feat(pgpm): subsystem substitution in apply — exclude, rebind, cascade-safe materialization

__fixtures__/apply/substitution/packages/auth-provider/auth-provider.control

@@ -0,0 +1,7 @@
+# auth-provider extension
+comment = 'auth-provider extension'
+default_version = '0.0.1'
+module_pathname = '$libdir/auth-provider'
+requires = 'plpgsql'
+relocatable = false
+superuser = false

__fixtures__/apply/substitution/packages/auth-provider/deploy/schemas/app_auth/procedures/current_user_id.sql

@@ -0,0 +1,11 @@
+-- Deploy schemas/app_auth/procedures/current_user_id to pg
+
+-- requires: schemas/app_auth/schema
+
+BEGIN;
+
+CREATE FUNCTION app_auth.current_user_id() RETURNS uuid AS $$
+  SELECT nullif(current_setting('jwt.claims.user_id', true), '')::uuid;
+$$ LANGUAGE sql STABLE;
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/deploy/schemas/app_auth/schema.sql

@@ -0,0 +1,7 @@
+-- Deploy schemas/app_auth/schema to pg
+
+BEGIN;
+
+CREATE SCHEMA app_auth;
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/deploy/schemas/app_auth/tables/users/table.sql

@@ -0,0 +1,12 @@
+-- Deploy schemas/app_auth/tables/users/table to pg
+
+-- requires: schemas/app_auth/schema
+
+BEGIN;
+
+CREATE TABLE app_auth.users (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/pgpm.plan

@@ -0,0 +1,7 @@
+%syntax-version=1.0.0
+%project=auth-provider
+%uri=auth-provider
+
+schemas/app_auth/schema 2024-01-01T00:00:00Z Dev <dev@example.com> # add app_auth schema
+schemas/app_auth/tables/users/table [schemas/app_auth/schema] 2024-01-01T00:00:01Z Dev <dev@example.com> # add users table
+schemas/app_auth/procedures/current_user_id [schemas/app_auth/schema] 2024-01-01T00:00:02Z Dev <dev@example.com> # add current_user_id

__fixtures__/apply/substitution/packages/auth-provider/revert/schemas/app_auth/procedures/current_user_id.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app_auth/procedures/current_user_id from pg
+
+BEGIN;
+
+DROP FUNCTION app_auth.current_user_id();
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/revert/schemas/app_auth/schema.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app_auth/schema from pg
+
+BEGIN;
+
+DROP SCHEMA app_auth;
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/revert/schemas/app_auth/tables/users/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app_auth/tables/users/table from pg
+
+BEGIN;
+
+DROP TABLE app_auth.users;
+
+COMMIT;

__fixtures__/apply/substitution/packages/auth-provider/verify/schemas/app_auth/procedures/current_user_id.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app_auth/procedures/current_user_id on pg
+
+BEGIN;
+
+SELECT app_auth.current_user_id();
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/auth-provider/verify/schemas/app_auth/schema.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app_auth/schema on pg
+
+BEGIN;
+
+SELECT pg_catalog.has_schema_privilege('app_auth', 'usage');
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/auth-provider/verify/schemas/app_auth/tables/users/table.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app_auth/tables/users/table on pg
+
+BEGIN;
+
+SELECT id, created_at FROM app_auth.users WHERE FALSE;
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-app/pgpm.apply.json

@@ -0,0 +1,25 @@
+{
+  "source": "crm-module",
+  "schemas": {
+    "app": "crm"
+  },
+  "exclude": {
+    "schemas": ["identity"]
+  },
+  "route": [
+    {
+      "fromSchema": "identity",
+      "kind": "table",
+      "name": "users",
+      "toSchema": "app_auth"
+    },
+    {
+      "fromSchema": "identity",
+      "kind": "function",
+      "name": "current_actor",
+      "toSchema": "app_auth",
+      "toName": "current_user_id"
+    }
+  ],
+  "requires": ["auth-provider"]
+}

__fixtures__/apply/substitution/packages/crm-module/crm-module.control

@@ -0,0 +1,7 @@
+# crm-module extension
+comment = 'crm-module extension'
+default_version = '0.0.1'
+module_pathname = '$libdir/crm-module'
+requires = 'plpgsql'
+relocatable = false
+superuser = false

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/app/policies/notes_owner.sql

@@ -0,0 +1,13 @@
+-- Deploy schemas/app/policies/notes_owner to pg
+
+-- requires: schemas/app/tables/notes/table
+-- requires: schemas/identity/procedures/current_actor
+
+BEGIN;
+
+ALTER TABLE app.notes ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY notes_owner ON app.notes
+  USING (owner = identity.current_actor());
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/app/schema.sql

@@ -0,0 +1,7 @@
+-- Deploy schemas/app/schema to pg
+
+BEGIN;
+
+CREATE SCHEMA app;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/app/tables/notes/table.sql

@@ -0,0 +1,18 @@
+-- Deploy schemas/app/tables/notes/table to pg
+
+-- requires: schemas/app/schema
+-- requires: schemas/identity/tables/users/table
+
+BEGIN;
+
+CREATE TABLE app.notes (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  owner uuid NOT NULL,
+  body text NOT NULL
+);
+
+ALTER TABLE app.notes
+  ADD CONSTRAINT notes_owner_fkey
+  FOREIGN KEY (owner) REFERENCES identity.users (id);
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/identity/procedures/current_actor.sql

@@ -0,0 +1,11 @@
+-- Deploy schemas/identity/procedures/current_actor to pg
+
+-- requires: schemas/identity/schema
+
+BEGIN;
+
+CREATE FUNCTION identity.current_actor() RETURNS uuid AS $$
+  SELECT nullif(current_setting('request.claims.sub', true), '')::uuid;
+$$ LANGUAGE sql STABLE;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/identity/schema.sql

@@ -0,0 +1,7 @@
+-- Deploy schemas/identity/schema to pg
+
+BEGIN;
+
+CREATE SCHEMA identity;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/deploy/schemas/identity/tables/users/table.sql

@@ -0,0 +1,13 @@
+-- Deploy schemas/identity/tables/users/table to pg
+
+-- requires: schemas/identity/schema
+
+BEGIN;
+
+CREATE TABLE identity.users (
+  id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
+  secret_token text,
+  recovery_token text
+);
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/pgpm.plan

@@ -0,0 +1,10 @@
+%syntax-version=1.0.0
+%project=crm-module
+%uri=crm-module
+
+schemas/identity/schema 2024-01-01T00:00:00Z Dev <dev@example.com> # add identity schema
+schemas/identity/tables/users/table [schemas/identity/schema] 2024-01-01T00:00:01Z Dev <dev@example.com> # add identity users
+schemas/identity/procedures/current_actor [schemas/identity/schema] 2024-01-01T00:00:02Z Dev <dev@example.com> # add current_actor
+schemas/app/schema 2024-01-01T00:00:03Z Dev <dev@example.com> # add app schema
+schemas/app/tables/notes/table [schemas/app/schema schemas/identity/tables/users/table] 2024-01-01T00:00:04Z Dev <dev@example.com> # add notes table
+schemas/app/policies/notes_owner [schemas/app/tables/notes/table schemas/identity/procedures/current_actor] 2024-01-01T00:00:05Z Dev <dev@example.com> # add notes policy

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/app/policies/notes_owner.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app/policies/notes_owner from pg
+
+BEGIN;
+
+DROP POLICY notes_owner ON app.notes;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/app/schema.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app/schema from pg
+
+BEGIN;
+
+DROP SCHEMA app;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/app/tables/notes/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/app/tables/notes/table from pg
+
+BEGIN;
+
+DROP TABLE app.notes;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/identity/procedures/current_actor.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/identity/procedures/current_actor from pg
+
+BEGIN;
+
+DROP FUNCTION identity.current_actor();
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/identity/schema.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/identity/schema from pg
+
+BEGIN;
+
+DROP SCHEMA identity;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/revert/schemas/identity/tables/users/table.sql

@@ -0,0 +1,7 @@
+-- Revert schemas/identity/tables/users/table from pg
+
+BEGIN;
+
+DROP TABLE identity.users;
+
+COMMIT;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/app/policies/notes_owner.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app/policies/notes_owner on pg
+
+BEGIN;
+
+SELECT owner FROM app.notes WHERE FALSE;
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/app/schema.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app/schema on pg
+
+BEGIN;
+
+SELECT pg_catalog.has_schema_privilege('app', 'usage');
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/app/tables/notes/table.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/app/tables/notes/table on pg
+
+BEGIN;
+
+SELECT id, owner, body FROM app.notes WHERE FALSE;
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/identity/procedures/current_actor.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/identity/procedures/current_actor on pg
+
+BEGIN;
+
+SELECT identity.current_actor();
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/identity/schema.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/identity/schema on pg
+
+BEGIN;
+
+SELECT pg_catalog.has_schema_privilege('identity', 'usage');
+
+ROLLBACK;

__fixtures__/apply/substitution/packages/crm-module/verify/schemas/identity/tables/users/table.sql

@@ -0,0 +1,7 @@
+-- Verify schemas/identity/tables/users/table on pg
+
+BEGIN;
+
+SELECT id FROM identity.users WHERE FALSE;
+
+ROLLBACK;

__fixtures__/apply/substitution/pgpm.json

@@ -0,0 +1,5 @@
+{
+    "packages": [
+        "packages/*"
+    ]
+}

pgpm/core/__tests__/apply/apply-routing.test.ts

@@ -44,7 +44,7 @@ describe('apply spec parsing — object routes', () => {
   });
 
   it.each([
-    [{ source: 'x' }, /at least one of "schemas", "route", "extensions", or "roles"/],
+    [{ source: 'x' }, /at least one of "schemas", "route", "extensions", "roles", or "exclude"/],
     [{ source: 'x', route: [] }, /"route" must be a non-empty array/],
     [{ source: 'x', route: [{ fromSchema: 'a', kind: 'widget', name: 'n', toSchema: 'b' }] }, /route" entry/],
     [{ source: 'x', route: [{ fromSchema: 'a', name: 'n', toSchema: 'b' }] }, /route" entry/],