Skip to content

fix: a refused role drop no longer rolls back the whole apply, and clone writes where --local-url points - #160

Merged
jasdeepkhalsa merged 2 commits into
mainfrom
fix/drop-role-in-use
Nov 3, 2026
Merged

jasdeepkhalsa merged 2 commits into
mainfrom
fix/drop-role-in-use

Conversation

@jasdeepkhalsa

Copy link
Copy Markdown
Member

Two issues found while syncing public sample databases (Chinook, AdventureWorks) between local servers and a self-hosted Supabase.

A refused DROP ROLE rolled back every other fix

Roles are server-wide. A role the source lacks can still own objects or hold privileges in another database on the target's server, and DROP ROLE is then refused (2BP01). That one refusal rolled back the whole apply. A sync of Chinook into a fresh database on a shared server created 0 of 11 tables.

It's now handled like an unmet dependency: left out, the rest committed, and the error says how to resolve it (REASSIGN OWNED / DROP OWNED in each database). Because left-out fixes are retried after the others, a drop ordered ahead of its own revoke now also succeeds.

Live, against self-hosted Supabase (PG15), 0.0.39 vs this branch:

Extra role on the target 0.0.39 This branch
only granted USAGE in the target database rolled back 11, 0 tables applied 13, 11 tables, role dropped
also owns a table in another database rolled back 11, 0 tables applied 12, 11 tables, role left with the reason

clone --local-url …/mydb cloned somewhere else

clone took only the server from --local-url and wrote to --local-db, which defaulted to supaforge_local, so the database the URL named was ignored. And --local-url …/mydb --local-db mydb --force failed with "cannot drop the currently open database". Now:

  • the clone goes to the database the URL names when --local-db isn't given (still supaforge_local for a URL naming postgres or nothing);
  • the target is created and dropped from the server's postgres database.

Verified live: clone --local-url …/clx --force --apply fills clx and creates no supaforge_local.

Tests

  • promote-savepoints.test.ts: the classification test, plus a batch test (role drop refused → other fixes committed). Both fail without the change.
  • branch.test.ts: target name and maintenance URL.
  • npm run lint, npm test (1949 passed) and npm run build pass.

🤖 Generated with Claude Code

…one writes where --local-url points

Roles are server-wide. A role the source lacks can own objects or hold
privileges in another database on the target's server, and then DROP ROLE
is refused (2BP01) — which rolled back every other fix in the apply, so a
sync onto a shared server created nothing. It is now left out like a fix
with an unmet dependency: the rest commit, and the error says what to do.
Retried with the others, it also succeeds once the same apply's revokes have
run, where before a drop ordered ahead of its revoke failed the batch.

clone read only the server from --local-url and wrote to --local-db, which
defaulted to supaforge_local, so `--local-url …/mydb` cloned somewhere else.
And with --local-db naming the URL's own database, --force failed: it tried
to drop the database it was connected to. The clone now goes to the database
the URL names when --local-db is not given, and creates or drops it from
the server's postgres database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@jasdeepkhalsa
jasdeepkhalsa merged commit da3d0ad into main Nov 3, 2026
28 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant