@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/role/role.model.ts

@@ -0,0 +1,484 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
+
+const membershipInfoSchema = z.object({
+  member: z.string(),
+  grantor: z.string(),
+  admin_option: z.boolean(),
+  inherit_option: z.boolean().nullish(),
+  set_option: z.boolean().nullish(),
+});
+
+const defaultPrivilegeSchema = z.object({
+  in_schema: z.string().nullable(),
+  objtype: z.enum(["r", "S", "f", "T", "n"]),
+  grantee: z.string(),
+  privileges: z.array(
+    z.object({ privilege: z.string(), grantable: z.boolean() }),
+  ),
+  is_implicit: z.boolean(),
+});
+
+const rolePropsSchema = z.object({
+  name: z.string(),
+  is_superuser: z.boolean(),
+  can_inherit: z.boolean(),
+  can_create_roles: z.boolean(),
+  can_create_databases: z.boolean(),
+  can_login: z.boolean(),
+  can_replicate: z.boolean(),
+  connection_limit: z.number().nullable(),
+  can_bypass_rls: z.boolean(),
+  config: z.array(z.string()).nullable(),
+  comment: z.string().nullable(),
+  members: z.array(membershipInfoSchema),
+  default_privileges: z.array(defaultPrivilegeSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+export type RoleProps = z.infer<typeof rolePropsSchema>;
+
+export class Role extends BasePgModel {
+  public readonly name: RoleProps["name"];
+  public readonly is_superuser: RoleProps["is_superuser"];
+  public readonly can_inherit: RoleProps["can_inherit"];
+  public readonly can_create_roles: RoleProps["can_create_roles"];
+  public readonly can_create_databases: RoleProps["can_create_databases"];
+  public readonly can_login: RoleProps["can_login"];
+  public readonly can_replicate: RoleProps["can_replicate"];
+  public readonly connection_limit: RoleProps["connection_limit"];
+  public readonly can_bypass_rls: RoleProps["can_bypass_rls"];
+  public readonly config: RoleProps["config"];
+  public readonly comment: RoleProps["comment"];
+  public readonly members: RoleProps["members"];
+  public readonly default_privileges: RoleProps["default_privileges"];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: RoleProps) {
+    super();
+
+    // Identity fields
+    this.name = props.name;
+
+    // Data fields
+    this.is_superuser = props.is_superuser;
+    this.can_inherit = props.can_inherit;
+    this.can_create_roles = props.can_create_roles;
+    this.can_create_databases = props.can_create_databases;
+    this.can_login = props.can_login;
+    this.can_replicate = props.can_replicate;
+    this.connection_limit = props.connection_limit;
+    this.can_bypass_rls = props.can_bypass_rls;
+    this.config = props.config;
+    this.comment = props.comment;
+    this.members = deduplicateMembers(props.members);
+    this.default_privileges = props.default_privileges;
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `role:${string}` {
+    return `role:${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    const sortedMembers = [...this.members].sort((a, b) => {
+      return (
+        a.member.localeCompare(b.member) ||
+        a.grantor.localeCompare(b.grantor) ||
+        Number(a.admin_option) - Number(b.admin_option) ||
+        Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
+        Number(a.set_option ?? false) - Number(b.set_option ?? false)
+      );
+    });
+
+    const sortedDefaultPrivs = [...this.default_privileges].map((dp) => {
+      const { is_implicit: _, ...rest } = dp;
+      return {
+        ...rest,
+        privileges: [...dp.privileges].sort((a, b) => {
+          return (
+            a.privilege.localeCompare(b.privilege) ||
+            Number(a.grantable) - Number(b.grantable)
+          );
+        }),
+      };
+    });
+    sortedDefaultPrivs.sort((a, b) => {
+      return (
+        (a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
+        a.objtype.localeCompare(b.objtype) ||
+        a.grantee.localeCompare(b.grantee)
+      );
+    });
+
+    return {
+      is_superuser: this.is_superuser,
+      can_inherit: this.can_inherit,
+      can_create_roles: this.can_create_roles,
+      can_create_databases: this.can_create_databases,
+      can_login: this.can_login,
+      can_replicate: this.can_replicate,
+      connection_limit: this.connection_limit,
+      can_bypass_rls: this.can_bypass_rls,
+      config: this.config,
+      comment: this.comment,
+      members: sortedMembers,
+      default_privileges: sortedDefaultPrivs,
+      security_labels: this.security_labels,
+    };
+  }
+}
+
+/**
+ * Deduplicate members by member name.
+ *
+ * In PostgreSQL 16+, `pg_auth_members` can have multiple rows for the same
+ * (roleid, member) pair with different grantors. Merge them into a single
+ * entry per member, combining options with OR so the most permissive wins.
+ *
+ * When merging, prefer a non-self grantor (grantor !== member) so that
+ * downstream code can detect true self-grants (auto-created by CREATE ROLE)
+ * by checking `grantor === member`.
+ */
+function deduplicateMembers(
+  members: RoleProps["members"],
+): RoleProps["members"] {
+  const map = new Map<string, RoleProps["members"][number]>();
+  for (const m of members) {
+    const existing = map.get(m.member);
+    if (existing) {
+      // admin_option is always boolean (non-nullable in schema)
+      existing.admin_option = existing.admin_option || m.admin_option;
+      // inherit_option and set_option are nullish (only available in PG 16+)
+      if (m.inherit_option != null) {
+        existing.inherit_option =
+          (existing.inherit_option ?? false) || m.inherit_option;
+      }
+      if (m.set_option != null) {
+        existing.set_option = (existing.set_option ?? false) || m.set_option;
+      }
+      // Prefer a non-self grantor so diff can detect true self-grants.
+      // Once a non-self grantor is chosen the value is kept (the specific
+      // non-self grantor doesn't matter — only the self vs non-self
+      // distinction is used downstream).
+      if (existing.grantor === existing.member && m.grantor !== m.member) {
+        existing.grantor = m.grantor;
+      }
+    } else {
+      map.set(m.member, { ...m });
+    }
+  }
+  return [...map.values()];
+}
+
+export async function extractRoles(pool: Pool): Promise<Role[]> {
+  // Check PostgreSQL version capabilities for membership options
+  const { rows: capabilitiesRows } = await pool.query<{
+    has_inherit: boolean;
+    has_set: boolean;
+  }>(sql`
+      select
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'inherit_option'
+        ) as has_inherit,
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'set_option'
+        ) as has_set
+  `);
+
+  const capabilities = capabilitiesRows[0];
+
+  let roleRows: RoleProps[];
+
+  if (capabilities?.has_inherit && capabilities?.has_set) {
+    const result = await pool.query<RoleProps>(sql`
+          WITH role_memberships AS (
+            SELECT
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',   m.rolname,
+                  'grantor',  g.rolname,
+                  'admin_option',   am.admin_option,
+                  'inherit_option', am.inherit_option,
+                  'set_option',     am.set_option
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper      AS is_superuser,
+            r.rolinherit    AS can_inherit,
+            r.rolcreaterole AS can_create_roles,
+            r.rolcreatedb   AS can_create_databases,
+            r.rolcanlogin   AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit  AS connection_limit,
+            r.rolbypassrls  AS can_bypass_rls,
+            r.rolconfig     AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(
+              (
+                SELECT json_agg(
+                  json_build_object('provider', sl.provider, 'label', sl.label)
+                  ORDER BY sl.provider
+                )
+                FROM pg_catalog.pg_shseclabel sl
+                WHERE sl.objoid = r.oid
+                  AND sl.classoid = 'pg_authid'::regclass
+              ),
+              '[]'::json
+            ) AS security_labels,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  -- Explicit entries from pg_default_acl
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    false AS is_implicit
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            r.rolname !~ '^pg_'
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1
+    `);
+    roleRows = result.rows;
+  } else {
+    const result = await pool.query<RoleProps>(sql`
+          WITH role_memberships AS (
+            SELECT
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',         m.rolname,
+                  'grantor',        g.rolname,
+                  'admin_option',   am.admin_option,
+                  'inherit_option', NULL,
+                  'set_option',     NULL
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper       AS is_superuser,
+            r.rolinherit     AS can_inherit,
+            r.rolcreaterole  AS can_create_roles,
+            r.rolcreatedb    AS can_create_databases,
+            r.rolcanlogin    AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit   AS connection_limit,
+            r.rolbypassrls   AS can_bypass_rls,
+            r.rolconfig      AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(
+              (
+                SELECT json_agg(
+                  json_build_object('provider', sl.provider, 'label', sl.label)
+                  ORDER BY sl.provider
+                )
+                FROM pg_catalog.pg_shseclabel sl
+                WHERE sl.objoid = r.oid
+                  AND sl.classoid = 'pg_authid'::regclass
+              ),
+              '[]'::json
+            ) AS security_labels,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges,
+                          'is_implicit', s.is_implicit
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  -- Explicit entries from pg_default_acl
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    false AS is_implicit
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                  UNION ALL
+                  -- Implicit defaults from acldefault() for objtypes without a
+                  -- global pg_default_acl entry.  PostgreSQL applies these implicit
+                  -- defaults (e.g. PUBLIC gets EXECUTE on functions) when no
+                  -- explicit ALTER DEFAULT PRIVILEGES has been issued.  Including
+                  -- them lets the diff detect REVOKEs of implicit grants.
+                  SELECT
+                    0 AS defaclnamespace,
+                    v.t::"char" AS defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges,
+                    true AS is_implicit
+                  FROM (VALUES ('r'), ('S'), ('f'), ('T'), ('n')) AS v(t)
+                  CROSS JOIN LATERAL aclexplode(acldefault(v.t::"char", r.oid))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE NOT EXISTS (
+                    SELECT 1 FROM pg_default_acl d2
+                    WHERE d2.defaclrole     = r.oid
+                      AND d2.defaclobjtype  = v.t::"char"
+                      AND d2.defaclnamespace = 0
+                  )
+                  GROUP BY v.t, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            r.rolname !~ '^pg_'
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1
+    `);
+    roleRows = result.rows;
+  }
+
+  // Validate and parse each row using the Zod schema
+  const validatedRows = roleRows.map((row: unknown) =>
+    rolePropsSchema.parse(row),
+  );
+  return validatedRows.map((row: RoleProps) => new Role(row));
+}

package/src/core/objects/rule/changes/rule.alter.test.ts

@@ -0,0 +1,82 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { stableId } from "../../utils.ts";
+import { Rule } from "../rule.model.ts";
+import { ReplaceRule, SetRuleEnabledState } from "./rule.alter.ts";
+
+type RuleProps = ConstructorParameters<typeof Rule>[0];
+
+const base: RuleProps = {
+  schema: "public",
+  name: '"my_rule"',
+  table_name: '"my_table"',
+  relation_kind: "r",
+  event: "INSERT",
+  enabled: "O",
+  is_instead: true,
+  owner: "owner1",
+  definition:
+    'CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+  comment: null,
+  columns: ["id"],
+};
+
+const makeRule = (override: Partial<RuleProps> = {}) =>
+  new Rule({
+    ...base,
+    ...override,
+    columns: override.columns ? [...override.columns] : [...base.columns],
+  });
+
+describe("rule.alter", () => {
+  test("replace rule serializes using create or replace and tracks dependencies", async () => {
+    const rule = makeRule({ columns: ["id", "amount"] });
+    const change = new ReplaceRule({ rule });
+
+    expect(change.requires).toEqual([
+      rule.stableId,
+      rule.relationStableId,
+      ...rule.columns.map((column) =>
+        stableId.column(rule.schema, rule.table_name, column),
+      ),
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      'CREATE OR REPLACE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+    );
+  });
+
+  test("set rule enabled state serializes appropriate clause", async () => {
+    const rule = makeRule({ columns: ["id", "amount"] });
+    const change = new SetRuleEnabledState({ rule, enabled: "D" });
+
+    expect(change.requires).toEqual([
+      rule.stableId,
+      rule.relationStableId,
+      ...rule.columns.map((column) =>
+        stableId.column(rule.schema, rule.table_name, column),
+      ),
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      'ALTER TABLE public."my_table" DISABLE RULE "my_rule"',
+    );
+  });
+
+  test("set rule enabled state defaults to rule value and supports views", async () => {
+    const rule = makeRule({
+      table_name: '"my_view"',
+      relation_kind: "v",
+      enabled: "R",
+      columns: [],
+    });
+
+    const change = new SetRuleEnabledState({ rule });
+
+    expect(change.requires).toEqual([rule.stableId, rule.relationStableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      'ALTER TABLE public."my_view" ENABLE REPLICA RULE "my_rule"',
+    );
+  });
+});

package/src/core/objects/rule/changes/rule.alter.ts

@@ -0,0 +1,73 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Rule, RuleEnabledState } from "../rule.model.ts";
+import { AlterRuleChange } from "./rule.base.ts";
+import { CreateRule } from "./rule.create.ts";
+
+export class ReplaceRule extends AlterRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "object" as const;
+
+  constructor(props: { rule: Rule }) {
+    super();
+    this.rule = props.rule;
+  }
+
+  get requires() {
+    return [
+      this.rule.stableId,
+      this.rule.relationStableId,
+      ...this.rule.columns.map((column) =>
+        stableId.column(this.rule.schema, this.rule.table_name, column),
+      ),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return new CreateRule({ rule: this.rule, orReplace: true }).serialize();
+  }
+}
+
+export class SetRuleEnabledState extends AlterRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "object" as const;
+  public readonly enabled: RuleEnabledState;
+
+  constructor(props: { rule: Rule; enabled?: RuleEnabledState }) {
+    super();
+    this.rule = props.rule;
+    this.enabled = props.enabled ?? props.rule.enabled;
+  }
+
+  get requires() {
+    return [
+      this.rule.stableId,
+      this.rule.relationStableId,
+      ...this.rule.columns.map((column) =>
+        stableId.column(this.rule.schema, this.rule.table_name, column),
+      ),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const clause = clauseForState(this.enabled);
+    return `ALTER TABLE ${this.rule.schema}.${this.rule.table_name} ${clause} ${this.rule.name}`;
+  }
+}
+
+function clauseForState(state: RuleEnabledState) {
+  switch (state) {
+    case "O":
+      return "ENABLE RULE";
+    case "D":
+      return "DISABLE RULE";
+    case "R":
+      return "ENABLE REPLICA RULE";
+    case "A":
+      return "ENABLE ALWAYS RULE";
+    default: {
+      const _exhaustive: never = state;
+      return _exhaustive;
+    }
+  }
+}

package/src/core/objects/rule/changes/rule.base.ts

@@ -0,0 +1,20 @@
+import { BaseChange } from "../../base.change.ts";
+import type { Rule } from "../rule.model.ts";
+
+abstract class BaseRuleChange extends BaseChange {
+  abstract readonly rule: Rule;
+  abstract readonly scope: "object" | "comment";
+  readonly objectType = "rule" as const;
+}
+
+export abstract class CreateRuleChange extends BaseRuleChange {
+  readonly operation = "create" as const;
+}
+
+export abstract class AlterRuleChange extends BaseRuleChange {
+  readonly operation = "alter" as const;
+}
+
+export abstract class DropRuleChange extends BaseRuleChange {
+  readonly operation = "drop" as const;
+}