@coffre/db 0.5.0 → 0.6.0

package/dist/grants.d.ts

@@ -1,6 +1,6 @@
 import { i as Queryable } from "./database-C63WjCrC.js";
 import { Authenticity, Newest } from "./log.js";
-import { Conversion, InstanceRole, Scope } from "@coffre/core/access";
+import { Conversion, ConversionInput, InstanceRole, Scope } from "@coffre/core/access";
 import { StoredEntry } from "@coffre/core/audit";
 //#region src/grants.d.ts
 /**
@@ -48,6 +48,17 @@ export declare function storedRole({ owner, role, scope }: StoredRole): {
 };
 /** The columns that store a member's instance role and scope: `owner` too, for a vault of 0.4 to read. */
 export declare function roleColumns(role: InstanceRole, scope: Scope): StoredRole;
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+export declare function liveProjects(db: Queryable): Promise<ConversionInput['projects']>;
+/**
+ * What the vault makes of a member's grants on every project of 0.4
+ * (`convertEveryProjectGrants`), from their instance role and their grants
+ * as stored, those live at `at`: the vault as it converts them, under their
+ * row's lock, and `coffre migrate` before, from the rows as they are. The
+ * role is the one their row holds: the vault converts these before it makes
+ * the Owners its deployment names.
+ */
+export declare function everyProjectConversion(principal: string, role: InstanceRole, grants: readonly GrantRow[], at: number, projects: ConversionInput['projects']): Conversion;
 /** What the vault does, when this version first runs, to one member's grants on every project of 0.4. */
 export type EveryProjectPreview = {
   principal: string;
@@ -78,9 +89,7 @@ export type EveryProjectPreview = {
  * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
  * they read: whether that report is the vault's own, or forged so as to
  * hide what it will do, only the vault can tell. Any member the vault
- * converts is listed. A root admin's it leaves while they are one, until
- * they are not; which they are, the vault's configuration says and the
- * database does not, so they are listed too.
+ * converts is listed.
  */
 export declare function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]>;
 /** A service token or trust binding of 0.4, which carries no scope of its own yet. */

package/dist/grants.js

@@ -1,8 +1,8 @@
 import { tablesOf } from "./index.js";
+import { tombstone, truth } from "./dialect.js";
 import { LOOK_BACK, entryColumns, newestAuthentic } from "./log.js";
-import { and, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
+import { and, asc, desc, eq, gt, inArray, isNull, lt, or, sql } from "drizzle-orm";
 import { EVERYWHERE, administers, convertEveryProjectGrants, isInstanceRole, isScope, normalScope, unscoped } from "@coffre/core/access";
-import { isTombstone } from "@coffre/core/schemas";
 import { ACCESS_ACTIONS } from "@coffre/core/vault";
 //#region src/grants.ts
 /** Grants, lapsed ones too unless `liveAt` says when to judge them: one member's, or everyone's. */
@@ -60,6 +60,54 @@ function roleColumns(role, scope) {
 		scope: role === "member" || unscoped(normal) ? null : JSON.stringify(normal)
 	};
 }
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+async function liveProjects(db) {
+	const { projects, environments } = tablesOf(db);
+	const [found, inside] = await Promise.all([db.select({
+		id: projects.id,
+		deleted: truth(tombstone(projects.slug))
+	}).from(projects).orderBy(asc(projects.id)), db.select({
+		id: environments.id,
+		projectId: environments.projectId,
+		slug: environments.slug,
+		deleted: truth(tombstone(environments.slug))
+	}).from(environments).orderBy(asc(environments.id))]);
+	return found.filter((project) => !project.deleted).map((project) => ({
+		id: project.id,
+		environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({
+			id,
+			slug
+		}))
+	}));
+}
+/**
+* What the vault makes of a member's grants on every project of 0.4
+* (`convertEveryProjectGrants`), from their instance role and their grants
+* as stored, those live at `at`: the vault as it converts them, under their
+* row's lock, and `coffre migrate` before, from the rows as they are. The
+* role is the one their row holds: the vault converts these before it makes
+* the Owners its deployment names.
+*/
+function everyProjectConversion(principal, role, grants, at, projects) {
+	const person = principal.startsWith("user:");
+	const live = grants.filter((grant) => grant.expiresAt === null || grant.expiresAt > at);
+	return convertEveryProjectGrants({
+		person,
+		role: person ? role : "member",
+		everyProject: live.filter((grant) => grant.projectId === null && grant.environmentId === null).map((grant) => ({
+			environmentSlug: grant.environmentSlug,
+			role: grant.role,
+			expiresAt: grant.expiresAt
+		})),
+		grants: live.filter((grant) => grant.projectId !== null).map((grant) => ({
+			projectId: grant.projectId,
+			environmentId: grant.environmentId,
+			role: grant.role,
+			expiresAt: grant.expiresAt
+		})),
+		projects
+	});
+}
 /**
 * What the vault will make of the grants on every project of 0.4 that live
 * members hold, by the rule it converts them with
@@ -71,16 +119,15 @@ function roleColumns(role, scope) {
 * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
 * they read: whether that report is the vault's own, or forged so as to
 * hide what it will do, only the vault can tell. Any member the vault
-* converts is listed. A root admin's it leaves while they are one, until
-* they are not; which they are, the vault's configuration says and the
-* database does not, so they are listed too.
+* converts is listed.
 */
 async function everyProjectPreview(db, at) {
 	const { vaultMembers, projects, environments } = tablesOf(db);
-	const held = (await readGrants(db, { liveAt: at })).filter((grant) => grant.projectId === null && grant.environmentId === null);
+	const grants = await readGrants(db, { liveAt: at });
+	const held = grants.filter((grant) => grant.projectId === null && grant.environmentId === null);
 	if (held.length === 0) return [];
 	const holders = [...new Set(held.map((grant) => grant.principal))].sort();
-	const [members, grants, places, inside, tampered] = await Promise.all([
+	const [members, places, inside, live, tampered] = await Promise.all([
 		db.select({
 			principal: vaultMembers.principal,
 			status: vaultMembers.status,
@@ -88,7 +135,6 @@ async function everyProjectPreview(db, at) {
 			role: vaultMembers.role,
 			scope: vaultMembers.scope
 		}).from(vaultMembers),
-		readGrants(db, { liveAt: at }),
 		db.select({
 			id: projects.id,
 			slug: projects.slug
@@ -98,43 +144,21 @@ async function everyProjectPreview(db, at) {
 			projectId: environments.projectId,
 			slug: environments.slug
 		}).from(environments),
+		liveProjects(db),
 		tamperedMembers(db)
 	]);
-	const live = places.filter((project) => !isTombstone(project.slug)).map((project) => ({
-		id: project.id,
-		environments: inside.filter((environment) => environment.projectId === project.id && !isTombstone(environment.slug)).map(({ id, slug }) => ({
-			id,
-			slug
-		}))
-	}));
 	const paths = Object.fromEntries(places.flatMap((project) => [[project.id, project.slug], ...inside.filter((environment) => environment.projectId === project.id).map((environment) => [environment.id, `${project.slug}/${environment.slug}`])]));
 	return holders.flatMap((principal) => {
 		const member = members.find((row) => row.principal === principal);
 		if (member?.status !== "active") return [];
-		const theirs = held.filter((grant) => grant.principal === principal);
 		return [{
 			principal,
-			before: theirs.map((grant) => ({
+			before: held.filter((grant) => grant.principal === principal).map((grant) => ({
 				place: grant.environmentSlug === null ? "*" : `*/${grant.environmentSlug}`,
 				role: grant.role,
 				expiresAt: grant.expiresAt
 			})),
-			conversion: convertEveryProjectGrants({
-				person: principal.startsWith("user:"),
-				role: principal.startsWith("user:") ? storedRole(member).role : "member",
-				everyProject: theirs.map((grant) => ({
-					environmentSlug: grant.environmentSlug,
-					role: grant.role,
-					expiresAt: grant.expiresAt
-				})),
-				grants: grants.filter((grant) => grant.principal === principal && grant.projectId !== null).map((grant) => ({
-					projectId: grant.projectId,
-					environmentId: grant.environmentId,
-					role: grant.role,
-					expiresAt: grant.expiresAt
-				})),
-				projects: live
-			}),
+			conversion: everyProjectConversion(principal, storedRole(member).role, grants.filter((grant) => grant.principal === principal), at, live),
 			paths,
 			reported: tampered.has(principal)
 		}];
@@ -224,4 +248,4 @@ async function tamperReportsAbout(db, principal, limit, after, before) {
 	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.subjectPrincipal, principal), eq(auditLog.action, "vault.tampered"), inArray(auditLog.code, [...TAMPER_CODES]), gt(auditLog.seq, after), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
 }
 //#endregion
-export { accessEntriesAbout, everyProjectPreview, insertGrant, newestAccess, readGrants, reportStands, roleColumns, storedRole, tamperedMembers, unsealedCredentials };
+export { accessEntriesAbout, everyProjectConversion, everyProjectPreview, insertGrant, liveProjects, newestAccess, readGrants, reportStands, roleColumns, storedRole, tamperedMembers, unsealedCredentials };

package/dist/log.d.ts

@@ -450,6 +450,8 @@ export type Authenticity = {
   authentic: (entry: StoredEntry) => boolean;
   forged: (entry: StoredEntry) => void;
 };
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+export declare function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]>;
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export declare const LOOK_BACK: {
   page: number;

package/dist/log.js

@@ -1,7 +1,7 @@
 import { t as afterCommit } from "./commits-BuW-NL3n.js";
 import { tablesOf } from "./index.js";
 import { clockMillis, forUpdate } from "./dialect.js";
-import { desc, eq } from "drizzle-orm";
+import { and, desc, eq, lt } from "drizzle-orm";
 import { GENESIS_HASH, sealEntry } from "@coffre/core/audit";
 //#region src/log.ts
 /** The log's head does not name its last entry: something moved it, or cut the log behind it. */
@@ -163,6 +163,11 @@ function entryColumns(db) {
 		hash: auditLog.hash
 	};
 }
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+async function newestVaultEntries(db, action, limit, before) {
+	const { auditLog } = tablesOf(db);
+	return await db.select(entryColumns(db)).from(auditLog).where(and(eq(auditLog.author, "vault"), eq(auditLog.action, action), eq(auditLog.decision, "allow"), before === void 0 ? void 0 : lt(auditLog.seq, before))).orderBy(desc(auditLog.seq)).limit(limit);
+}
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 const LOOK_BACK = {
 	page: 32,
@@ -189,4 +194,4 @@ async function newestAuthentic(page, check) {
 	return "unreached";
 }
 //#endregion
-export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic };
+export { LOOK_BACK, LogHeadMismatch, LogRewound, appendEntries, entryColumns, forgetLogHeads, lockLogHead, newestAuthentic, newestVaultEntries };

package/dist/migrate.d.ts

@@ -3,6 +3,40 @@ import { PoolClient } from "pg";
 //#region src/migrate.d.ts
 /** Reassert database privileges that pg_dump and CREATE DATABASE TEMPLATE do not carry. */
 export declare function restrictDatabase(client: Pick<PoolClient, 'query'>): Promise<void>;
+/** An owner of coffre's objects whose privileges the login lacks: not a member of it, or one that does not inherit them. */
+export type ForeignOwner = {
+  name: string;
+  member: boolean;
+};
+/**
+ * The login cannot change coffre's objects, the ledger's schema, the tables
+ * and the functions: their owners are roles whose privileges it does not
+ * have, as neither one of them nor a member of one that inherits them.
+ * Postgres would refuse the first migration that touches one, "permission
+ * denied for schema drizzle"; this says whose login migrates, or what makes
+ * this one able to: on Postgres 16 and later, a membership that inherits,
+ * which each one's GRANT says; before, a membership, and a login that
+ * inherits (`ALTER ROLE … INHERIT`).
+ */
+export declare class NotOwner extends Error {
+  readonly login: string;
+  readonly owners: ForeignOwner[];
+  constructor(login: string, owners: ForeignOwner[], { grantsInherit, inherits }: {
+    grantsInherit: boolean;
+    inherits: boolean;
+  });
+}
+/** What coffre's migrations make and so change later: relations and functions, by name, in public. */
+type Managed = {
+  relations: string[];
+  functions: string[];
+};
+/**
+ * The names a migration's SQL makes: CREATE TABLE, VIEW, MATERIALIZED VIEW
+ * and SEQUENCE, and CREATE FUNCTION, in public. Unquoted, a name is folded
+ * to lower case, as Postgres folds it.
+ */
+export declare function managedObjects(sqlTexts: readonly string[]): Managed;
 /**
  * Beside this module: src/migrations in the workspace, and dist/migrations
  * in the built package, where the build copies them.
@@ -35,17 +69,20 @@ export type MigrationPlan = {
 };
 /**
  * Which of this version's migrations a database has applied, and which it
- * has not, without changing it or waiting on a migration under way. A
- * history that is not a prefix of this version's is refused, as
- * `migrateDatabase` refuses it.
+ * has not, without changing it or waiting on a migration under way; and
+ * whether this login could apply them (`notOwner`), as `migrateDatabase`
+ * requires: thrown, when it cannot read which. A history that is not a
+ * prefix of this version's is refused, as `migrateDatabase` refuses it.
  */
 export declare function migrationStatus(url: string): Promise<{
   applied: string[];
   pending: string[];
+  notOwner: NotOwner | null;
 }>;
 /**
  * Apply missing migrations, check their history and reassert database
- * privileges. `onPlan` hears what there is to apply before it is, under
+ * privileges, as a login that can change coffre's objects: another is
+ * refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
  * the migration lock, and may stop the run by throwing: all of it then goes
  * in one call, with no word of each.
  */

package/dist/migrate.js

@@ -25,6 +25,71 @@ async function restrictDatabase(client) {
   END $$`);
 }
 /**
+* The login cannot change coffre's objects, the ledger's schema, the tables
+* and the functions: their owners are roles whose privileges it does not
+* have, as neither one of them nor a member of one that inherits them.
+* Postgres would refuse the first migration that touches one, "permission
+* denied for schema drizzle"; this says whose login migrates, or what makes
+* this one able to: on Postgres 16 and later, a membership that inherits,
+* which each one's GRANT says; before, a membership, and a login that
+* inherits (`ALTER ROLE … INHERIT`).
+*/
+var NotOwner = class extends Error {
+	login;
+	owners;
+	constructor(login, owners, { grantsInherit, inherits }) {
+		const one = owners.length === 1;
+		const members = owners.every((owner) => owner.member);
+		const fixes = [...owners.filter((owner) => grantsInherit || !owner.member).map((owner) => `GRANT ${identifier(owner.name)} TO ${identifier(login)}${grantsInherit ? " WITH INHERIT TRUE" : ""}`), ...grantsInherit || inherits ? [] : [`ALTER ROLE ${identifier(login)} INHERIT`]];
+		super(`coffre's tables are owned by ${owners.map((owner) => owner.name).join(" and ")}, and this login, ${login}, ` + (members ? `is a member of ${one ? "it" : "them"} but does not inherit ${one ? "its" : "their"} privileges: ` : `is neither ${one ? "it nor a member of it" : "one nor a member of one"}: `) + `migrate with ${one ? `${owners[0].name}'s` : "their"} connection string, or, as a role that administers ${one ? "it" : "them"}, run ${fixes.join("; ")}`);
+		this.name = "NotOwner";
+		this.login = login;
+		this.owners = owners;
+	}
+};
+/** A role's name as SQL takes it: always quoted, as a keyword such as `user` must be. */
+function identifier(name) {
+	return `"${name.replace(/"/g, "\"\"")}"`;
+}
+/**
+* The names a migration's SQL makes: CREATE TABLE, VIEW, MATERIALIZED VIEW
+* and SEQUENCE, and CREATE FUNCTION, in public. Unquoted, a name is folded
+* to lower case, as Postgres folds it.
+*/
+function managedObjects(sqlTexts) {
+	const name = String.raw`(?:"?public"?\.)?(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))`;
+	const relation = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:UNLOGGED\s+)?(?:TABLE|VIEW|MATERIALIZED\s+VIEW|SEQUENCE)\s+(?:IF\s+NOT\s+EXISTS\s+)?${name}`, "gi");
+	const fn = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+${name}\s*\(`, "gi");
+	const names = (pattern) => [...new Set(sqlTexts.flatMap((text) => [...text.matchAll(pattern)].map(([, quoted, bare]) => quoted !== void 0 ? quoted.replace(/""/g, "\"") : bare.toLowerCase())))];
+	return {
+		relations: names(relation),
+		functions: names(fn)
+	};
+}
+/**
+* The owners of what migrations change, whose privileges the login lacks:
+* the drizzle schema and everything in it, and in public the relations and
+* functions coffre's migrations make ($1, $2), and nothing else of public,
+* which may hold a database's other tables. A superuser has every role's.
+*/
+const FOREIGN_OWNERS = `
+  WITH owned AS (
+    SELECT nspowner AS owner FROM pg_namespace WHERE nspname = 'drizzle'
+    UNION ALL
+    SELECT c.relowner FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
+        AND (n.nspname = 'drizzle' OR (n.nspname = 'public' AND c.relname = ANY($1::text[])))
+    UNION ALL
+    SELECT p.proowner FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = 'public' AND p.proname = ANY($2::text[])
+  )
+  SELECT DISTINCT r.rolname AS owner, pg_has_role(owned.owner, 'MEMBER') AS member, current_user AS login,
+    current_setting('server_version_num')::int >= 160000 AS grants_inherit,
+    (SELECT rolinherit FROM pg_roles WHERE rolname = current_user) AS inherits
+  FROM owned JOIN pg_roles r ON r.oid = owned.owner
+  WHERE NOT pg_has_role(owned.owner, 'USAGE')
+  ORDER BY r.rolname`;
+/**
 * Beside this module: src/migrations in the workspace, and dist/migrations
 * in the built package, where the build copies them.
 */
@@ -41,7 +106,8 @@ async function expectedMigrations(engine) {
 		return {
 			createdAt: String(entry.when),
 			hash: createHash("sha256").update(sqlText).digest("hex"),
-			tag: entry.tag
+			tag: entry.tag,
+			sql: sqlText
 		};
 	}));
 	for (let index = 1; index < expected.length; index += 1) if (BigInt(expected[index - 1].createdAt) >= BigInt(expected[index].createdAt)) throw new Error("Drizzle migration journal timestamps must be strictly increasing");
@@ -106,6 +172,18 @@ async function postgresMigrator(url) {
 		},
 		migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
 		restrict: () => restrictDatabase(client),
+		async notOwner({ relations, functions }) {
+			const { rows } = await client.query(FOREIGN_OWNERS, [relations, functions]);
+			if (rows.length === 0) return null;
+			const [{ login, grants_inherit: grantsInherit, inherits }] = rows;
+			return new NotOwner(login, rows.map(({ owner, member }) => ({
+				name: owner,
+				member
+			})), {
+				grantsInherit,
+				inherits
+			});
+		},
 		async close() {
 			client.release();
 			await pool.end();
@@ -125,14 +203,16 @@ async function sqliteMigrator(url) {
 		async unlock() {},
 		migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
 		async restrict() {},
+		notOwner: async () => null,
 		close
 	};
 }
 /**
 * Which of this version's migrations a database has applied, and which it
-* has not, without changing it or waiting on a migration under way. A
-* history that is not a prefix of this version's is refused, as
-* `migrateDatabase` refuses it.
+* has not, without changing it or waiting on a migration under way; and
+* whether this login could apply them (`notOwner`), as `migrateDatabase`
+* requires: thrown, when it cannot read which. A history that is not a
+* prefix of this version's is refused, as `migrateDatabase` refuses it.
 */
 async function migrationStatus(url) {
 	const engine = engineOfUrl(url);
@@ -142,12 +222,16 @@ async function migrationStatus(url) {
 		sqlite: sqliteMigrator
 	}[engine](url);
 	try {
-		const history = await migrator.applied();
+		const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+		const history = await migrator.applied().catch((error) => {
+			throw notOwner ?? error;
+		});
 		verifyHistory(expected, history, false);
 		const applied = history?.length ?? 0;
 		return {
 			applied: expected.slice(0, applied).map((entry) => entry.tag),
-			pending: expected.slice(applied).map((entry) => entry.tag)
+			pending: expected.slice(applied).map((entry) => entry.tag),
+			notOwner
 		};
 	} finally {
 		await migrator.close();
@@ -155,7 +239,8 @@ async function migrationStatus(url) {
 }
 /**
 * Apply missing migrations, check their history and reassert database
-* privileges. `onPlan` hears what there is to apply before it is, under
+* privileges, as a login that can change coffre's objects: another is
+* refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
 * the migration lock, and may stop the run by throwing: all of it then goes
 * in one call, with no word of each.
 */
@@ -170,6 +255,8 @@ async function migrateDatabase(url, onPlan) {
 	try {
 		await migrator.lock();
 		locked = true;
+		const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+		if (notOwner !== null) throw notOwner;
 		const applied = await migrator.applied();
 		verifyHistory(expected, applied, false);
 		const done = applied?.length ?? 0;
@@ -190,4 +277,4 @@ async function migrateDatabase(url, onPlan) {
 	}
 }
 //#endregion
-export { DatabaseAhead, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };
+export { DatabaseAhead, NotOwner, managedObjects, migrateDatabase, migrationStatus, migrationsFolder, restrictDatabase };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@coffre/db",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "coffre's database: the schema, its migrations and the connections, on Postgres or SQLite.",
   "license": "MIT",
   "repository": {
@@ -79,7 +79,7 @@
     "drizzle-orm": "0.45.2",
     "pg": "8.16.3",
     "pg-connection-string": "2.14.0",
-    "@coffre/core": "0.5.0"
+    "@coffre/core": "0.6.0"
   },
   "devDependencies": {
     "@types/node": "26.1.1",

package/src/grants.ts

@@ -7,17 +7,18 @@ import {
   normalScope,
   unscoped,
   type Conversion,
+  type ConversionInput,
   type InstanceRole,
   type Role,
   type Scope,
 } from '@coffre/core/access';
 import type { StoredEntry } from '@coffre/core/audit';
-import { isTombstone } from '@coffre/core/schemas';
 import { ACCESS_ACTIONS } from '@coffre/core/vault';
-import { and, desc, eq, gt, inArray, isNull, lt, or, sql, type SQL } from 'drizzle-orm';
+import { and, asc, desc, eq, gt, inArray, isNull, like, lt, or, sql, type SQL } from 'drizzle-orm';
 
 import { tablesOf, type Queryable } from './database.ts';
-import { entryColumns, LOOK_BACK, newestAuthentic, type Authenticity, type Newest } from './log.ts';
+import { tombstone, truth } from './dialect.ts';
+import { entryColumns, LOOK_BACK, newestAuthentic, newestVaultEntries, type Authenticity, type Newest } from './log.ts';
 
 /**
  * One grant, as `vault_grants` holds it: on a project (`environmentId`
@@ -93,6 +94,49 @@ export function roleColumns(role: InstanceRole, scope: Scope): StoredRole {
   return { owner: administers(role), role, scope: role === 'member' || unscoped(normal) ? null : JSON.stringify(normal) };
 }
 
+/** Every project not deleted, with its environments not deleted: what a grant on every project of 0.4 reached. */
+export async function liveProjects(db: Queryable): Promise<ConversionInput['projects']> {
+  const { projects, environments } = tablesOf(db);
+  const [found, inside] = await Promise.all([
+    db.select({ id: projects.id, deleted: truth(tombstone(projects.slug)) }).from(projects).orderBy(asc(projects.id)),
+    db.select({ id: environments.id, projectId: environments.projectId, slug: environments.slug, deleted: truth(tombstone(environments.slug)) }).from(environments).orderBy(asc(environments.id)),
+  ]);
+  return found.filter((project) => !project.deleted).map((project) => ({
+    id: project.id,
+    environments: inside.filter((environment) => environment.projectId === project.id && !environment.deleted).map(({ id, slug }) => ({ id, slug })),
+  }));
+}
+
+/**
+ * What the vault makes of a member's grants on every project of 0.4
+ * (`convertEveryProjectGrants`), from their instance role and their grants
+ * as stored, those live at `at`: the vault as it converts them, under their
+ * row's lock, and `coffre migrate` before, from the rows as they are. The
+ * role is the one their row holds: the vault converts these before it makes
+ * the Owners its deployment names.
+ */
+export function everyProjectConversion(
+  principal: string,
+  role: InstanceRole,
+  grants: readonly GrantRow[],
+  at: number,
+  projects: ConversionInput['projects'],
+): Conversion {
+  const person = principal.startsWith('user:');
+  const live = grants.filter((grant) => grant.expiresAt === null || grant.expiresAt > at);
+  return convertEveryProjectGrants({
+    person,
+    role: person ? role : 'member',
+    everyProject: live
+      .filter((grant) => grant.projectId === null && grant.environmentId === null)
+      .map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
+    grants: live
+      .filter((grant) => grant.projectId !== null)
+      .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
+    projects,
+  });
+}
+
 /** What the vault does, when this version first runs, to one member's grants on every project of 0.4. */
 export type EveryProjectPreview = {
   principal: string;
@@ -120,28 +164,23 @@ export type EveryProjectPreview = {
  * `reported`, by the vault's own rule (`tamperedMembers`) over the entries as
  * they read: whether that report is the vault's own, or forged so as to
  * hide what it will do, only the vault can tell. Any member the vault
- * converts is listed. A root admin's it leaves while they are one, until
- * they are not; which they are, the vault's configuration says and the
- * database does not, so they are listed too.
+ * converts is listed.
  */
 export async function everyProjectPreview(db: Queryable, at: number): Promise<EveryProjectPreview[]> {
   const { vaultMembers, projects, environments } = tablesOf(db);
-  const held = (await readGrants(db, { liveAt: at })).filter((grant) => grant.projectId === null && grant.environmentId === null);
+  const grants = await readGrants(db, { liveAt: at });
+  const held = grants.filter((grant) => grant.projectId === null && grant.environmentId === null);
   if (held.length === 0) return [];
   const holders = [...new Set(held.map((grant) => grant.principal))].sort();
-  const [members, grants, places, inside, tampered] = await Promise.all([
+  const [members, places, inside, live, tampered] = await Promise.all([
     db.select({ principal: vaultMembers.principal, status: vaultMembers.status, owner: vaultMembers.owner, role: vaultMembers.role, scope: vaultMembers.scope }).from(vaultMembers),
-    readGrants(db, { liveAt: at }),
     db.select({ id: projects.id, slug: projects.slug }).from(projects),
     db.select({ id: environments.id, projectId: environments.projectId, slug: environments.slug }).from(environments),
+    liveProjects(db),
     // The vault's own rule (`reportStands`), over every entry in its name, for everyone in two queries.
     tamperedMembers(db),
   ]);
-  // A deleted place keeps its row under a tombstone's slug, its own or its project's: no grant reaches it.
-  const live = places.filter((project) => !isTombstone(project.slug)).map((project) => ({
-    id: project.id,
-    environments: inside.filter((environment) => environment.projectId === project.id && !isTombstone(environment.slug)).map(({ id, slug }) => ({ id, slug })),
-  }));
+  // A deleted place keeps its row under a tombstone's slug, its own or its project's, named as it was.
   const paths = Object.fromEntries(places.flatMap((project) => [
     [project.id, project.slug],
     ...inside.filter((environment) => environment.projectId === project.id).map((environment) => [environment.id, `${project.slug}/${environment.slug}`]),
@@ -153,15 +192,7 @@ export async function everyProjectPreview(db: Queryable, at: number): Promise<Ev
     return [{
       principal,
       before: theirs.map((grant) => ({ place: grant.environmentSlug === null ? '*' : `*/${grant.environmentSlug}`, role: grant.role, expiresAt: grant.expiresAt })),
-      conversion: convertEveryProjectGrants({
-        person: principal.startsWith('user:'),
-        role: principal.startsWith('user:') ? storedRole(member).role : 'member',
-        everyProject: theirs.map((grant) => ({ environmentSlug: grant.environmentSlug, role: grant.role as Role, expiresAt: grant.expiresAt })),
-        grants: grants
-          .filter((grant) => grant.principal === principal && grant.projectId !== null)
-          .map((grant) => ({ projectId: grant.projectId, environmentId: grant.environmentId, role: grant.role as Role, expiresAt: grant.expiresAt })),
-        projects: live,
-      }),
+      conversion: everyProjectConversion(principal, storedRole(member).role, grants.filter((grant) => grant.principal === principal), at, live),
       paths,
       reported: tampered.has(principal),
     }];

package/src/log.ts

@@ -1,5 +1,5 @@
 import { GENESIS_HASH, sealEntry, type LogFields, type LogKey, type StoredEntry } from '@coffre/core/audit';
-import { desc, eq } from 'drizzle-orm';
+import { and, desc, eq, lt } from 'drizzle-orm';
 
 import { afterCommit } from './commits.ts';
 import { tablesOf, type Queryable, type Transaction } from './database.ts';
@@ -225,6 +225,25 @@ export function entryColumns(db: Queryable) {
  */
 export type Authenticity = { authentic: (entry: StoredEntry) => boolean; forged: (entry: StoredEntry) => void };
 
+/** Up to `limit` of the entries in the vault's name, allowed, of one `action`, before `before` (the newest when undefined), newest first. */
+export async function newestVaultEntries(db: Queryable, action: string, limit: number, before?: bigint): Promise<StoredEntry[]> {
+  const { auditLog } = tablesOf(db);
+  const rows = await db
+    .select(entryColumns(db))
+    .from(auditLog)
+    .where(
+      and(
+        eq(auditLog.author, 'vault'),
+        eq(auditLog.action, action),
+        eq(auditLog.decision, 'allow'),
+        before === undefined ? undefined : lt(auditLog.seq, before),
+      ),
+    )
+    .orderBy(desc(auditLog.seq))
+    .limit(limit);
+  return rows as StoredEntry[];
+}
+
 /** How many entries in its name the vault reads back, a page at a time, for its own newest of a kind (`newestAuthentic`). */
 export const LOOK_BACK = { page: 32, pages: 32 };
 

package/src/migrate.ts

@@ -40,6 +40,7 @@ interface ExpectedMigration {
   createdAt: string;
   hash: string;
   tag: string;
+  sql: string;
 }
 
 interface AppliedMigration {
@@ -56,9 +57,95 @@ interface Migrator {
   migrate(migrationsFolder: string): Promise<void>;
   /** Reassert privileges a one-database backup does not carry. */
   restrict(): Promise<void>;
+  /** Why this login cannot change the objects migrations change, `managed` among them, or null when it can. */
+  notOwner(managed: Managed): Promise<NotOwner | null>;
   close(): Promise<void>;
 }
 
+/** An owner of coffre's objects whose privileges the login lacks: not a member of it, or one that does not inherit them. */
+export type ForeignOwner = { name: string; member: boolean };
+
+/**
+ * The login cannot change coffre's objects, the ledger's schema, the tables
+ * and the functions: their owners are roles whose privileges it does not
+ * have, as neither one of them nor a member of one that inherits them.
+ * Postgres would refuse the first migration that touches one, "permission
+ * denied for schema drizzle"; this says whose login migrates, or what makes
+ * this one able to: on Postgres 16 and later, a membership that inherits,
+ * which each one's GRANT says; before, a membership, and a login that
+ * inherits (`ALTER ROLE … INHERIT`).
+ */
+export class NotOwner extends Error {
+  readonly login: string;
+  readonly owners: ForeignOwner[];
+
+  constructor(login: string, owners: ForeignOwner[], { grantsInherit, inherits }: { grantsInherit: boolean; inherits: boolean }) {
+    const one = owners.length === 1;
+    const members = owners.every((owner) => owner.member);
+    const fixes = [
+      ...owners.filter((owner) => grantsInherit || !owner.member).map((owner) => `GRANT ${identifier(owner.name)} TO ${identifier(login)}${grantsInherit ? ' WITH INHERIT TRUE' : ''}`),
+      ...(grantsInherit || inherits ? [] : [`ALTER ROLE ${identifier(login)} INHERIT`]),
+    ];
+    super(
+      `coffre's tables are owned by ${owners.map((owner) => owner.name).join(' and ')}, and this login, ${login}, ` +
+        (members
+          ? `is a member of ${one ? 'it' : 'them'} but does not inherit ${one ? 'its' : 'their'} privileges: `
+          : `is neither ${one ? 'it nor a member of it' : 'one nor a member of one'}: `) +
+        `migrate with ${one ? `${owners[0]!.name}'s` : 'their'} connection string, or, as a role that administers ${one ? 'it' : 'them'}, run ${fixes.join('; ')}`,
+    );
+    this.name = 'NotOwner';
+    this.login = login;
+    this.owners = owners;
+  }
+}
+
+/** A role's name as SQL takes it: always quoted, as a keyword such as `user` must be. */
+function identifier(name: string): string {
+  return `"${name.replace(/"/g, '""')}"`;
+}
+
+/** What coffre's migrations make and so change later: relations and functions, by name, in public. */
+type Managed = { relations: string[]; functions: string[] };
+
+/**
+ * The names a migration's SQL makes: CREATE TABLE, VIEW, MATERIALIZED VIEW
+ * and SEQUENCE, and CREATE FUNCTION, in public. Unquoted, a name is folded
+ * to lower case, as Postgres folds it.
+ */
+export function managedObjects(sqlTexts: readonly string[]): Managed {
+  const name = String.raw`(?:"?public"?\.)?(?:"((?:[^"]|"")+)"|([A-Za-z_][A-Za-z0-9_$]*))`;
+  const relation = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?(?:UNLOGGED\s+)?(?:TABLE|VIEW|MATERIALIZED\s+VIEW|SEQUENCE)\s+(?:IF\s+NOT\s+EXISTS\s+)?${name}`, 'gi');
+  const fn = new RegExp(String.raw`\bCREATE\s+(?:OR\s+REPLACE\s+)?FUNCTION\s+${name}\s*\(`, 'gi');
+  const names = (pattern: RegExp) => [
+    ...new Set(sqlTexts.flatMap((text) => [...text.matchAll(pattern)].map(([, quoted, bare]) => (quoted !== undefined ? quoted.replace(/""/g, '"') : bare!.toLowerCase())))),
+  ];
+  return { relations: names(relation), functions: names(fn) };
+}
+
+/**
+ * The owners of what migrations change, whose privileges the login lacks:
+ * the drizzle schema and everything in it, and in public the relations and
+ * functions coffre's migrations make ($1, $2), and nothing else of public,
+ * which may hold a database's other tables. A superuser has every role's.
+ */
+const FOREIGN_OWNERS = `
+  WITH owned AS (
+    SELECT nspowner AS owner FROM pg_namespace WHERE nspname = 'drizzle'
+    UNION ALL
+    SELECT c.relowner FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+      WHERE c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
+        AND (n.nspname = 'drizzle' OR (n.nspname = 'public' AND c.relname = ANY($1::text[])))
+    UNION ALL
+    SELECT p.proowner FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+      WHERE n.nspname = 'public' AND p.proname = ANY($2::text[])
+  )
+  SELECT DISTINCT r.rolname AS owner, pg_has_role(owned.owner, 'MEMBER') AS member, current_user AS login,
+    current_setting('server_version_num')::int >= 160000 AS grants_inherit,
+    (SELECT rolinherit FROM pg_roles WHERE rolname = current_user) AS inherits
+  FROM owned JOIN pg_roles r ON r.oid = owned.owner
+  WHERE NOT pg_has_role(owned.owner, 'USAGE')
+  ORDER BY r.rolname`;
+
 /**
  * Beside this module: src/migrations in the workspace, and dist/migrations
  * in the built package, where the build copies them.
@@ -89,6 +176,7 @@ async function expectedMigrations(engine: Engine): Promise<ExpectedMigration[]>
         createdAt: String(entry.when),
         hash: createHash('sha256').update(sqlText).digest('hex'),
         tag: entry.tag,
+        sql: sqlText,
       };
     }),
   );
@@ -177,6 +265,12 @@ async function postgresMigrator(url: string): Promise<Migrator> {
     },
     migrate: (migrationsFolder) => migrate(drizzle(client), { migrationsFolder }),
     restrict: () => restrictDatabase(client),
+    async notOwner({ relations, functions }) {
+      const { rows } = await client.query<{ owner: string; member: boolean; login: string; grants_inherit: boolean; inherits: boolean }>(FOREIGN_OWNERS, [relations, functions]);
+      if (rows.length === 0) return null;
+      const [{ login, grants_inherit: grantsInherit, inherits }] = rows as [(typeof rows)[number]];
+      return new NotOwner(login, rows.map(({ owner, member }) => ({ name: owner, member })), { grantsInherit, inherits });
+    },
     async close() {
       client.release();
       await pool.end();
@@ -206,6 +300,8 @@ async function sqliteMigrator(url: string): Promise<Migrator> {
     async unlock() {},
     migrate: (migrationsFolder) => migrate(sqlite, { migrationsFolder }),
     async restrict() {},
+    // One file, which whoever opens it may change.
+    notOwner: async () => null,
     close,
   };
 }
@@ -218,21 +314,27 @@ export type MigrationPlan = { applied: number; total: number; pending: string[]
 
 /**
  * Which of this version's migrations a database has applied, and which it
- * has not, without changing it or waiting on a migration under way. A
- * history that is not a prefix of this version's is refused, as
- * `migrateDatabase` refuses it.
+ * has not, without changing it or waiting on a migration under way; and
+ * whether this login could apply them (`notOwner`), as `migrateDatabase`
+ * requires: thrown, when it cannot read which. A history that is not a
+ * prefix of this version's is refused, as `migrateDatabase` refuses it.
  */
-export async function migrationStatus(url: string): Promise<{ applied: string[]; pending: string[] }> {
+export async function migrationStatus(url: string): Promise<{ applied: string[]; pending: string[]; notOwner: NotOwner | null }> {
   const engine = engineOfUrl(url);
   const expected = await expectedMigrations(engine);
   const migrator = await { postgres: postgresMigrator, sqlite: sqliteMigrator }[engine](url);
   try {
-    const history = await migrator.applied();
+    const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+    // A login that may not even read the ledger is told why.
+    const history = await migrator.applied().catch((error: unknown) => {
+      throw notOwner ?? error;
+    });
     verifyHistory(expected, history, false);
     const applied = history?.length ?? 0;
     return {
       applied: expected.slice(0, applied).map((entry) => entry.tag),
       pending: expected.slice(applied).map((entry) => entry.tag),
+      notOwner,
     };
   } finally {
     await migrator.close();
@@ -241,7 +343,8 @@ export async function migrationStatus(url: string): Promise<{ applied: string[];
 
 /**
  * Apply missing migrations, check their history and reassert database
- * privileges. `onPlan` hears what there is to apply before it is, under
+ * privileges, as a login that can change coffre's objects: another is
+ * refused, NotOwner, before anything changes. `onPlan` hears what there is to apply before it is, under
  * the migration lock, and may stop the run by throwing: all of it then goes
  * in one call, with no word of each.
  */
@@ -258,6 +361,8 @@ export async function migrateDatabase(
     await migrator.lock();
     locked = true;
 
+    const notOwner = await migrator.notOwner(managedObjects(expected.map((entry) => entry.sql)));
+    if (notOwner !== null) throw notOwner;
     const applied = await migrator.applied();
     verifyHistory(expected, applied, false);
     const done = applied?.length ?? 0;

package/src/schema.ts

@@ -205,8 +205,7 @@ export const vaultMembers = pgTable(
     principal: text().primaryKey(),
     status: text().notNull(),
     // An owner of 0.4: an Admin, unless `role` says otherwise. Written as
-    // whether `role` administers, for a vault of 0.4 to read. Root admins
-    // come from the vault's configuration, never from a row.
+    // whether `role` administers, for a vault of 0.4 to read.
     owner: boolean().notNull().default(false),
     // A person's instance role (`INSTANCE_ROLES` in @coffre/core/access),
     // and where it applies, as JSON (`Scope`, projects by id); null on a row