omen 0.8.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50e0ccd4a4b0c3fa358e235be39a5e79b53fabbcb4e05c09424508cab6be99f9
-  data.tar.gz: 4c4de5e474629c685455a599469c33caff9ae1e646dd331752313bf8c2e00020
+  metadata.gz: 9698c59cc037f0a9ccbe6b100af4a7137df0d26c8a54b3a8e5c37e9effe5e5e6
+  data.tar.gz: 792f03229094807c6ca995cc1271a199cc158db1f54ecfebee4a3e5db242712d
 SHA512:
-  metadata.gz: 5158631649bc16dbeffbd630ba07303880657e30dd0c15ccba1ebde0a66317985caff827dfa423259d71091f74bf835634fa029050cd554917427784f9ef766e
-  data.tar.gz: 91910028f557c76263c24b7c664aca12e6e89a8f5c009e605e4fd3563f1c39a8bbd35672dc24c3529c800a689b5c62a09a572e3e5e01f5072232ee8acf98db03
+  metadata.gz: 4395ce363d33978256ce75d72d6495c873af06299c140f0a61bf0fc637bda94bde5cbb129744447a01b6603ebbcaf4fb5567920d3a32c859ba86c097ef206354
+  data.tar.gz: 8f5c0384edd2be88dcaacb5a60cb9256c4f8c2139a5fcb351a7eae9fce3ff5619bf5403a919c9ebb6e61fe64103c94bcc80a58d9f656552568862f34ac6f8e9c

data/CHANGELOG.md

@@ -5,6 +5,27 @@ All notable changes to this project will be documented in this file.
 For more information about changelogs, check [Keep a Changelog](http://keepachangelog.com) and
 [Vandamme](http://tech-angels.github.io/vandamme).
 
+## 0.10.1 - 2026-10-14
+
+* [Change] The narrowed role is granted the connection's current schema rather than `public`,
+  so a host keeping its tables in a schema of its own -- sharing a database with another app,
+  each in a schema -- gets a role that reads its tables and no one else's. A host that never
+  set a search path reads `public` as before.
+
+## 0.9.0 - 2026-09-18
+
+* [Fix] An answer landing touches the reading it belongs to, so a page watching one refreshes
+  on the answer rather than on whichever status change the run happens to make around it. A
+  question already touched its reading, which is why a question appeared and its answer did not.
+* [Fix] Making an audience's role and letting members into it are two transactions, not one.
+  A managed database refuses to make a role at all, and a refusal takes its whole transaction
+  with it -- so the membership a role already there only needed was rolled back with the
+  refusal, and every statement run as it went on saying the app was misconfigured.
+* [Change] An audience whose Postgres role could not be made says so once and narrows nothing,
+  rather than failing table by table and then reporting the audience narrowed. A managed
+  database refuses `CREATE ROLE` to the app's own user, and the refusal used to arrive as a
+  screenful of `role does not exist` followed by a success line.
+
 ## 0.8.0 - 2026-09-16
 
 * [Feature] Make how a Postgres role is made safely public, so a host builds the read-only role

data/README.md

@@ -18,7 +18,7 @@ statement returned is ever sent back.
 In your `Gemfile`, pinned to the current minor while this is still below 1.0:
 
 ```ruby
-gem 'omen', '~> 0.6.0'
+gem 'omen', '~> 0.10.0'
 ```
 
 Then four commands:

data/app/models/omen/answer.rb

@@ -5,7 +5,10 @@ class Omen::Answer < Omen.config.record
   # A \uXXXX escape that outlived JSON.parse, because Claude escaped the backslash of its own.
   UNICODE_ESCAPE = /\\u([0-9a-fA-F]{4})/
 
-  belongs_to :question
+  # Touched, so that a reading whose answer has just landed says so: the reading is what
+  # broadcasts, and the row it broadcasts for is this one. Without it a page waits on the
+  # status the run happens to change around the answer rather than on the answer itself.
+  belongs_to :question, touch: true
 
   # @return [String] the side of the conversation this was said on, in the words the API uses.
   def role = 'assistant'

data/lib/omen/bound.rb

@@ -9,7 +9,7 @@ module Omen
       SELECT p.tablename, p.policyname, r.rolname FROM pg_policies p
         CROSS JOIN LATERAL unnest(p.roles) AS named(rolname)
         JOIN pg_roles r ON pg_has_role(r.oid, named.rolname::regrole::oid, 'USAGE')
-       WHERE p.permissive = 'RESTRICTIVE' AND p.schemaname = 'public' AND NOT r.rolsuper
+       WHERE p.permissive = 'RESTRICTIVE' AND p.schemaname = current_schema() AND NOT r.rolsuper
        ORDER BY p.tablename, p.policyname, r.rolname
     SQL
 

data/lib/omen/grants.rb

@@ -17,12 +17,13 @@ module Omen
     # @return [Array<String>] the statements to run, in order.
     def self.statements(connection, members)
       role = connection.quote_table_name Omen.config.narrow_role
+      read = schema connection
       [
         *made(connection, Omen.config.narrow_role),
         *members.map { |member| "GRANT #{role} TO #{connection.quote_table_name member}" },
-        "GRANT USAGE ON SCHEMA public TO #{role}",
-        "GRANT SELECT ON ALL TABLES IN SCHEMA public TO #{role}",
-        "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO #{role}",
+        "GRANT USAGE ON SCHEMA #{read} TO #{role}",
+        "GRANT SELECT ON ALL TABLES IN SCHEMA #{read} TO #{role}",
+        "ALTER DEFAULT PRIVILEGES IN SCHEMA #{read} GRANT SELECT ON TABLES TO #{role}",
         *revoked(connection, role),
         *Omen::Renamed.statements,
         *Omen::TimeZone.statements(connection),
@@ -30,8 +31,10 @@ module Omen
       ]
     end
 
-    # The same role, made for one audience rather than for every table: it is granted nothing
-    # here, since a narrowing names the tables and the columns of each itself.
+    # Who may enter the role, and the schema it reads in. Kept apart from making the role: a
+    # managed database refuses to make one at all, and a refusal takes its whole transaction
+    # with it -- so membership granted in the same breath would be lost to a role that was
+    # already there and only needed letting into.
     # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
     # @param name [String] the role to make.
     # @param members [Array<String>] the roles that may enter it, none of them inheriting it.
@@ -39,12 +42,16 @@ module Omen
     def self.narrowed(connection, name, members)
       role = connection.quote_table_name name
       [
-        *made(connection, name),
         *members.map { |member| apart role, connection.quote_table_name(member) },
-        "GRANT USAGE ON SCHEMA public TO #{role}",
+        "GRANT USAGE ON SCHEMA #{schema connection} TO #{role}",
       ]
     end
 
+    # The schema a host keeps its tables in: the first of its search path, `public` by default.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [String] its name, quoted.
+    def self.schema(connection) = connection.quote_table_name connection.current_schema
+
     # @param role [String] the role, quoted.
     # @param member [String] the role that may enter it, quoted.
     # @return [String] the statement that lets it in without handing it what the role holds.

data/lib/omen/inquirer.rb

@@ -14,6 +14,13 @@ module Omen
     UNMADE = 'Could not make %{role}, so every reading will say this app is misconfigured. Ask ' \
              'for that role, NOLOGIN, granted SELECT on every table but %{tables}.'
 
+    # Said where an audience's own role could not be made. Its tables are then granted to
+    # nobody and no policy stands over them, so every reading of that audience says the app is
+    # misconfigured -- and every statement after the refusal fails for the same reason, which
+    # is one message worth saying and a screenful worth not.
+    UNNARROWED = 'Could not make %{role}, so nothing was narrowed to it and every reading of ' \
+                 'that audience will say this app is misconfigured. Ask for that role, NOLOGIN.'
+
     # Said where a role that already existed is one a reading should not be able to reach through.
     DANGEROUS = '%{role} holds %{held}. This gem cannot take that away without being a superuser ' \
                 'itself, so ask for it to be taken away.'
@@ -58,10 +65,24 @@ module Omen
     # @param members [Array<String>] the roles that may enter a narrowed one.
     # @return [void]
     def self.narrow(connection, members)
-      Omen::Reading.narrowings.each do |narrowing|
-        narrowing.statements(connection, members).each { |group| Omen.attempted connection, *group }
-        puts "Narrowed #{narrowing.role} to the rows #{narrowing.setting} names"
-      end
+      Omen::Reading.narrowings.each { |narrowing| narrowed connection, narrowing, members }
+    end
+
+    # One audience: its role made first and asked for straight after, since everything else
+    # here names that role and a database that would not make it refuses the lot. Nothing is
+    # said to have been narrowed where nothing was.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param narrowing [Omen::Narrowing] the audience to write.
+    # @param members [Array<String>] the roles that may enter its role.
+    # @return [void]
+    def self.narrowed(connection, narrowing, members)
+      making, *holding = narrowing.statements(connection, members)
+      Omen.attempted connection, *making
+      return warn UNNARROWED % { role: narrowing.role } unless
+        Attributes.exists? connection, narrowing.role
+
+      holding.each { |group| Omen.attempted connection, *group }
+      puts "Narrowed #{narrowing.role} to the rows #{narrowing.setting} names"
     end
 
     # Discovered rather than named: SET LOCAL ROLE needs the connecting role to be a member of

data/lib/omen/narrowing.rb

@@ -37,7 +37,8 @@ module Omen
     # @return [Array<Array<String>>] the statements, grouped: what arrives together is applied
     #   together, so no table is left with row level security on and no policy under it.
     def statements(connection, members)
-      [ Grants.narrowed(connection, @role, members),
+      [ Grants.made(connection, @role),
+        Grants.narrowed(connection, @role, members),
         *@whole.map { |table| granted connection, table },
         *@own.map { |table, own| narrowed connection, table, own }, ]
     end

data/lib/omen/version.rb

@@ -1,4 +1,4 @@
 module Omen
   # The version of this gem, as RubyGems knows it.
-  VERSION = '0.8.0'
+  VERSION = '0.10.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omen
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Claudio Baccigalupo
@@ -146,7 +146,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ask Claude about your own data
 test_files: []