,
+  DropSecurityLabelOnEnum,
+} from "./changes/enum.security-label.ts";
 import type { EnumChange } from "./changes/enum.types.ts";
 import type { Enum } from "./enum.model.ts";
 
@@ -61,6 +66,14 @@ export function diffEnums(
     if (createdEnum.comment !== null) {
       changes.push(new CreateCommentOnEnum({ enum: createdEnum }));
     }
+    for (const label of createdEnum.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnEnum({
+          enum: createdEnum,
+          securityLabel: label,
+        }),
+      );
+    }
 
     // PRIVILEGES: For created objects, compare against default privileges state
     // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
@@ -196,6 +209,26 @@ export function diffEnums(
       }
     }
 
+    // SECURITY LABELS
+    changes.push(
+      ...diffSecurityLabels<
+        CreateSecurityLabelOnEnum | DropSecurityLabelOnEnum
+      >(
+        mainEnum.security_labels,
+        branchEnum.security_labels,
+        (securityLabel) =>
+          new CreateSecurityLabelOnEnum({
+            enum: branchEnum,
+            securityLabel,
+          }),
+        (securityLabel) =>
+          new DropSecurityLabelOnEnum({
+            enum: mainEnum,
+            securityLabel,
+          }),
+      ),
+    );
+
     // PRIVILEGES
     // Filter out PUBLIC's built-in default USAGE privilege from main catalog
     // (PostgreSQL grants it automatically, so we shouldn't compare it)

package/src/core/objects/type/enum/enum.model.ts

@@ -6,6 +6,10 @@ import {
   type PrivilegeProps,
   privilegePropsSchema,
 } from "../../base.privilege-diff.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../../security-label.types.ts";
 
 const enumLabelSchema = z.object({
   sort_order: z.number(),
@@ -33,6 +37,7 @@ const enumPropsSchema = z.object({
   labels: z.array(enumLabelSchema),
   comment: z.string().nullable(),
   privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
 });
 
 type EnumPrivilegeProps = PrivilegeProps;
@@ -45,6 +50,7 @@ export class Enum extends BasePgModel {
   public readonly labels: EnumProps["labels"];
   public readonly comment: EnumProps["comment"];
   public readonly privileges: EnumPrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
 
   constructor(props: EnumProps) {
     super();
@@ -58,6 +64,7 @@ export class Enum extends BasePgModel {
     this.labels = props.labels;
     this.comment = props.comment;
     this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
   }
 
   get stableId(): `type:${string}` {
@@ -105,6 +112,7 @@ export class Enum extends BasePgModel {
       labels,
       comment: this.comment,
       privileges,
+      security_labels: this.security_labels,
     };
   }
 }
@@ -118,6 +126,7 @@ export async function extractEnums(pool: Pool): Promise<Enum[]> {
     owner: string;
     comment: string | null;
     privileges: { grantee: string; privilege: string; grantable: boolean }[];
+    security_labels: { provider: string; label: string }[];
   }>(sql`
 with extension_oids as (
   select
@@ -147,7 +156,20 @@ select
       )
       from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
-  ) as privileges
+  ) as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = t.oid
+        and sl.classoid = 'pg_type'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
 from
   pg_catalog.pg_enum e
   inner join pg_catalog.pg_type t on t.oid = e.enumtypid
@@ -170,6 +192,7 @@ order by
         privilege: string;
         grantable: boolean;
       }[];
+      security_labels: { provider: string; label: string }[];
     }
   > = {};
   for (const e of enumRows) {
@@ -182,6 +205,7 @@ order by
         labels: [],
         comment: e.comment,
         privileges: e.privileges,
+        security_labels: e.security_labels,
       };
     }
     grouped[key].labels.push({ sort_order: e.sort_order, label: e.label });