@intentius/chant-lexicon-sql 0.116.0 → 0.117.0

package/src/postgres/access/acl.ts

@@ -0,0 +1,400 @@
+/**
+ * Access as chant compares it (#3681): the privileges each role holds on each
+ * object, and the default privileges objects are created with.
+ *
+ * A `grant` declaration is a statement, not an object: `GRANT SELECT ON a, b
+ * TO r1, r2` is four privileges, and the catalog keeps no statement, only
+ * each object's access control list. So declarations and the server are both
+ * brought to the same form, one entry per object (or column) and grantee
+ * holding a set of privileges, and those entries are compared.
+ *
+ * What a declared object's entries should be:
+ *
+ * - what Postgres gives a new object of its kind, the owner's own privileges
+ *   left out (a function or procedure: EXECUTE to PUBLIC; anything else:
+ *   nothing);
+ * - with the declared default privileges for objects of that kind created by
+ *   the role that applies, globally and in the object's schema, since chant
+ *   creates it as that role;
+ * - with every declared GRANT added and every declared REVOKE taken away, in
+ *   the build's order.
+ *
+ * The owner's own privileges are never compared: the owner has them by
+ * owning the object. A grant on an object the build does not declare (the
+ * `public` schema) is compared too, from what Postgres gives a new object.
+ *
+ * Default privileges are compared for the role that applies (and each role a
+ * declaration names with `FOR ROLE`): globally, where none declared means
+ * Postgres's own defaults, and per schema, where none declared means none.
+ */
+
+import { quoteIdent } from "../keywords";
+import { PG_CLASSIFIER_RULES } from "../plan/rules";
+import { classifiedChange } from "../../core/classifier";
+import type { PgChange } from "../plan/diff";
+import type { CanonicalPgObject } from "../plan/normalize";
+
+export type AclKind = "schema" | "table" | "sequence" | "function" | "procedure" | "column" | "default";
+
+/** The kinds of object default privileges are for. */
+export type DefaultObjects = "tables" | "sequences" | "functions" | "types" | "schemas";
+
+/** What an entry is on. */
+export interface AclTarget {
+  kind: AclKind;
+  /** The object's canonical name: `app`, `app.orders`, `app.f(integer)`. Empty for default privileges. */
+  name: string;
+  column?: string;
+  /** Default privileges: whose new objects (`""` for the role that applies), in which schema (undefined: every schema), of which kind. */
+  role?: string;
+  schema?: string;
+  objects?: DefaultObjects;
+}
+
+/** One grantee's privileges on one target: each privilege, and whether it was granted WITH GRANT OPTION. */
+export interface AclEntry {
+  target: AclTarget;
+  grantee: string;
+  privileges: Map<string, boolean>;
+}
+
+export type AccessState = Map<string, AclEntry>;
+
+/** An access change, with the statements that make it and the grant declarations behind it. */
+export interface AccessChange {
+  change: PgChange;
+  target: AclTarget;
+  grantee: string;
+  sql: string[];
+  /** The export names of the declarations that grant or revoke on this target to this grantee. */
+  exports: string[];
+}
+
+const SELF = "";
+
+/** A target's key: relations (tables, views, sequences) share one namespace, as in the catalog. */
+export function targetKey(t: AclTarget): string {
+  switch (t.kind) {
+    case "schema":
+      return `schema ${t.name}`;
+    case "table":
+    case "sequence":
+      return `relation ${t.name}`;
+    case "column":
+      return `relation ${t.name} (${quoteIdent(t.column ?? "")})`;
+    case "function":
+    case "procedure":
+      return `routine ${t.name}`;
+    case "default":
+      return `default privileges${t.role ? ` for ${quoteIdent(t.role)}` : ""}${t.schema !== undefined ? ` in ${quoteIdent(t.schema)}` : ""} on ${t.objects}`;
+  }
+}
+
+export const entryKey = (t: AclTarget, grantee: string): string => `${targetKey(t)} TO ${grantee === "public" ? "PUBLIC" : quoteIdent(grantee)}`;
+
+/** Every privilege of a kind of object, as ALL PRIVILEGES grants them. MAINTAIN is a table's from 17. */
+export function allPrivileges(kind: AclKind | DefaultObjects, major: number): string[] {
+  switch (kind) {
+    case "table":
+    case "tables":
+      return ["select", "insert", "update", "delete", "truncate", "references", "trigger", ...(major >= 17 ? ["maintain"] : [])];
+    case "sequence":
+    case "sequences":
+      return ["usage", "select", "update"];
+    case "schema":
+    case "schemas":
+      return ["usage", "create"];
+    case "function":
+    case "procedure":
+    case "functions":
+      return ["execute"];
+    case "types":
+      return ["usage"];
+    case "column":
+      return ["select", "insert", "update", "references"];
+    case "default":
+      return [];
+  }
+}
+
+/** What Postgres gives a new object of a kind, the owner's own privileges left out: EXECUTE on a routine and USAGE on a type to PUBLIC. */
+export function builtinEntries(kind: AclKind | DefaultObjects): Array<{ grantee: string; privilege: string }> {
+  if (kind === "function" || kind === "procedure" || kind === "functions") return [{ grantee: "public", privilege: "execute" }];
+  if (kind === "types") return [{ grantee: "public", privilege: "usage" }];
+  return [];
+}
+
+/** The default-privileges kind an object kind is created as. */
+const defaultObjectsOf = (kind: AclKind): DefaultObjects | undefined =>
+  kind === "table" ? "tables" : kind === "sequence" ? "sequences" : kind === "function" || kind === "procedure" ? "functions" : kind === "schema" ? "schemas" : undefined;
+
+function add(state: AccessState, target: AclTarget, grantee: string, privilege: string, grantable: boolean): void {
+  const key = entryKey(target, grantee);
+  let e = state.get(key);
+  if (!e) state.set(key, (e = { target, grantee, privileges: new Map() }));
+  e.privileges.set(privilege, grantable || e.privileges.get(privilege) === true);
+}
+
+function remove(state: AccessState, target: AclTarget, grantee: string, privilege: string, grantOptionOnly: boolean): void {
+  const e = state.get(entryKey(target, grantee));
+  if (!e || !e.privileges.has(privilege)) return;
+  if (grantOptionOnly) e.privileges.set(privilege, false);
+  else e.privileges.delete(privilege);
+}
+
+/** The state with every empty entry left out. */
+const compact = (state: AccessState): AccessState => new Map([...state].filter(([, e]) => e.privileges.size > 0));
+
+interface GrantFields {
+  action: "grant" | "revoke";
+  on: string;
+  objects?: string[];
+  privileges: Array<{ privilege: string; columns?: string[] }>;
+  grantees: string[];
+  forRoles?: string[];
+  inSchemas?: string[];
+  withGrantOption?: boolean;
+  grantOptionFor?: boolean;
+}
+
+export interface DeclaredAccess {
+  state: AccessState;
+  /** Every target the declarations decide: the declared objects and what the grants name. */
+  targets: AclTarget[];
+  /** The export names of the declarations behind each entry. */
+  exportsOf: Map<string, string[]>;
+  /** The roles `FOR ROLE` names, whose default privileges are compared too. */
+  forRoles: string[];
+}
+
+/**
+ * The access a set of declarations adds up to. `objects` are canonical, in
+ * the build's order, keyed by export name. `self` is the role that applies,
+ * when known: a declaration naming it with `FOR ROLE` is its own default
+ * privileges, and a grant to it is the owner's, which is never compared.
+ */
+export function declaredAccess(objects: ReadonlyArray<{ key: string; canonical: CanonicalPgObject }>, opts: { major: number; self?: string }): DeclaredAccess {
+  const state: AccessState = new Map();
+  const exportsOf = new Map<string, string[]>();
+  const targets = new Map<string, AclTarget>();
+  const relationKind = new Map<string, "table" | "sequence">();
+  const routineKind = new Map<string, "function" | "procedure">();
+  const forRoles = new Set<string>();
+  const roleOf = (r: string | undefined) => (r === undefined || r === opts.self ? SELF : r);
+  const note = (key: string, exportName: string) => exportsOf.set(key, [...new Set([...(exportsOf.get(key) ?? []), exportName])]);
+
+  // The objects themselves.
+  const declaredTargets: AclTarget[] = [];
+  for (const { canonical: o } of objects) {
+    const name = `${o.schema ? `${quoteIdent(o.schema)}.` : ""}${quoteIdent(o.name)}`;
+    if (o.kind === "schema") declaredTargets.push({ kind: "schema", name: quoteIdent(o.name) });
+    else if (o.kind === "table" || o.kind === "view" || o.kind === "materializedView") {
+      relationKind.set(name, "table");
+      declaredTargets.push({ kind: "table", name });
+    } else if (o.kind === "sequence") {
+      relationKind.set(name, "sequence");
+      declaredTargets.push({ kind: "sequence", name });
+    } else if (o.kind === "function" || o.kind === "procedure") {
+      routineKind.set(`${name}${o.signature ?? ""}`, o.kind);
+      declaredTargets.push({ kind: o.kind, name: `${name}${o.signature ?? ""}` });
+    }
+  }
+
+  // Default privileges, per role, schema and kind of object.
+  const defaults: AccessState = new Map();
+  const declaredDefaults = new Set<string>();
+  for (const { key: exportName, canonical: o } of objects) {
+    if (o.kind !== "defaultPrivileges") continue;
+    const g = o.fields.grant as GrantFields;
+    const on = g.on as DefaultObjects;
+    for (const r of g.forRoles ?? [undefined]) {
+      const role = roleOf(r);
+      if (role !== SELF) forRoles.add(role);
+      for (const schema of g.inSchemas ?? [undefined]) {
+        const target: AclTarget = { kind: "default", name: "", role, ...(schema !== undefined ? { schema } : {}), objects: on };
+        const tk = targetKey(target);
+        if (!declaredDefaults.has(tk)) {
+          declaredDefaults.add(tk);
+          targets.set(tk, target);
+          // A global entry starts from Postgres's own defaults; a schema's from nothing.
+          if (schema === undefined) for (const b of builtinEntries(on)) add(defaults, target, b.grantee, b.privilege, false);
+        }
+        for (const grantee of g.grantees) {
+          for (const p of g.privileges) {
+            for (const privilege of p.privilege === "all" ? allPrivileges(on, opts.major) : [p.privilege]) {
+              if (g.action === "grant") add(defaults, target, grantee, privilege, g.withGrantOption === true);
+              else remove(defaults, target, grantee, privilege, g.grantOptionFor === true);
+            }
+          }
+          note(entryKey(target, grantee), exportName);
+        }
+      }
+    }
+  }
+  for (const [k, e] of defaults) state.set(k, e);
+
+  /** What an object chant creates is given: Postgres's defaults, or the declared global ones, and the declared ones for its schema. */
+  const created = (t: AclTarget, schema: string | undefined) => {
+    const objectsKind = defaultObjectsOf(t.kind);
+    const global = objectsKind ? [...defaults.values()].filter((e) => e.target.role === SELF && e.target.schema === undefined && e.target.objects === objectsKind) : [];
+    const anyGlobal = objectsKind !== undefined && declaredDefaults.has(targetKey({ kind: "default", name: "", role: SELF, objects: objectsKind }));
+    if (!anyGlobal) for (const b of builtinEntries(t.kind)) add(state, t, b.grantee, b.privilege, false);
+    for (const e of global) for (const [p, g] of e.privileges) add(state, t, e.grantee, p, g);
+    if (objectsKind && schema !== undefined && objectsKind !== "schemas") {
+      for (const e of defaults.values()) {
+        if (e.target.role === SELF && e.target.schema === schema && e.target.objects === objectsKind) for (const [p, g] of e.privileges) add(state, t, e.grantee, p, g);
+      }
+    }
+  };
+  for (const t of declaredTargets) {
+    targets.set(targetKey(t), t);
+    const schema = t.kind === "schema" ? undefined : unquotedSchema(t.name);
+    created(t, schema);
+  }
+
+  // Grants and revokes, in the build's order.
+  for (const { key: exportName, canonical: o } of objects) {
+    if (o.kind !== "grant") continue;
+    const g = o.fields.grant as GrantFields;
+    for (const name of g.objects ?? []) {
+      const kind: AclKind =
+        g.on === "schema"
+          ? "schema"
+          : g.on === "sequence"
+            ? "sequence"
+            : g.on === "table"
+              ? (relationKind.get(name) ?? "table")
+              : g.on === "procedure"
+                ? "procedure"
+                : g.on === "function"
+                  ? "function"
+                  : (routineKind.get(name) ?? "function");
+      const target: AclTarget = { kind, name };
+      const tk = targetKey(target);
+      if (!targets.has(tk)) {
+        // An object the build does not declare starts from what Postgres gives a new one.
+        targets.set(tk, target);
+        for (const b of builtinEntries(kind)) add(state, target, b.grantee, b.privilege, false);
+      }
+      for (const grantee of g.grantees) {
+        for (const p of g.privileges) {
+          const on: AclTarget[] = p.columns ? p.columns.map((column) => ({ kind: "column" as const, name, column })) : [target];
+          for (const t of on) {
+            if (t.kind === "column") targets.set(targetKey(t), t);
+            for (const privilege of p.privilege === "all" ? allPrivileges(t.kind, opts.major) : [p.privilege]) {
+              if (g.action === "grant") add(state, t, grantee, privilege, g.withGrantOption === true);
+              else remove(state, t, grantee, privilege, g.grantOptionFor === true);
+            }
+            note(entryKey(t, grantee), exportName);
+          }
+        }
+      }
+    }
+  }
+
+  // A grant to the role that applies is the owner's, which owning gives.
+  const out = compact(new Map([...state].filter(([, e]) => opts.self === undefined || e.grantee !== opts.self)));
+  return { state: out, targets: [...targets.values()], exportsOf, forRoles: [...forRoles].sort() };
+}
+
+/** The schema of a canonical qualified name, unquoted. */
+function unquotedSchema(name: string): string | undefined {
+  const m = /^("(?:[^"]|"")*"|[^."]+)\./.exec(name);
+  if (!m) return undefined;
+  return m[1]!.startsWith('"') ? m[1]!.slice(1, -1).replace(/""/g, '"') : m[1]!;
+}
+
+const show = (privileges: ReadonlyMap<string, boolean> | undefined): string | undefined =>
+  privileges && privileges.size > 0 ? [...privileges].sort(([a], [b]) => (a < b ? -1 : 1)).map(([p, g]) => `${p}${g ? "*" : ""}`).join(", ") : undefined;
+
+const ON: Record<Exclude<AclKind, "default" | "column">, string> = { schema: "SCHEMA", table: "TABLE", sequence: "SEQUENCE", function: "FUNCTION", procedure: "PROCEDURE" };
+
+/** The `ON ...` and grantee of an entry's statements. */
+function onClause(t: AclTarget): string {
+  if (t.kind === "column" || t.kind === "default") return "";
+  return `ON ${ON[t.kind]} ${t.name}`;
+}
+
+const granteeSql = (g: string) => (g === "public" ? "PUBLIC" : quoteIdent(g));
+
+/** One GRANT or REVOKE for a set of privileges on one entry's target. */
+function statement(t: AclTarget, grantee: string, action: "grant" | "revoke" | "revoke-option", privileges: string[], withGrantOption = false): string {
+  const list = privileges.map((p) => p.toUpperCase()).join(", ");
+  const verb = action === "grant" ? "GRANT" : action === "revoke" ? "REVOKE" : "REVOKE GRANT OPTION FOR";
+  const to = action === "grant" ? "TO" : "FROM";
+  const tail = action === "grant" && withGrantOption ? " WITH GRANT OPTION" : "";
+  if (t.kind === "column") return `${verb} ${privileges.map((p) => `${p.toUpperCase()} (${quoteIdent(t.column ?? "")})`).join(", ")} ON TABLE ${t.name} ${to} ${granteeSql(grantee)}${tail}`;
+  if (t.kind === "default") {
+    const head = `ALTER DEFAULT PRIVILEGES${t.role ? ` FOR ROLE ${quoteIdent(t.role)}` : ""}${t.schema !== undefined ? ` IN SCHEMA ${quoteIdent(t.schema)}` : ""}`;
+    return `${head} ${verb} ${list} ON ${String(t.objects).toUpperCase()} ${to} ${granteeSql(grantee)}${tail}`;
+  }
+  return `${verb} ${list} ${onClause(t)} ${to} ${granteeSql(grantee)}${tail}`;
+}
+
+/**
+ * The changes from `before` to `after`, one per entry and direction, each
+ * with its statements: revokes first (a privilege, then a grant option), then
+ * grants (a grant option on its own with WITH GRANT OPTION).
+ */
+export function diffAccess(before: AccessState, after: AccessState, exportsOf: ReadonlyMap<string, string[]> = new Map()): AccessChange[] {
+  const out: AccessChange[] = [];
+  const keys = [...new Set([...before.keys(), ...after.keys()])].sort();
+  for (const key of keys) {
+    const b = before.get(key);
+    const a = after.get(key);
+    const target = (a ?? b)!.target;
+    const grantee = (a ?? b)!.grantee;
+    const bp = b?.privileges ?? new Map<string, boolean>();
+    const ap = a?.privileges ?? new Map<string, boolean>();
+    const revoke = [...bp.keys()].filter((p) => !ap.has(p)).sort();
+    const revokeOption = [...bp].filter(([p, g]) => g && ap.get(p) === false).map(([p]) => p).sort();
+    const grant = [...ap].filter(([p, g]) => !bp.has(p) || (g && bp.get(p) === false)).map(([p]) => p).sort();
+    if (revoke.length + revokeOption.length + grant.length === 0) continue;
+    const exports = exportsOf.get(key) ?? [];
+    const rule = target.kind === "default" ? "SQLPG298" : revoke.length + revokeOption.length > 0 && grant.length === 0 ? "SQLPG297" : "SQLPG296";
+    const sql: string[] = [];
+    if (revoke.length > 0) sql.push(statement(target, grantee, "revoke", revoke));
+    if (revokeOption.length > 0) sql.push(statement(target, grantee, "revoke-option", revokeOption));
+    const plain = grant.filter((p) => ap.get(p) === false);
+    const withOption = grant.filter((p) => ap.get(p) === true);
+    if (plain.length > 0) sql.push(statement(target, grantee, "grant", plain));
+    if (withOption.length > 0) sql.push(statement(target, grantee, "grant", withOption, true));
+    const change = classifiedChange(PG_CLASSIFIER_RULES, `acl ${key}`, "privileges", rule, show(bp), show(ap), revoke.length > 0 && grant.length > 0 ? { note: `revokes ${revoke.join(", ")}` } : {});
+    out.push({ change, target, grantee, sql, exports });
+  }
+  return out;
+}
+
+/** What a server holds: its entries, which objects exist, and for which kinds the role that applies has global default privileges of its own. */
+export interface LiveAccess {
+  state: AccessState;
+  /** The target keys of the objects that exist. */
+  present: Set<string>;
+  /** The kinds of object the role that applies has a global `pg_default_acl` row for. */
+  globalDefaults: Set<DefaultObjects>;
+}
+
+/**
+ * The entries the server would give each declared object that does not exist
+ * yet: Postgres's defaults, or the role's global default privileges, and its
+ * default privileges in the object's schema.
+ */
+export function predictedAccess(missing: readonly AclTarget[], live: LiveAccess): AccessState {
+  const out: AccessState = new Map();
+  const defaults = [...live.state.values()].filter((e) => e.target.kind === "default" && e.target.role === SELF);
+  for (const t of missing) {
+    const objectsKind = defaultObjectsOf(t.kind);
+    if (!objectsKind) continue;
+    if (!live.globalDefaults.has(objectsKind)) for (const b of builtinEntries(t.kind)) add(out, t, b.grantee, b.privilege, false);
+    const schema = t.kind === "schema" ? undefined : unquotedSchema(t.name);
+    for (const e of defaults) {
+      if (e.target.objects !== objectsKind) continue;
+      if (e.target.schema === undefined || (e.target.schema === schema && objectsKind !== "schemas")) for (const [p, g] of e.privileges) add(out, t, e.grantee, p, g);
+    }
+  }
+  return compact(out);
+}
+
+/** Adds an entry, for the live reader. */
+export const addEntry = add;
+export { SELF as APPLYING_ROLE };

package/src/postgres/access/import.ts

@@ -0,0 +1,64 @@
+/**
+ * Import's access (#3681): the privileges on the imported objects, and the
+ * default privileges of the role that reads, as `grant` declarations. Each
+ * is the GRANT, REVOKE or ALTER DEFAULT PRIVILEGES that takes what Postgres
+ * gives a new object (EXECUTE to PUBLIC on a routine, nothing on the rest) to
+ * what the server holds, one per object and grantee, so the import plans as
+ * no change.
+ */
+
+import type { PostgresClient } from "../live/client";
+import type { LivePgObject } from "../live/catalog";
+import type { ImportedPgObject } from "../import/ir";
+import { POSTGRES_ENTITY_TYPES } from "../entity-types";
+import { quoteIdent } from "../keywords";
+import { builtinEntries, diffAccess, entryKey, targetKey, type AccessState, type AclTarget } from "./acl";
+import { readLiveAccess } from "./live";
+
+/** The access targets of imported objects, named as the catalog read names them. */
+function targetsOf(objects: readonly LivePgObject[]): AclTarget[] {
+  const out: AclTarget[] = [];
+  for (const o of objects) {
+    const name = `${o.schema ? `${quoteIdent(o.schema)}.` : ""}${quoteIdent(o.name)}`;
+    if (o.type === POSTGRES_ENTITY_TYPES.schema) out.push({ kind: "schema", name: quoteIdent(o.name) });
+    else if (o.type === POSTGRES_ENTITY_TYPES.table || o.type === POSTGRES_ENTITY_TYPES.view || o.type === POSTGRES_ENTITY_TYPES.materializedView) out.push({ kind: "table", name });
+    else if (o.type === POSTGRES_ENTITY_TYPES.sequence) out.push({ kind: "sequence", name });
+    else if (o.type === POSTGRES_ENTITY_TYPES.function || o.type === POSTGRES_ENTITY_TYPES.procedure) {
+      out.push({ kind: o.type === POSTGRES_ENTITY_TYPES.function ? "function" : "procedure", name: `${name}${o.signature ?? ""}` });
+    }
+  }
+  return out;
+}
+
+const word = (s: string) => s.replace(/[^A-Za-z0-9]+/g, "_").replace(/^_|_$/g, "");
+
+export async function importedAccess(client: PostgresClient, objects: readonly LivePgObject[], schemas: readonly string[] | undefined): Promise<ImportedPgObject[]> {
+  const targets = targetsOf(objects);
+  const live = await readLiveAccess(client, targets, schemas ? { schemas } : {});
+  // What a new object is given: the starting point each declaration takes to the server's.
+  const baseline: AccessState = new Map();
+  for (const t of targets) {
+    for (const b of builtinEntries(t.kind)) baseline.set(entryKey(t, b.grantee), { target: t, grantee: b.grantee, privileges: new Map([[b.privilege, false]]) });
+  }
+  for (const e of live.state.values()) {
+    if (e.target.kind !== "default" || e.target.schema !== undefined) continue;
+    for (const b of builtinEntries(e.target.objects!)) {
+      const k = entryKey(e.target, b.grantee);
+      if (!baseline.has(k)) baseline.set(k, { target: e.target, grantee: b.grantee, privileges: new Map([[b.privilege, false]]) });
+    }
+  }
+  // Only global default rows that exist on the server are compared from Postgres's own defaults.
+  const globalRows = new Set([...live.state.values()].filter((e) => e.target.kind === "default").map((e) => targetKey(e.target)));
+  const from = new Map([...baseline].filter(([, e]) => e.target.kind !== "default" || globalRows.has(targetKey(e.target))));
+  return diffAccess(from, live.state).flatMap((c) =>
+    c.sql.map((sql, i) => {
+      const defaults = c.target.kind === "default";
+      const on = defaults ? `default_${c.target.schema ?? "all"}_${c.target.objects}` : c.target.name.replace(/\(.*$/, "").split(".").pop()!;
+      return {
+        type: defaults ? POSTGRES_ENTITY_TYPES.defaultPrivileges : POSTGRES_ENTITY_TYPES.grant,
+        name: word(`${/^REVOKE|^ALTER DEFAULT PRIVILEGES.* REVOKE /.test(sql) ? "revoke" : "grant"}_${on}${c.target.column ? `_${c.target.column}` : ""}_${c.grantee}${i > 0 ? `_${i}` : ""}`),
+        ddl: sql,
+      };
+    }),
+  );
+}

package/src/postgres/access/live.ts

@@ -0,0 +1,123 @@
+/**
+ * Reading access from a live server (#3681): each target's access control
+ * list, exploded into one entry per grantee (`aclexplode`, with
+ * `acldefault` where the list is NULL, which means Postgres's own defaults),
+ * the owner's own privileges left out; every column's list of a relation
+ * read; and the default privileges (`pg_default_acl`) of the role that runs
+ * the read and of the roles the declarations name with `FOR ROLE`, globally
+ * and in the schemas in scope.
+ */
+
+import type { PostgresClient } from "../live/client";
+import { addEntry, APPLYING_ROLE, builtinEntries, targetKey, type AccessState, type AclTarget, type DefaultObjects, type LiveAccess } from "./acl";
+
+type Row = Record<string, unknown>;
+
+const OBJTYPE: Readonly<Record<string, DefaultObjects>> = { r: "tables", S: "sequences", f: "functions", T: "types", n: "schemas" };
+
+const GRANTEE = "CASE WHEN a.grantee = 0 THEN 'public' ELSE pg_catalog.pg_get_userbyid(a.grantee) END";
+
+export interface LiveAccessScope {
+  /** The schemas whose default privileges are read; undefined is every schema. */
+  schemas?: readonly string[];
+  /** Roles besides the one that runs the read whose default privileges are read. */
+  forRoles?: readonly string[];
+  /** Global default-privilege targets the declarations decide: one with no row on the server holds Postgres's own defaults. */
+  declaredDefaults?: readonly AclTarget[];
+}
+
+/** The access the server holds on `targets`, and the default privileges in scope. */
+export async function readLiveAccess(client: PostgresClient, targets: readonly AclTarget[], scope: LiveAccessScope = {}): Promise<LiveAccess & { self: string }> {
+  const state: AccessState = new Map();
+  const present = new Set<string>();
+  const [me] = await client.query<Row>("SELECT current_user AS self");
+  const self = String(me?.self ?? "");
+  const entry = (t: AclTarget, r: Row) => addEntry(state, t, String(r.grantee), String(r.privilege).toLowerCase(), r.grantable === true);
+
+  const names = (kinds: readonly string[]) => [...new Set(targets.filter((t) => kinds.includes(t.kind)).map((t) => t.name))];
+
+  const schemas = names(["schema"]);
+  if (schemas.length > 0) {
+    const rows = await client.query<Row>(
+      `SELECT x AS target, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_namespace n ON n.oid = pg_catalog.to_regnamespace(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(n.nspacl, pg_catalog.acldefault('n'::"char", n.nspowner))) a ON a.grantee <> n.nspowner`,
+      [schemas],
+    );
+    for (const r of rows) {
+      const t: AclTarget = { kind: "schema", name: String(r.target) };
+      present.add(targetKey(t));
+      if (r.privilege !== null) entry(t, r);
+    }
+  }
+
+  const relations = names(["table", "sequence", "column"]);
+  if (relations.length > 0) {
+    const rows = await client.query<Row>(
+      `SELECT x AS target, c.relkind AS kind, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_class c ON c.oid = pg_catalog.to_regclass(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(c.relacl, pg_catalog.acldefault((CASE WHEN c.relkind = 'S' THEN 's' ELSE 'r' END)::"char", c.relowner))) a ON a.grantee <> c.relowner`,
+      [relations],
+    );
+    for (const r of rows) {
+      const t: AclTarget = { kind: r.kind === "S" ? "sequence" : "table", name: String(r.target) };
+      present.add(targetKey(t));
+      if (r.privilege !== null) entry(t, r);
+    }
+    const columns = await client.query<Row>(
+      `SELECT x AS target, att.attname AS column, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_class c ON c.oid = pg_catalog.to_regclass(x)
+       JOIN pg_catalog.pg_attribute att ON att.attrelid = c.oid AND att.attnum > 0 AND NOT att.attisdropped AND att.attacl IS NOT NULL
+       CROSS JOIN LATERAL pg_catalog.aclexplode(att.attacl) a
+       WHERE a.grantee <> c.relowner`,
+      [relations],
+    );
+    for (const r of columns) entry({ kind: "column", name: String(r.target), column: String(r.column) }, r);
+  }
+
+  const routines = names(["function", "procedure"]);
+  if (routines.length > 0) {
+    const rows = await client.query<Row>(
+      `SELECT x AS target, p.prokind AS kind, ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+       FROM pg_catalog.unnest($1::text[]) x JOIN pg_catalog.pg_proc p ON p.oid = pg_catalog.to_regprocedure(x)
+       LEFT JOIN LATERAL pg_catalog.aclexplode(COALESCE(p.proacl, pg_catalog.acldefault('f'::"char", p.proowner))) a ON a.grantee <> p.proowner`,
+      [routines],
+    );
+    for (const r of rows) {
+      const t: AclTarget = { kind: r.kind === "p" ? "procedure" : "function", name: String(r.target) };
+      present.add(targetKey(t));
+      if (r.privilege !== null) entry(t, r);
+    }
+  }
+
+  // Default privileges: the reading role's (written as the role that applies) and the FOR ROLE ones.
+  const roles = [self, ...(scope.forRoles ?? [])];
+  const defaults = await client.query<Row>(
+    `SELECT pg_catalog.pg_get_userbyid(d.defaclrole) AS role, n.nspname AS schema, d.defaclobjtype AS objtype,
+            ${GRANTEE} AS grantee, a.privilege_type AS privilege, a.is_grantable AS grantable
+     FROM pg_catalog.pg_default_acl d LEFT JOIN pg_catalog.pg_namespace n ON n.oid = d.defaclnamespace
+     LEFT JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) a ON a.grantee <> d.defaclrole
+     WHERE pg_catalog.pg_get_userbyid(d.defaclrole) = ANY($1::text[])
+       AND (d.defaclnamespace = 0${scope.schemas ? " OR n.nspname = ANY($2::text[])" : ""})`,
+    scope.schemas ? [roles, [...scope.schemas]] : [roles],
+  );
+  const globalRows = new Set<string>();
+  const globalDefaults = new Set<DefaultObjects>();
+  for (const r of defaults) {
+    const objects = OBJTYPE[String(r.objtype)];
+    if (!objects) continue;
+    const role = String(r.role) === self ? APPLYING_ROLE : String(r.role);
+    const t: AclTarget = { kind: "default", name: "", role, ...(r.schema !== null && r.schema !== undefined ? { schema: String(r.schema) } : {}), objects };
+    if (t.schema === undefined) {
+      globalRows.add(targetKey(t));
+      if (role === APPLYING_ROLE) globalDefaults.add(objects);
+    }
+    if (r.privilege !== null) entry(t, r);
+  }
+  // A global default the declarations decide with no row on the server is Postgres's own.
+  for (const t of scope.declaredDefaults ?? []) {
+    if (t.kind !== "default" || t.schema !== undefined || globalRows.has(targetKey(t))) continue;
+    for (const b of builtinEntries(t.objects!)) addEntry(state, t, b.grantee, b.privilege, false);
+  }
+  return { state, present, globalDefaults, self };
+}