@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/table/changes/table.drop.ts

@@ -0,0 +1,87 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Table } from "../table.model.ts";
+import { DropTableChange } from "./table.base.ts";
+
+/**
+ * Drop a table.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-droptable.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP TABLE [ IF EXISTS ] name [, ...] [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class DropTable extends DropTableChange {
+  public readonly table: Table;
+  public readonly scope = "object" as const;
+  /**
+   * Names of constraints on this table that are dropped explicitly by a
+   * separate `AlterTableDropConstraint` change. Those constraints must not be
+   * claimed by `DropTable.drops` / `.requires`, otherwise catalog edges tied
+   * to the constraint stableId will attach to this DropTable node instead of
+   * the dedicated AlterTableDropConstraint node. When two tables with mutual
+   * FK references are dropped in the same phase, that misattribution
+   * produces an unbreakable cycle between the two DropTable changes.
+   */
+  public readonly externallyDroppedConstraints: ReadonlySet<string>;
+
+  constructor(props: {
+    table: Table;
+    externallyDroppedConstraints?: ReadonlySet<string>;
+  }) {
+    super();
+    this.table = props.table;
+    this.externallyDroppedConstraints =
+      props.externallyDroppedConstraints ?? new Set();
+  }
+
+  private get claimedConstraints() {
+    return this.table.constraints.filter(
+      (constraint) => !this.externallyDroppedConstraints.has(constraint.name),
+    );
+  }
+
+  get drops() {
+    return [
+      this.table.stableId,
+      ...this.table.columns.map((column) =>
+        stableId.column(this.table.schema, this.table.name, column.name),
+      ),
+      // Include constraint stableIds so FK relationships that only exist at the
+      // constraint level still affect whole-table drop ordering. Skip any
+      // constraint that the diff layer is dropping via a dedicated
+      // AlterTableDropConstraint change — that node owns the stableId.
+      ...this.claimedConstraints.map((constraint) =>
+        stableId.constraint(
+          this.table.schema,
+          this.table.name,
+          constraint.name,
+        ),
+      ),
+    ];
+  }
+
+  get requires() {
+    return [
+      this.table.stableId,
+      ...this.table.columns.map((col) =>
+        stableId.column(this.table.schema, this.table.name, col.name),
+      ),
+      // Mirror the dropped constraint ids in requires so drop-phase graph
+      // consumers can connect catalog FK edges back to this table drop.
+      ...this.claimedConstraints.map((constraint) =>
+        stableId.constraint(
+          this.table.schema,
+          this.table.name,
+          constraint.name,
+        ),
+      ),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return ["DROP TABLE", `${this.table.schema}.${this.table.name}`].join(" ");
+  }
+}

package/src/core/objects/table/changes/table.privilege.ts

@@ -0,0 +1,201 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import {
+  formatObjectPrivilegeList,
+  getObjectKindPrefix,
+} from "../../base.privilege.ts";
+import { stableId } from "../../utils.ts";
+import type { Table } from "../table.model.ts";
+import { AlterTableChange } from "./table.base.ts";
+
+export type TablePrivilege =
+  | GrantTablePrivileges
+  | RevokeTablePrivileges
+  | RevokeGrantOptionTablePrivileges;
+
+/**
+ * Grant privileges on a table.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
+ *     [, ...] | ALL [ PRIVILEGES ] }
+ *     ON { [ TABLE ] table_name [, ...]
+ *          | ALL TABLES IN SCHEMA schema_name [, ...] }
+ *     TO role_specification [, ...] [ WITH GRANT OPTION ]
+ *     [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantTablePrivileges extends AlterTableChange {
+  public readonly table: Table;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly columns?: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    table: Table;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    columns?: string[];
+    version?: number;
+  }) {
+    super();
+    this.table = props.table;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.columns = props.columns;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.table.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.table.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantTablePrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const kindPrefix = getObjectKindPrefix("TABLE");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("TABLE", list, this.version);
+    const tableName = `${this.table.schema}.${this.table.name}`;
+    const columnSpec =
+      this.columns && this.columns.length > 0
+        ? ` (${this.columns.join(", ")})`
+        : "";
+    return `GRANT ${privSql}${columnSpec} ${kindPrefix} ${tableName} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+/**
+ * Revoke privileges on a table.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ GRANT OPTION FOR ]
+ *     { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
+ *     [, ...] | ALL [ PRIVILEGES ] }
+ *     ON { [ TABLE ] table_name [, ...]
+ *          | ALL TABLES IN SCHEMA schema_name [, ...] }
+ *     FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeTablePrivileges extends AlterTableChange {
+  public readonly table: Table;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly columns?: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    table: Table;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    columns?: string[];
+    version?: number;
+  }) {
+    super();
+    this.table = props.table;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.columns = props.columns;
+    this.version = props.version;
+  }
+
+  get drops() {
+    // Return ACL ID for dependency tracking, even though this is an ALTER operation
+    // Phase assignment now uses operation type, so this won't affect phase placement
+    return [stableId.acl(this.table.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.table.stableId, this.grantee),
+      this.table.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const kindPrefix = getObjectKindPrefix("TABLE");
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("TABLE", list, this.version);
+    const tableName = `${this.table.schema}.${this.table.name}`;
+    const columnSpec =
+      this.columns && this.columns.length > 0
+        ? ` (${this.columns.join(", ")})`
+        : "";
+    return `REVOKE ${privSql}${columnSpec} ${kindPrefix} ${tableName} FROM ${this.grantee}`;
+  }
+}
+
+/**
+ * Revoke grant option for privileges on a table.
+ *
+ * This removes the ability to grant the privilege to others, but keeps the privilege itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeGrantOptionTablePrivileges extends AlterTableChange {
+  public readonly table: Table;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly columns?: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    table: Table;
+    grantee: string;
+    privilegeNames: string[];
+    columns?: string[];
+    version?: number;
+  }) {
+    super();
+    this.table = props.table;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.columns = props.columns;
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.table.stableId, this.grantee),
+      this.table.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const kindPrefix = getObjectKindPrefix("TABLE");
+    const privSql = formatObjectPrivilegeList(
+      "TABLE",
+      this.privilegeNames,
+      this.version,
+    );
+    const tableName = `${this.table.schema}.${this.table.name}`;
+    const columnSpec =
+      this.columns && this.columns.length > 0
+        ? ` (${this.columns.join(", ")})`
+        : "";
+    return `REVOKE GRANT OPTION FOR ${privSql}${columnSpec} ${kindPrefix} ${tableName} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/table/changes/table.security-label.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import type { ColumnProps } from "../../base.model.ts";
+import { stableId } from "../../utils.ts";
+import { Table, type TableProps } from "../table.model.ts";
+import {
+  CreateSecurityLabelOnColumn,
+  CreateSecurityLabelOnTable,
+  DropSecurityLabelOnColumn,
+  DropSecurityLabelOnTable,
+} from "./table.security-label.ts";
+
+const makeColumn = (overrides: Partial<ColumnProps> = {}): ColumnProps => ({
+  name: "id",
+  position: 1,
+  data_type: "integer",
+  data_type_str: "integer",
+  is_custom_type: false,
+  custom_type_type: null,
+  custom_type_category: null,
+  custom_type_schema: null,
+  custom_type_name: null,
+  not_null: false,
+  is_identity: false,
+  is_identity_always: false,
+  is_generated: false,
+  collation: null,
+  default: null,
+  comment: null,
+  ...overrides,
+});
+
+const makeTable = (): Table =>
+  new Table({
+    schema: "public",
+    name: "users",
+    persistence: "p",
+    row_security: false,
+    force_row_security: false,
+    has_indexes: false,
+    has_rules: false,
+    has_triggers: false,
+    has_subclasses: false,
+    is_populated: true,
+    replica_identity: "d",
+    is_partition: false,
+    options: null,
+    partition_bound: null,
+    partition_by: null,
+    owner: "postgres",
+    comment: null,
+    parent_schema: null,
+    parent_name: null,
+    columns: [makeColumn({ name: "email" })],
+    privileges: [],
+    security_labels: [],
+  } as TableProps);
+
+describe("table.security-label", () => {
+  test("table create serializes and tracks dependencies", async () => {
+    const table = makeTable();
+    const change = new CreateSecurityLabelOnTable({
+      table,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+
+    expect(change.scope).toBe("security_label");
+    expect(change.objectType).toBe("table");
+    expect(change.operation).toBe("create");
+    expect(change.creates).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([table.stableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON TABLE public.users IS 'classified'",
+    );
+  });
+
+  test("table drop serializes to IS NULL", async () => {
+    const table = makeTable();
+    const change = new DropSecurityLabelOnTable({
+      table,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+    expect(change.drops).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([
+      stableId.securityLabel(table.stableId, "dummy"),
+      table.stableId,
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON TABLE public.users IS NULL",
+    );
+  });
+
+  test("column create serializes and tracks dependencies", async () => {
+    const table = makeTable();
+    const column = makeColumn({ name: "email" });
+    const change = new CreateSecurityLabelOnColumn({
+      table,
+      column,
+      securityLabel: { provider: "dummy", label: "classified" },
+    });
+
+    const colStableId = stableId.column(table.schema, table.name, column.name);
+    expect(change.creates).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([colStableId]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON COLUMN public.users.email IS 'classified'",
+    );
+  });
+
+  test("column drop serializes to IS NULL", async () => {
+    const table = makeTable();
+    const column = makeColumn({ name: "email" });
+    const change = new DropSecurityLabelOnColumn({
+      table,
+      column,
+      securityLabel: { provider: "dummy", label: "x" },
+    });
+    const colStableId = stableId.column(table.schema, table.name, column.name);
+    expect(change.drops).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+    ]);
+    expect(change.requires).toEqual([
+      stableId.securityLabel(colStableId, "dummy"),
+      colStableId,
+    ]);
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "SECURITY LABEL FOR dummy ON COLUMN public.users.email IS NULL",
+    );
+  });
+});

package/src/core/objects/table/changes/table.security-label.ts

@@ -0,0 +1,183 @@
+import { quoteLiteral } from "../../base.change.ts";
+import type { ColumnProps } from "../../base.model.ts";
+import type { SecurityLabelProps } from "../../security-label.types.ts";
+import { stableId } from "../../utils.ts";
+import type { Table } from "../table.model.ts";
+import { CreateTableChange, DropTableChange } from "./table.base.ts";
+
+export type SecurityLabelTable =
+  | CreateSecurityLabelOnTable
+  | DropSecurityLabelOnTable
+  | CreateSecurityLabelOnColumn
+  | DropSecurityLabelOnColumn;
+
+/**
+ * SECURITY LABEL FOR <provider> ON TABLE <schema>.<table> IS <literal>
+ */
+export class CreateSecurityLabelOnTable extends CreateTableChange {
+  public readonly table: Table;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { table: Table; securityLabel: SecurityLabelProps }) {
+    super();
+    this.table = props.table;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [this.table.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TABLE",
+      `${this.table.schema}.${this.table.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnTable extends DropTableChange {
+  public readonly table: Table;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: { table: Table; securityLabel: SecurityLabelProps }) {
+    super();
+    this.table = props.table;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.securityLabel(this.table.stableId, this.securityLabel.provider),
+      this.table.stableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON TABLE",
+      `${this.table.schema}.${this.table.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}
+
+/**
+ * SECURITY LABEL FOR <provider> ON COLUMN <schema>.<table>.<column> IS <literal>
+ */
+export class CreateSecurityLabelOnColumn extends CreateTableChange {
+  public readonly table: Table;
+  public readonly column: ColumnProps;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    table: Table;
+    column: ColumnProps;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.table = props.table;
+    this.column = props.column;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get creates() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    return [
+      stableId.column(this.table.schema, this.table.name, this.column.name),
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON COLUMN",
+      `${this.table.schema}.${this.table.name}.${this.column.name}`,
+      "IS",
+      quoteLiteral(this.securityLabel.label),
+    ].join(" ");
+  }
+}
+
+export class DropSecurityLabelOnColumn extends DropTableChange {
+  public readonly table: Table;
+  public readonly column: ColumnProps;
+  public readonly securityLabel: SecurityLabelProps;
+  public readonly scope = "security_label" as const;
+
+  constructor(props: {
+    table: Table;
+    column: ColumnProps;
+    securityLabel: SecurityLabelProps;
+  }) {
+    super();
+    this.table = props.table;
+    this.column = props.column;
+    this.securityLabel = props.securityLabel;
+  }
+
+  get drops() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+    ];
+  }
+
+  get requires() {
+    const columnStableId = stableId.column(
+      this.table.schema,
+      this.table.name,
+      this.column.name,
+    );
+    return [
+      stableId.securityLabel(columnStableId, this.securityLabel.provider),
+      columnStableId,
+    ];
+  }
+
+  serialize(): string {
+    return [
+      "SECURITY LABEL FOR",
+      this.securityLabel.provider,
+      "ON COLUMN",
+      `${this.table.schema}.${this.table.name}.${this.column.name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/table/changes/table.types.ts

@@ -0,0 +1,15 @@
+import type { AlterTable } from "./table.alter.ts";
+import type { CommentTable } from "./table.comment.ts";
+import type { CreateTable } from "./table.create.ts";
+import type { DropTable } from "./table.drop.ts";
+import type { TablePrivilege } from "./table.privilege.ts";
+import type { SecurityLabelTable } from "./table.security-label.ts";
+
+/** Union of all table-related change variants (`objectType: "table"`). @category Change Types */
+export type TableChange =
+  | AlterTable
+  | CommentTable
+  | CreateTable
+  | DropTable
+  | TablePrivilege
+  | SecurityLabelTable;