@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.30

package/src/core/objects/foreign-data-wrapper/server/changes/server.create.test.ts

@@ -0,0 +1,180 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../../test-utils/assert-valid-sql.ts";
+import { Server } from "../server.model.ts";
+import { CreateServer } from "./server.create.ts";
+
+describe("server", () => {
+  test("create basic", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server FOREIGN DATA WRAPPER test_fdw",
+    );
+  });
+
+  test("create with type", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: "postgres_fdw",
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server TYPE 'postgres_fdw' FOREIGN DATA WRAPPER test_fdw",
+    );
+  });
+
+  test("create with version", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: null,
+      version: "1.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server VERSION '1.0' FOREIGN DATA WRAPPER test_fdw",
+    );
+  });
+
+  test("create with type and version", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: "postgres_fdw",
+      version: "1.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server TYPE 'postgres_fdw' VERSION '1.0' FOREIGN DATA WRAPPER test_fdw",
+    );
+  });
+
+  test("create with options", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: null,
+      version: null,
+      options: ["host", "localhost", "port", "5432"],
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server FOREIGN DATA WRAPPER test_fdw OPTIONS (host 'localhost', port '5432')",
+    );
+  });
+
+  test("create with all properties", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: "postgres_fdw",
+      version: "1.0",
+      options: ["host", "localhost", "port", "5432"],
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe(
+      "CREATE SERVER test_server TYPE 'postgres_fdw' VERSION '1.0' FOREIGN DATA WRAPPER test_fdw OPTIONS (host 'localhost', port '5432')",
+    );
+  });
+
+  test("redacts sensitive option values to prevent secret leakage (CLI-1467)", async () => {
+    const server = new Server({
+      name: "live_risk_server",
+      owner: "postgres",
+      foreign_data_wrapper: "postgres_fdw",
+      type: null,
+      version: null,
+      options: [
+        "host",
+        "remote.example.com",
+        "port",
+        "5432",
+        "password",
+        "server-shared-secret",
+        "passfile",
+        "/etc/secrets/passfile",
+      ],
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new CreateServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    const sql = change.serialize();
+    expect(sql).not.toContain("server-shared-secret");
+    expect(sql).not.toContain("/etc/secrets/passfile");
+    expect(sql).toContain("host 'remote.example.com'");
+    expect(sql).toContain("port '5432'");
+    expect(sql).toContain("password '__OPTION_PASSWORD__'");
+    expect(sql).toContain("passfile '__OPTION_PASSFILE__'");
+  });
+});

package/src/core/objects/foreign-data-wrapper/server/changes/server.create.ts

@@ -0,0 +1,84 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
+import { quoteLiteral } from "../../../base.change.ts";
+import { stableId } from "../../../utils.ts";
+import { redactOptionValue } from "../../sensitive-options.ts";
+import type { Server } from "../server.model.ts";
+import { CreateServerChange } from "./server.base.ts";
+
+/**
+ * Create a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-createserver.html
+ *
+ * Synopsis
+ * ```sql
+ * CREATE SERVER [ IF NOT EXISTS ] server_name [ TYPE 'server_type' ] [ VERSION 'server_version' ]
+ *     FOREIGN DATA WRAPPER fdw_name
+ *     [ OPTIONS ( option 'value' [, ... ] ) ]
+ * ```
+ */
+export class CreateServer extends CreateServerChange {
+  public readonly server: Server;
+  public readonly scope = "object" as const;
+
+  constructor(props: { server: Server }) {
+    super();
+    this.server = props.server;
+  }
+
+  get creates() {
+    return [this.server.stableId];
+  }
+
+  get requires() {
+    const dependencies = new Set<string>();
+
+    // Foreign Data Wrapper dependency
+    dependencies.add(
+      stableId.foreignDataWrapper(this.server.foreign_data_wrapper),
+    );
+
+    // Owner dependency
+    dependencies.add(stableId.role(this.server.owner));
+
+    return Array.from(dependencies);
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const parts: string[] = ["CREATE SERVER"];
+
+    // Add server name
+    parts.push(this.server.name);
+
+    // Add TYPE clause
+    if (this.server.type) {
+      parts.push("TYPE", quoteLiteral(this.server.type));
+    }
+
+    // Add VERSION clause
+    if (this.server.version) {
+      parts.push("VERSION", quoteLiteral(this.server.version));
+    }
+
+    // Add FOREIGN DATA WRAPPER clause
+    parts.push("FOREIGN DATA WRAPPER", this.server.foreign_data_wrapper);
+
+    // Add OPTIONS clause
+    if (this.server.options && this.server.options.length > 0) {
+      const optionPairs: string[] = [];
+      for (let i = 0; i < this.server.options.length; i += 2) {
+        const key = this.server.options[i];
+        const value = this.server.options[i + 1];
+        if (key === undefined || value === undefined) continue;
+        optionPairs.push(
+          `${key} ${quoteLiteral(redactOptionValue(key, value))}`,
+        );
+      }
+      if (optionPairs.length > 0) {
+        parts.push(`OPTIONS (${optionPairs.join(", ")})`);
+      }
+    }
+
+    return parts.join(" ");
+  }
+}

package/src/core/objects/foreign-data-wrapper/server/changes/server.drop.test.ts

@@ -0,0 +1,27 @@
+import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../../test-utils/assert-valid-sql.ts";
+import { Server } from "../server.model.ts";
+import { DropServer } from "./server.drop.ts";
+
+describe("server", () => {
+  test("drop", async () => {
+    const server = new Server({
+      name: "test_server",
+      owner: "test",
+      foreign_data_wrapper: "test_fdw",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const change = new DropServer({
+      server,
+    });
+
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe("DROP SERVER test_server");
+  });
+});

package/src/core/objects/foreign-data-wrapper/server/changes/server.drop.ts

@@ -0,0 +1,35 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
+import type { Server } from "../server.model.ts";
+import { DropServerChange } from "./server.base.ts";
+
+/**
+ * Drop a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-dropserver.html
+ *
+ * Synopsis
+ * ```sql
+ * DROP SERVER [ IF EXISTS ] name [, ...] [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class DropServer extends DropServerChange {
+  public readonly server: Server;
+  public readonly scope = "object" as const;
+
+  constructor(props: { server: Server }) {
+    super();
+    this.server = props.server;
+  }
+
+  get drops() {
+    return [this.server.stableId];
+  }
+
+  get requires() {
+    return [this.server.stableId];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    return ["DROP SERVER", this.server.name].join(" ");
+  }
+}

package/src/core/objects/foreign-data-wrapper/server/changes/server.privilege.ts

@@ -0,0 +1,165 @@
+import type { SerializeOptions } from "../../../../integrations/serialize/serialize.types.ts";
+import { formatObjectPrivilegeList } from "../../../base.privilege.ts";
+import { stableId } from "../../../utils.ts";
+import type { Server } from "../server.model.ts";
+import { AlterServerChange } from "./server.base.ts";
+
+export type ServerPrivilege =
+  | GrantServerPrivileges
+  | RevokeServerPrivileges
+  | RevokeGrantOptionServerPrivileges;
+
+/**
+ * Grant privileges on a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT { USAGE | ALL [ PRIVILEGES ] }
+ *    ON SERVER server_name [, ...]
+ *    TO role_specification [, ...] [ WITH GRANT OPTION ]
+ *    [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.server.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.server.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantServerPrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SERVER", list, this.version);
+    return `GRANT ${privSql} ON SERVER ${this.server.name} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+/**
+ * Revoke privileges on a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ GRANT OPTION FOR ]
+ *     { USAGE | ALL [ PRIVILEGES ] }
+ *     ON SERVER server_name [, ...]
+ *     FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    return [stableId.acl(this.server.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.server.stableId, this.grantee),
+      this.server.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SERVER", list, this.version);
+    return `REVOKE ${privSql} ON SERVER ${this.server.name} FROM ${this.grantee}`;
+  }
+}
+
+/**
+ * Revoke grant option for privileges on a server.
+ *
+ * This removes the ability to grant the privilege to others, but keeps the privilege itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeGrantOptionServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privilegeNames: string[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.server.stableId, this.grantee),
+      this.server.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(_options?: SerializeOptions): string {
+    const privSql = formatObjectPrivilegeList(
+      "SERVER",
+      this.privilegeNames,
+      this.version,
+    );
+    return `REVOKE GRANT OPTION FOR ${privSql} ON SERVER ${this.server.name} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/foreign-data-wrapper/server/changes/server.types.ts

@@ -0,0 +1,13 @@
+import type { AlterServer } from "./server.alter.ts";
+import type { CommentServer } from "./server.comment.ts";
+import type { CreateServer } from "./server.create.ts";
+import type { DropServer } from "./server.drop.ts";
+import type { ServerPrivilege } from "./server.privilege.ts";
+
+/** Union of all server-related change variants (`objectType: "server"`). @category Change Types */
+export type ServerChange =
+  | AlterServer
+  | CommentServer
+  | CreateServer
+  | DropServer
+  | ServerPrivilege;