@everystack/cli 0.4.71 → 0.4.73

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.73] - 2026-09-04
+
+### Fixed
+
+- db:reconcile converges an owned relation's self-grant
+
+## [0.4.72] - 2026-09-04
+
+### Fixed
+
+- db:reconcile defers function-body validation (check_function_bodies=off)
+
 ## [0.4.71] - 2026-09-04
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.71",
+  "version": "0.4.73",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -178,7 +178,7 @@
     "jest": "29.7.0",
     "react": "19.2.0",
     "ts-jest": "29.4.9",
-    "@everystack/server": "0.4.29"
+    "@everystack/server": "0.4.30"
   },
   "scripts": {
     "test": "jest",

package/src/cli/commands/db-reconcile.ts

@@ -188,6 +188,16 @@ export async function executeReconcile(
   // as it was. See derivedSearchPath.
   const setSearchPath = renderSetSearchPath(derivedSearchPath(parsed.objects), atomic);
 
+  // Defer SQL/PLpgSQL function-body validation for the apply window — the pg_dump/pg_restore idiom
+  // db:build already uses (db-build.ts). A SQL-language function's body is validated at CREATE, so a
+  // function that reads a derived object being dropped-and-recreated in the SAME batch aborts with
+  // "relation does not exist" when it is (re)created before that object. The bodies are already
+  // validated upstream (db:build against a fresh DB, db:check in CI); the reconcile only needs the
+  // objects to EXIST by commit, which they do. Without this, reconcile fails where db:build succeeds
+  // on the very same schema — the only difference between them was this SET. LOCAL in the atomic
+  // batch (reverts at COMMIT); session-scoped on the unwrapped path (its connection is ephemeral).
+  const setCheckBodies = atomic ? 'SET LOCAL check_function_bodies = off' : 'SET check_function_bodies = off';
+
   // A schema populated only by derived objects has no model in it, so the state layer never
   // CREATE SCHEMAs it — the derived apply ensures its own object schemas (+ their USAGE
   // grants) before anything is created in them. Empty for all-public apps. See
@@ -221,9 +231,10 @@ export async function executeReconcile(
 
     if (rendered.statements.length > 0) {
       if (atomic) {
-        // The SET rides the same simple-query batch (and the same transaction) as the DDL,
-        // so bare body refs resolve to their real schema; SET LOCAL resets it at COMMIT.
-        await runner([...ensureSchemas, setSearchPath, ...rendered.statements].filter(Boolean).join(';\n'));
+        // The SETs ride the same simple-query batch (and the same transaction) as the DDL, so bare
+        // body refs resolve to their real schema and function bodies defer validation; SET LOCAL
+        // resets both at COMMIT.
+        await runner([...ensureSchemas, setSearchPath, setCheckBodies, ...rendered.statements].filter(Boolean).join(';\n'));
       } else {
         // Self-committing statements (CONCURRENTLY, VACUUM) refuse ANY transaction block —
         // including the implicit one a joined multi-statement simple query runs in, so the
@@ -233,7 +244,17 @@ export async function executeReconcile(
         // create resolves its bare refs.
         for (const statement of ensureSchemas) await runner(statement);
         if (setSearchPath) await runner(setSearchPath);
-        for (const statement of rendered.statements) await runner(statement);
+        // No transaction to scope the deferral to (this path exists for statements a transaction
+        // forbids), so the session GUC is set bare and RESET in a finally. A leak of THIS GUC is
+        // benign, unlike search_path: it only defers a body validation that already ran upstream
+        // (db:build against a fresh DB, db:check in CI) — it never changes what a query resolves to
+        // or what a fingerprint reads, so it cannot mint a wrong result the way a leaked path could.
+        await runner(setCheckBodies);
+        try {
+          for (const statement of rendered.statements) await runner(statement);
+        } finally {
+          await runner('RESET check_function_bodies');
+        }
       }
     }
 

package/src/cli/derived-grants.ts

@@ -106,24 +106,30 @@ export interface ObjectGrantDiff {
 }
 
 /**
- * Ownership context for a FUNCTION's grant diff. Absent for relations.
+ * Ownership context for an object's grant diff — passed for EVERY kind (functions AND relations).
  *
- * Owner-implicit EXECUTE is excluded from both grant reads (`grantee <> proowner`), which is
- * correct in isolation — an owner's privileges are not grants. But it means the SET of
- * non-owner grants is computed RELATIVE TO THE OWNER, so two sides with different owners
- * produce two different sets for the same function, and the differ reconciles a difference
- * that is purely ownership.
+ * Owner-implicit privileges are excluded from both grant reads (`grantee <> proowner` for
+ * functions, `<> relowner` for relations), which is correct in isolation — an owner's privileges
+ * are not grants. But it means the SET of non-owner grants is computed RELATIVE TO THE OWNER, so
+ * two sides with different owners produce two different sets for the same object, and the differ
+ * reconciles a difference that is purely ownership.
  *
- * Measured by a consumer, 2026-08-10: their local `resolve_user_slug` is owned by
+ * First measured on functions, 2026-08-10: a consumer's local `resolve_user_slug` is owned by
  * `outbound_migrator` (owner-implicit, so the pull rendered NO privilege), while on stage the
  * same function is owned by `slug_resolver` and `outbound_migrator` holds an EXPLICIT grant.
  * The differ planned `REVOKE EXECUTE ON api.resolve_user_slug FROM outbound_migrator` — a real
  * access removal minted from an ownership difference. They did not apply it.
+ *
+ * The relation half surfaced 2026-09-04: after `db:provision ADOPT` made `outbound_migrator` own a
+ * VIEW the model also lists in its grants, the live read excluded the owner's own rows, so the
+ * declared self-grant was minted on every reconcile and never converged. The relation call site
+ * used to pass no ownership context on the belief that a relation's grant set does not shift with
+ * its owner — true only while relacl is NULL. Both kinds now share this context.
  */
 export interface GrantOwnerContext {
   /** The owner the DECLARED grant set was computed against, when the models declare one. */
   declared?: string;
-  /** The owner the LIVE grant set was computed against (`pg_get_userbyid(proowner)`). */
+  /** The owner the LIVE grant set was computed against (`pg_get_userbyid(proowner|relowner)`). */
   live?: string;
 }
 
@@ -131,8 +137,9 @@ export interface GrantOwnerContext {
  * The idempotent REVOKE/GRANT delta between the declared contract and the live ACLs —
  * the table path's reconcileGrants, per derived object. Empty when they match.
  *
- * When `owners` is supplied (functions) and the two sides cannot be shown to have been
- * computed against the SAME owner, REVOKEs are WITHHELD and reported. GRANTs still flow: a
+ * When `owners` is supplied (every kind — functions and relations) and the two sides cannot be
+ * shown to have been computed against the SAME owner, REVOKEs are WITHHELD and reported. GRANTs
+ * still flow: a
  * redundant GRANT is noise, a wrong REVOKE removes access that was really there. Failing to
  * revoke is the recoverable error and it is never silent.
  *
@@ -198,10 +205,10 @@ export function diffObjectGrants(
         out.push(`REVOKE ${toRevoke.join(', ')} ON ${target} FROM ${grantee}`);
       } else {
         const why = grantee === owners!.live
-          ? `'${grantee}' is the function's live OWNER, whose implicit privileges are excluded from both grant reads — so this difference is ownership, not a grant`
-          : `'${grantee}' is the function's declared owner (live owner: ${owners!.live}), and an owner's implicit privileges are excluded from both grant reads`;
+          ? `'${grantee}' is the object's live OWNER, whose implicit privileges are excluded from both grant reads — so this difference is ownership, not a grant`
+          : `'${grantee}' is the object's declared owner (live owner: ${owners!.live}), and an owner's implicit privileges are excluded from both grant reads`;
         suppressed.push(
-          `${target}: withheld REVOKE ${toRevoke.join(', ')} FROM ${grantee} — ${why}. An owner's implicit privileges are excluded from both reads, so the two grant sets are not comparable and this revoke may remove access that is really there. Declare the function's owner to restore revokes.`,
+          `${target}: withheld REVOKE ${toRevoke.join(', ')} FROM ${grantee} — ${why}. An owner's implicit privileges are excluded from both reads, so the two grant sets are not comparable and this revoke may remove access that is really there. Declare the object's owner to restore revokes.`,
         );
       }
     }

package/src/cli/derived-plan.ts

@@ -482,11 +482,21 @@ export function planReconcile(
         );
       } else {
         const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
-        // Functions carry ownership context; relations do not (relacl's NULL means owner-only
-        // and aclexplode(NULL) is empty, so a relation's grant set does not shift with its owner).
-        const owners = src.kind === 'function'
-          ? { ...(src.owner !== undefined ? { declared: src.owner } : {}), ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}) }
-          : undefined;
+        // Ownership context is passed for EVERY kind. An owner's implicit privileges are excluded
+        // from the live read for relations too (`a.grantee <> c.relowner`), so a model that both
+        // owns an object and lists that owner in its grants declares a self-grant the read can
+        // never confirm — diffObjectGrants normalizes the owner grantee away. The earlier belief
+        // that a relation's grant set "does not shift with its owner" holds only while relacl is
+        // NULL; the first non-owner grant materializes the ACL and the owner's own rows drop out,
+        // exactly as for a function. (A consumer's ADOPT'd view, owned by a role its model also
+        // grants, looped forever — 2026-09-04.)
+        // KNOWN LIMIT: a privilege an owner has deliberately self-revoked is not restored — that
+        // is a failure to ADD access (availability), never to remove it, and unnormalized code did
+        // not converge on it either.
+        const owners = {
+          ...(src.owner !== undefined ? { declared: src.owner } : {}),
+          ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
+        };
         const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, owners);
         if (statements.length > 0) regrants.push({ identity: src.identity, statements });
         // Never silent: a withheld revoke is reported every run until the owner is declared.