Repository navigation
The data copy preflight misses extension arrays, extensions in other schemas, and some auth references #173
Description
Found in the review of #171 (spec S-007 preflight, #125).
The data copy preflight refuses what it can see, but three common Supabase shapes get past it. Each still fails safe: pg_restore --single-transaction rolls back and the copy exits ENGINE_STEP_FAILED. But the preflight's point is to say why before dumping, and the operator gets a raw restore error instead.
- Array types of an extension type. The
pg_dependwalk inengine/ansible/roles/cloudfall_data_migration/defaults/main.ymlmisses acitext[]column: the array type isn't a direct member of the extension, socitextis neither reported underextensionsnor passed topg_dump --extension. - An extension installed in an unselected schema. Supabase installs extensions in schema
extensions. Copying--source-schema publicdumpsCREATE EXTENSION ... WITH SCHEMA extensions, which fails on a target without that schema. The preflight doesn't detect it. auth.references beyond functions and policies. A foreign key toauth.users, a columnDEFAULT auth.uid(), and a view callingauth.aren't named underauthReferences.
Not reproduced on a live server (no PostgreSQL in the review environment); read from the queries and PostgreSQL's catalog rules.
Items 1 and 2 are bugs in the preflight S-007-7 describes. Item 3 widens authReferences beyond what S-007 names, so it needs a spec change first.
Related: #82, #125, spec docs/specs/007-data-copy-schemas.md.
Activity
shipmill-romamo commentedon Oct 30, 2026
Triage: implement, item 1 only.
Item 1 is a bug in what S-007-7 already specifies: "need" means an object in a selected schema depends on the extension in
pg_depend, and acitext[]column does, one step removed (column → array type →citexttype → extension). Checked on main (745c129): the query inengine/ansible/roles/cloudfall_data_migration/defaults/main.ymlreads only direct members of the extension.The plan:
pg_type.typelemfor atypcategory = 'A'type) before matching the extension's members, in both theextensionsfinding and the list passed topg_dump --extensiontypbasetype) is the same shape; cover it in the same walkcitext[]column namescitext, as the S-007-7 tests do (no live PostgreSQL in CI)Items 2 and 3 change what S-007 specifies (a new kind of finding, and
authReferencesbeyond functions and policies), so they moved to #175, which goes to product intake. I'll link the PR here.shipmill-romamo commentedon Oct 30, 2026
The fix is in #176: the preflight follows each type a selected object uses through array element types and domain base types (chains included) before matching the extension that owns it, in the one query that feeds both
extensionsandpg_dump --extension. Acitext[]column, or a domain overcitext, now namescitext.Checked on a throwaway PostgreSQL 16.2 with
vectorstanding in forcitext(the build had no contrib): main returned no extension for array, domain, domain-of-domain and array-of-domain columns, the branch named it for all four.citextitself and other PostgreSQL versions are unverified. This issue closes when #176 merges.shipmill-romamo commentedon Oct 30, 2026
Released in v0.8.0rc12 (pre-release).
A plain install gets it with the next stable release.
If you filed this: react 👍 on this comment once it works for you, or reply if it doesn't.