omen 0.9.0 → 0.10.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c51ab71a4d3ccce3f1bdcfa1e6f4b6a8196e2778f55368e7dea902e220f367d4
-  data.tar.gz: '003328f8dcba05fe6654e1852b8c9c18ef5e305d8c0ba95456b266c01880c546'
+  metadata.gz: 9698c59cc037f0a9ccbe6b100af4a7137df0d26c8a54b3a8e5c37e9effe5e5e6
+  data.tar.gz: 792f03229094807c6ca995cc1271a199cc158db1f54ecfebee4a3e5db242712d
 SHA512:
-  metadata.gz: 89a995c7beebd10a587d370ba7e8762f4e92a05252985045666101e64af81f10e5b7100631d670bd12ef89fe527fd4fc744f56918d26500268a39667311ee941
-  data.tar.gz: cf1a91b08d3e40e10d4a43a12872f2befad7cdefea114bbfe0e0e4eb78a8eb55076201ac8bf55e0bd2cd22d9a7ae3a4525367880d0a9622aa05a3d6f11e9062f
+  metadata.gz: 4395ce363d33978256ce75d72d6495c873af06299c140f0a61bf0fc637bda94bde5cbb129744447a01b6603ebbcaf4fb5567920d3a32c859ba86c097ef206354
+  data.tar.gz: 8f5c0384edd2be88dcaacb5a60cb9256c4f8c2139a5fcb351a7eae9fce3ff5619bf5403a919c9ebb6e61fe64103c94bcc80a58d9f656552568862f34ac6f8e9c

data/CHANGELOG.md

@@ -5,6 +5,13 @@ All notable changes to this project will be documented in this file.
 For more information about changelogs, check [Keep a Changelog](http://keepachangelog.com) and
 [Vandamme](http://tech-angels.github.io/vandamme).
 
+## 0.10.1 - 2026-10-14
+
+* [Change] The narrowed role is granted the connection's current schema rather than `public`,
+  so a host keeping its tables in a schema of its own -- sharing a database with another app,
+  each in a schema -- gets a role that reads its tables and no one else's. A host that never
+  set a search path reads `public` as before.
+
 ## 0.9.0 - 2026-09-18
 
 * [Fix] An answer landing touches the reading it belongs to, so a page watching one refreshes

data/README.md

@@ -18,7 +18,7 @@ statement returned is ever sent back.
 In your `Gemfile`, pinned to the current minor while this is still below 1.0:
 
 ```ruby
-gem 'omen', '~> 0.6.0'
+gem 'omen', '~> 0.10.0'
 ```
 
 Then four commands:

data/lib/omen/bound.rb

@@ -9,7 +9,7 @@ module Omen
       SELECT p.tablename, p.policyname, r.rolname FROM pg_policies p
         CROSS JOIN LATERAL unnest(p.roles) AS named(rolname)
         JOIN pg_roles r ON pg_has_role(r.oid, named.rolname::regrole::oid, 'USAGE')
-       WHERE p.permissive = 'RESTRICTIVE' AND p.schemaname = 'public' AND NOT r.rolsuper
+       WHERE p.permissive = 'RESTRICTIVE' AND p.schemaname = current_schema() AND NOT r.rolsuper
        ORDER BY p.tablename, p.policyname, r.rolname
     SQL
 

data/lib/omen/grants.rb

@@ -17,12 +17,13 @@ module Omen
     # @return [Array<String>] the statements to run, in order.
     def self.statements(connection, members)
       role = connection.quote_table_name Omen.config.narrow_role
+      read = schema connection
       [
         *made(connection, Omen.config.narrow_role),
         *members.map { |member| "GRANT #{role} TO #{connection.quote_table_name member}" },
-        "GRANT USAGE ON SCHEMA public TO #{role}",
-        "GRANT SELECT ON ALL TABLES IN SCHEMA public TO #{role}",
-        "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO #{role}",
+        "GRANT USAGE ON SCHEMA #{read} TO #{role}",
+        "GRANT SELECT ON ALL TABLES IN SCHEMA #{read} TO #{role}",
+        "ALTER DEFAULT PRIVILEGES IN SCHEMA #{read} GRANT SELECT ON TABLES TO #{role}",
         *revoked(connection, role),
         *Omen::Renamed.statements,
         *Omen::TimeZone.statements(connection),
@@ -42,10 +43,15 @@ module Omen
       role = connection.quote_table_name name
       [
         *members.map { |member| apart role, connection.quote_table_name(member) },
-        "GRANT USAGE ON SCHEMA public TO #{role}",
+        "GRANT USAGE ON SCHEMA #{schema connection} TO #{role}",
       ]
     end
 
+    # The schema a host keeps its tables in: the first of its search path, `public` by default.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @return [String] its name, quoted.
+    def self.schema(connection) = connection.quote_table_name connection.current_schema
+
     # @param role [String] the role, quoted.
     # @param member [String] the role that may enter it, quoted.
     # @return [String] the statement that lets it in without handing it what the role holds.

data/lib/omen/version.rb

@@ -1,4 +1,4 @@
 module Omen
   # The version of this gem, as RubyGems knows it.
-  VERSION = '0.9.0'
+  VERSION = '0.10.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omen
 version: !ruby/object:Gem::Version
-  version: 0.9.0
+  version: 0.10.1
 platform: ruby
 authors:
 - Claudio Baccigalupo
@@ -146,7 +146,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 4.0.3
+rubygems_version: 4.0.20
 specification_version: 4
 summary: Ask Claude about your own data
 test_files: []