@intentius/chant-lexicon-sql 0.124.52 → 0.124.55

package/src/ci-setup.ts

@@ -0,0 +1,116 @@
+/**
+ * What a SQL project's CI jobs need from the sql lexicon (#4572, over
+ * #4550's `LexiconPlugin.ciSetup`): the setup lines for chant's default
+ * image, and the replay server per dialect as a job service
+ * (`LexiconPlugin.ciServices`). sql-yodeler's own versions were
+ * `src/ci/render.ts` (`installLines`, `REPLAY_SERVICE`, `waitFor`), which
+ * now come from here.
+ *
+ * The lines: a Node check, since the lexicon and chant run on Node 22, then
+ * the project's packages with `npm ci` unless the lexicon is already
+ * installed, with `node_modules/.bin` put on PATH for the job's later
+ * steps. That one install carries the dialect's client too: Postgres is the
+ * lexicon's own `pg` dependency and ClickHouse is spoken over HTTP, so no
+ * separate client goes into the image. A token source needs no cloud
+ * command line in CI either: in a job that traded its OIDC token through
+ * chant's `ci.identity`, `./token-source.ts` mints from what the trade left.
+ *
+ * The replay server is the image the lexicon's emulator runs, at the same
+ * pin (`./spec/pin.ts`, `./spec/postgres-pin.ts`), so a replay in CI and
+ * `chant emulator up` on a laptop run one server. It is a throwaway: the
+ * replay resets it. The dialects are read from the text of the project's
+ * `chant.config.ts`, never by running it, as lexicon detection reads source.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import type { CiService } from "@intentius/chant/components/ci-services";
+import { clickhouseImage } from "./spec/pin";
+import { POSTGRES_LATEST_MAJOR, postgresImage } from "./spec/postgres-pin";
+
+export type SqlCiDialect = "clickhouse" | "postgres";
+
+/** The profile the replay check runs on, as sql-yodeler names it. */
+export const REPLAY_PROFILE = "replay";
+
+/** The oldest Node the lexicon and chant run on. */
+export const SQL_CI_NODE_MAJOR = 22;
+
+/** Fails the job, naming the version, when the image's Node is older than {@link SQL_CI_NODE_MAJOR}. */
+export const NODE_CHECK_LINE = `node -e 'const m = Number(process.versions.node.split(".")[0]); if (m < ${String(SQL_CI_NODE_MAJOR)}) { console.error("the sql lexicon needs Node ${String(SQL_CI_NODE_MAJOR)} or newer; this image has " + process.versions.node); process.exit(1); }'`;
+
+/**
+ * The project's packages, unless the lexicon is already installed (an image
+ * that carries them pays nothing), and their bins on PATH: exported for the
+ * rest of a GitLab script, appended to `$GITHUB_PATH` for a GitHub or
+ * Forgejo job's later steps.
+ */
+export const PACKAGES_INSTALL_LINE =
+  '{ [ -d node_modules/@intentius/chant-lexicon-sql ] || npm ci; } && export PATH="$PWD/node_modules/.bin:$PATH" && if [ -n "${GITHUB_PATH:-}" ]; then echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"; fi';
+
+/** The replay server of each dialect: the emulator's pinned image, under a prefixed name. */
+export function replayService(dialect: SqlCiDialect): CiService {
+  if (dialect === "clickhouse") {
+    return {
+      name: "replay-clickhouse",
+      image: clickhouseImage(),
+      port: 8123,
+      // The default user, with no password, from outside the container.
+      env: { CLICKHOUSE_SKIP_USER_SETUP: "1" },
+      health: "clickhouse-client --query 'SELECT 1'",
+      jobEnv: { REPLAY_CLICKHOUSE_URL: "http://replay-clickhouse:8123" },
+    };
+  }
+  return {
+    name: "replay-postgres",
+    image: postgresImage(POSTGRES_LATEST_MAJOR),
+    port: 5432,
+    env: { POSTGRES_PASSWORD: "replay" },
+    // Over TCP: during its first start the image runs a server on the socket only, then restarts.
+    health: "pg_isready -h 127.0.0.1 -U postgres",
+    jobEnv: { REPLAY_POSTGRES_URL: "postgres://replay-postgres:5432/postgres", REPLAY_POSTGRES_USER: "postgres", REPLAY_POSTGRES_PASSWORD: "replay" },
+  };
+}
+
+/** The text of the project's config, or undefined without one. */
+function configText(dir: string): string | undefined {
+  for (const name of ["chant.config.ts", "chant.config.mts", "chant.config.js"]) {
+    const file = join(dir, name);
+    if (!existsSync(file)) continue;
+    try {
+      return readFileSync(file, "utf-8");
+    } catch {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
+/**
+ * The dialects the config names (`dialect: "postgres"`, or a list), in
+ * {@link SqlCiDialect} order; ClickHouse, the lexicon's default, when it
+ * names none.
+ */
+export function sqlDialectsOf(text: string): SqlCiDialect[] {
+  const m = /\bdialect\s*:\s*(\[[^\]]*\]|["'][a-z]+["'])/.exec(text);
+  if (!m) return ["clickhouse"];
+  const named = new Set([...m[1]!.matchAll(/["']([a-z]+)["']/g)].map((x) => x[1]));
+  const out = (["clickhouse", "postgres"] as const).filter((d) => named.has(d));
+  return out.length > 0 ? [...out] : ["clickhouse"];
+}
+
+/** Whether the config declares the `replay` profile, the one the replay check runs on. */
+export function declaresReplay(text: string): boolean {
+  return new RegExp(`(^|[\\s{,])["']?${REPLAY_PROFILE}["']?\\s*:`).test(text);
+}
+
+/** The setup lines for the project at `dir`: none when it has no config naming the sql lexicon's settings. */
+export function sqlCiSetup(ctx: { dir: string }): string[] {
+  return configText(ctx.dir) === undefined ? [] : [NODE_CHECK_LINE, PACKAGES_INSTALL_LINE];
+}
+
+/** The replay service per dialect for the project at `dir`, when its config declares the `replay` profile. */
+export function sqlCiServices(ctx: { dir: string }): CiService[] {
+  const text = configText(ctx.dir);
+  if (text === undefined || !declaresReplay(text)) return [];
+  return sqlDialectsOf(text).map(replayService);
+}

package/src/clickhouse/access.ts

@@ -552,7 +552,8 @@ export function atomKey(a: GrantAtom): string {
   return `${a.revoke ? "REVOKE " : ""}${a.privilege}${a.column !== undefined ? `(${a.column})` : ""} ON ${a.target}${a.option ? " WITH GRANT OPTION" : ""}`;
 }
 
-function grantAtoms(ddl: string, defaultDatabase: string): Array<{ grantees: string[]; atoms: GrantAtom[] }> {
+/** Each statement's grantees and atoms. A bare table is qualified with `defaultDatabase`, or left bare when it is undefined. */
+function grantAtoms(ddl: string, defaultDatabase: string | undefined): Array<{ grantees: string[]; atoms: GrantAtom[] }> {
   const out: Array<{ grantees: string[]; atoms: GrantAtom[] }> = [];
   for (const statement of splitLines(ddl)) {
     const tokens = tokenizeText(statement, 0);
@@ -565,7 +566,7 @@ function grantAtoms(ddl: string, defaultDatabase: string): Array<{ grantees: str
       const parts = sigOf(tokens, node.target)
         .filter((t) => !(t.kind === "punct" && t.text === "."))
         .map((t) => unquote(t.text));
-      target = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0] === "*" ? "*" : `${defaultDatabase}.${parts[0]}`;
+      target = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0] === "*" || defaultDatabase === undefined ? parts[0] : `${defaultDatabase}.${parts[0]}`;
     }
     for (const item of node.items) {
       const sig = sigOf(tokens, item);
@@ -646,6 +647,52 @@ export function grantsCanonical(ddl: string, grantee: string, defaultDatabase =
   );
 }
 
+/**
+ * The atoms one grant declaration gives, one per grantee (#4582): `key` is
+ * the atom as the declaration spells its target (a bare table stays bare),
+ * which is how the deep diff addresses it on both sides; `atom` has the
+ * target qualified with `defaultDatabase`, which is what the server is asked
+ * about.
+ */
+export function declaredGrantAtoms(ddl: string, defaultDatabase = "default"): Array<{ grantee: string; key: string; atom: GrantAtom }> {
+  const spelled = grantAtoms(ddl, undefined);
+  const resolved = grantAtoms(ddl, defaultDatabase);
+  const out: Array<{ grantee: string; key: string; atom: GrantAtom }> = [];
+  spelled.forEach((g, i) => {
+    for (const grantee of g.grantees) {
+      g.atoms.forEach((a, j) => out.push({ grantee, key: atomKey(a), atom: resolved[i]!.atoms[j]! }));
+    }
+  });
+  return out;
+}
+
+/**
+ * Whether a grantee holding `have` (its `SHOW GRANTS` atoms) holds `a`: the
+ * same atom, or one the server folds it under (the table's privilege for a
+ * column's, the database's for a table's, `*.*` for any), with a grant or
+ * admin option at least as wide, and no partial revoke the server holds
+ * taking part of it back.
+ */
+export function holdsAtom(have: readonly GrantAtom[], a: GrantAtom): boolean {
+  if (a.role !== undefined) return have.some((b) => b.role === a.role && (b.option ?? false) >= (a.option ?? false));
+  const granted = have.some(
+    (b) =>
+      !b.revoke &&
+      b.role === undefined &&
+      b.privilege === a.privilege &&
+      (b.option ?? false) >= (a.option ?? false) &&
+      ((b.target === a.target && (b.column === undefined || b.column === a.column)) || (b.column === undefined && covers(b.target!, a.target!))),
+  );
+  if (!granted) return false;
+  return !have.some(
+    (r) =>
+      r.revoke === true &&
+      r.privilege === a.privilege &&
+      (r.target === a.target || (a.column === undefined && covers(a.target!, r.target!))) &&
+      (a.column === undefined || r.column === undefined || r.column === a.column),
+  );
+}
+
 /** Every grantee a grant statement names. */
 export function granteesOf(ddl: string): string[] {
   return [...new Set(grantAtoms(ddl, "default").flatMap((g) => g.grantees))];

package/src/clickhouse/live/access.e2e.test.ts

@@ -13,7 +13,8 @@
  * - a privilege granted by hand to a declared grantee is SQLCH274 and is
  *   revoked, a declared one revoked by hand is SQLCH273 and is granted
  *   again, a changed role setting is SQLCH270, a changed policy SQLCH272;
- *   the deep read lists both as pending, with the statements (#3733);
+ *   the deep read lists the hand grant as pending, with the statement
+ *   (#3733), and the hand revoke as absent drift on its declaration (#4582);
  * - the row policy filters rows for the user;
  * - with a profile that does not manage access (no `access: true`, #3716),
  *   none of it is applied, planned or read: each access declaration is
@@ -169,8 +170,10 @@ describe.skipIf(!enabled)("access control on a single node (#3682)", () => {
     expect(diff.changes).toEqual([]);
     const entities = new Map(Object.entries(v1).map(([k, e]) => [k, { entityType: e.entityType, props: e.props as unknown as Record<string, unknown> }]));
     const deep = await observeResourcesDeep({ environment: "test", entityNames: [...entities.keys()], entities, config: configOf(endpoint), env: envOf(endpoint) });
-    expect(Object.keys(deep.unobserved ?? {}).sort()).toEqual(["readEvents", "readerToApp"]);
+    // Each grant declaration is read atom by atom (#4582), as the declaration spells it.
+    expect(deep.unobserved ?? {}).toEqual({});
     expect(deep.pending).toBeUndefined();
+    for (const k of ["readEvents", "readerToApp"] as const) expect(deep.resources[k]!.properties, k).toEqual(sqlDeepNormalizationHooks.prepare!(v1[k].props as unknown as Record<string, unknown>, { entityType: "ClickHouse::Grant", side: "declared" }));
     for (const k of ["reader", "app", "tenant"] as const) expect(compared(deep.resources[k]!.properties), k).toEqual(compared(v1[k].props));
 
     // The policy filters rows for the user.
@@ -181,12 +184,10 @@ describe.skipIf(!enabled)("access control on a single node (#3682)", () => {
     // Changed by hand: a privilege granted, a declared one revoked. Changed in the declaration: a setting and the condition.
     await q(`GRANT INSERT ON ${DB}.events TO ${READER}`);
     await q(`REVOKE ${READER} FROM ${APP}`);
-    // The deep read lists what an apply would grant and revoke (#3733), so an approval's plan digest moves.
+    // The deep read lists the hand grant as pending (#3733) and the hand revoke on its declaration (#4582), so an approval's plan digest moves.
     const handMade = await observeResourcesDeep({ environment: "test", entityNames: [...entities.keys()], entities, config: configOf(endpoint), env: envOf(endpoint) });
-    expect(handMade.pending).toEqual([
-      { subject: `grants ${READER}`, change: `REVOKE INSERT ON \`${DB}\`.\`events\` FROM \`${READER}\``, entities: ["readEvents"] },
-      { subject: `grants ${APP}`, change: `GRANT \`${READER}\` TO \`${APP}\``, entities: ["readerToApp"] },
-    ]);
+    expect(handMade.pending).toEqual([{ subject: `grants ${READER}`, change: `REVOKE INSERT ON \`${DB}\`.\`events\` FROM \`${READER}\``, entities: ["readEvents"] }]);
+    expect(handMade.resources.readerToApp!.properties).toEqual({});
     const v2 = declarations({ memory: "2000000000", tenant: "b" });
     const planned = await planAgainstServer("test", writeBuild("v2.json", v2), { config: configOf(endpoint), env: envOf(endpoint) });
     expect(planned.changes.map((c) => [c.object, c.field, c.rule])).toEqual([

package/src/clickhouse/live/describe-resources.ts

@@ -1,6 +1,8 @@
 /**
  * `describeResources()` for the ClickHouse dialect: which declared databases,
- * tables and views exist on the environment's server.
+ * tables and views exist on the environment's server. A grant declaration is
+ * present when the server has every grantee it names, and missing when it
+ * lacks one (#4582); which privileges the grantee holds is the deep diff's.
  *
  * One read of `system.databases`, `system.tables` and `system.functions` per
  * run, then a lookup per declared entity, so N entities are three queries,
@@ -26,6 +28,7 @@ import {
 import { bindClickHouse, classifyClickHouseFailure, type BindOptions, type ClickHouseTarget } from "./bind";
 import { ACCESS_ENTITY_TYPES, ACCESS_UNMANAGED_DETAIL, accessOf, readLiveAccess, readLiveSchema, type DeclaredAccess, type LiveObject } from "./catalog";
 import { CLICKHOUSE_ENTITY_TYPES } from "../entities";
+import { granteesOf } from "../access";
 import { objectKey } from "../plan/normalize";
 import { isChantManaged, readMarker, stripMarker } from "../ownership";
 
@@ -71,7 +74,18 @@ function adapter(options: BindOptions & { owned?: boolean; access?: (defaultData
         return { unobserved: { reason: "filtered", detail: ACCESS_UNMANAGED_DETAIL } };
       }
       if (entity.type === CLICKHOUSE_ENTITY_TYPES.grant) {
-        return { unobserved: { reason: "unsupported-kind", detail: "a grant is compared as part of its grantees' grants, which chant sql plan reports" } };
+        let grantees: string[];
+        try {
+          grantees = granteesOf(String(entity.props.ddl ?? ""));
+        } catch (err) {
+          return { unobserved: { reason: "read-failed", detail: `the grant does not parse: ${(err as Error).message}` } };
+        }
+        const gone = grantees.find((g) => !byKey.has(objectKey({ type: entity.type, name: g })));
+        const queried = `${target.endpoint.url} grants ${gone ?? grantees.join(", ")}`;
+        if (gone !== undefined || grantees.length === 0) return { absent: true, queried };
+        // A grant carries no comment, so no marker: like a user or a role, it is never chant's by marker.
+        if (options.owned) return { unobserved: { reason: "filtered", detail: "a grant carries no chant ownership marker and owned was requested" }, queried };
+        return { present: { type: entity.type, physicalId: `grants ${grantees.join(", ")}`, status: "", ownership: "foreign" }, queried };
       }
       const { database, name } = declaredAddress(entity, target.defaultDatabase);
       const queried = `${target.endpoint.url} ${database ? `${database}.` : ""}${name}`;
@@ -112,5 +126,15 @@ export async function describeResources(
     const entity = options.entities.get(name);
     return { name, type: entity?.entityType ?? "", props: entity?.props ?? {} };
   });
-  return observeEntities(declared, adapter({ ...options, access: (db) => accessOf(options.entities, db) }));
+  const grantees = [...options.entities.values()]
+    .filter((e) => e.entityType === CLICKHOUSE_ENTITY_TYPES.grant)
+    .flatMap((e) => {
+      try {
+        return granteesOf(String(e.props.ddl ?? ""));
+      } catch {
+        return [];
+      }
+    });
+  const access = (db: string): DeclaredAccess[] => [...accessOf(options.entities, db), ...[...new Set(grantees)].map((name) => ({ kind: "grants", name }))];
+  return observeEntities(declared, adapter({ ...options, access }));
 }

package/src/clickhouse/plan/deep-grants-drift.test.ts

@@ -0,0 +1,151 @@
+/**
+ * ClickHouse grants in `chant lifecycle diff --live` (#4582): each grant
+ * declaration is read atom by atom, so a privilege revoked by hand is
+ * `absent` drift on the declaration that gives it, a privilege granted by
+ * hand is pending on its grantee, and a grant whose grantee the server does
+ * not have is missing in the thin diff. The server is a stub answering the
+ * queries `readLiveAccess` sends with recorded `SHOW GRANTS FOR` lines; no
+ * ClickHouse runs.
+ */
+
+import { beforeEach, describe, expect, test, vi } from "vitest";
+import { diffDeepObservation } from "@intentius/chant/lifecycle/deep-observe";
+import { normalizeObservation } from "@intentius/chant/observation";
+import { normalizeDeepObservation } from "@intentius/chant/deep-observation";
+import { grant } from "../entities";
+import type { ClickHouseTarget } from "../live/bind";
+
+/** What `SHOW GRANTS FOR` prints, by grantee; a grantee missing here does not exist. */
+let held: Record<string, string[]> = {};
+
+const target: ClickHouseTarget = { endpoint: { url: "http://stub:8123" }, source: "sql.profiles.test", defaultDatabase: "shop", access: true };
+
+vi.mock("../http", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../http")>();
+  return {
+    ...actual,
+    clickhouseQuery: async (_endpoint: unknown, sql: string) => {
+      if (/FROM system\.users/.test(sql)) return Object.keys(held).filter((n) => sql.includes(`'${n}'`)).map((name) => ({ name }));
+      if (/FROM system\.roles/.test(sql)) return [];
+      const show = /^SHOW GRANTS FOR `(.+)`$/.exec(sql.trim());
+      if (show) return (held[show[1]!] ?? []).map((line) => ({ [`GRANTS FOR ${show[1]}`]: line }));
+      throw new Error(`unexpected query: ${sql}`);
+    },
+  };
+});
+
+vi.mock("../live/bind", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../live/bind")>();
+  return { ...actual, bindClickHouse: async () => target };
+});
+
+vi.mock("../live/catalog", async (importOriginal) => {
+  const actual = await importOriginal<typeof import("../live/catalog")>();
+  // No tables, views or databases: these tests declare grants only.
+  return { ...actual, readLiveSchema: async () => [] };
+});
+
+const { observeResourcesDeep, sqlDeepNormalizationHooks } = await import("./deep");
+const { describeResources } = await import("../live/describe-resources");
+
+type Entities = Map<string, { entityType: string; props: Record<string, unknown> }>;
+
+const entities = (all: Record<string, ReturnType<typeof grant>>): Entities =>
+  new Map(Object.entries(all).map(([k, e]) => [k, { entityType: e.entityType, props: e.props as unknown as Record<string, unknown> }]));
+
+const declared = entities({
+  readEvents: grant`GRANT SELECT ON shop.events TO app`,
+  // A bare table is the profile's default database.
+  readOrders: grant`GRANT SELECT ON orders TO app`,
+});
+
+async function liveDiff(all: Entities) {
+  const live = await observeResourcesDeep({ environment: "test", entityNames: [...all.keys()], entities: all });
+  return diffDeepObservation(all, normalizeDeepObservation(live), sqlDeepNormalizationHooks);
+}
+
+beforeEach(() => {
+  held = {};
+});
+
+describe("grants in the live diff (#4582)", () => {
+  test("a grant declaration's declared tree is its atoms by grantee, as it spells them", () => {
+    const props = declared.get("readOrders")!.props;
+    expect(sqlDeepNormalizationHooks.prepare!(props, { entityType: "ClickHouse::Grant", side: "declared" })).toEqual({ grants: { app: { "SELECT ON orders": "granted" } } });
+  });
+
+  test("a grantee holding every declared grant is unchanged, and no grant is unobserved", async () => {
+    held = { app: ["GRANT SELECT ON shop.events TO app", "GRANT SELECT ON shop.orders TO app"] };
+    const diff = await liveDiff(declared);
+    expect(diff.drifted).toEqual([]);
+    expect(diff.unobserved).toEqual([]);
+    expect(diff.unchanged).toEqual(["readEvents", "readOrders"]);
+    expect(diff.pending).toBeUndefined();
+  });
+
+  test("a privilege revoked by hand is absent drift on the declaration that gives it (SQLCH273)", async () => {
+    held = { app: ["GRANT SELECT ON shop.events TO app"] };
+    const diff = await liveDiff(declared);
+    expect(diff.drifted).toEqual([{ name: "readOrders", type: "ClickHouse::Grant", changes: [{ path: "grants.app.SELECT ON orders", kind: "absent", declared: "granted" }] }]);
+    expect(diff.unchanged).toEqual(["readEvents"]);
+    expect(diff.pending).toBeUndefined();
+  });
+
+  test("a privilege granted by hand is pending on its grantee, the revoke an apply would send (SQLCH274)", async () => {
+    held = { app: ["GRANT INSERT, SELECT ON shop.events TO app", "GRANT SELECT ON shop.orders TO app"] };
+    const diff = await liveDiff(declared);
+    expect(diff.drifted).toEqual([]);
+    expect(diff.pending).toEqual([{ subject: "grants app", change: "REVOKE INSERT ON `shop`.`events` FROM `app`", entities: ["readEvents", "readOrders"] }]);
+  });
+
+  test("a privilege the server folds under a wider one is held", async () => {
+    held = { app: ["GRANT SELECT ON shop.* TO app"] };
+    const all = entities({ readShop: grant`GRANT SELECT ON shop.* TO app`, readEvents: grant`GRANT SELECT ON shop.events TO app` });
+    const diff = await liveDiff(all);
+    expect(diff.drifted).toEqual([]);
+    expect(diff.unchanged).toEqual(["readEvents", "readShop"]);
+  });
+
+  test("a partial revoke held under a declared privilege is drift", async () => {
+    held = { app: ["GRANT SELECT ON shop.events TO app", "REVOKE SELECT(email) ON shop.events FROM app", "GRANT SELECT ON shop.orders TO app"] };
+    const diff = await liveDiff(declared);
+    expect(diff.drifted.map((d) => [d.name, d.changes.map((c) => `${c.path} ${c.kind}`)])).toEqual([["readEvents", ["grants.app.SELECT ON shop.events absent"]]]);
+  });
+
+  test("a role revoked by hand is absent drift", async () => {
+    held = { app: ["GRANT reader TO app"] };
+    const all = entities({ appReads: grant`GRANT reader, writer TO app` });
+    const diff = await liveDiff(all);
+    expect(diff.drifted).toEqual([{ name: "appReads", type: "ClickHouse::Grant", changes: [{ path: "grants.app.ROLE writer", kind: "absent", declared: "granted" }] }]);
+  });
+
+  test("a grant whose grantee the server does not have is missing in the thin diff and not restated in the deep one", async () => {
+    held = {};
+    const diff = await liveDiff(declared);
+    expect(diff.drifted).toEqual([]);
+    expect(diff.unobserved).toEqual([]);
+    const thin = normalizeObservation(await describeResources({ environment: "test", entityNames: [...declared.keys()], entities: declared }));
+    expect(Object.keys(thin.resources)).toEqual([]);
+    expect(Object.keys(thin.unobserved)).toEqual([]);
+  });
+
+  test("a grant whose grantees the server has is present in the thin diff", async () => {
+    held = { app: ["GRANT SELECT ON shop.events TO app"] };
+    const thin = normalizeObservation(await describeResources({ environment: "test", entityNames: [...declared.keys()], entities: declared }));
+    expect(Object.keys(thin.resources).sort()).toEqual(["readEvents", "readOrders"]);
+    expect(thin.resources.readEvents).toMatchObject({ type: "ClickHouse::Grant", physicalId: "grants app" });
+  });
+
+  test("a profile that does not manage access leaves grants filtered", async () => {
+    target.access = false;
+    try {
+      const diff = await liveDiff(declared);
+      expect(diff.unobserved.map((u) => [u.name, u.reason])).toEqual([
+        ["readEvents", "filtered"],
+        ["readOrders", "filtered"],
+      ]);
+    } finally {
+      target.access = true;
+    }
+  });
+});

package/src/clickhouse/plan/deep-grants.test.ts

@@ -1,8 +1,8 @@
 /**
  * The grants the deep read reports as pending (#3733): what an apply would
- * grant or revoke from each declared grantee, so a privilege granted by hand
- * after an approval moves the plan digest. The server is a stub answering the
- * queries `readLiveAccess` sends.
+ * send a grantee holding a privilege no declaration gives it, so a privilege
+ * granted by hand after an approval moves the plan digest. The server is a
+ * stub answering the queries `readLiveAccess` sends.
  */
 
 import { describe, expect, test, vi } from "vitest";
@@ -55,9 +55,14 @@ describe("pendingGrants (#3733)", () => {
     ]);
   });
 
-  test("a grantee the server does not hold yet is given every declared grant", async () => {
+  test("a grantee that only lacks declared grants has nothing pending: each declaration reports them (#4582)", async () => {
+    held = { app: ["GRANT SELECT ON shop.events TO app"] };
+    expect(await pendingGrants(target, declared)).toEqual([]);
+  });
+
+  test("a grantee the server does not have has nothing pending: the thin diff reports it missing (#4582)", async () => {
     held = {};
-    expect((await pendingGrants(target, declared)).map((p) => p.change)).toEqual(["GRANT SELECT ON `shop`.`events` TO `app`; GRANT SELECT ON `shop`.`orders` TO `app`"]);
+    expect(await pendingGrants(target, declared)).toEqual([]);
   });
 
   test("no grant declarations read nothing", async () => {