@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/src/core/objects/materialized-view/materialized-view.diff.ts

@@ -1,10 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
-  groupPrivilegesByColumns,
+  emitColumnPrivilegeChanges,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
 import {
   AlterMaterializedViewChangeOwner,
@@ -35,12 +34,10 @@ import type { MaterializedView } from "./materialized-view.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffMaterializedViews(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, MaterializedView>,
   branch: Record<string, MaterializedView>,
 ): MaterializedViewChange[] {
@@ -101,105 +98,34 @@ export function diffMaterializedViews(
       "materialized_view",
       mv.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      mv.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     const desiredPrivileges = mv.privileges;
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the materialized view owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      creatorFilteredDefaults,
       desiredPrivileges,
       mv.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByColumns(result.grants);
-        for (const [, group] of grantGroups) {
-          for (const [grantable, privSet] of group.byGrant) {
-            const privileges = Array.from(privSet).map((priv) => ({
-              privilege: priv,
-              grantable,
-            }));
-            changes.push(
-              new GrantMaterializedViewPrivileges({
-                materializedView: mv,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByColumns(result.revokes);
-        for (const [, group] of revokeGroups) {
-          const allPrivileges = new Set<string>();
-          for (const [, privSet] of group.byGrant) {
-            for (const priv of privSet) {
-              allPrivileges.add(priv);
-            }
-          }
-          const privileges = Array.from(allPrivileges).map((priv) => ({
-            privilege: priv,
-            grantable: false,
-          }));
-          changes.push(
-            new RevokeMaterializedViewPrivileges({
-              materializedView: mv,
-              grantee,
-              privileges,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        const revokeGrantGroups = new Map<
-          string,
-          { columns?: string[]; privileges: Set<string> }
-        >();
-        for (const r of result.revokeGrantOption) {
-          // For revoke grant option, we need to find the columns from the effective defaults
-          const originalPriv = effectiveDefaults.find(
-            (p) => p.grantee === grantee && p.privilege === r,
-          );
-          const key = originalPriv?.columns
-            ? originalPriv.columns.sort().join(",")
-            : "";
-          if (!revokeGrantGroups.has(key)) {
-            revokeGrantGroups.set(key, {
-              columns: originalPriv?.columns
-                ? [...originalPriv.columns]
-                : undefined,
-              privileges: new Set(),
-            });
-          }
-          const group = revokeGrantGroups.get(key);
-          if (!group) continue;
-          group.privileges.add(r);
-        }
-        for (const [, group] of revokeGrantGroups) {
-          const privilegeNames = Array.from(group.privileges);
-          changes.push(
-            new RevokeGrantOptionMaterializedViewPrivileges({
-              materializedView: mv,
-              grantee,
-              privilegeNames,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-    }
+    changes.push(
+      ...(emitColumnPrivilegeChanges(
+        privilegeResults,
+        mv,
+        mv,
+        "materializedView",
+        {
+          Grant: GrantMaterializedViewPrivileges,
+          Revoke: RevokeMaterializedViewPrivileges,
+          RevokeGrantOption: RevokeGrantOptionMaterializedViewPrivileges,
+        },
+        effectiveDefaults,
+        ctx.version,
+      ) as MaterializedViewChange[]),
+    );
   }
 
   for (const materializedViewId of dropped) {
@@ -351,99 +277,23 @@ export function diffMaterializedViews(
         mainMaterializedView.privileges,
         branchMaterializedView.privileges,
         branchMaterializedView.owner,
-        ctx.mainRoles,
       );
 
-      for (const [grantee, result] of privilegeResults) {
-        // Generate grant changes
-        if (result.grants.length > 0) {
-          const grantGroups = groupPrivilegesByColumns(result.grants);
-          for (const [, group] of grantGroups) {
-            for (const [grantable, privSet] of group.byGrant) {
-              const privileges = Array.from(privSet).map((priv) => ({
-                privilege: priv,
-                grantable,
-              }));
-              changes.push(
-                new GrantMaterializedViewPrivileges({
-                  materializedView: branchMaterializedView,
-                  grantee,
-                  privileges,
-                  columns: group.columns,
-                  version: ctx.version,
-                }),
-              );
-            }
-          }
-        }
-
-        // Generate revoke changes
-        if (result.revokes.length > 0) {
-          const revokeGroups = groupPrivilegesByColumns(result.revokes);
-          for (const [, group] of revokeGroups) {
-            // Collapse all grantable groups into a single revoke (grantable: false)
-            const allPrivileges = new Set<string>();
-            for (const [, privSet] of group.byGrant) {
-              for (const priv of privSet) {
-                allPrivileges.add(priv);
-              }
-            }
-            const privileges = Array.from(allPrivileges).map((priv) => ({
-              privilege: priv,
-              grantable: false,
-            }));
-            changes.push(
-              new RevokeMaterializedViewPrivileges({
-                materializedView: mainMaterializedView,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke grant option changes
-        if (result.revokeGrantOption.length > 0) {
-          const revokeGrantGroups = new Map<
-            string,
-            { columns?: string[]; privileges: Set<string> }
-          >();
-          for (const r of result.revokeGrantOption) {
-            // For revoke grant option, we need to find the columns from the original privilege
-            const originalPriv = mainMaterializedView.privileges.find(
-              (p) => p.grantee === grantee && p.privilege === r,
-            );
-            const key = originalPriv?.columns
-              ? originalPriv.columns.sort().join(",")
-              : "";
-            if (!revokeGrantGroups.has(key)) {
-              revokeGrantGroups.set(key, {
-                columns: originalPriv?.columns
-                  ? [...originalPriv.columns]
-                  : undefined,
-                privileges: new Set(),
-              });
-            }
-            const group = revokeGrantGroups.get(key);
-            if (!group) continue;
-            group.privileges.add(r);
-          }
-          for (const [, group] of revokeGrantGroups) {
-            const privilegeNames = Array.from(group.privileges);
-            changes.push(
-              new RevokeGrantOptionMaterializedViewPrivileges({
-                materializedView: mainMaterializedView,
-                grantee,
-                privilegeNames,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
+      changes.push(
+        ...(emitColumnPrivilegeChanges(
+          privilegeResults,
+          branchMaterializedView,
+          mainMaterializedView,
+          "materializedView",
+          {
+            Grant: GrantMaterializedViewPrivileges,
+            Revoke: RevokeMaterializedViewPrivileges,
+            RevokeGrantOption: RevokeGrantOptionMaterializedViewPrivileges,
+          },
+          mainMaterializedView.privileges,
+          ctx.version,
+        ) as MaterializedViewChange[]),
+      );
     }
   }
 

package/src/core/objects/materialized-view/materialized-view.model.ts

@@ -221,7 +221,7 @@ select
           filter (where src.attname is not null) as cols
       from (
         -- one row for object ACL + one row per column ACL
-        select null::name as attname, c.relacl as acl
+        select null::name as attname, COALESCE(c.relacl, acldefault('r', c.relowner)) as acl
         union all
         select a2.attname, a2.attacl
         from pg_attribute a2