fix: contain generated files and assets and harden SQL rendering

2026-10-12 20:59:46 +02:00
parent 2fa48335d3
commit dd97413b8e
68 changed files with 2328 additions and 798 deletions
@@ -8,7 +8,6 @@ import (
 	"text/template"

 	"git.warky.dev/wdevs/relspecgo/pkg/models"
-	"git.warky.dev/wdevs/relspecgo/pkg/writers"
 )

 //go:embed templates/*.tmpl
@@ -29,7 +28,7 @@ func NewTemplateExecutor(flattenSchema bool) (*TemplateExecutor, error) {
 	}

 	// qual_table returns a quoted, schema-qualified identifier.
-	// With flatten=false: "schema"."table" (or unquoted equivalents).
+	// With flatten=false: "schema"."table".
 	// With flatten=true:  "schema_table".
 	funcMap["qual_table"] = func(schema, name string) string {
 		if schema == "" {
@@ -41,20 +40,20 @@ func NewTemplateExecutor(flattenSchema bool) (*TemplateExecutor, error) {
 		return quoteIdent(schema) + "." + quoteIdent(name)
 	}

-	// qual_table_raw is the same as qual_table but without identifier quoting.
-	funcMap["qual_table_raw"] = func(schema, name string) string {
-		if schema == "" {
-			return name
-		}
-		if flattenSchema {
-			return schema + "_" + name
-		}
-		return schema + "." + name
-	}
-
-	tmpl, err := template.New("").Funcs(funcMap).ParseFS(templateFS, "templates/*.tmpl")
+	funcMap["dollar_delimiter"] = func() string { return "$$" }
+	tmpl := template.New("").Funcs(funcMap)
+	entries, err := templateFS.ReadDir("templates")
 	if err != nil {
-		return nil, fmt.Errorf("failed to parse templates: %w", err)
+		return nil, err
+	}
+	for _, entry := range entries {
+		source, err := templateFS.ReadFile("templates/" + entry.Name())
+		if err != nil {
+			return nil, err
+		}
+		if _, err := tmpl.New(entry.Name()).Parse(string(source)); err != nil {
+			return nil, fmt.Errorf("parse %s: %w", entry.Name(), err)
+		}
 	}

 	return &TemplateExecutor{
@@ -62,6 +61,31 @@ func NewTemplateExecutor(flattenSchema bool) (*TemplateExecutor, error) {
 	}, nil
 }

+// execute chooses a delimiter absent from rendered data, including SQL expressions.
+// Only explicit template calls emit delimiters; user text is never rewritten.
+func (te *TemplateExecutor) execute(name string, data any) (string, error) {
+	for n := 0; ; n++ {
+		delimiter := fmt.Sprintf("$relspec_%d$", n)
+		count := 0
+		tmpl, err := te.templates.Clone()
+		if err != nil {
+			return "", err
+		}
+		tmpl.Funcs(template.FuncMap{"dollar_delimiter": func() string { count++; return delimiter }})
+		var buf bytes.Buffer
+		if err := tmpl.ExecuteTemplate(&buf, name, data); err != nil {
+			return "", fmt.Errorf("execute %s: %w", name, err)
+		}
+		rendered := buf.String()
+		if strings.ContainsRune(rendered, 0) {
+			return "", fmt.Errorf("%s contains a NUL byte", name)
+		}
+		if strings.Count(rendered, delimiter) == count {
+			return rendered, nil
+		}
+	}
+}
+
 // Template data structures

 // CreateTableData contains data for create table template
@@ -305,230 +329,117 @@ type CreatePrimaryKeyWithAutoGenCheckData struct {

 // ExecuteCreateTable executes the create table template
 func (te *TemplateExecutor) ExecuteCreateTable(data CreateTableData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_table.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_table template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_table.tmpl", data)
 }

 // ExecuteAddColumn executes the add column template
 func (te *TemplateExecutor) ExecuteAddColumn(data AddColumnData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "add_column.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute add_column template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("add_column.tmpl", data)
 }

 // ExecuteAlterColumnTypeWithCheck executes the guarded alter column type
 // template shared by the full-schema writer and the diff-based migration
 // writer.
 func (te *TemplateExecutor) ExecuteAlterColumnTypeWithCheck(data AlterColumnTypeWithCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "alter_column_type_with_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute alter_column_type_with_check template: %w", err)
-	}
-	body := strings.TrimSpace(buf.String())
-	body = strings.TrimPrefix(body, "DO $$")
-	body = strings.TrimSuffix(body, "$$;")
-	return dollarBlock(strings.TrimSpace(body), "relspec_alter_type"), nil
+	return te.execute("alter_column_type_with_check.tmpl", data)
 }

 // ExecuteAlterColumnDefaultWithCheck executes the guarded alter column
 // default template shared by the full-schema writer and the diff-based
 // migration writer.
 func (te *TemplateExecutor) ExecuteAlterColumnDefaultWithCheck(data AlterColumnDefaultWithCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "alter_column_default_with_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute alter_column_default_with_check template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("alter_column_default_with_check.tmpl", data)
 }

 // ExecuteAlterColumnNullabilityWithCheck executes the guarded alter column
 // nullability template.
 func (te *TemplateExecutor) ExecuteAlterColumnNullabilityWithCheck(data AlterColumnNullabilityWithCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "alter_column_nullability_with_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute alter_column_nullability_with_check template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("alter_column_nullability_with_check.tmpl", data)
 }

 // ExecuteCreatePrimaryKey executes the create primary key template
 func (te *TemplateExecutor) ExecuteCreatePrimaryKey(data CreatePrimaryKeyData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_primary_key.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_primary_key template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_primary_key.tmpl", data)
 }

 // ExecuteCreateIndex executes the create index template
 func (te *TemplateExecutor) ExecuteCreateIndex(data CreateIndexData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_index.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_index template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_index.tmpl", data)
 }

 // ExecuteCreateForeignKey executes the create foreign key template
 func (te *TemplateExecutor) ExecuteCreateForeignKey(data CreateForeignKeyData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_foreign_key.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_foreign_key template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_foreign_key.tmpl", data)
 }

 // ExecuteDropConstraint executes the drop constraint template
 func (te *TemplateExecutor) ExecuteDropConstraint(data DropConstraintData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "drop_constraint.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute drop_constraint template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("drop_constraint.tmpl", data)
 }

 // ExecuteDropIndex executes the drop index template
 func (te *TemplateExecutor) ExecuteDropIndex(data DropIndexData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "drop_index.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute drop_index template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("drop_index.tmpl", data)
 }

 // ExecuteCommentTable executes the table comment template
 func (te *TemplateExecutor) ExecuteCommentTable(data CommentTableData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "comment_table.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute comment_table template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("comment_table.tmpl", data)
 }

 // ExecuteCommentColumn executes the column comment template
 func (te *TemplateExecutor) ExecuteCommentColumn(data CommentColumnData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "comment_column.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute comment_column template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("comment_column.tmpl", data)
 }

 // ExecuteAuditTables executes the audit tables template
 func (te *TemplateExecutor) ExecuteAuditTables(data AuditTablesData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "audit_tables.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute audit_tables template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("audit_tables.tmpl", data)
 }

 // ExecuteAuditFunction executes the audit function template
 func (te *TemplateExecutor) ExecuteAuditFunction(data AuditFunctionData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "audit_function.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute audit_function template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("audit_function.tmpl", data)
 }

 // ExecuteAuditTrigger executes the audit trigger template
 func (te *TemplateExecutor) ExecuteAuditTrigger(data AuditTriggerData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "audit_trigger.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute audit_trigger template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("audit_trigger.tmpl", data)
 }

 // ExecuteCreateUniqueConstraint executes the create unique constraint template
 func (te *TemplateExecutor) ExecuteCreateUniqueConstraint(data CreateUniqueConstraintData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_unique_constraint.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_unique_constraint template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_unique_constraint.tmpl", data)
 }

 // ExecuteCreateCheckConstraint executes the create check constraint template
 func (te *TemplateExecutor) ExecuteCreateCheckConstraint(data CreateCheckConstraintData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_check_constraint.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_check_constraint template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_check_constraint.tmpl", data)
 }

 // ExecuteCreateForeignKeyWithCheck executes the create foreign key with check template
 func (te *TemplateExecutor) ExecuteCreateForeignKeyWithCheck(data CreateForeignKeyWithCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_foreign_key_with_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_foreign_key_with_check template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_foreign_key_with_check.tmpl", data)
 }

 // ExecuteSetSequenceValue executes the set sequence value template
 func (te *TemplateExecutor) ExecuteSetSequenceValue(data SetSequenceValueData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "set_sequence_value.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute set_sequence_value template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("set_sequence_value.tmpl", data)
 }

 // ExecuteCreateSequence executes the create sequence template
 func (te *TemplateExecutor) ExecuteCreateSequence(data CreateSequenceData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_sequence.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_sequence template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_sequence.tmpl", data)
 }

 // ExecuteAddColumnWithCheck executes the add column with check template
 func (te *TemplateExecutor) ExecuteAddColumnWithCheck(data AddColumnWithCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "add_column_with_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute add_column_with_check template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("add_column_with_check.tmpl", data)
 }

 // ExecuteCreatePrimaryKeyWithAutoGenCheck executes the create primary key with auto-generated key check template
 func (te *TemplateExecutor) ExecuteCreatePrimaryKeyWithAutoGenCheck(data CreatePrimaryKeyWithAutoGenCheckData) (string, error) {
-	var buf bytes.Buffer
-	err := te.templates.ExecuteTemplate(&buf, "create_primary_key_with_autogen_check.tmpl", data)
-	if err != nil {
-		return "", fmt.Errorf("failed to execute create_primary_key_with_autogen_check template: %w", err)
-	}
-	return buf.String(), nil
+	return te.execute("create_primary_key_with_autogen_check.tmpl", data)
 }

 // Helper functions to build template data from models
@@ -561,7 +472,7 @@ func BuildCreateTableData(schemaName string, table *models.Table) CreateTableDat
 		colData.Generated, colData.Identity = columnGenerationClauses(col)
 		if col.Default != nil && colData.Generated == "" && colData.Identity == "" {
 			if value, ok := col.Default.(string); ok {
-				colData.Default = writers.QuoteDefaultValue(stripBackticks(value), col.Type)
+				colData.Default = quoteDefaultValue(stripBackticks(value), col.Type)
 			} else {
 				colData.Default = fmt.Sprintf("%v", col.Default)
 			}
@@ -612,7 +523,7 @@ func BuildAuditFunctionData(
 	updateComparisons := make([]string, 0)
 	for _, col := range auditedColumns {
 		updateComparisons = append(updateComparisons,
-			fmt.Sprintf("old.%s IS DISTINCT FROM new.%s", col.Name, col.Name))
+			fmt.Sprintf("old.%s IS DISTINCT FROM new.%s", quoteIdent(col.Name), quoteIdent(col.Name)))
 	}
 	updateCondition := strings.Join(updateComparisons, " OR ")

@@ -627,8 +538,8 @@ func BuildAuditFunctionData(
 			}
 		}

-		oldValue := fmt.Sprintf("old.%s::text", col.Name)
-		newValue := fmt.Sprintf("new.%s::text", col.Name)
+		oldValue := fmt.Sprintf("old.%s::text", quoteIdent(col.Name))
+		newValue := fmt.Sprintf("new.%s::text", quoteIdent(col.Name))

 		if isEncrypted {
 			oldValue = "'****************'"
@@ -653,7 +564,7 @@ func BuildAuditFunctionData(
 			}
 		}

-		oldValue := fmt.Sprintf("old.%s::text", col.Name)
+		oldValue := fmt.Sprintf("old.%s::text", quoteIdent(col.Name))
 		if isEncrypted {
 			oldValue = "'****************'"
 		}
@@ -666,7 +577,7 @@ func BuildAuditFunctionData(

 	tablePrefix := "NULL"
 	if config.TablePrefix != "" {
-		tablePrefix = fmt.Sprintf("'%s'", config.TablePrefix)
+		tablePrefix = quote(config.TablePrefix)
 	}

 	return AuditFunctionData{