omen 0.8.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 50e0ccd4a4b0c3fa358e235be39a5e79b53fabbcb4e05c09424508cab6be99f9
-  data.tar.gz: 4c4de5e474629c685455a599469c33caff9ae1e646dd331752313bf8c2e00020
+  metadata.gz: c51ab71a4d3ccce3f1bdcfa1e6f4b6a8196e2778f55368e7dea902e220f367d4
+  data.tar.gz: '003328f8dcba05fe6654e1852b8c9c18ef5e305d8c0ba95456b266c01880c546'
 SHA512:
-  metadata.gz: 5158631649bc16dbeffbd630ba07303880657e30dd0c15ccba1ebde0a66317985caff827dfa423259d71091f74bf835634fa029050cd554917427784f9ef766e
-  data.tar.gz: 91910028f557c76263c24b7c664aca12e6e89a8f5c009e605e4fd3563f1c39a8bbd35672dc24c3529c800a689b5c62a09a572e3e5e01f5072232ee8acf98db03
+  metadata.gz: 89a995c7beebd10a587d370ba7e8762f4e92a05252985045666101e64af81f10e5b7100631d670bd12ef89fe527fd4fc744f56918d26500268a39667311ee941
+  data.tar.gz: cf1a91b08d3e40e10d4a43a12872f2befad7cdefea114bbfe0e0e4eb78a8eb55076201ac8bf55e0bd2cd22d9a7ae3a4525367880d0a9622aa05a3d6f11e9062f

data/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 For more information about changelogs, check [Keep a Changelog](http://keepachangelog.com) and
 [Vandamme](http://tech-angels.github.io/vandamme).
 
+## 0.9.0 - 2026-09-18
+
+* [Fix] An answer landing touches the reading it belongs to, so a page watching one refreshes
+  on the answer rather than on whichever status change the run happens to make around it. A
+  question already touched its reading, which is why a question appeared and its answer did not.
+* [Fix] Making an audience's role and letting members into it are two transactions, not one.
+  A managed database refuses to make a role at all, and a refusal takes its whole transaction
+  with it -- so the membership a role already there only needed was rolled back with the
+  refusal, and every statement run as it went on saying the app was misconfigured.
+* [Change] An audience whose Postgres role could not be made says so once and narrows nothing,
+  rather than failing table by table and then reporting the audience narrowed. A managed
+  database refuses `CREATE ROLE` to the app's own user, and the refusal used to arrive as a
+  screenful of `role does not exist` followed by a success line.
+
 ## 0.8.0 - 2026-09-16
 
 * [Feature] Make how a Postgres role is made safely public, so a host builds the read-only role

data/app/models/omen/answer.rb

@@ -5,7 +5,10 @@ class Omen::Answer < Omen.config.record
   # A \uXXXX escape that outlived JSON.parse, because Claude escaped the backslash of its own.
   UNICODE_ESCAPE = /\\u([0-9a-fA-F]{4})/
 
-  belongs_to :question
+  # Touched, so that a reading whose answer has just landed says so: the reading is what
+  # broadcasts, and the row it broadcasts for is this one. Without it a page waits on the
+  # status the run happens to change around the answer rather than on the answer itself.
+  belongs_to :question, touch: true
 
   # @return [String] the side of the conversation this was said on, in the words the API uses.
   def role = 'assistant'

data/lib/omen/grants.rb

@@ -30,8 +30,10 @@ module Omen
       ]
     end
 
-    # The same role, made for one audience rather than for every table: it is granted nothing
-    # here, since a narrowing names the tables and the columns of each itself.
+    # Who may enter the role, and the schema it reads in. Kept apart from making the role: a
+    # managed database refuses to make one at all, and a refusal takes its whole transaction
+    # with it -- so membership granted in the same breath would be lost to a role that was
+    # already there and only needed letting into.
     # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
     # @param name [String] the role to make.
     # @param members [Array<String>] the roles that may enter it, none of them inheriting it.
@@ -39,7 +41,6 @@ module Omen
     def self.narrowed(connection, name, members)
       role = connection.quote_table_name name
       [
-        *made(connection, name),
         *members.map { |member| apart role, connection.quote_table_name(member) },
         "GRANT USAGE ON SCHEMA public TO #{role}",
       ]

data/lib/omen/inquirer.rb

@@ -14,6 +14,13 @@ module Omen
     UNMADE = 'Could not make %{role}, so every reading will say this app is misconfigured. Ask ' \
              'for that role, NOLOGIN, granted SELECT on every table but %{tables}.'
 
+    # Said where an audience's own role could not be made. Its tables are then granted to
+    # nobody and no policy stands over them, so every reading of that audience says the app is
+    # misconfigured -- and every statement after the refusal fails for the same reason, which
+    # is one message worth saying and a screenful worth not.
+    UNNARROWED = 'Could not make %{role}, so nothing was narrowed to it and every reading of ' \
+                 'that audience will say this app is misconfigured. Ask for that role, NOLOGIN.'
+
     # Said where a role that already existed is one a reading should not be able to reach through.
     DANGEROUS = '%{role} holds %{held}. This gem cannot take that away without being a superuser ' \
                 'itself, so ask for it to be taken away.'
@@ -58,10 +65,24 @@ module Omen
     # @param members [Array<String>] the roles that may enter a narrowed one.
     # @return [void]
     def self.narrow(connection, members)
-      Omen::Reading.narrowings.each do |narrowing|
-        narrowing.statements(connection, members).each { |group| Omen.attempted connection, *group }
-        puts "Narrowed #{narrowing.role} to the rows #{narrowing.setting} names"
-      end
+      Omen::Reading.narrowings.each { |narrowing| narrowed connection, narrowing, members }
+    end
+
+    # One audience: its role made first and asked for straight after, since everything else
+    # here names that role and a database that would not make it refuses the lot. Nothing is
+    # said to have been narrowed where nothing was.
+    # @param connection [ActiveRecord::ConnectionAdapters::AbstractAdapter] a writing one.
+    # @param narrowing [Omen::Narrowing] the audience to write.
+    # @param members [Array<String>] the roles that may enter its role.
+    # @return [void]
+    def self.narrowed(connection, narrowing, members)
+      making, *holding = narrowing.statements(connection, members)
+      Omen.attempted connection, *making
+      return warn UNNARROWED % { role: narrowing.role } unless
+        Attributes.exists? connection, narrowing.role
+
+      holding.each { |group| Omen.attempted connection, *group }
+      puts "Narrowed #{narrowing.role} to the rows #{narrowing.setting} names"
     end
 
     # Discovered rather than named: SET LOCAL ROLE needs the connecting role to be a member of

data/lib/omen/narrowing.rb

@@ -37,7 +37,8 @@ module Omen
     # @return [Array<Array<String>>] the statements, grouped: what arrives together is applied
     #   together, so no table is left with row level security on and no policy under it.
     def statements(connection, members)
-      [ Grants.narrowed(connection, @role, members),
+      [ Grants.made(connection, @role),
+        Grants.narrowed(connection, @role, members),
         *@whole.map { |table| granted connection, table },
         *@own.map { |table, own| narrowed connection, table, own }, ]
     end

data/lib/omen/version.rb

@@ -1,4 +1,4 @@
 module Omen
   # The version of this gem, as RubyGems knows it.
-  VERSION = '0.8.0'
+  VERSION = '0.9.0'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omen
 version: !ruby/object:Gem::Version
-  version: 0.8.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Claudio Baccigalupo