cloudflare-next-intl 0.8.4 → 0.8.6

package/supabase/cfni_exec.sql

@@ -1,34 +1,149 @@
 -- Executes a statement generated by cloudflare-next-intl's `db` module and
--- returns its rows as positional JSON arrays, which is the shape
--- drizzle-orm/pg-proxy maps result columns from.
+-- returns its rows/rowCount as jsonb, in the shape drizzle-orm/pg-proxy expects.
+--
+-- v2: statements arrive with parameters already inlined as literals by the
+-- `db` transport (see `inline_params.ts`), so this function takes no
+-- parameters and never binds anything itself. It also now supports
+-- INSERT/UPDATE/DELETE, with or without RETURNING.
+--
+-- Each output row is cast with `r::text`, Postgres' own composite-literal
+-- text format: `(field1,field2,...)`, fields comma-separated, quoted with
+-- `"…"` (doubling embedded quotes) whenever a field's own text contains a
+-- comma/quote/paren/backslash/whitespace, and empty-unquoted for NULL. Every
+-- field is already in that column's normal `::text` form — arrays as
+-- `{1,2}`, booleans as `t`/`f`, timestamps without a `T`, full `numeric`
+-- precision — the same representation the `pg` wire protocol sends in text
+-- mode, and what Drizzle's column mappers decode. Unlike `row_to_json`/
+-- `hstore(record)`, this stays correct with duplicate column names (a common
+-- shape after a join with `select a.*, b.*`), since it is purely positional
+-- and never keys fields by name. The transport (`supabase_transport.ts`)
+-- parses this literal back into a positional array with `parse_composite.ts`.
 --
 -- SECURITY INVOKER is load-bearing: the statement runs with the privileges of
 -- the caller (anon or authenticated, per the request's JWT), so row-level
 -- security still applies exactly as it does over the REST API. Do not change
 -- this to SECURITY DEFINER, and do not add a role parameter — either would
 -- turn this into a privilege-escalation primitive.
-create or replace function public.cfni_exec(statement text, params jsonb default '[]'::jsonb)
-returns json
+--
+-- The drop below is only needed when upgrading from the old `json`-returning
+-- v1 of this function — `create or replace` cannot change a function's
+-- return type, and is a no-op (safe to re-run) when this is a fresh install.
+drop function if exists public.cfni_exec(text);
+
+create or replace function public.cfni_exec(statement text)
+returns jsonb
 language plpgsql
 security invoker
 as $$
 declare
-    result json;
-    args text[];
+    top_level_verb text;
+    has_returning boolean;
+    has_inner_writable_cte boolean;
+    rows_json jsonb := '[]'::jsonb;
+    row_count bigint := 0;
+    row_value record;
+    row_texts text[] := '{}';
+begin
+    top_level_verb := public.cfni_top_level_verb(statement);
+    has_returning := statement ~* '\yreturning\y';
+
+    if top_level_verb in ('insert', 'update', 'delete') and not has_returning then
+        execute statement;
+        get diagnostics row_count = row_count;
+        return jsonb_build_object('rows', '[]'::jsonb, 'rowCount', row_count);
+    end if;
+
+    if top_level_verb in ('insert', 'update', 'delete') then
+        -- INSERT/UPDATE/DELETE with RETURNING cannot be wrapped as
+        -- `from (<stmt>) r` — Postgres rejects DML directly inside FROM —
+        -- so run it as a CTE instead and select its rows out of that.
+        execute format(
+            'with cfni_dml_result as (%s) select coalesce(jsonb_agg(r::text), ''[]''::jsonb), count(*) from cfni_dml_result r',
+            statement
+        ) into rows_json, row_count;
+        return jsonb_build_object('rows', rows_json, 'rowCount', row_count);
+    end if;
+
+    -- Top-level statement is a SELECT (plain, or `with ... select ...`).
+    has_inner_writable_cte := statement ~* '\y(with|,)\s+[A-Za-z_][A-Za-z0-9_]*\s+as\s*\(\s*(insert|update|delete)\y';
+    if has_inner_writable_cte then
+        -- Postgres forbids nesting a WITH that contains a data-modifying
+        -- statement inside another query (`from (with u as (update ...
+        -- returning ...) select ... from u) r` is rejected even though the
+        -- statement is legal standalone) — so this shape must run exactly
+        -- as given, not wrapped in a further subquery. Row values are
+        -- collected by iterating the statement's own result set instead,
+        -- casting each row to its composite-literal text form directly.
+        for row_value in execute statement loop
+            row_texts := row_texts || (row_value::text);
+            row_count := row_count + 1;
+        end loop;
+        return jsonb_build_object('rows', to_jsonb(row_texts), 'rowCount', row_count);
+    end if;
+
+    -- Plain SELECT with no inner writable CTE: wrap as a subquery and emit
+    -- each row's composite-literal text form; the transport parses it back
+    -- into a positional array of column values.
+    execute format(
+        'select coalesce(jsonb_agg(r::text), ''[]''::jsonb), count(*) from (%s) r',
+        statement
+    ) into rows_json, row_count;
+
+    return jsonb_build_object('rows', rows_json, 'rowCount', row_count);
+end;
+$$;
+
+-- Finds the leading keyword of a statement's *outermost* clause, skipping
+-- past any leading CTE chain (`with x as (...), y as (...) <verb> ...`) by
+-- tracking paren depth rather than a single non-greedy regex match, which
+-- breaks on multiple CTEs or parens nested inside a CTE body. Returns one of
+-- 'select', 'insert', 'update', 'delete', or 'other' (lowercased).
+create or replace function public.cfni_top_level_verb(statement text)
+returns text
+language plpgsql
+immutable
+as $$
+declare
+    stripped text;
+    depth int := 0;
+    i int := 1;
+    len int;
+    ch text;
 begin
-    select coalesce(array_agg(value #>> '{}' order by ordinality), '{}')
-      into args
-      from jsonb_array_elements(params) with ordinality as t(value, ordinality);
+    stripped := regexp_replace(statement, '^(\s*--[^\n]*\n|\s*/\*.*?\*/)*\s*', '', 'sn');
 
-    execute format('select coalesce(json_agg(json_build_array(r.*)), ''[]''::json) from (%s) r', statement)
-       into result
-      using args;
+    if stripped !~* '^with\y' then
+        return lower((regexp_match(stripped, '^([A-Za-z]+)'))[1]);
+    end if;
 
-    return result;
+    len := length(stripped);
+    while i <= len loop
+        ch := substr(stripped, i, 1);
+        if ch = '(' then
+            depth := depth + 1;
+        elsif ch = ')' then
+            depth := depth - 1;
+        elsif depth = 0 and ch = ',' then
+            -- Between CTE definitions at depth 0; keep scanning for the
+            -- statement that follows the whole `with ... ,` chain.
+            null;
+        elsif depth = 0 and substr(stripped, i) ~* '^(select|insert|update|delete)\y' then
+            return lower((regexp_match(substr(stripped, i), '^([A-Za-z]+)'))[1]);
+        end if;
+        i := i + 1;
+    end loop;
+
+    return 'other';
 end;
 $$;
 
-revoke all on function public.cfni_exec(text, jsonb) from public;
-grant execute on function public.cfni_exec(text, jsonb) to authenticated;
+revoke all on function public.cfni_exec(text) from public;
+grant execute on function public.cfni_exec(text) to authenticated;
 -- Grant to anon only if your app calls withPublicDb:
-grant execute on function public.cfni_exec(text, jsonb) to anon;
+grant execute on function public.cfni_exec(text) to anon;
+grant execute on function public.cfni_exec(text) to service_role;
+
+revoke all on function public.cfni_top_level_verb(text) from public;
+grant execute on function public.cfni_top_level_verb(text) to authenticated;
+grant execute on function public.cfni_top_level_verb(text) to anon;
+grant execute on function public.cfni_top_level_verb(text) to service_role;

package/supabase/tests/cfni_exec.sql

@@ -0,0 +1,150 @@
+-- pgTAP tests for cfni_exec.sql. Run with `supabase test db` (or
+-- `pg_prove`) from a project that has installed both this file and
+-- `cfni_exec.sql`. Mirrors the scenarios in
+-- `src/db/cfni_exec.integration.test.ts` on the TypeScript side — this file
+-- checks the SQL function itself and its RLS interaction directly in
+-- Postgres, without going through the transport/JS parsing layer.
+begin;
+select plan(20);
+
+do $$
+begin
+    if not exists (select 1 from pg_roles where rolname = 'anon') then
+        create role anon;
+    end if;
+    if not exists (select 1 from pg_roles where rolname = 'authenticated') then
+        create role authenticated;
+    end if;
+end
+$$;
+
+create table cfni_test_a (id int primary key, name text);
+create table cfni_test_b (id int primary key, name text);
+insert into cfni_test_a values (1, 'a1');
+insert into cfni_test_b values (2, 'b2');
+
+select is(pg_typeof(cfni_exec('select 1'))::text, 'jsonb', 'cfni_exec returns jsonb');
+
+select is(
+    cfni_exec('select id, name from cfni_test_a where id = 1'),
+    '{"rows": ["(1,a1)"], "rowCount": 1}'::jsonb,
+    'plain select returns rows and rowCount'
+);
+
+select is(
+    cfni_exec('select a.*, b.* from cfni_test_a a, cfni_test_b b'),
+    '{"rows": ["(1,a1,2,b2)"], "rowCount": 1}'::jsonb,
+    'duplicate column names from a join are preserved positionally'
+);
+
+select is(
+    cfni_exec('select array[1,2,3] as arr, true as b, 1.10::numeric as n, null as z'),
+    '{"rows": ["(\"{1,2,3}\",t,1.10,)"], "rowCount": 1}'::jsonb,
+    'array/boolean/numeric/null values use pg text form, not JSON re-encoding'
+);
+
+select is(
+    cfni_exec('insert into cfni_test_a (id, name) values (10, ''x'')'),
+    '{"rows": [], "rowCount": 1}'::jsonb,
+    'insert without returning reports rowCount with no rows'
+);
+
+select is(
+    cfni_exec('insert into cfni_test_a (id, name) values (11, ''y'') returning id, name'),
+    '{"rows": ["(11,y)"], "rowCount": 1}'::jsonb,
+    'insert with returning reports rows'
+);
+
+select is(
+    cfni_exec('update cfni_test_a set name = ''z'' where id = 1 returning id, name'),
+    '{"rows": ["(1,z)"], "rowCount": 1}'::jsonb,
+    'update with returning reports rows'
+);
+
+select is(
+    cfni_exec('update cfni_test_a set name = ''z2'' where id = 1'),
+    '{"rows": [], "rowCount": 1}'::jsonb,
+    'update without returning reports rowCount with no rows'
+);
+
+select is(
+    cfni_exec('delete from cfni_test_a where id = 10 returning id'),
+    '{"rows": ["(10)"], "rowCount": 1}'::jsonb,
+    'delete with returning reports rows'
+);
+
+select is(
+    cfni_exec('delete from cfni_test_a where id = 11'),
+    '{"rows": [], "rowCount": 1}'::jsonb,
+    'delete without returning reports rowCount with no rows'
+);
+
+alter table cfni_test_a add constraint cfni_test_a_id_uq unique (id);
+select is(
+    cfni_exec('insert into cfni_test_a (id, name) values (1, ''dup'') on conflict (id) do update set name = excluded.name returning id, name'),
+    '{"rows": ["(1,dup)"], "rowCount": 1}'::jsonb,
+    'on conflict do update via excluded works'
+);
+
+select is(
+    cfni_exec('with x as (select 1 as v) select v from x'),
+    '{"rows": ["(1)"], "rowCount": 1}'::jsonb,
+    'plain with-select CTE works'
+);
+
+select is(
+    cfni_exec('with src as (select 20 as id, ''q'' as name) insert into cfni_test_a (id, name) select id, name from src returning id, name'),
+    '{"rows": ["(20,q)"], "rowCount": 1}'::jsonb,
+    'writable CTE (insert ... select ... returning) at the top level works'
+);
+
+select is(
+    cfni_exec('with u as (update cfni_test_a set name = ''zz'' where id = 1 returning id) select id from u'),
+    '{"rows": ["(1)"], "rowCount": 1}'::jsonb,
+    'writable CTE wrapped in an outer select works'
+);
+
+select is(
+    cfni_exec('select ''the returning hero'' as s'),
+    '{"rows": ["(\"the returning hero\")"], "rowCount": 1}'::jsonb,
+    'a select whose literal text contains the word "returning" is not misclassified as DML'
+);
+
+select is(
+    cfni_exec('select 1 where false'),
+    '{"rows": [], "rowCount": 0}'::jsonb,
+    'no matching rows returns an empty result set'
+);
+
+select is(pg_proc.prosecdef, false, 'cfni_exec is security invoker, not security definer')
+from pg_proc where proname = 'cfni_exec';
+
+-- Re-running the install file must not error (create-or-replace + a
+-- return-type-changing drop guard) — exercised by re-declaring the function
+-- with an identical body here, standing in for `\i cfni_exec.sql` a second
+-- time, since re-sourcing the actual file mid-transaction isn't expressible
+-- from within a single pgTAP script.
+select isnt(cfni_exec('select 1'), null, 'cfni_exec remains callable after a hypothetical reinstall');
+
+alter table cfni_test_a enable row level security;
+create policy cfni_test_a_select on cfni_test_a for select to authenticated using (true);
+grant select on cfni_test_a to anon, authenticated;
+
+set role anon;
+select is(
+    cfni_exec('select * from cfni_test_a'),
+    '{"rows": [], "rowCount": 0}'::jsonb,
+    'anon sees no rows with no matching RLS policy'
+);
+reset role;
+
+set role authenticated;
+select is(
+    (cfni_exec('select * from cfni_test_a') ->> 'rowCount')::int,
+    (select count(*)::int from cfni_test_a),
+    'authenticated sees all rows under its permissive select policy'
+);
+reset role;
+
+select * from finish();
+rollback;