pg-introspection 0.0.1-alpha.4 → 0.0.1-beta.10

package/CHANGELOG.md

@@ -1,11 +1,109 @@
 # pg-introspection
 
+## 0.0.1-beta.10
+
+### Patch Changes
+
+- [#2256](https://github.com/graphile/crystal/pull/2256)
+  [`dc5746594`](https://github.com/graphile/crystal/commit/dc5746594d7870a13296f405f4327f89d17dac1e)
+  Thanks [@benjie](https://github.com/benjie)! - Add support for introspecting
+  RLS policies.
+
+## 0.0.1-beta.9
+
+### Patch Changes
+
+- [#2202](https://github.com/graphile/crystal/pull/2202)
+  [`2efadc0f8`](https://github.com/graphile/crystal/commit/2efadc0f80c3a0c172fb94c770afecc5447e832b)
+  Thanks [@benjie](https://github.com/benjie)! - Postgres v17 support
+
+## 0.0.1-beta.8
+
+### Patch Changes
+
+- [#1962](https://github.com/graphile/crystal/pull/1962)
+  [`7606a5b87`](https://github.com/graphile/crystal/commit/7606a5b87aed747fad4eb11744ef7b01cfa3b879)
+  Thanks [@DanielFGray](https://github.com/DanielFGray)! - Export PgEntity type
+  in pg-introspection
+
+## 0.0.1-beta.7
+
+### Patch Changes
+
+- [#1943](https://github.com/graphile/crystal/pull/1943)
+  [`46d8289b4`](https://github.com/graphile/crystal/commit/46d8289b44ab10aea1ff3d2915184650d6896b81)
+  Thanks [@benjie](https://github.com/benjie)! - `pg-introspection` now exports
+  `reservedWords` which are a list of reserved keywords in PostgreSQL (in
+  uppercase; though SQL is case insensitive).
+
+## 0.0.1-beta.6
+
+### Patch Changes
+
+- [#1927](https://github.com/graphile/crystal/pull/1927)
+  [`00d32d887`](https://github.com/graphile/crystal/commit/00d32d887a6ae01374a4fda1babab7c8f14832c0)
+  Thanks [@benjie](https://github.com/benjie)! - Excludes table constraints on
+  tables from extensions if configured to not include extensions.
+
+- [#1927](https://github.com/graphile/crystal/pull/1927)
+  [`c62eee10b`](https://github.com/graphile/crystal/commit/c62eee10b445f9455bf2a0524ad2b828bdf4ffa6)
+  Thanks [@benjie](https://github.com/benjie)! - Add pg_am to pg-introspection
+  to enable determining index access method
+
+## 0.0.1-beta.5
+
+### Patch Changes
+
+- [#1894](https://github.com/graphile/crystal/pull/1894)
+  [`7851d89ab`](https://github.com/graphile/crystal/commit/7851d89ab4216b0252583f0068a69900fa2ddc88)
+  Thanks [@benjie](https://github.com/benjie)! - Fix logic around RBAC
+  permissions for tables and sequences.
+
+- [#1893](https://github.com/graphile/crystal/pull/1893)
+  [`470ee4000`](https://github.com/graphile/crystal/commit/470ee40008689de7cf6f206a9897abbe4891ff9b)
+  Thanks [@benjie](https://github.com/benjie)! - Import latest PG16 docs into
+  pg-introspection
+
+## 0.0.1-beta.4
+
+### Patch Changes
+
+- [#1801](https://github.com/graphile/crystal/pull/1801)
+  [`2d447a6b4`](https://github.com/graphile/crystal/commit/2d447a6b45d7db2813bd957f412cd959e2185759)
+  Thanks [@benjie](https://github.com/benjie)! - Fix bug where the owner of a
+  database object wasn't seen as having any privileges.
+
+## 0.0.1-beta.3
+
+### Patch Changes
+
+- [#514](https://github.com/graphile/crystal-pre-merge/pull/514)
+  [`c9848f693`](https://github.com/graphile/crystal-pre-merge/commit/c9848f6936a5abd7740c0638bfb458fb5551f03b)
+  Thanks [@benjie](https://github.com/benjie)! - Update package.json repository
+  information
+
+## 0.0.1-beta.2
+
+### Patch Changes
+
+- [#496](https://github.com/benjie/crystal/pull/496)
+  [`c9bfd9892`](https://github.com/benjie/crystal/commit/c9bfd989247f9433fb5b18c5175c9d8d64cd21a1)
+  Thanks [@benjie](https://github.com/benjie)! - Update dependencies (sometimes
+  through major versions).
+
+## 0.0.1-beta.1
+
+### Patch Changes
+
+- [`cbd987385`](https://github.com/benjie/crystal/commit/cbd987385f99bd1248bc093ac507cc2f641ba3e8)
+  Thanks [@benjie](https://github.com/benjie)! - Bump all packages to beta
+
 ## 0.0.1-alpha.4
 
 ### Patch Changes
 
-- [#408](https://github.com/benjie/postgraphile-private/pull/408)
-  [`bc14d488d`](https://github.com/benjie/postgraphile-private/commit/bc14d488d5385f350b6d377716e43c46a405dc57)
+- [#408](https://github.com/benjie/crystal/pull/408)
+  [`bc14d488d`](https://github.com/benjie/crystal/commit/bc14d488d5385f350b6d377716e43c46a405dc57)
   Thanks [@benjie](https://github.com/benjie)! - When sorting, specify a
   concrete locale to localeCompare to ensure stable ordering across machines.
 
@@ -13,8 +111,8 @@
 
 ### Patch Changes
 
-- [#386](https://github.com/benjie/postgraphile-private/pull/386)
-  [`8230fcaeb`](https://github.com/benjie/postgraphile-private/commit/8230fcaeb0286c905fc0dad4b7af2d94bac88a44)
+- [#386](https://github.com/benjie/crystal/pull/386)
+  [`8230fcaeb`](https://github.com/benjie/crystal/commit/8230fcaeb0286c905fc0dad4b7af2d94bac88a44)
   Thanks [@benjie](https://github.com/benjie)! - If an issue occurs whilst
   retrieving attributes for a constraint, we now log an error and return an
   empty array.
@@ -23,7 +121,7 @@
 
 ### Patch Changes
 
-- [`7f857950a`](https://github.com/benjie/postgraphile-private/commit/7f857950a7e4ec763c936eb6bd1fb77824041d71)
+- [`7f857950a`](https://github.com/benjie/crystal/commit/7f857950a7e4ec763c936eb6bd1fb77824041d71)
   Thanks [@benjie](https://github.com/benjie)! - Upgrade to the latest
   TypeScript/tslib
 
@@ -31,7 +129,7 @@
 
 ### Patch Changes
 
-- [`759ad403d`](https://github.com/benjie/postgraphile-private/commit/759ad403d71363312c5225c165873ae84b8a098c)
+- [`759ad403d`](https://github.com/benjie/crystal/commit/759ad403d71363312c5225c165873ae84b8a098c)
   Thanks [@benjie](https://github.com/benjie)! - Alpha release - see
   https://postgraphile.org/news/2023-04-26-version-5-alpha
 
@@ -39,8 +137,8 @@
 
 ### Patch Changes
 
-- [#260](https://github.com/benjie/postgraphile-private/pull/260)
-  [`d5312e6b9`](https://github.com/benjie/postgraphile-private/commit/d5312e6b968fbeb46d074b82a41b4bdbc166598c)
+- [#260](https://github.com/benjie/crystal/pull/260)
+  [`d5312e6b9`](https://github.com/benjie/crystal/commit/d5312e6b968fbeb46d074b82a41b4bdbc166598c)
   Thanks [@benjie](https://github.com/benjie)! - TypeScript v5 is now required
 
 ## 0.0.1-0.3
@@ -71,6 +169,6 @@
 
 ### Patch Changes
 
-- [#125](https://github.com/benjie/postgraphile-private/pull/125)
-  [`91f2256b3`](https://github.com/benjie/postgraphile-private/commit/91f2256b3fd699bec19fc86f1ca79df057e58639)
+- [#125](https://github.com/benjie/crystal/pull/125)
+  [`91f2256b3`](https://github.com/benjie/crystal/commit/91f2256b3fd699bec19fc86f1ca79df057e58639)
   Thanks [@benjie](https://github.com/benjie)! - Initial changesets release

package/LICENSE.md

@@ -26,7 +26,8 @@ license applies to those excerpts:
 
 PostgreSQL is Copyright © 1996–2022 by the PostgreSQL Global Development Group.
 
-Postgres95 is Copyright © 1994–5 by the Regents of the University of California.
+Postgres95 is Copyright © 1994–5 by the Regents of the University of
+California.
 
 Permission to use, copy, modify, and distribute this software and its
 documentation for any purpose, without fee, and without a written agreement is

package/README.md

@@ -15,9 +15,9 @@ PostgreSQL documentation for easy reference directly in your editor.
 
 ## Crowd-funded open-source software
 
-To help us develop this software sustainably under the MIT license, we ask all
-individuals and businesses that use it to help support its ongoing maintenance
-and development via sponsorship.
+To help us develop this software sustainably, we ask all individuals and
+businesses that use it to help support its ongoing maintenance and development
+via sponsorship.
 
 ### [Click here to find out more about sponsors and sponsorship.](https://www.graphile.org/sponsor/)
 
@@ -26,11 +26,10 @@ And please give some love to our featured sponsors 🤩:
 <table><tr>
 <td align="center"><a href="https://www.the-guild.dev/"><img src="https://graphile.org/images/sponsors/theguild.png" width="90" height="90" alt="The Guild" /><br />The Guild</a> *</td>
 <td align="center"><a href="https://dovetailapp.com/"><img src="https://graphile.org/images/sponsors/dovetail.png" width="90" height="90" alt="Dovetail" /><br />Dovetail</a> *</td>
-<td align="center"><a href="https://qwick.com/"><img src="https://graphile.org/images/sponsors/qwick.png" width="90" height="90" alt="Qwick" /><br />Qwick</a> *</td>
-<td align="center"><a href="https://www.netflix.com/"><img src="https://graphile.org/images/sponsors/Netflix.png" width="90" height="90" alt="Netflix" /><br />Netflix</a> *</td>
-</tr><tr>
-<td align="center"><a href=""><img src="https://graphile.org/images/sponsors/chadf.png" width="90" height="90" alt="Chad Furman" /><br />Chad Furman</a> *</td>
 <td align="center"><a href="https://stellate.co/"><img src="https://graphile.org/images/sponsors/Stellate.png" width="90" height="90" alt="Stellate" /><br />Stellate</a> *</td>
+<td align="center"><a href="https://gosteelhead.com/"><img src="https://graphile.org/images/sponsors/steelhead.svg" width="90" height="90" alt="Steelhead" /><br />Steelhead</a> *</td>
+</tr><tr>
+<td align="center"><a href=""><img src="https://graphile.org/images/sponsors/latchbio.jpg" width="90" height="90" alt="LatchBio" /><br />LatchBio</a> *</td>
 </tr></table>
 
 <em>\* Sponsors the entire Graphile suite</em>
@@ -59,7 +58,7 @@ const pool = new Pool({
 async function main() {
   const sql = makeIntrospectionQuery();
   const { rows } = await pool.query(sql);
-  const introspection = parseIntrospectionResults(row[0].introspection);
+  const introspection = parseIntrospectionResults(rows[0].introspection);
 
   console.log(
     `The ${introspection.database.datname} DBA is ${

package/dist/acl.d.ts

@@ -1,4 +1,4 @@
-import type { Introspection, PgClass, PgRoles } from "./introspection.js";
+import type { Introspection, PgEntity, PgRoles } from "./introspection.js";
 /**
  * A fake 'pg_roles' record representing the 'public' meta-role.
  */
@@ -60,6 +60,10 @@ export interface AclObject {
     temporary?: boolean;
     /** T* */
     temporaryGrant?: boolean;
+    /** m */
+    maintain?: boolean;
+    /** m* */
+    maintainGrant?: boolean;
 }
 export type ResolvedPermissions = Omit<AclObject, "role" | "granter">;
 /**
@@ -73,7 +77,7 @@ export declare function parseAcl(aclString: string): AclObject;
  */
 export declare function serializeAcl(acl: AclObject): string;
 export declare const emptyAclObject: AclObject;
-export declare const OBJECT_ATTRIBUTE = "OBJECT_ATTRIBUTE";
+export declare const OBJECT_COLUMN = "OBJECT_COLUMN";
 export declare const OBJECT_TABLE = "OBJECT_TABLE";
 export declare const OBJECT_SEQUENCE = "OBJECT_SEQUENCE";
 export declare const OBJECT_DATABASE = "OBJECT_DATABASE";
@@ -86,7 +90,7 @@ export declare const OBJECT_FDW = "OBJECT_FDW";
 export declare const OBJECT_FOREIGN_SERVER = "OBJECT_FOREIGN_SERVER";
 export declare const OBJECT_DOMAIN = "OBJECT_DOMAIN";
 export declare const OBJECT_TYPE = "OBJECT_TYPE";
-export type AclDefaultObjectType = typeof OBJECT_ATTRIBUTE | typeof OBJECT_TABLE | typeof OBJECT_SEQUENCE | typeof OBJECT_DATABASE | typeof OBJECT_FUNCTION | typeof OBJECT_LANGUAGE | typeof OBJECT_LARGEOBJECT | typeof OBJECT_SCHEMA | typeof OBJECT_TABLESPACE | typeof OBJECT_FDW | typeof OBJECT_FOREIGN_SERVER | typeof OBJECT_DOMAIN | typeof OBJECT_TYPE;
+export type AclDefaultObjectType = typeof OBJECT_COLUMN | typeof OBJECT_TABLE | typeof OBJECT_SEQUENCE | typeof OBJECT_DATABASE | typeof OBJECT_FUNCTION | typeof OBJECT_LANGUAGE | typeof OBJECT_LARGEOBJECT | typeof OBJECT_SCHEMA | typeof OBJECT_TABLESPACE | typeof OBJECT_FDW | typeof OBJECT_FOREIGN_SERVER | typeof OBJECT_DOMAIN | typeof OBJECT_TYPE;
 /**
  * Returns a list of AclObject by parsing the given input ACL strings. If no
  * ACL strings are present then it will return the default (implied) ACL for
@@ -100,7 +104,7 @@ export type AclDefaultObjectType = typeof OBJECT_ATTRIBUTE | typeof OBJECT_TABLE
  *
  * https://github.com/postgres/postgres/blob/fb3b098fe88441f9531a5169008ea17eac01301f/src/include/utils/acl.h#L153-L167
  */
-export declare function parseAcls(introspection: Introspection, inAcls: readonly string[] | null, ownerId: string, type: AclDefaultObjectType): AclObject[];
+export declare function parseAcls(introspection: Introspection, inAcls: readonly string[] | null, ownerId: string, objtype: AclDefaultObjectType): AclObject[];
 export declare const Permission: {
     readonly select: "select";
     readonly selectGrant: "selectGrant";
@@ -126,8 +130,9 @@ export declare const Permission: {
     readonly connectGrant: "connectGrant";
     readonly temporary: "temporary";
     readonly temporaryGrant: "temporaryGrant";
+    readonly maintain: "maintain";
+    readonly maintainGrant: "maintainGrant";
 };
-export declare function aclsForTable(introspection: Introspection, table: PgClass): AclObject[];
 /**
  * Returns all the roles role has been granted (including PUBLIC),
  * respecting `NOINHERIT`
@@ -147,5 +152,8 @@ export declare function aclContainsRole(introspection: Introspection, acl: AclOb
  * Filters the ACL objects to only those that apply to `role`, then calculates
  * the `OR` of all the permissions to see what permissions the role has.
  */
-export declare function resolvePermissions(introspection: Introspection, acls: AclObject[], role: PgRoles, includeNoInherit?: boolean): ResolvedPermissions;
+export declare function resolvePermissions(introspection: Introspection, acls: AclObject[], role: PgRoles, includeNoInherit?: boolean, isOwnerAndHasNoExplicitACLs?: boolean): ResolvedPermissions;
+export declare function entityPermissions(introspection: Introspection, entity: Extract<PgEntity, {
+    getACL(): readonly AclObject[];
+}>, role: PgRoles, includeNoInherit?: boolean): ResolvedPermissions;
 //# sourceMappingURL=acl.d.ts.map

package/dist/acl.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE1E;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,OAcxB,CAAC;AA8BH;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS;IACT,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,QAAQ;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS;IACT,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS;IACT,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS;IACT,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAWtE;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAmErD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,UA0C1C;AAED,eAAO,MAAM,cAAc,WAAyB,CAAC;AAErD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AACnD,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAEzC,MAAM,MAAM,oBAAoB,GAC5B,OAAO,gBAAgB,GACvB,OAAO,YAAY,GACnB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,aAAa,GACpB,OAAO,iBAAiB,GACxB,OAAO,UAAU,GACjB,OAAO,qBAAqB,GAC5B,OAAO,aAAa,GACpB,OAAO,WAAW,CAAC;AAEvB;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EAChC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,oBAAoB,GACzB,SAAS,EAAE,CAuCb;AAID,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;CAyBb,CAAC;AAUX,wBAAgB,YAAY,CAC1B,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,OAAO,GACb,SAAS,EAAE,CAYb;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,OAAO,EAAE,EAChB,gBAAgB,UAAQ,GACvB,OAAO,EAAE,CAuBX;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,OAAO,EACb,gBAAgB,UAAQ,GACvB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,SAAS,EAAE,EACjB,IAAI,EAAE,OAAO,EACb,gBAAgB,UAAQ,GACvB,mBAAmB,CA0ErB"}
+{"version":3,"file":"acl.d.ts","sourceRoot":"","sources":["../src/acl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE3E;;GAEG;AACH,eAAO,MAAM,WAAW,EAAE,OAcxB,CAAC;AA8BH;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,qCAAqC;IACrC,OAAO,EAAE,MAAM,CAAC;IAEhB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS;IACT,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,QAAQ;IACR,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS;IACT,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,SAAS;IACT,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,QAAQ;IACR,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS;IACT,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,QAAQ;IACR,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS;IACT,YAAY,CAAC,EAAE,OAAO,CAAC;IAEvB,QAAQ;IACR,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,SAAS;IACT,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,QAAQ;IACR,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS;IACT,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,MAAM,mBAAmB,GAAG,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAWtE;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAuErD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,UA6C1C;AAED,eAAO,MAAM,cAAc,WAAyB,CAAC;AAErD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,eAAe,oBAAoB,CAAC;AACjD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,iBAAiB,sBAAsB,CAAC;AACrD,eAAO,MAAM,UAAU,eAAe,CAAC;AACvC,eAAO,MAAM,qBAAqB,0BAA0B,CAAC;AAC7D,eAAO,MAAM,aAAa,kBAAkB,CAAC;AAC7C,eAAO,MAAM,WAAW,gBAAgB,CAAC;AAGzC,MAAM,MAAM,oBAAoB,GAC5B,OAAO,aAAa,GACpB,OAAO,YAAY,GACnB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,eAAe,GACtB,OAAO,kBAAkB,GACzB,OAAO,aAAa,GACpB,OAAO,iBAAiB,GACxB,OAAO,UAAU,GACjB,OAAO,qBAAqB,GAC5B,OAAO,aAAa,GACpB,OAAO,WAAW,CAAC;AAoCvB;;;;;;;;;;;;GAYG;AACH,wBAAgB,SAAS,CACvB,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,EAChC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,oBAAoB,GAC5B,SAAS,EAAE,CA2Eb;AAID,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Bb,CAAC;AAEX;;;GAGG;AACH,wBAAgB,WAAW,CACzB,aAAa,EAAE,aAAa,EAC5B,KAAK,EAAE,OAAO,EAAE,EAChB,gBAAgB,UAAQ,GACvB,OAAO,EAAE,CAuBX;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,aAAa,EAAE,aAAa,EAC5B,GAAG,EAAE,SAAS,EACd,IAAI,EAAE,OAAO,EACb,gBAAgB,UAAQ,GACvB,OAAO,CAIT;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,aAAa,EAC5B,IAAI,EAAE,SAAS,EAAE,EACjB,IAAI,EAAE,OAAO,EACb,gBAAgB,UAAQ,EACxB,2BAA2B,UAAQ,GAClC,mBAAmB,CAmFrB;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,aAAa,EAC5B,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;IAAE,MAAM,IAAI,SAAS,SAAS,EAAE,CAAA;CAAE,CAAC,EAC7D,IAAI,EAAE,OAAO,EACb,gBAAgB,UAAQ,uBAwBzB"}

package/dist/acl.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolvePermissions = exports.aclContainsRole = exports.expandRoles = exports.aclsForTable = exports.Permission = exports.parseAcls = exports.OBJECT_TYPE = exports.OBJECT_DOMAIN = exports.OBJECT_FOREIGN_SERVER = exports.OBJECT_FDW = exports.OBJECT_TABLESPACE = exports.OBJECT_SCHEMA = exports.OBJECT_LARGEOBJECT = exports.OBJECT_LANGUAGE = exports.OBJECT_FUNCTION = exports.OBJECT_DATABASE = exports.OBJECT_SEQUENCE = exports.OBJECT_TABLE = exports.OBJECT_ATTRIBUTE = exports.emptyAclObject = exports.serializeAcl = exports.parseAcl = exports.PUBLIC_ROLE = void 0;
+exports.entityPermissions = exports.resolvePermissions = exports.aclContainsRole = exports.expandRoles = exports.Permission = exports.parseAcls = exports.OBJECT_TYPE = exports.OBJECT_DOMAIN = exports.OBJECT_FOREIGN_SERVER = exports.OBJECT_FDW = exports.OBJECT_TABLESPACE = exports.OBJECT_SCHEMA = exports.OBJECT_LARGEOBJECT = exports.OBJECT_LANGUAGE = exports.OBJECT_FUNCTION = exports.OBJECT_DATABASE = exports.OBJECT_SEQUENCE = exports.OBJECT_TABLE = exports.OBJECT_COLUMN = exports.emptyAclObject = exports.serializeAcl = exports.parseAcl = exports.PUBLIC_ROLE = void 0;
 /**
  * A fake 'pg_roles' record representing the 'public' meta-role.
  */
@@ -58,7 +58,7 @@ const parseIdentifier = (str) => str.startsWith('"') ? str.replace(/"("?)/g, "$1
  */
 function parseAcl(aclString) {
     // https://www.postgresql.org/docs/current/ddl-priv.html#PRIVILEGE-ABBREVS-TABLE
-    const matches = aclString.match(/^([^=]*)=([rwadDxtXUCcT*]*)\/([^=]+)$/);
+    const matches = aclString.match(/^([^=]*)=([rwadDxtXUCcTm*]*)\/([^=]+)$/);
     if (!matches) {
         throw new Error(`Could not parse ACL string '${aclString}'`);
     }
@@ -89,6 +89,8 @@ function parseAcl(aclString) {
     const connectGrant = permissions.includes("c*");
     const temporary = permissions.includes("T");
     const temporaryGrant = permissions.includes("T*");
+    const maintain = permissions.includes("m");
+    const maintainGrant = permissions.includes("m*");
     const acl = {
         role: role || "public",
         granter,
@@ -116,6 +118,8 @@ function parseAcl(aclString) {
         connectGrant,
         temporary,
         temporaryGrant,
+        maintain,
+        maintainGrant,
     };
     return acl;
 }
@@ -174,12 +178,16 @@ function serializeAcl(acl) {
         permissions += "T*";
     else if (acl.temporary)
         permissions += "T";
+    if (acl.maintainGrant)
+        permissions += "m*";
+    else if (acl.maintain)
+        permissions += "m";
     permissions += `/${acl.granter}`;
     return permissions;
 }
 exports.serializeAcl = serializeAcl;
 exports.emptyAclObject = parseAcl("=/postgres");
-exports.OBJECT_ATTRIBUTE = "OBJECT_ATTRIBUTE";
+exports.OBJECT_COLUMN = "OBJECT_COLUMN";
 exports.OBJECT_TABLE = "OBJECT_TABLE";
 exports.OBJECT_SEQUENCE = "OBJECT_SEQUENCE";
 exports.OBJECT_DATABASE = "OBJECT_DATABASE";
@@ -192,6 +200,37 @@ exports.OBJECT_FDW = "OBJECT_FDW";
 exports.OBJECT_FOREIGN_SERVER = "OBJECT_FOREIGN_SERVER";
 exports.OBJECT_DOMAIN = "OBJECT_DOMAIN";
 exports.OBJECT_TYPE = "OBJECT_TYPE";
+// https://github.com/postgres/postgres/blob/4908c5872059c409aa647bcde758dfeffe07996e/src/include/nodes/parsenodes.h#L76-L89
+// https://www.postgresql.org/docs/current/ddl-priv.html#PRIVILEGE-ABBREVS-TABLE
+const ACL_SELECT = "r";
+const ACL_INSERT = "a";
+const ACL_UPDATE = "w";
+const ACL_DELETE = "d";
+const ACL_TRUNCATE = "D";
+const ACL_REFERENCES = "x";
+const ACL_TRIGGER = "t";
+const ACL_CREATE = "C";
+const ACL_CONNECT = "c";
+const ACL_CREATE_TEMP = "T";
+const ACL_MAINTAIN = "m";
+const ACL_EXECUTE = "X";
+const ACL_USAGE = "U";
+// const ACL_SET = "s";
+// const ACL_ALTER_SYSTEM = "A";
+/** @see {@link https://github.com/postgres/postgres/blob/4908c5872059c409aa647bcde758dfeffe07996e/src/include/nodes/parsenodes.h#L91} */
+const ACL_NO_RIGHTS = "";
+/** @see {@link https://github.com/postgres/postgres/blob/4908c5872059c409aa647bcde758dfeffe07996e/src/include/utils/acl.h#L159} */
+const ACL_ALL_RIGHTS_RELATION = `${ACL_INSERT}${ACL_SELECT}${ACL_UPDATE}${ACL_DELETE}${ACL_TRUNCATE}${ACL_REFERENCES}${ACL_TRIGGER}${ACL_MAINTAIN}`;
+const ACL_ALL_RIGHTS_SEQUENCE = `${ACL_USAGE}${ACL_SELECT}${ACL_UPDATE}`;
+const ACL_ALL_RIGHTS_DATABASE = `${ACL_CREATE}${ACL_CREATE_TEMP}${ACL_CONNECT}`;
+const ACL_ALL_RIGHTS_FDW = ACL_USAGE;
+const ACL_ALL_RIGHTS_FOREIGN_SERVER = ACL_USAGE;
+const ACL_ALL_RIGHTS_FUNCTION = ACL_EXECUTE;
+const ACL_ALL_RIGHTS_LANGUAGE = ACL_USAGE;
+const ACL_ALL_RIGHTS_LARGEOBJECT = `${ACL_SELECT}${ACL_UPDATE}`;
+const ACL_ALL_RIGHTS_SCHEMA = `${ACL_USAGE}${ACL_CREATE}`;
+const ACL_ALL_RIGHTS_TABLESPACE = ACL_CREATE;
+const ACL_ALL_RIGHTS_TYPE = ACL_USAGE;
 /**
  * Returns a list of AclObject by parsing the given input ACL strings. If no
  * ACL strings are present then it will return the default (implied) ACL for
@@ -205,40 +244,75 @@ exports.OBJECT_TYPE = "OBJECT_TYPE";
  *
  * https://github.com/postgres/postgres/blob/fb3b098fe88441f9531a5169008ea17eac01301f/src/include/utils/acl.h#L153-L167
  */
-function parseAcls(introspection, inAcls, ownerId, type) {
+function parseAcls(introspection, inAcls, ownerId, objtype) {
     const aclStrings = inAcls ||
         (() => {
             const owner = getRole(introspection, ownerId);
-            switch (type) {
+            let worldDefault;
+            let ownerDefault;
+            switch (objtype) {
+                case exports.OBJECT_COLUMN:
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_NO_RIGHTS;
+                    break;
                 case exports.OBJECT_TABLE:
-                    return [`${owner.rolname}=arwdDxt/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_RELATION;
+                    break;
                 case exports.OBJECT_SEQUENCE:
-                    return [`${owner.rolname}=Urw/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_SEQUENCE;
+                    break;
                 case exports.OBJECT_DATABASE:
-                    return [
-                        `=Tc/${owner.rolname}`,
-                        `${owner.rolname}=CTc/${owner.rolname}`,
-                    ];
+                    worldDefault = `${ACL_CREATE_TEMP}${ACL_CONNECT}`;
+                    ownerDefault = ACL_ALL_RIGHTS_DATABASE;
+                    break;
                 case exports.OBJECT_FUNCTION:
-                    return [`=X/${owner.rolname}`, `${owner.rolname}=X/${owner.rolname}`];
+                    worldDefault = ACL_EXECUTE;
+                    ownerDefault = ACL_ALL_RIGHTS_FUNCTION;
+                    break;
                 case exports.OBJECT_LANGUAGE:
-                    return [`=U/${owner.rolname}`, `${owner.rolname}=U/${owner.rolname}`];
+                    worldDefault = ACL_USAGE;
+                    ownerDefault = ACL_ALL_RIGHTS_LANGUAGE;
+                    break;
                 case exports.OBJECT_LARGEOBJECT:
-                    return [`${owner.rolname}=rw/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_LARGEOBJECT;
+                    break;
                 case exports.OBJECT_SCHEMA:
-                    return [`${owner.rolname}=UC/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_SCHEMA;
+                    break;
                 case exports.OBJECT_TABLESPACE:
-                    return [`${owner.rolname}=C/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_TABLESPACE;
+                    break;
                 case exports.OBJECT_FDW:
-                    return [`${owner.rolname}=U/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_FDW;
+                    break;
                 case exports.OBJECT_FOREIGN_SERVER:
-                    return [`${owner.rolname}=U/${owner.rolname}`];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_ALL_RIGHTS_FOREIGN_SERVER;
+                    break;
                 case exports.OBJECT_DOMAIN:
                 case exports.OBJECT_TYPE:
-                    return [`=U/${owner.rolname}`, `${owner.rolname}=U/${owner.rolname}`];
+                    worldDefault = ACL_USAGE;
+                    ownerDefault = ACL_ALL_RIGHTS_TYPE;
+                    break;
                 default:
-                    return [];
+                    worldDefault = ACL_NO_RIGHTS;
+                    ownerDefault = ACL_NO_RIGHTS;
+                    break;
             }
+            const acl = [];
+            if (worldDefault !== ACL_NO_RIGHTS) {
+                acl.push(`=${worldDefault}/${owner.rolname}`);
+            }
+            if (ownerDefault !== ACL_NO_RIGHTS) {
+                acl.push(`${owner.rolname}=${ownerDefault}/${owner.rolname}`);
+            }
+            return acl;
         })();
     const acls = aclStrings.map((aclString) => parseAcl(aclString));
     return acls;
@@ -271,25 +345,9 @@ exports.Permission = {
     connectGrant: "connectGrant",
     temporary: "temporary",
     temporaryGrant: "temporaryGrant",
+    maintain: "maintain",
+    maintainGrant: "maintainGrant",
 };
-/*
- * For default permissions, see:
- * https://github.com/postgres/postgres/blob/14aec03502302eff6c67981d8fd121175c436ce9/src/backend/utils/adt/acl.c#L748-L854
- *
- * For what the privileges mean, see:
- * https://www.postgresql.org/docs/current/ddl-priv.html#PRIVILEGE-ABBREVS-TABLE
- */
-function aclsForTable(introspection, table) {
-    const dbOwner = getRole(introspection, introspection.database.datdba);
-    const isSequence = table.relkind === "S";
-    const tableOwner = getRole(introspection, table.relowner);
-    const defaultAcl = isSequence
-        ? [`${tableOwner.rolname}=/${dbOwner.rolname}`]
-        : [`=/${dbOwner.rolname}`, `${dbOwner.rolname}=/${dbOwner.rolname}`];
-    const acls = (table.relacl || defaultAcl).map((aclString) => parseAcl(aclString));
-    return acls;
-}
-exports.aclsForTable = aclsForTable;
 /**
  * Returns all the roles role has been granted (including PUBLIC),
  * respecting `NOINHERIT`
@@ -334,37 +392,42 @@ exports.aclContainsRole = aclContainsRole;
  * Filters the ACL objects to only those that apply to `role`, then calculates
  * the `OR` of all the permissions to see what permissions the role has.
  */
-function resolvePermissions(introspection, acls, role, includeNoInherit = false) {
+function resolvePermissions(introspection, acls, role, includeNoInherit = false, isOwnerAndHasNoExplicitACLs = false) {
     const expandedRoles = expandRoles(introspection, [role], includeNoInherit);
     const isSuperuser = expandedRoles.some((role) => role.rolsuper);
-    // Just as in life, you start with nothing...
+    // Superusers have all permissions. An owner of an object has all permissions
+    // _unless_ there's a specific ACL for that owner. In all other cases, just as
+    // in life, you start with nothing...
+    const grantAll = isSuperuser || isOwnerAndHasNoExplicitACLs;
     const permissions = {
-        select: isSuperuser,
-        selectGrant: isSuperuser,
-        update: isSuperuser,
-        updateGrant: isSuperuser,
-        insert: isSuperuser,
-        insertGrant: isSuperuser,
-        delete: isSuperuser,
-        deleteGrant: isSuperuser,
-        truncate: isSuperuser,
-        truncateGrant: isSuperuser,
-        references: isSuperuser,
-        referencesGrant: isSuperuser,
-        trigger: isSuperuser,
-        triggerGrant: isSuperuser,
-        execute: isSuperuser,
-        executeGrant: isSuperuser,
-        usage: isSuperuser,
-        usageGrant: isSuperuser,
-        create: isSuperuser,
-        createGrant: isSuperuser,
-        connect: isSuperuser,
-        connectGrant: isSuperuser,
-        temporary: isSuperuser,
-        temporaryGrant: isSuperuser,
+        select: grantAll,
+        selectGrant: grantAll,
+        update: grantAll,
+        updateGrant: grantAll,
+        insert: grantAll,
+        insertGrant: grantAll,
+        delete: grantAll,
+        deleteGrant: grantAll,
+        truncate: grantAll,
+        truncateGrant: grantAll,
+        references: grantAll,
+        referencesGrant: grantAll,
+        trigger: grantAll,
+        triggerGrant: grantAll,
+        execute: grantAll,
+        executeGrant: grantAll,
+        usage: grantAll,
+        usageGrant: grantAll,
+        create: grantAll,
+        createGrant: grantAll,
+        connect: grantAll,
+        connectGrant: grantAll,
+        temporary: grantAll,
+        temporaryGrant: grantAll,
+        maintain: grantAll,
+        maintainGrant: grantAll,
     };
-    if (isSuperuser) {
+    if (grantAll) {
         return permissions;
     }
     for (const acl of acls) {
@@ -397,9 +460,29 @@ function resolvePermissions(introspection, acls, role, includeNoInherit = false)
             permissions.temporary = permissions.temporary || acl.temporary;
             permissions.temporaryGrant =
                 permissions.temporaryGrant || acl.temporaryGrant;
+            permissions.maintain = permissions.maintain || acl.maintain;
+            permissions.maintainGrant =
+                permissions.maintainGrant || acl.maintainGrant;
         }
     }
     return permissions;
 }
 exports.resolvePermissions = resolvePermissions;
+function entityPermissions(introspection, entity, role, includeNoInherit = false) {
+    const acls = entity.getACL();
+    const owner = entity._type === "PgAttribute"
+        ? entity.getClass()?.getOwner()
+        : entity.getOwner();
+    // If the role is the owner, and no explicit ACLs have been granted to this role, then the owner has all privileges.
+    const isOwnerAndHasNoExplicitACLs = owner &&
+        owner === role &&
+        !acls.some((acl) => acl.role === owner.rolname) &&
+        (entity._type !== "PgAttribute" ||
+            !entity
+                .getClass()
+                ?.getACL()
+                .some((acl) => acl.role === owner.rolname));
+    return resolvePermissions(introspection, acls, role, includeNoInherit, isOwnerAndHasNoExplicitACLs);
+}
+exports.entityPermissions = entityPermissions;
 //# sourceMappingURL=acl.js.map