@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/src/core/integrations/serialize/dsl.test.ts

@@ -0,0 +1,91 @@
+import { describe, expect, test } from "bun:test";
+import type { Change } from "../../change.types.ts";
+import { compileSerializeDSL } from "./dsl.ts";
+
+function makeChange(
+  type: string,
+  operation: string,
+  serializeFn: (opts?: Record<string, unknown>) => string,
+): Change {
+  return {
+    objectType: type,
+    operation,
+    scope: "object",
+    schema: { name: "test" },
+    serialize: serializeFn,
+  } as unknown as Change;
+}
+
+describe("compileSerializeDSL", () => {
+  test("matching rule applies its options", () => {
+    const serializer = compileSerializeDSL([
+      {
+        when: { type: "schema" as const, operation: "create" as const },
+        options: { skipAuthorization: true },
+      },
+    ]);
+
+    const change = makeChange("schema", "create", (opts) =>
+      opts?.skipAuthorization
+        ? "CREATE SCHEMA test"
+        : "CREATE SCHEMA test AUTHORIZATION owner",
+    );
+
+    expect(serializer(change)).toBe("CREATE SCHEMA test");
+  });
+
+  test("no matching rule uses default serialization", () => {
+    const serializer = compileSerializeDSL([
+      {
+        when: { type: "table" as const },
+        options: { skipAuthorization: true },
+      },
+    ]);
+
+    const change = makeChange("schema", "create", (opts) =>
+      opts?.skipAuthorization
+        ? "CREATE SCHEMA test"
+        : "CREATE SCHEMA test AUTHORIZATION owner",
+    );
+
+    expect(serializer(change)).toBe("CREATE SCHEMA test AUTHORIZATION owner");
+  });
+
+  test("first matching rule wins", () => {
+    const serializer = compileSerializeDSL([
+      {
+        when: { type: "schema" as const },
+        options: { skipAuthorization: true },
+      },
+      {
+        when: { type: "schema" as const },
+        options: { skipAuthorization: false },
+      },
+    ]);
+
+    const change = makeChange("schema", "create", (opts) =>
+      opts?.skipAuthorization ? "WITHOUT AUTH" : "WITH AUTH",
+    );
+
+    expect(serializer(change)).toBe("WITHOUT AUTH");
+  });
+
+  test("skips non-matching first rule and applies second", () => {
+    const serializer = compileSerializeDSL([
+      {
+        when: { type: "table" as const },
+        options: { skipAuthorization: true },
+      },
+      {
+        when: { type: "schema" as const },
+        options: { skipAuthorization: false },
+      },
+    ]);
+
+    const change = makeChange("schema", "create", (opts) =>
+      opts?.skipAuthorization ? "WITHOUT AUTH" : "WITH AUTH",
+    );
+
+    expect(serializer(change)).toBe("WITH AUTH");
+  });
+});

package/src/core/integrations/supabase.ts

@@ -58,7 +58,16 @@ const SUPABASE_SYSTEM_ROLES = [
   "supabase_superuser",
 ] as const;
 
+/**
+ * To generate the emptyCatalog snapshot, run catalog-export against a fresh
+ * supabase/postgres container:
+ *
+ *   pgdelta catalog-export --target postgres://postgres:postgres@localhost:54322/postgres --output supabase-baseline.json
+ *
+ * Then import and assign the JSON content to the emptyCatalog field below.
+ */
 export const supabase: IntegrationDSL = {
+  // TODO: emptyCatalog: undefined -- populate by running catalog-export on a clean Supabase container
   filter: {
     or: [
       {

package/src/core/objects/aggregate/aggregate.diff.ts

@@ -1,11 +1,10 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
+  emitObjectPrivilegeChanges,
   filterPublicBuiltInDefaults,
-  groupPrivilegesByGrantable,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
 import type { Aggregate } from "./aggregate.model.ts";
 import { AlterAggregateChangeOwner } from "./changes/aggregate.alter.ts";
@@ -23,12 +22,10 @@ import {
 import type { AggregateChange } from "./changes/aggregate.types.ts";
 
 export function diffAggregates(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, Aggregate>,
   branch: Record<string, Aggregate>,
 ): AggregateChange[] {
@@ -65,6 +62,10 @@ export function diffAggregates(
       "aggregate",
       aggregate.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      aggregate.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     // Filter out PUBLIC's built-in default EXECUTE privilege (PostgreSQL grants it automatically)
     // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
     // This prevents generating unnecessary "GRANT EXECUTE TO PUBLIC" statements
@@ -75,55 +76,25 @@ export function diffAggregates(
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the aggregate owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      filterPublicBuiltInDefaults("aggregate", creatorFilteredDefaults),
       desiredPrivileges,
       aggregate.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [, list] of grantGroups) {
-          changes.push(
-            new GrantAggregatePrivileges({
-              aggregate,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [, list] of revokeGroups) {
-          changes.push(
-            new RevokeAggregatePrivileges({
-              aggregate,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionAggregatePrivileges({
-            aggregate,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        aggregate,
+        aggregate,
+        "aggregate",
+        {
+          Grant: GrantAggregatePrivileges,
+          Revoke: RevokeAggregatePrivileges,
+          RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        },
+        ctx.version,
+      ) as AggregateChange[]),
+    );
   }
 
   for (const aggregateId of dropped) {
@@ -229,49 +200,22 @@ export function diffAggregates(
       mainPrivilegesFiltered,
       branchPrivilegesFiltered,
       branchAggregate.owner,
-      ctx.mainRoles,
     );
 
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [, list] of grantGroups) {
-          changes.push(
-            new GrantAggregatePrivileges({
-              aggregate: branchAggregate,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [, list] of revokeGroups) {
-          changes.push(
-            new RevokeAggregatePrivileges({
-              aggregate: mainAggregate,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionAggregatePrivileges({
-            aggregate: mainAggregate,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        branchAggregate,
+        mainAggregate,
+        "aggregate",
+        {
+          Grant: GrantAggregatePrivileges,
+          Revoke: RevokeAggregatePrivileges,
+          RevokeGrantOption: RevokeGrantOptionAggregatePrivileges,
+        },
+        ctx.version,
+      ) as AggregateChange[]),
+    );
   }
 
   return changes;

package/src/core/objects/aggregate/aggregate.model.ts

@@ -292,7 +292,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(p.proacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from

package/src/core/objects/aggregate/changes/aggregate.alter.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Aggregate } from "../aggregate.model.ts";
 import { AlterAggregateChangeOwner } from "./aggregate.alter.ts";
 
@@ -49,7 +50,7 @@ const base: AggregateProps = {
 };
 
 describe("aggregate.alter", () => {
-  test("serialize owner change", () => {
+  test("serialize owner change", async () => {
     const aggregate = new Aggregate(base);
     const change = new AlterAggregateChangeOwner({
       aggregate,
@@ -57,6 +58,7 @@ describe("aggregate.alter", () => {
     });
 
     expect(change.requires).toEqual([aggregate.stableId]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "ALTER AGGREGATE public.agg_sum(integer) OWNER TO owner2",
     );

package/src/core/objects/aggregate/changes/aggregate.comment.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { stableId } from "../../utils.ts";
 import { Aggregate } from "../aggregate.model.ts";
 import {
@@ -59,18 +60,19 @@ const makeAggregate = (override: Partial<AggregateProps> = {}) =>
   });
 
 describe("aggregate.comment", () => {
-  test("create comment serializes and tracks dependencies", () => {
+  test("create comment serializes and tracks dependencies", async () => {
     const aggregate = makeAggregate({ comment: "aggregate's total" });
     const change = new CreateCommentOnAggregate({ aggregate });
 
     expect(change.creates).toEqual([stableId.comment(aggregate.stableId)]);
     expect(change.requires).toEqual([aggregate.stableId]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "COMMENT ON AGGREGATE public.agg_sum(integer) IS 'aggregate''s total'",
     );
   });
 
-  test("drop comment serializes and tracks dependencies", () => {
+  test("drop comment serializes and tracks dependencies", async () => {
     const aggregate = makeAggregate({ comment: "some comment" });
     const change = new DropCommentOnAggregate({ aggregate });
 
@@ -79,6 +81,7 @@ describe("aggregate.comment", () => {
       stableId.comment(aggregate.stableId),
       aggregate.stableId,
     ]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "COMMENT ON AGGREGATE public.agg_sum(integer) IS NULL",
     );

package/src/core/objects/aggregate/changes/aggregate.create.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Aggregate } from "../aggregate.model.ts";
 import { CreateAggregate } from "./aggregate.create.ts";
 
@@ -55,17 +56,18 @@ const makeAggregate = (override: Partial<AggregateProps> = {}) =>
   });
 
 describe("aggregate.create", () => {
-  test("serialize minimal aggregate", () => {
+  test("serialize minimal aggregate", async () => {
     const aggregate = makeAggregate();
     const change = new CreateAggregate({ aggregate });
 
     expect(change.creates).toEqual([aggregate.stableId]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toMatchInlineSnapshot(
       `"CREATE AGGREGATE public.agg_sum(integer) (SFUNC = pg_catalog.int4pl, STYPE = integer)"`,
     );
   });
 
-  test("serialize aggregate with optional clauses and or replace", () => {
+  test("serialize aggregate with optional clauses and or replace", async () => {
     const aggregate = makeAggregate({
       name: "agg_full",
       transition_function: "public.sum_int8(bigint,bigint)",
@@ -94,8 +96,9 @@ describe("aggregate.create", () => {
 
     const change = new CreateAggregate({ aggregate, orReplace: true });
 
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toMatchInlineSnapshot(
-      `"CREATE OR REPLACE AGGREGATE public.agg_full(integer) (SFUNC = public.sum_int8, STYPE = bigint, SSPACE = 8, FINALFUNC = public.finalize, FINALFUNC_EXTRA, FINALFUNC_MODIFY = READ_WRITE, COMBINEFUNC = public.combine, SERIALFUNC = public.serialize_state, DESERIALFUNC = public.deserialize_state, INITCOND = '0', MSFUNC = public.msum, MINVFUNC = public.minv, MSTYPE = pg_catalog.bigint, MSSPACE = 16, MFINALFUNC = public.mfinal, MFINALFUNC_EXTRA, MFINALFUNC_MODIFY = SHAREABLE, MINITCOND = '0', SORTOP = OPERATOR(pg_catalog.<), PARALLEL SAFE, STRICT, HYPOTHETICAL)"`,
+      `"CREATE OR REPLACE AGGREGATE public.agg_full(integer) (SFUNC = public.sum_int8, STYPE = bigint, SSPACE = 8, FINALFUNC = public.finalize, FINALFUNC_EXTRA, FINALFUNC_MODIFY = READ_WRITE, COMBINEFUNC = public.combine, SERIALFUNC = public.serialize_state, DESERIALFUNC = public.deserialize_state, INITCOND = '0', MSFUNC = public.msum, MINVFUNC = public.minv, MSTYPE = pg_catalog.bigint, MSSPACE = 16, MFINALFUNC = public.mfinal, MFINALFUNC_EXTRA, MFINALFUNC_MODIFY = SHAREABLE, MINITCOND = '0', SORTOP = OPERATOR(pg_catalog.<), PARALLEL = SAFE, STRICT, HYPOTHETICAL)"`,
     );
   });
 });

package/src/core/objects/aggregate/changes/aggregate.create.ts

@@ -275,7 +275,7 @@ export class CreateAggregate extends CreateAggregateChange {
 
     if (this.aggregate.parallel_safety !== "u") {
       clauses.push(
-        `PARALLEL ${formatParallel(this.aggregate.parallel_safety)}`,
+        `PARALLEL = ${formatParallel(this.aggregate.parallel_safety)}`,
       );
     }
 

package/src/core/objects/aggregate/changes/aggregate.drop.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Aggregate } from "../aggregate.model.ts";
 import { DropAggregate } from "./aggregate.drop.ts";
 
@@ -55,16 +56,17 @@ const makeAggregate = (override: Partial<AggregateProps> = {}) =>
   });
 
 describe("aggregate.drop", () => {
-  test("serialize drop for aggregate with arguments", () => {
+  test("serialize drop for aggregate with arguments", async () => {
     const aggregate = makeAggregate();
     const change = new DropAggregate({ aggregate });
 
     expect(change.drops).toEqual([aggregate.stableId]);
     expect(change.requires).toEqual([aggregate.stableId]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe("DROP AGGREGATE public.agg_sum(integer)");
   });
 
-  test("serialize drop for aggregate without arguments", () => {
+  test("serialize drop for aggregate without arguments", async () => {
     const aggregate = makeAggregate({
       name: "agg_no_args",
       identity_arguments: "",
@@ -73,6 +75,8 @@ describe("aggregate.drop", () => {
     });
     const change = new DropAggregate({ aggregate });
 
-    expect(change.serialize()).toBe("DROP AGGREGATE public.agg_no_args()");
+    await assertValidSql(change.serialize());
+
+    expect(change.serialize()).toBe("DROP AGGREGATE public.agg_no_args(*)");
   });
 });

package/src/core/objects/aggregate/changes/aggregate.drop.ts

@@ -26,7 +26,7 @@ export class DropAggregate extends DropAggregateChange {
   serialize(): string {
     const signature = this.aggregate.identityArguments;
     const qualifiedName = `${this.aggregate.schema}.${this.aggregate.name}`;
-    const withArgs = signature.length > 0 ? `(${signature})` : "()";
+    const withArgs = signature.length > 0 ? `(${signature})` : "(*)";
     return `DROP AGGREGATE ${qualifiedName}${withArgs}`;
   }
 }

package/src/core/objects/aggregate/changes/aggregate.privilege.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { stableId } from "../../utils.ts";
 import { Aggregate } from "../aggregate.model.ts";
 import {
@@ -54,7 +55,7 @@ const base: AggregateProps = {
 };
 
 describe("aggregate.privilege", () => {
-  test("grant privileges without grant option", () => {
+  test("grant privileges without grant option", async () => {
     const aggregate = new Aggregate(base);
     const change = new GrantAggregatePrivileges({
       aggregate,
@@ -70,12 +71,13 @@ describe("aggregate.privilege", () => {
       aggregate.stableId,
       stableId.role("role_exec"),
     ]);
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "GRANT ALL ON FUNCTION public.agg_sum(integer) TO role_exec",
     );
   });
 
-  test("grant privileges with grant option", () => {
+  test("grant privileges with grant option", async () => {
     const aggregate = new Aggregate(base);
     const change = new GrantAggregatePrivileges({
       aggregate,
@@ -83,12 +85,14 @@ describe("aggregate.privilege", () => {
       privileges: [{ privilege: "EXECUTE", grantable: true }],
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "GRANT ALL ON FUNCTION public.agg_sum(integer) TO role_exec WITH GRANT OPTION",
     );
   });
 
-  test("revoke privileges and grant option", () => {
+  test("revoke privileges and grant option", async () => {
     const aggregate = new Aggregate(base);
     const revoke = new RevokeAggregatePrivileges({
       aggregate,
@@ -105,6 +109,7 @@ describe("aggregate.privilege", () => {
       aggregate.stableId,
       stableId.role("role_old"),
     ]);
+    await assertValidSql(revoke.serialize());
     expect(revoke.serialize()).toBe(
       "REVOKE ALL ON FUNCTION public.agg_sum(integer) FROM role_old",
     );
@@ -123,6 +128,7 @@ describe("aggregate.privilege", () => {
       aggregate.stableId,
       stableId.role("role_with_option"),
     ]);
+    await assertValidSql(revokeGrantOption.serialize());
     expect(revokeGrantOption.serialize()).toBe(
       "REVOKE GRANT OPTION FOR ALL ON FUNCTION public.agg_sum(integer) FROM role_with_option",
     );