refactor(target-postgres): policy content equality is node-owned; policy inputs are required-but-undefined

PostgresPolicySchemaNode owns the single policy content-equality
relation (contentEquals); the exact-mode isEqualTo delegates to it and
the planner's phase-2 rename pairing calls it instead of a
planner-local twin — the same consolidation the index pass received.
PostgresRlsPolicyInput and PostgresPolicySchemaNodeInput document the
prefix-presence naming-mode discriminator and type legitimately-absent
values as required-but-undefined; construction sites state absence
explicitly instead of conditionally omitting keys.

Signed-off-by: willbot <w.a.madden+machine@gmail.com>
Signed-off-by: Will Madden <madden@prisma.io>

Author: wmadden-electric

packages/3-targets/3-targets/postgres/src/core/authoring.ts

@@ -172,8 +172,8 @@ function buildRlsPolicyEntity(input: {
     namespaceId: input.namespaceId,
     operation: input.operation,
     roles: input.roles,
-    ...ifDefined('using', input.using),
-    ...ifDefined('withCheck', input.withCheck),
+    using: input.using,
+    withCheck: input.withCheck,
     permissive: true,
   });
 }
@@ -237,17 +237,18 @@ function lowerRlsPolicyFromBlock(
       });
       return undefined;
     }
-    // Every policy has a SQL body, so every `@@map` policy gets the D9
+    // Every policy has a SQL body, so every `@@map` policy gets the
     // exact-name body-comparison warning (batched once per build).
     ctx.warnings?.push(exactNameBodyWarningEntry({ subject: 'policy', exactName }));
     return new PostgresRlsPolicy({
       name: exactName,
+      prefix: undefined,
       tableName,
       namespaceId: block.namespaceId,
       operation,
       roles,
-      ...ifDefined('using', using),
-      ...ifDefined('withCheck', withCheck),
+      using,
+      withCheck,
       permissive: true,
     });
   }

packages/3-targets/3-targets/postgres/src/core/migrations/contract-to-postgres-database-schema-node.ts

@@ -60,13 +60,13 @@ function columnDependsOn(
 function toPolicyNode(policy: PostgresRlsPolicy, namespaceId: string): PostgresPolicySchemaNode {
   return new PostgresPolicySchemaNode({
     name: policy.name,
-    ...ifDefined('prefix', policy.prefix),
+    prefix: policy.prefix,
     tableName: policy.tableName,
     namespaceId,
     operation: policy.operation,
     roles: [...policy.roles],
-    ...ifDefined('using', policy.using),
-    ...ifDefined('withCheck', policy.withCheck),
+    using: policy.using,
+    withCheck: policy.withCheck,
     permissive: policy.permissive,
     dependsOn: [tableDependsOn(namespaceId, policy.tableName), ...policy.roles.map(roleDependsOn)],
   });

packages/3-targets/3-targets/postgres/src/core/migrations/op-factory-call.ts

@@ -1721,7 +1721,10 @@ export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
 
   renderTypeScript(): string {
     const p = this.policy;
-    const input: PostgresRlsPolicyInput = {
+    const input = blindCast<
+      PostgresRlsPolicyInput,
+      'ifDefined keeps absent keys out of the rendered TypeScript source'
+    >({
       name: p.name,
       ...ifDefined('prefix', p.prefix),
       tableName: p.tableName,
@@ -1731,7 +1734,7 @@ export class CreatePostgresRlsPolicyCall extends PostgresOpFactoryCallNode {
       ...ifDefined('using', p.using),
       ...ifDefined('withCheck', p.withCheck),
       permissive: p.permissive,
-    };
+    });
     return `this.createRlsPolicy({ schema: ${jsonToTsSource(this.schemaName)}, table: ${jsonToTsSource(this.tableName)}, policy: ${jsonToTsSource(input)} })`;
   }
 

packages/3-targets/3-targets/postgres/src/core/migrations/planner.ts

@@ -512,7 +512,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
    * pairs a `not-found` and a `not-expected` policy on the SAME table whose
    * wire-name content hashes match but prefixes differ (prefix-only rename);
    * phase 2 pairs remaining managed-missing policies against remaining
-   * extras of any name shape by verbatim content (`policyContentEqual` —
+   * extras of any name shape by verbatim content (the node-owned `contentEquals` —
    * exact→managed adoption). Multi-candidate groups pair deterministically
    * by sorted name; leftovers proceed as create/drop; an exact-named
    * missing policy never content-pairs.
@@ -630,7 +630,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
       // Phase 2 — content pairing (exact→managed convergence, D7 policy
       // half): a remaining managed-missing policy pairs with a remaining
       // extra of ANY name shape when the content matches verbatim
-      // (`policyContentEqual` — not the normalized hash tuple). This is how
+      // (the node-owned `contentEquals` — not the normalized hash tuple). This is how
       // replacing `@@map` with the plain head converges as one
       // `ALTER POLICY … RENAME`. Deterministic like the index pass: missing
       // already iterates sorted by name, candidates consume sorted by name.
@@ -645,7 +645,7 @@ export class PostgresMigrationPlanner implements MigrationPlanner<'sql', 'postgr
             !renamedExtras.has(extraFinding) &&
             extraFinding.schemaForTable === missingFinding.schemaForTable &&
             extraFinding.node.tableName === missingFinding.node.tableName &&
-            policyContentEqual(missingFinding.node, extraFinding.node),
+            missingFinding.node.contentEquals(extraFinding.node),
         );
         if (candidate === undefined) continue;
         renamedExtras.add(candidate);
@@ -811,29 +811,13 @@ function relationalNamespaceNode(
 function policyNodeToContractPolicy(node: PostgresPolicySchemaNode): PostgresRlsPolicy {
   return new PostgresRlsPolicy({
     name: node.name,
-    ...ifDefined('prefix', node.prefix),
+    prefix: node.prefix,
     tableName: node.tableName,
     namespaceId: node.namespaceId,
     operation: node.operation,
     roles: [...node.roles],
-    ...ifDefined('using', node.using),
-    ...ifDefined('withCheck', node.withCheck),
+    using: node.using,
+    withCheck: node.withCheck,
     permissive: node.permissive,
   });
 }
-
-/**
- * Content equality for the policy rename phase 2: `operation` and
- * `permissive` strict, `roles` compared sorted, `using`/`withCheck` VERBATIM
- * byte-for-byte with absent ≡ empty — the same relation the exact-mode
- * `isEqualTo` uses, deliberately NOT the normalized wire-hash tuple.
- */
-function policyContentEqual(a: PostgresPolicySchemaNode, b: PostgresPolicySchemaNode): boolean {
-  return (
-    a.operation === b.operation &&
-    a.permissive === b.permissive &&
-    isArrayEqual([...a.roles].sort(), [...b.roles].sort()) &&
-    (a.using ?? '') === (b.using ?? '') &&
-    (a.withCheck ?? '') === (b.withCheck ?? '')
-  );
-}

packages/3-targets/3-targets/postgres/src/core/postgres-rls-policy.ts

@@ -5,28 +5,36 @@ import { formatWireName, parseWireName } from '@prisma-next/sql-schema-ir/naming
 
 export type RlsPolicyOperation = 'select' | 'insert' | 'update' | 'delete' | 'all';
 
+/**
+ * Every field is a required key. Values that may legitimately be absent
+ * (an exact-named policy's prefix, a missing predicate) are typed
+ * `| undefined` instead of optional, so each construction site states the
+ * absence explicitly rather than omitting the key silently.
+ */
 export interface PostgresRlsPolicyInput {
   /**
-   * Full physical name. Managed: `<prefix>_<8hex>`. Exact: the verbatim
-   * adopted name. Stored as-is; hashing is not this class's job.
+   * Full physical name. Stored as-is; hashing is not this class's job.
    */
   readonly name: string;
   /**
-   * Wire-name prefix (the part before the `_<8hex>` suffix). Present ⇔
-   * managed; absent ⇔ exact-named.
+   * The managed-mode name prefix — its PRESENCE is the naming-mode
+   * discriminator (there is no stored enum). Present ⇔ managed: the
+   * toolchain owns the physical name and `name === formatWireName(prefix,
+   * <8hex content hash>)`. Absent ⇔ exact: `name` is an adopted verbatim
+   * physical name whose identity the author owns entirely.
    */
-  readonly prefix?: string;
+  readonly prefix: string | undefined;
   /** Name of the table this policy attaches to, by name within the same schema. */
   readonly tableName: string;
   /** Namespace coordinate (schema name). Policies are schema-scoped. */
   readonly namespaceId: string;
   readonly operation: RlsPolicyOperation;
-  /** Sorted role names rendered in `TO <roles>`. Plain strings in this slice. */
+  /** Sorted role names rendered in `TO <roles>`. Plain strings for now. */
   readonly roles: readonly string[];
   /** USING predicate SQL string, if present. */
-  readonly using?: string;
+  readonly using: string | undefined;
   /** WITH CHECK predicate SQL string, if present. */
-  readonly withCheck?: string;
+  readonly withCheck: string | undefined;
   /** `true` = `AS PERMISSIVE`, `false` = `AS RESTRICTIVE`. */
   readonly permissive: boolean;
 }

packages/3-targets/3-targets/postgres/src/core/schema-ir/postgres-policy-schema-node.ts

@@ -8,14 +8,23 @@ import { InternalError } from '@prisma-next/utils/internal-error';
 import type { RlsPolicyOperation } from '../postgres-rls-policy';
 import { PostgresSchemaNodeKind } from './schema-node-kinds';
 
+/**
+ * Every field is a required key. Values that may legitimately be absent
+ * (an exact-named policy's prefix, a missing predicate) are typed
+ * `| undefined` instead of optional, so each construction site states the
+ * absence explicitly rather than omitting the key silently.
+ */
 export interface PostgresPolicySchemaNodeInput {
-  /** Full physical name. Managed: `<prefix>_<8hex>`. Exact: verbatim. */
+  /** Full physical name — the node's identity. */
   readonly name: string;
   /**
-   * Wire-name prefix (the part before the `_<8hex>` suffix). Present ⇔
-   * managed; absent ⇔ exact-named.
+   * The managed-mode name prefix — its PRESENCE is the naming-mode
+   * discriminator (there is no stored enum). Present ⇔ managed: the
+   * toolchain owns the physical name and `name === formatWireName(prefix,
+   * <8hex content hash>)`. Absent ⇔ exact: `name` is an adopted verbatim
+   * physical name whose identity the author owns entirely.
    */
-  readonly prefix?: string;
+  readonly prefix: string | undefined;
   /** Name of the table this policy attaches to, by name within the same schema. */
   readonly tableName: string;
   /** Namespace coordinate (schema name). */
@@ -24,9 +33,9 @@ export interface PostgresPolicySchemaNodeInput {
   /** Sorted role names rendered in `TO <roles>`. */
   readonly roles: readonly string[];
   /** USING predicate SQL string, if present. */
-  readonly using?: string;
+  readonly using: string | undefined;
   /** WITH CHECK predicate SQL string, if present. */
-  readonly withCheck?: string;
+  readonly withCheck: string | undefined;
   /** `true` = `AS PERMISSIVE`, `false` = `AS RESTRICTIVE`. */
   readonly permissive: boolean;
   /**
@@ -35,7 +44,7 @@ export interface PostgresPolicySchemaNodeInput {
    * the derivation, which holds the parent (database/namespace) context.
    * Never compared by `isEqualTo`.
    */
-  readonly dependsOn?: readonly SchemaNodeRef[];
+  readonly dependsOn: readonly SchemaNodeRef[] | undefined;
 }
 
 /**
@@ -109,12 +118,24 @@ export class PostgresPolicySchemaNode extends SqlSchemaIRNode implements Diffabl
     if (this.prefix !== undefined) {
       return this.id === node.id;
     }
+    return this.contentEquals(node);
+  }
+
+  /**
+   * The single policy content-equality relation — the exact-mode
+   * {@link isEqualTo} and the planner's rename content-pairing both call
+   * this rather than growing a parallel relation: `operation` and
+   * `permissive` strict, `roles` compared sorted, `using`/`withCheck`
+   * VERBATIM byte-for-byte with absent ≡ empty — deliberately NOT the
+   * normalized wire-hash tuple.
+   */
+  contentEquals(other: PostgresPolicySchemaNode): boolean {
     return (
-      this.operation === node.operation &&
-      this.permissive === node.permissive &&
-      isArrayEqual([...this.roles].sort(), [...node.roles].sort()) &&
-      (this.using ?? '') === (node.using ?? '') &&
-      (this.withCheck ?? '') === (node.withCheck ?? '')
+      this.operation === other.operation &&
+      this.permissive === other.permissive &&
+      isArrayEqual([...this.roles].sort(), [...other.roles].sort()) &&
+      (this.using ?? '') === (other.using ?? '') &&
+      (this.withCheck ?? '') === (other.withCheck ?? '')
     );
   }
 

packages/3-targets/3-targets/postgres/test/migrations/contract-to-postgres-database-schema-node.test.ts

@@ -29,6 +29,7 @@ function makePolicy(name: string): PostgresRlsPolicy {
     roles: ['authenticated'],
     using: '(auth.uid() = user_id)',
     permissive: true,
+    withCheck: undefined,
   });
 }
 
@@ -270,6 +271,8 @@ describe('contractToPostgresDatabaseSchemaNode', () => {
       operation: 'select',
       roles: ['authenticated'],
       permissive: true,
+      using: undefined,
+      withCheck: undefined,
     });
     expect(() =>
       contractToPostgresDatabaseSchemaNode(makeContract({ policies: [orphan] }), projectionOptions),

packages/3-targets/3-targets/postgres/test/migrations/op-factory-call.lowering.test.ts

@@ -921,6 +921,7 @@ function makePolicy(): PostgresRlsPolicy {
     roles: ['authenticated'],
     using: 'author_id = current_user_id()',
     permissive: true,
+    withCheck: undefined,
   });
 }
 

packages/3-targets/3-targets/postgres/test/migrations/render-typescript.test.ts

@@ -163,6 +163,7 @@ describe('renderCallsToTypeScript (postgres) — facade import surface', () => {
     roles: ['authenticated'],
     using: '(owner_id = auth.uid())',
     permissive: true,
+    withCheck: undefined,
   });
 
   const rawOp = {

packages/3-targets/3-targets/postgres/test/migrations/rls-enablement-planner.test.ts

@@ -48,6 +48,7 @@ function contractPolicy(name: string): PostgresRlsPolicy {
     roles: ['authenticated'],
     using: '(auth.uid() = user_id)',
     permissive: true,
+    withCheck: undefined,
   });
 }
 
@@ -127,12 +128,12 @@ function actualSchema(options: {
               (policy) =>
                 new PostgresPolicySchemaNode({
                   name: policy.name,
-                  ...(policy.prefix !== undefined ? { prefix: policy.prefix } : {}),
+                  prefix: policy.prefix,
                   tableName: policy.tableName,
                   namespaceId: 'public',
                   operation: policy.operation,
                   roles: [...policy.roles],
-                  ...(policy.using !== undefined ? { using: policy.using } : {}),
+                  using: policy.using,
                   permissive: policy.permissive,
                 }),
             ),