omen 0.3.0 → 0.3.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 529ccf31849252011c372776067dfb887267dea3b8e1580a0dbb598bab0afa56
-  data.tar.gz: 7a9bb4e0ebd22451484b508b1a96e5f2ba85fcc92fcaaf62cd1f433b683b6ef5
+  metadata.gz: f96e34cbde627e0781a12488ba4308d704c6896a71fc44b031b7d412512c22eb
+  data.tar.gz: 408ad7c0b4a13f8ef3aef1b1c271e81ac116791ff627ffa2d056f5ecb6c45e34
 SHA512:
-  metadata.gz: b9d59820ced246e19969a0ff0dbea02b29feb1bc85be637522066ec49d3a15b8e11c83d0aca97397a05235ab1cd7413dc3553bba3b8d17102933fae40c18d549
-  data.tar.gz: bdcda330b4d7e03ef0b1fa6e2586b8c35dee10101af54600e5cdde47ca1f23b0ed06825e59b3d43ce7559f906aab03de186a2ae75d19396bfae8e481e6670a0e
+  metadata.gz: fd53d5b7acb9fea6560bf0edbd5e1fb8f26200d99edaa52dfd9a81c9945dbd154a69514a7ba0028a025f36284bbd04be01e7aa57df61b7c01fa68ceb974638fd
+  data.tar.gz: a5b4226127e861f2600ebf62eb1d0c10ae2921886caf8e27b8041b411ac1b904c5e3406a0265f11e1f4c54a80ae9fa33994f396ec9adbc0df74c57b2304946df

data/CHANGELOG.md

@@ -7,6 +7,14 @@ For more information about changelogs, check [Keep a Changelog](http://keepachan
 
 ## [Unreleased]
 
+## 0.3.1 - 2026-08-24
+
+* [Fix] Stop asserting the role attributes only a superuser may set, since `NOSUPERUSER`,
+  `NOBYPASSRLS` and `NOREPLICATION` are refused outright by every managed database -- a role is
+  created without them anyway, so they are read back and warned about rather than set
+* [Fix] Run each statement of the grant in a savepoint of its own, so one a database refuses no
+  longer discards the grants, the revocations and both functions behind it
+
 ## 0.3.0 - 2026-08-24
 
 * [Feature] Create a `miles_between(lat1, lng1, lat2, lng2)` function and name it in the prompt,

data/README.md

@@ -147,6 +147,10 @@ usually does — the role is made by hand and the revocation with it:
 REVOKE SELECT ON omen_readings, omen_questions, omen_answers FROM omen_inquirer;
 ```
 
+A managed database also refuses `ALTER ROLE ... NOSUPERUSER`, since only a superuser may say it.
+Omen skips that statement and carries on rather than stopping, then reads the role back and says
+so if it holds `SUPERUSER`, `BYPASSRLS` or `REPLICATION` -- which a role it created never does.
+
 A missed table there means Claude is shown the log of every question ever asked.
 
 ## License

data/lib/omen/attributes.rb

@@ -0,0 +1,35 @@
+module Omen
+  # What the role a statement runs as may and may not be. A role is created with every dangerous
+  # attribute already off, so this gem sets only what whoever created it may set, and reads the
+  # rest back rather than asserting them: saying `NOSUPERUSER` needs the SUPERUSER attribute, so
+  # a managed database refuses the very statement that would have made the role safe.
+  module Attributes
+    # Set on the role, because whoever may create a role may set these.
+    SETTABLE = 'NOLOGIN NOCREATEDB NOCREATEROLE'
+
+    # Read back instead, since saying no to one of these needs the attribute itself.
+    DANGEROUS = { rolsuper: 'SUPERUSER', rolbypassrls: 'BYPASSRLS',
+                  rolreplication: 'REPLICATION', }
+
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [Boolean] whether the role is there at all to be granted anything.
+    def self.exists?(connection) = held(connection).present?
+
+    # Nil where there is no such role, so that an empty list and a missing role read apart.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [Hash, nil] the row of what the role is, or nothing where the role is not.
+    def self.held(connection)
+      connection.select_one <<~SQL.squish
+        SELECT #{DANGEROUS.keys.join ', '} FROM pg_roles
+        WHERE rolname = #{connection.quote Omen.config.narrow_role}
+      SQL
+    end
+
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [Array<String>] what the role holds that no reading should be able to reach.
+    def self.dangerous(connection)
+      row = held(connection) || {}
+      DANGEROUS.filter_map { |column, name| name if row[column.to_s] }
+    end
+  end
+end

data/lib/omen/grants.rb

@@ -0,0 +1,39 @@
+module Omen
+  # Everything said to a database to make the role a statement runs as: what it may be, what it
+  # may read, and what it may not. Kept apart from the task that runs them, which is about a
+  # database it has to find and a refusal it has to survive rather than about privileges.
+  module Grants
+    # DDL, which Active Record has no expression for, and not a query.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param members [Array<String>] the roles that may SET LOCAL ROLE to this one. The owner
+    #   running the task is one of them, and matters in tests, where Rails swaps the reading
+    #   pool for the writing one and the test connection is the owner.
+    # @return [Array<String>] the statements to run, in order.
+    def self.statements(connection, members)
+      role = connection.quote_table_name Omen.config.narrow_role
+      [
+        'DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ' \
+          "#{connection.quote Omen.config.narrow_role}) THEN CREATE ROLE #{role} NOLOGIN; " \
+          'END IF; END $$',
+        "ALTER ROLE #{role} WITH #{Attributes::SETTABLE}",
+        "GRANT USAGE ON SCHEMA public TO #{role}",
+        "GRANT SELECT ON ALL TABLES IN SCHEMA public TO #{role}",
+        "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO #{role}",
+        *members.map { |member| "GRANT #{role} TO #{connection.quote_table_name member}" },
+        *revoked(connection, role),
+        *Omen::Eastern.statements(connection),
+        *Omen::Distance.statements(connection),
+      ]
+    end
+
+    # Intersected, so a bare db:create with no table yet to revoke on is not a failure.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param role [String] the role to hide this feature's own tables from.
+    # @return [Array<String>] one REVOKE per table there is.
+    def self.revoked(connection, role)
+      (connection.tables & Omen.tables).map do |table|
+        "REVOKE SELECT ON #{connection.quote_table_name table} FROM #{role}"
+      end
+    end
+  end
+end

data/lib/omen/inquirer.rb

@@ -3,9 +3,6 @@ module Omen
   # It needs no database.yml entry of its own: NOLOGIN, it is a privilege container reached
   # with SET LOCAL ROLE and never connected as.
   module Inquirer
-    # What this role may never be: a superuser bypasses GRANT outright.
-    ATTRIBUTES = 'NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS NOREPLICATION'
-
     # Whom to ask, since the role a host reads through is one this gem has no name for.
     WHOEVER = 'SELECT current_user'
 
@@ -13,6 +10,18 @@ module Omen
     UNGRANTED = 'No %{role} connection is configured, so nothing was granted to whatever ' \
                 'reads through it. Run this again once config/database.yml names one.'
 
+    # Said where the role could not be made: a managed database never grants CREATEROLE.
+    UNMADE = 'Could not make %{role}, so every reading will say this app is misconfigured. Ask ' \
+             'for that role, NOLOGIN, granted SELECT on every table but %{tables}.'
+
+    # Said per statement, since the grants, the revocations and the functions need nothing from
+    # one another and one refusal should not discard the rest.
+    REFUSED = 'Skipped, refused by the database: %{statement} (%{error})'
+
+    # Said where a role that already existed is one a reading should not be able to reach through.
+    DANGEROUS = '%{role} holds %{held}. This gem cannot take that away without being a superuser ' \
+                'itself, so ask for it to be taken away.'
+
     # Creates the role and the function, on every database this environment prepares.
     # @return [void]
     def self.grant
@@ -37,12 +46,26 @@ module Omen
       read_by = reader
       warn UNGRANTED % { role: Omen.config.reading_role } unless read_by
       members = [ read_by, connection.select_value(WHOEVER) ].compact
-      statements(connection, members).each { |statement| connection.execute statement }
-      puts "Granted SELECT on #{connection.current_database} to #{Omen.config.narrow_role}"
+      Grants.statements(connection, members).each { |statement| attempted connection, statement }
+      role = Omen.config.narrow_role
+      return warn UNMADE % { role: role, tables: Omen.tables.to_sentence } unless
+        Attributes.exists? connection
+
+      held = Attributes.dangerous connection
+      warn DANGEROUS % { role: role, held: held.to_sentence } if held.any?
+      puts "Granted SELECT on #{connection.current_database} to #{role}"
+    end
+
+    # One statement at a time, so a database that refuses one still runs the others -- and each
+    # inside a savepoint of its own, since a refusal inside a transaction refuses everything
+    # after it too, and this task is as likely to be run from a console as from a deploy.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param statement [String] one of the statements Omen::Grants builds.
+    # @return [void]
+    def self.attempted(connection, statement)
+      connection.transaction(requires_new: true) { connection.execute statement }
     rescue ActiveRecord::StatementInvalid => error
-      warn "Could not make #{Omen.config.narrow_role}, so every reading will say this app is " \
-           'misconfigured. Ask for that role, NOLOGIN, granted SELECT on every table but ' \
-           "#{Omen.tables.to_sentence}: #{error.message}"
+      warn REFUSED % { statement: statement.squish, error: error.message.lines.first.strip }
     end
 
     # Discovered rather than named: SET LOCAL ROLE needs the connecting role to be a member of
@@ -55,38 +78,5 @@ module Omen
     rescue ActiveRecord::ConnectionNotDefined, ActiveRecord::ConnectionNotEstablished
       nil
     end
-
-    # DDL, which Active Record has no expression for, and not a query.
-    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
-    # @param members [Array<String>] the roles that may SET LOCAL ROLE to this one. The owner
-    #   running the task is one of them, and matters in tests, where Rails swaps the reading
-    #   pool for the writing one and the test connection is the owner.
-    # @return [Array<String>] the statements to run, in order.
-    def self.statements(connection, members)
-      role = connection.quote_table_name Omen.config.narrow_role
-      [
-        'DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ' \
-          "#{connection.quote Omen.config.narrow_role}) THEN CREATE ROLE #{role} NOLOGIN; " \
-          'END IF; END $$',
-        "ALTER ROLE #{role} WITH NOLOGIN #{ATTRIBUTES}",
-        "GRANT USAGE ON SCHEMA public TO #{role}",
-        "GRANT SELECT ON ALL TABLES IN SCHEMA public TO #{role}",
-        "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO #{role}",
-        *members.map { |member| "GRANT #{role} TO #{connection.quote_table_name member}" },
-        *revoked(connection, role),
-        *Eastern.statements(connection),
-        *Distance.statements(connection),
-      ]
-    end
-
-    # Intersected, so a bare db:create with no table yet to revoke on is not a failure.
-    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
-    # @param role [String] the role to hide this feature's own tables from.
-    # @return [Array<String>] one REVOKE per table there is.
-    def self.revoked(connection, role)
-      (connection.tables & Omen.tables).map do |table|
-        "REVOKE SELECT ON #{connection.quote_table_name table} FROM #{role}"
-      end
-    end
   end
 end

data/lib/omen/version.rb

@@ -1,4 +1,4 @@
 module Omen
   # The version of this gem, as RubyGems knows it.
-  VERSION = '0.3.0'
+  VERSION = '0.3.1'
 end

data/lib/omen.rb

@@ -1,9 +1,11 @@
 require 'active_job/performs'
 require 'anthropic'
 
+require 'omen/attributes'
 require 'omen/config'
 require 'omen/distance'
 require 'omen/eastern'
+require 'omen/grants'
 require 'omen/inquirer'
 require 'omen/requirements'
 require 'omen/version'

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omen
 version: !ruby/object:Gem::Version
-  version: 0.3.0
+  version: 0.3.1
 platform: ruby
 authors:
 - Claudio Baccigalupo
@@ -97,10 +97,12 @@ files:
 - lib/generators/omen/install/install_generator.rb
 - lib/generators/omen/install/templates/omen.rb
 - lib/omen.rb
+- lib/omen/attributes.rb
 - lib/omen/config.rb
 - lib/omen/distance.rb
 - lib/omen/eastern.rb
 - lib/omen/engine.rb
+- lib/omen/grants.rb
 - lib/omen/inquirer.rb
 - lib/omen/requirements.rb
 - lib/omen/stubs.rb