@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/schema/changes/schema.security-label.test.ts

@@ -0,0 +1,76 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { stableId } from "../../utils.ts";
+import { Schema } from "../schema.model.ts";
+import {
+  CreateSecurityLabelOnSchema,
+  DropSecurityLabelOnSchema,
+} from "./schema.security-label.ts";
+
+const makeSchema = () =>
+  new Schema({
+    name: "app",
+    owner: "postgres",
+    comment: null,
+    privileges: [],
+    security_labels: [],
+  });
+
+describe("schema.security-label", () => {
+  test("create serializes and tracks dependencies", async () => {
+    const schema = makeSchema();
+    const change = new CreateSecurityLabelOnSchema({
+      schema,
+      securityLabel: {
+        provider: "pg_graphql",
+        label: '{"inflect_names":true}',
+      },
+    });
+
+    expect(change.scope).toBe("security_label");
+    expect(change.operation).toBe("create");
+    expect(change.objectType).toBe("schema");
+    expect(change.creates).toEqual([
+      stableId.securityLabel(schema.stableId, "pg_graphql"),
+    ]);
+    expect(change.requires).toEqual([schema.stableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      `SECURITY LABEL FOR pg_graphql ON SCHEMA app IS '{"inflect_names":true}'`,
+    );
+  });
+
+  test("drop serializes to IS NULL and tracks dependencies", async () => {
+    const schema = makeSchema();
+    const change = new DropSecurityLabelOnSchema({
+      schema,
+      securityLabel: { provider: "pg_graphql", label: "old" },
+    });
+
+    expect(change.scope).toBe("security_label");
+    expect(change.operation).toBe("drop");
+    expect(change.drops).toEqual([
+      stableId.securityLabel(schema.stableId, "pg_graphql"),
+    ]);
+    expect(change.requires).toEqual([
+      stableId.securityLabel(schema.stableId, "pg_graphql"),
+      schema.stableId,
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR pg_graphql ON SCHEMA app IS NULL",
+    );
+  });
+
+  test("create escapes single quotes in label", async () => {
+    const schema = makeSchema();
+    const change = new CreateSecurityLabelOnSchema({
+      schema,
+      securityLabel: { provider: "p", label: "it's a test" },
+    });
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR p ON SCHEMA app IS 'it''s a test'",
+    );
+  });
+});

package/src/core/objects/schema/changes/schema.security-label.ts

@@ -0,0 +1,77 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Schema } from "../schema.model.ts";
+import { CreateSchemaChange, DropSchemaChange } from "./schema.base.ts";
+
+export type SecurityLabelSchema =
+  | CreateSecurityLabelOnSchema
+  | DropSecurityLabelOnSchema;
+
+export class CreateSecurityLabelOnSchema extends CreateSchemaChange {
+  public readonly schema: Schema;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { schema: Schema; securityLabel: SecurityLabelProps }) {
+    super();
+    this.schema = props.schema;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(this.schema.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [this.schema.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SCHEMA",
+      this.schema.name,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnSchema extends DropSchemaChange {
+  public readonly schema: Schema;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { schema: Schema; securityLabel: SecurityLabelProps }) {
+    super();
+    this.schema = props.schema;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(this.schema.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(this.schema.stableId, this.securityLabel.provider),
+      this.schema.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON SCHEMA",
+      this.schema.name,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/schema/changes/schema.types.ts

@@ -0,0 +1,15 @@
+import type { AlterSchema } from "./schema.alter.ts";
+import type { CommentSchema } from "./schema.comment.ts";
+import type { CreateSchema } from "./schema.create.ts";
+import type { DropSchema } from "./schema.drop.ts";
+import type { SchemaPrivilege } from "./schema.privilege.ts";
+import type { SecurityLabelSchema } from "./schema.security-label.ts";
+
+/** Union of all schema-related change variants (`objectType: "schema"`). @category Change Types */
+export type SchemaChange =
+  | AlterSchema
+  | CommentSchema
+  | CreateSchema
+  | DropSchema
+  | SchemaPrivilege
+  | SecurityLabelSchema;

package/src/core/objects/schema/schema.diff.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../base.default-privileges.ts";
+import { AlterSchemaChangeOwner } from "./changes/schema.alter.ts";
+import { CreateSchema } from "./changes/schema.create.ts";
+import { DropSchema } from "./changes/schema.drop.ts";
+import { diffSchemas } from "./schema.diff.ts";
+import { Schema, type SchemaProps } from "./schema.model.ts";
+
+const base: SchemaProps = {
+  name: "utils",
+  owner: "o1",
+  comment: null,
+  privileges: [],
+  security_labels: [],
+};
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("schema.diff", () => {
+  test("create and drop", () => {
+    const s = new Schema(base);
+    const created = diffSchemas(testContext, {}, { [s.stableId]: s });
+    expect(created[0]).toBeInstanceOf(CreateSchema);
+    const dropped = diffSchemas(testContext, { [s.stableId]: s }, {});
+    expect(dropped[0]).toBeInstanceOf(DropSchema);
+  });
+
+  test("alter owner", () => {
+    const main = new Schema(base);
+    const branch = new Schema({ ...base, owner: "o2" });
+    const changes = diffSchemas(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterSchemaChangeOwner);
+  });
+});

package/src/core/objects/schema/schema.diff.ts

@@ -0,0 +1,188 @@
+import { diffObjects } from "../base.diff.ts";
+import {
+  diffPrivileges,
+  emitObjectPrivilegeChanges,
+} from "../base.privilege-diff.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
+import { diffSecurityLabels } from "../security-label.types.ts";
+import { AlterSchemaChangeOwner } from "./changes/schema.alter.ts";
+import {
+  CreateCommentOnSchema,
+  DropCommentOnSchema,
+} from "./changes/schema.comment.ts";
+import { CreateSchema } from "./changes/schema.create.ts";
+import { DropSchema } from "./changes/schema.drop.ts";
+import {
+  GrantSchemaPrivileges,
+  RevokeGrantOptionSchemaPrivileges,
+  RevokeSchemaPrivileges,
+} from "./changes/schema.privilege.ts";
+import {
+  CreateSecurityLabelOnSchema,
+  DropSecurityLabelOnSchema,
+} from "./changes/schema.security-label.ts";
+import type { SchemaChange } from "./changes/schema.types.ts";
+import type { Schema } from "./schema.model.ts";
+
+/**
+ * Diff two sets of schemas from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The schemas in the main catalog.
+ * @param branch - The schemas in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffSchemas(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  main: Record<string, Schema>,
+  branch: Record<string, Schema>,
+): SchemaChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: SchemaChange[] = [];
+
+  for (const schemaId of created) {
+    const sc = branch[schemaId];
+    changes.push(new CreateSchema({ schema: sc }));
+    if (sc.comment !== null) {
+      changes.push(new CreateCommentOnSchema({ schema: sc }));
+    }
+    for (const label of sc.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnSchema({
+          schema: sc,
+          securityLabel: label,
+        }),
+      );
+    }
+
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    // Note: Schemas don't have a schema property, so we pass empty string
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+      ctx.currentUser,
+      "schema",
+      "",
+    );
+    const creatorFilteredDefaults =
+      sc.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
+    const desiredPrivileges = sc.privileges;
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the schema owner as the reference.
+    const privilegeResults = diffPrivileges(
+      creatorFilteredDefaults,
+      desiredPrivileges,
+      sc.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        sc,
+        sc,
+        "schema",
+        {
+          Grant: GrantSchemaPrivileges,
+          Revoke: RevokeSchemaPrivileges,
+          RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        },
+        ctx.version,
+      ) as SchemaChange[]),
+    );
+  }
+
+  for (const schemaId of dropped) {
+    const mainSchema = main[schemaId];
+    for (const label of mainSchema.security_labels) {
+      changes.push(
+        new DropSecurityLabelOnSchema({
+          schema: mainSchema,
+          securityLabel: label,
+        }),
+      );
+    }
+    changes.push(new DropSchema({ schema: mainSchema }));
+  }
+
+  for (const schemaId of altered) {
+    const mainSchema = main[schemaId];
+    const branchSchema = branch[schemaId];
+
+    // OWNER
+    if (mainSchema.owner !== branchSchema.owner) {
+      changes.push(
+        new AlterSchemaChangeOwner({
+          schema: mainSchema,
+          owner: branchSchema.owner,
+        }),
+      );
+    }
+
+    // COMMENT
+    if (mainSchema.comment !== branchSchema.comment) {
+      if (branchSchema.comment === null) {
+        changes.push(new DropCommentOnSchema({ schema: mainSchema }));
+      } else {
+        changes.push(new CreateCommentOnSchema({ schema: branchSchema }));
+      }
+    }
+
+    // SECURITY LABELS
+    changes.push(
+      ...diffSecurityLabels<
+        CreateSecurityLabelOnSchema | DropSecurityLabelOnSchema
+      >(
+        mainSchema.security_labels,
+        branchSchema.security_labels,
+        (securityLabel) =>
+          new CreateSecurityLabelOnSchema({
+            schema: branchSchema,
+            securityLabel,
+          }),
+        (securityLabel) =>
+          new DropSecurityLabelOnSchema({
+            schema: mainSchema,
+            securityLabel,
+          }),
+      ),
+    );
+
+    // PRIVILEGES
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use branch owner as the reference.
+    const privilegeResults = diffPrivileges(
+      mainSchema.privileges,
+      branchSchema.privileges,
+      branchSchema.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        branchSchema,
+        mainSchema,
+        "schema",
+        {
+          Grant: GrantSchemaPrivileges,
+          Revoke: RevokeSchemaPrivileges,
+          RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        },
+        ctx.version,
+      ) as SchemaChange[]),
+    );
+
+    // Note: Schema renaming would also use ALTER SCHEMA ... RENAME TO ...
+    // But since our Schema model uses 'schema' as the identity field,
+    // a name change would be handled as drop + create by diffObjects()
+  }
+
+  return changes;
+}

package/src/core/objects/schema/schema.model.ts

@@ -0,0 +1,127 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+import {
+  type PrivilegeProps,
+  privilegePropsSchema,
+} from "../base.privilege-diff.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
+
+/**
+ * All properties exposed by CREATE SCHEMA statement are included in diff output.
+ * https://www.postgresql.org/docs/current/sql-createschema.html
+ *
+ * ALTER SCHEMA statement can be generated for all properties.
+ * https://www.postgresql.org/docs/current/sql-alterschema.html
+ */
+const schemaPropsSchema = z.object({
+  name: z.string(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+  privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+type SchemaPrivilegeProps = PrivilegeProps;
+export type SchemaProps = z.infer<typeof schemaPropsSchema>;
+
+export class Schema extends BasePgModel {
+  public readonly name: SchemaProps["name"];
+  public readonly owner: SchemaProps["owner"];
+  public readonly comment: SchemaProps["comment"];
+  public readonly privileges: SchemaPrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: SchemaProps) {
+    super();
+
+    // Identity fields
+    this.name = props.name;
+
+    // Data fields
+    this.owner = props.owner;
+    this.comment = props.comment;
+    this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `schema:${string}` {
+    return `schema:${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      owner: this.owner,
+      comment: this.comment,
+      privileges: this.privileges,
+      security_labels: this.security_labels,
+    };
+  }
+}
+
+export async function extractSchemas(pool: Pool): Promise<Schema[]> {
+  const { rows: schemaRows } = await pool.query<SchemaProps>(sql`
+    with extension_oids as (
+      select
+        objid
+      from
+        pg_depend d
+      where
+        d.refclassid = 'pg_extension'::regclass
+        and d.classid = 'pg_namespace'::regclass
+    )
+    select
+      quote_ident(nspname) as name,
+      nspowner::regrole::text as owner,
+      obj_description(oid, 'pg_namespace') as comment,
+      coalesce(
+        (
+          select json_agg(
+            json_build_object(
+              'grantee', case when x.grantee = 0 then 'PUBLIC' else x.grantee::regrole::text end,
+              'privilege', x.privilege_type,
+              'grantable', x.is_grantable
+            )
+            order by x.grantee, x.privilege_type
+          )
+          from lateral aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) as x(grantor, grantee, privilege_type, is_grantable)
+        ), '[]'
+      ) as privileges,
+      coalesce(
+        (
+          select json_agg(
+            json_build_object('provider', sl.provider, 'label', sl.label)
+            order by sl.provider
+          )
+          from pg_catalog.pg_seclabel sl
+          where sl.objoid = pg_namespace.oid
+            and sl.classoid = 'pg_namespace'::regclass
+            and sl.objsubid = 0
+        ), '[]'
+      ) as security_labels
+    from
+      pg_catalog.pg_namespace
+      left outer join extension_oids e on e.objid = oid
+      -- <EXCLUDE_INTERNAL>
+      where not nspname like any(array['pg\\_%', 'information\\_schema'])
+      and e.objid is null
+      -- </EXCLUDE_INTERNAL>
+    order by
+      1
+  `);
+  // Validate and parse each row using the Zod schema
+  const validatedRows = schemaRows.map((row: unknown) =>
+    schemaPropsSchema.parse(row),
+  );
+  return validatedRows.map((row: SchemaProps) => new Schema(row));
+}

package/src/core/objects/security-label.types.test.ts

@@ -0,0 +1,106 @@
+import { describe, expect, test } from "bun:test";
+import {
+  diffSecurityLabels,
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "./security-label.types.ts";
+
+describe("securityLabelPropsSchema", () => {
+  test("parses valid props", () => {
+    const parsed = securityLabelPropsSchema.parse({
+      provider: "p",
+      label: "l",
+    });
+    expect(parsed).toEqual({ provider: "p", label: "l" });
+  });
+
+  test("rejects null provider", () => {
+    expect(() =>
+      securityLabelPropsSchema.parse({ provider: null, label: "l" }),
+    ).toThrow();
+  });
+
+  test("rejects null label", () => {
+    expect(() =>
+      securityLabelPropsSchema.parse({ provider: "p", label: null }),
+    ).toThrow();
+  });
+});
+
+describe("diffSecurityLabels", () => {
+  type Change = { kind: "create" | "drop" } & SecurityLabelProps;
+  const makeCreate = (p: SecurityLabelProps): Change => ({
+    kind: "create",
+    ...p,
+  });
+  const makeDrop = (p: SecurityLabelProps): Change => ({
+    kind: "drop",
+    ...p,
+  });
+
+  test("both empty → no changes", () => {
+    expect(diffSecurityLabels([], [], makeCreate, makeDrop)).toEqual([]);
+  });
+
+  test("added providers emit create", () => {
+    expect(
+      diffSecurityLabels(
+        [],
+        [{ provider: "a", label: "x" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "create", provider: "a", label: "x" }]);
+  });
+
+  test("removed providers emit drop", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "x" }],
+        [],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "drop", provider: "a", label: "x" }]);
+  });
+
+  test("changed label emits create (overwrite semantics)", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "old" }],
+        [{ provider: "a", label: "new" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([{ kind: "create", provider: "a", label: "new" }]);
+  });
+
+  test("unchanged label emits nothing", () => {
+    expect(
+      diffSecurityLabels(
+        [{ provider: "a", label: "x" }],
+        [{ provider: "a", label: "x" }],
+        makeCreate,
+        makeDrop,
+      ),
+    ).toEqual([]);
+  });
+
+  test("mixed add/remove/change/unchanged across providers, sorted by provider", () => {
+    const main = [
+      { provider: "a", label: "stay" },
+      { provider: "b", label: "old" },
+      { provider: "c", label: "remove" },
+    ];
+    const branch = [
+      { provider: "a", label: "stay" },
+      { provider: "b", label: "new" },
+      { provider: "d", label: "add" },
+    ];
+    expect(diffSecurityLabels(main, branch, makeCreate, makeDrop)).toEqual([
+      { kind: "create", provider: "b", label: "new" },
+      { kind: "drop", provider: "c", label: "remove" },
+      { kind: "create", provider: "d", label: "add" },
+    ]);
+  });
+});

package/src/core/objects/security-label.types.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+
+export const securityLabelPropsSchema = z.object({
+  provider: z.string(),
+  label: z.string(),
+});
+
+export type SecurityLabelProps = z.infer<typeof securityLabelPropsSchema>;
+
+export function normalizeSecurityLabels(
+  labels: readonly SecurityLabelProps[],
+): SecurityLabelProps[] {
+  return [...labels].sort((a, b) => a.provider.localeCompare(b.provider));
+}
+
+/**
+ * Pure helper: compares two arrays of security labels keyed by provider and
+ * returns a deterministic list of create/drop changes.
+ *
+ * - Labels present only on `branch` → emit create (via makeCreate).
+ * - Labels present only on `main` → emit drop (via makeDrop).
+ * - Labels with differing `label` under the same provider → emit create
+ *   (PostgreSQL's SECURITY LABEL … IS '…' overwrites, so no separate alter).
+ * - Unchanged labels → nothing.
+ *
+ * Output order: by provider ascending.
+ */
+export function diffSecurityLabels<C>(
+  main: readonly SecurityLabelProps[],
+  branch: readonly SecurityLabelProps[],
+  makeCreate: (props: SecurityLabelProps) => C,
+  makeDrop: (props: SecurityLabelProps) => C,
+): C[] {
+  const mainByProvider = new Map(main.map((l) => [l.provider, l.label]));
+  const branchByProvider = new Map(branch.map((l) => [l.provider, l.label]));
+
+  const providers = new Set<string>([
+    ...mainByProvider.keys(),
+    ...branchByProvider.keys(),
+  ]);
+  const sortedProviders = [...providers].sort();
+
+  const out: C[] = [];
+  for (const provider of sortedProviders) {
+    const mainLabel = mainByProvider.get(provider);
+    const branchLabel = branchByProvider.get(provider);
+
+    if (mainLabel === undefined && branchLabel !== undefined) {
+      out.push(makeCreate({ provider, label: branchLabel }));
+    } else if (mainLabel !== undefined && branchLabel === undefined) {
+      out.push(makeDrop({ provider, label: mainLabel }));
+    } else if (
+      mainLabel !== undefined &&
+      branchLabel !== undefined &&
+      mainLabel !== branchLabel
+    ) {
+      out.push(makeCreate({ provider, label: branchLabel }));
+    }
+  }
+  return out;
+}