@xemahq/biome-database-nest 0.8.0 → 0.9.0

package/dist/lib/external-runtime-verifier.js

@@ -3,11 +3,18 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyExternallyManagedRuntime = verifyExternallyManagedRuntime;
 const node_crypto_1 = require("node:crypto");
 const pg_1 = require("pg");
+const credential_generation_1 = require("./credential-generation");
 const migration_mode_1 = require("./migration-mode");
 const LOG_PREFIX = '[biome-database]';
 const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const SHA_256_PATTERN = /^[0-9a-f]{64}$/;
 const ALL_TABLE_DML = Object.values(migration_mode_1.RuntimeTablePrivilege);
+const ALL_TABLE_PRIVILEGES = [
+    ...ALL_TABLE_DML,
+    'TRUNCATE',
+    'REFERENCES',
+    'TRIGGER',
+];
 const ALL_SEQUENCE_PRIVILEGES = Object.values(migration_mode_1.RuntimeSequencePrivilege);
 const TABLE_DML_SET = new Set(ALL_TABLE_DML);
 const SEQUENCE_PRIVILEGE_SET = new Set(ALL_SEQUENCE_PRIVILEGES);
@@ -30,6 +37,29 @@ function assertExpectation(expectation) {
         expectation.tablePrivileges.length === 0) {
         throw new Error(`${LOG_PREFIX} externally-managed runtime access must require at least one table privilege.`);
     }
+    if (!Array.isArray(expectation.writableRelations)) {
+        throw new Error(`${LOG_PREFIX} externally-managed runtime access must explicitly declare writableRelations.`);
+    }
+    const writableRelationKeys = new Set();
+    for (const relation of expectation.writableRelations) {
+        assertNonEmpty(relation.name, 'writable relation name');
+        const relationPrivileges = relation.privileges;
+        if (!Object.values(migration_mode_1.RuntimeWritableRelationKind).includes(relation.kind)) {
+            throw new Error(`${LOG_PREFIX} writable relation kind is invalid.`);
+        }
+        if (!Array.isArray(relationPrivileges) ||
+            !relationPrivileges.includes(migration_mode_1.RuntimeTablePrivilege.Select) ||
+            !relationPrivileges.some((privilege) => privilege !== migration_mode_1.RuntimeTablePrivilege.Select) ||
+            relationPrivileges.some((privilege) => !TABLE_DML_SET.has(privilege)) ||
+            new Set(relationPrivileges).size !== relationPrivileges.length) {
+            throw new Error(`${LOG_PREFIX} writable relation ${relation.name} must declare unique SELECT plus at least one DML privilege.`);
+        }
+        const key = `${relation.kind}\u0000${relation.name}`;
+        if (writableRelationKeys.has(key)) {
+            throw new Error(`${LOG_PREFIX} writableRelations contains duplicate ${relation.name}.`);
+        }
+        writableRelationKeys.add(key);
+    }
     if (expectation.tablePrivileges.some((privilege) => !TABLE_DML_SET.has(privilege)) ||
         new Set(expectation.tablePrivileges).size !==
             expectation.tablePrivileges.length) {
@@ -42,122 +72,404 @@ function assertExpectation(expectation) {
         throw new Error(`${LOG_PREFIX} runtime sequence privileges must be unique RuntimeSequencePrivilege values.`);
     }
     const memberships = expectation.authorizedRoleMemberships;
-    if (!Array.isArray(memberships)) {
-        throw new Error(`${LOG_PREFIX} externally-managed runtime access must explicitly declare authorizedRoleMemberships.`);
+    if (!Array.isArray(memberships) || memberships.length !== 0) {
+        throw new Error(`${LOG_PREFIX} externally-managed runtime access forbids all role memberships; authorizedRoleMemberships must be an empty tuple.`);
     }
-    for (const role of memberships) {
-        assertNonEmpty(role, 'authorized role membership');
+    if (!Array.isArray(expectation.targetFunctions)) {
+        throw new Error(`${LOG_PREFIX} externally-managed runtime access must explicitly declare targetFunctions.`);
     }
-    if (new Set(memberships).size !== memberships.length) {
-        throw new Error(`${LOG_PREFIX} authorizedRoleMemberships must not contain duplicates.`);
+    const functionKeys = new Set();
+    for (const fn of expectation.targetFunctions) {
+        assertNonEmpty(fn.name, 'target function name');
+        if (typeof fn.identityArguments !== 'string') {
+            throw new Error(`${LOG_PREFIX} target function identityArguments must be a string.`);
+        }
+        if (!Array.isArray(fn.privileges) ||
+            fn.privileges.length !== 1 ||
+            fn.privileges[0] !== migration_mode_1.RuntimeExtensionFunctionPrivilege.Execute) {
+            throw new Error(`${LOG_PREFIX} target function ${fn.name} must declare exactly EXECUTE.`);
+        }
+        const key = `${fn.name}\u0000${fn.identityArguments}`;
+        if (functionKeys.has(key)) {
+            throw new Error(`${LOG_PREFIX} targetFunctions contains duplicate ${fn.name}.`);
+        }
+        functionKeys.add(key);
     }
+    assertExtensionDependencies(expectation.extensionDependencies);
 }
-function buildMissingTablePrivilegeQuery(privileges) {
-    const projections = privileges
-        .map((privilege) => `CASE WHEN NOT has_table_privilege(current_user, ` +
-        `format('%I.%I', table_schema, table_name), '${privilege}') ` +
-        `THEN '${privilege}' END`)
-        .join(', ');
-    return `
-    SELECT table_name AS object_name,
-           array_remove(ARRAY[${projections}], NULL) AS missing_privileges
-      FROM information_schema.tables
-     WHERE table_schema = $1
-       AND table_type = 'BASE TABLE'
-       AND table_name <> '_prisma_migrations'
-       AND NOT (
-         ${privileges
-        .map((privilege) => `has_table_privilege(current_user, ` +
-        `format('%I.%I', table_schema, table_name), '${privilege}')`)
-        .join(' AND ')}
-       )
-     ORDER BY table_name
-  `;
+function extensionObjectKey(extensionName, schema, object) {
+    const identityArguments = object.kind === migration_mode_1.RuntimeExtensionObjectKind.Function
+        ? object.identityArguments
+        : '';
+    return [
+        extensionName,
+        object.kind,
+        schema,
+        object.name,
+        identityArguments,
+    ].join('\u0000');
 }
-function buildMissingSequencePrivilegeQuery(privileges) {
-    if (privileges.length === 0) {
-        return null;
-    }
-    const projections = privileges
-        .map((privilege) => `CASE WHEN NOT has_sequence_privilege(current_user, ` +
-        `format('%I.%I', sequence_schema, sequence_name), '${privilege}') ` +
-        `THEN '${privilege}' END`)
-        .join(', ');
-    return `
-    SELECT sequence_name AS object_name,
-           array_remove(ARRAY[${projections}], NULL) AS missing_privileges
-      FROM information_schema.sequences
-     WHERE sequence_schema = $1
-       AND NOT (
-         ${privileges
-        .map((privilege) => `has_sequence_privilege(current_user, ` +
-        `format('%I.%I', sequence_schema, sequence_name), '${privilege}')`)
-        .join(' AND ')}
-       )
-     ORDER BY sequence_name
-  `;
+function assertExtensionDependencies(dependencies) {
+    if (!Array.isArray(dependencies)) {
+        throw new Error(`${LOG_PREFIX} externally-managed runtime access must explicitly declare extensionDependencies.`);
+    }
+    const names = new Set();
+    const objectKeys = new Set();
+    for (const dependency of dependencies) {
+        assertNonEmpty(dependency.name, 'extension dependency name');
+        assertNonEmpty(dependency.schema, 'extension dependency schema');
+        assertNonEmpty(dependency.version, 'extension dependency version');
+        if (names.has(dependency.name)) {
+            throw new Error(`${LOG_PREFIX} extensionDependencies contains duplicate extension ${dependency.name}.`);
+        }
+        names.add(dependency.name);
+        if (!Array.isArray(dependency.objects) || dependency.objects.length === 0) {
+            throw new Error(`${LOG_PREFIX} extension dependency ${dependency.name} must declare at least one object.`);
+        }
+        for (const object of dependency.objects) {
+            assertNonEmpty(object.name, `${dependency.name} extension object name`);
+            const expectedPrivilege = (() => {
+                switch (object.kind) {
+                    case migration_mode_1.RuntimeExtensionObjectKind.Type:
+                        return migration_mode_1.RuntimeExtensionTypePrivilege.Usage;
+                    case migration_mode_1.RuntimeExtensionObjectKind.Function:
+                        if (typeof object.identityArguments !== 'string') {
+                            throw new Error(`${LOG_PREFIX} ${dependency.name}.${object.name} function identityArguments must be a string.`);
+                        }
+                        return migration_mode_1.RuntimeExtensionFunctionPrivilege.Execute;
+                    case migration_mode_1.RuntimeExtensionObjectKind.Table:
+                        return migration_mode_1.RuntimeExtensionTablePrivilege.Select;
+                    case migration_mode_1.RuntimeExtensionObjectKind.Sequence:
+                        return migration_mode_1.RuntimeExtensionSequencePrivilege.Select;
+                    default:
+                        throw new Error(`${LOG_PREFIX} extension dependency ${dependency.name} contains an unsupported object kind.`);
+                }
+            })();
+            if (!Array.isArray(object.privileges) ||
+                object.privileges.length !== 1 ||
+                object.privileges[0] !== expectedPrivilege) {
+                throw new Error(`${LOG_PREFIX} extension object ${dependency.schema}.${object.name} must declare exactly ${expectedPrivilege}.`);
+            }
+            const key = extensionObjectKey(dependency.name, dependency.schema, object);
+            if (objectKeys.has(key)) {
+                throw new Error(`${LOG_PREFIX} extensionDependencies contains duplicate object ${dependency.schema}.${object.name}.`);
+            }
+            objectKeys.add(key);
+        }
+    }
 }
-function buildCrossSchemaTablePrivilegeQuery() {
-    const projections = ALL_TABLE_DML.map((privilege) => `CASE WHEN has_table_privilege(current_user, ` +
-        `format('%I.%I', table_schema, table_name), '${privilege}') ` +
+function buildTablePrivilegeQuery(crossSchema) {
+    const projections = ALL_TABLE_PRIVILEGES.map((privilege) => `CASE WHEN has_table_privilege(current_user, c.oid, '${privilege}') ` +
         `THEN '${privilege}' END`).join(', ');
+    const publicProjections = ALL_TABLE_PRIVILEGES.map((privilege) => `CASE WHEN EXISTS (` +
+        `SELECT 1 FROM aclexplode(COALESCE(c.relacl, acldefault('r', c.relowner))) acl ` +
+        `WHERE acl.grantee = 0 AND acl.privilege_type = '${privilege}'` +
+        `) THEN '${privilege}' END`).join(', ');
     return `
-    SELECT table_schema AS schema_name,
-           table_name AS object_name,
-           array_remove(ARRAY[${projections}], NULL) AS privileges
-      FROM information_schema.tables
-     WHERE table_schema <> $1
-       AND table_schema NOT IN ('pg_catalog', 'information_schema')
-       AND table_schema NOT LIKE 'pg_toast%'
-       AND table_schema NOT LIKE 'pg_temp_%'
-       AND (
-         ${ALL_TABLE_DML.map((privilege) => `has_table_privilege(current_user, ` +
-        `format('%I.%I', table_schema, table_name), '${privilege}')`).join(' OR ')}
-       )
-     ORDER BY table_schema, table_name
+    SELECT n.nspname AS schema_name,
+           c.relname AS object_name,
+           c.relkind AS relation_kind,
+           array_remove(ARRAY[${projections}], NULL) AS privileges,
+           e.extname AS extension_name,
+           array_remove(ARRAY[${publicProjections}], NULL) AS public_privileges,
+           pg_has_role(current_user, c.relowner, 'USAGE') AS owns_object
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      LEFT JOIN pg_depend d
+        ON d.classid = 'pg_class'::regclass
+       AND d.objid = c.oid
+       AND d.objsubid = 0
+       AND d.refclassid = 'pg_extension'::regclass
+       AND d.deptype = 'e'
+      LEFT JOIN pg_extension e ON e.oid = d.refobjid
+     WHERE n.nspname ${crossSchema ? '<>' : '='} $1
+       AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+       AND n.nspname NOT LIKE 'pg_toast%'
+       AND n.nspname NOT LIKE 'pg_temp_%'
+       AND c.relkind IN ('r', 'p', 'v', 'm', 'f')
+       AND c.relname <> '_prisma_migrations'
+       ${crossSchema
+        ? `AND (${ALL_TABLE_PRIVILEGES.map((privilege) => `has_table_privilege(current_user, c.oid, '${privilege}')`).join(' OR ')})`
+        : ''}
+     ORDER BY n.nspname, c.relname
   `;
 }
-function buildCrossSchemaSequencePrivilegeQuery() {
-    const projections = ALL_SEQUENCE_PRIVILEGES.map((privilege) => `CASE WHEN has_sequence_privilege(current_user, ` +
-        `format('%I.%I', sequence_schema, sequence_name), '${privilege}') ` +
+function buildSequencePrivilegeQuery(crossSchema) {
+    const projections = ALL_SEQUENCE_PRIVILEGES.map((privilege) => `CASE WHEN has_sequence_privilege(current_user, c.oid, '${privilege}') ` +
         `THEN '${privilege}' END`).join(', ');
+    const publicProjections = ALL_SEQUENCE_PRIVILEGES.map((privilege) => `CASE WHEN EXISTS (` +
+        `SELECT 1 FROM aclexplode(COALESCE(c.relacl, acldefault('s', c.relowner))) acl ` +
+        `WHERE acl.grantee = 0 AND acl.privilege_type = '${privilege}'` +
+        `) THEN '${privilege}' END`).join(', ');
     return `
-    SELECT sequence_schema AS schema_name,
-           sequence_name AS object_name,
-           array_remove(ARRAY[${projections}], NULL) AS privileges
-      FROM information_schema.sequences
-     WHERE sequence_schema <> $1
-       AND sequence_schema NOT IN ('pg_catalog', 'information_schema')
-       AND sequence_schema NOT LIKE 'pg_toast%'
-       AND sequence_schema NOT LIKE 'pg_temp_%'
-       AND (
-         ${ALL_SEQUENCE_PRIVILEGES.map((privilege) => `has_sequence_privilege(current_user, ` +
-        `format('%I.%I', sequence_schema, sequence_name), '${privilege}')`).join(' OR ')}
-       )
-     ORDER BY sequence_schema, sequence_name
+    SELECT n.nspname AS schema_name,
+           c.relname AS object_name,
+           array_remove(ARRAY[${projections}], NULL) AS privileges,
+           e.extname AS extension_name,
+           array_remove(ARRAY[${publicProjections}], NULL) AS public_privileges,
+           pg_has_role(current_user, c.relowner, 'USAGE') AS owns_object
+      FROM pg_class c
+      JOIN pg_namespace n ON n.oid = c.relnamespace
+      LEFT JOIN pg_depend d
+        ON d.classid = 'pg_class'::regclass
+       AND d.objid = c.oid
+       AND d.objsubid = 0
+       AND d.refclassid = 'pg_extension'::regclass
+       AND d.deptype = 'e'
+      LEFT JOIN pg_extension e ON e.oid = d.refobjid
+     WHERE n.nspname ${crossSchema ? '<>' : '='} $1
+       AND n.nspname NOT IN ('pg_catalog', 'information_schema')
+       AND n.nspname NOT LIKE 'pg_toast%'
+       AND n.nspname NOT LIKE 'pg_temp_%'
+       AND c.relkind = 'S'
+       ${crossSchema
+        ? `AND (${ALL_SEQUENCE_PRIVILEGES.map((privilege) => `has_sequence_privilege(current_user, c.oid, '${privilege}')`).join(' OR ')})`
+        : ''}
+     ORDER BY n.nspname, c.relname
   `;
 }
-function formatMissingPrivileges(kind, rows) {
-    return rows
-        .map((row) => `${kind} ${row.object_name} missing ${row.missing_privileges.join('/')}`)
-        .join(', ');
-}
 function formatCrossSchemaPrivileges(kind, rows) {
     return rows
         .map((row) => `${kind} ${row.schema_name}.${row.object_name} ` +
         `[${row.privileges.join('/')}]`)
         .join(', ');
 }
-function assertExactRoleMemberships(observedRows, authorized, expectedRole) {
-    if (authorized.includes(expectedRole)) {
-        throw new Error(`${LOG_PREFIX} authorizedRoleMemberships must not include the runtime login role itself.`);
+function samePrivileges(observed, expected) {
+    const sortedObserved = [...observed].sort();
+    const sortedExpected = [...expected].sort();
+    return (sortedObserved.length === sortedExpected.length &&
+        sortedObserved.every((privilege, index) => privilege === sortedExpected[index]));
+}
+function expectedRelationPrivileges(row, tablePrivileges, writableRelations) {
+    if (row.relation_kind === 'r' || row.relation_kind === 'p') {
+        return tablePrivileges;
+    }
+    if (row.relation_kind === 'm') {
+        return [migration_mode_1.RuntimeTablePrivilege.Select];
+    }
+    const writableKind = row.relation_kind === 'v'
+        ? migration_mode_1.RuntimeWritableRelationKind.View
+        : migration_mode_1.RuntimeWritableRelationKind.ForeignTable;
+    return (writableRelations.find((relation) => relation.kind === writableKind && relation.name === row.object_name)?.privileges ?? [migration_mode_1.RuntimeTablePrivilege.Select]);
+}
+function assertExactTargetPrivileges(kind, rows, expected, writableRelations) {
+    if (kind === 'table') {
+        const observedWritableRelations = new Set(rows.flatMap((row) => {
+            if (!('relation_kind' in row))
+                return [];
+            const writableKind = row.relation_kind === 'v'
+                ? migration_mode_1.RuntimeWritableRelationKind.View
+                : row.relation_kind === 'f'
+                    ? migration_mode_1.RuntimeWritableRelationKind.ForeignTable
+                    : null;
+            return writableKind === null
+                ? []
+                : [`${writableKind}\u0000${row.object_name}`];
+        }));
+        const missingDeclarations = writableRelations.filter((relation) => !observedWritableRelations.has(`${relation.kind}\u0000${relation.name}`));
+        if (missingDeclarations.length > 0) {
+            throw new Error(`${LOG_PREFIX} writableRelations names missing target view/foreign table: ` +
+                missingDeclarations.map((relation) => relation.name).join(', '));
+        }
     }
-    const observed = observedRows.map((row) => row.role_name).sort();
-    const expected = [...authorized].sort();
-    if (observed.length !== expected.length ||
-        observed.some((role, index) => role !== expected[index])) {
-        throw new Error(`${LOG_PREFIX} runtime role membership mismatch: expected ` +
-            `[${expected.join(', ')}], observed [${observed.join(', ')}].`);
+    const mismatches = rows.filter((row) => {
+        const applicableExpected = kind === 'table' && 'relation_kind' in row
+            ? expectedRelationPrivileges(row, expected, writableRelations)
+            : expected;
+        return (!samePrivileges(row.privileges, applicableExpected) ||
+            row.public_privileges.length > 0 ||
+            row.owns_object);
+    });
+    if (mismatches.length > 0) {
+        throw new Error(`${LOG_PREFIX} runtime ${kind} privilege contract failed: ${mismatches
+            .map((row) => {
+            const applicableExpected = kind === 'table' && 'relation_kind' in row
+                ? expectedRelationPrivileges(row, expected, writableRelations)
+                : expected;
+            return (`${row.schema_name}.${row.object_name} expected [${applicableExpected.join('/')}], observed [${row.privileges.join('/')}], PUBLIC [` +
+                `${row.public_privileges.join('/')}], owns=${row.owns_object}`);
+        })
+            .join(', ')}.`);
+    }
+}
+function assertTargetTypes(rows) {
+    const violations = rows.filter((row) => !row.can_use || row.public_has_privilege || row.owns_object);
+    if (violations.length > 0) {
+        throw new Error(`${LOG_PREFIX} target type privilege contract failed: ${violations
+            .map((row) => `${row.object_name} kind=${row.type_kind} USAGE=${row.can_use} ` +
+            `PUBLIC=${row.public_has_privilege} owns=${row.owns_object}`)
+            .join(', ')}.`);
+    }
+}
+function functionIdentityKey(name, identityArguments) {
+    return `${name}\u0000${identityArguments}`;
+}
+function hasSafeTargetFunctionConfiguration(configuration, targetSchema) {
+    if (configuration === null || configuration.length !== 1) {
+        return false;
+    }
+    const prefix = 'search_path=';
+    const setting = configuration[0];
+    if (!setting.startsWith(prefix)) {
+        return false;
+    }
+    const path = setting
+        .slice(prefix.length)
+        .split(',')
+        .map((schema) => schema.trim());
+    return (path.length === 2 && path[0] === 'pg_catalog' && path[1] === targetSchema);
+}
+function assertTargetFunctions(rows, expectedFunctions, targetSchema) {
+    const ownership = rows.filter((row) => row.owns_object);
+    const publicExecute = rows.filter((row) => row.public_has_privilege);
+    const executable = rows.filter((row) => row.can_execute);
+    const expected = new Set(expectedFunctions.map((fn) => functionIdentityKey(fn.name, fn.identityArguments)));
+    const observed = new Set(executable.map((row) => functionIdentityKey(row.object_name, row.identity_arguments)));
+    const missing = [...expected].filter((key) => !observed.has(key));
+    const extra = [...observed].filter((key) => !expected.has(key));
+    const unsafe = executable.filter((row) => row.security_definer ||
+        !hasSafeTargetFunctionConfiguration(row.configuration, targetSchema));
+    if (ownership.length > 0 ||
+        publicExecute.length > 0 ||
+        missing.length > 0 ||
+        extra.length > 0 ||
+        unsafe.length > 0) {
+        throw new Error(`${LOG_PREFIX} target function privilege contract failed: ` +
+            `owned=${JSON.stringify(ownership.map((row) => functionIdentityKey(row.object_name, row.identity_arguments)))}, PUBLIC=${JSON.stringify(publicExecute.map((row) => functionIdentityKey(row.object_name, row.identity_arguments)))}, missing=${JSON.stringify(missing)}, extra=${JSON.stringify(extra)}, ` +
+            `unsafe=${JSON.stringify(unsafe.map((row) => ({
+                function: functionIdentityKey(row.object_name, row.identity_arguments),
+                securityDefiner: row.security_definer,
+                configuration: row.configuration ?? [],
+            })))}.`);
+    }
+}
+function findDependency(dependencies, extensionName, schema) {
+    if (extensionName === null) {
+        return undefined;
+    }
+    return dependencies.find((dependency) => dependency.name === extensionName && dependency.schema === schema);
+}
+function expectedExtensionObjectKeys(dependencies) {
+    return new Set(dependencies.flatMap((dependency) => dependency.objects.map((object) => extensionObjectKey(dependency.name, dependency.schema, object))));
+}
+function assertExtensionMetadata(expected, observed) {
+    const actualByName = new Map(observed.map((row) => [row.extension_name, row]));
+    const mismatches = expected.filter((dependency) => {
+        const actual = actualByName.get(dependency.name);
+        return (actual === undefined ||
+            actual.schema_name !== dependency.schema ||
+            actual.extension_version !== dependency.version ||
+            actual.owns_extension);
+    });
+    if (observed.length !== expected.length || mismatches.length > 0) {
+        throw new Error(`${LOG_PREFIX} extension dependency mismatch: expected ${expected
+            .map((dependency) => `${dependency.name}@${dependency.version} in ${dependency.schema}`)
+            .join(', ')}, observed ${observed
+            .map((row) => `${row.extension_name}@${row.extension_version} in ${row.schema_name} owns=${row.owns_extension}`)
+            .join(', ')}.`);
+    }
+}
+function assertExactExtensionObjects(dependencies, types, functions, tables, sequences) {
+    const expected = expectedExtensionObjectKeys(dependencies);
+    const observed = new Set();
+    const publicObjects = [];
+    const invalidMembership = [];
+    for (const row of types) {
+        const dependency = findDependency(dependencies, row.extension_name, row.schema_name);
+        const key = extensionObjectKey(row.extension_name ?? '<none>', row.schema_name, {
+            kind: migration_mode_1.RuntimeExtensionObjectKind.Type,
+            name: row.object_name,
+            privileges: [migration_mode_1.RuntimeExtensionTypePrivilege.Usage],
+        });
+        observed.add(key);
+        if (dependency === undefined) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name}`);
+        }
+        if (row.owns_object) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name} owned by runtime`);
+        }
+        if (row.public_has_privilege) {
+            publicObjects.push(`${row.schema_name}.${row.object_name} TYPE USAGE`);
+        }
+    }
+    for (const row of functions) {
+        const dependency = findDependency(dependencies, row.extension_name, row.schema_name);
+        const key = extensionObjectKey(row.extension_name ?? '<none>', row.schema_name, {
+            kind: migration_mode_1.RuntimeExtensionObjectKind.Function,
+            name: row.object_name,
+            identityArguments: row.identity_arguments,
+            privileges: [migration_mode_1.RuntimeExtensionFunctionPrivilege.Execute],
+        });
+        observed.add(key);
+        if (dependency === undefined) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name}(${row.identity_arguments})`);
+        }
+        if (row.owns_object ||
+            row.security_definer ||
+            (row.configuration !== null && row.configuration.length > 0)) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name}(${row.identity_arguments}) ` +
+                `owner=${row.owns_object} securityDefiner=${row.security_definer} ` +
+                `configuration=${JSON.stringify(row.configuration ?? [])}`);
+        }
+        if (row.public_has_privilege) {
+            publicObjects.push(`${row.schema_name}.${row.object_name}(${row.identity_arguments}) EXECUTE`);
+        }
+    }
+    for (const row of tables) {
+        const dependency = findDependency(dependencies, row.extension_name, row.schema_name);
+        if (dependency === undefined ||
+            !samePrivileges(row.privileges, [
+                migration_mode_1.RuntimeExtensionTablePrivilege.Select,
+            ]) ||
+            row.owns_object) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name}`);
+        }
+        observed.add(extensionObjectKey(row.extension_name ?? '<none>', row.schema_name, {
+            kind: migration_mode_1.RuntimeExtensionObjectKind.Table,
+            name: row.object_name,
+            privileges: [migration_mode_1.RuntimeExtensionTablePrivilege.Select],
+        }));
+        if (row.public_privileges.length > 0) {
+            publicObjects.push(`${row.schema_name}.${row.object_name} [${row.public_privileges.join('/')}]`);
+        }
+    }
+    for (const row of sequences) {
+        const dependency = findDependency(dependencies, row.extension_name, row.schema_name);
+        if (dependency === undefined ||
+            !samePrivileges(row.privileges, [
+                migration_mode_1.RuntimeExtensionSequencePrivilege.Select,
+            ]) ||
+            row.owns_object) {
+            invalidMembership.push(`${row.schema_name}.${row.object_name}`);
+        }
+        observed.add(extensionObjectKey(row.extension_name ?? '<none>', row.schema_name, {
+            kind: migration_mode_1.RuntimeExtensionObjectKind.Sequence,
+            name: row.object_name,
+            privileges: [migration_mode_1.RuntimeExtensionSequencePrivilege.Select],
+        }));
+        if (row.public_privileges.length > 0) {
+            publicObjects.push(`${row.schema_name}.${row.object_name} [${row.public_privileges.join('/')}]`);
+        }
+    }
+    const missing = [...expected].filter((key) => !observed.has(key));
+    const extra = [...observed].filter((key) => !expected.has(key));
+    if (missing.length > 0 ||
+        extra.length > 0 ||
+        invalidMembership.length > 0 ||
+        publicObjects.length > 0) {
+        throw new Error(`${LOG_PREFIX} extension object privilege contract failed: ` +
+            `missing=${JSON.stringify(missing)}, extra=${JSON.stringify(extra)}, ` +
+            `invalidExtensionMembership=${JSON.stringify(invalidMembership)}, ` +
+            `PUBLIC=${JSON.stringify(publicObjects)}.`);
+    }
+}
+function assertNoRoleMemberships(observedRows) {
+    if (observedRows.length > 0) {
+        throw new Error(`${LOG_PREFIX} runtime role has forbidden direct or transitive membership(s): ` +
+            observedRows
+                .map((row) => row.role_name)
+                .sort()
+                .join(', '));
     }
 }
 function parseLedgerTimestamp(value, migrationName, field) {
@@ -224,6 +536,7 @@ function assertTarget(target) {
     assertNonEmpty(target.schema, 'expected target schema');
     assertNonEmpty(target.applicationName, 'expected application_name');
     assertNonEmpty(target.expectedRole, 'expected runtime role');
+    (0, credential_generation_1.assertDatabaseCredentialGeneration)(target.credentialGeneration, `${LOG_PREFIX} expected credential generation`);
 }
 async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compatibility) {
     assertTarget(target);
@@ -276,7 +589,7 @@ async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compat
            AND pg_has_role(current_user, oid, 'MEMBER')
          ORDER BY rolname
       `)).rows;
-        assertExactRoleMemberships(roleMemberships, access.authorizedRoleMemberships, target.expectedRole);
+        assertNoRoleMemberships(roleMemberships);
         const databasePrivileges = requireSingleRow((await client.query(`
           SELECT has_database_privilege(current_user, current_database(), 'CONNECT') AS can_connect,
                  has_database_privilege(current_user, current_database(), 'CREATE') AS can_create,
@@ -295,7 +608,13 @@ async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compat
         SELECT nspname AS schema_name,
                has_schema_privilege(current_user, oid, 'USAGE') AS can_use,
                has_schema_privilege(current_user, oid, 'CREATE') AS can_create,
-               pg_has_role(current_user, nspowner, 'USAGE') AS owns_schema
+               pg_has_role(current_user, nspowner, 'USAGE') AS owns_schema,
+               EXISTS (
+                 SELECT 1
+                   FROM aclexplode(COALESCE(nspacl, acldefault('n', nspowner))) acl
+                  WHERE acl.grantee = 0
+                    AND acl.privilege_type = 'USAGE'
+               ) AS public_can_use
           FROM pg_namespace
          WHERE nspname NOT IN ('pg_catalog', 'information_schema')
            AND nspname NOT LIKE 'pg_toast%'
@@ -306,6 +625,9 @@ async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compat
         if (!targetSchemaPrivileges.can_use) {
             throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} lacks USAGE on schema ${target.schema}.`);
         }
+        if (targetSchemaPrivileges.public_can_use) {
+            throw new Error(`${LOG_PREFIX} target schema ${target.schema} grants forbidden USAGE to PUBLIC.`);
+        }
         const persistentDdlSchemas = persistentSchemaPrivileges.filter((row) => row.can_create || row.owns_schema);
         if (persistentDdlSchemas.length > 0) {
             throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden persistent ` +
@@ -313,62 +635,189 @@ async function verifyExternallyManagedRuntime(runtimeUrl, target, access, compat
                     .map((row) => row.schema_name)
                     .join(', ')}.`);
         }
-        const crossSchemaUsage = persistentSchemaPrivileges.filter((row) => row.schema_name !== target.schema && row.can_use);
+        const extensionSchemas = new Set(access.extensionDependencies.map((dependency) => dependency.schema));
+        if (extensionSchemas.has(target.schema)) {
+            throw new Error(`${LOG_PREFIX} extension dependency schema must differ from target schema ${target.schema}.`);
+        }
+        const crossSchemaUsage = persistentSchemaPrivileges.filter((row) => row.schema_name !== target.schema &&
+            row.can_use &&
+            !extensionSchemas.has(row.schema_name));
         if (crossSchemaUsage.length > 0) {
             throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden cross-schema ` +
                 `USAGE on: ${crossSchemaUsage
                     .map((row) => row.schema_name)
                     .join(', ')}.`);
         }
-        const crossSchemaTablePrivileges = (await client.query(buildCrossSchemaTablePrivilegeQuery(), [target.schema])).rows;
-        if (crossSchemaTablePrivileges.length > 0) {
-            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden cross-schema ` +
-                `table privileges: ${formatCrossSchemaPrivileges('table', crossSchemaTablePrivileges)}.`);
+        const missingOrPublicExtensionSchemas = [...extensionSchemas].filter((schema) => {
+            const row = persistentSchemaPrivileges.find((candidate) => candidate.schema_name === schema);
+            return row === undefined || !row.can_use || row.public_can_use;
+        });
+        if (missingOrPublicExtensionSchemas.length > 0) {
+            throw new Error(`${LOG_PREFIX} extension schemas must grant direct runtime USAGE and revoke PUBLIC USAGE: ` +
+                missingOrPublicExtensionSchemas.join(', '));
         }
-        const crossSchemaSequencePrivileges = (await client.query(buildCrossSchemaSequencePrivilegeQuery(), [target.schema])).rows;
-        if (crossSchemaSequencePrivileges.length > 0) {
+        const crossSchemaTablePrivileges = (await client.query(buildTablePrivilegeQuery(true), [
+            target.schema,
+        ])).rows;
+        const crossSchemaSequencePrivileges = (await client.query(buildSequencePrivilegeQuery(true), [target.schema])).rows;
+        const undeclaredCrossSchemaTables = crossSchemaTablePrivileges.filter((row) => !access.extensionDependencies.some((dependency) => dependency.name === row.extension_name &&
+            dependency.schema === row.schema_name));
+        if (undeclaredCrossSchemaTables.length > 0) {
             throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden cross-schema ` +
-                `sequence privileges: ${formatCrossSchemaPrivileges('sequence', crossSchemaSequencePrivileges)}.`);
+                `table privileges: ${formatCrossSchemaPrivileges('table', undeclaredCrossSchemaTables)}.`);
         }
-        const missingTablePrivileges = (await client.query(buildMissingTablePrivilegeQuery(access.tablePrivileges), [target.schema])).rows;
-        if (missingTablePrivileges.length > 0) {
-            throw new Error(`${LOG_PREFIX} runtime DML contract failed: ${formatMissingPrivileges('table', missingTablePrivileges)}.`);
+        const undeclaredCrossSchemaSequences = crossSchemaSequencePrivileges.filter((row) => !access.extensionDependencies.some((dependency) => dependency.name === row.extension_name &&
+            dependency.schema === row.schema_name));
+        if (undeclaredCrossSchemaSequences.length > 0) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden cross-schema ` +
+                `sequence privileges: ${formatCrossSchemaPrivileges('sequence', undeclaredCrossSchemaSequences)}.`);
         }
-        const sequenceQuery = buildMissingSequencePrivilegeQuery(access.sequencePrivileges);
-        if (sequenceQuery !== null) {
-            const missingSequencePrivileges = (await client.query(sequenceQuery, [target.schema])).rows;
-            if (missingSequencePrivileges.length > 0) {
-                throw new Error(`${LOG_PREFIX} runtime DML contract failed: ${formatMissingPrivileges('sequence', missingSequencePrivileges)}.`);
-            }
+        const targetTablePrivileges = (await client.query(buildTablePrivilegeQuery(false), [
+            target.schema,
+        ])).rows;
+        assertExactTargetPrivileges('table', targetTablePrivileges, access.tablePrivileges, access.writableRelations);
+        const targetSequencePrivileges = (await client.query(buildSequencePrivilegeQuery(false), [target.schema])).rows;
+        assertExactTargetPrivileges('sequence', targetSequencePrivileges, access.sequencePrivileges, access.writableRelations);
+        const targetTypes = (await client.query(`
+          SELECT t.typname AS object_name,
+                 t.typtype AS type_kind,
+                 has_type_privilege(current_user, t.oid, 'USAGE') AS can_use,
+                 EXISTS (
+                   SELECT 1
+                     FROM aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) acl
+                    WHERE acl.grantee = 0
+                      AND acl.privilege_type = 'USAGE'
+                 ) AS public_has_privilege,
+                 pg_has_role(current_user, t.typowner, 'USAGE') AS owns_object
+            FROM pg_type t
+            JOIN pg_namespace n ON n.oid = t.typnamespace
+           WHERE n.nspname = $1
+             AND t.typelem = 0
+             AND t.typtype IN ('b', 'd', 'e', 'r', 'm')
+           ORDER BY t.typname
+        `, [target.schema])).rows;
+        assertTargetTypes(targetTypes);
+        const targetFunctions = (await client.query(`
+          SELECT p.proname AS object_name,
+                 pg_get_function_identity_arguments(p.oid) AS identity_arguments,
+                 has_function_privilege(current_user, p.oid, 'EXECUTE') AS can_execute,
+                 EXISTS (
+                   SELECT 1
+                     FROM aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) acl
+                    WHERE acl.grantee = 0
+                      AND acl.privilege_type = 'EXECUTE'
+                 ) AS public_has_privilege,
+                 pg_has_role(current_user, p.proowner, 'USAGE') AS owns_object,
+                 p.prosecdef AS security_definer,
+                 p.proconfig AS configuration
+            FROM pg_proc p
+            JOIN pg_namespace n ON n.oid = p.pronamespace
+           WHERE n.nspname = $1
+           ORDER BY p.proname, identity_arguments
+        `, [target.schema])).rows;
+        assertTargetFunctions(targetFunctions, access.targetFunctions, target.schema);
+        if (access.extensionDependencies.length > 0) {
+            const extensionNames = access.extensionDependencies.map((dependency) => dependency.name);
+            const extensionSchemaNames = [...extensionSchemas];
+            const extensionRows = (await client.query(`
+            SELECT e.extname AS extension_name,
+                   n.nspname AS schema_name,
+                   e.extversion AS extension_version,
+                   pg_has_role(current_user, e.extowner, 'USAGE') AS owns_extension
+              FROM pg_extension e
+              JOIN pg_namespace n ON n.oid = e.extnamespace
+             WHERE e.extname = ANY($1::text[])
+             ORDER BY e.extname
+          `, [extensionNames])).rows;
+            assertExtensionMetadata(access.extensionDependencies, extensionRows);
+            const extensionTypes = (await client.query(`
+            SELECT n.nspname AS schema_name,
+                   t.typname AS object_name,
+                   e.extname AS extension_name,
+                   EXISTS (
+                     SELECT 1
+                       FROM aclexplode(COALESCE(t.typacl, acldefault('T', t.typowner))) acl
+                      WHERE acl.grantee = 0
+                        AND acl.privilege_type = 'USAGE'
+                   ) AS public_has_privilege,
+                   pg_has_role(current_user, t.typowner, 'USAGE') AS owns_object
+              FROM pg_type t
+              JOIN pg_namespace n ON n.oid = t.typnamespace
+              LEFT JOIN pg_depend d
+                ON d.classid = 'pg_type'::regclass
+               AND d.objid = t.oid
+               AND d.objsubid = 0
+               AND d.refclassid = 'pg_extension'::regclass
+               AND d.deptype = 'e'
+              LEFT JOIN pg_extension e ON e.oid = d.refobjid
+             WHERE n.nspname = ANY($1::text[])
+               -- Array type privileges are inherited from their element type
+               -- and PostgreSQL rejects direct GRANT/REVOKE on array types.
+               AND t.typelem = 0
+               AND has_type_privilege(current_user, t.oid, 'USAGE')
+             ORDER BY n.nspname, t.typname
+          `, [extensionSchemaNames])).rows;
+            const extensionFunctions = (await client.query(`
+            SELECT n.nspname AS schema_name,
+                   p.proname AS object_name,
+                   pg_get_function_identity_arguments(p.oid) AS identity_arguments,
+                   e.extname AS extension_name,
+                   EXISTS (
+                     SELECT 1
+                       FROM aclexplode(COALESCE(p.proacl, acldefault('f', p.proowner))) acl
+                      WHERE acl.grantee = 0
+                        AND acl.privilege_type = 'EXECUTE'
+                   ) AS public_has_privilege,
+                   pg_has_role(current_user, p.proowner, 'USAGE') AS owns_object,
+                   p.prosecdef AS security_definer,
+                   p.proconfig AS configuration
+              FROM pg_proc p
+              JOIN pg_namespace n ON n.oid = p.pronamespace
+              LEFT JOIN pg_depend d
+                ON d.classid = 'pg_proc'::regclass
+               AND d.objid = p.oid
+               AND d.objsubid = 0
+               AND d.refclassid = 'pg_extension'::regclass
+               AND d.deptype = 'e'
+              LEFT JOIN pg_extension e ON e.oid = d.refobjid
+             WHERE n.nspname = ANY($1::text[])
+               AND has_function_privilege(current_user, p.oid, 'EXECUTE')
+             ORDER BY n.nspname, p.proname, identity_arguments
+          `, [extensionSchemaNames])).rows;
+            assertExactExtensionObjects(access.extensionDependencies, extensionTypes, extensionFunctions, crossSchemaTablePrivileges, crossSchemaSequencePrivileges);
         }
         const ledgerPrivileges = requireSingleRow((await client.query(`
-            SELECT has_table_privilege(
-                     current_user,
-                     format('%I.%I', $1, '_prisma_migrations'),
-                     'SELECT'
-                   ) AS can_select,
-                   has_table_privilege(
-                     current_user,
-                     format('%I.%I', $1, '_prisma_migrations'),
-                     'INSERT'
-                   ) AS can_insert,
-                   has_table_privilege(
-                     current_user,
-                     format('%I.%I', $1, '_prisma_migrations'),
-                     'UPDATE'
-                   ) AS can_update,
-                   has_table_privilege(
-                     current_user,
-                     format('%I.%I', $1, '_prisma_migrations'),
-                     'DELETE'
-                   ) AS can_delete
+            SELECT has_table_privilege(current_user, c.oid, 'SELECT') AS can_select,
+                   has_table_privilege(current_user, c.oid, 'INSERT') AS can_insert,
+                   has_table_privilege(current_user, c.oid, 'UPDATE') AS can_update,
+                   has_table_privilege(current_user, c.oid, 'DELETE') AS can_delete,
+                   has_table_privilege(current_user, c.oid, 'TRUNCATE') AS can_truncate,
+                   has_table_privilege(current_user, c.oid, 'REFERENCES') AS can_references,
+                   has_table_privilege(current_user, c.oid, 'TRIGGER') AS can_trigger,
+                   pg_has_role(current_user, c.relowner, 'USAGE') AS owns_object,
+                   ARRAY(
+                     SELECT acl.privilege_type
+                       FROM aclexplode(COALESCE(c.relacl, acldefault('r', c.relowner))) acl
+                      WHERE acl.grantee = 0
+                      ORDER BY acl.privilege_type
+                   ) AS public_privileges
+              FROM pg_class c
+             WHERE c.oid = to_regclass(
+               format('%I.%I', $1::text, '_prisma_migrations')
+             )
           `, [target.schema])).rows, 'migration ledger privilege');
-        if (!ledgerPrivileges.can_select) {
-            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} lacks required SELECT on ${target.schema}._prisma_migrations.`);
+        if (!ledgerPrivileges.can_select ||
+            ledgerPrivileges.public_privileges.length > 0 ||
+            ledgerPrivileges.owns_object) {
+            throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} does not have exact private SELECT-only access to ` +
+                `${target.schema}._prisma_migrations (PUBLIC=[${ledgerPrivileges.public_privileges.join('/')}], owns=${ledgerPrivileges.owns_object}).`);
         }
         if (ledgerPrivileges.can_insert ||
             ledgerPrivileges.can_update ||
-            ledgerPrivileges.can_delete) {
+            ledgerPrivileges.can_delete ||
+            ledgerPrivileges.can_truncate ||
+            ledgerPrivileges.can_references ||
+            ledgerPrivileges.can_trigger) {
             throw new Error(`${LOG_PREFIX} runtime role ${identity.role_name} has forbidden write privilege on ` +
                 `${target.schema}._prisma_migrations.`);
         }