@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/src/core/objects/schema/changes/schema.create.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Schema } from "../schema.model.ts";
 import { CreateSchema } from "./schema.create.ts";
 
 describe("schema", () => {
-  test("create", () => {
+  test("create", async () => {
     const schema = new Schema({
       name: "test_schema",
       owner: "test",
@@ -15,6 +16,8 @@ describe("schema", () => {
       schema,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE SCHEMA test_schema AUTHORIZATION test",
     );

package/src/core/objects/schema/changes/schema.drop.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Schema } from "../schema.model.ts";
 import { DropSchema } from "./schema.drop.ts";
 
 describe("schema", () => {
-  test("drop", () => {
+  test("drop", async () => {
     const schema = new Schema({
       name: "test_schema",
       owner: "test",
@@ -15,6 +16,8 @@ describe("schema", () => {
       schema,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe("DROP SCHEMA test_schema");
   });
 });

package/src/core/objects/schema/schema.diff.ts

@@ -1,10 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
-  groupPrivilegesByGrantable,
+  emitObjectPrivilegeChanges,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { AlterSchemaChangeOwner } from "./changes/schema.alter.ts";
 import {
   CreateCommentOnSchema,
@@ -29,12 +28,10 @@ import type { Schema } from "./schema.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffSchemas(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, Schema>,
   branch: Record<string, Schema>,
 ): SchemaChange[] {
@@ -60,61 +57,33 @@ export function diffSchemas(
       "schema",
       "",
     );
+    const creatorFilteredDefaults =
+      sc.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     const desiredPrivileges = sc.privileges;
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the schema owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      creatorFilteredDefaults,
       desiredPrivileges,
       sc.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [grantable, list] of grantGroups) {
-          void grantable;
-          changes.push(
-            new GrantSchemaPrivileges({
-              schema: sc,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [grantable, list] of revokeGroups) {
-          void grantable;
-          changes.push(
-            new RevokeSchemaPrivileges({
-              schema: sc,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionSchemaPrivileges({
-            schema: sc,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        sc,
+        sc,
+        "schema",
+        {
+          Grant: GrantSchemaPrivileges,
+          Revoke: RevokeSchemaPrivileges,
+          RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        },
+        ctx.version,
+      ) as SchemaChange[]),
+    );
   }
 
   for (const schemaId of dropped) {
@@ -151,54 +120,22 @@ export function diffSchemas(
       mainSchema.privileges,
       branchSchema.privileges,
       branchSchema.owner,
-      ctx.mainRoles,
     );
 
-    for (const [grantee, result] of privilegeResults) {
-      // Generate grant changes
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [grantable, list] of grantGroups) {
-          void grantable;
-          changes.push(
-            new GrantSchemaPrivileges({
-              schema: branchSchema,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [grantable, list] of revokeGroups) {
-          void grantable;
-          changes.push(
-            new RevokeSchemaPrivileges({
-              schema: mainSchema,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionSchemaPrivileges({
-            schema: mainSchema,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        branchSchema,
+        mainSchema,
+        "schema",
+        {
+          Grant: GrantSchemaPrivileges,
+          Revoke: RevokeSchemaPrivileges,
+          RevokeGrantOption: RevokeGrantOptionSchemaPrivileges,
+        },
+        ctx.version,
+      ) as SchemaChange[]),
+    );
 
     // Note: Schema renaming would also use ALTER SCHEMA ... RENAME TO ...
     // But since our Schema model uses 'schema' as the identity field,

package/src/core/objects/schema/schema.model.ts

@@ -86,7 +86,7 @@ export async function extractSchemas(pool: Pool): Promise<Schema[]> {
             )
             order by x.grantee, x.privilege_type
           )
-          from lateral aclexplode(nspacl) as x(grantor, grantee, privilege_type, is_grantable)
+          from lateral aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) as x(grantor, grantee, privilege_type, is_grantable)
         ), '[]'
       ) as privileges
     from

package/src/core/objects/sequence/changes/sequence.alter.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Sequence, type SequenceProps } from "../sequence.model.ts";
 import {
   AlterSequenceSetOptions,
@@ -7,7 +8,7 @@ import {
 
 describe.concurrent("sequence", () => {
   describe("alter", () => {
-    test("set owned by table column", () => {
+    test("set owned by table column", async () => {
       const props: Omit<
         SequenceProps,
         "owned_by_schema" | "owned_by_table" | "owned_by_column"
@@ -38,12 +39,14 @@ describe.concurrent("sequence", () => {
         ownedBy: { schema: "public", table: "t", column: "id" },
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER SEQUENCE public.test_sequence OWNED BY public.t.id",
       );
     });
 
-    test("owned by none", () => {
+    test("owned by none", async () => {
       const sequence = new Sequence({
         schema: "public",
         name: "s",
@@ -63,14 +66,15 @@ describe.concurrent("sequence", () => {
         owner: "test",
       });
       const change = new AlterSequenceSetOwnedBy({ sequence, ownedBy: null });
+      await assertValidSql(change.serialize());
       expect(change.serialize()).toBe("ALTER SEQUENCE public.s OWNED BY NONE");
     });
 
-    test("drop + create sequence (handled in diff)", () => {
+    test("drop + create sequence (handled in diff)", async () => {
       expect(1).toBe(1);
     });
 
-    test("alter options: increment, min/max, start, cache, cycle", () => {
+    test("alter options: increment, min/max, start, cache, cycle", async () => {
       const sequence = new Sequence({
         schema: "public",
         name: "s",
@@ -105,12 +109,13 @@ describe.concurrent("sequence", () => {
           "CYCLE",
         ],
       });
+      await assertValidSql(change.serialize());
       expect(change.serialize()).toBe(
         "ALTER SEQUENCE public.s INCREMENT BY 2 MINVALUE 5 MAXVALUE 100 START WITH 10 CACHE 3 CYCLE",
       );
     });
 
-    test("alter options: reset to defaults uses NO MINVALUE/NO MAXVALUE", () => {
+    test("alter options: reset to defaults uses NO MINVALUE/NO MAXVALUE", async () => {
       const sequence = new Sequence({
         schema: "public",
         name: "s",
@@ -143,6 +148,7 @@ describe.concurrent("sequence", () => {
           "NO CYCLE",
         ],
       });
+      await assertValidSql(change.serialize());
       expect(change.serialize()).toBe(
         "ALTER SEQUENCE public.s INCREMENT BY 1 NO MINVALUE NO MAXVALUE START WITH 1 CACHE 1 NO CYCLE",
       );

package/src/core/objects/sequence/changes/sequence.create.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Sequence } from "../sequence.model.ts";
 import { CreateSequence } from "./sequence.create.ts";
 
 describe("sequence", () => {
-  test("create minimal (all defaults elided)", () => {
+  test("create minimal (all defaults elided)", async () => {
     const sequence = new Sequence({
       schema: "public",
       name: "s_min",
@@ -24,10 +25,11 @@ describe("sequence", () => {
     });
 
     const change = new CreateSequence({ sequence });
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe("CREATE SEQUENCE public.s_min");
   });
 
-  test("create", () => {
+  test("create", async () => {
     const sequence = new Sequence({
       schema: "public",
       name: "test_sequence",
@@ -51,12 +53,14 @@ describe("sequence", () => {
       sequence,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE SEQUENCE public.test_sequence AS integer",
     );
   });
 
-  test("create with all options", () => {
+  test("create with all options", async () => {
     const sequence = new Sequence({
       schema: "public",
       name: "s_all",
@@ -77,6 +81,7 @@ describe("sequence", () => {
     });
 
     const change = new CreateSequence({ sequence });
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "CREATE SEQUENCE public.s_all AS integer INCREMENT BY 2 MINVALUE 5 MAXVALUE 100 START WITH 10 CACHE 3 CYCLE",
     );

package/src/core/objects/sequence/changes/sequence.drop.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { Sequence } from "../sequence.model.ts";
 import { DropSequence } from "./sequence.drop.ts";
 
 describe("sequence", () => {
-  test("drop", () => {
+  test("drop", async () => {
     const sequence = new Sequence({
       schema: "public",
       name: "test_sequence",
@@ -27,6 +28,8 @@ describe("sequence", () => {
       sequence,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe("DROP SEQUENCE public.test_sequence");
   });
 });

package/src/core/objects/sequence/sequence.diff.test.ts

@@ -5,8 +5,17 @@ import {
   AlterSequenceSetOptions,
   AlterSequenceSetOwnedBy,
 } from "./changes/sequence.alter.ts";
+import {
+  CreateCommentOnSequence,
+  DropCommentOnSequence,
+} from "./changes/sequence.comment.ts";
 import { CreateSequence } from "./changes/sequence.create.ts";
 import { DropSequence } from "./changes/sequence.drop.ts";
+import {
+  GrantSequencePrivileges,
+  RevokeGrantOptionSequencePrivileges,
+  RevokeSequencePrivileges,
+} from "./changes/sequence.privilege.ts";
 import { diffSequences } from "./sequence.diff.ts";
 import { Sequence, type SequenceProps } from "./sequence.model.ts";
 
@@ -138,4 +147,109 @@ describe.concurrent("sequence.diff", () => {
     expect(changes).toHaveLength(1);
     expect(changes[0]).toBeInstanceOf(DropSequence);
   });
+
+  test("create with comment emits CreateCommentOnSequence", () => {
+    const s = new Sequence({ ...base, comment: "my seq" });
+    const changes = diffSequences(testContext, {}, { [s.stableId]: s });
+    expect(changes[0]).toBeInstanceOf(CreateSequence);
+    expect(changes.some((c) => c instanceof CreateCommentOnSequence)).toBe(
+      true,
+    );
+  });
+
+  test("create with owned-by emits AlterSequenceSetOwnedBy", () => {
+    const s = new Sequence({
+      ...base,
+      owned_by_schema: "public",
+      owned_by_table: "t",
+      owned_by_column: "id",
+    });
+    const changes = diffSequences(testContext, {}, { [s.stableId]: s });
+    expect(changes[0]).toBeInstanceOf(CreateSequence);
+    expect(changes.some((c) => c instanceof AlterSequenceSetOwnedBy)).toBe(
+      true,
+    );
+  });
+
+  test("create with privileges emits grant, revoke, and revoke grant option", () => {
+    const dpState = new DefaultPrivilegeState({});
+    dpState.applyGrant("postgres", "S", null, "role_revoke_me", [
+      { privilege: "USAGE", grantable: false },
+    ]);
+    dpState.applyGrant("postgres", "S", null, "role_downgrade", [
+      { privilege: "USAGE", grantable: true },
+    ]);
+    const ctx = { ...testContext, defaultPrivilegeState: dpState };
+    const s = new Sequence({
+      ...base,
+      privileges: [
+        { grantee: "role_grant_me", privilege: "USAGE", grantable: false },
+        { grantee: "role_downgrade", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const changes = diffSequences(ctx, {}, { [s.stableId]: s });
+    expect(changes[0]).toBeInstanceOf(CreateSequence);
+    expect(changes.some((c) => c instanceof GrantSequencePrivileges)).toBe(
+      true,
+    );
+    expect(changes.some((c) => c instanceof RevokeSequencePrivileges)).toBe(
+      true,
+    );
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionSequencePrivileges),
+    ).toBe(true);
+  });
+
+  test("alter comment emits create and drop comment", () => {
+    const main = new Sequence(base);
+    const withComment = new Sequence({ ...base, comment: "my seq" });
+
+    const addComment = diffSequences(
+      testContext,
+      { [main.stableId]: main },
+      { [withComment.stableId]: withComment },
+    );
+    expect(addComment[0]).toBeInstanceOf(CreateCommentOnSequence);
+
+    const dropComment = diffSequences(
+      testContext,
+      { [withComment.stableId]: withComment },
+      { [main.stableId]: main },
+    );
+    expect(dropComment[0]).toBeInstanceOf(DropCommentOnSequence);
+  });
+
+  test("alter privileges emits grant, revoke, and revoke grant option", () => {
+    const main = new Sequence({
+      ...base,
+      privileges: [
+        { grantee: "role_a", privilege: "USAGE", grantable: false },
+        { grantee: "role_b", privilege: "USAGE", grantable: true },
+        { grantee: "role_removed", privilege: "USAGE", grantable: false },
+      ],
+    });
+    const branch = new Sequence({
+      ...base,
+      privileges: [
+        { grantee: "role_a", privilege: "USAGE", grantable: true },
+        { grantee: "role_b", privilege: "USAGE", grantable: false },
+        { grantee: "role_new", privilege: "USAGE", grantable: false },
+      ],
+    });
+
+    const changes = diffSequences(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+    expect(changes.some((c) => c instanceof GrantSequencePrivileges)).toBe(
+      true,
+    );
+    expect(changes.some((c) => c instanceof RevokeSequencePrivileges)).toBe(
+      true,
+    );
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionSequencePrivileges),
+    ).toBe(true);
+  });
 });

package/src/core/objects/sequence/sequence.diff.ts

@@ -1,10 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
-  groupPrivilegesByGrantable,
+  emitObjectPrivilegeChanges,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import type { Table } from "../table/table.model.ts";
 import { hasNonAlterableChanges } from "../utils.ts";
 import {
@@ -35,12 +34,10 @@ import type { Sequence } from "./sequence.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffSequences(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, Sequence>,
   branch: Record<string, Sequence>,
   branchTables: Record<string, Table> = {},
@@ -83,62 +80,33 @@ export function diffSequences(
       "sequence",
       createdSeq.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      createdSeq.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     const desiredPrivileges = createdSeq.privileges;
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the sequence owner as the reference.
-    // Superuser privileges are filtered inside diffPrivileges.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      creatorFilteredDefaults,
       desiredPrivileges,
       createdSeq.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [grantable, list] of grantGroups) {
-          void grantable;
-          changes.push(
-            new GrantSequencePrivileges({
-              sequence: createdSeq,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [grantable, list] of revokeGroups) {
-          void grantable;
-          changes.push(
-            new RevokeSequencePrivileges({
-              sequence: createdSeq,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionSequencePrivileges({
-            sequence: createdSeq,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        createdSeq,
+        createdSeq,
+        "sequence",
+        {
+          Grant: GrantSequencePrivileges,
+          Revoke: RevokeSequencePrivileges,
+          RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+        },
+        ctx.version,
+      ) as SequenceChange[]),
+    );
   }
 
   for (const sequenceId of dropped) {
@@ -295,59 +263,26 @@ export function diffSequences(
       // PRIVILEGES
       // Filter out owner privileges - owner always has ALL privileges implicitly
       // and shouldn't be compared. Use branch owner as the reference.
-      // Superuser privileges are filtered inside diffPrivileges.
       const privilegeResults = diffPrivileges(
         mainSequence.privileges,
         branchSequence.privileges,
         branchSequence.owner,
-        ctx.mainRoles,
       );
 
-      for (const [grantee, result] of privilegeResults) {
-        // Generate grant changes
-        if (result.grants.length > 0) {
-          const grantGroups = groupPrivilegesByGrantable(result.grants);
-          for (const [grantable, list] of grantGroups) {
-            void grantable;
-            changes.push(
-              new GrantSequencePrivileges({
-                sequence: branchSequence,
-                grantee,
-                privileges: list,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke changes
-        if (result.revokes.length > 0) {
-          const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-          for (const [grantable, list] of revokeGroups) {
-            void grantable;
-            changes.push(
-              new RevokeSequencePrivileges({
-                sequence: mainSequence,
-                grantee,
-                privileges: list,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke grant option changes
-        if (result.revokeGrantOption.length > 0) {
-          changes.push(
-            new RevokeGrantOptionSequencePrivileges({
-              sequence: mainSequence,
-              grantee,
-              privilegeNames: result.revokeGrantOption,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
+      changes.push(
+        ...(emitObjectPrivilegeChanges(
+          privilegeResults,
+          branchSequence,
+          mainSequence,
+          "sequence",
+          {
+            Grant: GrantSequencePrivileges,
+            Revoke: RevokeSequencePrivileges,
+            RevokeGrantOption: RevokeGrantOptionSequencePrivileges,
+          },
+          ctx.version,
+        ) as SequenceChange[]),
+      );
 
       // Note: Sequence renaming would also use ALTER SEQUENCE ... RENAME TO ...
       // But since our Sequence model uses 'name' as the identity field,