pgkiln 0.35.0 → 0.37.0

package/src/builder/scripts.ts

@@ -7,12 +7,14 @@ import { clientIp, logActivity, type Session } from '../session.ts';
 import { runScript, splitScript, type ScriptRun, type StatementResult } from '../sqlscript.ts';
 import { clearCompletions } from './code-editor.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { currentWorkspace, workshopDb } from './workspaces.ts';
 
 // SQL Workshop → SQL Scripts: saved scripts (create, edit, upload, download,
 // delete), run with a result per statement (stop at the first error or go on,
 // optionally in one transaction), and the run history. Scripts run on the
 // owner connection, like SQL Commands, on a connection of their own that is
-// closed afterwards (a script may SET ROLE or change settings).
+// closed afterwards (a script may SET ROLE or change settings). Scripts and runs belong
+// to the current workspace; an isolated workspace's run on its developer login (090).
 
 /** Largest script (upload or editor), in MB. */
 export const SCRIPT_MAX_MB = 5;
@@ -30,7 +32,7 @@ export interface RunRequest {
 /** Run a script, record the run (history + activity log) and return the run's id. */
 export async function runAndRecord(s: Session, ip: string, r: RunRequest): Promise<{ id: string; run: ScriptRun }> {
   const statements = splitScript(r.content);
-  const c = await owner.pool.connect();
+  const c = await (await workshopDb(s)).pool.connect();
   let run: ScriptRun;
   try {
     run = await runScript(c, statements, { stopOnError: r.stopOnError, transaction: r.transaction });
@@ -40,12 +42,17 @@ export async function runAndRecord(s: Session, ip: string, r: RunRequest): Promi
   }
   clearCompletions(); // the script may have changed tables or grants
   const saved = await owner.one<{ id: string }>(
-    `insert into meta.sql_script_run (script_id, script_name, run_by, elapsed_ms, stop_on_error, transactional, statements, succeeded, failed, rolled_back, results)
-     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) returning id`,
+    `insert into meta.sql_script_run (script_id, script_name, run_by, elapsed_ms, stop_on_error, transactional, statements, succeeded, failed, rolled_back, results, workspace_id)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) returning id`,
     [r.scriptId, r.name, s.username, run.ms, r.stopOnError, r.transaction, run.statements, run.succeeded, run.failed, run.rolledBack,
-      JSON.stringify(run.commitError ? [...run.results, { n: 0, line: 0, sql: 'COMMIT', status: 'error', error: run.commitError, ms: 0 }] : run.results)],
+      JSON.stringify(run.commitError ? [...run.results, { n: 0, line: 0, sql: 'COMMIT', status: 'error', error: run.commitError, ms: 0 }] : run.results),
+      currentWorkspace(s)],
+  );
+  await owner.query(
+    `delete from meta.sql_script_run where workspace_id = $2
+        and id <= (select id from meta.sql_script_run where workspace_id = $2 order by id desc offset $1 limit 1)`,
+    [KEEP_RUNS, currentWorkspace(s)],
   );
-  await owner.query(`delete from meta.sql_script_run where id <= (select id from meta.sql_script_run order by id desc offset $1 limit 1)`, [KEEP_RUNS]);
   await logActivity({
     username: s.username,
     event: 'sql_script',
@@ -121,10 +128,12 @@ export async function scriptRoutes(app: FastifyInstance) {
                 r.started_at as last_run, r.failed as last_failed
            from meta.sql_script s
            left join lateral (select started_at, failed from meta.sql_script_run x where x.script_id = s.id order by x.id desc limit 1) r on true
+          where s.workspace_id = $1
           order by lower(s.name)`,
+        [currentWorkspace(s)],
       )
     ).rows;
-    const runs = (await owner.query('select * from meta.sql_script_run order by id desc limit 20')).rows;
+    const runs = (await owner.query('select * from meta.sql_script_run where workspace_id = $1 order by id desc limit 20', [currentWorkspace(s)])).rows;
     const list = scripts.length
       ? html`<div class="table-wrap"><table class="report"><thead><tr><th>Script</th><th>Updated</th><th class="num">Size</th><th>Last run</th><th>File</th></tr></thead><tbody>
           ${scripts.map((x) => html`<tr><td><a href="${BASE}/sql/scripts/${x.id}">${x.name}</a>${x.description ? html`<br><span class="muted small">${x.description}</span>` : ''}</td>
@@ -193,7 +202,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/:id`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const row = /^\d+$/.test(req.params.id) ? await owner.one('select * from meta.sql_script where id = $1', [req.params.id]) : undefined;
+    const row = /^\d+$/.test(req.params.id) ? await owner.one('select * from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]) : undefined;
     if (!row) return reply.code(404).send('Not found');
     return editor(req, reply, s, row);
   });
@@ -220,15 +229,15 @@ export async function scriptRoutes(app: FastifyInstance) {
     try {
       if (id) {
         const r = await owner.one(
-          'update meta.sql_script set name = $2, description = nullif($3, \'\'), content = $4, updated_by = $5, updated_at = now() where id = $1 returning id',
-          [id, name, b.description ?? '', content, s.username],
+          'update meta.sql_script set name = $2, description = nullif($3, \'\'), content = $4, updated_by = $5, updated_at = now() where id = $1 and workspace_id = $6 returning id',
+          [id, name, b.description ?? '', content, s.username, currentWorkspace(s)],
         );
         if (!r) return reply.code(404).send('Not found');
         scriptId = r.id;
       } else {
         const r = await owner.one(
-          `insert into meta.sql_script (name, description, content, created_by, updated_by) values ($1, nullif($2, ''), $3, $4, $4) returning id`,
-          [name, b.description ?? '', content, s.username],
+          `insert into meta.sql_script (name, description, content, created_by, updated_by, workspace_id) values ($1, nullif($2, ''), $3, $4, $4, $5) returning id`,
+          [name, b.description ?? '', content, s.username, currentWorkspace(s)],
         );
         scriptId = r!.id;
       }
@@ -260,6 +269,8 @@ export async function scriptRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!/^\d+$/.test(req.params.id)) return reply.code(404).send('Not found');
     const r = await owner.tx(async (c) => {
+      const own = (await c.query('select 1 from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)])).rowCount;
+      if (!own) return undefined;
       await c.query('delete from meta.sql_script_run where script_id = $1', [req.params.id]);
       return (await c.query('delete from meta.sql_script where id = $1 returning name', [req.params.id])).rows[0];
     });
@@ -270,7 +281,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/:id/download`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const row = /^\d+$/.test(req.params.id) ? await owner.one('select name, content from meta.sql_script where id = $1', [req.params.id]) : undefined;
+    const row = /^\d+$/.test(req.params.id) ? await owner.one('select name, content from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]) : undefined;
     if (!row) return reply.code(404).send('Not found');
     return reply
       .header('content-type', 'application/sql; charset=utf-8')
@@ -302,8 +313,8 @@ export async function scriptRoutes(app: FastifyInstance) {
     if (content.includes('\0')) return fail('The file is not a text file.');
     const base = file.filename.replace(/^.*[\\/]/, '').replace(/\.sql$/i, '').slice(0, 180) || 'script';
     let name = base;
-    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1', [name]); n++) name = `${base} (${n})`;
-    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by) values ($1, $2, $3, $3) returning id`, [name, content, s.username]);
+    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1 and workspace_id = $2', [name, currentWorkspace(s)]); n++) name = `${base} (${n})`;
+    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by, workspace_id) values ($1, $2, $3, $3, $4) returning id`, [name, content, s.username, currentWorkspace(s)]);
     flash(s, `Script “${name}” uploaded.`);
     return back(reply, s, `${BASE}/sql/scripts/${r!.id}`);
   });
@@ -312,7 +323,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/runs/:run`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const run = /^\d+$/.test(req.params.run) ? await owner.one('select * from meta.sql_script_run where id = $1', [req.params.run]) : undefined;
+    const run = /^\d+$/.test(req.params.run) ? await owner.one('select * from meta.sql_script_run where id = $1 and workspace_id = $2', [req.params.run, currentWorkspace(s)]) : undefined;
     if (!run) return reply.code(404).send('Not found');
     const exists = run.script_id ? await owner.one('select id from meta.sql_script where id = $1', [run.script_id]) : undefined;
     const options = `${run.stop_on_error ? 'stop on error' : 'continue on error'}${run.transactional ? ', one transaction' : ''}`;

package/src/builder/shared.ts

@@ -33,7 +33,7 @@ function listExtras(appId: number, list: any, entries: any[]): Raw {
 
 export async function sharedRoutes(app: FastifyInstance) {
   // ---------------------------------------------------------------- shared components
-  const SHARED = ['nav_entry', 'authz_scheme', 'build_option', 'lov', 'app_item', 'app_process', 'automation', 'automation_action', 'report_layout', 'document_template', 'task_definition', 'workflow_definition', 'rest_module', 'template_component', 'web_credential', 'rest_source', 'data_load_def', 'list', 'list_entry', 'supporting_script', 'search_config', 'email_template', 'app_setting', 'dynamic_translation'];
+  const SHARED = ['nav_entry', 'authz_scheme', 'build_option', 'page_group', 'lov', 'app_item', 'app_process', 'automation', 'automation_action', 'report_layout', 'document_template', 'task_definition', 'workflow_definition', 'rest_module', 'template_component', 'web_credential', 'rest_source', 'data_load_def', 'list', 'list_entry', 'supporting_script', 'search_config', 'email_template', 'app_setting', 'dynamic_translation'];
 
   const ORDER: Record<string, string> = {
     search_config: 'seq, name', dynamic_translation: 'language, source',

package/src/builder/sql.ts

@@ -1,6 +1,5 @@
 import type { FastifyInstance, FastifyReply } from 'fastify';
 import pg from 'pg';
-import { owner } from '../db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { BASE, csrf, developer, region, send, shell, workshopTabs, type Req } from './ui.ts';
@@ -10,8 +9,11 @@ import { scriptRoutes } from './scripts.ts';
 import { quickSqlRoutes } from './quicksql.ts';
 import { queryBuilderRoutes } from './querybuilder.ts';
 import { unloadRoutes } from './unload.ts';
+import { ddlToolRoutes } from './ddl-tools.ts';
+import { workshopDb, workshopRunsAs } from './workspaces.ts';
 
-// SQL Workshop: SQL commands and the object browser (owner connection).
+// SQL Workshop: SQL commands and the object browser (owner connection; an isolated
+// workspace's developer login for its developers, see workshopDb).
 
 export async function sqlRoutes(app: FastifyInstance) {
   // SQL Scripts, Quick SQL and the query builder (sprint 31)
@@ -20,6 +22,8 @@ export async function sqlRoutes(app: FastifyInstance) {
   await app.register(queryBuilderRoutes);
   // Unload Data (sprint 32)
   await app.register(unloadRoutes);
+  // Generate DDL and Schema Comparison (sprint 56)
+  await app.register(ddlToolRoutes);
   // ---------------------------------------------------------------- SQL workshop
   const resultTable = (res: pg.QueryResult<any[]>, limit = 500) => {
     const rows = (res.rows ?? []).slice(0, limit);
@@ -32,12 +36,13 @@ export async function sqlRoutes(app: FastifyInstance) {
     if (!s) return;
     const sql = req.body?.sql ?? '';
     let result: Raw | '' = '';
+    const db = await workshopDb(s);
     if (req.method === 'POST' && sql.trim()) {
       const started = performance.now();
       try {
         // a connection of its own, closed afterwards: the SQL may SET ROLE or change settings,
         // which must not leak into the builder's pooled owner connections
-        const c = await owner.pool.connect();
+        const c = await db.pool.connect();
         let out;
         try {
           out = await c.query({ text: sql, rowMode: 'array' });
@@ -56,7 +61,7 @@ export async function sqlRoutes(app: FastifyInstance) {
       await logActivity({ username: s.username, event: 'sql_command', ip: clientIp(req), elapsedMs: Math.round(performance.now() - started), detail: sql.length > 2000 ? `${sql.slice(0, 2000)}…` : sql });
     }
     const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('sql')}
-      <p class="muted">Runs as the builder's owner connection (not as an application role). Multiple statements are allowed; results of the last one are shown.</p>
+      <p class="muted">Runs as ${workshopRunsAs(db)} (not as an application role). Multiple statements are allowed; results of the last one are shown.</p>
       <form method="post">${csrf(s)}
         <textarea name="sql" class="code sql-editor" rows="12" spellcheck="false" aria-label="SQL" data-code="plpgsql">${sql || 'select current_user, version();'}</textarea>
         <div class="buttons"><button class="btn btn-hot">${icon('play')} Run (Ctrl+Enter)</button></div>
@@ -70,17 +75,20 @@ export async function sqlRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/objects`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
+    const db = await workshopDb(s);
     const objects = (
-      await owner.query(
+      await db.query(
         `select n.nspname as schema, c.relname as name, c.oid::regclass::text as qname,
                 case c.relkind when 'r' then 'table' when 'p' then 'table' when 'v' then 'view' when 'm' then 'view' end as kind,
                 c.relrowsecurity as rls
            from pg_class c join pg_namespace n on n.oid = c.relnamespace
           where c.relkind in ('r', 'p', 'v', 'm') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema')
+            and has_schema_privilege(n.oid, 'USAGE')
          union all
          select n.nspname, p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')', p.oid::regprocedure::text, 'function', false
            from pg_proc p join pg_namespace n on n.oid = p.pronamespace
           where n.nspname !~ '^pg_' and n.nspname not in ('information_schema') and p.prokind in ('f', 'p')
+            and has_schema_privilege(n.oid, 'USAGE')
           order by 1, 4 desc, 2`,
       )
     ).rows;
@@ -89,24 +97,24 @@ export async function sqlRoutes(app: FastifyInstance) {
     let detail: Raw = html`<p class="muted">Select a table, view or function.</p>`;
     if (selected) {
       if (selected.kind === 'function') {
-        const src = await owner.one('select pg_get_functiondef($1::regprocedure) as def', [selected.qname]);
+        const src = await db.one('select pg_get_functiondef($1::regprocedure) as def', [selected.qname]);
         detail = region(selected.qname, html`<pre class="source">${src.def}</pre>`);
       } else {
         const [cols, policies, grants, data] = await Promise.all([
-          owner.query(
+          db.query(
             `select a.attname as column, format_type(a.atttypid, a.atttypmod) as type, not a.attnotnull as nullable,
                     pg_get_expr(d.adbin, d.adrelid) as "default"
                from pg_attribute a left join pg_attrdef d on d.adrelid = a.attrelid and d.adnum = a.attnum
               where a.attrelid = $1::regclass and a.attnum > 0 and not a.attisdropped order by a.attnum`,
             [selected.qname],
           ),
-          owner.query('select policyname as policy, cmd, roles::text, qual as using, with_check from pg_policies where schemaname = $1 and tablename = $2', [selected.schema, selected.name]),
-          owner.query(
+          db.query('select policyname as policy, cmd, roles::text, qual as using, with_check from pg_policies where schemaname = $1 and tablename = $2', [selected.schema, selected.name]),
+          db.query(
             `select grantee, string_agg(privilege_type, ', ' order by privilege_type) as privileges
                from information_schema.role_table_grants where table_schema = $1 and table_name = $2 group by grantee order by grantee`,
             [selected.schema, selected.name],
           ),
-          owner.pool.query({ text: `select * from ${selected.qname} limit 25`, rowMode: 'array' }).catch((e) => e as Error),
+          db.pool.query({ text: `select * from ${selected.qname} limit 25`, rowMode: 'array' }).catch((e) => e as Error),
         ]);
         const asArray = (r: pg.QueryResult) => ({ ...r, rows: r.rows.map((x) => Object.values(x)) }) as unknown as pg.QueryResult<any[]>;
         detail = html`${region(`${selected.kind === 'view' ? 'View' : 'Table'} ${selected.qname}`, resultTable(asArray(cols)),

package/src/builder/ui.ts

@@ -209,13 +209,13 @@ export const appHeader = (a: any, active: 'pages' | 'shared' | 'settings' | 'act
 };
 
 /** Tabs of the SQL Workshop. */
-export type WorkshopTab = 'sql' | 'scripts' | 'quicksql' | 'query' | 'objects' | 'load' | 'unload' | 'sample' | 'ai';
+export type WorkshopTab = 'sql' | 'scripts' | 'quicksql' | 'query' | 'objects' | 'load' | 'unload' | 'sample' | 'ai' | 'ddl' | 'compare';
 export const workshopTabs = (active: WorkshopTab) => {
   const tab = (key: WorkshopTab, href: string, ic: string, label: string) =>
     html`<a class="ide-tab" href="${BASE}${href}"${active === key ? raw(' aria-current="page"') : ''}>${icon(ic)}<span>${label}</span></a>`;
   return html`<nav class="ide-tabs u-mb1" aria-label="SQL Workshop">
     ${tab('sql', '/sql', 'code', 'SQL Commands')}${tab('scripts', '/sql/scripts', 'file', 'SQL Scripts')}${tab('quicksql', '/sql/quick', 'bolt', 'Quick SQL')}
-    ${tab('query', '/sql/query', 'filter', 'Query Builder')}${tab('objects', '/sql/objects', 'database', 'Object Browser')}${tab('load', '/sql/load', 'upload', 'Load Data')}${tab('unload', '/sql/unload', 'download', 'Unload Data')}${tab('sample', '/sql/sample-data', 'layers', 'Sample Data')}${tab('ai', '/sql/ai', 'bolt', 'AI')}</nav>`;
+    ${tab('query', '/sql/query', 'filter', 'Query Builder')}${tab('objects', '/sql/objects', 'database', 'Object Browser')}${tab('load', '/sql/load', 'upload', 'Load Data')}${tab('unload', '/sql/unload', 'download', 'Unload Data')}${tab('sample', '/sql/sample-data', 'layers', 'Sample Data')}${tab('ddl', '/sql/ddl', 'file', 'DDL')}${tab('compare', '/sql/compare', 'layers', 'Compare')}${tab('ai', '/sql/ai', 'bolt', 'AI')}</nav>`;
 };
 
 /** Number of app tile colours (.app-color-0 … -7 in app.css). */

package/src/builder/unload.ts

@@ -21,6 +21,7 @@ import {
   type UnloadOptions,
 } from '../unload.ts';
 import { BASE, csrf, developer, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Unload Data (APEX: Data Workshop → Unload Data): a table or
 // view (chosen columns, an optional WHERE and ORDER BY) or a query, to CSV,
@@ -125,7 +126,7 @@ export async function unloadRoutes(app: FastifyInstance) {
       <a class="ide-tab" href="${BASE}/sql/unload?source=query"${active === 'query' ? raw(' aria-current="page"') : ''}>${icon('code')}<span>Query</span></a></nav>`;
 
   const intro = html`<p class="muted">Download the rows of a table, a view or a query as CSV, JSON, Excel or XML (up to ${DOWNLOAD_MAX_ROWS.toLocaleString('en')} rows).
-    Runs as the builder's owner connection in a read-only transaction. To load a file into a table, use <a href="${BASE}/sql/load">Load Data</a>.</p>`;
+    Runs as the builder's owner connection (an isolated workspace's developer login for its developers) in a read-only transaction. To load a file into a table, use <a href="${BASE}/sql/load">Load Data</a>.</p>`;
 
   const form = async (s: Session, b: Body, error?: string) => {
     const alert = error ? html`<div class="alert alert-error" role="alert">${error}</div>` : '';
@@ -212,7 +213,7 @@ export async function unloadRoutes(app: FastifyInstance) {
     if (typeof opts === 'string') return refuse(opts);
 
     const started = performance.now();
-    const c = await owner.pool.connect();
+    const c = await (await workshopDb(s)).pool.connect();
     let opened;
     try {
       await c.query('begin transaction read only');

package/src/builder/workspaces.ts

@@ -1,5 +1,8 @@
 import type { FastifyInstance, FastifyReply } from 'fastify';
-import { owner } from '../db.ts';
+import { owner, type Db } from '../db.ts';
+import { devDbForWorkspace, workspacesChanged } from '../workspace-db.ts';
+import { ownerUrl, runtimeUrl } from '../db.ts';
+import { secretKeyConfigured } from '../secrets.ts';
 import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type Session } from '../session.ts';
@@ -68,6 +71,19 @@ export async function appAllowed(s: Session, appId: number | string) {
   return true;
 }
 
+/**
+ * The connection for a developer's own SQL (the SQL Workshop's tools): the owner, or in an
+ * isolated workspace (090) its developer login, which reaches the workspace's application
+ * roles only. Administrators keep the owner.
+ */
+export async function workshopDb(s: Session): Promise<Db> {
+  if (!s.workspace || (await isAdmin(s.username))) return owner;
+  return (await devDbForWorkspace(s.workspace.id)) ?? owner;
+}
+
+/** Who the SQL Workshop runs as, for its notes. */
+export const workshopRunsAs = (db: Db) => (db === owner ? 'the builder\'s owner connection' : 'this isolated workspace\'s developer login (its applications\' roles, nothing else)');
+
 /** Put an application in a workspace (inside the caller's transaction, or on the owner pool). */
 export async function placeApp(db: { query: (sql: string, params?: unknown[]) => Promise<unknown> }, appId: number, workspaceId: number) {
   await db.query(
@@ -99,6 +115,18 @@ async function adminOnly(s: Session, reply: FastifyReply) {
   return false;
 }
 
+/** An administrator, or a workspace administrator of this workspace (090). */
+export async function workspaceAdmin(username: string | null, workspaceId: number | string) {
+  if (!username) return false;
+  if (await isAdmin(username)) return true;
+  return !!(await owner.one('select 1 as ok from meta.workspace_member where workspace_id = $1 and username = $2 and is_admin', [workspaceId, username]));
+}
+
+async function workspaceAdminOnly(s: Session, reply: FastifyReply, workspaceId: string) {
+  if (await workspaceAdmin(s.username, workspaceId)) return true;
+  return adminOnly(s, reply);
+}
+
 const crumbs = (extra: [string, string?][] = []): [string, string?][] => [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Workspaces', `${BASE}/workspaces`], ...extra];
 
 const nameError = (e: unknown) => {
@@ -108,6 +136,49 @@ const nameError = (e: unknown) => {
   return m;
 };
 
+const ROLE = /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/;
+
+/** Why this installation can't isolate a workspace (090), or null. */
+export function isolationProblem(): string | null {
+  if (!secretKeyConfigured()) return 'set PGKILN_SECRET_KEY (at least 32 characters) in the server\'s environment: the workspace\'s database logins get passwords derived from it.';
+  if (runtimeUrl === ownerUrl) return 'set RUNTIME_DATABASE_URL: applications run on the owner connection, so no workspace can be isolated.';
+  return null;
+}
+
+/** A role problem from meta.workspace_sync_roles (or a duplicate role) in words. */
+const roleError = (e: unknown) => {
+  const m = (e as Error).message;
+  if (m.includes('workspace_role_role_name_key')) return 'this role belongs to another workspace already.';
+  if (m.includes('workspace_role_pkey')) return 'the workspace has this role already.';
+  return m;
+};
+
+/** The Isolation region of a workspace's page. */
+function isolationRegion(s: Session, w: { id: number; name: string; isolated: boolean; run_role: string | null; dev_role: string | null },
+  roles: { role_name: string; exists: boolean; apps: string | null }[]) {
+  const problem = w.isolated ? null : isolationProblem();
+  const body = w.isolated
+    ? html`<p class="u-mt0"><span class="tag">${icon('lock')} isolated</span> Its applications run as <code>${w.run_role}</code> and its developers' SQL (SQL Workshop, code checks, the Advisor) as <code>${w.dev_role}</code>. Both reach only the roles below, and see only this workspace's applications, sessions and accounts in pgkiln's own tables. Developers who also belong to a shared workspace keep that workspace's rights there.</p>
+      <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Database role</th><th>Used by</th><th></th></tr></thead><tbody>
+        ${roles.length
+          ? roles.map((r) => html`<tr><td data-label="Database role"><code>${r.role_name}</code>${r.exists ? '' : html` <span class="tag tag-error">missing</span>`}</td>
+              <td data-label="Used by">${r.apps ?? html`<span class="muted">no application</span>`}</td>
+              <td><form method="post" action="${BASE}/workspaces/${w.id}/roles">${csrf(s)}<input type="hidden" name="role" value="${r.role_name}">
+                <button class="btn btn-sm" name="action" value="remove">Remove</button></form></td></tr>`)
+          : html`<tr><td colspan="3" class="empty">No database roles: applications here can't run as a role of their own.</td></tr>`}</tbody></table></div>
+      <form method="post" action="${BASE}/workspaces/${w.id}/roles" class="u-mt1">${csrf(s)}
+        ${input('role', 'Add a database role', '', { help: 'An existing role (not a superuser, not one that creates roles or bypasses row-level security). Its rights become this workspace\'s; it can\'t belong to another workspace.' })}
+        <div class="buttons"><button class="btn" name="action" value="add">${icon('plus')} Add role</button></div></form>
+      <form method="post" action="${BASE}/workspaces/${w.id}/isolation" class="danger-zone">${csrf(s)}<input type="hidden" name="isolated" value="false">
+        <button class="btn btn-danger" data-confirm="Make ${w.name} shared again? Its applications then run on the shared runtime connection, and its developers' SQL as the owner.">Make shared</button></form>`
+    : html`<p class="u-mt0">Shared: the applications run on the shared runtime connection and the developers' SQL as the owner, like every shared workspace's.</p>
+      <p class="muted small">Isolating gives the workspace two database logins of its own and the database roles its applications use now. Application code then reaches only those roles and this workspace's applications; its developers' SQL Workshop runs on the workspace's login instead of the owner. New applications get a new role and schema of their own.</p>
+      ${problem ? html`<div class="alert alert-error" role="alert">To isolate a workspace, ${problem}</div>` : ''}
+      <form method="post" action="${BASE}/workspaces/${w.id}/isolation">${csrf(s)}<input type="hidden" name="isolated" value="true">
+        <div class="buttons"><button class="btn btn-hot"${problem ? raw(' disabled') : ''} data-confirm="Isolate ${w.name}?">${icon('lock')} Isolate this workspace</button></div></form>`;
+  return region('Isolation', body);
+}
+
 export async function workspaceRoutes(app: FastifyInstance) {
   // switch the current workspace (any of the developer's own)
   app.post(`${BASE}/workspace`, async (req: Req, reply) => {
@@ -125,7 +196,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
     if (!s || !(await adminOnly(s, reply))) return;
     const rows = (
       await owner.query(
-        `select w.id, w.name, w.description,
+        `select w.id, w.name, w.description, w.isolated,
                 (select count(*) from meta.app a where meta.app_workspace(a.id) = w.id)::int as apps,
                 (select string_agg(m.username, ', ' order by m.username) from meta.workspace_member m where m.workspace_id = w.id) as members
            from meta.workspace w order by w.id = 1 desc, lower(w.name)`,
@@ -133,12 +204,12 @@ export async function workspaceRoutes(app: FastifyInstance) {
     ).rows;
     const main = html`
       <div class="title-row"><h1>Workspaces</h1></div>
-      <p class="muted u-mt0">A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. Workspaces are not a security boundary between developers who write SQL: the SQL Workshop and application code run with this installation's rights. Give tenants who must not see each other separate installations.</p>
+      <p class="muted u-mt0">A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. A shared workspace is not a security boundary between developers who write SQL: its SQL Workshop and application code run with this installation's rights. An <strong>isolated</strong> workspace is: its applications and SQL run on database logins of its own that reach only its database roles and its own applications.</p>
       <div class="columns wide-left">
         ${region('Workspaces', html`<div class="table-wrap"><table class="report report-reflow">
           <thead><tr><th>Workspace</th><th class="num">Applications</th><th>Developers</th></tr></thead>
           <tbody>${rows.map((w) => html`<tr>
-            <td data-label="Workspace"><a href="${BASE}/workspaces/${w.id}">${w.name}</a>${w.description ? html` <span class="muted">${w.description}</span>` : ''}</td>
+            <td data-label="Workspace"><a href="${BASE}/workspaces/${w.id}">${w.name}</a>${w.isolated ? html` <span class="tag">${icon('lock')} isolated</span>` : ''}${w.description ? html` <span class="muted">${w.description}</span>` : ''}</td>
             <td class="num" data-label="Applications">${w.apps}</td>
             <td data-label="Developers">${w.members ?? html`<span class="muted">administrators only</span>`}</td></tr>`)}</tbody></table></div>`)}
         ${region('Add workspace', html`<form method="post" action="${BASE}/workspaces">${csrf(s)}
@@ -175,18 +246,26 @@ export async function workspaceRoutes(app: FastifyInstance) {
 
   app.get(`${BASE}/workspaces/:id(^\\d{1,9}$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const full = await isAdmin(s.username);
     const w = await owner.one('select * from meta.workspace where id = $1', [req.params.id]);
     if (!w) return reply.code(404).send('Not found');
-    const [devs, apps, others] = await Promise.all([
+    const [devs, apps, others, rolesQ] = await Promise.all([
       owner.query(
-        `select d.username, d.is_admin, m.username is not null as member
+        `select d.username, d.is_admin, m.username is not null as member, coalesce(m.is_admin, false) as ws_admin
            from meta.developer d left join meta.workspace_member m on m.username = d.username and m.workspace_id = $1 order by d.username`,
         [w.id],
       ),
       owner.query(`select a.id, a.name, a.alias from meta.app a where meta.app_workspace(a.id) = $1 order by lower(a.name), a.id`, [w.id]),
       owner.query('select id, name from meta.workspace where id <> $1 order by id = 1 desc, lower(name)', [w.id]),
+      owner.query(
+        `select x.role_name, exists (select 1 from pg_roles r where r.rolname = x.role_name) as exists,
+                (select string_agg(a.alias, ', ' order by a.alias) from meta.app a where a.db_role = x.role_name) as apps
+           from meta.workspace_role x where x.workspace_id = $1 order by 1`,
+        [w.id],
+      ),
     ]);
+    const roles = rolesQ;
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -194,7 +273,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
             ${input('name', 'Name', w.name, { required: true })}
             ${input('description', 'Description', w.description ?? '')}
             <div class="buttons"><button class="btn btn-hot">Save</button></div></form>
-          ${w.id === 1
+          ${!full ? '' : w.id === 1
             ? html`<p class="muted small">The Default workspace can't be deleted: imported applications and applications made with the command line start here.</p>`
             : html`<form method="post" action="${BASE}/workspaces/${w.id}/delete" class="danger-zone">${csrf(s)}
                 <button class="btn btn-danger" data-confirm="Delete workspace ${w.name}?"${apps.rows.length ? raw(' disabled') : ''}>Delete workspace</button>
@@ -204,9 +283,13 @@ export async function workspaceRoutes(app: FastifyInstance) {
             <fieldset class="field"><legend class="sr-only">Developers</legend><div class="radio-group">
             ${devs.rows.map((d) => html`<label class="check"><input type="checkbox" name="member" value="${d.username}"${d.member ? raw(' checked') : ''}> ${d.username}${d.is_admin ? html` <span class="muted">(administrator)</span>` : ''}</label>`)}
             </div></fieldset>
+            <fieldset class="field"><legend class="label">Workspace administrators</legend><div class="radio-group">
+            ${devs.rows.filter((d) => d.member && !d.is_admin).map((d) => html`<label class="check"><input type="checkbox" name="admin" value="${d.username}"${d.ws_admin ? raw(' checked') : ''}> ${d.username}</label>`)}
+            </div><small class="help">They manage this workspace's name and developers. Isolation, database roles, moving applications and deleting the workspace stay with administrators.</small></fieldset>
             <div class="buttons"><button class="btn">Save developers</button></div></form>`)}
       </div>
-      ${region('Applications', html`<div class="table-wrap"><table class="report report-reflow">
+      ${full ? isolationRegion(s, w, roles.rows) : region('Isolation', html`<p class="u-mt0">${w.isolated ? 'Isolated: its applications and SQL run on database logins of its own.' : 'Shared.'} Administrators change it.</p>`)}
+      ${!full ? '' : region('Applications', html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>Application</th><th>Move to</th></tr></thead>
         <tbody>${apps.rows.length
           ? apps.rows.map((a) => html`<tr><td data-label="Application"><a href="${BASE}/apps/${a.id}">${a.name}</a> <span class="muted">${a.id} · /a/${a.alias}</span></td>
@@ -217,12 +300,12 @@ export async function workspaceRoutes(app: FastifyInstance) {
                     <button class="btn">Move</button></form>`
                 : html`<span class="muted">no other workspace</span>`}</td></tr>`)
           : html`<tr><td colspan="2" class="empty">No applications.</td></tr>`}</tbody></table></div>`)}`;
-    return send(reply, s, shell(s, w.name, crumbs([[w.name]]), main));
+    return send(reply, s, shell(s, w.name, full ? crumbs([[w.name]]) : [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], [w.name]], main));
   });
 
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
     const name = String(req.body?.name ?? '').trim();
     try {
       if (!NAME.test(name)) throw new Error('The name is 1 to 60 characters.');
@@ -236,16 +319,19 @@ export async function workspaceRoutes(app: FastifyInstance) {
 
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/members`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
     if (!(await owner.one('select 1 as ok from meta.workspace where id = $1', [req.params.id]))) return reply.code(404).send('Not found');
     const posted = req.body?.member as unknown;
     const names = (Array.isArray(posted) ? posted : posted == null ? [] : [posted]).map(String).slice(0, 10000);
+    const postedAdmins = req.body?.admin as unknown;
+    const admins = (Array.isArray(postedAdmins) ? postedAdmins : postedAdmins == null ? [] : [postedAdmins]).map(String).slice(0, 10000);
     await owner.tx(async (c) => {
       await c.query('delete from meta.workspace_member where workspace_id = $1', [req.params.id]);
       // only existing developers (unknown names are ignored)
       await c.query(
-        `insert into meta.workspace_member (workspace_id, username) select $1, d.username from meta.developer d where d.username = any($2::text[])`,
-        [req.params.id, names],
+        `insert into meta.workspace_member (workspace_id, username, is_admin)
+         select $1, d.username, d.username = any($3::text[]) from meta.developer d where d.username = any($2::text[])`,
+        [req.params.id, names, admins],
       );
     });
     await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `developers of workspace ${req.params.id}: ${names.join(', ').slice(0, 1000)}` });
@@ -260,7 +346,28 @@ export async function workspaceRoutes(app: FastifyInstance) {
     const appId = /^\d{1,9}$/.test(req.body?.app ?? '') ? Number(req.body!.app) : null;
     const to = (await owner.one<{ id: number; name: string }>('select id, name from meta.workspace where id = $1', [/^\d{1,9}$/.test(req.body?.to ?? '') ? req.body!.to : null]));
     if (appId === null || !to || (await appWorkspace(appId)) !== from) return reply.code(404).send('Not found');
-    await placeApp(owner, appId, to.id);
+    try {
+      await owner.tx(async (c) => {
+        // (090) the application's database role goes along: out of the old workspace's roles (when no other
+        // application there uses it), into the new one's when that one is isolated
+        const role = (await c.query<{ db_role: string | null }>('select db_role from meta.app where id = $1', [appId])).rows[0]?.db_role;
+        if (role) {
+          await c.query(
+            `delete from meta.workspace_role x where x.workspace_id = $1 and x.role_name = $2
+                and not exists (select 1 from meta.app a where a.db_role = $2 and a.id <> $3 and meta.app_workspace(a.id) = $1)`,
+            [from, role, appId],
+          );
+          if ((await c.query('select 1 from meta.workspace where id = $1 and isolated', [to.id])).rowCount)
+            await c.query('insert into meta.workspace_role (workspace_id, role_name) values ($1, $2) on conflict do nothing', [to.id, role]);
+        }
+        await placeApp(c, appId, to.id);
+      });
+    } catch (e) {
+      flash(s, `Not moved: ${roleError(e)}`, 'error');
+      return back(reply, s, `${BASE}/workspaces/${from}`);
+    } finally {
+      await workspacesChanged();
+    }
     await logActivity({ appId, username: s.username, event: 'workspace', ip: clientIp(req), detail: `moved from workspace ${from} to ${to.id}` });
     flash(s, `Application moved to ${to.name}.`);
     return back(reply, s, `${BASE}/workspaces/${from}`);
@@ -274,6 +381,10 @@ export async function workspaceRoutes(app: FastifyInstance) {
       flash(s, 'The Default workspace cannot be deleted.', 'error');
       return back(reply, s, `${BASE}/workspaces/${id}`);
     }
+    if (await owner.one('select 1 as ok from meta.workspace where id = $1 and isolated', [id])) {
+      flash(s, 'Make the workspace shared (not isolated) before deleting it.', 'error');
+      return back(reply, s, `${BASE}/workspaces/${id}`);
+    }
     if (await owner.one('select 1 as ok from meta.workspace_app where workspace_id = $1 limit 1', [id])) {
       flash(s, 'Move the applications of this workspace to another workspace first.', 'error');
       return back(reply, s, `${BASE}/workspaces/${id}`);
@@ -283,4 +394,53 @@ export async function workspaceRoutes(app: FastifyInstance) {
     flash(s, r ? `Workspace ${r.name} deleted.` : 'Not found.', r ? 'ok' : 'error');
     return back(reply, s, `${BASE}/workspaces`);
   });
+
+  // (090) isolate a workspace, or make it shared again
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/isolation`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply))) return;
+    const id = Number(req.params.id);
+    const on = req.body?.isolated === 'true';
+    try {
+      const problem = on ? isolationProblem() : null;
+      if (problem) throw new Error(problem);
+      const r = await owner.query('update meta.workspace set isolated = $2 where id = $1', [id, on]);
+      if (!r.rowCount) return reply.code(404).send('Not found');
+      await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `workspace ${id} ${on ? 'isolated' : 'shared'}` });
+      flash(s, on ? 'The workspace is isolated: its applications and SQL now run on its own database logins.' : 'The workspace is shared again: its applications run on the shared runtime connection.');
+    } catch (e) {
+      flash(s, `${on ? 'Not isolated' : 'Not changed'}: ${roleError(e)}`, 'error');
+    } finally {
+      await workspacesChanged();
+    }
+    return back(reply, s, `${BASE}/workspaces/${id}`);
+  });
+
+  // (090) the database roles of an isolated workspace
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/roles`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply))) return;
+    const id = Number(req.params.id);
+    const role = String(req.body?.role ?? '').trim();
+    const remove = req.body?.action === 'remove';
+    try {
+      if (!ROLE.test(role)) throw new Error('A role name is a letter or _ followed by letters, digits, _ or $ (at most 63).');
+      if (!remove && !(await owner.one('select 1 as ok from pg_roles where rolname = $1', [role]))) throw new Error(`There is no database role ${role}.`);
+      if (remove) {
+        const used = await owner.one<{ aliases: string }>(
+          `select string_agg(alias, ', ') as aliases from meta.app a where a.db_role = $2 and meta.app_workspace(a.id) = $1 having count(*) > 0`,
+          [id, role],
+        );
+        if (used) throw new Error(`${used.aliases} run${used.aliases.includes(',') ? '' : 's'} as ${role}: give ${used.aliases.includes(',') ? 'them' : 'it'} another role first.`);
+        await owner.query('delete from meta.workspace_role where workspace_id = $1 and role_name = $2', [id, role]);
+      } else await owner.query('insert into meta.workspace_role (workspace_id, role_name) values ($1, $2)', [id, role]);
+      await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `workspace ${id}: ${remove ? 'removed' : 'added'} role ${role}` });
+      flash(s, remove ? `Role ${role} removed.` : `Role ${role} added.`);
+    } catch (e) {
+      flash(s, `Not saved: ${roleError(e)}`, 'error');
+    } finally {
+      await workspacesChanged();
+    }
+    return back(reply, s, `${BASE}/workspaces/${id}`);
+  });
 }