@kromatv/sdk 0.1.40-canary.0

package/rust/kroma-db/src/downloaded_subs.rs

@@ -0,0 +1,136 @@
+//! Subtitles fetched from an online provider and cached as WebVTT. One row per
+//! downloaded track; merged into the item's subtitle list so they show in the
+//! player next to embedded tracks.
+
+use rusqlite::OptionalExtension;
+
+use super::*;
+
+/// A cached generated subtitle; `path` is an absolute WebVTT file under the data dir.
+#[derive(Debug, Clone)]
+pub struct DownloadedSub {
+    pub id: String,
+    pub item_id: String,
+    pub language: Option<String>,
+    pub label: String,
+    pub provider: String,
+    pub path: String,
+}
+
+fn from_row(r: &Row) -> rusqlite::Result<DownloadedSub> {
+    Ok(DownloadedSub {
+        id: r.get(0)?,
+        item_id: r.get(1)?,
+        language: r.get(2)?,
+        label: r.get(3)?,
+        provider: r.get(4)?,
+        path: r.get(5)?,
+    })
+}
+
+const COLS: &str = "id, item_id, language, label, provider, path";
+
+/// Oldest first.
+pub fn downloaded_subs_for_item(
+    conn: &Connection,
+    item_id: &str,
+) -> rusqlite::Result<Vec<DownloadedSub>> {
+    let mut stmt = conn.prepare(&format!(
+        "SELECT {COLS} FROM downloaded_subtitles WHERE item_id = ?1 ORDER BY created_at"
+    ))?;
+    let rows = stmt.query_map(params![item_id], from_row)?;
+    rows.collect()
+}
+
+pub fn downloaded_sub(conn: &Connection, id: &str) -> rusqlite::Result<Option<DownloadedSub>> {
+    let mut stmt = conn.prepare(&format!(
+        "SELECT {COLS} FROM downloaded_subtitles WHERE id = ?1"
+    ))?;
+    let mut rows = stmt.query_map(params![id], from_row)?;
+    rows.next().transpose()
+}
+
+pub fn insert_downloaded_sub(pool: &Pool, sub: &DownloadedSub) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "INSERT OR REPLACE INTO downloaded_subtitles (id, item_id, language, label, provider, path, created_at) \
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, datetime('now'))",
+        params![sub.id, sub.item_id, sub.language, sub.label, sub.provider, sub.path],
+    )?;
+    Ok(())
+}
+
+/// Returns the deleted row's file path so the caller can remove the cached
+/// WebVTT from disk.
+pub fn delete_downloaded_sub(pool: &Pool, id: &str) -> Result<Option<String>> {
+    let conn = pool.get()?;
+    let path: Option<String> = conn
+        .query_row(
+            "SELECT path FROM downloaded_subtitles WHERE id = ?1",
+            params![id],
+            |r| r.get(0),
+        )
+        .optional()?;
+    if path.is_some() {
+        conn.execute(
+            "DELETE FROM downloaded_subtitles WHERE id = ?1",
+            params![id],
+        )?;
+    }
+    Ok(path)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::testing::TempPool;
+
+    fn pool_with_item() -> TempPool {
+        let pool = crate::testing::temp_pool("dsub");
+        let conn = pool.get().unwrap();
+        conn.execute("INSERT INTO libraries (id,name,kind,path,added_at) VALUES ('lib','L','movies','/x','t')", []).unwrap();
+        conn.execute(
+            "INSERT INTO items (id,kind,title,container,library,added_at) VALUES ('m1','movie','T','mkv','lib','t')",
+            [],
+        )
+        .unwrap();
+        drop(conn);
+        pool
+    }
+
+    fn sub(id: &str) -> DownloadedSub {
+        DownloadedSub {
+            id: id.into(),
+            item_id: "m1".into(),
+            language: Some("fr".into()),
+            label: "Francais (Whisper)".into(),
+            provider: "whisper".into(),
+            path: format!("/data/subs/{id}.vtt"),
+        }
+    }
+
+    #[test]
+    fn insert_list_get_and_delete() {
+        let p = pool_with_item();
+        insert_downloaded_sub(&p, &sub("s1")).unwrap();
+        insert_downloaded_sub(&p, &sub("s2")).unwrap();
+
+        let conn = p.get().unwrap();
+        let subs = downloaded_subs_for_item(&conn, "m1").unwrap();
+        assert_eq!(subs.len(), 2);
+        assert_eq!(subs[0].language.as_deref(), Some("fr"));
+        assert_eq!(subs[0].provider, "whisper");
+        let one = downloaded_sub(&conn, "s1").unwrap().unwrap();
+        assert_eq!(one.path, "/data/subs/s1.vtt");
+        assert!(downloaded_sub(&conn, "missing").unwrap().is_none());
+        drop(conn);
+
+        assert_eq!(
+            delete_downloaded_sub(&p, "s1").unwrap().as_deref(),
+            Some("/data/subs/s1.vtt")
+        );
+        assert!(delete_downloaded_sub(&p, "s1").unwrap().is_none());
+        let conn = p.get().unwrap();
+        assert_eq!(downloaded_subs_for_item(&conn, "m1").unwrap().len(), 1);
+    }
+}

package/rust/kroma-db/src/downloads.rs

@@ -0,0 +1,219 @@
+//! Acquisition TMDB hint (`acq_file_tmdb`): pin a known TMDB id to the exact
+//! file path an import wrote, so metadata enrichment adopts the real id instead
+//! of re-guessing it from the filename.
+//!
+//! Keyed by absolute path rather than a recomputed logical item id: the import
+//! knows exactly where it placed the file, and the scanner records that same
+//! path in `files.abs_path`, so enrichment resolves an item's id by joining
+//! `files` to this table and the link can never orphan on a title-parse
+//! difference (the failure mode that matched "Scary Movie" to "A Scary Movie").
+//!
+//! The `downloads` / `download_clients` ledger tables and their typed queries now
+//! live in the tv.kroma.torrents module crate (`kroma_torrent::db`); only this
+//! core hint table stays here, because the join is read by the core enrichment
+//! service (which depends on no module crate).
+
+use std::collections::HashMap;
+
+use super::*;
+
+/// Pin a known TMDB id to the absolute path an import wrote a file to, so
+/// enrichment adopts it instead of guessing from the filename. `abs_path` must be
+/// the same (canonicalized) path the scanner records in `files.abs_path`.
+pub fn set_file_tmdb(pool: &Pool, abs_path: &str, tmdb_id: u64) -> Result<()> {
+    let conn = pool.get()?;
+    conn.execute(
+        "INSERT INTO acq_file_tmdb (abs_path, tmdb_id) VALUES (?1, ?2) \
+         ON CONFLICT(abs_path) DO UPDATE SET tmdb_id = excluded.tmdb_id",
+        params![abs_path, tmdb_id as i64],
+    )?;
+    Ok(())
+}
+
+/// The acquisition-known TMDB id for one movie item, resolved through any of its
+/// files' paths. `None` when no imported file of the item carries a hint.
+pub fn acq_tmdb_for_item(conn: &Connection, item_id: &str) -> rusqlite::Result<Option<u64>> {
+    use rusqlite::OptionalExtension;
+    conn.query_row(
+        "SELECT act.tmdb_id FROM acq_file_tmdb act \
+         JOIN files f ON f.abs_path = act.abs_path \
+         WHERE f.item_id = ?1 LIMIT 1",
+        params![item_id],
+        |r| r.get::<_, i64>(0).map(|v| v as u64),
+    )
+    .optional()
+}
+
+/// The acquisition-known TMDB id for one show, resolved through any of its
+/// episodes' files (an episode download carries the show's TMDB id).
+pub fn acq_tmdb_for_show(conn: &Connection, show_id: &str) -> rusqlite::Result<Option<u64>> {
+    use rusqlite::OptionalExtension;
+    conn.query_row(
+        "SELECT act.tmdb_id FROM acq_file_tmdb act \
+         JOIN files f ON f.abs_path = act.abs_path \
+         JOIN items i ON i.id = f.item_id \
+         WHERE i.show_id = ?1 LIMIT 1",
+        params![show_id],
+        |r| r.get::<_, i64>(0).map(|v| v as u64),
+    )
+    .optional()
+}
+
+/// Every movie item that has an acquisition TMDB hint, keyed by item id. Loaded
+/// once per enrichment run instead of a per-item query (the table is empty on a
+/// library that never used the built-in acquisition).
+pub fn acq_tmdb_by_item(pool: &Pool) -> Result<HashMap<String, u64>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(
+        "SELECT f.item_id, act.tmdb_id FROM acq_file_tmdb act \
+         JOIN files f ON f.abs_path = act.abs_path",
+    )?;
+    let rows = stmt.query_map([], |r| {
+        Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as u64))
+    })?;
+    Ok(rows.flatten().collect())
+}
+
+/// Every show that has an acquisition TMDB hint on one of its episode files,
+/// keyed by show id (an episode file's download carries the show's TMDB id).
+pub fn acq_tmdb_by_show(pool: &Pool) -> Result<HashMap<String, u64>> {
+    let conn = pool.get()?;
+    let mut stmt = conn.prepare(
+        "SELECT i.show_id, act.tmdb_id FROM acq_file_tmdb act \
+         JOIN files f ON f.abs_path = act.abs_path \
+         JOIN items i ON i.id = f.item_id \
+         WHERE i.show_id IS NOT NULL",
+    )?;
+    let rows = stmt.query_map([], |r| {
+        Ok((r.get::<_, String>(0)?, r.get::<_, i64>(1)? as u64))
+    })?;
+    Ok(rows.flatten().collect())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::testing::TempPool;
+
+    fn pool() -> TempPool {
+        crate::testing::temp_pool("dl")
+    }
+
+    // Insert a movie item with one file at `abs_path`, so the hint join has
+    // something to resolve against. `foreign_keys` is ON, so the parent library
+    // must exist first.
+    fn seed_movie(pool: &Pool, item_id: &str, abs_path: &str) {
+        let conn = pool.get().unwrap();
+        conn.execute(
+            "INSERT OR IGNORE INTO libraries (id, name, kind, path, added_at) \
+             VALUES ('lib', 'Lib', 'movies', '/lib', '2026-01-01')",
+            [],
+        )
+        .unwrap();
+        conn.execute(
+            "INSERT INTO items (id, title, kind, container, library, added_at) \
+             VALUES (?1, 'X', 'movie', 'mkv', 'lib', '2026-01-01')",
+            params![item_id],
+        )
+        .unwrap();
+        conn.execute(
+            "INSERT INTO files (id, item_id, abs_path, container) \
+             VALUES (?1, ?2, ?3, 'mkv')",
+            params![format!("f-{item_id}"), item_id, abs_path],
+        )
+        .unwrap();
+    }
+
+    #[test]
+    fn set_and_resolve_item_hint_by_path() {
+        let p = pool();
+        let path = "/lib/Scary Movie (2026)/Scary Movie (2026).mkv";
+        seed_movie(&p, "item-1", path);
+        {
+            let conn = p.get().unwrap();
+            assert!(acq_tmdb_for_item(&conn, "item-1").unwrap().is_none());
+        }
+        set_file_tmdb(&p, path, 1273221).unwrap();
+        {
+            let conn = p.get().unwrap();
+            assert_eq!(acq_tmdb_for_item(&conn, "item-1").unwrap(), Some(1273221));
+        }
+        // Upsert replaces the pinned id in place.
+        set_file_tmdb(&p, path, 999).unwrap();
+        let conn = p.get().unwrap();
+        assert_eq!(acq_tmdb_for_item(&conn, "item-1").unwrap(), Some(999));
+        assert!(acq_tmdb_for_item(&conn, "unknown-item").unwrap().is_none());
+    }
+
+    #[test]
+    fn preload_maps_items_by_id() {
+        let p = pool();
+        seed_movie(&p, "item-a", "/lib/A/A.mkv");
+        seed_movie(&p, "item-b", "/lib/B/B.mkv");
+        set_file_tmdb(&p, "/lib/A/A.mkv", 111).unwrap();
+        // item-b has no hint -> absent from the map.
+        let map = acq_tmdb_by_item(&p).unwrap();
+        assert_eq!(map.get("item-a"), Some(&111));
+        assert_eq!(map.get("item-b"), None);
+    }
+
+    fn seed_episode(pool: &Pool, show_id: &str, item_id: &str, abs_path: &str) {
+        let conn = pool.get().unwrap();
+        conn.execute(
+            "INSERT OR IGNORE INTO libraries (id, name, kind, path, added_at) \
+             VALUES ('lib', 'Lib', 'shows', '/lib', '2026-01-01')",
+            [],
+        )
+        .unwrap();
+        conn.execute(
+            "INSERT OR IGNORE INTO shows (id, library, title, added_at) \
+             VALUES (?1, 'lib', 'Show', '2026-01-01')",
+            params![show_id],
+        )
+        .unwrap();
+        conn.execute(
+            "INSERT INTO items (id, title, kind, container, library, show_id, season, episode, added_at) \
+             VALUES (?1, 'E', 'episode', 'mkv', 'lib', ?2, 1, 1, '2026-01-01')",
+            params![item_id, show_id],
+        )
+        .unwrap();
+        conn.execute(
+            "INSERT INTO files (id, item_id, abs_path, container) VALUES (?1, ?2, ?3, 'mkv')",
+            params![format!("f-{item_id}"), item_id, abs_path],
+        )
+        .unwrap();
+    }
+
+    #[test]
+    fn a_shows_hint_is_resolved_through_any_one_of_its_episode_files() {
+        let p = pool();
+        seed_episode(&p, "show-1", "ep-1", "/lib/Show/S01E01.mkv");
+        seed_episode(&p, "show-1", "ep-2", "/lib/Show/S01E02.mkv");
+        seed_episode(&p, "show-2", "ep-3", "/lib/Other/S01E01.mkv");
+        set_file_tmdb(&p, "/lib/Show/S01E02.mkv", 76331).unwrap();
+
+        {
+            let conn = p.get().unwrap();
+            assert_eq!(acq_tmdb_for_show(&conn, "show-1").unwrap(), Some(76331));
+            assert!(acq_tmdb_for_show(&conn, "show-2").unwrap().is_none());
+            assert!(acq_tmdb_for_show(&conn, "unknown-show").unwrap().is_none());
+        }
+
+        let by_show = acq_tmdb_by_show(&p).unwrap();
+        assert_eq!(by_show.get("show-1"), Some(&76331));
+        assert_eq!(by_show.get("show-2"), None);
+        seed_movie(&p, "item-m", "/lib/M/M.mkv");
+        set_file_tmdb(&p, "/lib/M/M.mkv", 603).unwrap();
+        assert_eq!(acq_tmdb_by_show(&p).unwrap().len(), 1);
+    }
+
+    #[test]
+    fn a_hint_for_a_path_no_file_scanned_yet_resolves_nothing() {
+        // The import may write the hint before the scan has indexed the file.
+        // Until a `files` row exists at that path, the join yields nothing (and
+        // must not error): the next scan lands the file and the id is adopted.
+        let p = pool();
+        set_file_tmdb(&p, "/lib/Pending/Pending.mkv", 42).unwrap();
+        assert!(acq_tmdb_by_item(&p).unwrap().is_empty());
+    }
+}

package/rust/kroma-db/src/grant/escapes/schema.rs

@@ -0,0 +1,120 @@
+//! Routes through the schema itself: attach, DDL, views, triggers, pragmas.
+
+use super::{fixture, refused};
+
+#[test]
+fn attach_is_refused_so_the_same_file_cannot_come_back_under_another_name() {
+    // The per-table rules key on a table name in the main schema. Re-opening the
+    // same database as `side` would put every row behind a name they never see.
+    let f = fixture();
+    refused(&f.scoped, "ATTACH DATABASE ':memory:' AS side");
+    let path = f.core.path().display().to_string();
+    refused(&f.scoped, &format!("ATTACH DATABASE '{path}' AS side"));
+    refused(&f.scoped, "DETACH DATABASE main");
+}
+
+#[test]
+fn no_ddl_at_all_on_a_database_the_module_does_not_own() {
+    let f = fixture();
+    refused(&f.scoped, "CREATE TABLE mine (id TEXT)");
+    refused(&f.scoped, "CREATE TEMP TABLE mine (id TEXT)");
+    refused(&f.scoped, "DROP TABLE requests");
+    refused(&f.scoped, "ALTER TABLE requests ADD COLUMN sneaky TEXT");
+    refused(&f.scoped, "CREATE INDEX idx_sneaky ON requests(title)");
+    refused(&f.scoped, "DROP TABLE sessions");
+}
+
+#[test]
+fn a_view_cannot_be_built_over_an_ungranted_table() {
+    // Nor read through one: the authorizer fires for the tables INSIDE a view,
+    // with the view named as the accessor, so a view someone else created is
+    // checked against this module's grant and not against its author's.
+    let f = fixture();
+    refused(&f.scoped, "CREATE VIEW leak AS SELECT token FROM sessions");
+
+    f.core
+        .get()
+        .unwrap()
+        .execute_batch("CREATE VIEW all_tokens AS SELECT token FROM sessions")
+        .unwrap();
+    refused(&f.scoped, "SELECT * FROM all_tokens");
+    refused(&f.scoped, "SELECT token FROM all_tokens");
+}
+
+#[test]
+fn a_trigger_cannot_be_used_to_reach_further_than_the_grant() {
+    let f = fixture();
+    refused(
+        &f.scoped,
+        "CREATE TRIGGER leak AFTER UPDATE ON wanted BEGIN \
+         UPDATE wanted SET title = (SELECT token FROM sessions LIMIT 1); END",
+    );
+
+    // One that already exists is checked when the statement that fires it is
+    // prepared, so writing a granted table cannot run ungranted SQL by proxy.
+    f.core
+        .get()
+        .unwrap()
+        .execute_batch(
+            "CREATE TRIGGER steal AFTER UPDATE ON wanted BEGIN \
+             INSERT INTO sessions (token,user_id,created_at,expires_at) VALUES ('X','u1','n',1); END",
+        )
+        .unwrap();
+    refused(
+        &f.scoped,
+        "UPDATE wanted SET status = 'grabbed' WHERE id = 'wt1'",
+    );
+}
+
+#[test]
+fn pragmas_are_refused_including_the_ones_that_read_a_schema() {
+    let f = fixture();
+    refused(&f.scoped, "PRAGMA table_info(sessions)");
+    refused(&f.scoped, "PRAGMA foreign_keys = OFF");
+    refused(&f.scoped, "PRAGMA writable_schema = ON");
+    refused(&f.scoped, "PRAGMA journal_mode = DELETE");
+    // ...and the table-valued spelling of the same thing.
+    refused(&f.scoped, "SELECT name FROM pragma_table_info('sessions')");
+}
+
+#[test]
+fn the_schema_is_readable_and_the_rows_behind_it_are_not() {
+    // `sqlite_master` stays readable because denying it breaks rusqlite's own
+    // column lookups. It carries DDL, never a row: this pins that the one does
+    // not become the other.
+    let f = fixture();
+    let conn = f.scoped.get().unwrap();
+    let n: i64 = conn
+        .query_row(
+            "SELECT count(*) FROM sqlite_master WHERE type='table'",
+            [],
+            |r| r.get(0),
+        )
+        .unwrap();
+    assert!(n > 0, "the schema is readable");
+
+    refused(&f.scoped, "SELECT token FROM sessions");
+    // And it is not a back door to the data either.
+    refused(&f.scoped, "SELECT sql FROM sqlite_master JOIN sessions");
+}
+
+#[test]
+fn loading_an_extension_is_refused_before_the_authorizer_even_sees_it() {
+    // An extension runs native code inside the process with the connection in
+    // hand, which would make every rule above advisory. This one is refused by
+    // a second mechanism entirely -- extension loading is off at the connection
+    // level, so the function does not resolve -- which is why it does not come
+    // back as an authorizer denial like everything else here.
+    // It is also the one refusal that lands at RUN time rather than at prepare:
+    // the function resolves, and calling it is what fails.
+    let f = fixture();
+    let call = "SELECT load_extension('/tmp/evil.dylib')";
+    for (which, pool) in [("scoped", &f.scoped), ("core", &f.core)] {
+        let conn = pool.get().unwrap();
+        let err = conn
+            .query_row(call, [], |_| Ok(()))
+            .expect_err("extension loading must not be reachable")
+            .to_string();
+        assert!(err.contains("not authorized"), "{which}: {err}");
+    }
+}

package/rust/kroma-db/src/grant/escapes/statements.rs

@@ -0,0 +1,170 @@
+//! Statement shapes that could launder a read past the grant.
+
+use super::{allowed, fixture, refused, MODULE};
+use crate::grant::{init_scoped, Grant};
+
+#[test]
+fn a_plain_read_of_an_ungranted_table_is_refused() {
+    let f = fixture();
+    refused(&f.scoped, "SELECT token FROM sessions");
+    refused(&f.scoped, "SELECT * FROM sessions");
+    refused(&f.scoped, "SELECT count(*) FROM sessions");
+    // ...while the granted one still answers, or the scope would be useless.
+    allowed(&f.scoped, "SELECT title FROM requests");
+}
+
+#[test]
+fn a_subquery_is_a_read_like_any_other() {
+    let f = fixture();
+    refused(&f.scoped, "SELECT (SELECT token FROM sessions LIMIT 1)");
+    refused(
+        &f.scoped,
+        "SELECT title FROM requests WHERE id IN (SELECT user_id FROM sessions)",
+    );
+    refused(
+        &f.scoped,
+        "SELECT title FROM requests WHERE EXISTS (SELECT 1 FROM sessions)",
+    );
+    refused(
+        &f.scoped,
+        "SELECT (SELECT token FROM sessions LIMIT 1) AS leak FROM requests",
+    );
+}
+
+#[test]
+fn a_join_does_not_launder_the_other_table() {
+    let f = fixture();
+    refused(
+        &f.scoped,
+        "SELECT r.title FROM requests r JOIN sessions s ON s.user_id = r.requested_by",
+    );
+    refused(
+        &f.scoped,
+        "SELECT r.title FROM requests r LEFT JOIN users u ON u.id = r.requested_by",
+    );
+    refused(&f.scoped, "SELECT r.title FROM requests r, sessions s");
+}
+
+#[test]
+fn a_union_cannot_smuggle_a_second_table_in() {
+    let f = fixture();
+    refused(
+        &f.scoped,
+        "SELECT title FROM requests UNION SELECT token FROM sessions",
+    );
+    refused(
+        &f.scoped,
+        "SELECT title FROM requests UNION ALL SELECT token FROM sessions",
+    );
+    refused(
+        &f.scoped,
+        "SELECT title FROM requests EXCEPT SELECT token FROM sessions",
+    );
+}
+
+#[test]
+fn a_cte_is_not_a_way_round_it() {
+    let f = fixture();
+    refused(
+        &f.scoped,
+        "WITH s AS (SELECT token FROM sessions) SELECT * FROM s",
+    );
+    refused(
+        &f.scoped,
+        "WITH s AS (SELECT token FROM sessions) SELECT r.title FROM requests r, s",
+    );
+}
+
+#[test]
+fn a_write_cannot_carry_an_ungranted_read_with_it() {
+    let f = fixture();
+    // The classic exfiltration: copy the secret into a table you CAN read.
+    refused(
+        &f.scoped,
+        "UPDATE wanted SET title = (SELECT token FROM sessions LIMIT 1) WHERE id = 'wt1'",
+    );
+    refused(
+        &f.scoped,
+        "INSERT INTO wanted (id,request_id,kind,tmdb_id,title,status,updated_at) \
+         SELECT 'wt2','rq1','movie',603,token,'wanted',1 FROM sessions",
+    );
+    refused(
+        &f.scoped,
+        "DELETE FROM wanted WHERE title IN (SELECT token FROM sessions)",
+    );
+}
+
+#[test]
+fn the_returning_clause_returns_nothing_it_was_not_granted() {
+    let f = fixture();
+    refused(
+        &f.scoped,
+        "UPDATE wanted SET status = 'grabbed' WHERE id = 'wt1' \
+         RETURNING (SELECT token FROM sessions LIMIT 1)",
+    );
+}
+
+#[test]
+fn a_write_grant_is_not_a_read_grant_and_the_reverse() {
+    let f = fixture();
+    // `requests` is readable, not writable.
+    refused(
+        &f.scoped,
+        "UPDATE requests SET title = 'x' WHERE id = 'rq1'",
+    );
+    refused(&f.scoped, "DELETE FROM requests WHERE id = 'rq1'");
+    refused(
+        &f.scoped,
+        "INSERT INTO requests (id,kind,tmdb_id,title,status,created_at,updated_at) \
+         VALUES ('rq2','movie',1,'x','approved',1,1)",
+    );
+    // `wanted` is both, which is what the module declared.
+    allowed(
+        &f.scoped,
+        "UPDATE wanted SET status = 'grabbed' WHERE id = 'wt1'",
+    );
+}
+
+#[test]
+fn a_column_grant_holds_across_every_place_a_column_is_reached() {
+    let f = fixture();
+    let path = f.core.path().to_path_buf();
+    let narrow = init_scoped(
+        &path,
+        MODULE,
+        &Grant {
+            read: vec!["users.username".into()],
+            write: Vec::new(),
+        },
+    )
+    .unwrap();
+
+    allowed(&narrow, "SELECT username FROM users");
+    // Projected, filtered, ordered, grouped, aggregated: all reads.
+    refused(&narrow, "SELECT password_hash FROM users");
+    refused(
+        &narrow,
+        "SELECT username FROM users WHERE password_hash = 'x'",
+    );
+    refused(&narrow, "SELECT username FROM users ORDER BY password_hash");
+    refused(&narrow, "SELECT username FROM users GROUP BY password_hash");
+    refused(&narrow, "SELECT max(password_hash) FROM users");
+    refused(&narrow, "SELECT u.password_hash AS pw FROM users u");
+    refused(&narrow, "SELECT * FROM users");
+}
+
+#[test]
+fn the_empty_grant_is_the_default_and_it_answers_nothing() {
+    // What a module with no declared `storage.core` is handed. It must be a pool
+    // that refuses, never an unscoped one.
+    let f = fixture();
+    let none = init_scoped(f.core.path(), "tv.kroma.vpn", &Grant::none()).unwrap();
+    for sql in [
+        "SELECT token FROM sessions",
+        "SELECT title FROM requests",
+        "SELECT id FROM users",
+        "SELECT count(*) FROM sqlite_master WHERE 1 = (SELECT count(*) FROM users)",
+    ] {
+        refused(&none, sql);
+    }
+}