@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/type/range/range.diff.test.ts

@@ -0,0 +1,147 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../../base.default-privileges.ts";
+import { AlterRangeChangeOwner } from "./changes/range.alter.ts";
+import {
+  CreateCommentOnRange,
+  DropCommentOnRange,
+} from "./changes/range.comment.ts";
+import { CreateRange } from "./changes/range.create.ts";
+import { DropRange } from "./changes/range.drop.ts";
+import {
+  GrantRangePrivileges,
+  RevokeGrantOptionRangePrivileges,
+  RevokeRangePrivileges,
+} from "./changes/range.privilege.ts";
+import { diffRanges } from "./range.diff.ts";
+import { Range, type RangeProps } from "./range.model.ts";
+
+const base: RangeProps = {
+  schema: "public",
+  name: "ts_custom",
+  owner: "o1",
+  subtype_schema: "pg_catalog",
+  subtype_str: "int4",
+  collation: null,
+  canonical_function_schema: null,
+  canonical_function_name: null,
+  subtype_diff_schema: null,
+  subtype_diff_name: null,
+  subtype_opclass_schema: null,
+  subtype_opclass_name: null,
+  comment: null,
+  privileges: [],
+};
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("range.diff", () => {
+  test("create and drop", () => {
+    const r = new Range(base);
+    const created = diffRanges(testContext, {}, { [r.stableId]: r });
+    expect(created[0]).toBeInstanceOf(CreateRange);
+    const dropped = diffRanges(testContext, { [r.stableId]: r }, {});
+    expect(dropped[0]).toBeInstanceOf(DropRange);
+  });
+
+  test("alter owner", () => {
+    const main = new Range(base);
+    const branch = new Range({ ...base, owner: "o2" });
+    const changes = diffRanges(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes[0]).toBeInstanceOf(AlterRangeChangeOwner);
+  });
+
+  test("drop and create when non-alterable property changes", () => {
+    const main = new Range(base);
+    const branch = new Range({
+      ...base,
+      subtype_schema: "pg_catalog",
+      subtype_str: "text",
+      collation: "en_US",
+    });
+    const changes = diffRanges(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes).toHaveLength(2);
+    expect(changes[0]).toBeInstanceOf(DropRange);
+    expect(changes[1]).toBeInstanceOf(CreateRange);
+  });
+
+  test("create with comment emits CreateCommentOnRange", () => {
+    const r = new Range({ ...base, comment: "my range" });
+    const changes = diffRanges(testContext, {}, { [r.stableId]: r });
+    expect(changes[0]).toBeInstanceOf(CreateRange);
+    expect(changes.some((c) => c instanceof CreateCommentOnRange)).toBe(true);
+  });
+
+  test("create with privileges emits grant changes", () => {
+    const r = new Range({
+      ...base,
+      privileges: [{ grantee: "role_a", privilege: "USAGE", grantable: false }],
+    });
+    const changes = diffRanges(testContext, {}, { [r.stableId]: r });
+    expect(changes[0]).toBeInstanceOf(CreateRange);
+    expect(changes.some((c) => c instanceof GrantRangePrivileges)).toBe(true);
+  });
+
+  test("alter comment emits create and drop comment", () => {
+    const main = new Range(base);
+    const withComment = new Range({ ...base, comment: "my range" });
+
+    const addComment = diffRanges(
+      testContext,
+      { [main.stableId]: main },
+      { [withComment.stableId]: withComment },
+    );
+    expect(addComment.some((c) => c instanceof CreateCommentOnRange)).toBe(
+      true,
+    );
+
+    const dropComment = diffRanges(
+      testContext,
+      { [withComment.stableId]: withComment },
+      { [main.stableId]: main },
+    );
+    expect(dropComment.some((c) => c instanceof DropCommentOnRange)).toBe(true);
+  });
+
+  test("alter privileges emits grant, revoke, and revoke grant option", () => {
+    const main = new Range({
+      ...base,
+      privileges: [
+        { grantee: "role_a", privilege: "USAGE", grantable: false },
+        { grantee: "role_b", privilege: "USAGE", grantable: true },
+        { grantee: "role_removed", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const branch = new Range({
+      ...base,
+      privileges: [
+        { grantee: "role_a", privilege: "USAGE", grantable: true },
+        { grantee: "role_b", privilege: "USAGE", grantable: false },
+        { grantee: "role_new", privilege: "USAGE", grantable: false },
+      ],
+    });
+
+    const changes = diffRanges(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof GrantRangePrivileges)).toBe(true);
+    expect(changes.some((c) => c instanceof RevokeRangePrivileges)).toBe(true);
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionRangePrivileges),
+    ).toBe(true);
+  });
+});

package/src/core/objects/type/range/range.diff.ts

@@ -0,0 +1,230 @@
+import { diffObjects } from "../../base.diff.ts";
+import {
+  diffPrivileges,
+  emitObjectPrivilegeChanges,
+  filterPublicBuiltInDefaults,
+} from "../../base.privilege-diff.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
+import { diffSecurityLabels } from "../../security-label.types.ts";
+import { hasNonAlterableChanges } from "../../utils.ts";
+import { AlterRangeChangeOwner } from "./changes/range.alter.ts";
+import {
+  CreateCommentOnRange,
+  DropCommentOnRange,
+} from "./changes/range.comment.ts";
+import { CreateRange } from "./changes/range.create.ts";
+import { DropRange } from "./changes/range.drop.ts";
+import {
+  GrantRangePrivileges,
+  RevokeGrantOptionRangePrivileges,
+  RevokeRangePrivileges,
+} from "./changes/range.privilege.ts";
+import {
+  CreateSecurityLabelOnRange,
+  DropSecurityLabelOnRange,
+} from "./changes/range.security-label.ts";
+import type { RangeChange } from "./changes/range.types.ts";
+import type { Range } from "./range.model.ts";
+
+/**
+ * Diff two sets of range types from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The ranges in the main catalog.
+ * @param branch - The ranges in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffRanges(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  main: Record<string, Range>,
+  branch: Record<string, Range>,
+): RangeChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: RangeChange[] = [];
+
+  for (const id of created) {
+    const createdRange = branch[id];
+    changes.push(new CreateRange({ range: createdRange }));
+
+    // OWNER: If the range type should be owned by someone other than the current user,
+    // emit ALTER TYPE ... OWNER TO after creation
+    if (createdRange.owner !== ctx.currentUser) {
+      changes.push(
+        new AlterRangeChangeOwner({
+          range: createdRange,
+          owner: createdRange.owner,
+        }),
+      );
+    }
+
+    if (createdRange.comment !== null) {
+      changes.push(new CreateCommentOnRange({ range: createdRange }));
+    }
+    for (const label of createdRange.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnRange({
+          range: createdRange,
+          securityLabel: label,
+        }),
+      );
+    }
+
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+      ctx.currentUser,
+      "range",
+      createdRange.schema ?? "",
+    );
+    const creatorFilteredDefaults =
+      createdRange.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
+    // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
+    // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
+    // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
+    const desiredPrivileges = filterPublicBuiltInDefaults(
+      "range",
+      createdRange.privileges,
+    );
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the range owner as the reference.
+    const privilegeResults = diffPrivileges(
+      filterPublicBuiltInDefaults("range", creatorFilteredDefaults),
+      desiredPrivileges,
+      createdRange.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        createdRange,
+        createdRange,
+        "range",
+        {
+          Grant: GrantRangePrivileges,
+          Revoke: RevokeRangePrivileges,
+          RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+        },
+        ctx.version,
+      ) as RangeChange[]),
+    );
+  }
+
+  for (const id of dropped) {
+    changes.push(new DropRange({ range: main[id] }));
+  }
+
+  for (const id of altered) {
+    const mainRange = main[id];
+    const branchRange = branch[id];
+
+    const NON_ALTERABLE_FIELDS: Array<keyof Range> = [
+      // Changes to these require DROP + CREATE
+      "subtype_schema",
+      "subtype_str",
+      "collation",
+      "canonical_function_schema",
+      "canonical_function_name",
+      "subtype_diff_schema",
+      "subtype_diff_name",
+      "subtype_opclass_schema",
+      "subtype_opclass_name",
+    ];
+
+    const nonAlterablePropsChanged = hasNonAlterableChanges(
+      mainRange,
+      branchRange,
+      NON_ALTERABLE_FIELDS,
+    );
+
+    if (nonAlterablePropsChanged) {
+      changes.push(
+        new DropRange({ range: mainRange }),
+        new CreateRange({ range: branchRange }),
+      );
+    } else {
+      if (mainRange.owner !== branchRange.owner) {
+        changes.push(
+          new AlterRangeChangeOwner({
+            range: mainRange,
+            owner: branchRange.owner,
+          }),
+        );
+      }
+
+      // COMMENT
+      if (mainRange.comment !== branchRange.comment) {
+        if (branchRange.comment === null) {
+          changes.push(new DropCommentOnRange({ range: mainRange }));
+        } else {
+          changes.push(new CreateCommentOnRange({ range: branchRange }));
+        }
+      }
+
+      // SECURITY LABELS
+      changes.push(
+        ...diffSecurityLabels<
+          CreateSecurityLabelOnRange | DropSecurityLabelOnRange
+        >(
+          mainRange.security_labels,
+          branchRange.security_labels,
+          (securityLabel) =>
+            new CreateSecurityLabelOnRange({
+              range: branchRange,
+              securityLabel,
+            }),
+          (securityLabel) =>
+            new DropSecurityLabelOnRange({
+              range: mainRange,
+              securityLabel,
+            }),
+        ),
+      );
+
+      // PRIVILEGES
+      // Filter out PUBLIC's built-in default USAGE privilege from main catalog
+      // (PostgreSQL grants it automatically, so we shouldn't compare it)
+      const mainPrivilegesFiltered = filterPublicBuiltInDefaults(
+        "range",
+        mainRange.privileges,
+      );
+      // Filter out PUBLIC's built-in default USAGE privilege from branch catalog
+      const branchPrivilegesFiltered = filterPublicBuiltInDefaults(
+        "range",
+        branchRange.privileges,
+      );
+      // Filter out owner privileges - owner always has ALL privileges implicitly
+      // and shouldn't be compared. Use branch owner as the reference.
+      const privilegeResults = diffPrivileges(
+        mainPrivilegesFiltered,
+        branchPrivilegesFiltered,
+        branchRange.owner,
+      );
+
+      changes.push(
+        ...(emitObjectPrivilegeChanges(
+          privilegeResults,
+          branchRange,
+          mainRange,
+          "range",
+          {
+            Grant: GrantRangePrivileges,
+            Revoke: RevokeRangePrivileges,
+            RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+          },
+          ctx.version,
+        ) as RangeChange[]),
+      );
+    }
+  }
+
+  return changes;
+}

package/src/core/objects/type/range/range.model.ts

@@ -0,0 +1,208 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../../base.model.ts";
+import {
+  type PrivilegeProps,
+  privilegePropsSchema,
+} from "../../base.privilege-diff.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../../security-label.types.ts";
+
+const rangePropsSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+
+  // Subtype information
+  subtype_schema: z.string(),
+  subtype_str: z.string(),
+
+  // Optional, only present when non-default relative to subtype
+  collation: z.string().nullable(),
+
+  // Canonical and diff functions when present (non-default)
+  canonical_function_schema: z.string().nullable(),
+  canonical_function_name: z.string().nullable(),
+  subtype_diff_schema: z.string().nullable(),
+  subtype_diff_name: z.string().nullable(),
+
+  // Optional: print only when non-default (see extractor logic)
+  subtype_opclass_schema: z.string().nullable(),
+  subtype_opclass_name: z.string().nullable(),
+  privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+type RangePrivilegeProps = PrivilegeProps;
+export type RangeProps = z.infer<typeof rangePropsSchema>;
+
+export class Range extends BasePgModel {
+  public readonly schema: RangeProps["schema"];
+  public readonly name: RangeProps["name"];
+  public readonly owner: RangeProps["owner"];
+  public readonly comment: RangeProps["comment"];
+
+  public readonly subtype_schema: RangeProps["subtype_schema"];
+  public readonly subtype_str: RangeProps["subtype_str"];
+
+  public readonly collation: RangeProps["collation"];
+
+  public readonly canonical_function_schema: RangeProps["canonical_function_schema"];
+  public readonly canonical_function_name: RangeProps["canonical_function_name"];
+  public readonly subtype_diff_schema: RangeProps["subtype_diff_schema"];
+  public readonly subtype_diff_name: RangeProps["subtype_diff_name"];
+
+  public readonly subtype_opclass_schema: RangeProps["subtype_opclass_schema"];
+  public readonly subtype_opclass_name: RangeProps["subtype_opclass_name"];
+  public readonly privileges: RangePrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: RangeProps) {
+    super();
+
+    // Identity fields
+    this.schema = props.schema;
+    this.name = props.name;
+
+    // Data fields
+    this.owner = props.owner;
+    this.comment = props.comment;
+    this.subtype_schema = props.subtype_schema;
+    this.subtype_str = props.subtype_str;
+    this.collation = props.collation;
+    this.canonical_function_schema = props.canonical_function_schema;
+    this.canonical_function_name = props.canonical_function_name;
+    this.subtype_diff_schema = props.subtype_diff_schema;
+    this.subtype_diff_name = props.subtype_diff_name;
+    this.subtype_opclass_schema = props.subtype_opclass_schema;
+    this.subtype_opclass_name = props.subtype_opclass_name;
+    this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `type:${string}` {
+    return `type:${this.schema}.${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      schema: this.schema,
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      owner: this.owner,
+      subtype_schema: this.subtype_schema,
+      subtype_str: this.subtype_str,
+      collation: this.collation,
+      canonical_function_schema: this.canonical_function_schema,
+      canonical_function_name: this.canonical_function_name,
+      subtype_diff_schema: this.subtype_diff_schema,
+      subtype_diff_name: this.subtype_diff_name,
+      subtype_opclass_schema: this.subtype_opclass_schema,
+      subtype_opclass_name: this.subtype_opclass_name,
+      comment: this.comment,
+      privileges: this.privileges,
+      security_labels: this.security_labels,
+    };
+  }
+}
+
+/**
+ * Extract all range types from the database.
+ *
+ * We intentionally capture only non-default options for CREATE TYPE AS RANGE:
+ *  - SUBTYPE is required and always present
+ *  - SUBTYPE_OPCLASS is included only when it differs from the default btree opclass
+ *  - COLLATION is included only when it differs from the subtype's typcollation
+ *  - CANONICAL and SUBTYPE_DIFF are included only when set
+ *  - MULTIRANGE_TYPE_NAME is not included (we currently do not attempt to infer
+ *    whether it differs from the default auto-generated name)
+ */
+export async function extractRanges(pool: Pool): Promise<Range[]> {
+  const { rows } = await pool.query<RangeProps>(sql`
+with extension_oids as (
+  select objid from pg_depend d
+  where d.refclassid = 'pg_extension'::regclass and d.classid = 'pg_type'::regclass
+), default_btree_opclass as (
+  -- For each input type, find its default btree operator class
+  select oc2.opcintype as type_oid, oc2.oid as opclass_oid
+  from pg_opclass oc2
+  join pg_am am on am.oid = oc2.opcmethod and am.amname = 'btree'
+  where oc2.opcdefault
+)
+select
+  -- range type identity
+  t.typnamespace::regnamespace::text as schema,
+  quote_ident(t.typname) as name,
+  t.typowner::regrole::text as owner,
+  obj_description(t.oid, 'pg_type') as comment,
+
+  -- subtype info
+  subt.typnamespace::regnamespace::text as subtype_schema,
+  format_type(r.rngsubtype, 0) as subtype_str,
+
+  -- include collation only if not default
+  case when r.rngcollation is not null and r.rngcollation <> 0 and r.rngcollation <> subt.typcollation then quote_ident(c.collname) else null end as collation,
+
+  -- include canonical/subtype_diff when set
+  case when r.rngcanonical <> 0 then pn_subcanon.nspname::regnamespace::text else null end as canonical_function_schema,
+  case when r.rngcanonical <> 0 then quote_ident(p_subcanon.proname) else null end as canonical_function_name,
+  case when r.rngsubdiff <> 0 then pn_subdiff.nspname::regnamespace::text else null end as subtype_diff_schema,
+  case when r.rngsubdiff <> 0 then quote_ident(p_subdiff.proname) else null end as subtype_diff_name,
+
+  -- include opclass only when not default for btree
+  case when r.rngsubopc is not null and r.rngsubopc <> 0 and r.rngsubopc <> dbo.opclass_oid then opc.opcnamespace::regnamespace::text else null end as subtype_opclass_schema,
+  case when r.rngsubopc is not null and r.rngsubopc <> 0 and r.rngsubopc <> dbo.opclass_oid then quote_ident(opc.opcname) else null end as subtype_opclass_name,
+
+  -- privileges
+  coalesce(
+    (
+      select json_agg(
+        json_build_object(
+          'grantee', case when x.grantee = 0 then 'PUBLIC' else x.grantee::regrole::text end,
+          'privilege', x.privilege_type,
+          'grantable', x.is_grantable
+        )
+        order by x.grantee, x.privilege_type
+      )
+      from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
+    ), '[]'
+  ) as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = t.oid
+        and sl.classoid = 'pg_type'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
+from pg_catalog.pg_range r
+join pg_catalog.pg_type t on t.oid = r.rngtypid
+join pg_catalog.pg_type subt on subt.oid = r.rngsubtype
+left join default_btree_opclass dbo on dbo.type_oid = r.rngsubtype
+left join pg_catalog.pg_opclass opc on opc.oid = r.rngsubopc
+left join pg_catalog.pg_collation c on c.oid = r.rngcollation
+left join pg_catalog.pg_proc p_subcanon on p_subcanon.oid = r.rngcanonical
+left join pg_catalog.pg_namespace pn_subcanon on pn_subcanon.oid = p_subcanon.pronamespace
+left join pg_catalog.pg_proc p_subdiff on p_subdiff.oid = r.rngsubdiff
+left join pg_catalog.pg_namespace pn_subdiff on pn_subdiff.oid = p_subdiff.pronamespace
+left outer join extension_oids e on t.oid = e.objid
+where not t.typnamespace::regnamespace::text like any(array['pg\_%', 'information\_schema'])
+  and e.objid is null
+order by 1, 2
+  `);
+  const validated = rows.map((row: unknown) => rangePropsSchema.parse(row));
+  return validated.map((row: RangeProps) => new Range(row));
+}

package/src/core/objects/type/type.types.ts

@@ -0,0 +1,6 @@
+import type { CompositeTypeChange } from "./composite-type/changes/composite-type.types.ts";
+import type { EnumChange } from "./enum/changes/enum.types.ts";
+import type { RangeChange } from "./range/changes/range.types.ts";
+
+/** Union of all type-related change variants (`objectType: "composite_type" | "enum" | "range"`). @category Change Types */
+export type TypeChange = CompositeTypeChange | EnumChange | RangeChange;