@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.4

package/src/core/objects/foreign-data-wrapper/server/changes/server.privilege.ts

@@ -0,0 +1,164 @@
+import { formatObjectPrivilegeList } from "../../../base.privilege.ts";
+import { stableId } from "../../../utils.ts";
+import type { Server } from "../server.model.ts";
+import { AlterServerChange } from "./server.base.ts";
+
+export type ServerPrivilege =
+  | GrantServerPrivileges
+  | RevokeServerPrivileges
+  | RevokeGrantOptionServerPrivileges;
+
+/**
+ * Grant privileges on a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-grant.html
+ *
+ * Synopsis
+ * ```sql
+ * GRANT { USAGE | ALL [ PRIVILEGES ] }
+ *    ON SERVER server_name [, ...]
+ *    TO role_specification [, ...] [ WITH GRANT OPTION ]
+ *    [ GRANTED BY role_specification ]
+ * ```
+ */
+export class GrantServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get creates() {
+    return [stableId.acl(this.server.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [this.server.stableId, stableId.role(this.grantee)];
+  }
+
+  serialize(): string {
+    const hasGrantable = this.privileges.some((p) => p.grantable);
+    const hasBase = this.privileges.some((p) => !p.grantable);
+    if (hasGrantable && hasBase) {
+      throw new Error(
+        "GrantServerPrivileges expects privileges with uniform grantable flag",
+      );
+    }
+    const withGrant = hasGrantable ? " WITH GRANT OPTION" : "";
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SERVER", list, this.version);
+    return `GRANT ${privSql} ON SERVER ${this.server.name} TO ${this.grantee}${withGrant}`;
+  }
+}
+
+/**
+ * Revoke privileges on a server.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ *
+ * Synopsis
+ * ```sql
+ * REVOKE [ GRANT OPTION FOR ]
+ *     { USAGE | ALL [ PRIVILEGES ] }
+ *     ON SERVER server_name [, ...]
+ *     FROM role_specification [, ...]
+ *     [ GRANTED BY role_specification ]
+ *     [ CASCADE | RESTRICT ]
+ * ```
+ */
+export class RevokeServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privileges: { privilege: string; grantable: boolean }[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privileges: { privilege: string; grantable: boolean }[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privileges = props.privileges;
+    this.version = props.version;
+  }
+
+  get drops() {
+    return [stableId.acl(this.server.stableId, this.grantee)];
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.server.stableId, this.grantee),
+      this.server.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const list = this.privileges.map((p) => p.privilege);
+    const privSql = formatObjectPrivilegeList("SERVER", list, this.version);
+    return `REVOKE ${privSql} ON SERVER ${this.server.name} FROM ${this.grantee}`;
+  }
+}
+
+/**
+ * Revoke grant option for privileges on a server.
+ *
+ * This removes the ability to grant the privilege to others, but keeps the privilege itself.
+ *
+ * @see https://www.postgresql.org/docs/17/sql-revoke.html
+ */
+export class RevokeGrantOptionServerPrivileges extends AlterServerChange {
+  public readonly server: Server;
+  public readonly grantee: string;
+  public readonly privilegeNames: string[];
+  public readonly version: number | undefined;
+  public readonly scope = "privilege" as const;
+
+  constructor(props: {
+    server: Server;
+    grantee: string;
+    privilegeNames: string[];
+    version?: number;
+  }) {
+    super();
+    this.server = props.server;
+    this.grantee = props.grantee;
+    this.privilegeNames = [...new Set(props.privilegeNames)].sort();
+    this.version = props.version;
+  }
+
+  get requires() {
+    return [
+      stableId.acl(this.server.stableId, this.grantee),
+      this.server.stableId,
+      stableId.role(this.grantee),
+    ];
+  }
+
+  serialize(): string {
+    const privSql = formatObjectPrivilegeList(
+      "SERVER",
+      this.privilegeNames,
+      this.version,
+    );
+    return `REVOKE GRANT OPTION FOR ${privSql} ON SERVER ${this.server.name} FROM ${this.grantee}`;
+  }
+}

package/src/core/objects/foreign-data-wrapper/server/changes/server.types.ts

@@ -0,0 +1,12 @@
+import type { AlterServer } from "./server.alter.ts";
+import type { CommentServer } from "./server.comment.ts";
+import type { CreateServer } from "./server.create.ts";
+import type { DropServer } from "./server.drop.ts";
+import type { ServerPrivilege } from "./server.privilege.ts";
+
+export type ServerChange =
+  | AlterServer
+  | CommentServer
+  | CreateServer
+  | DropServer
+  | ServerPrivilege;

package/src/core/objects/foreign-data-wrapper/server/server.diff.test.ts

@@ -0,0 +1,167 @@
+import { describe, expect, test } from "bun:test";
+import { DefaultPrivilegeState } from "../../base.default-privileges.ts";
+import {
+  AlterServerChangeOwner,
+  AlterServerSetOptions,
+  AlterServerSetVersion,
+} from "./changes/server.alter.ts";
+import { CreateServer } from "./changes/server.create.ts";
+import { DropServer } from "./changes/server.drop.ts";
+import { diffServers } from "./server.diff.ts";
+import { Server, type ServerProps } from "./server.model.ts";
+
+const testContext = {
+  version: 170000,
+  currentUser: "postgres",
+  defaultPrivilegeState: new DefaultPrivilegeState({}),
+  mainRoles: {},
+};
+
+describe.concurrent("server.diff", () => {
+  test("create and drop", () => {
+    const props: ServerProps = {
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    };
+    const server = new Server(props);
+
+    const created = diffServers(testContext, {}, { [server.stableId]: server });
+    expect(created[0]).toBeInstanceOf(CreateServer);
+
+    const dropped = diffServers(testContext, { [server.stableId]: server }, {});
+    expect(dropped[0]).toBeInstanceOf(DropServer);
+  });
+
+  test("alter: owner change", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o2",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterServerChangeOwner)).toBe(true);
+  });
+
+  test("alter: version change", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: "1.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: "2.0",
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof AlterServerSetVersion)).toBe(true);
+  });
+
+  test("alter: options changes", () => {
+    // Use non-env-dependent options to test that option changes still work
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: ["fetch_size", "100"],
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: null,
+      version: null,
+      options: ["fetch_size", "200", "use_remote_estimate", "true"],
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    const optionsChange = changes.find(
+      (c) => c instanceof AlterServerSetOptions,
+    ) as AlterServerSetOptions | undefined;
+    expect(optionsChange).toBeDefined();
+    expect(optionsChange?.options.length).toBeGreaterThan(0);
+  });
+
+  test("type change triggers drop and create", () => {
+    const main = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: "old_type",
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+    const branch = new Server({
+      name: "srv1",
+      owner: "o1",
+      foreign_data_wrapper: "fdw1",
+      type: "new_type",
+      version: null,
+      options: null,
+      comment: null,
+      privileges: [],
+    });
+
+    const changes = diffServers(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    // Type change should trigger drop + create
+    expect(changes.some((c) => c instanceof DropServer)).toBe(true);
+    expect(changes.some((c) => c instanceof CreateServer)).toBe(true);
+  });
+});

package/src/core/objects/foreign-data-wrapper/server/server.diff.ts

@@ -0,0 +1,317 @@
+import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
+import { diffObjects } from "../../base.diff.ts";
+import {
+  diffPrivileges,
+  filterPublicBuiltInDefaults,
+  groupPrivilegesByGrantable,
+} from "../../base.privilege-diff.ts";
+import type { Role } from "../../role/role.model.ts";
+import {
+  AlterServerChangeOwner,
+  AlterServerSetOptions,
+  AlterServerSetVersion,
+} from "./changes/server.alter.ts";
+import {
+  CreateCommentOnServer,
+  DropCommentOnServer,
+} from "./changes/server.comment.ts";
+import { CreateServer } from "./changes/server.create.ts";
+import { DropServer } from "./changes/server.drop.ts";
+import {
+  GrantServerPrivileges,
+  RevokeGrantOptionServerPrivileges,
+  RevokeServerPrivileges,
+} from "./changes/server.privilege.ts";
+import type { ServerChange } from "./changes/server.types.ts";
+import type { Server } from "./server.model.ts";
+
+/**
+ * Diff two sets of servers from main and branch catalogs.
+ *
+ * @param ctx - Context containing version, currentUser, and defaultPrivilegeState
+ * @param main - The servers in the main catalog.
+ * @param branch - The servers in the branch catalog.
+ * @returns A list of changes to apply to main to make it match branch.
+ */
+export function diffServers(
+  ctx: {
+    version: number;
+    currentUser: string;
+    defaultPrivilegeState: DefaultPrivilegeState;
+    mainRoles: Record<string, Role>;
+  },
+  main: Record<string, Server>,
+  branch: Record<string, Server>,
+): ServerChange[] {
+  const { created, dropped, altered } = diffObjects(main, branch);
+
+  const changes: ServerChange[] = [];
+
+  for (const serverId of created) {
+    const createdServer = branch[serverId];
+    changes.push(new CreateServer({ server: createdServer }));
+
+    // OWNER: If the server should be owned by someone other than the current user,
+    // emit ALTER SERVER ... OWNER TO after creation
+    if (createdServer.owner !== ctx.currentUser) {
+      changes.push(
+        new AlterServerChangeOwner({
+          server: createdServer,
+          owner: createdServer.owner,
+        }),
+      );
+    }
+
+    if (createdServer.comment !== null) {
+      changes.push(new CreateCommentOnServer({ server: createdServer }));
+    }
+
+    // PRIVILEGES: Servers don't have default privileges
+    const effectiveDefaults: Array<{
+      grantee: string;
+      privilege: string;
+      grantable: boolean;
+    }> = [];
+    const desiredPrivileges = filterPublicBuiltInDefaults(
+      "server",
+      createdServer.privileges,
+    );
+    const privilegeResults = diffPrivileges(
+      effectiveDefaults,
+      desiredPrivileges,
+      createdServer.owner,
+      ctx.mainRoles,
+    );
+
+    // Generate grant changes
+    for (const [grantee, result] of privilegeResults) {
+      if (result.grants.length > 0) {
+        const grantGroups = groupPrivilegesByGrantable(result.grants);
+        for (const [grantable, list] of grantGroups) {
+          void grantable;
+          changes.push(
+            new GrantServerPrivileges({
+              server: createdServer,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke changes
+      if (result.revokes.length > 0) {
+        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+        for (const [grantable, list] of revokeGroups) {
+          void grantable;
+          changes.push(
+            new RevokeServerPrivileges({
+              server: createdServer,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke grant option changes
+      if (result.revokeGrantOption.length > 0) {
+        changes.push(
+          new RevokeGrantOptionServerPrivileges({
+            server: createdServer,
+            grantee,
+            privilegeNames: result.revokeGrantOption,
+            version: ctx.version,
+          }),
+        );
+      }
+    }
+  }
+
+  for (const serverId of dropped) {
+    changes.push(new DropServer({ server: main[serverId] }));
+  }
+
+  for (const serverId of altered) {
+    const mainServer = main[serverId];
+    const branchServer = branch[serverId];
+
+    // OWNER
+    if (mainServer.owner !== branchServer.owner) {
+      changes.push(
+        new AlterServerChangeOwner({
+          server: mainServer,
+          owner: branchServer.owner,
+        }),
+      );
+    }
+
+    // TYPE - if changed, need to recreate (not directly alterable)
+    if (mainServer.type !== branchServer.type) {
+      changes.push(new DropServer({ server: mainServer }));
+      changes.push(new CreateServer({ server: branchServer }));
+      if (branchServer.comment !== null) {
+        changes.push(new CreateCommentOnServer({ server: branchServer }));
+      }
+      continue;
+    }
+
+    // VERSION
+    if (mainServer.version !== branchServer.version) {
+      changes.push(
+        new AlterServerSetVersion({
+          server: mainServer,
+          version: branchServer.version,
+        }),
+      );
+    }
+
+    // OPTIONS
+    const optionsChanged = diffOptions(
+      mainServer.options,
+      branchServer.options,
+    );
+    if (optionsChanged.length > 0) {
+      changes.push(
+        new AlterServerSetOptions({
+          server: mainServer,
+          options: optionsChanged,
+        }),
+      );
+    }
+
+    // COMMENT
+    if (mainServer.comment !== branchServer.comment) {
+      if (branchServer.comment === null) {
+        changes.push(new DropCommentOnServer({ server: mainServer }));
+      } else {
+        changes.push(new CreateCommentOnServer({ server: branchServer }));
+      }
+    }
+
+    // PRIVILEGES
+    const mainPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "server",
+      mainServer.privileges,
+    );
+    const branchPrivilegesFiltered = filterPublicBuiltInDefaults(
+      "server",
+      branchServer.privileges,
+    );
+    const privilegeResults = diffPrivileges(
+      mainPrivilegesFiltered,
+      branchPrivilegesFiltered,
+      branchServer.owner,
+      ctx.mainRoles,
+    );
+
+    for (const [grantee, result] of privilegeResults) {
+      // Generate grant changes
+      if (result.grants.length > 0) {
+        const grantGroups = groupPrivilegesByGrantable(result.grants);
+        for (const [grantable, list] of grantGroups) {
+          void grantable;
+          changes.push(
+            new GrantServerPrivileges({
+              server: branchServer,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke changes
+      if (result.revokes.length > 0) {
+        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
+        for (const [grantable, list] of revokeGroups) {
+          void grantable;
+          changes.push(
+            new RevokeServerPrivileges({
+              server: mainServer,
+              grantee,
+              privileges: list,
+              version: ctx.version,
+            }),
+          );
+        }
+      }
+
+      // Generate revoke grant option changes
+      if (result.revokeGrantOption.length > 0) {
+        changes.push(
+          new RevokeGrantOptionServerPrivileges({
+            server: mainServer,
+            grantee,
+            privilegeNames: result.revokeGrantOption,
+            version: ctx.version,
+          }),
+        );
+      }
+    }
+
+    // Note: Server renaming would also use ALTER SERVER ... RENAME TO ...
+    // But since our Server model uses 'name' as the identity field,
+    // a name change would be handled as drop + create by diffObjects()
+  }
+
+  return changes;
+}
+
+/**
+ * Diff options arrays to determine ADD/SET/DROP operations.
+ * Options are stored as [key1, value1, key2, value2, ...]
+ */
+function diffOptions(
+  mainOptions: string[] | null,
+  branchOptions: string[] | null,
+): Array<{ action: "ADD" | "SET" | "DROP"; option: string; value?: string }> {
+  const mainMap = new Map<string, string>();
+  const branchMap = new Map<string, string>();
+
+  // Parse main options
+  if (mainOptions) {
+    for (let i = 0; i < mainOptions.length; i += 2) {
+      if (i + 1 < mainOptions.length) {
+        mainMap.set(mainOptions[i], mainOptions[i + 1]);
+      }
+    }
+  }
+
+  // Parse branch options
+  if (branchOptions) {
+    for (let i = 0; i < branchOptions.length; i += 2) {
+      if (i + 1 < branchOptions.length) {
+        branchMap.set(branchOptions[i], branchOptions[i + 1]);
+      }
+    }
+  }
+
+  const changes: Array<{
+    action: "ADD" | "SET" | "DROP";
+    option: string;
+    value?: string;
+  }> = [];
+
+  // Find options to ADD or SET
+  for (const [key, value] of branchMap) {
+    const mainValue = mainMap.get(key);
+    if (mainValue === undefined) {
+      changes.push({ action: "ADD", option: key, value });
+    } else if (mainValue !== value) {
+      changes.push({ action: "SET", option: key, value });
+    }
+  }
+
+  // Find options to DROP
+  for (const [key] of mainMap) {
+    if (!branchMap.has(key)) {
+      changes.push({ action: "DROP", option: key });
+    }
+  }
+
+  return changes;
+}