@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/domain/domain.diff.ts

@@ -0,0 +1,328 @@
+import { diffObjects } from "../base.diff.ts";
+import {
+  diffPrivileges,
+  emitObjectPrivilegeChanges,
+  filterPublicBuiltInDefaults,
+} from "../base.privilege-diff.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
+import { diffSecurityLabels } from "../security-label.types.ts";
+import {
+  AlterDomainAddConstraint,
+  AlterDomainChangeOwner,
+  AlterDomainDropConstraint,
+  AlterDomainDropDefault,
+  AlterDomainDropNotNull,
+  AlterDomainSetDefault,
+  AlterDomainSetNotNull,
+  AlterDomainValidateConstraint,
+} from "./changes/domain.alter.ts";
+import {
+  CreateCommentOnDomain,
+  DropCommentOnDomain,
+} from "./changes/domain.comment.ts";
+import { CreateDomain } from "./changes/domain.create.ts";
+import { DropDomain } from "./changes/domain.drop.ts";
+import {
+  GrantDomainPrivileges,
+  RevokeDomainPrivileges,
+  RevokeGrantOptionDomainPrivileges,
+} from "./changes/domain.privilege.ts";
+import {
+  CreateSecurityLabelOnDomain,
+  DropSecurityLabelOnDomain,
+} from "./changes/domain.security-label.ts";
+import type { DomainChange } from "./changes/domain.types.ts";
+import type { Domain } from "./domain.model.ts";
+
+/**
+ * Diff two sets of domains from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The domains in the main catalog.
+ * @param branch - The domains in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffDomains(
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
+  main: Record<string, Domain>,
+  branch: Record<string, Domain>,
+): DomainChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: DomainChange[] = [];
+
+  for (const domainId of created) {
+    const newDomain = branch[domainId];
+    changes.push(new CreateDomain({ domain: newDomain }));
+
+    // OWNER: If the domain should be owned by someone other than the current user,
+    // emit ALTER DOMAIN ... OWNER TO after creation
+    if (newDomain.owner !== ctx.currentUser) {
+      changes.push(
+        new AlterDomainChangeOwner({
+          domain: newDomain,
+          owner: newDomain.owner,
+        }),
+      );
+    }
+
+    if (newDomain.comment !== null) {
+      changes.push(new CreateCommentOnDomain({ domain: newDomain }));
+    }
+    for (const label of newDomain.security_labels) {
+      changes.push(
+        new CreateSecurityLabelOnDomain({
+          domain: newDomain,
+          securityLabel: label,
+        }),
+      );
+    }
+    // For unvalidated constraints, CREATE DOMAIN cannot specify NOT VALID.
+    // Add them after creation and validate to match branch state semantics.
+    // For already validated constraints, they are emitted inline in CREATE DOMAIN.
+    if (newDomain.constraints && newDomain.constraints.length > 0) {
+      for (const c of newDomain.constraints) {
+        if (c.validated === false) {
+          changes.push(
+            new AlterDomainAddConstraint({ domain: newDomain, constraint: c }),
+          );
+          changes.push(
+            new AlterDomainValidateConstraint({
+              domain: newDomain,
+              constraint: c,
+            }),
+          );
+        }
+      }
+    }
+
+    // PRIVILEGES: For created objects, compare against default privileges state
+    // The migration script will run ALTER DEFAULT PRIVILEGES before CREATE (via constraint spec),
+    // so objects are created with the default privileges state in effect.
+    // We compare default privileges against desired privileges to generate REVOKE/GRANT statements
+    // needed to reach the final desired state.
+    const effectiveDefaults = ctx.defaultPrivilegeState.getEffectiveDefaults(
+      ctx.currentUser,
+      "domain",
+      newDomain.schema ?? "",
+    );
+    const creatorFilteredDefaults =
+      newDomain.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
+    // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
+    // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
+    // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
+    const desiredPrivileges = filterPublicBuiltInDefaults(
+      "domain",
+      newDomain.privileges,
+    );
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use the domain owner as the reference.
+    const privilegeResults = diffPrivileges(
+      filterPublicBuiltInDefaults("domain", creatorFilteredDefaults),
+      desiredPrivileges,
+      newDomain.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        newDomain,
+        newDomain,
+        "domain",
+        {
+          Grant: GrantDomainPrivileges,
+          Revoke: RevokeDomainPrivileges,
+          RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        },
+        ctx.version,
+      ) as DomainChange[]),
+    );
+  }
+
+  for (const domainId of dropped) {
+    changes.push(new DropDomain({ domain: main[domainId] }));
+  }
+
+  for (const domainId of altered) {
+    const mainDomain = main[domainId];
+    const branchDomain = branch[domainId];
+
+    // DEFAULT
+    if (mainDomain.default_value !== branchDomain.default_value) {
+      if (branchDomain.default_value === null) {
+        changes.push(new AlterDomainDropDefault({ domain: mainDomain }));
+      } else {
+        changes.push(
+          new AlterDomainSetDefault({
+            domain: mainDomain,
+            defaultValue: branchDomain.default_value,
+          }),
+        );
+      }
+    }
+
+    // NOT NULL
+    if (mainDomain.not_null !== branchDomain.not_null) {
+      if (branchDomain.not_null) {
+        changes.push(new AlterDomainSetNotNull({ domain: mainDomain }));
+      } else {
+        changes.push(new AlterDomainDropNotNull({ domain: mainDomain }));
+      }
+    }
+
+    // DOMAIN CONSTRAINTS
+    const mainByName = new Map(mainDomain.constraints.map((c) => [c.name, c]));
+    const branchByName = new Map(
+      branchDomain.constraints.map((c) => [c.name, c]),
+    );
+
+    // Note: Constraint renames are modeled as drop+add because name is part
+    // of the identity we diff on. No dedicated rename class is generated here.
+
+    // Created
+    for (const [name, c] of branchByName) {
+      if (!mainByName.has(name)) {
+        changes.push(
+          new AlterDomainAddConstraint({
+            domain: branchDomain,
+            constraint: c,
+          }),
+        );
+        if (!c.validated) {
+          changes.push(
+            new AlterDomainValidateConstraint({
+              domain: branchDomain,
+              constraint: c,
+            }),
+          );
+        }
+      }
+    }
+
+    // Dropped
+    for (const [name, c] of mainByName) {
+      if (!branchByName.has(name)) {
+        changes.push(
+          new AlterDomainDropConstraint({
+            domain: mainDomain,
+            constraint: c,
+          }),
+        );
+      }
+    }
+
+    // Altered (drop + add for now)
+    for (const [name, mainC] of mainByName) {
+      const branchC = branchByName.get(name);
+      if (!branchC) continue;
+      const changed =
+        mainC.validated !== branchC.validated ||
+        mainC.is_local !== branchC.is_local ||
+        mainC.no_inherit !== branchC.no_inherit ||
+        mainC.check_expression !== branchC.check_expression;
+      if (changed) {
+        changes.push(
+          new AlterDomainDropConstraint({
+            domain: mainDomain,
+            constraint: mainC,
+          }),
+        );
+        changes.push(
+          new AlterDomainAddConstraint({
+            domain: branchDomain,
+            constraint: branchC,
+          }),
+        );
+        if (!branchC.validated) {
+          changes.push(
+            new AlterDomainValidateConstraint({
+              domain: branchDomain,
+              constraint: branchC,
+            }),
+          );
+        }
+      }
+    }
+
+    // OWNER
+    if (mainDomain.owner !== branchDomain.owner) {
+      changes.push(
+        new AlterDomainChangeOwner({
+          domain: mainDomain,
+          owner: branchDomain.owner,
+        }),
+      );
+    }
+
+    // COMMENT
+    if (mainDomain.comment !== branchDomain.comment) {
+      if (branchDomain.comment === null) {
+        changes.push(new DropCommentOnDomain({ domain: mainDomain }));
+      } else {
+        changes.push(new CreateCommentOnDomain({ domain: branchDomain }));
+      }
+    }
+
+    // SECURITY LABELS
+    changes.push(
+      ...diffSecurityLabels<
+        CreateSecurityLabelOnDomain | DropSecurityLabelOnDomain
+      >(
+        mainDomain.security_labels,
+        branchDomain.security_labels,
+        (securityLabel) =>
+          new CreateSecurityLabelOnDomain({
+            domain: branchDomain,
+            securityLabel,
+          }),
+        (securityLabel) =>
+          new DropSecurityLabelOnDomain({
+            domain: mainDomain,
+            securityLabel,
+          }),
+      ),
+    );
+
+    // PRIVILEGES
+    // Filter out PUBLIC's built-in default USAGE privilege from main catalog
+    // (PostgreSQL grants it automatically, so we shouldn't compare it)
+    const mainPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "domain",
+      mainDomain.privileges,
+    );
+    // Filter out PUBLIC's built-in default USAGE privilege from branch catalog
+    const branchPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "domain",
+      branchDomain.privileges,
+    );
+    // Filter out owner privileges - owner always has ALL privileges implicitly
+    // and shouldn't be compared. Use branch owner as the reference.
+    const privilegeResults = diffPrivileges(
+      mainPrivilegesFiltered,
+      branchPrivilegesFiltered,
+      branchDomain.owner,
+    );
+
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        branchDomain,
+        mainDomain,
+        "domain",
+        {
+          Grant: GrantDomainPrivileges,
+          Revoke: RevokeDomainPrivileges,
+          RevokeGrantOption: RevokeGrantOptionDomainPrivileges,
+        },
+        ctx.version,
+      ) as DomainChange[]),
+    );
+  }
+
+  return changes;
+}

package/src/core/objects/domain/domain.model.ts

@@ -0,0 +1,211 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+import {
+  type PrivilegeProps,
+  privilegePropsSchema,
+} from "../base.privilege-diff.ts";
+import {
+  type SecurityLabelProps,
+  securityLabelPropsSchema,
+} from "../security-label.types.ts";
+
+const domainConstraintPropsSchema = z.object({
+  name: z.string(),
+  validated: z.boolean(),
+  is_local: z.boolean(),
+  no_inherit: z.boolean(),
+  check_expression: z.string().nullable(),
+});
+
+const domainPropsSchema = z.object({
+  schema: z.string(),
+  name: z.string(),
+  base_type: z.string(),
+  base_type_schema: z.string(),
+  base_type_str: z.string().optional(),
+  not_null: z.boolean(),
+  type_modifier: z.number().nullable(),
+  array_dimensions: z.number().nullable(),
+  collation: z.string().nullable(),
+  default_bin: z.string().nullable(),
+  default_value: z.string().nullable(),
+  owner: z.string(),
+  comment: z.string().nullable(),
+  constraints: z.array(domainConstraintPropsSchema),
+  privileges: z.array(privilegePropsSchema),
+  security_labels: z.array(securityLabelPropsSchema).default([]).optional(),
+});
+
+export type DomainConstraintProps = z.infer<typeof domainConstraintPropsSchema>;
+type DomainPrivilegeProps = PrivilegeProps;
+export type DomainProps = z.infer<typeof domainPropsSchema>;
+
+/**
+ * A domain is a user-defined data type that is based on another underlying type.
+ *
+ * @see https://www.postgresql.org/docs/17/domains.html
+ */
+export class Domain extends BasePgModel {
+  public readonly schema: DomainProps["schema"];
+  public readonly name: DomainProps["name"];
+  public readonly base_type: DomainProps["base_type"];
+  public readonly base_type_schema: DomainProps["base_type_schema"];
+  public readonly base_type_str?: DomainProps["base_type_str"];
+  public readonly not_null: DomainProps["not_null"];
+  public readonly type_modifier: DomainProps["type_modifier"];
+  public readonly array_dimensions: DomainProps["array_dimensions"];
+  public readonly collation: DomainProps["collation"];
+  public readonly default_bin: DomainProps["default_bin"];
+  public readonly default_value: DomainProps["default_value"];
+  public readonly owner: DomainProps["owner"];
+  public readonly comment: DomainProps["comment"];
+  public readonly constraints: DomainConstraintProps[];
+  public readonly privileges: DomainPrivilegeProps[];
+  public readonly security_labels: SecurityLabelProps[];
+
+  constructor(props: DomainProps) {
+    super();
+
+    // Identity fields
+    this.schema = props.schema;
+    this.name = props.name;
+
+    // Data fields
+    this.base_type = props.base_type;
+    this.base_type_schema = props.base_type_schema;
+    this.base_type_str = props.base_type_str;
+    this.not_null = props.not_null;
+    this.type_modifier = props.type_modifier;
+    this.array_dimensions = props.array_dimensions;
+    this.collation = props.collation;
+    this.default_bin = props.default_bin;
+    this.default_value = props.default_value;
+    this.owner = props.owner;
+    this.comment = props.comment;
+    this.constraints = props.constraints;
+    this.privileges = props.privileges;
+    this.security_labels = props.security_labels ?? [];
+  }
+
+  get stableId(): `domain:${string}` {
+    return `domain:${this.schema}.${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      schema: this.schema,
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    return {
+      base_type: this.base_type,
+      base_type_schema: this.base_type_schema,
+      not_null: this.not_null,
+      type_modifier: this.type_modifier,
+      array_dimensions: this.array_dimensions,
+      collation: this.collation,
+      default_bin: this.default_bin,
+      default_value: this.default_value,
+      owner: this.owner,
+      comment: this.comment,
+      constraints: this.constraints,
+      privileges: this.privileges,
+      security_labels: this.security_labels,
+    };
+  }
+}
+
+/**
+ * Extract all domains from the database.
+ *
+ * @param sql - The SQL client.
+ * @returns A list of domains.
+ */
+export async function extractDomains(pool: Pool): Promise<Domain[]> {
+  const { rows: domainRows } = await pool.query<DomainProps>(sql`
+      with extension_oids as (
+        select
+          objid
+        from
+          pg_depend d
+        where
+          d.refclassid = 'pg_extension'::regclass
+          and d.classid = 'pg_type'::regclass
+      )
+      select
+        t.typnamespace::regnamespace::text as schema,
+        quote_ident(t.typname) as name,
+        bt.typname as base_type,
+        bt.typnamespace::regnamespace::text as base_type_schema,
+        format_type(t.typbasetype, t.typtypmod) as base_type_str,
+        t.typnotnull as not_null,
+        t.typtypmod as type_modifier,
+        t.typndims as array_dimensions,
+        case when t.typcollation <> bt.typcollation then quote_ident(c.collname) else null end as collation,
+        pg_get_expr(t.typdefaultbin, 0) as default_bin,
+        t.typdefault as default_value,
+        t.typowner::regrole::text as owner,
+        obj_description(t.oid, 'pg_type') as comment,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object(
+                'name', quote_ident(con.conname),
+                'validated', con.convalidated,
+                'is_local', con.conislocal,
+                'no_inherit', con.connoinherit,
+                'check_expression', pg_get_expr(con.conbin, 0)
+              )
+              order by con.conname
+            )
+            from pg_catalog.pg_constraint con
+            where con.contypid = t.oid
+          ), '[]'
+        ) as constraints,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object(
+                'grantee', case when x.grantee = 0 then 'PUBLIC' else x.grantee::regrole::text end,
+                'privilege', x.privilege_type,
+                'grantable', x.is_grantable
+              )
+              order by x.grantee, x.privilege_type
+            )
+            from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
+          ), '[]'
+        ) as privileges,
+        coalesce(
+          (
+            select json_agg(
+              json_build_object('provider', sl.provider, 'label', sl.label)
+              order by sl.provider
+            )
+            from pg_catalog.pg_seclabel sl
+            where sl.objoid = t.oid
+              and sl.classoid = 'pg_type'::regclass
+              and sl.objsubid = 0
+          ),
+          '[]'::json
+        ) as security_labels
+      from
+        pg_catalog.pg_type t
+        inner join pg_catalog.pg_type bt on bt.oid = t.typbasetype
+        left join pg_catalog.pg_collation c on c.oid = t.typcollation
+        left outer join extension_oids e on t.oid = e.objid
+        where not t.typnamespace::regnamespace::text like any(array['pg\\_%', 'information\\_schema'])
+        and e.objid is null
+        and t.typtype = 'd'
+      order by
+        1, 2
+  `);
+  // Validate and parse each row using the Zod schema
+  const validatedRows = domainRows.map((row: unknown) =>
+    domainPropsSchema.parse(row),
+  );
+  return validatedRows.map((row: DomainProps) => new Domain(row));
+}

package/src/core/objects/event-trigger/changes/event-trigger.alter.test.ts

@@ -0,0 +1,57 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
+import { EventTrigger } from "../event-trigger.model.ts";
+import {
+  AlterEventTriggerChangeOwner,
+  AlterEventTriggerSetEnabled,
+} from "./event-trigger.alter.ts";
+
+describe("event trigger alter change", () => {
+  const baseEventTrigger = new EventTrigger({
+    name: "ddl_logger",
+    event: "ddl_command_start",
+    function_schema: "public",
+    function_name: "log_ddl",
+    enabled: "O",
+    tags: null,
+    owner: "postgres",
+    comment: null,
+  });
+
+  test("serialize owner change", async () => {
+    const change = new AlterEventTriggerChangeOwner({
+      eventTrigger: baseEventTrigger,
+      owner: "new_owner",
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "ALTER EVENT TRIGGER ddl_logger OWNER TO new_owner",
+    );
+  });
+
+  test("serialize disable", async () => {
+    const change = new AlterEventTriggerSetEnabled({
+      eventTrigger: baseEventTrigger,
+      enabled: "D",
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe("ALTER EVENT TRIGGER ddl_logger DISABLE");
+  });
+
+  test("serialize enable always", async () => {
+    const change = new AlterEventTriggerSetEnabled({
+      eventTrigger: baseEventTrigger,
+      enabled: "A",
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "ALTER EVENT TRIGGER ddl_logger ENABLE ALWAYS",
+    );
+  });
+});

package/src/core/objects/event-trigger/changes/event-trigger.alter.ts

@@ -0,0 +1,83 @@
+import type { SerializeOptions } from "../../../integrations/serialize/serialize.types.ts";
+import type { EventTrigger } from "../event-trigger.model.ts";
+import { AlterEventTriggerChange } from "./event-trigger.base.ts";
+
+/**
+ * Alter an event trigger.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-altereventtrigger.html
+ *
+ * Synopsis
+ * ```sql
+ * ALTER EVENT TRIGGER name DISABLE
+ * ALTER EVENT TRIGGER name ENABLE [ REPLICA | ALWAYS ]
+ * ALTER EVENT TRIGGER name OWNER TO { newowner | CURRENT_ROLE | CURRENT_USER | SESSION_USER }
+ * ALTER EVENT TRIGGER name RENAME TO newname
+ * ```
+ */
+
+export type AlterEventTrigger =
+  | AlterEventTriggerChangeOwner
+  | AlterEventTriggerSetEnabled;
+
+/**
+ * ALTER EVENT TRIGGER ... OWNER TO ...
+ */
+export class AlterEventTriggerChangeOwner extends AlterEventTriggerChange {
+  public readonly eventTrigger: EventTrigger;
+  public readonly owner: string;
+  public readonly scope = "object" as const;
+
+  constructor(props: { eventTrigger: EventTrigger; owner: string }) {
+    super();
+    this.eventTrigger = props.eventTrigger;
+    this.owner = props.owner;
+  }
+
+  get requires() {
+    return [this.eventTrigger.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return [
+      "ALTER EVENT TRIGGER",
+      this.eventTrigger.name,
+      "OWNER TO",
+      this.owner,
+    ].join(" ");
+  }
+}
+
+const ENABLED_SQL = {
+  O: "ENABLE",
+  D: "DISABLE",
+  R: "ENABLE REPLICA",
+  A: "ENABLE ALWAYS",
+} as const;
+
+/**
+ * ALTER EVENT TRIGGER ... ENABLE/DISABLE ...
+ */
+export class AlterEventTriggerSetEnabled extends AlterEventTriggerChange {
+  public readonly eventTrigger: EventTrigger;
+  public readonly enabled: EventTrigger["enabled"];
+  public readonly scope = "object" as const;
+
+  constructor(props: {
+    eventTrigger: EventTrigger;
+    enabled: EventTrigger["enabled"];
+  }) {
+    super();
+    this.eventTrigger = props.eventTrigger;
+    this.enabled = props.enabled;
+  }
+
+  get requires() {
+    return [this.eventTrigger.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const clause = ENABLED_SQL[this.enabled];
+    return ["ALTER EVENT TRIGGER", this.eventTrigger.name, clause].join(" ");
+  }
+}

package/src/core/objects/event-trigger/changes/event-trigger.base.ts

@@ -0,0 +1,20 @@
+import { BaseChange } from "../../base.change.ts";
+import type { EventTrigger } from "../event-trigger.model.ts";
+
+abstract class BaseEventTriggerChange extends BaseChange {
+  abstract readonly eventTrigger: EventTrigger;
+  abstract readonly scope: "object" | "comment" | "security_label";
+  readonly objectType = "event_trigger" as const;
+}
+
+export abstract class CreateEventTriggerChange extends BaseEventTriggerChange {
+  readonly operation = "create" as const;
+}
+
+export abstract class AlterEventTriggerChange extends BaseEventTriggerChange {
+  readonly operation = "alter" as const;
+}
+
+export abstract class DropEventTriggerChange extends BaseEventTriggerChange {
+  readonly operation = "drop" as const;
+}