@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.5

package/src/core/objects/base.privilege-diff.ts

@@ -1,7 +1,6 @@
 import z from "zod";
 import type { Change } from "../change.types.ts";
-import type { Role } from "./role/role.model.ts";
-import { stableId } from "./utils.ts";
+import type { BaseChange } from "./base.change.ts";
 
 /**
  * Privilege properties that all privilege objects share.
@@ -118,7 +117,7 @@ function checkStillHasBase<T extends PrivilegeProps>(
 /**
  * Groups privileges by grantable flag for efficient SQL generation
  */
-export function groupPrivilegesByGrantable<T extends PrivilegeProps>(
+function groupPrivilegesByGrantable<T extends PrivilegeProps>(
   privileges: T[],
 ): Map<boolean, T[]> {
   const groups = new Map<boolean, T[]>();
@@ -135,7 +134,7 @@ export function groupPrivilegesByGrantable<T extends PrivilegeProps>(
 /**
  * Groups privileges by columns and grantable flag
  */
-export function groupPrivilegesByColumns<T extends PrivilegeProps>(
+function groupPrivilegesByColumns<T extends PrivilegeProps>(
   privileges: T[],
 ): Map<string, { columns?: string[]; byGrant: Map<boolean, Set<string>> }> {
   const groups = new Map<
@@ -236,22 +235,6 @@ function filterOwnerPrivileges<T extends PrivilegeProps>(
   return privileges.filter((p) => p.grantee !== owner);
 }
 
-/**
- * Filter out privileges for superuser roles, as PostgreSQL doesn't store
- * GRANTs to superusers in relacl (they already have all privileges implicitly).
- * Reference: https://www.postgresql.org/docs/current/role-attributes.html
- */
-function filterSuperuserPrivileges<T extends PrivilegeProps>(
-  privileges: T[],
-  mainRoles?: Record<string, Role>,
-): T[] {
-  if (!mainRoles) return privileges;
-  return privileges.filter((priv) => {
-    const role = mainRoles[stableId.role(priv.grantee)];
-    return !role?.is_superuser;
-  });
-}
-
 /**
  * Generic privilege diffing function that works for any object type
  */
@@ -259,22 +242,14 @@ export function diffPrivileges<T extends PrivilegeProps>(
   mainPrivileges: T[],
   branchPrivileges: T[],
   owner?: string,
-  mainRoles?: Record<string, Role>,
 ): Map<string, PrivilegeDiffResult<T>> {
-  // Filter out superuser privileges from branch - PostgreSQL doesn't store GRANTs
-  // to superusers in relacl because they already have all privileges implicitly
-  const branchPrivilegesFiltered = filterSuperuserPrivileges(
-    branchPrivileges,
-    mainRoles,
-  );
-
   // Filter out owner privileges if owner is provided
   const mainFiltered = owner
     ? filterOwnerPrivileges(mainPrivileges, owner)
     : mainPrivileges;
   const branchFiltered = owner
-    ? filterOwnerPrivileges(branchPrivilegesFiltered, owner)
-    : branchPrivilegesFiltered;
+    ? filterOwnerPrivileges(branchPrivileges, owner)
+    : branchPrivileges;
 
   const mainByGrantee = groupPrivilegesByGrantee(mainFiltered);
   const branchByGrantee = groupPrivilegesByGrantee(branchFiltered);
@@ -297,3 +272,176 @@ export function diffPrivileges<T extends PrivilegeProps>(
 
   return results;
 }
+
+// ==== Privilege Change Emission Helpers ====
+//
+// These helpers convert the output of `diffPrivileges` (per-grantee grant /
+// revoke / revoke-grant-option lists) into concrete Change instances so that
+// individual object diffs don't have to repeat the same iteration and grouping
+// logic.
+//
+// Callers pass a `PrivilegeChangeFactories` bag containing the three class
+// constructors (Grant, Revoke, RevokeGrantOption) for their object type.  The
+// helpers instantiate them with a common props shape: an object reference keyed
+// by `objectKey`, a `grantee`, `privileges` or `privilegeNames`, an optional
+// `version`, and (for column-level privileges) optional `columns`.
+
+/**
+ * Factory constructors for Grant / Revoke / RevokeGrantOption change classes.
+ * Every object type provides its own concrete classes.  The `any` props type
+ * is intentional: the helpers build props with a computed `[objectKey]` key
+ * whose name varies per object type, so no single concrete type can unify
+ * all call sites without an unsafe cast elsewhere.
+ */
+interface PrivilegeChangeFactories {
+  Grant: new (
+    // biome-ignore lint/suspicious/noExplicitAny: factory accepts heterogeneous prop bags keyed by object type
+    props: any,
+  ) => BaseChange;
+  Revoke: new (
+    // biome-ignore lint/suspicious/noExplicitAny: factory accepts heterogeneous prop bags keyed by object type
+    props: any,
+  ) => BaseChange;
+  RevokeGrantOption: new (
+    // biome-ignore lint/suspicious/noExplicitAny: factory accepts heterogeneous prop bags keyed by object type
+    props: any,
+  ) => BaseChange;
+}
+
+/**
+ * Emit privilege changes for object-level privileges (schema, sequence,
+ * procedure, etc.).
+ *
+ * For each grantee in `privilegeResults` the function groups grants and revokes
+ * by the `grantable` flag and pushes one change per group.  Revoke-grant-option
+ * entries produce a single change carrying `privilegeNames`.
+ *
+ * `grantTarget` is the *branch* object (the desired state) while `revokeTarget`
+ * is the *main* object (the current state), so that GRANTs reference the
+ * newly-created/altered object and REVOKEs reference the existing one.
+ */
+export function emitObjectPrivilegeChanges(
+  privilegeResults: Map<string, PrivilegeDiffResult<PrivilegeProps>>,
+  grantTarget: unknown,
+  revokeTarget: unknown,
+  objectKey: string,
+  factories: PrivilegeChangeFactories,
+  version?: number,
+): BaseChange[] {
+  const changes: BaseChange[] = [];
+
+  for (const [grantee, result] of privilegeResults) {
+    for (const [, revokes] of groupPrivilegesByGrantable(result.revokes)) {
+      changes.push(
+        new factories.Revoke({
+          [objectKey]: revokeTarget,
+          privileges: revokes,
+          grantee,
+          version,
+        }),
+      );
+    }
+    if (result.revokeGrantOption.length > 0) {
+      changes.push(
+        new factories.RevokeGrantOption({
+          [objectKey]: revokeTarget,
+          privilegeNames: result.revokeGrantOption,
+          grantee,
+          version,
+        }),
+      );
+    }
+    for (const [, grants] of groupPrivilegesByGrantable(result.grants)) {
+      changes.push(
+        new factories.Grant({
+          [objectKey]: grantTarget,
+          privileges: grants,
+          grantee,
+          version,
+        }),
+      );
+    }
+  }
+
+  return changes;
+}
+
+/**
+ * Emit privilege changes for column-level privileges (table, view,
+ * materialized view).
+ *
+ * Like {@link emitObjectPrivilegeChanges} but groups by column set (via
+ * `groupPrivilegesByColumns`) instead of only by grantable.  For
+ * revoke-grant-option the column sets come from `sourcePrivileges` so that
+ * `REVOKE GRANT OPTION FOR` is emitted per column set that originally carried
+ * the privilege.
+ */
+export function emitColumnPrivilegeChanges(
+  privilegeResults: Map<string, PrivilegeDiffResult<PrivilegeProps>>,
+  grantTarget: unknown,
+  revokeTarget: unknown,
+  objectKey: string,
+  factories: PrivilegeChangeFactories,
+  sourcePrivileges: PrivilegeProps[],
+  version?: number,
+): BaseChange[] {
+  const changes: BaseChange[] = [];
+
+  for (const [grantee, result] of privilegeResults) {
+    for (const [, group] of groupPrivilegesByColumns(result.revokes)) {
+      const allPrivileges = new Set<string>();
+      for (const [, privSet] of group.byGrant) {
+        for (const priv of privSet) {
+          allPrivileges.add(priv);
+        }
+      }
+      changes.push(
+        new factories.Revoke({
+          [objectKey]: revokeTarget,
+          privileges: [...allPrivileges].map((p) => ({
+            privilege: p,
+            grantable: false,
+          })),
+          grantee,
+          columns: group.columns,
+          version,
+        }),
+      );
+    }
+    if (result.revokeGrantOption.length > 0) {
+      const sourcePrivsForGrantee = sourcePrivileges.filter(
+        (p) => p.grantee === grantee,
+      );
+      for (const [, group] of groupPrivilegesByColumns(
+        sourcePrivsForGrantee.filter((p) =>
+          result.revokeGrantOption.includes(p.privilege),
+        ),
+      )) {
+        changes.push(
+          new factories.RevokeGrantOption({
+            [objectKey]: revokeTarget,
+            privilegeNames: result.revokeGrantOption,
+            grantee,
+            columns: group.columns,
+            version,
+          }),
+        );
+      }
+    }
+    for (const [, group] of groupPrivilegesByColumns(result.grants)) {
+      for (const [grantable, privSet] of group.byGrant) {
+        changes.push(
+          new factories.Grant({
+            [objectKey]: grantTarget,
+            privileges: [...privSet].map((p) => ({ privilege: p, grantable })),
+            grantee,
+            columns: group.columns,
+            version,
+          }),
+        );
+      }
+    }
+  }
+
+  return changes;
+}

package/src/core/objects/base.privilege.ts

@@ -164,7 +164,7 @@ export function getObjectKindPrefix(objectKind: string): string {
     case "TYPE":
       return "ON TYPE";
     case "FOREIGN TABLE":
-      return "ON FOREIGN TABLE";
+      return "ON TABLE";
     default:
       return "ON";
   }
@@ -176,9 +176,16 @@ export function normalizePrivileges(privileges: PrivilegeProps[]) {
       grantee: privilege.grantee,
       privilege: privilege.privilege,
       grantable: privilege.grantable,
+      columns: privilege.columns
+        ? [...privilege.columns].sort()
+        : privilege.columns,
     }))
     .sort((a, b) => {
       if (a.grantee !== b.grantee) return a.grantee.localeCompare(b.grantee);
-      return a.privilege.localeCompare(b.privilege);
+      if (a.privilege !== b.privilege)
+        return a.privilege.localeCompare(b.privilege);
+      const colA = a.columns?.join(",") ?? "";
+      const colB = b.columns?.join(",") ?? "";
+      return colA.localeCompare(colB);
     });
 }

package/src/core/objects/collation/changes/collation.alter.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Collation } from "../collation.model.ts";
 import {
   AlterCollationChangeOwner,
@@ -7,7 +8,7 @@ import {
 
 describe.concurrent("collation", () => {
   describe("alter", () => {
-    test("change owner", () => {
+    test("change owner", async () => {
       const collation = new Collation({
         schema: "public",
         name: "test",
@@ -28,12 +29,14 @@ describe.concurrent("collation", () => {
         owner: "new_owner",
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER COLLATION public.test OWNER TO new_owner",
       );
     });
 
-    test("refresh version", () => {
+    test("refresh version", async () => {
       const collation = new Collation({
         schema: "public",
         name: "test",
@@ -53,6 +56,8 @@ describe.concurrent("collation", () => {
         collation,
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER COLLATION public.test REFRESH VERSION",
       );

package/src/core/objects/collation/changes/collation.create.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Collation } from "../collation.model.ts";
 import { CreateCollation } from "./collation.create.ts";
 
 describe("collation", () => {
-  test("create minimal", () => {
+  test("create minimal", async () => {
     const collation = new Collation({
       schema: "public",
       name: "test",
@@ -21,12 +22,14 @@ describe("collation", () => {
 
     const change = new CreateCollation({ collation });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       `CREATE COLLATION public.test (LC_COLLATE = 'C', LC_CTYPE = 'C')`,
     );
   });
 
-  test("create with all options", () => {
+  test("create with all options", async () => {
     const collation = new Collation({
       schema: "public",
       name: "test",
@@ -44,6 +47,8 @@ describe("collation", () => {
 
     const change = new CreateCollation({ collation });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       `CREATE COLLATION public.test (LOCALE = 'en_US', LC_COLLATE = 'en_US', LC_CTYPE = 'en_US', PROVIDER = icu, DETERMINISTIC = false, RULES = '& A < a <<< à', VERSION = '1.0')`,
     );

package/src/core/objects/collation/changes/collation.drop.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Collation } from "../collation.model.ts";
 import { DropCollation } from "./collation.drop.ts";
 
 describe("collation", () => {
-  test("drop", () => {
+  test("drop", async () => {
     const collation = new Collation({
       schema: "public",
       name: "test",
@@ -23,6 +24,8 @@ describe("collation", () => {
       collation,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe("DROP COLLATION public.test");
   });
 });

package/src/core/objects/collation/collation.diff.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import {
   AlterCollationChangeOwner,
   AlterCollationRefreshVersion,
@@ -8,6 +9,10 @@ import { DropCollation } from "./changes/collation.drop.ts";
 import { diffCollations } from "./collation.diff.ts";
 import { Collation, type CollationProps } from "./collation.model.ts";
 
+const ctx: Pick<ObjectDiffContext, "currentUser"> = {
+  currentUser: "postgres",
+};
+
 describe.concurrent("collation.diff", () => {
   test("create and drop", () => {
     const props: CollationProps = {
@@ -26,19 +31,11 @@ describe.concurrent("collation.diff", () => {
     };
     const c = new Collation(props);
 
-    const created = diffCollations(
-      { currentUser: "postgres" },
-      {},
-      { [c.stableId]: c },
-    );
+    const created = diffCollations(ctx, {}, { [c.stableId]: c });
     expect(created).toHaveLength(1);
     expect(created[0]).toBeInstanceOf(CreateCollation);
 
-    const dropped = diffCollations(
-      { currentUser: "postgres" },
-      { [c.stableId]: c },
-      {},
-    );
+    const dropped = diffCollations(ctx, { [c.stableId]: c }, {});
     expect(dropped).toHaveLength(1);
     expect(dropped[0]).toBeInstanceOf(DropCollation);
   });
@@ -60,7 +57,7 @@ describe.concurrent("collation.diff", () => {
     const branch = new Collation({ ...base, version: "2.0", owner: "o2" });
 
     const changes = diffCollations(
-      { currentUser: "postgres" },
+      ctx,
       { [main.stableId]: main },
       { [branch.stableId]: branch },
     );
@@ -89,7 +86,7 @@ describe.concurrent("collation.diff", () => {
     const main = new Collation({ ...base, provider: "c" });
     const branch = new Collation({ ...base, provider: "i" });
     const changes = diffCollations(
-      { currentUser: "postgres" },
+      ctx,
       { [main.stableId]: main },
       { [branch.stableId]: branch },
     );

package/src/core/objects/collation/collation.diff.ts

@@ -1,4 +1,5 @@
 import { diffObjects } from "../base.diff.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { hasNonAlterableChanges } from "../utils.ts";
 import {
   AlterCollationChangeOwner,
@@ -22,7 +23,7 @@ import type { Collation } from "./collation.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffCollations(
-  ctx: { currentUser: string },
+  ctx: Pick<ObjectDiffContext, "currentUser">,
   main: Record<string, Collation>,
   branch: Record<string, Collation>,
 ): CollationChange[] {

package/src/core/objects/diff-context.ts

@@ -0,0 +1,16 @@
+import type { DefaultPrivilegeState } from "./base.default-privileges.ts";
+import type { Role } from "./role/role.model.ts";
+
+/**
+ * Unified context built by `diffCatalogs` and passed to per-object diff
+ * functions.  Each diff declares only the keys it reads via
+ * `Pick<ObjectDiffContext, …>`, so every signature documents its actual
+ * requirements.  The full object is always assignable to every narrower Pick.
+ */
+export interface ObjectDiffContext {
+  version: number;
+  currentUser: string;
+  defaultPrivilegeState: DefaultPrivilegeState;
+  mainRoles: Record<string, Role>;
+  skipDefaultPrivilegeSubtraction?: boolean;
+}

package/src/core/objects/domain/changes/domain.alter.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Domain, type DomainProps } from "../domain.model.ts";
 import {
   AlterDomainAddConstraint,
@@ -13,7 +14,7 @@ import {
 
 describe.concurrent("domain", () => {
   describe("alter", () => {
-    test("set default", () => {
+    test("set default", async () => {
       const props: Omit<DomainProps, "default_value"> = {
         schema: "public",
         name: "test_domain",
@@ -39,12 +40,14 @@ describe.concurrent("domain", () => {
         defaultValue: "42",
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain SET DEFAULT 42",
       );
     });
 
-    test("drop default", () => {
+    test("drop default", async () => {
       const props: Omit<DomainProps, "default_value"> = {
         schema: "public",
         name: "test_domain",
@@ -70,12 +73,14 @@ describe.concurrent("domain", () => {
         domain,
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain DROP DEFAULT",
       );
     });
 
-    test("set not null", () => {
+    test("set not null", async () => {
       const props: Omit<DomainProps, "not_null"> = {
         schema: "public",
         name: "test_domain",
@@ -101,12 +106,14 @@ describe.concurrent("domain", () => {
         domain,
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain SET NOT NULL",
       );
     });
 
-    test("drop not null", () => {
+    test("drop not null", async () => {
       const props: Omit<DomainProps, "not_null"> = {
         schema: "public",
         name: "test_domain",
@@ -132,12 +139,14 @@ describe.concurrent("domain", () => {
         domain,
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain DROP NOT NULL",
       );
     });
 
-    test("change owner", () => {
+    test("change owner", async () => {
       const props: Omit<DomainProps, "owner"> = {
         schema: "public",
         name: "test_domain",
@@ -164,12 +173,14 @@ describe.concurrent("domain", () => {
         owner: "new_owner",
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain OWNER TO new_owner",
       );
     });
 
-    test("add constraint", () => {
+    test("add constraint", async () => {
       const props: DomainProps = {
         schema: "public",
         name: "test_domain",
@@ -200,12 +211,14 @@ describe.concurrent("domain", () => {
         },
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain ADD CONSTRAINT test_check CHECK (VALUE > 0)",
       );
     });
 
-    test("add constraint not valid", () => {
+    test("add constraint not valid", async () => {
       const props: DomainProps = {
         schema: "public",
         name: "test_domain",
@@ -236,12 +249,14 @@ describe.concurrent("domain", () => {
         },
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain ADD CONSTRAINT test_check CHECK (VALUE > 0) NOT VALID",
       );
     });
 
-    test("drop constraint", () => {
+    test("drop constraint", async () => {
       const props: DomainProps = {
         schema: "public",
         name: "test_domain",
@@ -272,12 +287,14 @@ describe.concurrent("domain", () => {
         },
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain DROP CONSTRAINT test_check",
       );
     });
 
-    test("validate constraint", () => {
+    test("validate constraint", async () => {
       const props: DomainProps = {
         schema: "public",
         name: "test_domain",
@@ -308,6 +325,8 @@ describe.concurrent("domain", () => {
         },
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER DOMAIN public.test_domain VALIDATE CONSTRAINT test_check",
       );

package/src/core/objects/domain/changes/domain.create.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Domain } from "../domain.model.ts";
 import { CreateDomain } from "./domain.create.ts";
 
 describe("domain", () => {
-  test("create minimal", () => {
+  test("create minimal", async () => {
     const domain = new Domain({
       schema: "public",
       name: "test_domain",
@@ -24,12 +25,14 @@ describe("domain", () => {
 
     const change = new CreateDomain({ domain });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE DOMAIN public.test_domain AS integer",
     );
   });
 
-  test("create with all options", () => {
+  test("create with all options", async () => {
     const domain = new Domain({
       schema: "public",
       name: "test_domain_all",
@@ -58,8 +61,35 @@ describe("domain", () => {
 
     const change = new CreateDomain({ domain });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       `CREATE DOMAIN public.test_domain_all AS custom.text[][] COLLATE mycoll DEFAULT 'hello' NOT NULL CHECK (VALUE <> '')`,
     );
   });
+
+  test("create with already schema-qualified base type (format_type)", async () => {
+    const domain = new Domain({
+      schema: "app",
+      name: "email_address",
+      base_type: "citext",
+      base_type_schema: "extensions",
+      base_type_str: "extensions.citext",
+      not_null: false,
+      type_modifier: null,
+      array_dimensions: null,
+      collation: null,
+      default_bin: null,
+      default_value: null,
+      owner: "test",
+      comment: null,
+      constraints: [],
+      privileges: [],
+    });
+    const change = new CreateDomain({ domain });
+    await assertValidSql(change.serialize());
+    expect(change.serialize()).toBe(
+      "CREATE DOMAIN app.email_address AS extensions.citext",
+    );
+  });
 });