postgresai 0.14.0-dev.85 → 0.14.0-dev.87

package/test/init.test.ts

@@ -281,7 +281,7 @@ describe("init module", () => {
           return { rowCount: 1, rows: [] };
         }
         if (String(sql).includes("select rolconfig")) {
-          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, "$user", public, pg_catalog'] }] };
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, extensions, "$user", public, pg_catalog'] }] };
         }
         if (String(sql).includes("from pg_catalog.pg_roles")) {
           return { rowCount: 1, rows: [] };
@@ -307,6 +307,10 @@ describe("init module", () => {
         if (String(sql).includes("has_schema_privilege")) {
           return { rowCount: 1, rows: [{ ok: true }] };
         }
+        // Query for pg_stat_statements extension schema location
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "pg_catalog" }] };
+        }
 
         throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
       },
@@ -363,6 +367,10 @@ describe("init module", () => {
         if (String(sql).includes("has_schema_privilege")) {
           return { rowCount: 1, rows: [{ ok: true }] };
         }
+        // Query for pg_stat_statements extension schema location (Supabase uses 'extensions' schema)
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "extensions" }] };
+        }
 
         throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
       },
@@ -382,6 +390,335 @@ describe("init module", () => {
     expect(calls.some((c) => c.includes("select rolconfig"))).toBe(false);
   });
 
+  test("verifyInitSetup checks extensions schema when pg_stat_statements is there", async () => {
+    const calls: string[] = [];
+    const client = {
+      query: async (sql: string, params?: any) => {
+        calls.push(String(sql));
+
+        if (String(sql).toLowerCase().startsWith("begin isolation level repeatable read")) {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).toLowerCase() === "rollback;") {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).includes("select rolconfig")) {
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, extensions, "$user", public, pg_catalog'] }] };
+        }
+        if (String(sql).includes("from pg_catalog.pg_roles")) {
+          return { rowCount: 1, rows: [{ rolname: DEFAULT_MONITORING_USER }] };
+        }
+        if (String(sql).includes("has_database_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("pg_has_role")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_table_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("to_regclass")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_function_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        // pg_stat_statements is in 'extensions' schema
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "extensions" }] };
+        }
+        // Check for USAGE on extensions schema
+        if (String(sql).includes("has_schema_privilege") && params?.[1] === "extensions") {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_schema_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+
+        throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
+      },
+    };
+
+    const r = await init.verifyInitSetup({
+      client: client as any,
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      includeOptionalPermissions: false,
+    });
+    expect(r.ok).toBe(true);
+    expect(r.missingRequired.length).toBe(0);
+    // Should have queried for pg_stat_statements schema location
+    expect(calls.some((c) => c.includes("pg_extension e") && c.includes("pg_stat_statements"))).toBe(true);
+  });
+
+  test("verifyInitSetup reports missing extensions schema access", async () => {
+    const client = {
+      query: async (sql: string, params?: any) => {
+        if (String(sql).toLowerCase().startsWith("begin isolation level repeatable read")) {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).toLowerCase() === "rollback;") {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).includes("select rolconfig")) {
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, "$user", public, pg_catalog'] }] };
+        }
+        if (String(sql).includes("from pg_catalog.pg_roles")) {
+          return { rowCount: 1, rows: [{ rolname: DEFAULT_MONITORING_USER }] };
+        }
+        if (String(sql).includes("has_database_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("pg_has_role")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_table_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("to_regclass")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_function_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        // pg_stat_statements is in 'extensions' schema
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "extensions" }] };
+        }
+        // No USAGE on extensions schema
+        if (String(sql).includes("has_schema_privilege") && params?.[1] === "extensions") {
+          return { rowCount: 1, rows: [{ ok: false }] };
+        }
+        if (String(sql).includes("has_schema_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+
+        throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
+      },
+    };
+
+    const r = await init.verifyInitSetup({
+      client: client as any,
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      includeOptionalPermissions: false,
+    });
+    expect(r.ok).toBe(false);
+    // Should report missing USAGE on extensions schema
+    expect(r.missingRequired.some((m) => m.includes("extensions") && m.includes("pg_stat_statements"))).toBe(true);
+    // Should also report missing extensions in search_path
+    expect(r.missingRequired.some((m) => m.includes("search_path") && m.includes("extensions"))).toBe(true);
+  });
+
+  test("buildInitPlan includes dynamic search_path with extension schema detection", async () => {
+    const plan = await init.buildInitPlan({
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      monitoringPassword: "pw",
+      includeOptionalPermissions: false,
+    });
+
+    const permStep = plan.steps.find((s) => s.name === "03.permissions");
+    expect(permStep).toBeTruthy();
+    // Should use dynamic DO block to set search_path based on detected extension schema
+    expect(permStep!.sql).toMatch(/alter\s+user.*set\s+search_path\s*=/i);
+    // Should detect pg_stat_statements extension schema dynamically
+    expect(permStep!.sql).toMatch(/quote_ident\(ext_schema\)/i);
+  });
+
+  test("buildInitPlan includes dynamic extension schema grant", async () => {
+    const plan = await init.buildInitPlan({
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      monitoringPassword: "pw",
+      includeOptionalPermissions: false,
+    });
+
+    const permStep = plan.steps.find((s) => s.name === "03.permissions");
+    expect(permStep).toBeTruthy();
+    // Should include DO block that grants USAGE on extension schema
+    expect(permStep!.sql).toMatch(/do\s+\$\$/i);
+    expect(permStep!.sql).toMatch(/pg_stat_statements/);
+    expect(permStep!.sql).toMatch(/grant usage on schema/i);
+  });
+
+  test("verifyInitSetup handles pg_stat_statements not installed", async () => {
+    const calls: string[] = [];
+    const client = {
+      query: async (sql: string, params?: any) => {
+        calls.push(String(sql));
+
+        if (String(sql).toLowerCase().startsWith("begin isolation level repeatable read")) {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).toLowerCase() === "rollback;") {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).includes("select rolconfig")) {
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, extensions, "$user", public, pg_catalog'] }] };
+        }
+        if (String(sql).includes("from pg_catalog.pg_roles")) {
+          return { rowCount: 1, rows: [{ rolname: DEFAULT_MONITORING_USER }] };
+        }
+        if (String(sql).includes("has_database_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("pg_has_role")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_table_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("to_regclass")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_function_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        // pg_stat_statements is NOT installed - empty result
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 0, rows: [] };
+        }
+        if (String(sql).includes("has_schema_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+
+        throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
+      },
+    };
+
+    const r = await init.verifyInitSetup({
+      client: client as any,
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      includeOptionalPermissions: false,
+    });
+    // Should pass without errors - missing extension shouldn't cause failure
+    expect(r.ok).toBe(true);
+    expect(r.missingRequired.length).toBe(0);
+    // Should have queried for pg_stat_statements schema location
+    expect(calls.some((c) => c.includes("pg_extension e") && c.includes("pg_stat_statements"))).toBe(true);
+  });
+
+  test("verifyInitSetup skips extension schema check when in pg_catalog", async () => {
+    const calls: string[] = [];
+    const client = {
+      query: async (sql: string, params?: any) => {
+        calls.push(String(sql));
+
+        if (String(sql).toLowerCase().startsWith("begin isolation level repeatable read")) {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).toLowerCase() === "rollback;") {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).includes("select rolconfig")) {
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, "$user", public, pg_catalog'] }] };
+        }
+        if (String(sql).includes("from pg_catalog.pg_roles")) {
+          return { rowCount: 1, rows: [{ rolname: DEFAULT_MONITORING_USER }] };
+        }
+        if (String(sql).includes("has_database_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("pg_has_role")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_table_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("to_regclass")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_function_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        // pg_stat_statements is in pg_catalog (standard location)
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "pg_catalog" }] };
+        }
+        if (String(sql).includes("has_schema_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+
+        throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
+      },
+    };
+
+    const r = await init.verifyInitSetup({
+      client: client as any,
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      includeOptionalPermissions: false,
+    });
+    // Should pass - pg_catalog doesn't need extra USAGE grant
+    expect(r.ok).toBe(true);
+    expect(r.missingRequired.length).toBe(0);
+    // Should NOT have queried for has_schema_privilege on pg_catalog specifically
+    // (the code skips the check for pg_catalog and public schemas)
+    const pgCatalogPrivCheck = calls.filter(
+      (c) => c.includes("has_schema_privilege") && c.includes("pg_catalog")
+    );
+    // Should only have the standard public schema check, not a pg_catalog check for extension
+    expect(pgCatalogPrivCheck.length).toBe(0);
+  });
+
+  test("verifyInitSetup skips extension schema check when in public", async () => {
+    const calls: string[] = [];
+    const client = {
+      query: async (sql: string, params?: any) => {
+        calls.push(String(sql));
+
+        if (String(sql).toLowerCase().startsWith("begin isolation level repeatable read")) {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).toLowerCase() === "rollback;") {
+          return { rowCount: 1, rows: [] };
+        }
+        if (String(sql).includes("select rolconfig")) {
+          return { rowCount: 1, rows: [{ rolconfig: ['search_path=postgres_ai, "$user", public, pg_catalog'] }] };
+        }
+        if (String(sql).includes("from pg_catalog.pg_roles")) {
+          return { rowCount: 1, rows: [{ rolname: DEFAULT_MONITORING_USER }] };
+        }
+        if (String(sql).includes("has_database_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("pg_has_role")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_table_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("to_regclass")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        if (String(sql).includes("has_function_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+        // pg_stat_statements is in public schema
+        if (String(sql).includes("pg_extension e") && String(sql).includes("pg_stat_statements")) {
+          return { rowCount: 1, rows: [{ schema: "public" }] };
+        }
+        if (String(sql).includes("has_schema_privilege")) {
+          return { rowCount: 1, rows: [{ ok: true }] };
+        }
+
+        throw new Error(`unexpected sql: ${sql} params=${JSON.stringify(params)}`);
+      },
+    };
+
+    const r = await init.verifyInitSetup({
+      client: client as any,
+      database: "mydb",
+      monitoringUser: DEFAULT_MONITORING_USER,
+      includeOptionalPermissions: false,
+    });
+    // Should pass - public doesn't need extra USAGE grant for extension
+    expect(r.ok).toBe(true);
+    expect(r.missingRequired.length).toBe(0);
+  });
+
   test("buildInitPlan preserves comments when filtering ALTER USER", async () => {
     const plan = await init.buildInitPlan({
       database: "mydb",