@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/view/view.diff.ts

@@ -0,0 +1,268 @@
+import { diffObjects } from "../base.diff.ts";
+import { normalizeColumns } from "../base.model.ts";
+import {
+  diffPrivileges,
+  emitColumnPrivilegeChanges,
+} from "../base.privilege-diff.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
+import { diffSecurityLabels } from "../security-label.types.ts";
+import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
+import {
+  AlterViewChangeOwner,
+  AlterViewResetOptions,
+  AlterViewSetOptions,
+} from "./changes/view.alter.ts";
+import {
+  CreateCommentOnView,
+  DropCommentOnView,
+} from "./changes/view.comment.ts";
+import { CreateView } from "./changes/view.create.ts";
+import { DropView } from "./changes/view.drop.ts";
+import {
+  GrantViewPrivileges,
+  RevokeGrantOptionViewPrivileges,
+  RevokeViewPrivileges,
+} from "./changes/view.privilege.ts";
+import {
+  CreateSecurityLabelOnView,
+  DropSecurityLabelOnView,
+} from "./changes/view.security-label.ts";
+import type { ViewChange } from "./changes/view.types.ts";
+import type { View } from "./view.model.ts";
+
+export function buildCreateViewChanges(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  view: View,
+): ViewChange[] {
+  const changes: ViewChange[] = [new CreateView({ view })];
+
+  // OWNER: If the view should be owned by someone other than the current user,
+  // emit ALTER VIEW ... OWNER TO after creation
+  if (view.owner !== ctx.currentUser) {
+    changes.push(new AlterViewChangeOwner({ view, owner: view.owner }));
+  }
+
+  if (view.comment !== null) {
+    changes.push(new CreateCommentOnView({ view }));
+  }
+
+  for (const label of view.security_labels) {
+    changes.push(new CreateSecurityLabelOnView({ view, securityLabel: label }));
+  }
+
+  // PRIVILEGES: For created objects, compare against default privileges state
+  // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+  // so objects are created with the default privileges state in effect.
+  // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+  // needed to reach the final desired state.
+  const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+    ctx.currentUser,
+    "view",
+    view.schema ?? "",
+  );
+  const creatorFilteredDefaults =
+    view.owner !== ctx.currentUser
+      ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+      : effectiveDefaults;
+  const desiredPrivileges = view.privileges;
+  // Filter out owner privileges - owner always has ALL privileges implicitly
+  // and shouldn't be compared. Use the view owner as the reference.
+  const privilegeResults = diffPrivileges(
+    creatorFilteredDefaults,
+    desiredPrivileges,
+    view.owner,
+  );
+
+  changes.push(
+    ...(emitColumnPrivilegeChanges(
+      privilegeResults,
+      view,
+      view,
+      "view",
+      {
+        Grant: GrantViewPrivileges,
+        Revoke: RevokeViewPrivileges,
+        RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+      },
+      effectiveDefaults,
+      ctx.version,
+    ) as ViewChange[]),
+  );
+
+  return changes;
+}
+
+/**
+ * Diff two sets of views from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The views in the main catalog.
+ * @param branch - The views in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffViews(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  main: Record<string, View>,
+  branch: Record<string, View>,
+): ViewChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: ViewChange[] = [];
+
+  for (const viewId of created) {
+    changes.push(...buildCreateViewChanges(ctx, branch[viewId]));
+  }
+
+  for (const viewId of dropped) {
+    changes.push(new DropView({ view: main[viewId] }));
+  }
+
+  for (const viewId of altered) {
+    const mainView = main[viewId];
+    const branchView = branch[viewId];
+
+    // Check if non-alterable properties have changed
+    // These require dropping and recreating the view
+    const NON_ALTERABLE_FIELDS: Array<keyof View> = [
+      "definition",
+      "row_security",
+      "force_row_security",
+      "has_indexes",
+      "has_rules",
+      "has_triggers",
+      "has_subclasses",
+      "is_populated",
+      "replica_identity",
+      "is_partition",
+      "partition_bound",
+    ];
+    const nonAlterablePropsChanged = hasNonAlterableChanges(
+      mainView,
+      branchView,
+      NON_ALTERABLE_FIELDS,
+      { options: deepEqual },
+    );
+
+    // Normalize columns (strip position, sort by name) to match stableSnapshot().
+    // Position-only differences are safe to ignore here because column order in a
+    // view is determined by its definition, which is already checked above via
+    // NON_ALTERABLE_FIELDS - a position change always implies a definition change.
+    if (
+      !deepEqual(
+        normalizeColumns(mainView.columns),
+        normalizeColumns(branchView.columns),
+      )
+    ) {
+      changes.push(new DropView({ view: mainView }));
+      changes.push(...buildCreateViewChanges(ctx, branchView));
+    } else if (nonAlterablePropsChanged) {
+      // Replace the entire view using CREATE OR REPLACE to avoid drop when possible
+      changes.push(new CreateView({ view: branchView, orReplace: true }));
+    } else {
+      // Only alterable properties changed - check each one
+
+      // OWNER
+      if (mainView.owner !== branchView.owner) {
+        changes.push(
+          new AlterViewChangeOwner({ view: mainView, owner: branchView.owner }),
+        );
+      }
+
+      // VIEW OPTIONS (WITH (...))
+      if (!deepEqual(mainView.options, branchView.options)) {
+        const mainOpts = mainView.options ?? [];
+        const branchOpts = branchView.options ?? [];
+
+        // Always set branch options when provided
+        if (branchOpts.length > 0) {
+          changes.push(
+            new AlterViewSetOptions({ view: mainView, options: branchOpts }),
+          );
+        }
+
+        // Reset any params that are present in main but absent in branch
+        if (mainOpts.length > 0) {
+          const mainNames = new Set(mainOpts.map((opt) => opt.split("=")[0]));
+          const branchNames = new Set(
+            branchOpts.map((opt) => opt.split("=")[0]),
+          );
+          const removed: string[] = [];
+          for (const name of mainNames) {
+            if (!branchNames.has(name)) removed.push(name);
+          }
+          if (removed.length > 0) {
+            changes.push(
+              new AlterViewResetOptions({ view: mainView, params: removed }),
+            );
+          }
+        }
+      }
+
+      // COMMENT
+      if (mainView.comment !== branchView.comment) {
+        if (branchView.comment === null) {
+          changes.push(new DropCommentOnView({ view: mainView }));
+        } else {
+          changes.push(new CreateCommentOnView({ view: branchView }));
+        }
+      }
+
+      // SECURITY LABELS
+      changes.push(
+        ...diffSecurityLabels<
+          CreateSecurityLabelOnView | DropSecurityLabelOnView
+        >(
+          mainView.security_labels,
+          branchView.security_labels,
+          (securityLabel) =>
+            new CreateSecurityLabelOnView({
+              view: branchView,
+              securityLabel,
+            }),
+          (securityLabel) =>
+            new DropSecurityLabelOnView({
+              view: mainView,
+              securityLabel,
+            }),
+        ),
+      );
+
+      // Note: View renaming would also use ALTER VIEW ... RENAME TO ...
+      // But since our View model uses 'name' as the identity field,
+      // a name change would be handled as drop + create by diffObjects()
+
+      // PRIVILEGES (unified object and column privileges)
+      // Filter out owner privileges - owner always has ALL privileges implicitly
+      // and shouldn't be compared. Use branch owner as the reference.
+      const privilegeResults = diffPrivileges(
+        mainView.privileges,
+        branchView.privileges,
+        branchView.owner,
+      );
+
+      changes.push(
+        ...(emitColumnPrivilegeChanges(
+          privilegeResults,
+          branchView,
+          mainView,
+          "view",
+          {
+            Grant: GrantViewPrivileges,
+            Revoke: RevokeViewPrivileges,
+            RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+          },
+          mainView.privileges,
+          ctx.version,
+        ) as ViewChange[]),
+      );
+    }
+  }
+
+  return changes;
+}

package/src/core/objects/view/view.model.test.ts

@@ -0,0 +1,90 @@
+import { describe, expect, test } from "bun:test";
+import type { Pool } from "pg";
+import { extractViews, View } from "./view.model.ts";
+
+const baseRow = {
+  schema: "public",
+  row_security: false,
+  force_row_security: false,
+  has_indexes: false,
+  has_rules: false,
+  has_triggers: false,
+  has_subclasses: false,
+  is_populated: true,
+  replica_identity: "d" as const,
+  is_partition: false,
+  options: null,
+  partition_bound: null,
+  owner: "postgres",
+  comment: null,
+  columns: [],
+  privileges: [],
+};
+
+const mockPool = (rows: unknown[]): Pool =>
+  ({ query: async () => ({ rows }) }) as unknown as Pool;
+
+const mockPoolSequence = (...attempts: unknown[][]): Pool => {
+  let i = 0;
+  return {
+    query: async () => ({
+      rows: attempts[Math.min(i++, attempts.length - 1)],
+    }),
+  } as unknown as Pool;
+};
+
+const NO_BACKOFF = { backoffMs: 0 } as const;
+
+describe("extractViews", () => {
+  test("skips rows where pg_get_viewdef returned NULL after exhausting retries", async () => {
+    const views = await extractViews(
+      mockPool([
+        {
+          ...baseRow,
+          name: '"good_view"',
+          definition: "SELECT 1",
+        },
+        { ...baseRow, name: '"orphan_view"', definition: null },
+      ]),
+      NO_BACKOFF,
+    );
+
+    expect(views).toHaveLength(1);
+    expect(views[0]).toBeInstanceOf(View);
+    expect(views[0]?.name).toBe('"good_view"');
+    expect(views[0]?.definition).toBe("SELECT 1");
+  });
+
+  test("does not throw ZodError when the only row has a null definition", async () => {
+    await expect(
+      extractViews(
+        mockPool([{ ...baseRow, name: '"orphan"', definition: null }]),
+        NO_BACKOFF,
+      ),
+    ).resolves.toEqual([]);
+  });
+
+  test("returns all views when every row has a valid definition", async () => {
+    const views = await extractViews(
+      mockPool([
+        { ...baseRow, name: '"a"', definition: "SELECT 1" },
+        { ...baseRow, name: '"b"', definition: "SELECT 2" },
+      ]),
+      NO_BACKOFF,
+    );
+    expect(views.map((v) => v.name)).toEqual(['"a"', '"b"']);
+  });
+
+  test("recovers when pg_get_viewdef is NULL on first attempt but resolved on retry", async () => {
+    const views = await extractViews(
+      mockPoolSequence(
+        [{ ...baseRow, name: '"racy_view"', definition: null }],
+        [{ ...baseRow, name: '"racy_view"', definition: "SELECT 42" }],
+      ),
+      { retries: 2, backoffMs: 0 },
+    );
+    expect(views).toHaveLength(1);
+    expect(views[0]?.name).toBe('"racy_view"');
+    expect(views[0]?.definition).toBe("SELECT 42");
+  });
+});

package/src/core/objects/view/view.model.ts

@@ -0,0 +1,308 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import {
+  BasePgModel,
+  columnPropsSchema,
+  normalizeColumns,
+  type TableLikeObject,
+} from "../base.model.ts";
+import {
+  type PrivilegeProps,
+  privilegePropsSchema,
+} from "../base.privilege-diff.ts";
+import {
+  type ExtractRetryOptions,
+  extractWithDefinitionRetry,
+} from "../extract-with-retry.ts";
+import {
+  normalizeSecurityLabels,
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
+import { ReplicaIdentitySchema } from "../table/table.model.ts";
+
+const viewPropsSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  definition: z.string(),
+  row_security: z.boolean(),
+  force_row_security: z.boolean(),
+  has_indexes: z.boolean(),
+  has_rules: z.boolean(),
+  has_triggers: z.boolean(),
+  has_subclasses: z.boolean(),
+  is_populated: z.boolean(),
+  replica_identity: ReplicaIdentitySchema,
+  is_partition: z.boolean(),
+  options: z.array(z.string()).nullable(),
+  partition_bound: z.string().nullable(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+  columns: z.array(columnPropsSchema),
+  privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+// pg_get_viewdef(oid) can return NULL when the underlying view (or its
+// pg_rewrite row) is dropped between catalog scan and resolution, or under
+// transient catalog state during recovery. An unreadable view cannot be
+// diffed, so we accept NULL here and filter the row out at extraction time
+// rather than crashing the whole catalog parse with a ZodError.
+const viewRowSchema = viewPropsSchema.extend({
+  definition: z.string().nullable(),
+});
+
+type ViewPrivilegeProps = PrivilegeProps;
+export type ViewProps = z.infer<typeof viewPropsSchema>;
+
+export class View extends BasePgModel implements TableLikeObject {
+  public readonly schema: ViewProps["schema"];
+  public readonly name: ViewProps["name"];
+  public readonly definition: ViewProps["definition"];
+  public readonly row_security: ViewProps["row_security"];
+  public readonly force_row_security: ViewProps["force_row_security"];
+  public readonly has_indexes: ViewProps["has_indexes"];
+  public readonly has_rules: ViewProps["has_rules"];
+  public readonly has_triggers: ViewProps["has_triggers"];
+  public readonly has_subclasses: ViewProps["has_subclasses"];
+  public readonly is_populated: ViewProps["is_populated"];
+  public readonly replica_identity: ViewProps["replica_identity"];
+  public readonly is_partition: ViewProps["is_partition"];
+  public readonly options: ViewProps["options"];
+  public readonly partition_bound: ViewProps["partition_bound"];
+  public readonly owner: ViewProps["owner"];
+  public readonly comment: ViewProps["comment"];
+  public readonly columns: ViewProps["columns"];
+  public readonly privileges: ViewPrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: ViewProps) {
+    super();
+
+    // Identity fields
+    this.schema = props.schema;
+    this.name = props.name;
+
+    // Data fields
+    this.definition = props.definition;
+    this.row_security = props.row_security;
+    this.force_row_security = props.force_row_security;
+    this.has_indexes = props.has_indexes;
+    this.has_rules = props.has_rules;
+    this.has_triggers = props.has_triggers;
+    this.has_subclasses = props.has_subclasses;
+    this.is_populated = props.is_populated;
+    this.replica_identity = props.replica_identity;
+    this.is_partition = props.is_partition;
+    this.options = props.options;
+    this.partition_bound = props.partition_bound;
+    this.owner = props.owner;
+    this.comment = props.comment;
+    this.columns = props.columns;
+    this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `view:${string}` {
+    return `view:${this.schema}.${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      schema: this.schema,
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      definition: this.definition,
+      row_security: this.row_security,
+      force_row_security: this.force_row_security,
+      has_indexes: this.has_indexes,
+      has_rules: this.has_rules,
+      has_triggers: this.has_triggers,
+      has_subclasses: this.has_subclasses,
+      is_populated: this.is_populated,
+      replica_identity: this.replica_identity,
+      is_partition: this.is_partition,
+      options: this.options,
+      partition_bound: this.partition_bound,
+      owner: this.owner,
+      comment: this.comment,
+      columns: this.columns,
+      privileges: this.privileges,
+      security_labels: this.security_labels,
+    };
+  }
+
+  override stableSnapshot() {
+    return {
+      identity: this.identityFields,
+      data: {
+        ...this.dataFields,
+        columns: normalizeColumns(this.columns),
+        security_labels: normalizeSecurityLabels(this.security_labels),
+      },
+    };
+  }
+}
+
+export async function extractViews(
+  pool: Pool,
+  options?: ExtractRetryOptions,
+): Promise<View[]> {
+  const viewRows = await extractWithDefinitionRetry({
+    label: "views",
+    options,
+    hasNullDefinition: (row) => row.definition === null,
+    query: async () => {
+      const result = await pool.query<ViewProps>(sql`
+with extension_oids as (
+  select
+    objid
+  from
+    pg_depend d
+  where
+    d.refclassid = 'pg_extension'::regclass
+    and d.classid = 'pg_class'::regclass
+), views as (
+  select
+    c.relnamespace::regnamespace::text as schema,
+    quote_ident(c.relname) as name,
+    rtrim(pg_get_viewdef(c.oid), ';') as definition,
+    c.relrowsecurity as row_security,
+    c.relforcerowsecurity as force_row_security,
+    c.relhasindex as has_indexes,
+    c.relhasrules as has_rules,
+    c.relhastriggers as has_triggers,
+    c.relhassubclass as has_subclasses,
+    c.relispopulated as is_populated,
+    c.relreplident as replica_identity,
+    c.relispartition as is_partition,
+    c.reloptions as options,
+    pg_get_expr(c.relpartbound, c.oid) as partition_bound,
+    c.relowner::regrole::text as owner,
+    obj_description(c.oid, 'pg_class') as comment,
+    c.oid as oid
+  from
+    pg_catalog.pg_class c
+    left outer join extension_oids e on c.oid = e.objid
+  where not c.relnamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
+    and e.objid is null
+    and c.relkind = 'v'
+)
+select
+  v.schema,
+  v.name,
+  v.definition,
+  v.row_security,
+  v.force_row_security,
+  v.has_indexes,
+  v.has_rules,
+  v.has_triggers,
+  v.has_subclasses,
+  v.is_populated,
+  v.replica_identity,
+  v.is_partition,
+  v.options,
+  v.partition_bound,
+  v.owner,
+  v.comment,
+  coalesce(json_agg(
+    case when a.attname is not null then
+      json_build_object(
+        'name', quote_ident(a.attname),
+        'position', a.attnum,
+        'data_type', a.atttypid::regtype::text,
+        'data_type_str', format_type(a.atttypid, a.atttypmod),
+        'is_custom_type', ty.typnamespace::regnamespace::text not in ('pg_catalog', 'information_schema'),
+        'custom_type_type', case when ty.typnamespace::regnamespace::text not in ('pg_catalog', 'information_schema') then ty.typtype else null end,
+        'custom_type_category', case when ty.typnamespace::regnamespace::text not in ('pg_catalog', 'information_schema') then ty.typcategory else null end,
+        'custom_type_schema', case when ty.typnamespace::regnamespace::text not in ('pg_catalog', 'information_schema') then ty.typnamespace::regnamespace else null end,
+        'custom_type_name', case when ty.typnamespace::regnamespace::text not in ('pg_catalog', 'information_schema') then quote_ident(ty.typname) else null end,
+        'not_null', a.attnotnull,
+        'is_identity', a.attidentity != '',
+        'is_identity_always', a.attidentity = 'a',
+        'is_generated', a.attgenerated != '',
+        'collation', (
+          select quote_ident(c2.collname)
+          from pg_collation c2, pg_type t2
+          where c2.oid = a.attcollation
+            and t2.oid = a.atttypid
+            and a.attcollation <> t2.typcollation
+        ),
+        'default', pg_get_expr(ad.adbin, ad.adrelid),
+        'comment', col_description(a.attrelid, a.attnum)
+      )
+    end
+    order by a.attnum
+  ) filter (where a.attname is not null), '[]') as columns,
+  coalesce((
+    select json_agg(
+            json_build_object(
+              'grantee', case when grp.grantee = 0 then 'PUBLIC' else grp.grantee::regrole::text end,
+              'privilege', grp.privilege_type,
+              'grantable', grp.is_grantable,
+              'columns', case when grp.cols is not null and array_length(grp.cols,1) > 0
+                              then grp.cols
+                              else null end
+            )
+            order by grp.grantee, grp.privilege_type
+          )
+    from (
+      select
+        x.grantee,
+        x.privilege_type,
+        bool_or(x.is_grantable) as is_grantable,
+        array_agg(quote_ident(src.attname) order by src.attname)
+          filter (where src.attname is not null) as cols
+      from (
+        -- one row for object ACL + one row per column ACL
+        select null::name as attname, v.oid as relacl_oid, (
+          select COALESCE(c_rel.relacl, acldefault('r', c_rel.relowner)) from pg_class c_rel where c_rel.oid = v.oid
+        ) as acl
+        union all
+        select a2.attname, v.oid as relacl_oid, a2.attacl
+        from pg_attribute a2
+        where a2.attrelid = v.oid
+          and a2.attnum > 0
+          and not a2.attisdropped
+          and a2.attacl is not null
+      ) as src
+      join lateral aclexplode(src.acl) as x(grantor, grantee, privilege_type, is_grantable) on true
+      group by x.grantee, x.privilege_type
+    ) as grp
+  ), '[]') as privileges,
+  coalesce(
+    (
+      select json_agg(
+        json_build_object('provider', sl.provider, 'label', sl.label)
+        order by sl.provider
+      )
+      from pg_catalog.pg_seclabel sl
+      where sl.objoid = v.oid
+        and sl.classoid = 'pg_class'::regclass
+        and sl.objsubid = 0
+    ),
+    '[]'::json
+  ) as security_labels
+from
+  views v
+  left join pg_attribute a on a.attrelid = v.oid and a.attnum > 0 and not a.attisdropped
+  left join pg_attrdef ad on a.attrelid = ad.adrelid and a.attnum = ad.adnum
+  left join pg_type ty on ty.oid = a.atttypid
+group by
+  v.oid, v.schema, v.name, v.definition, v.row_security, v.force_row_security, v.has_indexes, v.has_rules, v.has_triggers, v.has_subclasses, v.is_populated, v.replica_identity, v.is_partition, v.options, v.partition_bound, v.owner, v.comment
+order by
+  v.schema, v.name
+  `);
+      return result.rows.map((row: unknown) => viewRowSchema.parse(row));
+    },
+  });
+  const validatedRows = viewRows.filter(
+    (row): row is ViewProps => row.definition !== null,
+  );
+  return validatedRows.map((row) => new View(row));
+}