@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/role/changes/role.create.ts

@@ -0,0 +1,103 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange } from "./role.base.ts";
+
+/**
+ * Create a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createrole.html
+ *
+ * Synopsis
+ * ```sql
+ * CREATE ROLE name [ [ WITH ] option [ ... ] ]
+ * where option can be:
+ *     SUPERUSER | NOSUPERUSER
+ *     | CREATEDB | NOCREATEDB
+ *     | CREATEROLE | NOCREATEROLE
+ *     | INHERIT | NOINHERIT
+ *     | LOGIN | NOLOGIN
+ *     | REPLICATION | NOREPLICATION
+ *     | BYPASSRLS | NOBYPASSRLS
+ *     | CONNECTION LIMIT connlimit
+ *     | [ ENCRYPTED ] PASSWORD 'password' | PASSWORD NULL
+ *     | VALID UNTIL 'timestamp'
+ *     | IN ROLE role_name [, ...]
+ *     | IN GROUP role_name [, ...]
+ *     | ROLE role_name [, ...]
+ *     | ADMIN role_name [, ...]
+ *     | USER role_name [, ...]
+ *     | SYSID uid
+ * ```
+ */
+export class CreateRole extends CreateRoleChange {
+  public readonly role: Role;
+  public readonly scope = "object" as const;
+
+  constructor(props: { role: Role }) {
+    super();
+    this.role = props.role;
+  }
+
+  get creates() {
+    return [this.role.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const parts: string[] = ["CREATE ROLE"];
+
+    // Add role name
+    parts.push(this.role.name);
+
+    // Add options (only non-default values)
+    const options: string[] = [];
+
+    // SUPERUSER (default is NOSUPERUSER)
+    if (this.role.is_superuser) {
+      options.push("SUPERUSER");
+    }
+
+    // CREATEDB (default is NOCREATEDB)
+    if (this.role.can_create_databases) {
+      options.push("CREATEDB");
+    }
+
+    // CREATEROLE (default is NOCREATEROLE)
+    if (this.role.can_create_roles) {
+      options.push("CREATEROLE");
+    }
+
+    // INHERIT (default is INHERIT, so only print if false)
+    if (!this.role.can_inherit) {
+      options.push("NOINHERIT");
+    }
+
+    // LOGIN (default is NOLOGIN)
+    if (this.role.can_login) {
+      options.push("LOGIN");
+    }
+
+    // REPLICATION (default is NOREPLICATION)
+    if (this.role.can_replicate) {
+      options.push("REPLICATION");
+    }
+
+    // BYPASSRLS (default is NOBYPASSRLS)
+    if (this.role.can_bypass_rls) {
+      options.push("BYPASSRLS");
+    }
+
+    // CONNECTION LIMIT
+    if (
+      this.role.connection_limit !== null &&
+      this.role.connection_limit !== -1
+    ) {
+      options.push(`CONNECTION LIMIT ${this.role.connection_limit}`);
+    }
+
+    if (options.length > 0) {
+      parts.push("WITH", options.join(" "));
+    }
+
+    return parts.join(" ");
+  }
+}

package/src/core/objects/role/changes/role.drop.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { Role } from "../role.model.ts";
+import { DropRole } from "./role.drop.ts";
+
+describe("role", () => {
+  test("drop", async () => {
+    const role = new Role({
+      name: "test_role",
+      is_superuser: false,
+      can_inherit: true,
+      can_create_roles: false,
+      can_create_databases: false,
+      can_login: true,
+      can_replicate: false,
+      connection_limit: null,
+      can_bypass_rls: false,
+      config: null,
+      comment: null,
+      members: [],
+      default_privileges: [],
+    });
+
+    const change = new DropRole({
+      role,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe("DROP ROLE test_role");
+  });
+});

package/src/core/objects/role/changes/role.drop.ts

@@ -0,0 +1,35 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { Role } from "../role.model.ts";
+import { DropRoleChange } from "./role.base.ts";
+
+/**
+ * Drop a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-droprole.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP ROLE [ IF EXISTS ] name [, ...]
+ * ```
+ */
+export class DropRole extends DropRoleChange {
+  public readonly role: Role;
+  public readonly scope = "object" as const;
+
+  constructor(props: { role: Role }) {
+    super();
+    this.role = props.role;
+  }
+
+  get drops() {
+    return [this.role.stableId];
+  }
+
+  get requires() {
+    return [this.role.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return ["DROP ROLE", this.role.name].join(" ");
+  }
+}

package/src/core/objects/role/changes/role.privilege.ts

@@ -0,0 +1,377 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
+
+export type RolePrivilege =
+  | GrantRoleMembership
+  | RevokeRoleMembership
+  | RevokeRoleMembershipOptions
+  | GrantRoleDefaultPrivileges
+  | RevokeRoleDefaultPrivileges;
+
+/**
+ * Grant role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT role_name [, ...] TO role_specification [, ...]
+ *     [ WITH ADMIN OPTION ]
+ *     [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantRoleMembership extends CreateRoleChange {
+  public readonly role: Role;
+  public readonly member: string;
+  public readonly options: {
+    admin: boolean;
+    inherit?: boolean | null;
+    set?: boolean | null;
+  };
+  public readonly scope = "membership" as const;
+
+  constructor(props: {
+    role: Role;
+    member: string;
+    options: { admin: boolean; inherit?: boolean | null; set?: boolean | null };
+  }) {
+    super();
+    this.role = props.role;
+    this.member = props.member;
+    this.options = props.options;
+  }
+
+  get creates() {
+    return [stableId.membership(this.role.name, this.member)];
+  }
+
+  get requires() {
+    return [this.role.stableId, stableId.role(this.member)];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    // On creation, only emit ADMIN OPTION; leave INHERIT/SET to defaults
+    const opts: string[] = [];
+    if (this.options.admin) opts.push("ADMIN OPTION");
+    const withClause = opts.length > 0 ? ` WITH ${opts.join(" ")}` : "";
+    return `GRANT ${this.role.name} TO ${this.member}${withClause}`;
+  }
+}
+
+/**
+ * Revoke role membership.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ ADMIN OPTION FOR ] role_name [, ...] FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeRoleMembership extends DropRoleChange {
+  public readonly role: Role;
+  public readonly member: string;
+  public readonly scope = "membership" as const;
+
+  constructor(props: { role: Role; member: string }) {
+    super();
+    this.role = props.role;
+    this.member = props.member;
+  }
+
+  get drops() {
+    return [stableId.membership(this.role.name, this.member)];
+  }
+
+  get requires() {
+    return [
+      stableId.membership(this.role.name, this.member),
+      stableId.role(this.member),
+      this.role.stableId,
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return `REVOKE ${this.role.name} FROM ${this.member}`;
+  }
+}
+
+/**
+ * Revoke membership options for a role.
+ *
+ * This removes specific options (ADMIN, INHERIT, SET) from a role membership,
+ * but keeps the membership itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeRoleMembershipOptions extends DropRoleChange {
+  public readonly role: Role;
+  public readonly member: string;
+  public readonly admin?: boolean;
+  public readonly inherit?: boolean;
+  public readonly set?: boolean;
+  public readonly scope = "membership" as const;
+
+  constructor(props: {
+    role: Role;
+    member: string;
+    admin?: boolean;
+    inherit?: boolean;
+    set?: boolean;
+  }) {
+    super();
+    this.role = props.role;
+    this.member = props.member;
+    this.admin = props.admin;
+    this.inherit = props.inherit;
+    this.set = props.set;
+  }
+
+  get requires() {
+    return [
+      stableId.membership(this.role.name, this.member),
+      stableId.role(this.member),
+      this.role.stableId,
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const parts: string[] = [];
+    if (this.admin) parts.push("ADMIN OPTION");
+    if (this.inherit) parts.push("INHERIT OPTION");
+    if (this.set) parts.push("SET OPTION");
+    return `REVOKE ${parts.join(" ")} FOR ${this.role.name} FROM ${this.member}`;
+  }
+}
+
+/**
+ * Grant default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export class GrantRoleDefaultPrivileges extends CreateRoleChange {
+  public readonly role: Role;
+  public readonly inSchema: string | null;
+  public readonly objtype: string;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number;
+  public readonly scope = "default_privilege" as const;
+
+  constructor(props: {
+    role: Role;
+    inSchema: string | null;
+    objtype: string;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version: number;
+  }) {
+    super();
+    this.role = props.role;
+    this.inSchema = props.inSchema;
+    this.objtype = props.objtype;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [
+      stableId.defacl(
+        this.role.name,
+        this.objtype,
+        this.inSchema,
+        this.grantee,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      this.role.stableId,
+      stableId.role(this.grantee),
+      ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantRoleDefaultPrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const privSql = formatPrivilegeList(
+      this.objtype,
+      this.privileges.map((p) => p.privilege),
+      this.version,
+    );
+    return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} GRANT ${privSql} ON ${objtypeToKeyword(this.objtype)} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+/**
+ * Revoke default privileges for a role.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-alterdefaultprivileges.html
+ */
+export class RevokeRoleDefaultPrivileges extends DropRoleChange {
+  public readonly role: Role;
+  public readonly inSchema: string | null;
+  public readonly objtype: string;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number;
+  public readonly scope = "default_privilege" as const;
+
+  constructor(props: {
+    role: Role;
+    inSchema: string | null;
+    objtype: string;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version: number;
+  }) {
+    super();
+    this.role = props.role;
+    this.inSchema = props.inSchema;
+    this.objtype = props.objtype;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    return [
+      stableId.defacl(
+        this.role.name,
+        this.objtype,
+        this.inSchema,
+        this.grantee,
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.defacl(
+        this.role.name,
+        this.objtype,
+        this.inSchema,
+        this.grantee,
+      ),
+      this.role.stableId,
+      stableId.role(this.grantee),
+      ...(this.inSchema ? [stableId.schema(this.inSchema)] : []),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const scope = this.inSchema ? ` IN SCHEMA ${this.inSchema}` : "";
+    const grantOptionPrivs = this.privileges
+      .filter((p) => p.grantable)
+      .map((p) => p.privilege);
+    const basePrivs = this.privileges
+      .filter((p) => !p.grantable)
+      .map((p) => p.privilege);
+    const hasGrantOption = grantOptionPrivs.length > 0;
+    const hasBase = basePrivs.length > 0;
+    if (hasGrantOption && hasBase) {
+      throw new Error(
+        "AlterDefaultPrivilegesRevoke expects privileges from a single revoke kind",
+      );
+    }
+    if (hasGrantOption) {
+      const privSql = formatPrivilegeList(
+        this.objtype,
+        grantOptionPrivs,
+        this.version,
+      );
+      return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} REVOKE GRANT OPTION FOR ${privSql} ON ${objtypeToKeyword(this.objtype)} FROM ${this.grantee}`;
+    }
+    const privSql = formatPrivilegeList(this.objtype, basePrivs, this.version);
+    return `ALTER DEFAULT PRIVILEGES FOR ROLE ${this.role.name}${scope} REVOKE ${privSql} ON ${objtypeToKeyword(this.objtype)} FROM ${this.grantee}`;
+  }
+}
+
+// Helper functions for default privileges
+function objtypeToKeyword(objtype: string): string {
+  switch (objtype) {
+    case "r":
+      return "TABLES";
+    case "S":
+      return "SEQUENCES";
+    case "f":
+      return "ROUTINES";
+    case "T":
+      return "TYPES";
+    case "n":
+      return "SCHEMAS";
+    default:
+      return objtype;
+  }
+}
+
+function defaultPrivilegeUniverse(objtype: string, version: number): string[] {
+  // Full privilege sets per object kind for ALTER DEFAULT PRIVILEGES
+  // Keep names aligned with pg_catalog privilege_type values
+  switch (objtype) {
+    case "r": {
+      // TABLES
+      // MAINTAIN exists on PostgreSQL >= 17
+      const includesMaintain = version >= 170000;
+      return [
+        "DELETE",
+        "INSERT",
+        ...(includesMaintain ? (["MAINTAIN"] as const) : []),
+        "REFERENCES",
+        "SELECT",
+        "TRIGGER",
+        "TRUNCATE",
+        "UPDATE",
+      ];
+    }
+    case "S": // SEQUENCES
+      return ["SELECT", "UPDATE", "USAGE"].sort();
+    case "f": // ROUTINES (FUNCTIONS)
+      return ["EXECUTE"];
+    case "T": // TYPES
+      return ["USAGE"];
+    case "n": // SCHEMAS
+      return ["CREATE", "USAGE"].sort();
+    default:
+      return [];
+  }
+}
+
+function isFullPrivilegeSet(
+  objtype: string,
+  list: string[],
+  version: number,
+): boolean {
+  const uniqSorted = [...new Set(list)].sort();
+  const fullSorted = [...defaultPrivilegeUniverse(objtype, version)].sort();
+  if (uniqSorted.length !== fullSorted.length) return false;
+  for (let i = 0; i < uniqSorted.length; i++) {
+    if (uniqSorted[i] !== fullSorted[i]) return false;
+  }
+  return true;
+}
+
+function formatPrivilegeList(
+  objtype: string,
+  list: string[],
+  version: number,
+): string {
+  const uniqSorted = [...new Set(list)].sort();
+  return isFullPrivilegeSet(objtype, uniqSorted, version)
+    ? "ALL"
+    : uniqSorted.join(", ");
+}

package/src/core/objects/role/changes/role.security-label.ts

@@ -0,0 +1,77 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Role } from "../role.model.ts";
+import { CreateRoleChange, DropRoleChange } from "./role.base.ts";
+
+export type SecurityLabelRole =
+  | CreateSecurityLabelOnRole
+  | DropSecurityLabelOnRole;
+
+export class CreateSecurityLabelOnRole extends CreateRoleChange {
+  public readonly role: Role;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { role: Role; securityLabel: SecurityLabelProps }) {
+    super();
+    this.role = props.role;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [this.role.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON ROLE",
+      this.role.name,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnRole extends DropRoleChange {
+  public readonly role: Role;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { role: Role; securityLabel: SecurityLabelProps }) {
+    super();
+    this.role = props.role;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(this.role.stableId, this.securityLabel.provider),
+      this.role.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON ROLE",
+      this.role.name,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/role/changes/role.types.ts

@@ -0,0 +1,15 @@
+import type { AlterRole } from "./role.alter.ts";
+import type { CommentRole } from "./role.comment.ts";
+import type { CreateRole } from "./role.create.ts";
+import type { DropRole } from "./role.drop.ts";
+import type { RolePrivilege } from "./role.privilege.ts";
+import type { SecurityLabelRole } from "./role.security-label.ts";
+
+/** Union of all role-related change variants (`objectType: "role"`). @category Change Types */
+export type RoleChange =
+  | AlterRole
+  | CommentRole
+  | CreateRole
+  | DropRole
+  | RolePrivilege
+  | SecurityLabelRole;