fix: allow secret to be an empty string

.github/workflows/test.yml

@@ -1,12 +1,24 @@
 name: Tests
 
-on: push
+on:
+  pull_request:
+  push:
+    branches:
+      - main
 
 jobs:
-  tests:
+  test:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        pg-version: ['13', '14', '15', '16']
+
     steps:
-      - uses: actions/checkout@v2
-      - name: Run tests
-        run: |
-          ./test.sh 15
+    - uses: actions/checkout@v4
+    - uses: cachix/install-nix-action@v13
+      with:
+        nix_path: nixpkgs=channel:nixos-unstable
+    - name: Run tests
+      run: nix-shell --run "vault-with-pg-${{ matrix.pg-version }} make installcheck"
+    - if: ${{ failure() }}
+      run: cat regression.diffs

.gitignore

@@ -0,0 +1,6 @@
+results/
+regression.*
+*.o
+*.so
+*.bc
+*.dylib

LICENSE

@@ -1,3 +1,5 @@
+# Supabase Vault License
+
                                  Apache License
                            Version 2.0, January 2004
                         http://www.apache.org/licenses/
@@ -188,3 +190,52 @@
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
    limitations under the License.
+
+# pgsodium License
+
+Copyright (c) 2020 Michel Pelletier and Contributors
+
+Permission to use, copy, modify, and distribute this software and its
+documentation for any purpose, without fee, and without a written agreement
+is hereby granted, provided that the above copyright notice and this
+paragraph and the following two paragraphs appear in all copies.
+
+IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR
+DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
+LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
+DOCUMENTATION, EVEN IF THE UNIVERSITY OF CALIFORNIA HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
+PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.
+
+# libsodium-xchacha20-siv License
+
+BSD 2-Clause License
+
+Copyright (c) 2020-2024, Frank Denis
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

Makefile

@@ -1,5 +1,25 @@
+PG_CFLAGS = -std=c99 -Werror -Wno-declaration-after-statement
 EXTENSION = supabase_vault
+EXTVERSION = 0.3.1
+
 DATA = $(wildcard sql/*--*.sql)
+
+TESTS = $(wildcard test/sql/*.sql)
+REGRESS = $(patsubst test/sql/%.sql,%,$(TESTS))
+REGRESS_OPTS = --use-existing --inputdir=test
+
+MODULE_big = $(EXTENSION)
+OBJS = $(patsubst %.c,%.o,$(wildcard src/*.c))
+
+all: $(EXTENSION).control
+
+$(EXTENSION).control:
+	sed "s/@VAULT_VERSION@/$(EXTVERSION)/g" $(EXTENSION).control.in > $(EXTENSION).control
+
 PG_CONFIG = pg_config
+SHLIB_LINK = -lsodium
+
+PG_CPPFLAGS := $(CPPFLAGS) -DEXTVERSION=\"$(EXTVERSION)\"
+
 PGXS := $(shell $(PG_CONFIG) --pgxs)
 include $(PGXS)

nix/pgScript.nix

@@ -0,0 +1,12 @@
+{ postgresql, writeShellScriptBin } :
+
+let
+  ver = builtins.head (builtins.splitVersion postgresql.version);
+  src = builtins.readFile ./withTmpDb.sh.in;
+in
+(writeShellScriptBin "vault-with-pg-${ver}" src).overrideAttrs(old: {
+  buildCommand = ''
+    ${old.buildCommand}
+    substituteInPlace $out/bin/${old.name} --subst-var-by 'POSTGRESQL_PATH' '${postgresql}'
+  '';
+})

nix/pgsodium.nix

@@ -0,0 +1,31 @@
+{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+
+stdenv.mkDerivation rec {
+  pname = "pgsodium";
+  version = "3.1.8";
+
+  buildInputs = [ libsodium postgresql ];
+
+  src = fetchFromGitHub {
+    owner = "michelp";
+    repo = pname;
+    rev = "refs/tags/v${version}";
+    hash = "sha256-j5F1PPdwfQRbV8XJ8Mloi8FvZF0MTl4eyIJcBYQy1E4=";
+  };
+
+  installPhase = ''
+    mkdir -p $out/{lib,share/postgresql/extension}
+
+    install -D *${postgresql.dlSuffix}      $out/lib
+    install -D -t $out/share/postgresql/extension sql/*.sql
+    install -D -t $out/share/postgresql/extension *.control
+  '';
+
+  meta = with lib; {
+    description = "Modern cryptography for PostgreSQL";
+    homepage = "https://github.com/michelp/${pname}";
+    maintainers = with maintainers; [ samrose ];
+    platforms = postgresql.meta.platforms;
+    license = licenses.postgresql;
+  };
+}

nix/pgtap.nix

@@ -0,0 +1,33 @@
+{ lib, stdenv, fetchFromGitHub, postgresql, perl, perlPackages, which }:
+
+stdenv.mkDerivation rec {
+  pname = "pgtap";
+  version = "1.2.0";
+
+  src = fetchFromGitHub {
+    owner = "theory";
+    repo = "pgtap";
+    rev = "v${version}";
+    hash = "sha256-lb0PRffwo6J5a6Hqw1ggvn0cW7gPZ02OEcLPi9ineI8=";
+  };
+
+  nativeBuildInputs = [ postgresql perl perlPackages.TAPParserSourceHandlerpgTAP which ];
+
+  installPhase = ''
+    install -D {sql/pgtap--${version}.sql,pgtap.control} -t $out/share/postgresql/extension
+  '';
+
+  meta = with lib; {
+    description = "A unit testing framework for PostgreSQL";
+    longDescription = ''
+      pgTAP is a unit testing framework for PostgreSQL written in PL/pgSQL and PL/SQL.
+      It includes a comprehensive collection of TAP-emitting assertion functions,
+      as well as the ability to integrate with other TAP-emitting test frameworks.
+      It can also be used in the xUnit testing style.
+    '';
+    maintainers = with maintainers; [ samrose ];
+    homepage = "https://pgtap.org";
+    inherit (postgresql.meta) platforms;
+    license = licenses.mit;
+  };
+}

nix/postgresql/17.nix

@@ -0,0 +1,4 @@
+import ./generic.nix {
+  version = "17.0";
+  hash = "sha256-fidhMcD91rYliNutmzuyS4w0mNUAkyjbpZrxboGRCd4=";
+}

nix/postgresql/default.nix

@@ -0,0 +1,27 @@
+self:
+let
+  # Before removing an EOL major version, make sure to check the versioning policy in:
+  # <nixpkgs>/nixos/modules/services/databases/postgresql.md
+  #
+  # Before removing, make sure to update it to the last minor version - and if only in
+  # an immediately preceding commit. This allows people relying on that old major version
+  # for a bit longer to still update up to this commit to at least get the latest minor
+  # version. In other words: Do not remove the second-to-last minor version from nixpkgs,
+  # yet. Update first.
+  versions = {
+    postgresql_17 = ./17.nix;
+  };
+
+  mkAttributes = jitSupport:
+    self.lib.mapAttrs' (version: path:
+      let
+        attrName = if jitSupport then "${version}_jit" else version;
+      in
+      self.lib.nameValuePair attrName (import path {
+        inherit jitSupport self;
+      })
+    ) versions;
+
+in
+# variations without and with JIT
+(mkAttributes false) // (mkAttributes true)