@everystack/cli 0.4.72 → 0.4.73

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes to `@everystack/cli` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.73] - 2026-09-04
+
+### Fixed
+
+- db:reconcile converges an owned relation's self-grant
+
 ## [0.4.72] - 2026-09-04
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.4.72",
+  "version": "0.4.73",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",

package/src/cli/derived-grants.ts

@@ -106,24 +106,30 @@ export interface ObjectGrantDiff {
 }
 
 /**
- * Ownership context for a FUNCTION's grant diff. Absent for relations.
+ * Ownership context for an object's grant diff — passed for EVERY kind (functions AND relations).
  *
- * Owner-implicit EXECUTE is excluded from both grant reads (`grantee <> proowner`), which is
- * correct in isolation — an owner's privileges are not grants. But it means the SET of
- * non-owner grants is computed RELATIVE TO THE OWNER, so two sides with different owners
- * produce two different sets for the same function, and the differ reconciles a difference
- * that is purely ownership.
+ * Owner-implicit privileges are excluded from both grant reads (`grantee <> proowner` for
+ * functions, `<> relowner` for relations), which is correct in isolation — an owner's privileges
+ * are not grants. But it means the SET of non-owner grants is computed RELATIVE TO THE OWNER, so
+ * two sides with different owners produce two different sets for the same object, and the differ
+ * reconciles a difference that is purely ownership.
  *
- * Measured by a consumer, 2026-08-10: their local `resolve_user_slug` is owned by
+ * First measured on functions, 2026-08-10: a consumer's local `resolve_user_slug` is owned by
  * `outbound_migrator` (owner-implicit, so the pull rendered NO privilege), while on stage the
  * same function is owned by `slug_resolver` and `outbound_migrator` holds an EXPLICIT grant.
  * The differ planned `REVOKE EXECUTE ON api.resolve_user_slug FROM outbound_migrator` — a real
  * access removal minted from an ownership difference. They did not apply it.
+ *
+ * The relation half surfaced 2026-09-04: after `db:provision ADOPT` made `outbound_migrator` own a
+ * VIEW the model also lists in its grants, the live read excluded the owner's own rows, so the
+ * declared self-grant was minted on every reconcile and never converged. The relation call site
+ * used to pass no ownership context on the belief that a relation's grant set does not shift with
+ * its owner — true only while relacl is NULL. Both kinds now share this context.
  */
 export interface GrantOwnerContext {
   /** The owner the DECLARED grant set was computed against, when the models declare one. */
   declared?: string;
-  /** The owner the LIVE grant set was computed against (`pg_get_userbyid(proowner)`). */
+  /** The owner the LIVE grant set was computed against (`pg_get_userbyid(proowner|relowner)`). */
   live?: string;
 }
 
@@ -131,8 +137,9 @@ export interface GrantOwnerContext {
  * The idempotent REVOKE/GRANT delta between the declared contract and the live ACLs —
  * the table path's reconcileGrants, per derived object. Empty when they match.
  *
- * When `owners` is supplied (functions) and the two sides cannot be shown to have been
- * computed against the SAME owner, REVOKEs are WITHHELD and reported. GRANTs still flow: a
+ * When `owners` is supplied (every kind — functions and relations) and the two sides cannot be
+ * shown to have been computed against the SAME owner, REVOKEs are WITHHELD and reported. GRANTs
+ * still flow: a
  * redundant GRANT is noise, a wrong REVOKE removes access that was really there. Failing to
  * revoke is the recoverable error and it is never silent.
  *
@@ -198,10 +205,10 @@ export function diffObjectGrants(
         out.push(`REVOKE ${toRevoke.join(', ')} ON ${target} FROM ${grantee}`);
       } else {
         const why = grantee === owners!.live
-          ? `'${grantee}' is the function's live OWNER, whose implicit privileges are excluded from both grant reads — so this difference is ownership, not a grant`
-          : `'${grantee}' is the function's declared owner (live owner: ${owners!.live}), and an owner's implicit privileges are excluded from both grant reads`;
+          ? `'${grantee}' is the object's live OWNER, whose implicit privileges are excluded from both grant reads — so this difference is ownership, not a grant`
+          : `'${grantee}' is the object's declared owner (live owner: ${owners!.live}), and an owner's implicit privileges are excluded from both grant reads`;
         suppressed.push(
-          `${target}: withheld REVOKE ${toRevoke.join(', ')} FROM ${grantee} — ${why}. An owner's implicit privileges are excluded from both reads, so the two grant sets are not comparable and this revoke may remove access that is really there. Declare the function's owner to restore revokes.`,
+          `${target}: withheld REVOKE ${toRevoke.join(', ')} FROM ${grantee} — ${why}. An owner's implicit privileges are excluded from both reads, so the two grant sets are not comparable and this revoke may remove access that is really there. Declare the object's owner to restore revokes.`,
         );
       }
     }

package/src/cli/derived-plan.ts

@@ -482,11 +482,21 @@ export function planReconcile(
         );
       } else {
         const target = parsed.target ?? (src.kind === 'function' ? `FUNCTION ${src.identity}` : src.identity);
-        // Functions carry ownership context; relations do not (relacl's NULL means owner-only
-        // and aclexplode(NULL) is empty, so a relation's grant set does not shift with its owner).
-        const owners = src.kind === 'function'
-          ? { ...(src.owner !== undefined ? { declared: src.owner } : {}), ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}) }
-          : undefined;
+        // Ownership context is passed for EVERY kind. An owner's implicit privileges are excluded
+        // from the live read for relations too (`a.grantee <> c.relowner`), so a model that both
+        // owns an object and lists that owner in its grants declares a self-grant the read can
+        // never confirm — diffObjectGrants normalizes the owner grantee away. The earlier belief
+        // that a relation's grant set "does not shift with its owner" holds only while relacl is
+        // NULL; the first non-owner grant materializes the ACL and the owner's own rows drop out,
+        // exactly as for a function. (A consumer's ADOPT'd view, owned by a role its model also
+        // grants, looped forever — 2026-09-04.)
+        // KNOWN LIMIT: a privilege an owner has deliberately self-revoked is not restored — that
+        // is a failure to ADD access (availability), never to remove it, and unnormalized code did
+        // not converge on it either.
+        const owners = {
+          ...(src.owner !== undefined ? { declared: src.owner } : {}),
+          ...(liveObj.owner !== undefined ? { live: liveObj.owner } : {}),
+        };
         const { statements, suppressed } = diffObjectGrants(target, parsed.grants, liveObj.grants, owners);
         if (statements.length > 0) regrants.push({ identity: src.identity, statements });
         // Never silent: a withheld revoke is reported every run until the owner is declared.