@homeflare/alchemy 0.43.0 → 0.45.0

package/src/postgres/grants-ops.ts

@@ -0,0 +1,229 @@
+/**
+ * The lifecycle cores of `Postgres.Grants`, against any `PgExecutor` — the real pooled
+ * client through `withPg`, or the recording fake in tests: `reconcile`, `read`, `delete`
+ * and the plan-time `diff`. The resource declaration and its doctrine header live in
+ * `grants.ts`.
+ *
+ * ★ VALIDATE BEFORE ANY STATEMENT. The declaration refusals and the name-length check are
+ *   pure and run first, then the container guards (schema in `pg_namespace`, the grantee
+ *   role and every default-privileges creator in `pg_roles`), then — and only then — the
+ *   repair's statements.
+ * ★ `reconcile` CONVERGES BY PROOF, NOT TRUST (S10): read → plan → execute → re-read →
+ *   re-plan; an EMPTY second plan is the success condition and a non-empty one fails loud
+ *   with the surviving statements (`PostgresGrantsRepairRefused`).
+ * ★ `output` (the last applied attributes) drives the two update-path repairs: the
+ *   RETARGET guard (the plan-time one can be bypassed when `news` was unresolved at diff
+ *   time — a role created in the same deploy) and the REMOVED-entries revoke set, run
+ *   before the new declaration's plan and re-read after, because the server's `REVOKE ALL`
+ *   on a table also clears that grantee's column entries on it.
+ * ★ `read` answers `undefined` for a target that holds NOTHING anywhere and has no stored
+ *   output: that is a first create, never an adoption of an empty schema (H1: only grants
+ *   mark the target as live). On the update path — the resource already has applied state
+ *   — an all-empty projection is a real answer (the grantee owns everything outright, so
+ *   `aclexplode` has no rows) and is returned as the projection, not as absent. No role
+ *   check — the aclexplode reads are missing-role-safe by construction (`grants-read.ts`).
+ * ★ `delete` NEVER RE-GRANTS THE DECLARATION, NEVER CASCADES. The `retain` policy is the
+ *   default; the revokes are idempotent; the delete then re-reads and re-plans like
+ *   `reconcile` does (S10), so a third grantor's grant that a revoke cannot clear fails loud
+ *   with the surviving statements (`PostgresGrantsRepairRefused`) instead of surviving
+ *   silently (`REVOKE … CASCADE` is never issued). The one re-grant a delete still makes is
+ *   the collateral a table `REVOKE ALL` clears on columns the declaration never named (a
+ *   DBA's or another Grants resource's column grant): `planRepair` restores those as it does
+ *   on the reconcile path (`grants.ts:17-18`, `grants-plan.ts:12-14`), so a delete takes
+ *   away what the declaration managed and leaves everything else exactly as it was.
+ * ★ THE REPAIR'S WRITES ARE ONE TRANSACTION. `unsafe` is still one command — the socket
+ *   path's prepared statement cannot carry several, and each psql `unsafe` is its own
+ *   process — but `pg.transaction` is `BEGIN`…`COMMIT` on both transports (one reserved
+ *   connection on the socket, one psql script on the runner; `psql-executor.ts`). GRANT
+ *   and REVOKE do not call `PreventInTransactionBlock` (`database-sql.ts` cites the same
+ *   rule for role membership). Removal revokes and the repair are planned together
+ *   against one read (`planReconcile`: removed tables count as revoked) and committed
+ *   together, so a live grantee never observes the gap between a `REVOKE ALL` and the
+ *   grants that restore it. The convergence re-read runs after that commit.
+ */
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import { isResolved } from 'alchemy/Diff';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';
+import { roleExists } from './database-sql.ts';
+import type { PgExecutor } from './database-sql.ts';
+import { currentDatabase } from './schema-sql.ts';
+import type { namesFromAttrs } from './grants-declare.ts';
+import { clearedDeclaration, declaredNames, removedNames, resolveProps } from './grants-declare.ts';
+import {
+  type DeclarationRefusal,
+  declarationRefusal,
+  grantsNamesRefusal,
+} from './grants-refuse.ts';
+import { attributesOf, grantsDiffer } from './grants-diff.ts';
+import { requireDeclaredObjectsExist } from './grants-existence.ts';
+import { planReconcile, planRepair } from './grants-plan.ts';
+import { readGrants, schemaExists } from './grants-read.ts';
+import {
+  PostgresGrantsDatabaseMismatch,
+  PostgresGrantsDuplicateObject,
+  type PostgresGrantsError,
+  PostgresGrantsNameRefused,
+  PostgresGrantsPrivilegeRefused,
+  PostgresGrantsRepairRefused,
+  PostgresGrantsRetargetRefused,
+  PostgresGrantsRoleMissing,
+  PostgresGrantsSchemaMissing,
+} from './grants-errors.ts';
+
+const failRefusal = (refusal: DeclarationRefusal) =>
+  refusal.kind === 'privilege'
+    ? Effect.fail(new PostgresGrantsPrivilegeRefused({ prop: refusal.prop, word: refusal.word }))
+    : Effect.fail(new PostgresGrantsDuplicateObject({ prop: refusal.prop, name: refusal.name }));
+
+/** The handlers open the declared database; this proves the session landed there.
+ * `current_database()` is the server's answer, not the override we asked `withPg` for. */
+const proveDatabase = (
+  pg: PgExecutor,
+  declared: string,
+): Effect.Effect<void, PostgresGrantsDatabaseMismatch | SqlError> =>
+  Effect.flatMap(currentDatabase(pg), (connected) =>
+    connected === declared
+      ? Effect.void
+      : Effect.fail(new PostgresGrantsDatabaseMismatch({ declared, connected })),
+  );
+
+const refuseNames = (props: PostgresGrantsProps) => {
+  const declared = resolveProps(props);
+  const names = grantsNamesRefusal(declared);
+  return names === undefined
+    ? undefined
+    : new PostgresGrantsNameRefused({
+        name: names.name,
+        byteLength: names.byteLength,
+        limit: names.limit,
+      });
+};
+
+export const reconcileWithClient = (
+  pg: PgExecutor,
+  props: PostgresGrantsProps,
+  output: PostgresGrantsAttributes | undefined,
+): Effect.Effect<PostgresGrantsAttributes, PostgresGrantsError | SqlError> =>
+  Effect.gen(function* () {
+    const declared = resolveProps(props);
+    const declRefusal = declarationRefusal(declared);
+    if (declRefusal !== undefined) return yield* failRefusal(declRefusal);
+    const nameRefusal = refuseNames(props);
+    if (nameRefusal !== undefined) return yield* Effect.fail(nameRefusal);
+    for (const [prop, from, to] of [
+      ['role', output?.role, declared.role],
+      ['database', output?.database, declared.database],
+      ['schema', output?.schema, declared.schema],
+    ] as const) {
+      if (from !== undefined && from !== to) {
+        return yield* Effect.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+      }
+    }
+    yield* proveDatabase(pg, declared.database);
+    if (!(yield* schemaExists(pg, declared.schema))) {
+      return yield* Effect.fail(new PostgresGrantsSchemaMissing({ schema: declared.schema }));
+    }
+    // The grantee and every default-privileges creator must exist BEFORE any statement:
+    // the role a GRANT names is not missing-role-safe (unlike the aclexplode reads).
+    for (const role of [declared.role, ...declared.defaults.map((entry) => entry.forRole)]) {
+      if (!(yield* roleExists(pg, role))) {
+        return yield* Effect.fail(new PostgresGrantsRoleMissing({ role }));
+      }
+    }
+    // Declared relations and columns must exist before any statement: a GRANT/REVOKE on a
+    // missing object would fail raw after earlier statements had already landed, leaving
+    // the state row `creating` and the resume failing OwnedBySomeoneElse.
+    yield* requireDeclaredObjectsExist(pg, declared);
+    const removed = removedNames(output, declared);
+    const current = yield* readGrants(pg, declared.schema, declared.role);
+    const planned = planReconcile(declared, current, removed);
+    if (planned.length > 0) yield* pg.transaction(planned);
+    const after = yield* readGrants(pg, declared.schema, declared.role);
+    const remaining = planReconcile(declared, after, removed);
+    if (remaining.length > 0) {
+      return yield* Effect.fail(
+        new PostgresGrantsRepairRefused({
+          schema: declared.schema,
+          role: declared.role,
+          remaining,
+        }),
+      );
+    }
+    return attributesOf(after, declaredNames(declared));
+  });
+
+export const readWithClient = (
+  pg: PgExecutor,
+  names: ReturnType<typeof namesFromAttrs>,
+  stored: boolean,
+): Effect.Effect<PostgresGrantsAttributes | undefined, PostgresGrantsDatabaseMismatch | SqlError> =>
+  Effect.gen(function* () {
+    yield* proveDatabase(pg, names.database);
+    if (!(yield* schemaExists(pg, names.schema))) return undefined;
+    const live = yield* readGrants(pg, names.schema, names.role);
+    const projected = attributesOf(live, names);
+    const holdsAnything =
+      projected.schemaPrivileges.length > 0 ||
+      projected.tables.some((table) => table.privileges.length > 0) ||
+      projected.columns.some((column) => column.privileges.length > 0) ||
+      projected.defaults.some((entry) => entry.privileges.length > 0);
+    return stored || holdsAnything ? projected : undefined;
+  });
+
+export const deleteWithClient = (
+  pg: PgExecutor,
+  props: PostgresGrantsProps,
+): Effect.Effect<void, PostgresGrantsDatabaseMismatch | PostgresGrantsRepairRefused | SqlError> =>
+  Effect.gen(function* () {
+    yield* proveDatabase(pg, props.database);
+    if (!(yield* roleExists(pg, props.role))) return;
+    if (!(yield* schemaExists(pg, props.schema))) return;
+    const cleared = clearedDeclaration(resolveProps(props));
+    const live = yield* readGrants(pg, cleared.schema, cleared.role);
+    const planned = planRepair(cleared, live);
+    if (planned.length > 0) yield* pg.transaction(planned);
+    const after = yield* readGrants(pg, cleared.schema, cleared.role);
+    const remaining = planRepair(cleared, after);
+    if (remaining.length > 0) {
+      return yield* Effect.fail(
+        new PostgresGrantsRepairRefused({
+          schema: cleared.schema,
+          role: cleared.role,
+          remaining,
+        }),
+      );
+    }
+  });
+
+/** Plan-time only, entirely offline: a retarget of `role`/`database`/`schema` is a refusal
+ * (those three name WHAT the grant set is about); everything else validates the same way
+ * `reconcileWithClient` does, then answers `update` on any drift or `noop` on equality.
+ * Unresolved news answers `undefined` (the engine falls back to its own comparison) — the
+ * retarget is then re-checked inside `reconcile`, where news is resolved, so the bypass a
+ * same-deploy role would otherwise get is closed. */
+export const diffPostgresGrants = (
+  news: Input<PostgresGrantsProps>,
+  output: PostgresGrantsAttributes | undefined,
+) =>
+  Effect.gen(function* () {
+    if (output === undefined || !isResolved(news)) return undefined;
+    const declared = resolveProps(news);
+    for (const [prop, from, to] of [
+      ['role', output.role, declared.role],
+      ['database', output.database, declared.database],
+      ['schema', output.schema, declared.schema],
+    ] as const) {
+      if (from !== to) {
+        return yield* Effect.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+      }
+    }
+    const nameRefusal = refuseNames(news);
+    if (nameRefusal !== undefined) return yield* Effect.fail(nameRefusal);
+    const declRefusal = declarationRefusal(declared);
+    if (declRefusal !== undefined) return yield* failRefusal(declRefusal);
+    return grantsDiffer(declared, output)
+      ? ({ action: 'update' } as const)
+      : ({ action: 'noop' } as const);
+  });

package/src/postgres/grants-owner-revoke.test.ts

@@ -0,0 +1,121 @@
+/**
+ * The restorable-grantor rule for a table `REVOKE ALL`'s column collateral, driven end to end.
+ *
+ * ★ THE ENGINE RULE UNDER TEST (`select_best_grantor`, acl.c@REL_18_6): a superuser, the owner
+ *   itself, or a member of the owning role performs a `GRANT`/`REVOKE` AS the owner
+ *   (`revoke.sgml@REL_18_6`: "the command is performed as though it were issued by the
+ *   containing role that actually owns the object"). So the owner's column grant to an
+ *   undeclared grantee IS cleared by a table `REVOKE ALL` and must be marked `restorable` —
+ *   the repair re-grants it. A non-superuser, non-member revoker clears only grants it made,
+ *   so the owner's grant survives the revoke and must NOT be re-granted (that would stack an
+ *   owner grant on top of an entry the revoke never removed).
+ * ⚠️ THE OLD CHECK READ `rolsuper` ONLY. A migrator that is a member of the table's owning
+ *   role (but not a superuser) revokes as that owner too, so its table revoke cleared the
+ *   owner's grant while `revoker_super` said it was not restorable — the grant was dropped.
+ *   The read now selects `pg_has_role(current_user, c.relowner, 'USAGE')`, which is true for a
+ *   superuser AND for a member of the owning role (`has_privs_of_role`, acl.c@REL_18_6).
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeGrants } from './fake-grants-sql.ts';
+import { readGrants } from './grants-read.ts';
+import { reconcileWithClient } from './grants-ops.ts';
+import type { PostgresGrantsProps } from './grants-attrs.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+
+const props: PostgresGrantsProps = {
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  tables: [{ table: 'widgets', privileges: ['select'] }],
+};
+
+/** `widgets` is owned by `admin`; the undeclared `seat_writer` holds `admin`'s `update(qty)`
+ * column grant, and the table words drift so a table `REVOKE ALL` is planned. */
+const widgetsByAdmin = () => ({
+  schemas: ['app'],
+  roles: ['postgres', 'seat', 'admin', 'migrator', 'seat_writer'],
+  tables: [{ schema: 'app', table: 'widgets', columns: ['qty'], owner: 'admin' }],
+});
+
+const adminGrant = {
+  object: { schema: 'app', table: 'widgets', column: 'qty' },
+  grantee: 'seat_writer',
+  grantor: 'admin',
+  words: ['update'],
+} as const;
+
+const qtyGrantors = (fake: ReturnType<typeof makeFakeGrants>): ReadonlyArray<string> =>
+  fake.acl
+    .filter((entry) => entry.object.column === 'qty' && entry.grantee === 'seat_writer')
+    .map((entry) => entry.grantor);
+
+describe('a revoker that acts as the owner restores the owner\u2019s column grant', () => {
+  test('a non-superuser, non-member connection leaves the owner\u2019s grant alone and converges', async () => {
+    const fake = makeFakeGrants({
+      ...widgetsByAdmin(),
+      executor: 'seat',
+      executorSuper: false,
+      acl: [adminGrant],
+    });
+    const live = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(live.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: [] },
+    ]);
+    await run(reconcileWithClient(fake, props, undefined));
+    const after = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(after.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: [] },
+    ]);
+    // The revoke never removed the admin grant, and the repair did not stack a seat grant.
+    expect(qtyGrantors(fake)).toEqual(['admin']);
+  });
+
+  test('a member of the owning role revokes as the owner: the owner\u2019s grant survives a repair', async () => {
+    // `migrator` is a non-superuser member of `admin`, which owns `widgets`. Its table
+    // `REVOKE ALL` is performed as `admin` (revoke.sgml), so `admin`'s `update(qty)` grant is
+    // cleared and must be restored — the exact case the old `revoker_super` check missed.
+    const fake = makeFakeGrants({
+      ...widgetsByAdmin(),
+      executor: 'migrator',
+      executorSuper: false,
+      executorMemberships: ['admin'],
+      acl: [adminGrant],
+    });
+    const live = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(live.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: ['update'] },
+    ]);
+    await run(reconcileWithClient(fake, props, undefined));
+    const after = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(after.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: ['update'] },
+    ]);
+    // The repair re-granted the cleared grant AS the owner (admin), not as a stacked migrator
+    // grant on top of an entry the revoke left behind.
+    expect(qtyGrantors(fake)).toEqual(['admin']);
+  });
+
+  test('a superuser connection revokes as the owner and the repair restores the owner\u2019s grant', async () => {
+    // The grant predates the superuser promotion: `admin` granted `update(qty)` before the
+    // revoker became a superuser, and `pg_has_role(..., 'USAGE')` answers on the CURRENT
+    // status, so the grant is restorable regardless of when it was made.
+    const fake = makeFakeGrants({
+      ...widgetsByAdmin(),
+      executor: 'postgres',
+      executorSuper: true,
+      acl: [adminGrant],
+    });
+    const live = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(live.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: ['update'] },
+    ]);
+    await run(reconcileWithClient(fake, props, undefined));
+    const after = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(after.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: ['update'] },
+    ]);
+    expect(qtyGrantors(fake)).toEqual(['admin']);
+  });
+});

package/src/postgres/grants-ownership.ts

@@ -0,0 +1,49 @@
+/**
+ * The ownership reads of `Postgres.Grants`: `pg_namespace.nspowner` and `pg_class.relowner`
+ * for the declared role, in one schema. The repair and the delete need these to LEAVE
+ * objects the grantee owns alone (H2, `grants-plan.ts`): an owner holds every privilege
+ * implicitly and a `REVOKE` cannot take that away, so neither writes nor clears ACL rows
+ * on an owned object — measured on PG 18.6, where the docs' own seat example had its
+ * owner rights churned by the table-level `REVOKE ALL`.
+ *
+ * ★ A fresh schema or table the role owns carries NO ACL rows at all, so the ownership
+ *   facts cannot ride the `aclexplode` reads (`grants-read.ts`) — they are separate
+ *   queries, still inside the read's one bounded burst.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+
+/** `pg_namespace.nspowner = <role>` for one schema. No rows when the schema is absent —
+ * the caller then reads the fact as `false`. */
+const SCHEMA_OWNER_SQL = `SELECT
+    n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = $2) AS role_owns
+  FROM pg_namespace n
+  WHERE n.nspname = $1`;
+
+export const readSchemaOwnership = (
+  pg: PgExecutor,
+  schema: string,
+  role: string,
+): Effect.Effect<boolean, SqlError> =>
+  Effect.map(
+    pg.unsafe<{ readonly role_owns: boolean }>(SCHEMA_OWNER_SQL, [schema, role]),
+    (rows) => rows[0]?.role_owns === true,
+  );
+
+/** Every relation in the schema the declared role OWNS, all relkinds (the table class is
+ * not relkind-filtered, and neither is this). */
+const OWNED_TABLES_SQL = `SELECT c.relname AS table
+  FROM pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = $2)
+  ORDER BY c.relname`;
+
+export const readOwnedTables = (
+  pg: PgExecutor,
+  schema: string,
+  role: string,
+): Effect.Effect<ReadonlyArray<string>, SqlError> =>
+  Effect.map(pg.unsafe<{ readonly table: string }>(OWNED_TABLES_SQL, [schema, role]), (rows) =>
+    rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)),
+  );

package/src/postgres/grants-plan-collateral.test.ts

@@ -0,0 +1,202 @@
+/**
+ * Regression for the review finding: the server's table-level `REVOKE ALL` clears the
+ * grantee's column entries on that table — ALL of them, including columns the declaration
+ * does not name. The planner re-granted only the DECLARED columns of a revoked table, so a
+ * column grant the declaration never mentioned was stripped by a table-words repair and
+ * never restored — the seat silently lost a grant the resource promised never to touch
+ * ("an object the declaration does not name is NEVER touched", grants-declare.ts). The
+ * repair now re-grants every live column entry on a revoked table the declaration does not
+ * name, as it was read, in the same pass; PUBLIC column words are untouched, because a
+ * revoke from the seat role never clears PUBLIC's entries (a different grantee).
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeGrants } from './fake-grants-sql.ts';
+import { planReconcile, planRepair } from './grants-plan.ts';
+import { resolveProps } from './grants-declare.ts';
+import { readGrants } from './grants-read.ts';
+import { reconcileWithClient } from './grants-ops.ts';
+import type { PostgresGrantsProps } from './grants-attrs.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+
+/** `widgets` carries an executor-granted UPDATE on column `qty` — the seat's own grant the
+ * declaration never names, plus PUBLIC's — exactly what a table repair used to strip. */
+const catalog = {
+  schemas: ['app'],
+  roles: ['postgres', 'seat_writer'],
+  tables: [{ schema: 'app', table: 'widgets', columns: ['id', 'qty'] }],
+  acl: [
+    {
+      object: { schema: 'app', table: 'widgets', column: 'qty' },
+      grantee: 'seat_writer',
+      grantor: 'postgres',
+      words: ['update'],
+    },
+    {
+      object: { schema: 'app', table: 'widgets', column: 'qty' },
+      grantee: 'PUBLIC',
+      grantor: 'postgres',
+      words: ['select'],
+    },
+  ],
+};
+
+const props: PostgresGrantsProps = {
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  tables: [{ table: 'widgets', privileges: ['select'] }],
+};
+
+const isWrite = (text: string): boolean => /^(GRANT|REVOKE|ALTER)/.test(text);
+
+describe('planRepair: a table revoke preserves the column grants it collaterally clears', () => {
+  test('every undeclared column entry on the revoked table is re-granted as it was read', async () => {
+    const fake = makeFakeGrants(catalog);
+    const live = await run(readGrants(fake, 'app', 'seat_writer'));
+    // The table drifts (live role words are empty), so a REVOKE ALL on widgets is
+    // planned — and the undeclared qty words must ride along in the same pass. PUBLIC's
+    // qty words appear nowhere: a revoke from the seat role is not PUBLIC's business.
+    const statements = planRepair(resolveProps(props), live);
+    expect(statements).toContain('GRANT update ("qty") ON "app"."widgets" TO "seat_writer"');
+    expect(statements).not.toContain('GRANT select ("qty") ON "app"."widgets" TO PUBLIC');
+  });
+});
+
+describe('reconcile: the undeclared column grant survives a table-words repair', () => {
+  test('the repair converges in one pass and leaves the undeclared grant exactly as it was', async () => {
+    const fake = makeFakeGrants(catalog);
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+
+    expect(fake.statements.map((s) => s.text).filter(isWrite)).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'GRANT usage ON SCHEMA "app" TO "seat_writer"',
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+      'GRANT select ON "app"."widgets" TO "seat_writer"',
+      'GRANT update ("qty") ON "app"."widgets" TO "seat_writer"',
+    ]);
+    // The undeclared column never appears in the recorded state (the projection keeps
+    // only declared names), yet its grant is still live after the repair.
+    expect(attrs.columns).toEqual([]);
+    const after = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(after.columns).toEqual([
+      {
+        table: 'widgets',
+        column: 'qty',
+        role: ['update'],
+        public: ['select'],
+        restorable: ['update'],
+      },
+    ]);
+
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    await run(reconcileWithClient(fake, props, attrs));
+    expect(fake.statements.filter((s) => isWrite(s.text)).length).toBe(writesBefore);
+  });
+
+  test('a third grantor\u2019s column grant is left in place — re-granting would add an owner grant on top', async () => {
+    const fake = makeFakeGrants({
+      schemas: ['app'],
+      roles: ['postgres', 'seat_writer', 'someone_else'],
+      tables: [{ schema: 'app', table: 'widgets', columns: ['id', 'qty'] }],
+      acl: [
+        {
+          object: { schema: 'app', table: 'widgets', column: 'qty' },
+          grantee: 'seat_writer',
+          grantor: 'someone_else',
+          words: ['update'],
+        },
+      ],
+    });
+    await run(reconcileWithClient(fake, props, undefined));
+    expect(fake.statements.map((s) => s.text).filter(isWrite)).not.toContain(
+      'GRANT update ("qty") ON "app"."widgets" TO "seat_writer"',
+    );
+    expect(
+      fake.acl
+        .filter((entry) => entry.object.column === 'qty' && entry.grantee === 'seat_writer')
+        .map((entry) => entry.grantor),
+    ).toEqual(['someone_else']);
+  });
+});
+
+describe('removing a table restores the column grants its REVOKE clears', () => {
+  test('an out-of-band column grant survives dropping the table, in the same transaction', async () => {
+    const fake = makeFakeGrants({
+      schemas: ['app'],
+      roles: ['postgres', 'seat_writer'],
+      tables: [{ schema: 'app', table: 'widgets', columns: ['qty'] }],
+      acl: [
+        {
+          object: { schema: 'app' },
+          grantee: 'seat_writer',
+          grantor: 'postgres',
+          words: ['usage'],
+        },
+        {
+          object: { schema: 'app', table: 'widgets' },
+          grantee: 'seat_writer',
+          grantor: 'postgres',
+          words: ['select'],
+        },
+        {
+          object: { schema: 'app', table: 'widgets', column: 'qty' },
+          grantee: 'seat_writer',
+          grantor: 'postgres',
+          words: ['update'],
+        },
+      ],
+    });
+    const kept = await run(reconcileWithClient(fake, props, undefined));
+    const before = fake.transactions.length;
+    await run(reconcileWithClient(fake, { ...props, tables: [] }, kept));
+    const revoke = 'REVOKE ALL ON "app"."widgets" FROM "seat_writer"';
+    const grant = 'GRANT update ("qty") ON "app"."widgets" TO "seat_writer"';
+    expect(fake.transactions.slice(before)).toEqual([[revoke, grant]]);
+    const after = await run(readGrants(fake, 'app', 'seat_writer'));
+    expect(after.columns).toEqual([
+      { table: 'widgets', column: 'qty', role: ['update'], public: [], restorable: ['update'] },
+    ]);
+  });
+
+  test('the plan re-grants only restorable words, and not a column the update removed', () => {
+    const declared = resolveProps({ ...props, tables: [] });
+    const live = {
+      schemaExists: true,
+      schema: { role: ['usage'], public: [] },
+      tables: [{ table: 'widgets', relkind: 'r', role: ['select'], public: [] }],
+      columns: [
+        {
+          table: 'widgets',
+          column: 'qty',
+          role: ['update'],
+          public: [],
+          restorable: ['update'],
+        },
+        {
+          table: 'widgets',
+          column: 'id',
+          role: ['select'],
+          public: [],
+          restorable: ['select'],
+        },
+      ],
+      defaults: [],
+      schemaOwnedByRole: false,
+      ownedTables: [],
+    };
+    const removed = {
+      schema: 'app',
+      role: 'seat_writer',
+      tables: [{ table: 'widgets', privileges: [] as ReadonlyArray<string> }],
+      columns: [{ table: 'widgets', column: 'id', privileges: [] as ReadonlyArray<string> }],
+      defaults: [],
+    };
+    expect(planReconcile(declared, live, removed)).toEqual([
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+      'REVOKE ALL ("id") ON "app"."widgets" FROM "seat_writer"',
+      'GRANT update ("qty") ON "app"."widgets" TO "seat_writer"',
+    ]);
+  });
+});