@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/publication/publication.model.ts

@@ -0,0 +1,229 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+import {
+  normalizeSecurityLabels,
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
+
+const publicationTablePropsSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  columns: z.array(z.string()).nullable(),
+  row_filter: z.string().nullable(),
+});
+
+const publicationPropsSchema = z.object({
+  name: z.string(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+  all_tables: z.boolean(),
+  publish_insert: z.boolean(),
+  publish_update: z.boolean(),
+  publish_delete: z.boolean(),
+  publish_truncate: z.boolean(),
+  publish_via_partition_root: z.boolean(),
+  tables: z.array(publicationTablePropsSchema),
+  schemas: z.array(z.string()),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+export type PublicationTableProps = z.infer<typeof publicationTablePropsSchema>;
+export type PublicationProps = z.infer<typeof publicationPropsSchema>;
+
+/**
+ * Logical replication publication definition extracted from pg_publication.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createpublication.html
+ */
+export class Publication extends BasePgModel {
+  public readonly name: PublicationProps["name"];
+  public readonly owner: PublicationProps["owner"];
+  public readonly comment: PublicationProps["comment"];
+  public readonly all_tables: PublicationProps["all_tables"];
+  public readonly publish_insert: PublicationProps["publish_insert"];
+  public readonly publish_update: PublicationProps["publish_update"];
+  public readonly publish_delete: PublicationProps["publish_delete"];
+  public readonly publish_truncate: PublicationProps["publish_truncate"];
+  public readonly publish_via_partition_root: PublicationProps["publish_via_partition_root"];
+  public readonly tables: PublicationTableProps[];
+  public readonly schemas: PublicationProps["schemas"];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: PublicationProps) {
+    super();
+
+    this.name = props.name;
+    this.owner = props.owner;
+    this.comment = props.comment;
+    this.all_tables = props.all_tables;
+    this.publish_insert = props.publish_insert;
+    this.publish_update = props.publish_update;
+    this.publish_delete = props.publish_delete;
+    this.publish_truncate = props.publish_truncate;
+    this.publish_via_partition_root = props.publish_via_partition_root;
+
+    const normalizedTables = props.tables.map((table) => ({
+      schema: table.schema,
+      name: table.name,
+      columns: table.columns
+        ? [...table.columns].sort((a, b) => a.localeCompare(b))
+        : null,
+      row_filter: table.row_filter,
+    }));
+
+    this.tables = normalizedTables.sort((a, b) => {
+      return a.schema.localeCompare(b.schema) || a.name.localeCompare(b.name);
+    });
+
+    this.schemas = [...props.schemas].sort((a, b) => a.localeCompare(b));
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `publication:${string}` {
+    return `publication:${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      owner: this.owner,
+      comment: this.comment,
+      all_tables: this.all_tables,
+      publish_insert: this.publish_insert,
+      publish_update: this.publish_update,
+      publish_delete: this.publish_delete,
+      publish_truncate: this.publish_truncate,
+      publish_via_partition_root: this.publish_via_partition_root,
+      tables: this.tables,
+      schemas: this.schemas,
+      security_labels: this.security_labels,
+    };
+  }
+
+  override stableSnapshot() {
+    const normalizedTables = this.tables.map((table) => ({
+      schema: table.schema,
+      name: table.name,
+      columns: table.columns
+        ? [...table.columns].sort((a, b) => a.localeCompare(b))
+        : null,
+      row_filter: table.row_filter,
+    }));
+
+    return {
+      identity: this.identityFields,
+      data: {
+        ...this.dataFields,
+        tables: normalizedTables.sort(
+          (a, b) =>
+            a.schema.localeCompare(b.schema) || a.name.localeCompare(b.name),
+        ),
+        schemas: [...this.schemas].sort((a, b) => a.localeCompare(b)),
+        security_labels: normalizeSecurityLabels(this.security_labels),
+      },
+    };
+  }
+}
+
+/**
+ * Extract all logical replication publications from the database.
+ */
+export async function extractPublications(pool: Pool): Promise<Publication[]> {
+  const { rows } = await pool.query<PublicationProps>(sql`
+      with extension_oids as (
+        select objid
+        from pg_depend d
+        where d.refclassid = 'pg_extension'::regclass
+          and d.classid = 'pg_publication'::regclass
+      ),
+      publication_tables as (
+        select
+          pr.prpubid,
+          quote_ident(ns.nspname) as schema,
+          quote_ident(cls.relname) as name,
+          case
+            when pr.prattrs is null then null
+            else (
+              select json_agg(quote_ident(att.attname) order by cols.ord)
+              from unnest(pr.prattrs) with ordinality as cols(attnum, ord)
+              join pg_attribute att
+                on att.attrelid = pr.prrelid
+               and att.attnum = cols.attnum
+            )
+          end as columns,
+          pg_get_expr(pr.prqual, pr.prrelid) as row_filter
+        from pg_publication_rel pr
+        join pg_class cls on cls.oid = pr.prrelid
+        join pg_namespace ns on ns.oid = cls.relnamespace
+      ),
+      publication_schemas as (
+        select
+          pn.pnpubid,
+          quote_ident(ns.nspname) as schema
+        from pg_publication_namespace pn
+        join pg_namespace ns on ns.oid = pn.pnnspid
+      )
+      select
+        quote_ident(p.pubname) as name,
+        p.pubowner::regrole::text as owner,
+        obj_description(p.oid, 'pg_publication') as comment,
+        p.puballtables as all_tables,
+        p.pubinsert as publish_insert,
+        p.pubupdate as publish_update,
+        p.pubdelete as publish_delete,
+        p.pubtruncate as publish_truncate,
+        p.pubviaroot as publish_via_partition_root,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object(
+                'schema', t.schema,
+                'name', t.name,
+                'columns', t.columns,
+                'row_filter', t.row_filter
+              )
+              order by t.schema, t.name
+            )
+            from publication_tables t
+            where t.prpubid = p.oid
+          ),
+          '[]'::json
+        ) as tables,
+        coalesce(
+          (
+            select json_agg(s.schema order by s.schema)
+            from publication_schemas s
+            where s.pnpubid = p.oid
+          ),
+          '[]'::json
+        ) as schemas,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = p.oid
+              and sl.classoid = 'pg_publication'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
+      from pg_publication p
+      left join extension_oids e on e.objid = p.oid
+      where e.objid is null
+      order by 1
+  `);
+
+  const validated = rows.map((row) => publicationPropsSchema.parse(row));
+  return validated.map((row) => new Publication(row));
+}

package/src/core/objects/publication/utils.ts

@@ -0,0 +1,55 @@
+import type {
+  Publication,
+  PublicationTableProps,
+} from "./publication.model.ts";
+
+function wrapRowFilter(expression: string): string {
+  const trimmed = expression.trim();
+  if (trimmed.startsWith("(") && trimmed.endsWith(")")) {
+    return trimmed;
+  }
+  return `(${trimmed})`;
+}
+
+export function formatPublicationTable(table: PublicationTableProps): string {
+  let clause = `TABLE ${table.schema}.${table.name}`;
+  if (table.columns && table.columns.length > 0) {
+    clause += ` (${table.columns.join(", ")})`;
+  }
+  if (table.row_filter) {
+    clause += ` WHERE ${wrapRowFilter(table.row_filter)}`;
+  }
+  return clause;
+}
+
+export function formatPublicationObjects(
+  tables: PublicationTableProps[],
+  schemas: string[],
+): string[] {
+  const clauses: string[] = [];
+  for (const table of tables) {
+    clauses.push(formatPublicationTable(table));
+  }
+  for (const schema of schemas) {
+    clauses.push(`TABLES IN SCHEMA ${schema}`);
+  }
+  return clauses;
+}
+
+export function getPublicationOperations(publication: Publication): string[] {
+  const operations: string[] = [];
+  if (publication.publish_insert) operations.push("insert");
+  if (publication.publish_update) operations.push("update");
+  if (publication.publish_delete) operations.push("delete");
+  if (publication.publish_truncate) operations.push("truncate");
+  return operations;
+}
+
+export function isDefaultPublicationOperations(publication: Publication) {
+  return (
+    publication.publish_insert &&
+    publication.publish_update &&
+    publication.publish_delete &&
+    publication.publish_truncate
+  );
+}

package/src/core/objects/rls-policy/changes/rls-policy.alter.test.ts

@@ -0,0 +1,283 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { diffRlsPolicies } from "../rls-policy.diff.ts";
+import { RlsPolicy, type RlsPolicyProps } from "../rls-policy.model.ts";
+import {
+  AlterRlsPolicySetRoles,
+  AlterRlsPolicySetUsingExpression,
+  AlterRlsPolicySetWithCheckExpression,
+} from "./rls-policy.alter.ts";
+import { CreateRlsPolicy } from "./rls-policy.create.ts";
+import { DropRlsPolicy } from "./rls-policy.drop.ts";
+
+describe.concurrent("rls-policy", () => {
+  describe("alter", () => {
+    test("change roles", async () => {
+      const props: Omit<RlsPolicyProps, "roles"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        roles: ["public"],
+      });
+
+      const change = new AlterRlsPolicySetRoles({
+        policy,
+        roles: ["role1", "role2"],
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table TO role1, role2",
+      );
+    });
+
+    test("change roles to PUBLIC (default)", async () => {
+      const props: Omit<RlsPolicyProps, "roles"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        using_expression: "expr",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        roles: ["role1"],
+      });
+
+      const change = new AlterRlsPolicySetRoles({
+        policy,
+        roles: ["public"],
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table TO PUBLIC",
+      );
+    });
+
+    test("drop + create rls policy when command changes", async () => {
+      const props: Omit<RlsPolicyProps, "command"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const main = new RlsPolicy({
+        ...props,
+        command: "r", // SELECT
+      });
+      const branch = new RlsPolicy({
+        ...props,
+        command: "w", // UPDATE
+      });
+
+      const changes = diffRlsPolicies(
+        { [main.stableId]: main },
+        { [branch.stableId]: branch },
+      );
+
+      expect(changes).toHaveLength(2);
+      expect(changes[0]).toBeInstanceOf(DropRlsPolicy);
+      expect(changes[1]).toBeInstanceOf(CreateRlsPolicy);
+      await assertValidSql(changes[0].serialize());
+      expect(changes[0].serialize()).toBe(
+        "DROP POLICY test_policy ON public.test_table",
+      );
+      await assertValidSql(changes[1].serialize());
+      expect(changes[1].serialize()).toBe(
+        "CREATE POLICY test_policy ON public.test_table FOR UPDATE USING (user_id = current_user_id())",
+      );
+    });
+
+    test("drop + create rls policy when permissive changes", async () => {
+      const props: Omit<RlsPolicyProps, "permissive"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        roles: ["public"],
+        using_expression: "user_id = current_user_id()",
+        with_check_expression: null,
+        owner: "owner",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const main = new RlsPolicy({
+        ...props,
+        permissive: true,
+      });
+      const branch = new RlsPolicy({
+        ...props,
+        permissive: false,
+      });
+
+      const changes = diffRlsPolicies(
+        { [main.stableId]: main },
+        { [branch.stableId]: branch },
+      );
+
+      expect(changes).toHaveLength(2);
+      expect(changes[0]).toBeInstanceOf(DropRlsPolicy);
+      expect(changes[1]).toBeInstanceOf(CreateRlsPolicy);
+      await assertValidSql(changes[0].serialize());
+      expect(changes[0].serialize()).toBe(
+        "DROP POLICY test_policy ON public.test_table",
+      );
+      await assertValidSql(changes[1].serialize());
+      expect(changes[1].serialize()).toBe(
+        "CREATE POLICY test_policy ON public.test_table AS RESTRICTIVE FOR SELECT USING (user_id = current_user_id())",
+      );
+    });
+
+    test("alter using expression", async () => {
+      const props: Omit<RlsPolicyProps, "using_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        with_check_expression: null,
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        using_expression: "old_expr",
+      });
+
+      const change = new AlterRlsPolicySetUsingExpression({
+        policy,
+        usingExpression: "new_expr",
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table USING (new_expr)",
+      );
+    });
+
+    test("clear using expression -> USING (true)", async () => {
+      const props: Omit<RlsPolicyProps, "using_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        with_check_expression: null,
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        using_expression: "old_expr",
+      });
+
+      const change = new AlterRlsPolicySetUsingExpression({
+        policy,
+        usingExpression: null,
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table USING (true)",
+      );
+    });
+
+    test("alter with check expression", async () => {
+      const props: Omit<RlsPolicyProps, "with_check_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "expr",
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        with_check_expression: "old_check",
+      });
+
+      const change = new AlterRlsPolicySetWithCheckExpression({
+        policy,
+        withCheckExpression: "new_check",
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table WITH CHECK (new_check)",
+      );
+    });
+
+    test("clear with check expression -> WITH CHECK (true)", async () => {
+      const props: Omit<RlsPolicyProps, "with_check_expression"> = {
+        schema: "public",
+        name: "test_policy",
+        table_name: "test_table",
+        command: "r",
+        permissive: true,
+        roles: ["public"],
+        using_expression: "expr",
+        owner: "test",
+        comment: null,
+        referenced_relations: [],
+        referenced_procedures: [],
+      };
+      const policy = new RlsPolicy({
+        ...props,
+        with_check_expression: "old_check",
+      });
+
+      const change = new AlterRlsPolicySetWithCheckExpression({
+        policy,
+        withCheckExpression: null,
+      });
+
+      await assertValidSql(change.serialize());
+
+      expect(change.serialize()).toBe(
+        "ALTER POLICY test_policy ON public.test_table WITH CHECK (true)",
+      );
+    });
+  });
+});

package/src/core/objects/rls-policy/changes/rls-policy.alter.ts

@@ -0,0 +1,129 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { RlsPolicy } from "../rls-policy.model.ts";
+import { AlterRlsPolicyChange } from "./rls-policy.base.ts";
+
+/**
+ * Alter an RLS policy.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterpolicy.html
+ *
+ * Synopsis
+ * ```sql
+ * ALTER POLICY name ON table_name
+ *     [ TO { role_name | PUBLIC | CURRENT_ROLE | CURRENT_USER | SESSION_USER } [, ...] ]
+ *     [ USING ( using_expression ) ]
+ *     [ WITH CHECK ( with_check_expression ) ]
+ * ```
+ */
+
+export type AlterRlsPolicy =
+  | AlterRlsPolicySetRoles
+  | AlterRlsPolicySetUsingExpression
+  | AlterRlsPolicySetWithCheckExpression;
+
+/**
+ * ALTER POLICY ... TO roles ...
+ */
+export class AlterRlsPolicySetRoles extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly roles: string[];
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy; roles: string[] }) {
+    super();
+    this.policy = props.policy;
+    this.roles = props.roles;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const targetRoles = this.roles;
+    const toPublic =
+      targetRoles.length === 0 ||
+      (targetRoles.length === 1 && targetRoles[0].toLowerCase() === "public");
+    const rolesSql = toPublic ? "PUBLIC" : targetRoles.join(", ");
+
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "TO",
+      rolesSql,
+    ].join(" ");
+  }
+}
+
+/**
+ * ALTER POLICY ... USING (...)
+ */
+export class AlterRlsPolicySetUsingExpression extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly usingExpression: string | null;
+  public readonly scope = "object" as const;
+
+  constructor(props: { policy: RlsPolicy; usingExpression: string | null }) {
+    super();
+    this.policy = props.policy;
+    this.usingExpression = props.usingExpression;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const expr = this.usingExpression ?? "true";
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "USING",
+      `(${expr})`,
+    ].join(" ");
+  }
+}
+
+/**
+ * ALTER POLICY ... WITH CHECK (...)
+ */
+export class AlterRlsPolicySetWithCheckExpression extends AlterRlsPolicyChange {
+  public readonly policy: RlsPolicy;
+  public readonly withCheckExpression: string | null;
+  public readonly scope = "object" as const;
+
+  constructor(props: {
+    policy: RlsPolicy;
+    withCheckExpression: string | null;
+  }) {
+    super();
+    this.policy = props.policy;
+    this.withCheckExpression = props.withCheckExpression;
+  }
+
+  get requires() {
+    return [this.policy.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const expr = this.withCheckExpression ?? "true";
+    return [
+      "ALTER POLICY",
+      this.policy.name,
+      "ON",
+      `${this.policy.schema}.${this.policy.table_name}`,
+      "WITH CHECK",
+      `(${expr})`,
+    ].join(" ");
+  }
+}
+
+/**
+ * Replace an RLS policy by dropping and recreating it.
+ * This is used when properties that cannot be altered via ALTER POLICY change.
+ */
+// NOTE: ReplaceRlsPolicy removed. Non-alterable changes are emitted as Drop + Create in rls-policy.diff.ts.