@supabase/pg-delta 1.0.0-alpha.4 → 1.0.0-alpha.6

package/src/core/objects/type/range/range.diff.ts

@@ -1,11 +1,10 @@
-import type { DefaultPrivilegeState } from "../../base.default-privileges.ts";
 import { diffObjects } from "../../base.diff.ts";
 import {
   diffPrivileges,
+  emitObjectPrivilegeChanges,
   filterPublicBuiltInDefaults,
-  groupPrivilegesByGrantable,
 } from "../../base.privilege-diff.ts";
-import type { Role } from "../../role/role.model.ts";
+import type { ObjectDiffContext } from "../../diff-context.ts";
 import { hasNonAlterableChanges } from "../../utils.ts";
 import { AlterRangeChangeOwner } from "./changes/range.alter.ts";
 import {
@@ -31,12 +30,10 @@ import type { Range } from "./range.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffRanges(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, Range>,
   branch: Record<string, Range>,
 ): RangeChange[] {
@@ -73,6 +70,10 @@ export function diffRanges(
       "range",
       createdRange.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      createdRange.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     // Filter out PUBLIC's built-in default USAGE privilege (PostgreSQL grants it automatically)
     // Reference: https://www.postgresql.org/docs/17/ddl-priv.html Table 5.2
     // This prevents generating unnecessary "GRANT USAGE TO PUBLIC" statements
@@ -83,56 +84,25 @@ export function diffRanges(
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the range owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      filterPublicBuiltInDefaults("range", creatorFilteredDefaults),
       desiredPrivileges,
       createdRange.owner,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByGrantable(result.grants);
-        for (const [grantable, list] of grantGroups) {
-          void grantable;
-          changes.push(
-            new GrantRangePrivileges({
-              range: createdRange,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-        for (const [grantable, list] of revokeGroups) {
-          void grantable;
-          changes.push(
-            new RevokeRangePrivileges({
-              range: createdRange,
-              grantee,
-              privileges: list,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        changes.push(
-          new RevokeGrantOptionRangePrivileges({
-            range: createdRange,
-            grantee,
-            privilegeNames: result.revokeGrantOption,
-            version: ctx.version,
-          }),
-        );
-      }
-    }
+    changes.push(
+      ...(emitObjectPrivilegeChanges(
+        privilegeResults,
+        createdRange,
+        createdRange,
+        "range",
+        {
+          Grant: GrantRangePrivileges,
+          Revoke: RevokeRangePrivileges,
+          RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+        },
+        ctx.version,
+      ) as RangeChange[]),
+    );
   }
 
   for (const id of dropped) {
@@ -204,54 +174,22 @@ export function diffRanges(
         mainPrivilegesFiltered,
         branchPrivilegesFiltered,
         branchRange.owner,
-        ctx.mainRoles,
       );
 
-      for (const [grantee, result] of privilegeResults) {
-        // Generate grant changes
-        if (result.grants.length > 0) {
-          const grantGroups = groupPrivilegesByGrantable(result.grants);
-          for (const [grantable, list] of grantGroups) {
-            void grantable;
-            changes.push(
-              new GrantRangePrivileges({
-                range: branchRange,
-                grantee,
-                privileges: list,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke changes
-        if (result.revokes.length > 0) {
-          const revokeGroups = groupPrivilegesByGrantable(result.revokes);
-          for (const [grantable, list] of revokeGroups) {
-            void grantable;
-            changes.push(
-              new RevokeRangePrivileges({
-                range: mainRange,
-                grantee,
-                privileges: list,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke grant option changes
-        if (result.revokeGrantOption.length > 0) {
-          changes.push(
-            new RevokeGrantOptionRangePrivileges({
-              range: mainRange,
-              grantee,
-              privilegeNames: result.revokeGrantOption,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
+      changes.push(
+        ...(emitObjectPrivilegeChanges(
+          privilegeResults,
+          branchRange,
+          mainRange,
+          "range",
+          {
+            Grant: GrantRangePrivileges,
+            Revoke: RevokeRangePrivileges,
+            RevokeGrantOption: RevokeGrantOptionRangePrivileges,
+          },
+          ctx.version,
+        ) as RangeChange[]),
+      );
     }
   }
 

package/src/core/objects/type/range/range.model.ts

@@ -164,7 +164,7 @@ select
         )
         order by x.grantee, x.privilege_type
       )
-      from lateral aclexplode(t.typacl) as x(grantor, grantee, privilege_type, is_grantable)
+      from lateral aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) as x(grantor, grantee, privilege_type, is_grantable)
     ), '[]'
   ) as privileges
 from pg_catalog.pg_range r

package/src/core/objects/view/changes/view.alter.test.ts

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { View, type ViewProps } from "../view.model.ts";
 import {
   AlterViewChangeOwner,
@@ -8,7 +9,7 @@ import {
 
 describe.concurrent("view", () => {
   describe("alter", () => {
-    test("change owner", () => {
+    test("change owner", async () => {
       const props: Omit<ViewProps, "owner"> = {
         schema: "public",
         name: "test_view",
@@ -39,13 +40,15 @@ describe.concurrent("view", () => {
         owner: "new_owner",
       });
 
+      await assertValidSql(change.serialize());
+
       expect(change.serialize()).toBe(
         "ALTER VIEW public.test_view OWNER TO new_owner",
       );
     });
   });
 
-  test("set options", () => {
+  test("set options", async () => {
     const props: Omit<ViewProps, "options"> = {
       schema: "public",
       name: "test_view",
@@ -72,12 +75,13 @@ describe.concurrent("view", () => {
       view: main,
       options: ["security_barrier=false"],
     });
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "ALTER VIEW public.test_view SET (security_barrier=false)",
     );
   });
 
-  test("reset options", () => {
+  test("reset options", async () => {
     const view = new View({
       schema: "public",
       name: "test_view",
@@ -103,6 +107,7 @@ describe.concurrent("view", () => {
       view,
       params: ["check_option"],
     });
+    await assertValidSql(change.serialize());
     expect(change.serialize()).toBe(
       "ALTER VIEW public.test_view RESET (check_option)",
     );

package/src/core/objects/view/changes/view.create.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { View } from "../view.model.ts";
 import { CreateView } from "./view.create.ts";
 
 describe("view", () => {
-  test("create", () => {
+  test("create", async () => {
     const view = new View({
       schema: "public",
       name: "test_view",
@@ -29,12 +30,14 @@ describe("view", () => {
       view,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE VIEW public.test_view AS SELECT * FROM test_table",
     );
   });
 
-  test("create with options", () => {
+  test("create with options", async () => {
     const view = new View({
       schema: "public",
       name: "test_view",
@@ -58,6 +61,8 @@ describe("view", () => {
 
     const change = new CreateView({ view });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe(
       "CREATE VIEW public.test_view WITH (security_barrier=true, check_option=local) AS SELECT * FROM test_table",
     );

package/src/core/objects/view/changes/view.drop.test.ts

@@ -1,9 +1,10 @@
 import { describe, expect, test } from "bun:test";
+import { assertValidSql } from "../../../test-utils/assert-valid-sql.ts";
 import { View } from "../view.model.ts";
 import { DropView } from "./view.drop.ts";
 
 describe("view", () => {
-  test("drop", () => {
+  test("drop", async () => {
     const view = new View({
       schema: "public",
       name: "test_view",
@@ -29,6 +30,8 @@ describe("view", () => {
       view,
     });
 
+    await assertValidSql(change.serialize());
+
     expect(change.serialize()).toBe("DROP VIEW public.test_view");
   });
 });

package/src/core/objects/view/view.diff.test.ts

@@ -5,8 +5,17 @@ import {
   AlterViewResetOptions,
   AlterViewSetOptions,
 } from "./changes/view.alter.ts";
+import {
+  CreateCommentOnView,
+  DropCommentOnView,
+} from "./changes/view.comment.ts";
 import { CreateView } from "./changes/view.create.ts";
 import { DropView } from "./changes/view.drop.ts";
+import {
+  GrantViewPrivileges,
+  RevokeGrantOptionViewPrivileges,
+  RevokeViewPrivileges,
+} from "./changes/view.privilege.ts";
 import { diffViews } from "./view.diff.ts";
 import { View, type ViewProps } from "./view.model.ts";
 
@@ -31,6 +40,13 @@ const base: ViewProps = {
   privileges: [],
 };
 
+const makeView = (override: Partial<ViewProps> = {}) =>
+  new View({
+    ...base,
+    ...override,
+    privileges: override.privileges ?? [...base.privileges],
+  });
+
 const testContext = {
   version: 170000,
   currentUser: "postgres",
@@ -88,4 +104,70 @@ describe.concurrent("view.diff", () => {
     expect(changes).toHaveLength(1);
     expect(changes[0]).toBeInstanceOf(CreateView);
   });
+
+  test("create with privileges emits grant changes", () => {
+    const v = makeView({
+      privileges: [
+        { grantee: "role_select", privilege: "SELECT", grantable: false },
+      ],
+    });
+    const changes = diffViews(testContext, {}, { [v.stableId]: v });
+    expect(changes[0]).toBeInstanceOf(CreateView);
+    expect(changes.some((c) => c instanceof GrantViewPrivileges)).toBe(true);
+  });
+
+  test("create with comment emits create comment change", () => {
+    const v = makeView({ comment: "my view" });
+    const changes = diffViews(testContext, {}, { [v.stableId]: v });
+    expect(changes[0]).toBeInstanceOf(CreateView);
+    expect(changes.some((c) => c instanceof CreateCommentOnView)).toBe(true);
+  });
+
+  test("comment changes emit create/drop comment statements", () => {
+    const main = makeView();
+    const withComment = makeView({ comment: "view comment" });
+
+    const addComment = diffViews(
+      testContext,
+      { [main.stableId]: main },
+      { [withComment.stableId]: withComment },
+    );
+    expect(addComment[0]).toBeInstanceOf(CreateCommentOnView);
+
+    const dropComment = diffViews(
+      testContext,
+      { [withComment.stableId]: withComment },
+      { [main.stableId]: main },
+    );
+    expect(dropComment[0]).toBeInstanceOf(DropCommentOnView);
+  });
+
+  test("privilege diffs emit grant, revoke, and revoke grant option statements", () => {
+    const main = makeView({
+      privileges: [
+        { grantee: "role_select", privilege: "SELECT", grantable: false },
+        { grantee: "role_with_option", privilege: "SELECT", grantable: true },
+        { grantee: "role_removed", privilege: "SELECT", grantable: false },
+      ],
+    });
+    const branch = makeView({
+      privileges: [
+        { grantee: "role_select", privilege: "SELECT", grantable: true },
+        { grantee: "role_with_option", privilege: "SELECT", grantable: false },
+        { grantee: "role_new", privilege: "SELECT", grantable: false },
+      ],
+    });
+
+    const changes = diffViews(
+      testContext,
+      { [main.stableId]: main },
+      { [branch.stableId]: branch },
+    );
+
+    expect(changes.some((c) => c instanceof GrantViewPrivileges)).toBe(true);
+    expect(changes.some((c) => c instanceof RevokeViewPrivileges)).toBe(true);
+    expect(
+      changes.some((c) => c instanceof RevokeGrantOptionViewPrivileges),
+    ).toBe(true);
+  });
 });

package/src/core/objects/view/view.diff.ts

@@ -1,10 +1,9 @@
-import type { DefaultPrivilegeState } from "../base.default-privileges.ts";
 import { diffObjects } from "../base.diff.ts";
 import {
   diffPrivileges,
-  groupPrivilegesByColumns,
+  emitColumnPrivilegeChanges,
 } from "../base.privilege-diff.ts";
-import type { Role } from "../role/role.model.ts";
+import type { ObjectDiffContext } from "../diff-context.ts";
 import { deepEqual, hasNonAlterableChanges } from "../utils.ts";
 import {
   AlterViewChangeOwner,
@@ -34,12 +33,10 @@ import type { View } from "./view.model.ts";
  * @returns A list of changes to apply to main to make it match branch.
  */
 export function diffViews(
-  ctx: {
-    version: number;
-    currentUser: string;
-    defaultPrivilegeState: DefaultPrivilegeState;
-    mainRoles: Record<string, Role>;
-  },
+  ctx: Pick<
+    ObjectDiffContext,
+    "version" | "currentUser" | "defaultPrivilegeState"
+  >,
   main: Record<string, View>,
   branch: Record<string, View>,
 ): ViewChange[] {
@@ -71,105 +68,34 @@ export function diffViews(
       "view",
       v.schema ?? "",
     );
+    const creatorFilteredDefaults =
+      v.owner !== ctx.currentUser
+        ? effectiveDefaults.filter((p) => p.grantee !== ctx.currentUser)
+        : effectiveDefaults;
     const desiredPrivileges = v.privileges;
     // Filter out owner privileges - owner always has ALL privileges implicitly
     // and shouldn't be compared. Use the view owner as the reference.
     const privilegeResults = diffPrivileges(
-      effectiveDefaults,
+      creatorFilteredDefaults,
       desiredPrivileges,
       v.owner,
-      ctx.mainRoles,
     );
 
-    // Generate grant changes
-    for (const [grantee, result] of privilegeResults) {
-      if (result.grants.length > 0) {
-        const grantGroups = groupPrivilegesByColumns(result.grants);
-        for (const [, group] of grantGroups) {
-          for (const [grantable, privSet] of group.byGrant) {
-            const privileges = Array.from(privSet).map((priv) => ({
-              privilege: priv,
-              grantable,
-            }));
-            changes.push(
-              new GrantViewPrivileges({
-                view: v,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
-
-      // Generate revoke changes
-      if (result.revokes.length > 0) {
-        const revokeGroups = groupPrivilegesByColumns(result.revokes);
-        for (const [, group] of revokeGroups) {
-          const allPrivileges = new Set<string>();
-          for (const [, privSet] of group.byGrant) {
-            for (const priv of privSet) {
-              allPrivileges.add(priv);
-            }
-          }
-          const privileges = Array.from(allPrivileges).map((priv) => ({
-            privilege: priv,
-            grantable: false,
-          }));
-          changes.push(
-            new RevokeViewPrivileges({
-              view: v,
-              grantee,
-              privileges,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-
-      // Generate revoke grant option changes
-      if (result.revokeGrantOption.length > 0) {
-        const revokeGrantGroups = new Map<
-          string,
-          { columns?: string[]; privileges: Set<string> }
-        >();
-        for (const r of result.revokeGrantOption) {
-          // For revoke grant option, we need to find the columns from the effective defaults
-          const originalPriv = effectiveDefaults.find(
-            (p) => p.grantee === grantee && p.privilege === r,
-          );
-          const key = originalPriv?.columns
-            ? originalPriv.columns.sort().join(",")
-            : "";
-          if (!revokeGrantGroups.has(key)) {
-            revokeGrantGroups.set(key, {
-              columns: originalPriv?.columns
-                ? [...originalPriv.columns]
-                : undefined,
-              privileges: new Set(),
-            });
-          }
-          const group = revokeGrantGroups.get(key);
-          if (!group) continue;
-          group.privileges.add(r);
-        }
-        for (const [, group] of revokeGrantGroups) {
-          const privilegeNames = Array.from(group.privileges);
-          changes.push(
-            new RevokeGrantOptionViewPrivileges({
-              view: v,
-              grantee,
-              privilegeNames,
-              columns: group.columns,
-              version: ctx.version,
-            }),
-          );
-        }
-      }
-    }
+    changes.push(
+      ...(emitColumnPrivilegeChanges(
+        privilegeResults,
+        v,
+        v,
+        "view",
+        {
+          Grant: GrantViewPrivileges,
+          Revoke: RevokeViewPrivileges,
+          RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+        },
+        effectiveDefaults,
+        ctx.version,
+      ) as ViewChange[]),
+    );
   }
 
   for (const viewId of dropped) {
@@ -265,99 +191,23 @@ export function diffViews(
         mainView.privileges,
         branchView.privileges,
         branchView.owner,
-        ctx.mainRoles,
       );
 
-      for (const [grantee, result] of privilegeResults) {
-        // Generate grant changes
-        if (result.grants.length > 0) {
-          const grantGroups = groupPrivilegesByColumns(result.grants);
-          for (const [, group] of grantGroups) {
-            for (const [grantable, privSet] of group.byGrant) {
-              const privileges = Array.from(privSet).map((priv) => ({
-                privilege: priv,
-                grantable,
-              }));
-              changes.push(
-                new GrantViewPrivileges({
-                  view: branchView,
-                  grantee,
-                  privileges,
-                  columns: group.columns,
-                  version: ctx.version,
-                }),
-              );
-            }
-          }
-        }
-
-        // Generate revoke changes
-        if (result.revokes.length > 0) {
-          const revokeGroups = groupPrivilegesByColumns(result.revokes);
-          for (const [, group] of revokeGroups) {
-            // Collapse all grantable groups into a single revoke (grantable: false)
-            const allPrivileges = new Set<string>();
-            for (const [, privSet] of group.byGrant) {
-              for (const priv of privSet) {
-                allPrivileges.add(priv);
-              }
-            }
-            const privileges = Array.from(allPrivileges).map((priv) => ({
-              privilege: priv,
-              grantable: false,
-            }));
-            changes.push(
-              new RevokeViewPrivileges({
-                view: mainView,
-                grantee,
-                privileges,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-
-        // Generate revoke grant option changes
-        if (result.revokeGrantOption.length > 0) {
-          const revokeGrantGroups = new Map<
-            string,
-            { columns?: string[]; privileges: Set<string> }
-          >();
-          for (const r of result.revokeGrantOption) {
-            // For revoke grant option, we need to find the columns from the original privilege
-            const originalPriv = mainView.privileges.find(
-              (p) => p.grantee === grantee && p.privilege === r,
-            );
-            const key = originalPriv?.columns
-              ? originalPriv.columns.sort().join(",")
-              : "";
-            if (!revokeGrantGroups.has(key)) {
-              revokeGrantGroups.set(key, {
-                columns: originalPriv?.columns
-                  ? [...originalPriv.columns]
-                  : undefined,
-                privileges: new Set(),
-              });
-            }
-            const group = revokeGrantGroups.get(key);
-            if (!group) continue;
-            group.privileges.add(r);
-          }
-          for (const [, group] of revokeGrantGroups) {
-            const privilegeNames = Array.from(group.privileges);
-            changes.push(
-              new RevokeGrantOptionViewPrivileges({
-                view: mainView,
-                grantee,
-                privilegeNames,
-                columns: group.columns,
-                version: ctx.version,
-              }),
-            );
-          }
-        }
-      }
+      changes.push(
+        ...(emitColumnPrivilegeChanges(
+          privilegeResults,
+          branchView,
+          mainView,
+          "view",
+          {
+            Grant: GrantViewPrivileges,
+            Revoke: RevokeViewPrivileges,
+            RevokeGrantOption: RevokeGrantOptionViewPrivileges,
+          },
+          mainView.privileges,
+          ctx.version,
+        ) as ViewChange[]),
+      );
     }
   }