@opengeni/db 0.14.3 → 0.16.2

package/src/provision-roles.ts

@@ -5,6 +5,11 @@ import {
   RUNTIME_READ_INSERT_TABLES,
   RUNTIME_READ_ONLY_TABLES,
 } from "./runtime-posture";
+import {
+  classifyRoleRelationships,
+  roleRelationshipsCatalogQuery,
+  type RoleRelationshipCatalogRow,
+} from "./role-relationships";
 
 export type ProvisionResult = {
   appRole: string | null;
@@ -106,10 +111,12 @@ export async function provisionRoles(
           "OPENGENI_APP_DATABASE_PASSWORD (or appPassword) is required for rlsStrategy 'force'",
         );
       }
-      // Ownership and role-graph edges cannot be safely guessed away. Refuse to
-      // mutate an existing role until an operator has explicitly transferred
-      // objects/removed memberships; role attributes and direct grants, however,
-      // are deterministic and are converged below on every run.
+      // Ownership and privilege-bearing role-graph edges cannot be safely
+      // guessed away. Refuse to mutate an existing role until an operator has
+      // explicitly transferred objects/removed those memberships; role
+      // attributes and direct grants, however, are deterministic and are
+      // converged below on every run. PostgreSQL 16+'s exact non-runtime-bearing
+      // creator-management edge is classified separately.
       await assertAppRoleSafeToNormalize(sql, appRole);
       await ensureRestrictedAppLoginRole(sql, appRole, appPassword);
       provisionedAppRole = appRole;
@@ -190,12 +197,23 @@ BEGIN
       ${literal(role)},
       ${literal(password)}
     );
-  ELSE
+  ELSIF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = current_user AND rolsuper) THEN
     EXECUTE format(
       'ALTER ROLE %I WITH LOGIN NOSUPERUSER NOBYPASSRLS NOCREATEROLE NOCREATEDB NOREPLICATION NOINHERIT PASSWORD %L',
       ${literal(role)},
       ${literal(password)}
     );
+  ELSE
+    -- PostgreSQL requires elevated attributes merely to name SUPERUSER,
+    -- BYPASSRLS, REPLICATION, or CREATEDB in ALTER ROLE, even when setting them
+    -- false. The preflight has already proved those protected attributes are
+    -- false, so a managed CREATEROLE administrator converges only the
+    -- attributes it may change.
+    EXECUTE format(
+      'ALTER ROLE %I WITH LOGIN NOCREATEROLE NOINHERIT PASSWORD %L',
+      ${literal(role)},
+      ${literal(password)}
+    );
   END IF;
 END $$;
 `);
@@ -214,25 +232,47 @@ async function assertAppRoleSafeToNormalize(sql: postgres.Sql, role: string): Pr
     return;
   }
 
-  const memberships = await sql<{ relationship: string }[]>`
-    select ('inherits:' || parent.rolname)::text as relationship
-    from pg_auth_members membership
-    join pg_roles member on member.oid = membership.member
-    join pg_roles parent on parent.oid = membership.roleid
-    where member.rolname = ${role}
-    union all
-    select ('member:' || member.rolname)::text as relationship
-    from pg_auth_members membership
-    join pg_roles member on member.oid = membership.member
-    join pg_roles parent on parent.oid = membership.roleid
-    where parent.rolname = ${role}
-    order by relationship
+  const [roleAttributes] = await sql<
+    {
+      administrator_superuser: boolean;
+      app_superuser: boolean;
+      app_bypass_rls: boolean;
+      app_create_database: boolean;
+      app_replication: boolean;
+    }[]
+  >`
+    select
+      administrator.rolsuper as administrator_superuser,
+      app.rolsuper as app_superuser,
+      app.rolbypassrls as app_bypass_rls,
+      app.rolcreatedb as app_create_database,
+      app.rolreplication as app_replication
+    from pg_roles app
+    join pg_roles administrator on administrator.rolname = current_user
+    where app.rolname = ${role}
   `;
-  if (memberships.length > 0) {
+  if (roleAttributes && !roleAttributes.administrator_superuser) {
+    const protectedAttributes = [
+      roleAttributes.app_superuser ? "SUPERUSER" : null,
+      roleAttributes.app_bypass_rls ? "BYPASSRLS" : null,
+      roleAttributes.app_create_database ? "CREATEDB" : null,
+      roleAttributes.app_replication ? "REPLICATION" : null,
+    ].filter((attribute): attribute is string => attribute !== null);
+    if (protectedAttributes.length > 0) {
+      throw new Error(
+        `Refusing to normalize app role ${role}: a non-superuser administrator cannot clear protected attributes (${protectedAttributes.join(", ")})`,
+      );
+    }
+  }
+
+  const relationshipRows = await sql.unsafe<RoleRelationshipCatalogRow[]>(
+    roleRelationshipsCatalogQuery("$1"),
+    [role],
+  );
+  const { unsafeRelationships } = classifyRoleRelationships(relationshipRows);
+  if (unsafeRelationships.length > 0) {
     throw new Error(
-      `Refusing to normalize app role ${role}: remove role relationships first (${memberships
-        .map((row) => row.relationship)
-        .join(", ")})`,
+      `Refusing to normalize app role ${role}: remove privilege-bearing role relationships first (${unsafeRelationships.join(", ")})`,
     );
   }
 
@@ -372,6 +412,39 @@ BEGIN
         ${literal(role)}
       );
     END IF;
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_apply_lifecycle(text,uuid,integer,uuid,uuid,text,uuid,text,text)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_apply_lifecycle(text, uuid, integer, uuid, uuid, text, uuid, text, text) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format('%I.preference_registry_lock_heads(uuid[])', ${literal(schema)})
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_lock_heads(uuid[]) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
+    IF to_regprocedure(
+      format(
+        '%I.preference_registry_get_or_create_snapshot(uuid,uuid,uuid,uuid,uuid,integer)',
+        ${literal(schema)}
+      )
+    ) IS NOT NULL THEN
+      EXECUTE format(
+        'GRANT EXECUTE ON FUNCTION %I.preference_registry_get_or_create_snapshot(uuid, uuid, uuid, uuid, uuid, integer) TO %I',
+        ${literal(schema)},
+        ${literal(role)}
+      );
+    END IF;
     EXECUTE format('GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA %I TO %I', ${literal(schema)}, ${literal(role)});
     EXECUTE format(
       'ALTER DEFAULT PRIVILEGES FOR ROLE %I IN SCHEMA %I REVOKE ALL PRIVILEGES ON TABLES FROM %I',

package/src/role-relationships.ts

@@ -0,0 +1,132 @@
+export type RoleRelationshipDirection = "inherits" | "member";
+
+export type RoleRelationshipCatalogRow = {
+  relationship: string;
+  direction: RoleRelationshipDirection;
+  server_version_num: number;
+  admin_option: boolean | null;
+  inherit_option: boolean | null;
+  set_option: boolean | null;
+  member_is_superuser: boolean | null;
+  member_can_create_role: boolean | null;
+  grantor_role: string | null;
+  grantor_is_superuser: boolean | null;
+};
+
+export type ClassifiedRoleRelationships = {
+  relationships: string[];
+  managementOnlyRelationships: string[];
+  unsafeRelationships: string[];
+};
+
+type RoleTargetExpression = "current_user" | "$1";
+
+/**
+ * One PostgreSQL 15-compatible catalog query for both provisioning and runtime
+ * posture. PostgreSQL 16 added per-membership INHERIT and SET columns; reading
+ * the catalog row through to_jsonb keeps this statement parseable on 15 while
+ * leaving the missing options null and therefore fail-closed.
+ */
+export function roleRelationshipsCatalogQuery(targetRole: RoleTargetExpression): string {
+  return `
+with recursive target_role(oid, rolname) as (
+  select oid, rolname
+  from pg_roles
+  where rolname = ${targetRole}
+), inherited_roles(oid, rolname) as (
+  select parent.oid, parent.rolname
+  from pg_auth_members membership
+  join target_role target on target.oid = membership.member
+  join pg_roles parent on parent.oid = membership.roleid
+  union
+  select parent.oid, parent.rolname
+  from inherited_roles inherited
+  join pg_auth_members membership on membership.member = inherited.oid
+  join pg_roles parent on parent.oid = membership.roleid
+), relationships as (
+  select
+    ('inherits:' || inherited.rolname)::text as relationship,
+    'inherits'::text as direction,
+    null::boolean as admin_option,
+    null::boolean as inherit_option,
+    null::boolean as set_option,
+    null::boolean as member_is_superuser,
+    null::boolean as member_can_create_role,
+    null::text as grantor_role,
+    null::boolean as grantor_is_superuser
+  from inherited_roles inherited
+  union all
+  select
+    ('member:' || member.rolname)::text as relationship,
+    'member'::text as direction,
+    membership.admin_option,
+    case
+      when current_setting('server_version_num')::integer >= 160000
+        then (to_jsonb(membership) ->> 'inherit_option')::boolean
+      else null::boolean
+    end as inherit_option,
+    case
+      when current_setting('server_version_num')::integer >= 160000
+        then (to_jsonb(membership) ->> 'set_option')::boolean
+      else null::boolean
+    end as set_option,
+    member.rolsuper as member_is_superuser,
+    member.rolcreaterole as member_can_create_role,
+    grantor.rolname::text as grantor_role,
+    grantor.rolsuper as grantor_is_superuser
+  from pg_auth_members membership
+  join target_role target on target.oid = membership.roleid
+  join pg_roles member on member.oid = membership.member
+  left join pg_roles grantor on grantor.oid = membership.grantor
+)
+select
+  relationship,
+  direction,
+  current_setting('server_version_num')::integer as server_version_num,
+  admin_option,
+  inherit_option,
+  set_option,
+  member_is_superuser,
+  member_can_create_role,
+  grantor_role,
+  grantor_is_superuser
+from relationships
+order by relationship, direction, grantor_role nulls first
+`;
+}
+
+/**
+ * PostgreSQL 16+ automatically gives a non-superuser CREATEROLE principal an
+ * ADMIN-only grant on a role it creates. The exact edge below permits role
+ * management but cannot inherit the app role's privileges or SET ROLE into it.
+ */
+export function isManagementOnlyRoleRelationship(row: RoleRelationshipCatalogRow): boolean {
+  return (
+    row.direction === "member" &&
+    row.server_version_num >= 160000 &&
+    row.admin_option === true &&
+    row.inherit_option === false &&
+    row.set_option === false &&
+    row.member_is_superuser === false &&
+    row.member_can_create_role === true &&
+    row.grantor_is_superuser === true
+  );
+}
+
+function sortedUnique(values: Iterable<string>): string[] {
+  return [...new Set(values)].sort((a, b) => a.localeCompare(b));
+}
+
+/** Classify exact management-only reverse grants while rejecting every other edge. */
+export function classifyRoleRelationships(
+  rows: readonly RoleRelationshipCatalogRow[],
+): ClassifiedRoleRelationships {
+  const managementOnlyRows = rows.filter(isManagementOnlyRoleRelationship);
+  const unsafeRows = rows.filter((row) => !isManagementOnlyRoleRelationship(row));
+
+  return {
+    relationships: sortedUnique(rows.map((row) => row.relationship)),
+    managementOnlyRelationships: sortedUnique(managementOnlyRows.map((row) => row.relationship)),
+    unsafeRelationships: sortedUnique(unsafeRows.map((row) => row.relationship)),
+  };
+}

package/src/runtime-posture.ts

@@ -1,5 +1,10 @@
 import { sql } from "drizzle-orm";
 import type { Database, RlsStrategy } from "./index";
+import {
+  classifyRoleRelationships,
+  roleRelationshipsCatalogQuery,
+  type RoleRelationshipCatalogRow,
+} from "./role-relationships";
 
 /**
  * The complete standalone tenant-table contract. Adding or removing a
@@ -40,11 +45,17 @@ export const FORCE_RLS_TABLES = [
   "knowledge_memories",
   "machine_metrics_latest",
   "machine_metrics_series",
+  "model_call_facts",
   "new_session_drafts",
   "pack_installations",
+  "preference_registry_events",
+  "preference_registry_preferences",
+  "preference_registry_revisions",
+  "preference_registry_snapshots",
   "rig_changes",
   "rig_versions",
   "rigs",
+  "sandbox_checkpoint_artifacts",
   "sandbox_lease_holders",
   "sandbox_leases",
   "sandbox_pty_sessions",
@@ -73,6 +84,7 @@ export const FORCE_RLS_TABLES = [
   "session_turns",
   "session_workflow_wake_outbox",
   "sessions",
+  "slack_bot_delete_operations",
   "slack_bot_post_operations",
   "social_connections",
   "social_posts",
@@ -150,11 +162,13 @@ export const RUNTIME_FULL_DML_TABLES = [
   "machine_metrics_latest",
   "machine_metrics_series",
   "managed_accounts",
+  "model_call_facts",
   "new_session_drafts",
   "pack_installations",
   "rig_changes",
   "rig_versions",
   "rigs",
+  "sandbox_checkpoint_artifacts",
   "sandbox_lease_holders",
   "sandbox_leases",
   "sandbox_pty_sessions",
@@ -182,6 +196,7 @@ export const RUNTIME_FULL_DML_TABLES = [
   "session_turns",
   "session_workflow_wake_outbox",
   "sessions",
+  "slack_bot_delete_operations",
   "slack_bot_post_operations",
   "social_connections",
   "social_posts",
@@ -200,11 +215,17 @@ export const RUNTIME_FULL_DML_TABLES = [
   "workspaces",
 ] as const;
 
-/** Configuration is deployment-global and intentionally read-only at runtime. */
-export const RUNTIME_READ_ONLY_TABLES = ["nested_agent_depth_configuration"] as const;
+/** Configuration and lifecycle-owned audit rows are read-only at runtime. */
+export const RUNTIME_READ_ONLY_TABLES = [
+  "nested_agent_depth_configuration",
+  "preference_registry_events",
+  "preference_registry_snapshots",
+] as const;
 
 /** Append-only evidence/revision tables are insertable and queryable, never mutable. */
 export const RUNTIME_READ_INSERT_TABLES = [
+  "preference_registry_preferences",
+  "preference_registry_revisions",
   "session_spawn_denials",
   "workspace_instruction_policy_activation_events",
   "workspace_instruction_policy_revisions",
@@ -299,6 +320,7 @@ export type RuntimeRoutinePosture = {
 
 export type RuntimeDatabasePosture = {
   identity: RuntimeDatabaseIdentity;
+  /** Privilege-bearing role relationships; exact PG16+ management-only grants are excluded. */
   memberships: string[];
   schemas: RuntimeSchemaPosture[];
   ownedSchemas: string[];
@@ -418,30 +440,10 @@ export async function inspectRuntimeDatabasePosture(
         };
       }
 
-      const memberships = resultRows<{ relationship: string }>(
-        await tx.execute(sql`
-          with recursive inherited_roles(oid, rolname) as (
-            select parent.oid, parent.rolname
-            from pg_auth_members membership
-            join pg_roles member on member.oid = membership.member
-            join pg_roles parent on parent.oid = membership.roleid
-            where member.rolname = current_user
-            union
-            select parent.oid, parent.rolname
-            from inherited_roles inherited
-            join pg_auth_members membership on membership.member = inherited.oid
-            join pg_roles parent on parent.oid = membership.roleid
-          )
-          select ('inherits:' || rolname)::text as relationship from inherited_roles
-          union
-          select ('member:' || member.rolname)::text as relationship
-          from pg_auth_members membership
-          join pg_roles parent on parent.oid = membership.roleid
-          join pg_roles member on member.oid = membership.member
-          where parent.rolname = current_user
-          order by relationship
-        `),
-      ).map((row) => row.relationship);
+      const relationshipRows = resultRows<RoleRelationshipCatalogRow>(
+        await tx.execute(sql.raw(roleRelationshipsCatalogQuery("current_user"))),
+      );
+      const memberships = classifyRoleRelationships(relationshipRows).unsafeRelationships;
 
       const schemas = resultRows<{
         name: string;