@supabase/pg-delta 1.0.0-alpha.27 → 1.0.0-alpha.29

package/src/core/expand-replace-dependencies.ts

@@ -1,13 +1,18 @@
 import type { Catalog } from "./catalog.model.ts";
 import type { Change } from "./change.types.ts";
+import type { ObjectDiffContext } from "./objects/diff-context.ts";
 import { CreateDomain } from "./objects/domain/changes/domain.create.ts";
 import { DropDomain } from "./objects/domain/changes/domain.drop.ts";
 import { CreateIndex } from "./objects/index/changes/index.create.ts";
 import { DropIndex } from "./objects/index/changes/index.drop.ts";
 import { CreateMaterializedView } from "./objects/materialized-view/changes/materialized-view.create.ts";
 import { DropMaterializedView } from "./objects/materialized-view/changes/materialized-view.drop.ts";
+import { buildCreateMaterializedViewChanges } from "./objects/materialized-view/materialized-view.diff.ts";
 import { CreateProcedure } from "./objects/procedure/changes/procedure.create.ts";
 import { DropProcedure } from "./objects/procedure/changes/procedure.drop.ts";
+import { CreateCommentOnRlsPolicy } from "./objects/rls-policy/changes/rls-policy.comment.ts";
+import { CreateRlsPolicy } from "./objects/rls-policy/changes/rls-policy.create.ts";
+import { DropRlsPolicy } from "./objects/rls-policy/changes/rls-policy.drop.ts";
 import { AlterTableAddConstraint } from "./objects/table/changes/table.alter.ts";
 import { CreateCommentOnConstraint } from "./objects/table/changes/table.comment.ts";
 import { CreateTable } from "./objects/table/changes/table.create.ts";
@@ -21,6 +26,7 @@ import { DropRange } from "./objects/type/range/changes/range.drop.ts";
 import { stableId } from "./objects/utils.ts";
 import { CreateView } from "./objects/view/changes/view.create.ts";
 import { DropView } from "./objects/view/changes/view.drop.ts";
+import { buildCreateViewChanges } from "./objects/view/view.diff.ts";
 
 type ResolvedObject =
   | {
@@ -49,6 +55,11 @@ type ResolvedObject =
       main: Catalog["procedures"][string];
       branch: Catalog["procedures"][string];
     }
+  | {
+      kind: "rls_policy";
+      main: Catalog["rlsPolicies"][string];
+      branch: Catalog["rlsPolicies"][string];
+    }
   | {
       kind: "enum";
       main: Catalog["enums"][string];
@@ -87,10 +98,15 @@ export function expandReplaceDependencies({
   changes,
   mainCatalog,
   branchCatalog,
+  diffContext,
 }: {
   changes: Change[];
   mainCatalog: Catalog;
   branchCatalog: Catalog;
+  diffContext?: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >;
 }): ExpandReplaceDependenciesResult {
   const createdIds = new Set<string>();
   const droppedIds = new Set<string>();
@@ -107,6 +123,16 @@ export function expandReplaceDependencies({
     }
   }
 
+  const promotedRlsPolicyIds = new Set<string>();
+  const additions: Change[] = collectInvalidatedRlsPolicyReplacements({
+    changes,
+    mainCatalog,
+    branchCatalog,
+    createdIds,
+    droppedIds,
+    promotedRlsPolicyIds,
+  });
+
   // Procedure stableIds are signature-qualified
   // (`procedure:schema.name(argtypes)`), so a function whose parameter types
   // change has different ids in `createdIds` and `droppedIds` and would not
@@ -150,7 +176,7 @@ export function expandReplaceDependencies({
     }
   }
 
-  if (replaceRoots.size === 0) {
+  if (replaceRoots.size === 0 && additions.length === 0) {
     return {
       changes,
       replacedTableIds: new Set<string>(),
@@ -168,7 +194,6 @@ export function expandReplaceDependencies({
     list.add(dep.dependent_stable_id);
   }
 
-  const additions: Change[] = [];
   const visitedTargets = new Set<string>();
   const visitedRefs = new Set<string>(replaceRoots);
   const queue: string[] = [...replaceRoots];
@@ -236,10 +261,14 @@ export function expandReplaceDependencies({
       const replacementChanges = buildReplaceChanges(resolved, {
         addDrop,
         addCreate,
+        diffContext,
       });
       if (!replacementChanges) continue;
 
       additions.push(...replacementChanges);
+      if (resolved.kind === "rls_policy") {
+        promotedRlsPolicyIds.add(targetId);
+      }
 
       // If we added a DropTable(T) for an existing table, mark T so any
       // pre-existing object-scope AlterTable*(T) changes get dropped below —
@@ -264,11 +293,90 @@ export function expandReplaceDependencies({
   }
 
   return {
-    changes: [...changes, ...additions],
+    changes: [
+      ...removeSupersededRlsPolicyAlters(changes, promotedRlsPolicyIds),
+      ...additions,
+    ],
     replacedTableIds: tablesReplacedByExpansion,
   };
 }
 
+function collectInvalidatedRlsPolicyReplacements({
+  changes,
+  mainCatalog,
+  branchCatalog,
+  createdIds,
+  droppedIds,
+  promotedRlsPolicyIds,
+}: {
+  changes: Change[];
+  mainCatalog: Catalog;
+  branchCatalog: Catalog;
+  createdIds: Set<string>;
+  droppedIds: Set<string>;
+  promotedRlsPolicyIds: Set<string>;
+}): Change[] {
+  // In-place rewrites report stable ids through `invalidates`: the referenced
+  // object keeps its identity, but dependents bound to the old definition must
+  // be torn down first. RLS policy expressions are tracked in pg_depend, so use
+  // those catalog edges to promote only policies that depend on an invalidated
+  // id, without coupling this expansion pass to a concrete table-change class.
+  const invalidatedIds = new Set<string>();
+  for (const change of changes) {
+    for (const invalidatedId of change.invalidates) {
+      invalidatedIds.add(invalidatedId);
+    }
+  }
+  if (invalidatedIds.size === 0) return [];
+
+  const replacements: Change[] = [];
+  for (const dep of mainCatalog.depends) {
+    if (!invalidatedIds.has(dep.referenced_stable_id)) continue;
+
+    const targetId = normalizeDependentId(dep.dependent_stable_id);
+    if (!targetId?.startsWith("rlsPolicy:")) continue;
+    if (promotedRlsPolicyIds.has(targetId)) continue;
+    if (createdIds.has(targetId) && droppedIds.has(targetId)) continue;
+
+    const resolved = resolveObjectForStableId(
+      targetId,
+      mainCatalog,
+      branchCatalog,
+    );
+    if (!resolved || resolved.kind !== "rls_policy") continue;
+
+    const addDrop = !droppedIds.has(targetId);
+    const addCreate = !createdIds.has(targetId);
+    const replacementChanges = buildReplaceChanges(resolved, {
+      addDrop,
+      addCreate,
+    });
+    if (!replacementChanges) continue;
+
+    replacements.push(...replacementChanges);
+    promotedRlsPolicyIds.add(targetId);
+    for (const change of replacementChanges) {
+      for (const id of change.creates ?? []) createdIds.add(id);
+      for (const id of change.drops ?? []) droppedIds.add(id);
+    }
+  }
+
+  return replacements;
+}
+
+function removeSupersededRlsPolicyAlters(
+  changes: Change[],
+  promotedRlsPolicyIds: ReadonlySet<string>,
+): Change[] {
+  if (promotedRlsPolicyIds.size === 0) return changes;
+  return changes.filter((change) => {
+    if (change.objectType !== "rls_policy" || change.operation !== "alter") {
+      return true;
+    }
+    return !promotedRlsPolicyIds.has(change.policy.stableId);
+  });
+}
+
 function isOwnedSequenceColumnDependency(
   referencedId: string,
   dependentId: string,
@@ -395,6 +503,12 @@ function resolveObjectForStableId(
     return main && branch ? { kind: "procedure", main, branch } : null;
   }
 
+  if (stableId.startsWith("rlsPolicy:")) {
+    const main = mainCatalog.rlsPolicies[stableId];
+    const branch = branchCatalog.rlsPolicies[stableId];
+    return main && branch ? { kind: "rls_policy", main, branch } : null;
+  }
+
   if (stableId.startsWith("domain:")) {
     const main = mainCatalog.domains[stableId];
     const branch = branchCatalog.domains[stableId];
@@ -430,9 +544,16 @@ function resolveObjectForStableId(
 
 function buildReplaceChanges(
   resolved: ResolvedObject,
-  options: { addDrop: boolean; addCreate: boolean },
+  options: {
+    addDrop: boolean;
+    addCreate: boolean;
+    diffContext?: Pick<
+      ObjectDiffContext,
+      "version" | "currentUser" | "defaultPrivilegeState"
+    >;
+  },
 ): Change[] | null {
-  const { addDrop, addCreate } = options;
+  const { addDrop, addCreate, diffContext } = options;
 
   if (!addDrop && !addCreate) return null;
 
@@ -471,7 +592,9 @@ function buildReplaceChanges(
     case "view":
       return [
         ...(addDrop ? [new DropView({ view: resolved.main })] : []),
-        ...(addCreate ? [new CreateView({ view: resolved.branch })] : []),
+        ...(addCreate
+          ? buildCreateViewReplacementChanges(resolved.branch, diffContext)
+          : []),
       ];
     case "materialized_view":
       return [
@@ -479,7 +602,13 @@ function buildReplaceChanges(
           ? [new DropMaterializedView({ materializedView: resolved.main })]
           : []),
         ...(addCreate
-          ? [new CreateMaterializedView({ materializedView: resolved.branch })]
+          ? diffContext
+            ? buildCreateMaterializedViewChanges(diffContext, resolved.branch)
+            : [
+                new CreateMaterializedView({
+                  materializedView: resolved.branch,
+                }),
+              ]
           : []),
       ];
     case "index":
@@ -519,6 +648,18 @@ function buildReplaceChanges(
           ? [new CreateProcedure({ procedure: resolved.branch })]
           : []),
       ];
+    case "rls_policy":
+      return [
+        ...(addDrop ? [new DropRlsPolicy({ policy: resolved.main })] : []),
+        ...(addCreate
+          ? [
+              new CreateRlsPolicy({ policy: resolved.branch }),
+              ...(resolved.branch.comment !== null
+                ? [new CreateCommentOnRlsPolicy({ policy: resolved.branch })]
+                : []),
+            ]
+          : []),
+      ];
     case "enum":
       return [
         ...(addDrop ? [new DropEnum({ enum: resolved.main })] : []),
@@ -547,3 +688,20 @@ function buildReplaceChanges(
       return null;
   }
 }
+
+function buildCreateViewReplacementChanges(
+  view: Catalog["views"][string],
+  diffContext:
+    | Pick<
+        ObjectDiffContext,
+        "version" | "currentUser" | "defaultPrivilegeState"
+      >
+    | undefined,
+): Change[] {
+  // Dependency-closure replacements synthesize a create without going through
+  // `diffViews`, so replay the same owner/comment/security-label/ACL metadata
+  // that a normal non-alterable view replacement would emit.
+  return diffContext
+    ? buildCreateViewChanges(diffContext, view)
+    : [new CreateView({ view })];
+}

package/src/core/objects/base.change.ts

@@ -51,6 +51,21 @@ export abstract class BaseChange {
     return [];
   }
 
+  /**
+   * Stable identifiers this change invalidates in place.
+   *
+   * Unlike `drops`, the object keeps its identity. This is an ordering-only
+   * signal for mutations that rewrite an existing object in a way that requires
+   * dependents bound to the old definition to be dropped before the mutation
+   * and rebuilt afterward.
+   *
+   * Defaults to an empty array. Override in subclasses that invalidate
+   * dependents without dropping the object.
+   */
+  get invalidates(): string[] {
+    return [];
+  }
+
   /**
    * Stable identifiers this change requires to exist beforehand.
    *

package/src/core/objects/materialized-view/materialized-view.diff.test.ts

@@ -106,7 +106,7 @@ describe.concurrent("materialized-view.diff", () => {
     expect(changes[0]).toBeInstanceOf(AlterMaterializedViewChangeOwner);
   });
 
-  test("drop + create on non-alterable change", () => {
+  test("drop + create with metadata on non-alterable change", () => {
     const main = new MaterializedView(base);
     const branch = new MaterializedView({ ...base, definition: "select 2" });
     const changes = diffMaterializedViews(
@@ -114,9 +114,10 @@ describe.concurrent("materialized-view.diff", () => {
       { [main.stableId]: main },
       { [branch.stableId]: branch },
     );
-    expect(changes).toHaveLength(2);
+    expect(changes).toHaveLength(3);
     expect(changes[0]).toBeInstanceOf(DropMaterializedView);
     expect(changes[1]).toBeInstanceOf(CreateMaterializedView);
+    expect(changes[2]).toBeInstanceOf(AlterMaterializedViewChangeOwner);
   });
 
   test("alter storage parameters: set and reset", () => {

package/src/core/objects/materialized-view/materialized-view.diff.ts

@@ -30,117 +30,126 @@ import {
 import type { MaterializedViewChange } from "./changes/materialized-view.types.ts";
 import type { MaterializedView } from "./materialized-view.model.ts";
 
-/**
- * Diff two sets of materialized views from main and branch catalogs.
- *
- * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
- * @param main - The materialized views in the main catalog.
- * @param branch - The materialized views in the branch catalog.
- * @returns A list of changes to apply to main to make it match branch.
- */
-export function diffMaterializedViews(
+export function buildCreateMaterializedViewChanges(
   ctx: Pick<
     ObjectDiffContext,
     "version" | "currentUser" | "defaultPrivilegeState"
   >,
-  main: Record<string, MaterializedView>,
-  branch: Record<string, MaterializedView>,
+  mv: MaterializedView,
 ): MaterializedViewChange[] {
-  const { created, dropped, altered } = diffObjects(main, branch);
-
-  const changes: MaterializedViewChange[] = [];
+  const changes: MaterializedViewChange[] = [
+    new CreateMaterializedView({
+      materializedView: mv,
+    }),
+  ];
 
-  for (const materializedViewId of created) {
-    const mv = branch[materializedViewId];
+  // OWNER: If the materialized view should be owned by someone other than the current user,
+  // emit ALTER MATERIALIZED VIEW ... OWNER TO after creation
+  if (mv.owner !== ctx.currentUser) {
     changes.push(
-      new CreateMaterializedView({
+      new AlterMaterializedViewChangeOwner({
         materializedView: mv,
+        owner: mv.owner,
       }),
     );
+  }
 
-    // OWNER: If the materialized view should be owned by someone other than the current user,
-    // emit ALTER MATERIALIZED VIEW ... OWNER TO after creation
-    if (mv.owner !== ctx.currentUser) {
+  // Materialized view comment on creation
+  if (mv.comment !== null) {
+    changes.push(
+      new CreateCommentOnMaterializedView({
+        materializedView: mv,
+      }),
+    );
+  }
+  // Column comments on creation
+  for (const col of mv.columns) {
+    if (col.comment !== null) {
       changes.push(
-        new AlterMaterializedViewChangeOwner({
+        new CreateCommentOnMaterializedViewColumn({
           materializedView: mv,
-          owner: mv.owner,
+          column: col,
         }),
       );
     }
+  }
 
-    // Note: RLS (row_security, force_row_security) is a non-alterable property for materialized views.
-    // If RLS needs to be enabled, the materialized view must be dropped and recreated, which is
-    // handled in the "altered" section when non-alterable properties change.
+  // Security labels on the matview itself (columns of matviews are not
+  // supported targets of SECURITY LABEL, so we only label the relation).
+  for (const label of mv.security_labels) {
+    changes.push(
+      new CreateSecurityLabelOnMaterializedView({
+        materializedView: mv,
+        securityLabel: label,
+      }),
+    );
+  }
 
-    // Materialized view comment on creation
-    if (mv.comment !== null) {
-      changes.push(
-        new CreateCommentOnMaterializedView({
-          materializedView: mv,
-        }),
-      );
-    }
-    // Column comments on creation
-    for (const col of mv.columns) {
-      if (col.comment !== null) {
-        changes.push(
-          new CreateCommentOnMaterializedViewColumn({
-            materializedView: mv,
-            column: col,
-          }),
-        );
-      }
-    }
+  // PRIVILEGES: For created objects, compare against default privileges state
+  // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+  // so objects are created with the default privileges state in effect.
+  // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+  // needed to reach the final desired state.
+  const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+    ctx.currentUser,
+    "materialized_view",
+    mv.schema ?? "",
+  );
+  const creatorFilteredDefaults =
+    mv.owner !== ctx.currentUser
+      ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+      : effectiveDefaults;
+  const desiredPrivileges = mv.privileges;
+  // Filter out owner privileges - owner always has ALL privileges implicitly
+  // and shouldn't be compared. Use the materialized view owner as the reference.
+  const privilegeResults = diffPrivileges(
+    creatorFilteredDefaults,
+    desiredPrivileges,
+    mv.owner,
+  );
 
-    // Security labels on the matview itself (columns of matviews are not
-    // supported targets of SECURITY LABEL, so we only label the relation).
-    for (const label of mv.security_labels) {
-      changes.push(
-        new CreateSecurityLabelOnMaterializedView({
-          materializedView: mv,
-          securityLabel: label,
-        }),
-      );
-    }
+  changes.push(
+    ...(emitColumnPrivilegeChanges(
+      privilegeResults,
+      mv,
+      mv,
+      "materializedView",
+      {
+        Grant: GrantMaterializedViewPrivileges,
+        Revoke: RevokeMaterializedViewPrivileges,
+        RevokeGrantOption: RevokeGrantOptionMaterializedViewPrivileges,
+      },
+      effectiveDefaults,
+      ctx.version,
+    ) as MaterializedViewChange[]),
+  );
 
-    // PRIVILEGES: For created objects, compare against default privileges state
-    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
-    // so objects are created with the default privileges state in effect.
-    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
-    // needed to reach the final desired state.
-    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
-      ctx.currentUser,
-      "materialized_view",
-      mv.schema ?? "",
-    );
-    const creatorFilteredDefaults =
-      mv.owner !== ctx.currentUser
-        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
-        : effectiveDefaults;
-    const desiredPrivileges = mv.privileges;
-    // Filter out owner privileges - owner always has ALL privileges implicitly
-    // and shouldn't be compared. Use the materialized view owner as the reference.
-    const privilegeResults = diffPrivileges(
-      creatorFilteredDefaults,
-      desiredPrivileges,
-      mv.owner,
-    );
+  return changes;
+}
+
+/**
+ * Diff two sets of materialized views from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The materialized views in the main catalog.
+ * @param branch - The materialized views in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffMaterializedViews(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  main: Record<string, MaterializedView>,
+  branch: Record<string, MaterializedView>,
+): MaterializedViewChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
 
+  const changes: MaterializedViewChange[] = [];
+
+  for (const materializedViewId of created) {
     changes.push(
-      ...(emitColumnPrivilegeChanges(
-        privilegeResults,
-        mv,
-        mv,
-        "materializedView",
-        {
-          Grant: GrantMaterializedViewPrivileges,
-          Revoke: RevokeMaterializedViewPrivileges,
-          RevokeGrantOption: RevokeGrantOptionMaterializedViewPrivileges,
-        },
-        effectiveDefaults,
-        ctx.version,
-      ) as MaterializedViewChange[]),
+      ...buildCreateMaterializedViewChanges(ctx, branch[materializedViewId]),
     );
   }
 
@@ -180,9 +189,7 @@ export function diffMaterializedViews(
       // Replace the entire materialized view (drop + create)
       changes.push(
         new DropMaterializedView({ materializedView: mainMaterializedView }),
-        new CreateMaterializedView({
-          materializedView: branchMaterializedView,
-        }),
+        ...buildCreateMaterializedViewChanges(ctx, branchMaterializedView),
       );
     } else {
       // Only alterable properties changed - check each one

package/src/core/objects/table/changes/table.alter.ts

@@ -651,6 +651,15 @@ export class AlterTableAlterColumnType extends AlterTableChange {
     ];
   }
 
+  get invalidates() {
+    // ALTER COLUMN ... TYPE rewrites the column in place. The column keeps its
+    // identity, but anything bound to its old type (views, rules, etc.) must be
+    // dropped before the rewrite and rebuilt after, so report it as invalidated.
+    return [
+      stableId.column(this.table.schema, this.table.name, this.column.name),
+    ];
+  }
+
   serialize(_options?: SerializeOptions): string {
     // previousColumn is optional so direct serializer tests/fixtures can keep
     // emitting canonical ALTER TYPE SQL without forcing a USING expression.