@supabase/pg-delta 1.0.0-alpha.26 → 1.0.0-alpha.28

package/src/core/expand-replace-dependencies.ts

@@ -1,13 +1,18 @@
 import type { Catalog } from "./catalog.model.ts";
 import type { Change } from "./change.types.ts";
+import type { ObjectDiffContext } from "./objects/diff-context.ts";
 import { CreateDomain } from "./objects/domain/changes/domain.create.ts";
 import { DropDomain } from "./objects/domain/changes/domain.drop.ts";
 import { CreateIndex } from "./objects/index/changes/index.create.ts";
 import { DropIndex } from "./objects/index/changes/index.drop.ts";
 import { CreateMaterializedView } from "./objects/materialized-view/changes/materialized-view.create.ts";
 import { DropMaterializedView } from "./objects/materialized-view/changes/materialized-view.drop.ts";
+import { buildCreateMaterializedViewChanges } from "./objects/materialized-view/materialized-view.diff.ts";
 import { CreateProcedure } from "./objects/procedure/changes/procedure.create.ts";
 import { DropProcedure } from "./objects/procedure/changes/procedure.drop.ts";
+import { CreateCommentOnRlsPolicy } from "./objects/rls-policy/changes/rls-policy.comment.ts";
+import { CreateRlsPolicy } from "./objects/rls-policy/changes/rls-policy.create.ts";
+import { DropRlsPolicy } from "./objects/rls-policy/changes/rls-policy.drop.ts";
 import { AlterTableAddConstraint } from "./objects/table/changes/table.alter.ts";
 import { CreateCommentOnConstraint } from "./objects/table/changes/table.comment.ts";
 import { CreateTable } from "./objects/table/changes/table.create.ts";
@@ -21,6 +26,7 @@ import { DropRange } from "./objects/type/range/changes/range.drop.ts";
 import { stableId } from "./objects/utils.ts";
 import { CreateView } from "./objects/view/changes/view.create.ts";
 import { DropView } from "./objects/view/changes/view.drop.ts";
+import { buildCreateViewChanges } from "./objects/view/view.diff.ts";
 
 type ResolvedObject =
   | {
@@ -49,6 +55,11 @@ type ResolvedObject =
       main: Catalog["procedures"][string];
       branch: Catalog["procedures"][string];
     }
+  | {
+      kind: "rls_policy";
+      main: Catalog["rlsPolicies"][string];
+      branch: Catalog["rlsPolicies"][string];
+    }
   | {
       kind: "enum";
       main: Catalog["enums"][string];
@@ -87,10 +98,15 @@ export function expandReplaceDependencies({
   changes,
   mainCatalog,
   branchCatalog,
+  diffContext,
 }: {
   changes: Change[];
   mainCatalog: Catalog;
   branchCatalog: Catalog;
+  diffContext?: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >;
 }): ExpandReplaceDependenciesResult {
   const createdIds = new Set<string>();
   const droppedIds = new Set<string>();
@@ -107,6 +123,16 @@ export function expandReplaceDependencies({
     }
   }
 
+  const promotedRlsPolicyIds = new Set<string>();
+  const additions: Change[] = collectInvalidatedRlsPolicyReplacements({
+    changes,
+    mainCatalog,
+    branchCatalog,
+    createdIds,
+    droppedIds,
+    promotedRlsPolicyIds,
+  });
+
   // Procedure stableIds are signature-qualified
   // (`procedure:schema.name(argtypes)`), so a function whose parameter types
   // change has different ids in `createdIds` and `droppedIds` and would not
@@ -150,7 +176,7 @@ export function expandReplaceDependencies({
     }
   }
 
-  if (replaceRoots.size === 0) {
+  if (replaceRoots.size === 0 && additions.length === 0) {
     return {
       changes,
       replacedTableIds: new Set<string>(),
@@ -168,7 +194,6 @@ export function expandReplaceDependencies({
     list.add(dep.dependent_stable_id);
   }
 
-  const additions: Change[] = [];
   const visitedTargets = new Set<string>();
   const visitedRefs = new Set<string>(replaceRoots);
   const queue: string[] = [...replaceRoots];
@@ -236,10 +261,14 @@ export function expandReplaceDependencies({
       const replacementChanges = buildReplaceChanges(resolved, {
         addDrop,
         addCreate,
+        diffContext,
       });
       if (!replacementChanges) continue;
 
       additions.push(...replacementChanges);
+      if (resolved.kind === "rls_policy") {
+        promotedRlsPolicyIds.add(targetId);
+      }
 
       // If we added a DropTable(T) for an existing table, mark T so any
       // pre-existing object-scope AlterTable*(T) changes get dropped below —
@@ -264,11 +293,90 @@ export function expandReplaceDependencies({
   }
 
   return {
-    changes: [...changes, ...additions],
+    changes: [
+      ...removeSupersededRlsPolicyAlters(changes, promotedRlsPolicyIds),
+      ...additions,
+    ],
     replacedTableIds: tablesReplacedByExpansion,
   };
 }
 
+function collectInvalidatedRlsPolicyReplacements({
+  changes,
+  mainCatalog,
+  branchCatalog,
+  createdIds,
+  droppedIds,
+  promotedRlsPolicyIds,
+}: {
+  changes: Change[];
+  mainCatalog: Catalog;
+  branchCatalog: Catalog;
+  createdIds: Set<string>;
+  droppedIds: Set<string>;
+  promotedRlsPolicyIds: Set<string>;
+}): Change[] {
+  // In-place rewrites report stable ids through `invalidates`: the referenced
+  // object keeps its identity, but dependents bound to the old definition must
+  // be torn down first. RLS policy expressions are tracked in pg_depend, so use
+  // those catalog edges to promote only policies that depend on an invalidated
+  // id, without coupling this expansion pass to a concrete table-change class.
+  const invalidatedIds = new Set<string>();
+  for (const change of changes) {
+    for (const invalidatedId of change.invalidates) {
+      invalidatedIds.add(invalidatedId);
+    }
+  }
+  if (invalidatedIds.size === 0) return [];
+
+  const replacements: Change[] = [];
+  for (const dep of mainCatalog.depends) {
+    if (!invalidatedIds.has(dep.referenced_stable_id)) continue;
+
+    const targetId = normalizeDependentId(dep.dependent_stable_id);
+    if (!targetId?.startsWith("rlsPolicy:")) continue;
+    if (promotedRlsPolicyIds.has(targetId)) continue;
+    if (createdIds.has(targetId) && droppedIds.has(targetId)) continue;
+
+    const resolved = resolveObjectForStableId(
+      targetId,
+      mainCatalog,
+      branchCatalog,
+    );
+    if (!resolved || resolved.kind !== "rls_policy") continue;
+
+    const addDrop = !droppedIds.has(targetId);
+    const addCreate = !createdIds.has(targetId);
+    const replacementChanges = buildReplaceChanges(resolved, {
+      addDrop,
+      addCreate,
+    });
+    if (!replacementChanges) continue;
+
+    replacements.push(...replacementChanges);
+    promotedRlsPolicyIds.add(targetId);
+    for (const change of replacementChanges) {
+      for (const id of change.creates ?? []) createdIds.add(id);
+      for (const id of change.drops ?? []) droppedIds.add(id);
+    }
+  }
+
+  return replacements;
+}
+
+function removeSupersededRlsPolicyAlters(
+  changes: Change[],
+  promotedRlsPolicyIds: ReadonlySet<string>,
+): Change[] {
+  if (promotedRlsPolicyIds.size === 0) return changes;
+  return changes.filter((change) => {
+    if (change.objectType !== "rls_policy" || change.operation !== "alter") {
+      return true;
+    }
+    return !promotedRlsPolicyIds.has(change.policy.stableId);
+  });
+}
+
 function isOwnedSequenceColumnDependency(
   referencedId: string,
   dependentId: string,
@@ -395,6 +503,12 @@ function resolveObjectForStableId(
     return main && branch ? { kind: "procedure", main, branch } : null;
   }
 
+  if (stableId.startsWith("rlsPolicy:")) {
+    const main = mainCatalog.rlsPolicies[stableId];
+    const branch = branchCatalog.rlsPolicies[stableId];
+    return main && branch ? { kind: "rls_policy", main, branch } : null;
+  }
+
   if (stableId.startsWith("domain:")) {
     const main = mainCatalog.domains[stableId];
     const branch = branchCatalog.domains[stableId];
@@ -430,9 +544,16 @@ function resolveObjectForStableId(
 
 function buildReplaceChanges(
   resolved: ResolvedObject,
-  options: { addDrop: boolean; addCreate: boolean },
+  options: {
+    addDrop: boolean;
+    addCreate: boolean;
+    diffContext?: Pick<
+      ObjectDiffContext,
+      "version" | "currentUser" | "defaultPrivilegeState"
+    >;
+  },
 ): Change[] | null {
-  const { addDrop, addCreate } = options;
+  const { addDrop, addCreate, diffContext } = options;
 
   if (!addDrop && !addCreate) return null;
 
@@ -471,7 +592,9 @@ function buildReplaceChanges(
     case "view":
       return [
         ...(addDrop ? [new DropView({ view: resolved.main })] : []),
-        ...(addCreate ? [new CreateView({ view: resolved.branch })] : []),
+        ...(addCreate
+          ? buildCreateViewReplacementChanges(resolved.branch, diffContext)
+          : []),
       ];
     case "materialized_view":
       return [
@@ -479,7 +602,13 @@ function buildReplaceChanges(
           ? [new DropMaterializedView({ materializedView: resolved.main })]
           : []),
         ...(addCreate
-          ? [new CreateMaterializedView({ materializedView: resolved.branch })]
+          ? diffContext
+            ? buildCreateMaterializedViewChanges(diffContext, resolved.branch)
+            : [
+                new CreateMaterializedView({
+                  materializedView: resolved.branch,
+                }),
+              ]
           : []),
       ];
     case "index":
@@ -519,6 +648,18 @@ function buildReplaceChanges(
           ? [new CreateProcedure({ procedure: resolved.branch })]
           : []),
       ];
+    case "rls_policy":
+      return [
+        ...(addDrop ? [new DropRlsPolicy({ policy: resolved.main })] : []),
+        ...(addCreate
+          ? [
+              new CreateRlsPolicy({ policy: resolved.branch }),
+              ...(resolved.branch.comment !== null
+                ? [new CreateCommentOnRlsPolicy({ policy: resolved.branch })]
+                : []),
+            ]
+          : []),
+      ];
     case "enum":
       return [
         ...(addDrop ? [new DropEnum({ enum: resolved.main })] : []),
@@ -547,3 +688,20 @@ function buildReplaceChanges(
       return null;
   }
 }
+
+function buildCreateViewReplacementChanges(
+  view: Catalog["views"][string],
+  diffContext:
+    | Pick<
+        ObjectDiffContext,
+        "version" | "currentUser" | "defaultPrivilegeState"
+      >
+    | undefined,
+): Change[] {
+  // Dependency-closure replacements synthesize a create without going through
+  // `diffViews`, so replay the same owner/comment/security-label/ACL metadata
+  // that a normal non-alterable view replacement would emit.
+  return diffContext
+    ? buildCreateViewChanges(diffContext, view)
+    : [new CreateView({ view })];
+}

package/src/core/integrations/supabase.test.ts

@@ -55,6 +55,86 @@ function fdwPrivilegeChange(fdw: { name: string; owner: string }): Change {
   } as unknown as Change;
 }
 
+function serverChange(
+  operation: "create" | "alter" | "drop",
+  server: {
+    name: string;
+    owner: string;
+    foreign_data_wrapper: string;
+    wrapper_handler: string | null;
+    wrapper_validator: string | null;
+  },
+): Change {
+  return {
+    objectType: "server",
+    operation,
+    scope: "object",
+    server: {
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+      ...server,
+    },
+    requires: [],
+    creates: [],
+    drops: [],
+  } as unknown as Change;
+}
+
+function foreignTableChange(
+  operation: "create" | "alter" | "drop",
+  foreignTable: {
+    schema: string;
+    name: string;
+    owner: string;
+    server: string;
+    wrapper_handler: string | null;
+    wrapper_validator: string | null;
+  },
+): Change {
+  return {
+    objectType: "foreign_table",
+    operation,
+    scope: "object",
+    foreignTable: {
+      options: null,
+      comment: null,
+      columns: [],
+      privileges: [],
+      security_labels: [],
+      ...foreignTable,
+    },
+    requires: [],
+    creates: [],
+    drops: [],
+  } as unknown as Change;
+}
+
+function userMappingChange(
+  operation: "create" | "alter" | "drop",
+  userMapping: {
+    user: string;
+    server: string;
+    wrapper_handler: string | null;
+    wrapper_validator: string | null;
+  },
+): Change {
+  return {
+    objectType: "user_mapping",
+    operation,
+    scope: "object",
+    userMapping: {
+      options: null,
+      ...userMapping,
+    },
+    requires: [],
+    creates: [],
+    drops: [],
+  } as unknown as Change;
+}
+
 function serverPrivilegeChange(server: {
   name: string;
   owner: string;
@@ -71,6 +151,33 @@ function serverPrivilegeChange(server: {
   } as unknown as Change;
 }
 
+/**
+ * Build a synthetic trigger change shaped like what `flattenChange` consumes.
+ * The flattener emits keys `trigger/schema`, `trigger/table_name`,
+ * `trigger/function_schema`, etc. by walking the nested `trigger` model.
+ */
+function triggerChange(
+  operation: "create" | "alter" | "drop",
+  trigger: {
+    schema: string;
+    name: string;
+    table_name: string;
+    function_schema: string;
+    function_name: string;
+    owner: string;
+  },
+): Change {
+  return {
+    objectType: "trigger",
+    operation,
+    scope: "object",
+    trigger,
+    requires: [],
+    creates: [],
+    drops: [],
+  } as unknown as Change;
+}
+
 describe("supabase integration filter — foreign data wrappers", () => {
   // Regression for CLI-1470. Wasm-based foreign data wrappers on Supabase
   // (e.g. `clerk`, `clerk_oauth`) are provisioned at project creation by
@@ -128,6 +235,35 @@ describe("supabase integration filter — foreign data wrappers", () => {
     expect(evaluatePattern(filter, change)).toBe(true);
   });
 
+  // `postgres_fdw` (and other contrib FDWs) install their handler/validator
+  // into `extensions` on Supabase, but they ARE available in the local image,
+  // so a user-created `postgres_fdw` wrapper must roundtrip. Only the Wasm
+  // `wasm_fdw_handler` / `wasm_fdw_validator` functions identify the
+  // platform-managed wrappers that local Docker cannot provision.
+  test("preserves user FDW whose handler is extensions.postgres_fdw_handler", () => {
+    const change = fdwChange("create", {
+      name: "postgres_fdw",
+      owner: "postgres",
+      handler: "extensions.postgres_fdw_handler",
+      validator: "extensions.postgres_fdw_validator",
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  // The Wasm discriminator must be an exact function-name match, not a
+  // prefix: a user function whose name merely starts with `wasm_fdw_handler`
+  // (e.g. `wasm_fdw_handler_custom`) is not the platform `wrappers` handler
+  // and must roundtrip.
+  test("preserves user FDW whose handler extends the wasm_fdw_handler prefix", () => {
+    const change = fdwChange("create", {
+      name: "custom_wasm",
+      owner: "postgres",
+      handler: "extensions.wasm_fdw_handler_custom",
+      validator: "extensions.wasm_fdw_validator_custom",
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
   test("preserves user FDW with no handler/validator", () => {
     const change = fdwChange("create", {
       name: "user_fdw_bare",
@@ -196,3 +332,202 @@ describe("supabase integration filter — foreign data wrapper / server ACLs", (
     expect(evaluatePattern(filter, change)).toBe(true);
   });
 });
+
+describe("supabase integration filter — Wasm FDW dependents", () => {
+  const wasmWrapper = {
+    wrapper_handler: "extensions.wasm_fdw_handler",
+    wrapper_validator: "extensions.wasm_fdw_validator",
+  } as const;
+
+  const userWrapper = {
+    wrapper_handler: "public.postgres_fdw_handler",
+    wrapper_validator: "public.postgres_fdw_validator",
+  } as const;
+
+  // `postgres_fdw` installs its handler/validator into `extensions` on
+  // Supabase, but the contrib FDW IS available locally, so user-owned
+  // servers / foreign tables / user mappings built on it must roundtrip.
+  // Keying suppression on the bare `extensions.*` namespace would wrongly
+  // drop them; only the Wasm `wasm_fdw_*` functions mark platform wrappers.
+  const extensionsPgFdwWrapper = {
+    wrapper_handler: "extensions.postgres_fdw_handler",
+    wrapper_validator: "extensions.postgres_fdw_validator",
+  } as const;
+
+  test("suppresses CREATE SERVER bound to extensions.* Wasm FDW", () => {
+    const change = serverChange("create", {
+      name: "clerk_oauth_server",
+      owner: "postgres",
+      foreign_data_wrapper: "clerk_oauth",
+      ...wasmWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("suppresses DROP FOREIGN TABLE bound to extensions.* Wasm FDW", () => {
+    const change = foreignTableChange("drop", {
+      schema: "public",
+      name: "clerk_oauth",
+      owner: "postgres",
+      server: "clerk_oauth_server",
+      ...wasmWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("suppresses ALTER FOREIGN TABLE bound to extensions.* Wasm FDW", () => {
+    const change = foreignTableChange("alter", {
+      schema: "public",
+      name: "clerk_oauth",
+      owner: "postgres",
+      server: "clerk_oauth_server",
+      ...wasmWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("suppresses DROP USER MAPPING bound to extensions.* Wasm FDW", () => {
+    const change = userMappingChange("drop", {
+      user: "postgres",
+      server: "clerk_server",
+      ...wasmWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("suppresses CREATE USER MAPPING when only wrapper validator is in extensions", () => {
+    const change = userMappingChange("create", {
+      user: "postgres",
+      server: "clerk_server",
+      wrapper_handler: null,
+      wrapper_validator: "extensions.wasm_fdw_validator",
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("preserves CREATE SERVER bound to user postgres_fdw wrapper", () => {
+    const change = serverChange("create", {
+      name: "live_risk_server",
+      owner: "postgres",
+      foreign_data_wrapper: "postgres_fdw",
+      ...userWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  test("preserves server ACL when postgres_fdw handler lives in extensions", () => {
+    const change = serverPrivilegeChange({
+      name: "user_server",
+      owner: "postgres",
+    });
+    (change as unknown as { server: Record<string, unknown> }).server = {
+      name: "user_server",
+      owner: "postgres",
+      wrapper_handler: "extensions.postgres_fdw_handler",
+      wrapper_validator: "extensions.postgres_fdw_validator",
+    };
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  test("preserves CREATE FOREIGN TABLE on user postgres_fdw server", () => {
+    const change = foreignTableChange("create", {
+      schema: "live_risk",
+      name: "devices",
+      owner: "postgres",
+      server: "live_risk_server",
+      ...userWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  test("preserves CREATE SERVER when postgres_fdw handler lives in extensions", () => {
+    const change = serverChange("create", {
+      name: "user_pg_server",
+      owner: "postgres",
+      foreign_data_wrapper: "postgres_fdw",
+      ...extensionsPgFdwWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  test("preserves CREATE FOREIGN TABLE when postgres_fdw handler lives in extensions", () => {
+    const change = foreignTableChange("create", {
+      schema: "user_fdw_test",
+      name: "remote_row",
+      owner: "postgres",
+      server: "user_pg_server",
+      ...extensionsPgFdwWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  test("preserves CREATE USER MAPPING when postgres_fdw handler lives in extensions", () => {
+    const change = userMappingChange("create", {
+      user: "postgres",
+      server: "user_pg_server",
+      ...extensionsPgFdwWrapper,
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+
+  // Exact-match guard at the dependent level too: a server bound to a wrapper
+  // whose handler merely shares the `wasm_fdw_handler` prefix must roundtrip.
+  test("preserves CREATE SERVER when wrapper handler extends the wasm_fdw_handler prefix", () => {
+    const change = serverChange("create", {
+      name: "custom_wasm_server",
+      owner: "postgres",
+      foreign_data_wrapper: "custom_wasm",
+      wrapper_handler: "extensions.wasm_fdw_handler_custom",
+      wrapper_validator: "extensions.wasm_fdw_validator_custom",
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+});
+
+describe("supabase integration filter — pgmq queue triggers", () => {
+  // Regression for the pgmq-1.4.4 cloud projects. `pgmq.create('<name>')`
+  // materializes `pgmq.q_<name>` and `pgmq.a_<name>` at runtime — they are
+  // NOT created by `CREATE EXTENSION pgmq`. On a healthy install the trigger
+  // extractor's `extension_table_oids` join already drops these via the
+  // `pg_depend deptype='e'` row that newer pgmq versions record, but on
+  // pgmq 1.4.4 that row is never recorded, so user triggers on the queue
+  // tables leak into the diff and break `supabase db reset` with
+  // `relation "pgmq.q_<name>" does not exist`. The filter must drop them
+  // at the supabase-integration level too, regardless of pg_depend state.
+
+  test("suppresses CREATE trigger on pgmq.q_<name> calling a public function", () => {
+    const change = triggerChange("create", {
+      schema: "pgmq",
+      name: "after_insert_processed_milestones_queue",
+      table_name: "q_processed_milestones_queue",
+      function_schema: "public",
+      function_name: "move_data_from_queue",
+      owner: "postgres",
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("suppresses DROP trigger on pgmq.a_<name> calling a public function", () => {
+    const change = triggerChange("drop", {
+      schema: "pgmq",
+      name: "after_insert_archive",
+      table_name: "a_processed_milestones_queue",
+      function_schema: "public",
+      function_name: "archive_handler",
+      owner: "postgres",
+    });
+    expect(evaluatePattern(filter, change)).toBe(false);
+  });
+
+  test("preserves CREATE trigger on auth.users calling a public function", () => {
+    const change = triggerChange("create", {
+      schema: "auth",
+      name: "on_auth_user_created",
+      table_name: "users",
+      function_schema: "public",
+      function_name: "handle_new_user",
+      owner: "supabase_auth_admin",
+    });
+    expect(evaluatePattern(filter, change)).toBe(true);
+  });
+});