@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/foreign-data-wrapper/server/server.diff.test.ts

@@ -0,0 +1,262 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../../base.default-privileges.ts";
+import {
+  AlterServerChangeOwner,
+  AlterServerSetOptions,
+  AlterServerSetVersion,
+} from "./changes/server.alter.ts";
+import {
+  CreateCommentOnServer,
+  DropCommentOnServer,
+} from "./changes/server.comment.ts";
+import { CreateServer } from "./changes/server.create.ts";
+import { DropServer } from "./changes/server.drop.ts";
+import {
+  GrantServerPrivileges,
+  RevokeGrantOptionServerPrivileges,
+  RevokeServerPrivileges,
+} from "./changes/server.privilege.ts";
+import { diffServers } from "./server.diff.ts";
+import { Server, type ServerProps } from "./server.model.ts";
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("server.diff", () => {
+  test("create and drop", () => {
+    const props: ServerProps = {
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    };
+    const server = new Server(props);
+
+    const created = diffServers(testContext, {}, { [server.stableId]: server });
+    expect(created[0]).toBeInstanceOf(CreateServer);
+
+    const dropped = diffServers(testContext, { [server.stableId]: server }, {});
+    expect(dropped[0]).toBeInstanceOf(DropServer);
+  });
+
+  test("alter: owner change", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o2",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterServerChangeOwner)).toBe(true);
+  });
+
+  test("alter: version change", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: "1.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: "2.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterServerSetVersion)).toBe(true);
+  });
+
+  test("alter: options changes", () => {
+    // Use non-env-dependent options to test that option changes still work
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: ["fetch_size", "100"],
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: ["fetch_size", "200", "use_remote_estimate", "true"],
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    const optionsChange = changes.find(
+      (c) => c instanceof AlterServerSetOptions,
+    ) as AlterServerSetOptions | undefined;
+    expect(optionsChange).toBeDefined();
+    expect(optionsChange?.options.length).toBeGreaterThan(0);
+  });
+
+  test("type change triggers drop and create", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: "old_type",
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: "new_type",
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    // Type change should trigger drop + create
+    expect(changes.some((c) => c instanceof DropServer)).toBe(true);
+    expect(changes.some((c) => c instanceof CreateServer)).toBe(true);
+  });
+
+  test("created with privileges emits grant", () => {
+    const server = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [
+        { grantee: "role_usage", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const changes = diffServers(testContext, {}, { [server.stableId]: server });
+    expect(changes[0]).toBeInstanceOf(CreateServer);
+    expect(changes.some((c) => c instanceof GrantServerPrivileges)).toBe(true);
+  });
+
+  test("altered comment emits create/drop comment", () => {
+    const base: ServerProps = {
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    };
+    const main = new Server(base);
+    const withComment = new Server({ ...base, comment: "my server" });
+
+    const addComment = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [withComment.stableId]: withComment },
+    );
+    expect(addComment[0]).toBeInstanceOf(CreateCommentOnServer);
+
+    const dropComment = diffServers(
+      testContext,
+      { [withComment.stableId]: withComment },
+      { [main.stableId]: main },
+    );
+    expect(dropComment[0]).toBeInstanceOf(DropCommentOnServer);
+  });
+
+  test("altered privileges emit grant, revoke, and revoke grant option", () => {
+    const base: ServerProps = {
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    };
+    const main = new Server({
+      ...base,
+      privileges: [
+        { grantee: "role_usage", privilege: "USAGE", grantable: false },
+        { grantee: "role_with_option", privilege: "USAGE", grantable: true },
+        { grantee: "role_removed", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const branch = new Server({
+      ...base,
+      privileges: [
+        { grantee: "role_usage", privilege: "USAGE", grantable: true },
+        { grantee: "role_with_option", privilege: "USAGE", grantable: false },
+        { grantee: "role_new", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof GrantServerPrivileges)).toBe(true);
+    expect(changes.some((c) => c instanceof RevokeServerPrivileges)).toBe(true);
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionServerPrivileges),
+    ).toBe(true);
+  });
+});

package/src/core/objects/foreign-data-wrapper/server/server.diff.ts

@@ -0,0 +1,247 @@
+import { diffObjects } from "../../base.diff.ts";
+import {
+  diffPrivileges,
+  emitObjectPrivilegeChanges,
+  filterPublicBuiltInDefaults,
+} from "../../base.privilege-diff.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
+import {
+  AlterServerChangeOwner,
+  AlterServerSetOptions,
+  AlterServerSetVersion,
+} from "./changes/server.alter.ts";
+import {
+  CreateCommentOnServer,
+  DropCommentOnServer,
+} from "./changes/server.comment.ts";
+import { CreateServer } from "./changes/server.create.ts";
+import { DropServer } from "./changes/server.drop.ts";
+import {
+  GrantServerPrivileges,
+  RevokeGrantOptionServerPrivileges,
+  RevokeServerPrivileges,
+} from "./changes/server.privilege.ts";
+import type { ServerChange } from "./changes/server.types.ts";
+import type { Server } from "./server.model.ts";
+
+/**
+ * Diff two sets of servers from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The servers in the main catalog.
+ * @param branch - The servers in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffServers(
+  ctx: Pick<ObjectDiffContext, "version" | "currentUser">,
+  main: Record<string, Server>,
+  branch: Record<string, Server>,
+): ServerChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: ServerChange[] = [];
+
+  for (const serverId of created) {
+    const createdServer = branch[serverId];
+    changes.push(new CreateServer({ server: createdServer }));
+
+    // OWNER: If the server should be owned by someone other than the current user,
+    // emit ALTER SERVER ... OWNER TO after creation
+    if (createdServer.owner !== ctx.currentUser) {
+      changes.push(
+        new AlterServerChangeOwner({
+          server: createdServer,
+          owner: createdServer.owner,
+        }),
+      );
+    }
+
+    if (createdServer.comment !== null) {
+      changes.push(new CreateCommentOnServer({ server: createdServer }));
+    }
+
+    // PRIVILEGES: Servers don't have default privileges
+    const effectiveDefaults: Array<{
+      grantee: string;
+      privilege: string;
+      grantable: boolean;
+    }> = [];
+    const desiredPrivileges = filterPublicBuiltInDefaults(
+      "server",
+      createdServer.privileges,
+    );
+    const privilegeResults = diffPrivileges(
+      effectiveDefaults,
+      desiredPrivileges,
+      createdServer.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        createdServer,
+        createdServer,
+        "server",
+        {
+          Grant: GrantServerPrivileges,
+          Revoke: RevokeServerPrivileges,
+          RevokeGrantOption: RevokeGrantOptionServerPrivileges,
+        },
+        ctx.version,
+      ) as ServerChange[]),
+    );
+  }
+
+  for (const serverId of dropped) {
+    changes.push(new DropServer({ server: main[serverId] }));
+  }
+
+  for (const serverId of altered) {
+    const mainServer = main[serverId];
+    const branchServer = branch[serverId];
+
+    // OWNER
+    if (mainServer.owner !== branchServer.owner) {
+      changes.push(
+        new AlterServerChangeOwner({
+          server: mainServer,
+          owner: branchServer.owner,
+        }),
+      );
+    }
+
+    // TYPE - if changed, need to recreate (not directly alterable)
+    if (mainServer.type !== branchServer.type) {
+      changes.push(new DropServer({ server: mainServer }));
+      changes.push(new CreateServer({ server: branchServer }));
+      if (branchServer.comment !== null) {
+        changes.push(new CreateCommentOnServer({ server: branchServer }));
+      }
+      continue;
+    }
+
+    // VERSION
+    if (mainServer.version !== branchServer.version) {
+      changes.push(
+        new AlterServerSetVersion({
+          server: mainServer,
+          version: branchServer.version,
+        }),
+      );
+    }
+
+    // OPTIONS
+    const optionsChanged = diffOptions(
+      mainServer.options,
+      branchServer.options,
+    );
+    if (optionsChanged.length > 0) {
+      changes.push(
+        new AlterServerSetOptions({
+          server: mainServer,
+          options: optionsChanged,
+        }),
+      );
+    }
+
+    // COMMENT
+    if (mainServer.comment !== branchServer.comment) {
+      if (branchServer.comment === null) {
+        changes.push(new DropCommentOnServer({ server: mainServer }));
+      } else {
+        changes.push(new CreateCommentOnServer({ server: branchServer }));
+      }
+    }
+
+    // PRIVILEGES
+    const mainPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "server",
+      mainServer.privileges,
+    );
+    const branchPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "server",
+      branchServer.privileges,
+    );
+    const privilegeResults = diffPrivileges(
+      mainPrivilegesFiltered,
+      branchPrivilegesFiltered,
+      branchServer.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        branchServer,
+        mainServer,
+        "server",
+        {
+          Grant: GrantServerPrivileges,
+          Revoke: RevokeServerPrivileges,
+          RevokeGrantOption: RevokeGrantOptionServerPrivileges,
+        },
+        ctx.version,
+      ) as ServerChange[]),
+    );
+
+    // Note: Server renaming would also use ALTER SERVER ... RENAME TO ...
+    // But since our Server model uses 'name' as the identity field,
+    // a name change would be handled as drop + create by diffObjects()
+  }
+
+  return changes;
+}
+
+/**
+ * Diff options arrays to determine ADD/SET/DROP operations.
+ * Options are stored as [key1, value1, key2, value2, ...]
+ */
+function diffOptions(
+  mainOptions: string[] | null,
+  branchOptions: string[] | null,
+): Array<{ action: "ADD" | "SET" | "DROP"; option: string; value?: string }> {
+  const mainMap = new Map<string, string>();
+  const branchMap = new Map<string, string>();
+
+  // Parse main options
+  if (mainOptions) {
+    for (let i = 0; i < mainOptions.length; i += 2) {
+      if (i + 1 < mainOptions.length) {
+        mainMap.set(mainOptions[i], mainOptions[i + 1]);
+      }
+    }
+  }
+
+  // Parse branch options
+  if (branchOptions) {
+    for (let i = 0; i < branchOptions.length; i += 2) {
+      if (i + 1 < branchOptions.length) {
+        branchMap.set(branchOptions[i], branchOptions[i + 1]);
+      }
+    }
+  }
+
+  const changes: Array<{
+    action: "ADD" | "SET" | "DROP";
+    option: string;
+    value?: string;
+  }> = [];
+
+  // Find options to ADD or SET
+  for (const [key, value] of branchMap) {
+    const mainValue = mainMap.get(key);
+    if (mainValue === undefined) {
+      changes.push({ action: "ADD", option: key, value });
+    } else if (mainValue !== value) {
+      changes.push({ action: "SET", option: key, value });
+    }
+  }
+
+  // Find options to DROP
+  for (const [key] of mainMap) {
+    if (!branchMap.has(key)) {
+      changes.push({ action: "DROP", option: key });
+    }
+  }
+
+  return changes;
+}

package/src/core/objects/foreign-data-wrapper/server/server.model.ts

@@ -0,0 +1,160 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../../base.model.ts";
+import {
+  type PrivilegeProps,
+  privilegePropsSchema,
+} from "../../base.privilege-diff.ts";
+
+/**
+ * All properties exposed by CREATE SERVER statement are included in diff output.
+ * https://www.postgresql.org/docs/17/sql-createserver.html
+ *
+ * ALTER SERVER statement can be generated for changes to the following properties:
+ *  - owner, type, version, options
+ * https://www.postgresql.org/docs/17/sql-alterserver.html
+ *
+ * Servers are not schema-qualified (no schema property).
+ */
+const serverPropsSchema = z.object({
+  name: z.string(),
+  owner: z.string(),
+  foreign_data_wrapper: z.string(),
+  type: z.string().nullable(),
+  version: z.string().nullable(),
+  options: z.array(z.string()).nullable(),
+  comment: z.string().nullable(),
+  privileges: z.array(privilegePropsSchema),
+  // Parent FDW handler/validator — filter metadata only, not in dataFields.
+  wrapper_handler: z.string().nullable().optional(),
+  wrapper_validator: z.string().nullable().optional(),
+});
+
+type ServerPrivilegeProps = PrivilegeProps;
+export type ServerProps = z.infer<typeof serverPropsSchema>;
+
+export class Server extends BasePgModel {
+  public readonly name: ServerProps["name"];
+  public readonly owner: ServerProps["owner"];
+  public readonly foreign_data_wrapper: ServerProps["foreign_data_wrapper"];
+  public readonly type: ServerProps["type"];
+  public readonly version: ServerProps["version"];
+  public readonly options: ServerProps["options"];
+  public readonly comment: ServerProps["comment"];
+  public readonly privileges: ServerPrivilegeProps[];
+  public readonly wrapper_handler: ServerProps["wrapper_handler"];
+  public readonly wrapper_validator: ServerProps["wrapper_validator"];
+
+  constructor(props: ServerProps) {
+    super();
+
+    // Identity fields
+    this.name = props.name;
+
+    // Data fields
+    this.owner = props.owner;
+    this.foreign_data_wrapper = props.foreign_data_wrapper;
+    this.type = props.type;
+    this.version = props.version;
+    this.options = props.options;
+    this.comment = props.comment;
+    this.privileges = props.privileges;
+    this.wrapper_handler = props.wrapper_handler ?? null;
+    this.wrapper_validator = props.wrapper_validator ?? null;
+  }
+
+  get stableId(): `server:${string}` {
+    return `server:${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      owner: this.owner,
+      foreign_data_wrapper: this.foreign_data_wrapper,
+      type: this.type,
+      version: this.version,
+      options: this.options,
+      comment: this.comment,
+      privileges: this.privileges,
+    };
+  }
+}
+
+/**
+ * Extract `pg_foreign_server` rows into `Server` models.
+ *
+ * The returned models carry option values **verbatim** from
+ * `pg_foreign_server.srvoptions`, which means cleartext secrets like
+ * `password` are present in memory. Always route through
+ * `extractCatalog` (which calls `normalizeCatalog`) before emitting
+ * options to any output channel — see CLI-1467 and
+ * `packages/pg-delta/src/core/objects/foreign-data-wrapper/sensitive-options.ts`.
+ */
+export async function extractServers(pool: Pool): Promise<Server[]> {
+  const { rows: serverRows } = await pool.query<ServerProps>(sql`
+      select
+        quote_ident(srv.srvname) as name,
+        srv.srvowner::regrole::text as owner,
+        quote_ident(fdw.fdwname) as foreign_data_wrapper,
+        srv.srvtype as type,
+        srv.srvversion as version,
+        coalesce(srv.srvoptions, array[]::text[]) as options,
+        obj_description(srv.oid, 'pg_foreign_server') as comment,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object(
+                'grantee', case when x.grantee = 0 then 'PUBLIC' else x.grantee::regrole::text end,
+                'privilege', x.privilege_type,
+                'grantable', x.is_grantable
+              )
+              order by x.grantee, x.privilege_type
+            )
+            from lateral aclexplode(srv.srvacl) as x(grantor, grantee, privilege_type, is_grantable)
+          ), '[]'
+        ) as privileges,
+        case
+          when fdw.fdwhandler = 0 then null
+          else p_handler.pronamespace::regnamespace::text || '.' || quote_ident(p_handler.proname)
+        end as wrapper_handler,
+        case
+          when fdw.fdwvalidator = 0 then null
+          else p_validator.pronamespace::regnamespace::text || '.' || quote_ident(p_validator.proname)
+        end as wrapper_validator
+      from
+        pg_catalog.pg_foreign_server srv
+        inner join pg_catalog.pg_foreign_data_wrapper fdw on fdw.oid = srv.srvfdw
+        left join pg_catalog.pg_proc p_handler on p_handler.oid = fdw.fdwhandler
+        left join pg_catalog.pg_proc p_validator on p_validator.oid = fdw.fdwvalidator
+      where
+        not fdw.fdwname like any(array['pg\\_%'])
+      order by
+        srv.srvname
+  `);
+
+  // Validate and parse each row using the Zod schema
+  const validatedRows = serverRows.map((row: unknown) => {
+    const parsed = serverPropsSchema.parse(row);
+    // Parse options from PostgreSQL format ['key=value'] to ['key', 'value']
+    if (parsed.options && parsed.options.length > 0) {
+      const parsedOptions: string[] = [];
+      for (const opt of parsed.options) {
+        const eqIndex = opt.indexOf("=");
+        if (eqIndex > 0) {
+          parsedOptions.push(opt.substring(0, eqIndex));
+          parsedOptions.push(opt.substring(eqIndex + 1));
+        }
+      }
+      parsed.options = parsedOptions.length > 0 ? parsedOptions : null;
+    }
+    return parsed;
+  });
+  return validatedRows.map((row: ServerProps) => new Server(row));
+}