@supabase/pg-delta 1.0.0-alpha.3 → 1.0.0-alpha.4

package/src/core/objects/role/role.model.ts

@@ -0,0 +1,344 @@
+import { sql } from "@ts-safeql/sql-tag";
+import type { Pool } from "pg";
+import z from "zod";
+import { BasePgModel } from "../base.model.ts";
+
+const membershipInfoSchema = z.object({
+  member: z.string(),
+  grantor: z.string(),
+  admin_option: z.boolean(),
+  inherit_option: z.boolean().nullish(),
+  set_option: z.boolean().nullish(),
+});
+
+const defaultPrivilegeSchema = z.object({
+  in_schema: z.string().nullable(),
+  objtype: z.enum(["r", "S", "f", "T", "n"]),
+  grantee: z.string(),
+  privileges: z.array(
+    z.object({ privilege: z.string(), grantable: z.boolean() }),
+  ),
+});
+
+const rolePropsSchema = z.object({
+  name: z.string(),
+  is_superuser: z.boolean(),
+  can_inherit: z.boolean(),
+  can_create_roles: z.boolean(),
+  can_create_databases: z.boolean(),
+  can_login: z.boolean(),
+  can_replicate: z.boolean(),
+  connection_limit: z.number().nullable(),
+  can_bypass_rls: z.boolean(),
+  config: z.array(z.string()).nullable(),
+  comment: z.string().nullable(),
+  members: z.array(membershipInfoSchema),
+  default_privileges: z.array(defaultPrivilegeSchema),
+});
+
+export type RoleProps = z.infer<typeof rolePropsSchema>;
+
+export class Role extends BasePgModel {
+  public readonly name: RoleProps["name"];
+  public readonly is_superuser: RoleProps["is_superuser"];
+  public readonly can_inherit: RoleProps["can_inherit"];
+  public readonly can_create_roles: RoleProps["can_create_roles"];
+  public readonly can_create_databases: RoleProps["can_create_databases"];
+  public readonly can_login: RoleProps["can_login"];
+  public readonly can_replicate: RoleProps["can_replicate"];
+  public readonly connection_limit: RoleProps["connection_limit"];
+  public readonly can_bypass_rls: RoleProps["can_bypass_rls"];
+  public readonly config: RoleProps["config"];
+  public readonly comment: RoleProps["comment"];
+  public readonly members: RoleProps["members"];
+  public readonly default_privileges: RoleProps["default_privileges"];
+
+  constructor(props: RoleProps) {
+    super();
+
+    // Identity fields
+    this.name = props.name;
+
+    // Data fields
+    this.is_superuser = props.is_superuser;
+    this.can_inherit = props.can_inherit;
+    this.can_create_roles = props.can_create_roles;
+    this.can_create_databases = props.can_create_databases;
+    this.can_login = props.can_login;
+    this.can_replicate = props.can_replicate;
+    this.connection_limit = props.connection_limit;
+    this.can_bypass_rls = props.can_bypass_rls;
+    this.config = props.config;
+    this.comment = props.comment;
+    this.members = props.members;
+    this.default_privileges = props.default_privileges;
+  }
+
+  get stableId(): `role:${string}` {
+    return `role:${this.name}`;
+  }
+
+  get identityFields() {
+    return {
+      name: this.name,
+    };
+  }
+
+  get dataFields() {
+    const sortedMembers = [...this.members].sort((a, b) => {
+      return (
+        a.member.localeCompare(b.member) ||
+        a.grantor.localeCompare(b.grantor) ||
+        Number(a.admin_option) - Number(b.admin_option) ||
+        Number(a.inherit_option ?? false) - Number(b.inherit_option ?? false) ||
+        Number(a.set_option ?? false) - Number(b.set_option ?? false)
+      );
+    });
+
+    const sortedDefaultPrivs = [...this.default_privileges].map((dp) => ({
+      ...dp,
+      privileges: [...dp.privileges].sort((a, b) => {
+        return (
+          a.privilege.localeCompare(b.privilege) ||
+          Number(a.grantable) - Number(b.grantable)
+        );
+      }),
+    }));
+    sortedDefaultPrivs.sort((a, b) => {
+      return (
+        (a.in_schema ?? "").localeCompare(b.in_schema ?? "") ||
+        a.objtype.localeCompare(b.objtype) ||
+        a.grantee.localeCompare(b.grantee)
+      );
+    });
+
+    return {
+      is_superuser: this.is_superuser,
+      can_inherit: this.can_inherit,
+      can_create_roles: this.can_create_roles,
+      can_create_databases: this.can_create_databases,
+      can_login: this.can_login,
+      can_replicate: this.can_replicate,
+      connection_limit: this.connection_limit,
+      can_bypass_rls: this.can_bypass_rls,
+      config: this.config,
+      comment: this.comment,
+      members: sortedMembers,
+      default_privileges: sortedDefaultPrivs,
+    };
+  }
+}
+
+export async function extractRoles(pool: Pool): Promise<Role[]> {
+  // Check PostgreSQL version capabilities for membership options
+  const { rows: capabilitiesRows } = await pool.query<{
+    has_inherit: boolean;
+    has_set: boolean;
+  }>(sql`
+      select
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'inherit_option'
+        ) as has_inherit,
+        exists (
+          select 1
+          from pg_attribute
+          where attrelid = 'pg_auth_members'::regclass
+            and attname = 'set_option'
+        ) as has_set
+  `);
+
+  const capabilities = capabilitiesRows[0];
+
+  let roleRows: RoleProps[];
+
+  if (capabilities?.has_inherit && capabilities?.has_set) {
+    const result = await pool.query<RoleProps>(sql`
+          WITH role_memberships AS (
+            SELECT
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',   m.rolname,
+                  'grantor',  g.rolname,
+                  'admin_option',   am.admin_option,
+                  'inherit_option', am.inherit_option,
+                  'set_option',     am.set_option
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper      AS is_superuser,
+            r.rolinherit    AS can_inherit,
+            r.rolcreaterole AS can_create_roles,
+            r.rolcreatedb   AS can_create_databases,
+            r.rolcanlogin   AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit  AS connection_limit,
+            r.rolbypassrls  AS can_bypass_rls,
+            r.rolconfig     AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            r.rolname !~ '^pg_'
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1
+    `);
+    roleRows = result.rows;
+  } else {
+    const result = await pool.query<RoleProps>(sql`
+          WITH role_memberships AS (
+            SELECT
+              r.rolname AS role_name,
+              json_agg(
+                json_build_object(
+                  'member',         m.rolname,
+                  'grantor',        g.rolname,
+                  'admin_option',   am.admin_option,
+                  'inherit_option', NULL,
+                  'set_option',     NULL
+                )
+              ) FILTER (WHERE m.rolname IS NOT NULL) AS members
+            FROM pg_catalog.pg_roles r
+            LEFT JOIN pg_auth_members am ON am.roleid = r.oid
+            LEFT JOIN pg_roles m          ON m.oid = am.member
+            LEFT JOIN pg_roles g          ON g.oid = am.grantor
+            GROUP BY r.rolname
+          )
+          SELECT
+            quote_ident(r.rolname) AS name,
+            r.rolsuper       AS is_superuser,
+            r.rolinherit     AS can_inherit,
+            r.rolcreaterole  AS can_create_roles,
+            r.rolcreatedb    AS can_create_databases,
+            r.rolcanlogin    AS can_login,
+            r.rolreplication AS can_replicate,
+            r.rolconnlimit   AS connection_limit,
+            r.rolbypassrls   AS can_bypass_rls,
+            r.rolconfig      AS config,
+            obj_description(r.oid, 'pg_authid') AS comment,
+            COALESCE(rm.members, '[]') AS members,
+            COALESCE(
+              (
+                SELECT json_agg(
+                        json_build_object(
+                          'in_schema',
+                            CASE WHEN s.defaclnamespace = 0
+                                    THEN NULL
+                                    ELSE s.defaclnamespace::regnamespace::text
+                            END,
+                          'objtype',   s.defaclobjtype,
+                          'grantee',
+                            CASE WHEN s.grantee = 0
+                                    THEN 'PUBLIC'
+                                    ELSE s.grantee::regrole::text
+                            END,
+                          'privileges', s.privileges
+                        )
+                        ORDER BY s.defaclnamespace NULLS FIRST,
+                                  s.defaclobjtype,
+                                  s.grantee
+                      )
+                FROM (
+                  SELECT
+                    d.defaclnamespace,
+                    d.defaclobjtype,
+                    x.grantee,
+                    json_agg(
+                      json_build_object(
+                        'privilege',  x.privilege_type,
+                        'grantable',  x.is_grantable
+                      )
+                      ORDER BY x.privilege_type, x.is_grantable
+                    ) AS privileges
+                  FROM pg_default_acl d
+                  CROSS JOIN LATERAL aclexplode(COALESCE(d.defaclacl, ARRAY[]::aclitem[]))
+                    AS x(grantor, grantee, privilege_type, is_grantable)
+                  WHERE d.defaclrole = r.oid
+                  GROUP BY d.defaclnamespace, d.defaclobjtype, x.grantee
+                ) AS s
+              ),
+              '[]'
+            ) AS default_privileges
+          FROM pg_catalog.pg_roles r
+          LEFT JOIN role_memberships rm ON rm.role_name = r.rolname
+          WHERE
+            r.rolname !~ '^pg_'
+            AND NOT EXISTS (
+              SELECT 1
+              FROM pg_catalog.pg_shdepend d
+              WHERE d.classid     = 'pg_authid'::regclass
+                AND d.objid       = r.oid
+                AND d.refclassid  = 'pg_extension'::regclass
+                AND d.deptype     IN ('e','x')
+            )
+          ORDER BY 1
+    `);
+    roleRows = result.rows;
+  }
+
+  // Validate and parse each row using the Zod schema
+  const validatedRows = roleRows.map((row: unknown) =>
+    rolePropsSchema.parse(row),
+  );
+  return validatedRows.map((row: RoleProps) => new Role(row));
+}

package/src/core/objects/rule/changes/rule.alter.test.ts

@@ -0,0 +1,78 @@
+import { describe, expect, test } from "bun:test";
+import { stableId } from "../../utils.ts";
+import { Rule } from "../rule.model.ts";
+import { ReplaceRule, SetRuleEnabledState } from "./rule.alter.ts";
+
+type RuleProps = ConstructorParameters<typeof Rule>[0];
+
+const base: RuleProps = {
+  schema: "public",
+  name: '"my_rule"',
+  table_name: '"my_table"',
+  relation_kind: "r",
+  event: "INSERT",
+  enabled: "O",
+  is_instead: true,
+  owner: "owner1",
+  definition:
+    'CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+  comment: null,
+  columns: ["id"],
+};
+
+const makeRule = (override: Partial<RuleProps> = {}) =>
+  new Rule({
+    ...base,
+    ...override,
+    columns: override.columns ? [...override.columns] : [...base.columns],
+  });
+
+describe("rule.alter", () => {
+  test("replace rule serializes using create or replace and tracks dependencies", () => {
+    const rule = makeRule({ columns: ["id", "amount"] });
+    const change = new ReplaceRule({ rule });
+
+    expect(change.requires).toEqual([
+      rule.stableId,
+      rule.relationStableId,
+      ...rule.columns.map((column) =>
+        stableId.column(rule.schema, rule.table_name, column),
+      ),
+    ]);
+    expect(change.serialize()).toBe(
+      'CREATE OR REPLACE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+    );
+  });
+
+  test("set rule enabled state serializes appropriate clause", () => {
+    const rule = makeRule({ columns: ["id", "amount"] });
+    const change = new SetRuleEnabledState({ rule, enabled: "D" });
+
+    expect(change.requires).toEqual([
+      rule.stableId,
+      rule.relationStableId,
+      ...rule.columns.map((column) =>
+        stableId.column(rule.schema, rule.table_name, column),
+      ),
+    ]);
+    expect(change.serialize()).toBe(
+      'ALTER TABLE public."my_table" DISABLE RULE "my_rule"',
+    );
+  });
+
+  test("set rule enabled state defaults to rule value and supports views", () => {
+    const rule = makeRule({
+      table_name: '"my_view"',
+      relation_kind: "v",
+      enabled: "R",
+      columns: [],
+    });
+
+    const change = new SetRuleEnabledState({ rule });
+
+    expect(change.requires).toEqual([rule.stableId, rule.relationStableId]);
+    expect(change.serialize()).toBe(
+      'ALTER TABLE public."my_view" ENABLE REPLICA RULE "my_rule"',
+    );
+  });
+});

package/src/core/objects/rule/changes/rule.alter.ts

@@ -0,0 +1,72 @@
+import { stableId } from "../../utils.ts";
+import type { Rule, RuleEnabledState } from "../rule.model.ts";
+import { AlterRuleChange } from "./rule.base.ts";
+import { CreateRule } from "./rule.create.ts";
+
+export class ReplaceRule extends AlterRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "object" as const;
+
+  constructor(props: { rule: Rule }) {
+    super();
+    this.rule = props.rule;
+  }
+
+  get requires() {
+    return [
+      this.rule.stableId,
+      this.rule.relationStableId,
+      ...this.rule.columns.map((column) =>
+        stableId.column(this.rule.schema, this.rule.table_name, column),
+      ),
+    ];
+  }
+
+  serialize(): string {
+    return new CreateRule({ rule: this.rule, orReplace: true }).serialize();
+  }
+}
+
+export class SetRuleEnabledState extends AlterRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "object" as const;
+  public readonly enabled: RuleEnabledState;
+
+  constructor(props: { rule: Rule; enabled?: RuleEnabledState }) {
+    super();
+    this.rule = props.rule;
+    this.enabled = props.enabled ?? props.rule.enabled;
+  }
+
+  get requires() {
+    return [
+      this.rule.stableId,
+      this.rule.relationStableId,
+      ...this.rule.columns.map((column) =>
+        stableId.column(this.rule.schema, this.rule.table_name, column),
+      ),
+    ];
+  }
+
+  serialize(): string {
+    const clause = clauseForState(this.enabled);
+    return `ALTER TABLE ${this.rule.schema}.${this.rule.table_name} ${clause} ${this.rule.name}`;
+  }
+}
+
+function clauseForState(state: RuleEnabledState) {
+  switch (state) {
+    case "O":
+      return "ENABLE RULE";
+    case "D":
+      return "DISABLE RULE";
+    case "R":
+      return "ENABLE REPLICA RULE";
+    case "A":
+      return "ENABLE ALWAYS RULE";
+    default: {
+      const _exhaustive: never = state;
+      return _exhaustive;
+    }
+  }
+}

package/src/core/objects/rule/changes/rule.base.ts

@@ -0,0 +1,20 @@
+import { BaseChange } from "../../base.change.ts";
+import type { Rule } from "../rule.model.ts";
+
+abstract class BaseRuleChange extends BaseChange {
+  abstract readonly rule: Rule;
+  abstract readonly scope: "object" | "comment";
+  readonly objectType = "rule" as const;
+}
+
+export abstract class CreateRuleChange extends BaseRuleChange {
+  readonly operation = "create" as const;
+}
+
+export abstract class AlterRuleChange extends BaseRuleChange {
+  readonly operation = "alter" as const;
+}
+
+export abstract class DropRuleChange extends BaseRuleChange {
+  readonly operation = "drop" as const;
+}

package/src/core/objects/rule/changes/rule.comment.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { stableId } from "../../utils.ts";
+import { Rule } from "../rule.model.ts";
+import { CreateCommentOnRule, DropCommentOnRule } from "./rule.comment.ts";
+
+type RuleProps = ConstructorParameters<typeof Rule>[0];
+
+const base: RuleProps = {
+  schema: "public",
+  name: '"my_rule"',
+  table_name: '"my_table"',
+  relation_kind: "r",
+  event: "INSERT",
+  enabled: "O",
+  is_instead: true,
+  owner: "owner1",
+  definition:
+    'CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+  comment: null,
+  columns: ["id"],
+};
+
+const makeRule = (override: Partial<RuleProps> = {}) =>
+  new Rule({
+    ...base,
+    ...override,
+    columns: override.columns ? [...override.columns] : [...base.columns],
+  });
+
+describe("rule.comment", () => {
+  test("create comment serializes and tracks dependencies", () => {
+    const rule = makeRule({ comment: "rule's description" });
+    const change = new CreateCommentOnRule({ rule });
+
+    expect(change.creates).toEqual([stableId.comment(rule.stableId)]);
+    expect(change.requires).toEqual([rule.stableId]);
+    expect(change.serialize()).toBe(
+      "COMMENT ON RULE \"my_rule\" ON public.\"my_table\" IS 'rule''s description'",
+    );
+  });
+
+  test("drop comment serializes and tracks dependencies", () => {
+    const rule = makeRule({ comment: "temporary comment" });
+    const change = new DropCommentOnRule({ rule });
+
+    expect(change.drops).toEqual([stableId.comment(rule.stableId)]);
+    expect(change.requires).toEqual([
+      stableId.comment(rule.stableId),
+      rule.stableId,
+    ]);
+    expect(change.serialize()).toBe(
+      'COMMENT ON RULE "my_rule" ON public."my_table" IS NULL',
+    );
+  });
+});

package/src/core/objects/rule/changes/rule.comment.ts

@@ -0,0 +1,62 @@
+import { quoteLiteral } from "../../base.change.ts";
+import { stableId } from "../../utils.ts";
+import type { Rule } from "../rule.model.ts";
+import { CreateRuleChange, DropRuleChange } from "./rule.base.ts";
+
+export class CreateCommentOnRule extends CreateRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "comment" as const;
+
+  constructor(props: { rule: Rule }) {
+    super();
+    this.rule = props.rule;
+  }
+
+  get creates() {
+    return [stableId.comment(this.rule.stableId)];
+  }
+
+  get requires() {
+    return [this.rule.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "COMMENT ON RULE",
+      this.rule.name,
+      "ON",
+      `${this.rule.schema}.${this.rule.table_name}`,
+      "IS",
+      // biome-ignore lint/style/noNonNullAssertion: rule comment is not nullable in this case
+      quoteLiteral(this.rule.comment!),
+    ].join(" ");
+  }
+}
+
+export class DropCommentOnRule extends DropRuleChange {
+  public readonly rule: Rule;
+  public readonly scope = "comment" as const;
+
+  constructor(props: { rule: Rule }) {
+    super();
+    this.rule = props.rule;
+  }
+
+  get drops() {
+    return [stableId.comment(this.rule.stableId)];
+  }
+
+  get requires() {
+    return [stableId.comment(this.rule.stableId), this.rule.stableId];
+  }
+
+  serialize(): string {
+    return [
+      "COMMENT ON RULE",
+      this.rule.name,
+      "ON",
+      `${this.rule.schema}.${this.rule.table_name}`,
+      "IS NULL",
+    ].join(" ");
+  }
+}

package/src/core/objects/rule/changes/rule.create.test.ts

@@ -0,0 +1,59 @@
+import { describe, expect, test } from "bun:test";
+import { stableId } from "../../utils.ts";
+import { Rule } from "../rule.model.ts";
+import { CreateRule } from "./rule.create.ts";
+
+type RuleProps = ConstructorParameters<typeof Rule>[0];
+
+const base: RuleProps = {
+  schema: "public",
+  name: '"my_rule"',
+  table_name: '"my_table"',
+  relation_kind: "r",
+  event: "INSERT",
+  enabled: "O",
+  is_instead: true,
+  owner: "owner1",
+  definition:
+    'CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+  comment: null,
+  columns: ["id"],
+};
+
+const makeRule = (override: Partial<RuleProps> = {}) =>
+  new Rule({
+    ...base,
+    ...override,
+    columns: override.columns ? [...override.columns] : [...base.columns],
+  });
+
+describe("rule.create", () => {
+  test("serialize rule definition and track dependencies", () => {
+    const rule = makeRule();
+    const change = new CreateRule({ rule });
+
+    expect(change.creates).toEqual([rule.stableId]);
+    expect(change.requires).toEqual([
+      rule.relationStableId,
+      ...rule.columns.map((column) =>
+        stableId.column(rule.schema, rule.table_name, column),
+      ),
+    ]);
+    expect(change.serialize()).toBe(
+      'CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+    );
+  });
+
+  test("serialize rule definition with or replace override", () => {
+    const rule = makeRule({
+      definition:
+        '  CREATE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING  ',
+    });
+
+    const change = new CreateRule({ rule, orReplace: true });
+
+    expect(change.serialize()).toBe(
+      'CREATE OR REPLACE RULE "my_rule" AS ON INSERT TO public."my_table" DO INSTEAD NOTHING',
+    );
+  });
+});