feat: multiple versions for the vault extension

flake.nix

@@ -1382,6 +1382,8 @@
           inherit (basePackages) wal-g-2 wal-g-3 dbmate-tool pg_regress;
         } // pkgs.lib.optionalAttrs (system == "aarch64-linux") {
           inherit (basePackages) postgresql_15_debug postgresql_15_src postgresql_orioledb-17_debug postgresql_orioledb-17_src postgresql_17_debug postgresql_17_src;
+        } // pkgs.lib.optionalAttrs (system == "x86_64-linux") {
+          vault = import ./nix/ext/tests/vault.nix { inherit self; inherit pkgs; };
         };
 
         # Apps is a list of names of things that can be executed with 'nix run';

nix/ext/tests/vault.nix

@@ -0,0 +1,161 @@
+{ self, pkgs }:
+let
+  pname = "supabase_vault";
+  inherit (pkgs) lib;
+  installedExtension =
+    postgresMajorVersion: self.packages.${pkgs.system}."psql_${postgresMajorVersion}/exts/${pname}-all";
+  versions = postgresqlMajorVersion: (installedExtension postgresqlMajorVersion).versions;
+  postgresqlWithExtension =
+    postgresql:
+    let
+      majorVersion = lib.versions.major postgresql.version;
+      pkg = pkgs.buildEnv {
+        name = "postgresql-${majorVersion}-${pname}";
+        paths = [
+          postgresql
+          postgresql.lib
+          (installedExtension majorVersion)
+          self.packages.${pkgs.system}."psql_${majorVersion}/exts/pgsodium" # dependency
+        ];
+        passthru = {
+          inherit (postgresql) version psqlSchema;
+          lib = pkg;
+          withPackages = _: pkg;
+        };
+        nativeBuildInputs = [ pkgs.makeWrapper ];
+        pathsToLink = [
+          "/"
+          "/bin"
+          "/lib"
+        ];
+        postBuild = ''
+          wrapProgram $out/bin/postgres --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_ctl --set NIX_PGLIBDIR $out/lib
+          wrapProgram $out/bin/pg_upgrade --set NIX_PGLIBDIR $out/lib
+        '';
+      };
+    in
+    pkg;
+  vaultGetKey = lib.getExe (
+    pkgs.writeShellScriptBin "vault-getkey" ''
+      echo 0000000000000000000000000000000000000000000000000000000000000000
+    ''
+  );
+in
+self.inputs.nixpkgs.lib.nixos.runTest {
+  name = pname;
+  hostPkgs = pkgs;
+  nodes.server =
+    { config, ... }:
+    {
+      virtualisation = {
+        forwardPorts = [
+          {
+            from = "host";
+            host.port = 13022;
+            guest.port = 22;
+          }
+        ];
+      };
+
+      services.postgresql = {
+        enable = true;
+        package = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+        settings = {
+          "shared_preload_libraries" = "${pname},pgsodium";
+          "pgsodium.getkey_script" = vaultGetKey;
+          "vault.getkey_script" = vaultGetKey;
+        };
+      };
+
+      specialisation.postgresql17.configuration = {
+        services.postgresql = {
+          package = lib.mkForce (postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17);
+        };
+
+        systemd.services.postgresql-migrate = {
+          serviceConfig = {
+            Type = "oneshot";
+            RemainAfterExit = true;
+            User = "postgres";
+            Group = "postgres";
+            StateDirectory = "postgresql";
+            WorkingDirectory = "${builtins.dirOf config.services.postgresql.dataDir}";
+          };
+          script =
+            let
+              oldPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_15;
+              newPostgresql = postgresqlWithExtension self.packages.${pkgs.system}.postgresql_17;
+              oldDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${oldPostgresql.psqlSchema}";
+              newDataDir = "${builtins.dirOf config.services.postgresql.dataDir}/${newPostgresql.psqlSchema}";
+            in
+            ''
+              if [[ ! -d ${newDataDir} ]]; then
+                install -d -m 0700 -o postgres -g postgres "${newDataDir}"
+                ${newPostgresql}/bin/initdb -D "${newDataDir}"
+                echo "shared_preload_libraries = '${pname},pgsodium'" >> "${newDataDir}/postgresql.conf"
+                echo "vault.getkey_script = '${vaultGetKey}'" >> "${newDataDir}/postgresql.conf";
+                echo "pgsodium.getkey_script = '${vaultGetKey}'" >> "${newDataDir}/postgresql.conf";
+                ${newPostgresql}/bin/pg_upgrade --old-datadir "${oldDataDir}" --new-datadir "${newDataDir}" \
+                  --old-bindir "${oldPostgresql}/bin" --new-bindir "${newPostgresql}/bin"
+              else
+                echo "${newDataDir} already exists"
+              fi
+            '';
+        };
+
+        systemd.services.postgresql = {
+          after = [ "postgresql-migrate.service" ];
+          requires = [ "postgresql-migrate.service" ];
+        };
+      };
+
+    };
+  testScript =
+    { nodes, ... }:
+    let
+      pg17-configuration = "${nodes.server.system.build.toplevel}/specialisation/postgresql17";
+    in
+    ''
+      versions = {
+        "15": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "15"))}],
+        "17": [${lib.concatStringsSep ", " (map (s: ''"${s}"'') (versions "17"))}],
+      }
+
+      def run_sql(query):
+        return server.succeed(f"""sudo -u postgres psql -t -A -F\",\" -c \"{query}\" """).strip()
+
+      def check_upgrade_path(pg_version):
+        with subtest("Check ${pname} upgrade path"):
+          firstVersion = versions[pg_version][0]
+          server.succeed("sudo -u postgres psql -c 'DROP EXTENSION IF EXISTS ${pname};'")
+          run_sql(f"""CREATE EXTENSION ${pname} WITH VERSION '{firstVersion}' CASCADE;""")
+          installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+          assert installed_version == firstVersion, f"Expected ${pname} version {firstVersion}, but found {installed_version}"
+          for version in versions[pg_version][1:]:
+            run_sql(f"""ALTER EXTENSION ${pname} UPDATE TO '{version}';""")
+            installed_version = run_sql(r"""SELECT extversion FROM pg_extension WHERE extname = '${pname}';""")
+            assert installed_version == version, f"Expected ${pname} version {version}, but found {installed_version}"
+
+      start_all()
+
+      server.wait_for_unit("multi-user.target")
+      server.wait_for_unit("postgresql.service")
+
+      check_upgrade_path("15")
+
+      with subtest("Check ${pname} latest extension version"):
+        server.succeed("sudo -u postgres psql -c 'DROP EXTENSION ${pname};'")
+        server.succeed("sudo -u postgres psql -c 'CREATE EXTENSION ${pname} CASCADE;'")
+        installed_extensions=run_sql(r"""SELECT extname, extversion FROM pg_extension;""")
+        latestVersion = versions["15"][-1]
+        assert f"${pname},{latestVersion}" in installed_extensions
+
+      with subtest("switch to postgresql 17"):
+        server.succeed(
+          "${pg17-configuration}/bin/switch-to-configuration test >&2"
+        )
+
+      check_upgrade_path("17")
+    '';
+}

nix/ext/vault.nix

@@ -1,30 +1,83 @@
-{ lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+{ pkgs, lib, stdenv, fetchFromGitHub, libsodium, postgresql }:
+let
+  pname = "supabase_vault";
 
-stdenv.mkDerivation rec {
-  pname = "vault";
-  version = "0.3.1";
+  # Load version configuration from external file
+  allVersions = (builtins.fromJSON (builtins.readFile ./versions.json)).${pname};
 
-  buildInputs = [ libsodium postgresql ];
+  # Filter versions compatible with current PostgreSQL version
+  supportedVersions = lib.filterAttrs (
+    _: value: builtins.elem (lib.versions.major postgresql.version) value.postgresql
+  ) allVersions;
 
-  src = fetchFromGitHub {
-    owner = "supabase";
-    repo = pname;
-    rev = "refs/tags/v${version}";
-    hash = "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30=";
-  };
+  # Derived version information
+  versions = lib.naturalSort (lib.attrNames supportedVersions);
+  latestVersion = lib.last versions;
+  numberOfVersions = builtins.length versions;
+  packages = builtins.attrValues (
+    lib.mapAttrs (name: value: build name value.hash) supportedVersions
+  );
+
+  # Build function for individual pgsodium versions
+  build =
+    version: hash:
+
+    stdenv.mkDerivation rec {
+      inherit pname version;
+
+      buildInputs = [ libsodium postgresql ];
+
+      src = fetchFromGitHub {
+        owner = "supabase";
+        repo = "vault";
+        rev = "refs/tags/v${version}";
+        inherit hash;
+      };
+
+      installPhase = ''
+        mkdir -p $out/{lib,share/postgresql/extension}
+
+
+        # Create version-specific control file
+        sed -e "/^default_version =/d" \
+            -e "s|^module_pathname = .*|module_pathname = '\$libdir/${pname}'|" \
+          ${pname}.control > $out/share/postgresql/extension/${pname}--${version}.control
+
+      '' + lib.optionalString (builtins.compareVersions "0.2.8" version < 0) ''
+        # Install shared library with version suffix
+        mv ${pname}${postgresql.dlSuffix} $out/lib/${pname}-${version}${postgresql.dlSuffix}
 
-  installPhase = ''
-    mkdir -p $out/{lib,share/postgresql/extension}
+        # For the latest version, copy the sql files
+        if [[ "${version}" == "${latestVersion}" ]]; then
+          install -D -t $out/share/postgresql/extension sql/*.sql
+            {
+              echo "default_version = '${latestVersion}'"
+              cat $out/share/postgresql/extension/${pname}--${latestVersion}.control
+            } > $out/share/postgresql/extension/${pname}.control
+        fi
+        ln -sfn ${pname}-${latestVersion}${postgresql.dlSuffix} $out/lib/${pname}${postgresql.dlSuffix}
+      '';
 
-    install -D *${postgresql.dlSuffix} $out/lib
-    install -D -t $out/share/postgresql/extension sql/*.sql
-    install -D -t $out/share/postgresql/extension *.control
-  '';
+      meta = with lib; {
+        description = "Store encrypted secrets in PostgreSQL";
+        homepage = "https://github.com/supabase/${pname}";
+        platforms = postgresql.meta.platforms;
+        license = licenses.postgresql;
+      };
+    };
+in
+pkgs.buildEnv {
+  name = pname;
+  paths = packages;
+  pathsToLink = [
+    "/lib"
+    "/share/postgresql/extension"
+  ];
 
-  meta = with lib; {
-    description = "Store encrypted secrets in PostgreSQL";
-    homepage = "https://github.com/supabase/${pname}";
-    platforms = postgresql.meta.platforms;
-    license = licenses.postgresql;
+  passthru = {
+    inherit versions numberOfVersions;
+    pname = "${pname}-all";
+    version =
+      "multi-" + lib.concatStringsSep "-" (map (v: lib.replaceStrings [ "." ] [ "-" ] v) versions);
   };
 }

nix/ext/versions.json

@@ -0,0 +1,18 @@
+{
+  "supabase_vault": {
+    "0.2.8": {
+      "postgresql": [
+        "15",
+        "17"
+      ],
+      "hash": "sha256-+QBd4/wj1n33ynt7Gopr6g3xT+TLJ9jMhLffdYeRy4k="
+    },
+    "0.3.1": {
+      "postgresql": [
+        "15",
+        "17"
+      ],
+      "hash": "sha256-MC87bqgtynnDhmNZAu96jvfCpsGDCPB0g5TZfRQHd30="
+    }
+  }
+}