@everystack/server 0.4.32 → 0.4.33

package/CHANGELOG.md

@@ -4,6 +4,17 @@ All notable changes to `@everystack/server` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.33] - 2026-09-24
+
+### BREAKING CHANGES
+
+- a declared owner needs USAGE on its schema; db:apply refuses without it, db:provision (server 0.4.33) grants it
+
+### Fixed
+
+- name USAGE with CREATE for a missing schema; review follow-ups
+- reject offset-less datetime strings (ambiguous: server-local, not UTC)
+
 ## [0.4.32] - 2026-09-21
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.32",
+  "version": "0.4.33",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -187,8 +187,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/auth": "0.4.5",
-    "@everystack/cli": "0.4.87"
+    "@everystack/auth": "0.4.6",
+    "@everystack/cli": "0.4.93"
   },
   "scripts": {
     "test": "jest",

package/src/owner-enactment.ts

@@ -11,6 +11,9 @@
  *      explicit SET ROLE, never inheriting the owner's privileges ambiently.
  *   2. `GRANT CREATE ON SCHEMA <schema> TO <owner>` — so the CREATE, which runs AS the owner,
  *      can place the object.
+ *   3. `GRANT USAGE ON SCHEMA <schema> TO <owner>` — so the owner's GRANT/REVOKE on that object,
+ *      which name it as `schema.object`, can resolve it. CREATE alone let the CREATE through and
+ *      then failed the object's own `REVOKE ALL … FROM PUBLIC` with `permission denied for schema`.
  *
  * These are privileged, idempotent SETUP — the same category as the role chain — so they belong
  * in db:provision, not in the least-privilege reconcile lane (which structurally cannot run them).
@@ -75,6 +78,8 @@ export interface OwnerFactRow {
   canSetRole: boolean;
   /** The owner already holds `CREATE` on the schema — no create grant needed. */
   ownerCanCreate: boolean;
+  /** The owner already holds `USAGE` on the schema — no usage grant needed. */
+  ownerCanUse: boolean;
 }
 
 /**
@@ -88,6 +93,8 @@ export interface GranterCapabilityRow {
   schema: string;
   canGrantMembership: boolean;
   canGrantCreate: boolean;
+  /** Can `GRANT USAGE ON SCHEMA` — owns the schema, holds USAGE WITH GRANT OPTION, or is a superuser. */
+  canGrantUsage: boolean;
 }
 
 /** Which connection runs a unit's statements. */
@@ -175,7 +182,8 @@ function assertIdent(name: string, what: string): void {
 
 /**
  * The connection-independent probe: for each (owner, schema), does the owner exist, does the
- * schema exist, can `operator` already SET ROLE the owner, and does the owner already hold CREATE.
+ * schema exist, can `operator` already SET ROLE the owner, and does the owner already hold CREATE
+ * and USAGE.
  * `has_schema_privilege` throws on an absent schema, so the schema is LEFT JOINed and the privilege
  * is evaluated only when the schema is really there. Run once, on either connection.
  */
@@ -195,7 +203,9 @@ SELECT
   (n.oid IS NOT NULL) AS schema_exists,
   CASE WHEN r.oid IS NULL THEN false ELSE pg_has_role('${operator}', r.oid, 'SET') END AS can_set_role,
   CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN false
-       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN false
+       ELSE has_schema_privilege(r.oid, n.oid, 'USAGE') END AS owner_can_use
 FROM declared d
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
 LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
@@ -207,7 +217,8 @@ ORDER BY d.owner_name, d.schema_name
  * The connection-DEPENDENT probe: run on a connection to learn what CURRENT_USER can grant.
  * Can it `GRANT <owner> TO <operator>` — it holds ADMIN OPTION on the owner, directly or through a
  * group. Can it `GRANT CREATE ON SCHEMA <schema>` — it owns the schema or holds CREATE WITH GRANT
- * OPTION. A REAL superuser can do both unconditionally. Run on the operator's connection and, when
+ * OPTION, and `GRANT USAGE ON SCHEMA` — it owns the schema or holds USAGE WITH GRANT OPTION. A REAL
+ * superuser can do all three unconditionally. Run on the operator's connection and, when
  * present, on the master's; the router merges the two.
  *
  * MEMBERSHIP IN `rds_superuser` IS NOT SUPERUSER, and this probe no longer pretends it is. RDS's
@@ -238,7 +249,9 @@ SELECT
   d.schema_name AS schema,
   COALESCE(me.is_super OR pg_has_role(me.oid, r.oid, 'MEMBER WITH ADMIN OPTION'), false) AS can_grant_membership,
   COALESCE(me.is_super OR n.nspowner = me.oid
-     OR has_schema_privilege(me.oid, n.oid, 'CREATE WITH GRANT OPTION'), false) AS can_grant_create
+     OR has_schema_privilege(me.oid, n.oid, 'CREATE WITH GRANT OPTION'), false) AS can_grant_create,
+  COALESCE(me.is_super OR n.nspowner = me.oid
+     OR has_schema_privilege(me.oid, n.oid, 'USAGE WITH GRANT OPTION'), false) AS can_grant_usage
 FROM declared d
 CROSS JOIN me
 LEFT JOIN pg_roles r ON r.rolname = d.owner_name
@@ -250,7 +263,8 @@ ORDER BY d.owner_name, d.schema_name
 const keyOf = (owner: string, schema: string) => `${owner}\u0000${schema}`;
 
 /**
- * Route the two grants each (owner, schema) may need onto the connection that can run them.
+ * Route the three grants each (owner, schema) may need — membership, CREATE, USAGE — onto the
+ * connection that can run them.
  *
  * `operator` is the least-privilege role (`migrator`). `masterCaps` is null when no master
  * connection is available — then anything the operator cannot do is a refusal, never an
@@ -305,6 +319,16 @@ export function planOwnerEnactment(
         `Run as the schema owner:  ${stmt};`,
       );
     }
+    // 3. Usage: the owner's GRANT/REVOKE on the object name `schema.object` — resolving it needs USAGE.
+    if (f.schemaExists && !f.ownerCanUse) {
+      const stmt = `GRANT USAGE ON SCHEMA ${f.schema} TO ${f.owner}`;
+      if (op?.canGrantUsage) addUnit(b, subject, 'operator', [stmt]);
+      else if (master?.canGrantUsage) addUnit(b, subject, 'master', [stmt]);
+      else plan.refusals.push(
+        `cannot GRANT USAGE ON SCHEMA ${f.schema} TO ${f.owner}: neither connection owns the schema or holds USAGE WITH GRANT OPTION. ` +
+        `Run as the schema owner:  ${stmt};`,
+      );
+    }
     // An absent schema is not enacted here — it is created by the reconcile builder, whose own
     // preflight then names the owner's missing CREATE. Enactment acts only on what exists.
   }

package/src/provision.ts

@@ -606,6 +606,7 @@ function toFacts(rows: any[]): OwnerFactRow[] {
     schemaExists: truthy(r.schema_exists),
     canSetRole: truthy(r.can_set_role),
     ownerCanCreate: truthy(r.owner_can_create),
+    ownerCanUse: truthy(r.owner_can_use),
   }));
 }
 
@@ -615,6 +616,7 @@ function toCaps(rows: any[]): GranterCapabilityRow[] {
     schema: String(r.schema),
     canGrantMembership: truthy(r.can_grant_membership),
     canGrantCreate: truthy(r.can_grant_create),
+    canGrantUsage: truthy(r.can_grant_usage),
   }));
 }