turbine-orm 0.77.1 → 0.78.0

package/dist/cli/destructive.js

@@ -45,7 +45,9 @@ export const DESTRUCTIVE_KIND_LABEL = {
     'alter-column-type': 'rewrites a column type (cast may truncate or fail)',
     'merge-delete': 'deletes matched rows (MERGE ... THEN DELETE)',
     rename: 'renames a table or column, every query and view referencing the old name breaks',
+    'rewrite-rule': 'installs a rewrite rule that runs a destructive statement every time a later ordinary statement matches it',
     'dynamic-destructive': 'runs destructive SQL assembled at run time, what it destroys cannot be known without running it',
+    'dynamic-unclassified': 'runs SQL assembled at run time whose statement the scanner cannot read; confirm what it does yourself',
 };
 /** Unquote a "quoted" identifier for display. */
 const ident = (raw) => (raw ?? '?').replace(/^"|"$/g, '');
@@ -150,6 +152,25 @@ const RULES = [
         target: (m) => (m[4] ? `${ident(m[2])}.${ident(m[4])}` : ident(m[2])),
         also: (stmt) => !hasTopLevelWhere(stmt),
     },
+    {
+        // `CREATE RULE r AS ON INSERT TO t DO INSTEAD DELETE FROM u`. The rule
+        // destroys nothing when it is created, which is why it passed: the DELETE
+        // runs later, on every ordinary INSERT into `t`, and the first one emptied
+        // the table. Deferred destruction is still destruction the migration
+        // installs. `DO ALSO` counts too (the action runs in addition), and the
+        // action may be a parenthesized list, whose FIRST statement decides.
+        kind: 'rewrite-rule',
+        regex: new RegExp(String.raw `^CREATE\s+(?:OR\s+REPLACE\s+)?RULE\s+${IDENT}\s+AS\s+ON\s+(?:SELECT|INSERT|UPDATE|DELETE)\s+TO\s+${IDENT}${OUTSIDE_QUOTES}\bDO\s+(?:ALSO\s+|INSTEAD\s+)?\(?\s*(DELETE|UPDATE|TRUNCATE|DROP)\b`, 'i'),
+        target: (m) => `${qualified(m, 4)} (${(m[7] ?? '').toUpperCase()} on every matching statement)`,
+        // An UPDATE action is judged the way a top-level UPDATE is: destructive
+        // without a WHERE, ordinary with one. `CREATE RULE v_upd AS ON UPDATE TO v
+        // DO INSTEAD UPDATE base SET n = 1 WHERE id = 2` is the standard updatable
+        // -view idiom and was being reported, which is a false positive on a shape
+        // that appears in ordinary migrations. DELETE, TRUNCATE and DROP stay
+        // unconditional: a DELETE inside a rule destroys on every matching
+        // statement whether or not it is narrowed, and the other two take no WHERE.
+        also: (stmt) => !/\bDO\s+(?:ALSO\s+|INSTEAD\s+)?\(?\s*UPDATE\b/i.test(stmt) || !hasTopLevelWhere(stmt),
+    },
     // Renames come LAST: they destroy no data, so any statement that is BOTH a
     // rename and a data-loss operation should report the data loss instead.
     {
@@ -222,6 +243,28 @@ function matchRules(candidate) {
     }
     return null;
 }
+/**
+ * The DML inside `COPY (DELETE FROM t RETURNING *) TO ...`.
+ *
+ * The same trick as a data-modifying CTE, through a different wrapper: the
+ * statement reads as a COPY, which nothing here treats as destructive, and the
+ * DELETE inside it runs and empties the table. Verified live on PostgreSQL 17
+ * through node-postgres, `TO STDOUT` included, so it needs no server-side file
+ * permission and no `TO PROGRAM`. `cteSubstatements` does not reach it because
+ * that one only fires on a leading `WITH`.
+ */
+function copySubstatements(stmt) {
+    if (!/^COPY\s*\(/i.test(stmt))
+        return [];
+    const open = stmt.indexOf('(');
+    if (open === -1)
+        return [];
+    const inner = stmt.slice(open + 1, closingParenIndex(stmt, open)).trim();
+    // A `COPY (SELECT ...) TO` is the ordinary export form and destroys nothing.
+    // A leading WITH is handed on so its own CTE bodies are read by the rule
+    // above rather than being judged as one blob here.
+    return /^(?:DELETE|UPDATE|INSERT|MERGE|WITH)\b/i.test(inner) ? [inner] : [];
+}
 /**
  * Data-modifying CTE bodies: `WITH d AS (DELETE FROM t ...) SELECT ...` runs a
  * real DELETE even though the statement reads as a SELECT. Each candidate is cut
@@ -294,7 +337,7 @@ function proceduralCandidates(body) {
         const re = /\b(?:DROP|TRUNCATE|DELETE|ALTER|UPDATE|MERGE)\s/gi;
         let m = re.exec(text);
         while (m !== null) {
-            out.push({ text: text.slice(m.index), before: text.slice(0, m.index) });
+            out.push({ text: text.slice(m.index), before: text.slice(0, m.index), statementCode: text });
             m = re.exec(text);
         }
     }
@@ -322,6 +365,7 @@ export function scanDestructiveSql(sql) {
         const candidates = [
             stripLeadingCtes(body),
             ...cteSubstatements(body),
+            ...copySubstatements(body).flatMap((inner) => [inner, ...cteSubstatements(inner)]),
         ].map((text) => ({
             text,
             display,
@@ -339,10 +383,20 @@ export function scanDestructiveSql(sql) {
                 candidates.push({
                     text: part.text,
                     display: `${display} [in block: ${part.text.replace(/\s+/g, ' ').slice(0, 60)}]`,
+                    statementCode: part.statementCode,
                 });
                 proceduralParts.push(part);
             }
         }
+        // Sub-statements of a procedural body that some pass has already named.
+        // ONE body holds several statements and each is judged on its own, so a
+        // pass that reports one must not silence the others: `DO $$ BEGIN EXECUTE
+        // 'ALTER TABLE t DROP COLUMN x'; EXECUTE 'D'||'ROP TABLE victim'; END $$`
+        // reported only the DROP COLUMN, and the DROP TABLE then ran under a
+        // confirmation the operator gave for something else. Equally, the
+        // unclassified backstop must not re-report a statement an earlier pass
+        // already named, which is what this set is for.
+        const spokenFor = new Set();
         let matched = false;
         for (const candidate of candidates) {
             const hit = matchRules(candidate.text);
@@ -350,9 +404,15 @@ export function scanDestructiveSql(sql) {
                 continue;
             found.push({ statement: candidate.display, kind: hit.kind, target: hit.target });
             matched = true;
-            break;
+            if (candidate.statementCode !== undefined)
+                spokenFor.add(candidate.statementCode);
+            // A statement outside a procedural body has exactly one verdict, as
+            // before. Inside one, keep going: the remaining sub-statements have not
+            // been judged yet.
+            if (!procedural)
+                break;
         }
-        if (matched)
+        if (matched && !procedural)
             continue;
         // Nothing matched a rule. Inside a PROCEDURAL body that is not the end of
         // the question, because the rules all need a parseable object name and
@@ -375,7 +435,10 @@ export function scanDestructiveSql(sql) {
         // `RAISE NOTICE 'DROP the mic'` would prompt, and a guard that fires on
         // prose teaches operators to confirm without reading, which costs more than
         // it saves.
+        let dynamicHit = false;
         for (const part of proceduralParts) {
+            if (spokenFor.has(part.statementCode))
+                continue;
             const kind = dynamicDestructiveKind(part);
             if (!kind)
                 continue;
@@ -384,11 +447,210 @@ export function scanDestructiveSql(sql) {
                 kind,
                 target: DYNAMIC_TARGET,
             });
-            break;
+            dynamicHit = true;
+            spokenFor.add(part.statementCode);
+        }
+        // Still nothing, in a procedural body. Every pass above needs to SEE a verb,
+        // and an EXECUTE whose text is assembled so that no verb is visible
+        // (`'D' || 'ROP TABLE t'`, `chr(68) || ...`, `reverse(...)`, an escape-
+        // encoded literal, a variable built across statements) walked past all of
+        // them and dropped the table live. The scanner cannot classify such a
+        // statement, and "cannot classify" must not be reported as "clean": that is
+        // the consent gate deciding in the author's favour on no evidence. So it
+        // asks, with a kind whose label says exactly that.
+        for (const block of procedural ? statement.blocks : []) {
+            for (const unreadable of unclassifiableExecutes(block, matched || dynamicHit)) {
+                if (spokenFor.has(unreadable.code))
+                    continue;
+                spokenFor.add(unreadable.code);
+                found.push({
+                    statement: `${display} [in block: ${`EXECUTE ${unreadable.expr}`.replace(/\s+/g, ' ').slice(0, 60)}]`,
+                    kind: 'dynamic-unclassified',
+                    target: DYNAMIC_TARGET,
+                });
+            }
         }
     }
     return found;
 }
+/**
+ * Statement openers that destroy nothing, so an assembled `EXECUTE` whose text
+ * visibly begins with one of them is left alone. `UPDATE` is here because its
+ * destructive form is the ABSENCE of a `WHERE`, which the tail of an assembled
+ * fragment cannot answer; flagging every dynamic `UPDATE ... WHERE` is the
+ * false-positive cost this module refuses to pay.
+ */
+const HARMLESS_OPENER = /^(?:SELECT|INSERT|UPDATE|CREATE|COMMENT|GRANT|REVOKE|ANALYZE|ANALYSE|REFRESH|VACUUM|REINDEX|CLUSTER|SET|RESET|SHOW|NOTIFY|LOCK|CALL|PERFORM|EXPLAIN)\b/i;
+/**
+ * Openers whose rules deliberately stay SILENT on a benign form, so silence
+ * from them is a decision rather than a failure to parse. `ALTER TABLE ... ADD
+ * COLUMN` loses nothing and is not reported on purpose; a `MERGE` without a
+ * `THEN DELETE` likewise; a `WITH` whose CTE bodies are all reads likewise.
+ * Reporting these again here would contradict that silence.
+ */
+const VERB_SILENT_WHEN_BENIGN = /^(?:ALTER|MERGE|WITH)\b/i;
+/**
+ * Openers whose rules ALWAYS report when they can read the statement. Silence
+ * from one of these is not a verdict, it is the rules failing to parse, so the
+ * skip is conditional on an earlier pass having actually reported.
+ *
+ * The shape that made the distinction necessary: two adjacent string literals
+ * are ONE string in PostgreSQL, so `EXECUTE 'DROP TABLE '\n'victims'` reads as
+ * `DROP` to the opener test while every earlier pass declines, the literal
+ * rules because a quote is not an identifier and the assembly test because
+ * continuation is lexical and carries no `||`, `concat` or `format`. The
+ * opener was trusted, the statement was skipped, and the table went.
+ */
+const VERB_ALWAYS_REPORTS = /^(?:DROP|TRUNCATE|DELETE)\b/i;
+/**
+ * `EXECUTE` in a position where plpgsql can begin a statement.
+ *
+ * Matched against a statement's `stripped` view, so the word can never be one
+ * that lived inside a string literal. `GRANT`/`REVOKE EXECUTE ON FUNCTION` are
+ * excluded by construction: their preceding token is a verb, not one of the
+ * introducers here.
+ */
+const EXECUTE_AT_STATEMENT_START = /(?:^|;|\bTHEN\b|\bELSE\b|\bLOOP\b|\bBEGIN\b|\bDECLARE\b)\s*EXECUTE\s/i;
+/**
+ * Functions whose FIRST literal argument is the statement text (or its
+ * template), so the opener can be read through the call.
+ */
+const TEMPLATE_FN = /^(?:format|replace|regexp_replace|concat|concat_ws|array_to_string)\s*\(/i;
+/** The leading string literal of `text`: its raw content and whether it can hide a verb. */
+function leadingLiteral(text) {
+    const m = /^(U&'|[EeBbXx]'|'|\$([A-Za-z_][\w]*)?\$)/.exec(text);
+    if (!m)
+        return null;
+    const open = m[1];
+    if (open.startsWith('$')) {
+        const close = text.indexOf(open, open.length);
+        if (close === -1)
+            return null;
+        return { content: text.slice(open.length, close), rest: text.slice(close + open.length), escaped: false };
+    }
+    // Single-quoted: `''` is an escaped quote inside the literal.
+    let i = open.length;
+    let content = '';
+    while (i < text.length) {
+        const ch = text[i];
+        if (ch === "'") {
+            if (text[i + 1] === "'") {
+                content += "'";
+                i += 2;
+                continue;
+            }
+            break;
+        }
+        content += ch;
+        i++;
+    }
+    if (i >= text.length)
+        return null;
+    // `E'\x44ROP'` and `U&'\0044ROP'` spell a verb the scanner cannot see; an
+    // escape string with no backslash in it hides nothing.
+    const escaped = open !== "'" && content.includes('\\');
+    return { content, rest: text.slice(i + 1), escaped };
+}
+/**
+ * The first word of the statement an `EXECUTE` argument would run, read as far
+ * as the text allows, plus whether the argument is one PLAIN literal (in which
+ * case the literal passes already had their chance and this pass stays out).
+ * `null` opener = the scanner cannot see a verb at all.
+ */
+function executeOpener(expr) {
+    const text = expr.trim();
+    const lit = leadingLiteral(text);
+    if (lit) {
+        const word = /^\s*([A-Za-z_][\w]*)/.exec(lit.content)?.[1] ?? null;
+        // Plain: the literal IS the whole argument (bar an INTO / USING clause),
+        // spelled without escapes.
+        const plain = !lit.escaped && /^\s*(?:;|INTO\b|USING\b|$)/i.test(lit.rest);
+        return { opener: lit.escaped ? null : word, plain };
+    }
+    if (TEMPLATE_FN.test(text)) {
+        // Read the opener from the first literal argument that carries a word: a
+        // `concat_ws(' ', ...)` separator or a `format('%s', ...)` placeholder is
+        // not a verb, and neither is a `concat('DR', 'OP', ...)` fragment.
+        const inner = text.slice(text.indexOf('(') + 1);
+        let cursor = inner;
+        for (let guard = 0; guard < 16; guard++) {
+            const lit2 = leadingLiteral(cursor.trimStart());
+            if (!lit2)
+                break;
+            const word = /^\s*([A-Za-z_][\w]*)/.exec(lit2.content)?.[1];
+            if (word)
+                return { opener: lit2.escaped ? null : word, plain: false };
+            const comma = lit2.rest.indexOf(',');
+            if (comma === -1)
+                break;
+            cursor = lit2.rest.slice(comma + 1);
+        }
+        return { opener: null, plain: false };
+    }
+    // Any other function call, a parenthesised expression, or a bare variable
+    // (`EXECUTE s`, built across earlier statements): nothing readable.
+    return { opener: null, plain: false };
+}
+/**
+ * The EXECUTE argument in `body`, when it is assembled or encoded such that no
+ * statement verb is visible to the passes above. Returns the offending
+ * fragment for display, or `null` when every EXECUTE in the body either is a
+ * plain literal (the literal rules own it) or visibly begins with a verb some
+ * other rule has already judged.
+ */
+function unclassifiableExecutes(body, verbPassesReported) {
+    const out = [];
+    for (const statement of tokenizeSql(body)) {
+        // Decide PRESENCE against `stripped`, whose literals are emptied, and read
+        // the ARGUMENT out of `code`, which keeps them. Reading both out of `code`
+        // fired on the word rather than on the statement: `RAISE NOTICE 'EXECUTE
+        // the plan'` and `INSERT INTO log(msg) VALUES ('EXECUTE me later')` both
+        // prompted, and a guard that fires on prose teaches operators to confirm
+        // without reading, which is the cost this module's own doctrine refuses to
+        // pay. `stripped` cannot contain a word that only ever appeared inside a
+        // literal, so it settles the question the offsets cannot.
+        //
+        // The keyword must also sit where a plpgsql STATEMENT can start, not
+        // merely somewhere in the text: `GRANT EXECUTE ON FUNCTION f() TO app` is
+        // an ordinary permission grant and was being reported as unreadable
+        // dynamic SQL, which fails an ordinary migration under `migrate deploy`
+        // where there is no terminal to confirm at. The introducers below are the
+        // positions plpgsql actually allows one at, since `tokenizeSql` splits on
+        // top-level semicolons and a body's `IF ... THEN EXECUTE ...` therefore
+        // arrives as one statement.
+        if (!EXECUTE_AT_STATEMENT_START.test(statement.stripped))
+            continue;
+        const m = /\bEXECUTE\s+([\s\S]+)$/i.exec(statement.code);
+        if (!m)
+            continue;
+        const expr = m[1];
+        const { opener, plain } = executeOpener(expr);
+        if (plain)
+            continue;
+        // `EXECUTE s` where `s` is a bare variable: the statement it runs was
+        // assembled by some EARLIER sub-statement of the same block, so when a pass
+        // has already named one, the operator has been told what this body does and
+        // a second "cannot classify" entry for the same thing is noise that
+        // contradicts the first. When nothing was named, this is the whole finding
+        // and it stands: an assignment the rules could not read leaves
+        // `verbPassesReported` false.
+        if (opener === null && verbPassesReported && /^[A-Za-z_]\w*\s*;?$/.test(expr.trim()))
+            continue;
+        if (opener !== null) {
+            if (HARMLESS_OPENER.test(opener))
+                continue;
+            if (VERB_SILENT_WHEN_BENIGN.test(opener))
+                continue;
+            // The remaining skip is a claim that an earlier pass already reported
+            // this statement, so it holds only when one actually did. See
+            // VERB_ALWAYS_REPORTS for the shape where none does.
+            if (verbPassesReported && VERB_ALWAYS_REPORTS.test(opener))
+                continue;
+        }
+        out.push({ code: statement.code, expr });
+    }
+    return out;
+}
 /** Shown in place of an object name that does not exist until the block runs. */
 export const DYNAMIC_TARGET = '<name assembled at run time>';
 /**
@@ -453,16 +715,41 @@ const ASSEMBLY_FN = /\b(?:format|concat_ws|concat|quote_ident|quote_literal|quot
 const WRAPPING_ASSEMBLY_FN = /\b(?:format|concat_ws|concat|quote_ident|quote_literal|quote_nullable|array_to_string|regexp_replace|replace)\s*\([^)]*$/i;
 /** Dynamic SQL only runs if something runs it. Scoped to the candidate's own statement. */
 const RUNS_DYNAMIC_SQL = /\bEXECUTE\b/i;
+/**
+ * `ALTER TABLE <assembled name> DROP [COLUMN] ...`: the sub-action that loses
+ * rows, with the same exclusions as the static `drop-column` rule (`DROP
+ * CONSTRAINT` / `DEFAULT` / `NOT NULL` / `IDENTITY` / `EXPRESSION` lose none).
+ * Matches when the keyword `COLUMN`, an `IF EXISTS`, or a literal column name
+ * follows the `DROP`; a `DROP` followed by nothing literal is handled below.
+ * {@link OUTSIDE_QUOTES} keeps `ADD COLUMN "drop me"` out, as it does statically.
+ */
+const DYNAMIC_ALTER_DROP_COLUMN = new RegExp(String.raw `^ALTER\s+TABLE\b${OUTSIDE_QUOTES}\bDROP\s+(?!CONSTRAINT\b|DEFAULT\b|NOT\b|IDENTITY\b|EXPRESSION\b)(?:COLUMN\b|IF\s+EXISTS\b|${IDENT})`, 'i');
+/** `ALTER TABLE <assembled name> ALTER [COLUMN] <col> [SET DATA] TYPE ...`. */
+const DYNAMIC_ALTER_COLUMN_TYPE = new RegExp(String.raw `^ALTER\s+TABLE\b${OUTSIDE_QUOTES}\bALTER\s+(?:COLUMN\s+)?${IDENT}\s+(?:SET\s+DATA\s+)?TYPE\b`, 'i');
+/** The `DROP <thing>` sub-actions of ALTER TABLE that lose no rows. */
+const DYNAMIC_ALTER_DROP_HARMLESS = new RegExp(String.raw `^ALTER\s+TABLE\b${OUTSIDE_QUOTES}\bDROP\s+(?:CONSTRAINT|DEFAULT|NOT\s+NULL|IDENTITY|EXPRESSION)\b`, 'i');
 /**
  * The kind a runtime-assembled procedural fragment should be reported as, or
  * `null` when it is not dynamic (so a rule already had its chance) or its verb
  * is not one that destroys data on its own.
  *
- * `ALTER` and `UPDATE` are deliberately absent even though
- * {@link proceduralCandidates} collects them: their destructive forms are
- * narrow (`ALTER COLUMN ... TYPE`, an `UPDATE` with no `WHERE`) and neither is
- * decidable from a fragment whose tail is a runtime expression, so including
- * them would flag every dynamic `UPDATE ... WHERE` in the file.
+ * `ALTER TABLE` IS decided here, by the sub-action that follows the assembled
+ * table name, because in the shape that matters that sub-action is literal
+ * text: a multi-tenant loop assembles the TABLE (`'ALTER TABLE ' ||
+ * quote_ident(t) || ' DROP COLUMN legacy_phone'`) and writes out what it does
+ * to it. That statement dropped the column from every tenant table while the
+ * scan reported a clean inventory, and its `DROP TABLE` twin was already being
+ * flagged, so an operator who had seen the guard fire once would assume this
+ * was covered. Only the forms that lose rows are reported (`DROP [COLUMN]`,
+ * `ALTER COLUMN ... TYPE`), with the same exclusions as their static rules; an
+ * assembled `ADD COLUMN` stays silent. A `DROP` whose object is itself in the
+ * runtime expression (`' DROP ' || what`) is `dynamic-destructive`, the bare
+ * `DROP` precedent below: alarming is fine, wrong is not.
+ *
+ * `UPDATE` is still deliberately absent even though {@link proceduralCandidates}
+ * collects it: its destructive form is the ABSENCE of a `WHERE`, and absence
+ * is not decidable from a fragment whose tail is a runtime expression, so
+ * including it would flag every dynamic `UPDATE ... WHERE` in the file.
  */
 function dynamicDestructiveKind({ text, before }) {
     const assembled = DYNAMIC_ASSEMBLY.test(text) ||
@@ -470,6 +757,17 @@ function dynamicDestructiveKind({ text, before }) {
         (RUNS_DYNAMIC_SQL.test(before) && WRAPPING_ASSEMBLY_FN.test(before));
     if (!assembled)
         return null;
+    if (/^ALTER\s+TABLE\b/i.test(text)) {
+        if (DYNAMIC_ALTER_DROP_COLUMN.test(text))
+            return 'drop-column';
+        if (DYNAMIC_ALTER_COLUMN_TYPE.test(text))
+            return 'alter-column-type';
+        if (DYNAMIC_ALTER_DROP_HARMLESS.test(text))
+            return null;
+        if (new RegExp(String.raw `^ALTER\s+TABLE\b${OUTSIDE_QUOTES}\bDROP\b`, 'i').test(text))
+            return 'dynamic-destructive';
+        return null;
+    }
     if (/^DROP\s+TABLE\b/i.test(text))
         return 'drop-table';
     if (/^DROP\s+SCHEMA\b/i.test(text))