@intentius/chant-lexicon-sql 0.118.1 → 0.120.0

package/src/migration-statements.ts

@@ -112,6 +112,8 @@ function clickhouseStatements(beforeJson: string, afterJson: string, options: Di
     current: new Map(before.map((o) => [o.exportName, o.canonical])),
     keyOf: (o) => o.exportName,
     allowDestructive: true,
+    // A user whose password is the environment's exists by the time a migration runs: the GRANTs to it need it too (#3717).
+    environmentCreatesUsers: true,
     topology,
     ...(options.marker ? { marker: options.marker } : {}),
   });

package/src/op/__snapshots__/watch-pipeline.test.ts.snap

@@ -62,7 +62,7 @@ jobs:
 `;
 
 exports[`generateOpsPipeline renders the sql drift watch (#3642) > GitLab: a schedule-only job with the reader's credentials and no token of its own 1`] = `
-"# chant Ops (#927, #2084, #2293) — one job per Op under stage "ops", each
+"# chant Ops — one job per Op under stage "ops", each
 # selected by its own rules:. A merge_request_event or push job needs no
 # setup; its rule fires on the event itself.
 #

package/src/op/activities/clickhouse-emulator.ts

@@ -10,9 +10,28 @@
  * `upstreamPin` already tracks the LTS tags (`-lts`).
  */
 
-import { emulatorLifecycle, type EmulatorCapability, type EmulatorSpec } from "@intentius/chant/op";
+import { emulatorLifecycle, type EmulatorCapability, type EmulatorIdentity, type EmulatorSpec } from "@intentius/chant/op";
 import { clickhouseImage } from "../../spec/pin";
 
+/**
+ * The server's UUID (#3673), read in the container and through the endpoint
+ * `status` prints, so a server of another origin on the same port is told
+ * apart from the emulator.
+ */
+export const CLICKHOUSE_EMULATOR_IDENTITY: EmulatorIdentity = {
+  server: "ClickHouse",
+  command: ["clickhouse-client", "-q", "SELECT serverUUID()"],
+  async probe(endpoint) {
+    const url = new URL(endpoint);
+    url.searchParams.set("query", "SELECT serverUUID(), version() FORMAT TSV");
+    const res = await fetch(url, { signal: AbortSignal.timeout(5_000) });
+    const body = (await res.text()).trim();
+    if (!res.ok) throw new Error(`HTTP ${res.status}: ${body.split("\n")[0]}`);
+    const [id = "", version = "(unknown version)"] = body.split("\t");
+    return { id, label: `ClickHouse ${version}` };
+  },
+};
+
 export const CLICKHOUSE_EMULATOR_SPEC: EmulatorSpec = {
   name: "chant-clickhouse",
   image: clickhouseImage(),
@@ -21,6 +40,8 @@ export const CLICKHOUSE_EMULATOR_SPEC: EmulatorSpec = {
   // The image disables network access for the passwordless default user
   // unless this is set; a local server is reached as `default` with no password.
   runArgs: ["-e", "CLICKHOUSE_SKIP_USER_SETUP=1"],
+  identity: CLICKHOUSE_EMULATOR_IDENTITY,
+  credentials: "user default, no password",
 };
 
 /** `CLICKHOUSE_URL` is the variable binding reads when no `sql.profiles.<env>` names a server. */

package/src/op/activities/postgres-apply-lock-timeout.e2e.test.ts

@@ -0,0 +1,87 @@
+/**
+ * The applier's catalog read under `lock_timeout` (#3726). One session holds
+ * ACCESS EXCLUSIVE on a table behind a view; `postgresApply` of a build that
+ * declares the view reads its definition first, so it stops after the
+ * profile's `lockTimeoutMs` instead of waiting for the lock, names the table
+ * and the pid holding it, and writes nothing.
+ *
+ * `CHANT_SQL_E2E_POSTGRES_URL` (with `CHANT_SQL_E2E_POSTGRES_PASSWORD`) names
+ * a running server, else a throwaway one, skipped when Docker is not
+ * available. The test makes only the schema `chant_e2e_3726`, dropped
+ * afterwards.
+ */
+
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startTestPostgres, type TestPostgres } from "../../postgres/testing/server";
+import { connectPostgres, type PostgresClient, type PostgresEndpoint } from "../../postgres/live/client";
+import { postgresApply } from "./postgres-apply";
+
+const SCHEMA = "chant_e2e_3726";
+const given = process.env.CHANT_SQL_E2E_POSTGRES_URL;
+const enabled = given ? true : await dockerAvailable();
+const dir = mkdtempSync(join(tmpdir(), "chant-pg-apply-3726-"));
+let server: TestPostgres | undefined;
+let endpoint: PostgresEndpoint;
+let admin: PostgresClient;
+let holder: PostgresClient;
+
+describe.skipIf(!enabled)("an apply whose catalog read is blocked behind ACCESS EXCLUSIVE", () => {
+  beforeAll(async () => {
+    if (given) endpoint = { url: given, password: process.env.CHANT_SQL_E2E_POSTGRES_PASSWORD ?? "" };
+    else {
+      server = await startTestPostgres();
+      endpoint = server.endpoint();
+    }
+    admin = await connectPostgres(endpoint);
+    await admin.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`);
+    await admin.query(`CREATE SCHEMA ${SCHEMA}`);
+    await admin.query(`CREATE TABLE ${SCHEMA}.orders (id bigint PRIMARY KEY)`);
+    await admin.query(`CREATE VIEW ${SCHEMA}.recent AS SELECT id FROM ${SCHEMA}.orders`);
+    holder = await connectPostgres(endpoint, { applicationName: "chant-e2e-3726-holder" });
+    await holder.query("BEGIN");
+    await holder.query(`LOCK TABLE ${SCHEMA}.orders IN ACCESS EXCLUSIVE MODE`);
+  }, 600_000);
+
+  afterAll(async () => {
+    await holder?.query("ROLLBACK").catch(() => undefined);
+    await holder?.end();
+    await admin?.query(`DROP SCHEMA IF EXISTS ${SCHEMA} CASCADE`).catch(() => undefined);
+    await admin?.end();
+    await server?.stop();
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("stops after lockTimeoutMs, naming the table and the pid, with nothing written", async () => {
+    const [{ pid }] = await holder.query<{ pid: number }>("SELECT pg_catalog.pg_backend_pid() AS pid");
+    const buildPath = join(dir, "schema.json");
+    writeFileSync(
+      buildPath,
+      JSON.stringify({
+        dialect: "postgres",
+        applyOrder: ["app", "orders", "recent", "audit"],
+        objects: [
+          { export: "app", type: "Postgres::Schema", dependsOn: [], ddl: `CREATE SCHEMA ${SCHEMA}` },
+          { export: "orders", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${SCHEMA}.orders (\n  id bigint PRIMARY KEY\n)` },
+          { export: "recent", type: "Postgres::View", dependsOn: ["orders"], ddl: `CREATE VIEW ${SCHEMA}.recent AS SELECT id FROM ${SCHEMA}.orders` },
+          { export: "audit", type: "Postgres::Table", dependsOn: ["app"], ddl: `CREATE TABLE ${SCHEMA}.audit (\n  id bigint\n)` },
+        ],
+      }),
+    );
+    const started = Date.now();
+    const err = (await postgresApply({ buildPath, environment: "e2e" }, undefined, {
+      config: { ownership: { stack: "e2e3726", env: "e2e" }, sql: { profiles: { e2e: { url: endpoint.url, password: { env: "PG_E2E_3726_PASSWORD" }, schemas: [SCHEMA], lockTimeoutMs: 300 } } } },
+      env: { PG_E2E_3726_PASSWORD: endpoint.password ?? "" },
+      log: () => undefined,
+    }).catch((e: unknown) => e)) as Error;
+    expect(Date.now() - started).toBeLessThan(10_000);
+    expect(err).toBeInstanceOf(Error);
+    expect(err.message).toContain("lock timeout: the catalog read waited 300ms for a lock");
+    expect(err.message).toContain(`${SCHEMA}.orders is held in ACCESS EXCLUSIVE by pid ${pid}`);
+    expect(err.message).toContain("chant-e2e-3726-holder");
+    const [audit] = await admin.query<{ n: number }>(`SELECT count(*)::int AS n FROM pg_catalog.pg_tables WHERE schemaname = $1 AND tablename = 'audit'`, [SCHEMA]);
+    expect(audit?.n).toBe(0);
+  }, 60_000);
+});

package/src/op/activities/postgres-apply.test.ts

@@ -8,6 +8,7 @@ import { buildMajor, postgresApply, type PostgresApplyArgs, type PostgresApplyDe
 import { toApplyResult } from "./index";
 import { writablePostgres, type StoredPgObject, type WritablePostgres } from "../../postgres/testing/writable-server";
 import { PostgresApplyError } from "../../postgres/apply/apply";
+import { PostgresQueryError } from "../../postgres/live/client";
 
 const dirs: string[] = [];
 afterAll(() => {
@@ -213,6 +214,37 @@ describe("a statement the server refuses", () => {
   });
 });
 
+describe("the catalog read before applying (#3726)", () => {
+  test("runs under the profile's lockTimeoutMs, else 5000 ms, else the argument's", async () => {
+    for (const [profile, arg, expected] of [[undefined, undefined, "5000ms"], [250, undefined, "250ms"], [250, 75, "75ms"]] as const) {
+      const s = writablePostgres();
+      const sent: unknown[][] = [];
+      const config = { ownership: { stack: "shop", env: "prod" }, sql: { profiles: { test: { url: "postgres://fake/shop", ...(profile !== undefined ? { lockTimeoutMs: profile } : {}) } } } };
+      const client = { query: (sql: string, p?: readonly unknown[]) => (sent.push([sql, ...(p ?? [])]), s.client.query(sql)), end: s.client.end };
+      await apply(s, [APP], arg !== undefined ? { lockTimeoutMs: arg } : {}, { config, env: {}, connect: async () => client as never });
+      expect(sent[0]).toEqual(["SELECT pg_catalog.set_config('lock_timeout', $1, false)", expected]);
+    }
+  });
+
+  test("blocked behind ACCESS EXCLUSIVE, it stops before any write, naming the relation and the pid holding it", async () => {
+    const s = writablePostgres();
+    const client = {
+      async query<T>(sql: string): Promise<T[]> {
+        if (sql.includes("pg_get_viewdef")) throw new PostgresQueryError("canceling statement due to lock timeout", "55P03");
+        if (sql.includes("pg_catalog.pg_locks")) return [{ pid: 4242, relation: "app.users", application: "psql", state: "idle in transaction", seconds: 9, query: "LOCK TABLE app.users" }] as T[];
+        return s.client.query<T>(sql);
+      },
+      end: s.client.end,
+    };
+    const err = (await apply(s, ALL, {}, { connect: async () => client as never, readLive: async (c) => (await c.query("SELECT pg_catalog.pg_get_viewdef(1)"), []) }).catch((e: unknown) => e)) as Error;
+    expect(err).toBeInstanceOf(PostgresQueryError);
+    expect(err.message).toContain("canceling statement due to lock timeout: the catalog read waited 5000ms for a lock");
+    expect(err.message).toContain("app.users is held in ACCESS EXCLUSIVE by pid 4242");
+    expect(s.writes).toEqual([]);
+    expect(s.control).toEqual([]);
+  });
+});
+
 describe("the target major", () => {
   test("is the build output's postgresMajor", () => {
     expect(buildMajor(JSON.stringify({ dialect: "postgres", postgresMajor: 16, objects: [] }))).toBe(16);

package/src/op/activities/postgres-emulator.test.ts

@@ -24,3 +24,23 @@ describe("the Postgres emulator capability (#3280)", () => {
     expect(lc.endpoint(5432)).toBe("postgres://localhost:5432/postgres");
   });
 });
+
+describe("the sql emulators say who they are (#3673)", () => {
+  test("Postgres compares the cluster's system identifier, read over the container's socket", () => {
+    expect(POSTGRES_EMULATOR.spec.identity?.server).toBe("Postgres");
+    expect(POSTGRES_EMULATOR.spec.identity?.command).toEqual(["psql", "-U", "postgres", "-tAc", "select system_identifier from pg_control_system()"]);
+    expect(POSTGRES_EMULATOR.spec.credentials).toBe("user postgres, password chant");
+  });
+
+  test("ClickHouse compares serverUUID(), and signs in as default with no password", () => {
+    expect(CLICKHOUSE_EMULATOR.spec.identity?.server).toBe("ClickHouse");
+    expect(CLICKHOUSE_EMULATOR.spec.identity?.command).toEqual(["clickhouse-client", "-q", "SELECT serverUUID()"]);
+    expect(CLICKHOUSE_EMULATOR.spec.credentials).toBe("user default, no password");
+  });
+
+  test("a server that is not Postgres fails the Postgres probe instead of matching", async () => {
+    // Nothing listens on port 1; the probe rejects, which status reports as "does not answer as the emulator".
+    await expect(POSTGRES_EMULATOR.spec.identity!.probe("postgres://127.0.0.1:1/postgres")).rejects.toThrow();
+  });
+});
+

package/src/op/activities/postgres-emulator.ts

@@ -15,12 +15,50 @@
  * `upstreamPins`, not the emulator freshness check.
  */
 
-import { emulatorLifecycle, type EmulatorCapability, type EmulatorSpec } from "@intentius/chant/op";
+import { emulatorLifecycle, type EmulatorCapability, type EmulatorIdentity, type EmulatorSpec } from "@intentius/chant/op";
 import { POSTGRES_LATEST_MAJOR, postgresImage } from "../../spec/postgres-pin";
+import { connectPostgres } from "../../postgres/live/client";
 
 /** The local server's password. It is a throwaway server on localhost. */
 export const POSTGRES_EMULATOR_PASSWORD = "chant";
 
+/** How long `chant emulator status` waits for the server behind the endpoint. */
+const PROBE_TIMEOUT_MS = 5_000;
+
+/**
+ * The cluster's system identifier, unique per `initdb` (#3673): read in the
+ * container over its socket, and through the endpoint `status` prints. A
+ * native Postgres holding 127.0.0.1:5432 answers with its own, or refuses
+ * the emulator's sign-in.
+ */
+export const POSTGRES_EMULATOR_IDENTITY: EmulatorIdentity = {
+  server: "Postgres",
+  command: ["psql", "-U", "postgres", "-tAc", "select system_identifier from pg_control_system()"],
+  async probe(endpoint) {
+    const client = await withTimeout(
+      connectPostgres({ url: endpoint, user: "postgres", password: POSTGRES_EMULATOR_PASSWORD }, { applicationName: "chant emulator status" }),
+    );
+    try {
+      const [row] = await withTimeout(
+        client.query<{ id: string; version: string }>(
+          "SELECT system_identifier::text AS id, pg_catalog.current_setting('server_version') AS version FROM pg_catalog.pg_control_system()",
+        ),
+      );
+      return { id: row?.id ?? "", label: `PostgreSQL ${row?.version ?? "(unknown version)"}` };
+    } finally {
+      await client.end();
+    }
+  },
+};
+
+function withTimeout<T>(promise: Promise<T>): Promise<T> {
+  let timer: ReturnType<typeof setTimeout> | undefined;
+  const timeout = new Promise<never>((_, reject) => {
+    timer = setTimeout(() => reject(new Error(`no answer within ${PROBE_TIMEOUT_MS / 1000}s`)), PROBE_TIMEOUT_MS);
+  });
+  return Promise.race([promise, timeout]).finally(() => clearTimeout(timer));
+}
+
 export const POSTGRES_EMULATOR_SPEC: EmulatorSpec = {
   name: "chant-postgres",
   image: postgresImage(POSTGRES_LATEST_MAJOR),
@@ -28,6 +66,8 @@ export const POSTGRES_EMULATOR_SPEC: EmulatorSpec = {
   readyCommand: ["pg_isready", "-h", "127.0.0.1", "-U", "postgres"],
   endpoint: (port) => `postgres://localhost:${port}/postgres`,
   runArgs: ["-e", `POSTGRES_PASSWORD=${POSTGRES_EMULATOR_PASSWORD}`],
+  identity: POSTGRES_EMULATOR_IDENTITY,
+  credentials: `user postgres, password ${POSTGRES_EMULATOR_PASSWORD}`,
 };
 
 /** `POSTGRES_URL` is the variable binding reads when no `sql.profiles.<env>` names a server. */

package/src/op/apply-gate-access-clickhouse.e2e.test.ts

@@ -0,0 +1,195 @@
+/**
+ * An approval does not cover a ClickHouse privilege granted by hand after it
+ * (#3733), end to end with a profile that manages access. The Postgres
+ * counterpart is `./apply-gate-access.e2e.test.ts`.
+ *
+ * A project in a temporary directory declares a database, a table, a reader
+ * role and a grant of SELECT on the table to it, and a gated `ApplyOp`. The
+ * first approved run creates them. The next run stops at the gate; the test
+ * approves its plan, grants INSERT on the table to the role by hand, and runs
+ * again. The gate refuses with "is approved, but not for this plan", the hand
+ * grant is still there, and the plan the run printed lists the REVOKE an
+ * apply would make. Approving that plan applies it.
+ *
+ * Before #3733 the plan digest was taken over a diff that left grants out (a
+ * grant was unobserved there), so the third run revoked the hand grant under
+ * the earlier approval.
+ *
+ * Everything is written to the database `chant_e2e_3733` and the role
+ * `chant_e2e_3733_reader`, both dropped afterwards.
+ *
+ * The server: `CHANT_SQL_GATE_CLICKHOUSE_URL` names a running one, such as
+ * the one `chant emulator up --lexicon sql` starts. Without it, a throwaway
+ * server at the pin, skipped cleanly when Docker is not available.
+ */
+
+import { execFile } from "node:child_process";
+import { mkdirSync, mkdtempSync, rmSync, symlinkSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { promisify } from "node:util";
+import { afterAll, beforeAll, describe, expect, test } from "vitest";
+import { dockerAvailable, startScratchServer, type ScratchServer } from "../clickhouse/container";
+import { clickhouseQuery, type ClickHouseEndpoint } from "../clickhouse/http";
+import { clickhouseImage } from "../spec/pin";
+
+const exec = promisify(execFile);
+
+const REPO = join(import.meta.dirname, "../../../..");
+const BIN = join(REPO, "node_modules/.bin");
+const DB = "chant_e2e_3733";
+const READER = "chant_e2e_3733_reader";
+const OP = "schema-apply";
+
+const given = process.env.CHANT_SQL_GATE_CLICKHOUSE_URL;
+const enabled = given ? true : await dockerAvailable();
+
+interface Run {
+  code: number;
+  output: string;
+}
+
+const strip = (s: string) => s.replace(/\u001b\[[0-9;]*m/g, "");
+
+const SCHEMA = `import { database, table, role, grant } from "@intentius/chant-lexicon-sql/clickhouse";
+
+export const db = database\`CREATE DATABASE ${DB} ENGINE = Atomic\`;
+
+export const events = table\`
+  CREATE TABLE \${db}.events (
+    id UInt64,
+    kind String
+  )
+  ENGINE = MergeTree
+  ORDER BY id\`;
+
+export const reader = role\`CREATE ROLE ${READER}\`;
+
+export const readEvents = grant\`GRANT SELECT ON \${events} TO \${reader}\`;
+`;
+
+const OPS = `import { ApplyOp } from "@intentius/chant/op";
+const { op } = ApplyOp({ name: "${OP}", env: "admin", target: "clickhouse", gate: { gate: "approve-schema" } });
+export default op;
+`;
+
+const config = (url: string) => `import type { ChantConfig } from "@intentius/chant";
+import "@intentius/chant-lexicon-sql";
+
+export default {
+  lexicons: ["sql"],
+  ownership: { stack: "e2e-3733", env: "admin" },
+  sql: ${JSON.stringify({ dialect: "clickhouse", profiles: { admin: { url, databases: [DB], access: true } } }, null, 2)},
+} satisfies ChantConfig;
+`;
+
+/** The `--plan <digest>` the stopped run printed in its approve command. */
+function approvedPlan(run: Run): string {
+  const m = /chant approve \S+ \S+ .*?--plan (jcs1-sha256:[0-9a-f]{64})/.exec(run.output);
+  if (!m) throw new Error(`the run printed no approve command with a plan:\n${run.output}`);
+  return m[1];
+}
+
+function gateOf(run: Run): string {
+  const m = /chant approve \S+ (\S+)/.exec(run.output);
+  if (!m) throw new Error(`the run printed no approve command:\n${run.output}`);
+  return m[1];
+}
+
+describe.skipIf(!enabled)("a gated ApplyOp over ClickHouse refuses after a privilege granted by hand (#3733)", () => {
+  let server: ScratchServer | undefined;
+  let admin: ClickHouseEndpoint;
+  let dir: string | undefined;
+  const q = <T = Record<string, unknown>>(sql: string) => clickhouseQuery<T>(admin, sql);
+  const cleanup = async () => {
+    await q(`DROP ROLE IF EXISTS ${READER}`);
+    await q(`DROP DATABASE IF EXISTS ${DB} SYNC`);
+  };
+
+  const chant = async (...args: string[]): Promise<Run> => {
+    try {
+      const r = await exec(join(BIN, "chant"), args, {
+        cwd: dir,
+        env: { ...process.env, PATH: `${BIN}:${process.env.PATH ?? ""}` },
+        maxBuffer: 16 * 1024 * 1024,
+      });
+      return { code: 0, output: strip(`${r.stdout}${r.stderr}`) };
+    } catch (err) {
+      const e = err as { code?: number; stdout?: string; stderr?: string };
+      return { code: typeof e.code === "number" ? e.code : 1, output: strip(`${e.stdout ?? ""}${e.stderr ?? ""}`) };
+    }
+  };
+
+  /** What `SHOW GRANTS FOR` the reader prints, one grant per line. */
+  const readerGrants = async () => (await q<Record<string, string>>(`SHOW GRANTS FOR ${READER}`)).map((r) => Object.values(r)[0]!);
+
+  beforeAll(async () => {
+    if (given) admin = { url: given };
+    else {
+      server = await startScratchServer(clickhouseImage(), { namePrefix: "chant-sql-gate-access" });
+      admin = server.endpoint;
+    }
+    await cleanup();
+    dir = mkdtempSync(join(tmpdir(), "chant-sql-gate-access-ch-"));
+    symlinkSync(join(REPO, "node_modules"), join(dir, "node_modules"), "dir");
+    const files: Record<string, string> = {
+      "package.json": JSON.stringify({ name: "sql-gate-access-ch-e2e", private: true, type: "module", scripts: { build: "chant build src --lexicon sql -o dist/schema.json" } }),
+      ".gitignore": "node_modules\ndist\n.chant\n",
+      "chant.config.ts": config(admin.url),
+      "ops/apply.op.ts": OPS,
+      "src/schema.ts": SCHEMA,
+    };
+    for (const [path, text] of Object.entries(files)) {
+      mkdirSync(join(dir, path, ".."), { recursive: true });
+      writeFileSync(join(dir, path), text);
+    }
+    const git = (...args: string[]) => exec("git", ["-c", "user.email=e2e@chant.invalid", "-c", "user.name=e2e", ...args], { cwd: dir });
+    await git("init", "-q");
+    await git("add", "-A");
+    await git("commit", "-qm", "the schema");
+  }, 600_000);
+
+  afterAll(async () => {
+    if (admin) await cleanup().catch(() => undefined);
+    await server?.stop();
+    if (dir) rmSync(dir, { recursive: true, force: true });
+  });
+
+  test("approve, grant by hand, rerun: the gate refuses and the hand grant stays", async () => {
+    // The first run creates everything once its plan is approved.
+    const created = await chant("run", OP);
+    const approveCreate = await chant("approve", OP, gateOf(created), "--plan", approvedPlan(created));
+    expect(approveCreate.code, approveCreate.output).toBe(0);
+    const applied = await chant("run", OP);
+    expect(applied.output).toMatch(/Op "schema-apply" completed/);
+    expect(await readerGrants()).toEqual([`GRANT SELECT ON ${DB}.events TO ${READER}`]);
+
+    // Nothing to change: the run stops at the gate, and its plan is approved.
+    const first = await chant("run", OP);
+    expect(first.output).not.toContain("PENDING (");
+    const gate = gateOf(first);
+    const digest = approvedPlan(first);
+    const approve = await chant("approve", OP, gate, "--plan", digest);
+    expect(approve.code, approve.output).toBe(0);
+
+    await q(`GRANT INSERT ON ${DB}.events TO ${READER}`);
+
+    const second = await chant("run", OP);
+    expect(second.output).toContain(`Gate "${gate}" is approved, but not for this plan.`);
+    expect(second.output).toContain(`approved: ${digest}`);
+    expect(second.output).toMatch(
+      /PENDING \(changes an apply would make that no declared property shows\):\s+~ grants chant_e2e_3733_reader: REVOKE INSERT ON `chant_e2e_3733`\.`events` FROM `chant_e2e_3733_reader` \[from: readEvents\]/,
+    );
+    expect(second.output).not.toMatch(/Op "schema-apply" completed/);
+    expect((await readerGrants()).join("\n")).toMatch(/GRANT INSERT, SELECT ON chant_e2e_3733\.events TO chant_e2e_3733_reader|GRANT SELECT, INSERT ON chant_e2e_3733\.events/);
+
+    // Approving the plan the second run produced applies the revoke.
+    const fresh = approvedPlan(second);
+    expect(fresh).not.toBe(digest);
+    const reapprove = await chant("approve", OP, gate, "--plan", fresh);
+    expect(reapprove.code, reapprove.output).toBe(0);
+    const third = await chant("run", OP);
+    expect(third.output).toMatch(/Op "schema-apply" completed/);
+    expect(await readerGrants()).toEqual([`GRANT SELECT ON ${DB}.events TO ${READER}`]);
+  }, 600_000);
+});