pgkiln 0.36.0 → 0.37.0

package/src/builder/ddl-tools.ts

@@ -6,6 +6,7 @@ import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity } from '../session.ts';
 import { BASE, developer, region, send, shell, workshopTabs, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Generate DDL and Schema Comparison (APEX: SQL Workshop →
 // Utilities). Both only read the catalog (src/ddl.ts); the scripts they
@@ -32,7 +33,8 @@ export async function ddlToolRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/ddl`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const schemas = await userSchemas(owner);
+    const db = await workshopDb(s);
+    const schemas = await userSchemas(db, { usable: db !== owner });
     const q = req.query ?? {};
     const schema = schemas.includes(q.schema ?? '') ? q.schema! : '';
     // the first visit: every type, comments and grants
@@ -42,7 +44,7 @@ export async function ddlToolRoutes(app: FastifyInstance) {
     let result: Raw | '' = '';
     if (schema) {
       try {
-        const objects = pick(await readSchema(owner.pool, schema), types, opts);
+        const objects = pick(await readSchema(db.pool, schema), types, opts);
         const script = ddlScript(schema, objects);
         await logActivity({ username: s.username, event: 'generate_ddl', ip: clientIp(req), detail: `${schema}: ${objects.length} objects` });
         if (q.download === '1')
@@ -73,7 +75,8 @@ export async function ddlToolRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/compare`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const schemas = await userSchemas(owner);
+    const db = await workshopDb(s);
+    const schemas = await userSchemas(db, { usable: db !== owner });
     const q = req.query ?? {};
     const source = schemas.includes(q.source ?? '') ? q.source! : '';
     const target = schemas.includes(q.target ?? '') ? q.target! : '';
@@ -81,7 +84,7 @@ export async function ddlToolRoutes(app: FastifyInstance) {
     if (source && target && source === target) result = html`<div class="alert alert-error" role="alert">Choose two different schemas.</div>`;
     else if (source && target) {
       try {
-        const [a, b] = await Promise.all([readSchema(owner.pool, source), readSchema(owner.pool, target)]);
+        const [a, b] = await Promise.all([readSchema(db.pool, source), readSchema(db.pool, target)]);
         const { differences, same } = compare(a, b);
         const script = changeScript(source, target, a, b);
         await logActivity({ username: s.username, event: 'schema_compare', ip: clientIp(req), detail: `${source} → ${target}: ${differences.length} differences` });

package/src/builder/documents.ts

@@ -2,6 +2,7 @@ import type { FastifyInstance } from 'fastify';
 import pg from 'pg';
 import { applyBinds } from '../binds.ts';
 import { owner } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html } from '../html.ts';
 import { english } from '../i18n.ts';
 import { documentData, documentPdf, fillTemplate, TemplateError } from '../runtime/document.ts';
@@ -42,7 +43,7 @@ export async function documentRoutes(app: FastifyInstance) {
     const tpl = a && /^\d+$/.test(tid) ? await owner.one('select * from meta.document_template where id = $1 and app_id = $2', [tid, a.id]) : undefined;
     if (!a || !tpl) return reply.code(404).send('Not found');
     const binds = previewBinds(String(req.query.binds ?? ''));
-    const c = await owner.pool.connect();
+    const c = await (await devDbForApp(a.id)).pool.connect();
     try {
       await c.query('begin');
       await c.query(`set local statement_timeout = '10s'`);

package/src/builder/home.ts

@@ -5,7 +5,7 @@ import { icon } from '../icons.ts';
 import { APP_COLORS, BASE, csrf, developer, input, region, select, send, shell, type Req } from './ui.ts';
 import type { Session } from '../session.ts';
 import { isAdmin } from './locks.ts';
-import { currentWorkspace, inWorkspaceSql } from './workspaces.ts';
+import { currentWorkspace, inWorkspaceSql, workspaceAdmin } from './workspaces.ts';
 
 // The workspace pages of the builder, laid out like APEX's App Builder: the
 // home page (tiles, a searchable list of applications as a report or as
@@ -285,7 +285,11 @@ export async function homeRoutes(app: FastifyInstance) {
         ${card(`${BASE}/sql`, icon('database'), 'SQL Workshop', 'Run SQL, browse objects and load data.')}
         ${card(`${BASE}/dashboard`, icon('activity'), 'Dashboard', 'Usage and problems across the workspace.')}
         ${(await isAdmin(s.username)) ? card(`${BASE}/instance`, icon('settings'), 'Instance settings', 'Session length, sign-in throttling and the server\'s configuration (administrators).') : ''}
-        ${(await isAdmin(s.username)) ? card(`${BASE}/workspaces`, icon('layers'), 'Workspaces', 'Groups of applications and their developers (administrators).') : ''}
+        ${(await isAdmin(s.username))
+          ? card(`${BASE}/workspaces`, icon('layers'), 'Workspaces', 'Groups of applications and their developers (administrators).')
+          : s.workspace && (await workspaceAdmin(s.username, s.workspace.id))
+            ? card(`${BASE}/workspaces/${s.workspace.id}`, icon('layers'), `Workspace ${s.workspace.name}`, 'Its name and developers (workspace administrators).')
+            : ''}
         ${(await isAdmin(s.username)) ? card(`${BASE}/ai`, icon('bolt'), 'AI services', 'Claude and OpenAI for the applications: models, keys, limits and usage (administrators).') : ''}
         ${(await isAdmin(s.username)) ? card(`${BASE}/mail`, icon('send'), 'Mail services', 'SMTP, Microsoft 365, Amazon SES, Resend, Postmark, SendGrid or Mailgun for the applications\' e-mail (administrators).') : ''}
         ${(await isAdmin(s.username)) ? card(`${BASE}/installation`, icon('history'), 'Installation', 'Version, install and upgrade runs, applied migrations (administrators).') : ''}

package/src/builder/newapp.ts

@@ -64,9 +64,27 @@ export async function createApp(c: Client, a: CheckedApp): Promise<{ id: number;
   const S = pg.escapeIdentifier(a.schema);
   const R = pg.escapeIdentifier(a.role);
   // The parsing schema: a role that can only use this schema.
-  await c.query(`create schema if not exists ${S}`);
-  if (!(await c.query('select 1 from pg_roles where rolname = $1', [a.role])).rowCount) await c.query(`create role ${R} nologin`);
-  await c.query(`grant ${R} to pgkiln_runtime`);
+  // (090) an isolated workspace's application gets a new role, and a schema that is new (owned by that
+  // role) or one of the workspace's own: never another workspace's
+  const isolated = (await c.query('select 1 from meta.workspace where id = $1 and isolated', [a.workspaceId])).rowCount;
+  const roleExists = (await c.query('select 1 from pg_roles where rolname = $1', [a.role])).rowCount;
+  if (isolated) {
+    // (a taken alias fails below, with its own message)
+    const aliasTaken = (await c.query('select 1 from meta.app where alias = $1', [a.alias])).rowCount;
+    if (roleExists && !aliasTaken) throw new Error(`The database role ${a.role} exists already: choose another alias.`);
+    const foreign = await c.query(
+      `select 1 from pg_namespace n where n.nspname = $1
+          and n.nspowner::regrole::text not in (select role_name from meta.workspace_role where workspace_id = $2)`,
+      [a.schema, a.workspaceId],
+    );
+    if (foreign.rowCount) throw new Error(`The schema ${a.schema} exists already and doesn't belong to this workspace: choose another schema.`);
+  }
+  if (!roleExists) await c.query(`create role ${R} nologin`);
+  await c.query(`create schema if not exists ${S}${isolated ? ` authorization ${R}` : ''}`);
+  if (isolated) {
+    // a name the workspace lists already (an application deleted, its role dropped) is its own; another workspace's is refused
+    await c.query('insert into meta.workspace_role (workspace_id, role_name) values ($1, $2) on conflict (workspace_id, role_name) do nothing', [a.workspaceId, a.role]);
+  } else await c.query(`grant ${R} to pgkiln_runtime`);
   await c.query(`grant usage on schema ${S} to ${R}`);
   await c.query(`grant select, insert, update, delete on all tables in schema ${S} to ${R}`);
   await c.query(`grant usage, select on all sequences in schema ${S} to ${R}`);

package/src/builder/quicksql.ts

@@ -6,6 +6,7 @@ import { quickSql } from '../quicksql.ts';
 import { clientIp, type Session } from '../session.ts';
 import { runAndRecord, runOptions, SCRIPT_MAX_MB } from './scripts.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Req } from './ui.ts';
+import { currentWorkspace } from './workspaces.ts';
 
 // SQL Workshop → Quick SQL: shorthand → DDL preview, then save it as a SQL
 // script or run it (as a script, so the results per statement are kept).
@@ -85,8 +86,8 @@ export async function quickSqlRoutes(app: FastifyInstance) {
       return back(reply, s, `${BASE}/sql/scripts/runs/${id}`);
     }
     let unique = name;
-    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1', [unique]); n++) unique = `${name} (${n})`;
-    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by) values ($1, $2, $3, $3) returning id`, [unique, content, s.username]);
+    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1 and workspace_id = $2', [unique, currentWorkspace(s)]); n++) unique = `${name} (${n})`;
+    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by, workspace_id) values ($1, $2, $3, $3, $4) returning id`, [unique, content, s.username, currentWorkspace(s)]);
     flash(s, `Saved as script “${unique}”.`);
     return back(reply, s, `${BASE}/sql/scripts/${r!.id}`);
   });

package/src/builder/report-settings.ts

@@ -3,6 +3,7 @@ import { designSql } from './websources.ts';
 import pg from 'pg';
 import { applyBinds } from '../binds.ts';
 import { owner } from '../db.ts';
+import { devDbForApp } from '../workspace-db.ts';
 import { html, raw } from '../html.ts';
 import { formatMaskError } from '../runtime/format.ts';
 import { heading } from '../runtime/items.ts';
@@ -19,12 +20,13 @@ const PAGE_SIZES = ['5', '10', '15', '25', '50', '100'];
 /** The column names of a report's query: run with limit 0, as the app's role, then rolled back. */
 export async function reportColumns(appId: number, source: string | null): Promise<{ columns: string[] } | { error: string }> {
   if (!source?.trim()) return { error: 'The region has no source query yet.' };
-  const c = await owner.pool.connect();
+  // the role from pgkiln's tables (the owner); the query on the developer's connection (090)
+  const role = (await owner.one<{ db_role: string | null }>('select db_role from meta.app where id = $1', [appId]))?.db_role;
+  const c = await (await devDbForApp(appId)).pool.connect();
   try {
     await c.query('begin');
     await c.query(`set local statement_timeout = '5s'`);
     await c.query(`select set_config('pgkiln.app_id', $1, true)`, [String(appId)]);
-    const role = (await c.query('select db_role from meta.app where id = $1', [appId])).rows[0]?.db_role;
     if (role) await c.query(`set local role ${pg.escapeIdentifier(role)}`);
     const sql = applyBinds(source.trim().replace(/;+\s*$/, ''), {});
     const res = await c.query(`select * from (\n${sql}\n) "__q" limit 0`);

package/src/builder/routes.ts

@@ -17,7 +17,7 @@ import { APP_COLORS, appHeader, back, BASE, builderHead, csrf, developer, flash,
 import { appOr404 } from './forms.ts';
 import { docToFiles, filesToZip } from '../appfiles.ts';
 import { homeRoutes, rememberApp } from './home.ts';
-import { appAllowed, currentWorkspace, placeApp, workspaceRoutes } from './workspaces.ts';
+import { appAllowed, currentWorkspace, placeApp, workshopDb, workspaceRoutes } from './workspaces.ts';
 import { instanceRoutes } from './instance.ts';
 import { saveTimeZoneSettings, timeZoneSettings } from './globalization.ts';
 import { WIZARD_KINDS, wizardRoutes, wizardTables } from './wizards.ts';
@@ -170,7 +170,7 @@ export async function builderRoutes(app: FastifyInstance) {
         await placeApp(c, made.id, ws);
         // (sprint 51) the Advisor on the imported application, before the commit: errors refuse it
         if (req.body?.check === 'true') {
-          const errors = (await advise(made.id, c)).findings.filter((f) => f.severity === 'error');
+          const errors = (await advise(made.id, c, { db: await workshopDb(s) })).findings.filter((f) => f.severity === 'error');
           if (errors.length)
             throw new Error(`the check found ${errors.length} error(s), nothing was imported: ${errors.slice(0, 5).map((f) =>
               `${f.entry ? `${f.entry.pageNo !== null ? `page ${f.entry.pageNo}, ` : ''}${f.entry.label}` : 'database'} (${f.field}): ${f.message}`).join('; ')}${errors.length > 5 ? '; …' : ''}. Fix them, or import without the check.`);

package/src/builder/sampledata.ts

@@ -31,6 +31,7 @@ import {
 } from '../sampledata.ts';
 import { clientIp, logActivity, type Session } from '../session.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { currentWorkspace, workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Sample Data (APEX 26.1: Data Generator): generate realistic
 // rows for one or more tables of a schema (src/sampledata.ts). Step 1 picks a
@@ -58,9 +59,9 @@ interface Saved {
   tables: TableSpec[];
 }
 
-async function saved(id: unknown) {
+async function saved(s: Session, id: unknown) {
   if (!/^\d{1,9}$/.test(String(id ?? ''))) return undefined;
-  return owner.one<Saved>('select * from meta.data_generator where id = $1', [id]);
+  return owner.one<Saved>('select * from meta.data_generator where id = $1 and workspace_id = $2', [id, currentWorkspace(s)]);
 }
 
 /** The definition posted by the generator form (never trusted: plan() checks it against the catalog). */
@@ -108,12 +109,13 @@ export async function sampleDataRoutes(app: FastifyInstance) {
 
   const intro = html`<p class="muted">Generate realistic rows for the tables of a schema: names, e-mail addresses, dates and numbers in a range, values from a list,
     foreign keys that pick existing parent rows. Preview them, insert them in one transaction (parents first) or download them as SQL or CSV.
-    Runs as the builder's owner connection, like <a href="${BASE}/sql">SQL Commands</a>.</p>`;
+    Runs as the builder's owner connection (an isolated workspace's developer login for its developers), like <a href="${BASE}/sql">SQL Commands</a>.</p>`;
 
   // ------------------------------------------------------------ step 1 and 2: schema and tables
   const start = async (s: Session, reply: FastifyReply, schema: string | undefined) => {
-    const all = await schemas(owner.pool);
-    const gens = (await owner.query<Saved & { updated_at: string; updated_by: string }>('select id, name, description, schema_name, tables, updated_at, updated_by from meta.data_generator order by lower(name)')).rows;
+    const db = await workshopDb(s);
+    const all = (await schemas(db.pool)).filter((x) => db === owner || x.usable);
+    const gens = (await owner.query<Saved & { updated_at: string; updated_by: string }>('select id, name, description, schema_name, tables, updated_at, updated_by from meta.data_generator where workspace_id = $1 order by lower(name)', [currentWorkspace(s)])).rows;
     const savedList = gens.length
       ? html`<ul class="sd-saved">${gens.map(
           (g) => html`<li><a href="${sdUrl}/${g.id}">${g.name}</a> <span class="muted small">${g.schema_name}: ${g.tables.map((t) => `${t.table} (${t.rows})`).join(', ')}</span>
@@ -129,7 +131,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
         <button class="btn">Choose</button></form>`;
     let tablesForm: Raw | '' = '';
     if (chosen) {
-      const tables = await schemaTables(owner.pool, chosen);
+      const tables = await schemaTables(db.pool, chosen);
       tablesForm = html`<form method="get" action="${sdUrl}" class="u-mt1"><input type="hidden" name="schema" value="${chosen}">
         <fieldset class="prop-group"><legend>Tables of ${chosen}</legend><div class="qb-pick">${tables.map(
           (t) => html`<label class="check"><input type="checkbox" name="t" value="${t.name}"> ${t.name} <span class="muted small">${t.estimate >= 0 ? `~${t.estimate.toLocaleString('en')} rows` : ''}</span></label>`,
@@ -155,23 +157,24 @@ export async function sampleDataRoutes(app: FastifyInstance) {
   }
 
   /** The tables of a definition with their catalog info; specs proposed for columns the definition doesn't mention. */
-  const describeAll = async (def: GeneratorDef) => {
+  const describeAll = async (s: Session, def: GeneratorDef) => {
+    const db = (await workshopDb(s)).pool;
     const out: { info: TableInfo; spec: TableSpec }[] = [];
     const missing: string[] = [];
     for (const t of def.tables) {
-      const info = await describe(owner.pool, def.schema, t.table);
+      const info = await describe(db, def.schema, t.table);
       if (!info) {
         missing.push(t.table);
         continue;
       }
-      const spec = tableSpec(info, DEFAULT_ROWS, t, undefined, await nextValues(owner.pool, info));
+      const spec = tableSpec(info, DEFAULT_ROWS, t, undefined, await nextValues(db, info));
       out.push({ info, spec: { ...spec, rows: Number.isInteger(t.rows) ? t.rows : DEFAULT_ROWS } });
     }
     return { tables: out, missing };
   };
 
   const editor = async (s: Session, reply: FastifyReply, st: FormState, code = 200) => {
-    const { tables, missing } = await describeAll(st.def);
+    const { tables, missing } = await describeAll(s, st.def);
     const title = st.id ? (st.name ?? 'Generator') : 'New generator';
     const columnRow = (i: number, j: number, c: ColumnInfo, spec: TableSpec) => {
       const cs = spec.columns.find((x) => x.column === c.name)!;
@@ -246,7 +249,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
   app.get(`${sdUrl}/:id`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const g = await saved(req.params.id);
+    const g = await saved(s, req.params.id);
     if (!g) return reply.code(404).send('Not found');
     return editor(s, reply, { id: g.id, name: g.name, description: g.description ?? '', def: cleanDef({ schema: g.schema_name, seed: g.seed, tables: g.tables }) });
   });
@@ -256,7 +259,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
     if (!s) return;
     const b = req.body ?? {};
     const def = defFromBody(b);
-    const g = b.id ? await saved(b.id) : undefined;
+    const g = b.id ? await saved(s, b.id) : undefined;
     if (b.id && !g) return reply.code(404).send('Not found');
     const st: FormState = { def, id: g?.id, name: (b.name ?? '').trim(), description: (b.description ?? '').trim() };
     const refuse = (error: string) => editor(s, reply, { ...st, error }, 422);
@@ -266,13 +269,13 @@ export async function sampleDataRoutes(app: FastifyInstance) {
       if (!st.name) return refuse('Give the generator a name to save it.');
       if (st.name.length > 100 || (st.description ?? '').length > 1000) return refuse('The name is at most 100 characters, the description 1000.');
       if (!allowedSchema(def.schema)) return refuse('Choose a schema of your own: not meta, information_schema or pg_*.');
-      const { tables } = await describeAll(def);
+      const { tables } = await describeAll(s, def);
       if (!tables.length) return refuse('Choose at least one table.');
       const json = JSON.stringify(tables.map(({ spec }) => spec));
       try {
         const id = g
           ? (await owner.one('update meta.data_generator set name = $2, description = $3, schema_name = $4, seed = $5, tables = $6, updated_by = $7, updated_at = now() where id = $1 returning id', [g.id, st.name, st.description || null, def.schema, def.seed, json, s.username])).id
-          : (await owner.one('insert into meta.data_generator (name, description, schema_name, seed, tables, created_by, updated_by) values ($1, $2, $3, $4, $5, $6, $6) returning id', [st.name, st.description || null, def.schema, def.seed, json, s.username])).id;
+          : (await owner.one('insert into meta.data_generator (name, description, schema_name, seed, tables, created_by, updated_by, workspace_id) values ($1, $2, $3, $4, $5, $6, $6, $7) returning id', [st.name, st.description || null, def.schema, def.seed, json, s.username, currentWorkspace(s)])).id;
         flash(s, `Generator ${st.name} saved.`);
         return back(reply, s, `${sdUrl}/${id}`);
       } catch (e) {
@@ -282,7 +285,8 @@ export async function sampleDataRoutes(app: FastifyInstance) {
     }
     if (!['preview', 'insert', 'sql', 'csv'].includes(action)) return refuse('Unknown action.');
 
-    const p = await plan(owner.pool, def);
+    const db = await workshopDb(s);
+    const p = await plan(db.pool, def);
     if (p.problems.length) return refuse(p.problems.join(' '));
     const seed = def.seed ?? randomSeed();
     st.def = { ...def, seed };
@@ -290,7 +294,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
     if (action === 'sql' || action === 'csv') {
       let generated;
       try {
-        generated = await generateAll(owner.pool, p.tables, seed);
+        generated = await generateAll(db.pool, p.tables, seed);
       } catch (e) {
         if (e instanceof SampleDataError) return refuse(e.message);
         throw e;
@@ -309,7 +313,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
 
     // preview and insert: the same run, rolled back or committed
     const started = performance.now();
-    const c = await owner.pool.connect();
+    const c = await db.pool.connect();
     let result: RunResult;
     try {
       await c.query('begin');
@@ -340,7 +344,7 @@ export async function sampleDataRoutes(app: FastifyInstance) {
   app.post(`${sdUrl}/:id/delete`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const g = await saved(req.params.id);
+    const g = await saved(s, req.params.id);
     if (!g) return reply.code(404).send('Not found');
     await owner.query('delete from meta.data_generator where id = $1', [g.id]);
     flash(s, `Generator ${g.name} deleted.`);

package/src/builder/scripts.ts

@@ -7,12 +7,14 @@ import { clientIp, logActivity, type Session } from '../session.ts';
 import { runScript, splitScript, type ScriptRun, type StatementResult } from '../sqlscript.ts';
 import { clearCompletions } from './code-editor.ts';
 import { back, BASE, csrf, developer, flash, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { currentWorkspace, workshopDb } from './workspaces.ts';
 
 // SQL Workshop → SQL Scripts: saved scripts (create, edit, upload, download,
 // delete), run with a result per statement (stop at the first error or go on,
 // optionally in one transaction), and the run history. Scripts run on the
 // owner connection, like SQL Commands, on a connection of their own that is
-// closed afterwards (a script may SET ROLE or change settings).
+// closed afterwards (a script may SET ROLE or change settings). Scripts and runs belong
+// to the current workspace; an isolated workspace's run on its developer login (090).
 
 /** Largest script (upload or editor), in MB. */
 export const SCRIPT_MAX_MB = 5;
@@ -30,7 +32,7 @@ export interface RunRequest {
 /** Run a script, record the run (history + activity log) and return the run's id. */
 export async function runAndRecord(s: Session, ip: string, r: RunRequest): Promise<{ id: string; run: ScriptRun }> {
   const statements = splitScript(r.content);
-  const c = await owner.pool.connect();
+  const c = await (await workshopDb(s)).pool.connect();
   let run: ScriptRun;
   try {
     run = await runScript(c, statements, { stopOnError: r.stopOnError, transaction: r.transaction });
@@ -40,12 +42,17 @@ export async function runAndRecord(s: Session, ip: string, r: RunRequest): Promi
   }
   clearCompletions(); // the script may have changed tables or grants
   const saved = await owner.one<{ id: string }>(
-    `insert into meta.sql_script_run (script_id, script_name, run_by, elapsed_ms, stop_on_error, transactional, statements, succeeded, failed, rolled_back, results)
-     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11) returning id`,
+    `insert into meta.sql_script_run (script_id, script_name, run_by, elapsed_ms, stop_on_error, transactional, statements, succeeded, failed, rolled_back, results, workspace_id)
+     values ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12) returning id`,
     [r.scriptId, r.name, s.username, run.ms, r.stopOnError, r.transaction, run.statements, run.succeeded, run.failed, run.rolledBack,
-      JSON.stringify(run.commitError ? [...run.results, { n: 0, line: 0, sql: 'COMMIT', status: 'error', error: run.commitError, ms: 0 }] : run.results)],
+      JSON.stringify(run.commitError ? [...run.results, { n: 0, line: 0, sql: 'COMMIT', status: 'error', error: run.commitError, ms: 0 }] : run.results),
+      currentWorkspace(s)],
+  );
+  await owner.query(
+    `delete from meta.sql_script_run where workspace_id = $2
+        and id <= (select id from meta.sql_script_run where workspace_id = $2 order by id desc offset $1 limit 1)`,
+    [KEEP_RUNS, currentWorkspace(s)],
   );
-  await owner.query(`delete from meta.sql_script_run where id <= (select id from meta.sql_script_run order by id desc offset $1 limit 1)`, [KEEP_RUNS]);
   await logActivity({
     username: s.username,
     event: 'sql_script',
@@ -121,10 +128,12 @@ export async function scriptRoutes(app: FastifyInstance) {
                 r.started_at as last_run, r.failed as last_failed
            from meta.sql_script s
            left join lateral (select started_at, failed from meta.sql_script_run x where x.script_id = s.id order by x.id desc limit 1) r on true
+          where s.workspace_id = $1
           order by lower(s.name)`,
+        [currentWorkspace(s)],
       )
     ).rows;
-    const runs = (await owner.query('select * from meta.sql_script_run order by id desc limit 20')).rows;
+    const runs = (await owner.query('select * from meta.sql_script_run where workspace_id = $1 order by id desc limit 20', [currentWorkspace(s)])).rows;
     const list = scripts.length
       ? html`<div class="table-wrap"><table class="report"><thead><tr><th>Script</th><th>Updated</th><th class="num">Size</th><th>Last run</th><th>File</th></tr></thead><tbody>
           ${scripts.map((x) => html`<tr><td><a href="${BASE}/sql/scripts/${x.id}">${x.name}</a>${x.description ? html`<br><span class="muted small">${x.description}</span>` : ''}</td>
@@ -193,7 +202,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/:id`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const row = /^\d+$/.test(req.params.id) ? await owner.one('select * from meta.sql_script where id = $1', [req.params.id]) : undefined;
+    const row = /^\d+$/.test(req.params.id) ? await owner.one('select * from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]) : undefined;
     if (!row) return reply.code(404).send('Not found');
     return editor(req, reply, s, row);
   });
@@ -220,15 +229,15 @@ export async function scriptRoutes(app: FastifyInstance) {
     try {
       if (id) {
         const r = await owner.one(
-          'update meta.sql_script set name = $2, description = nullif($3, \'\'), content = $4, updated_by = $5, updated_at = now() where id = $1 returning id',
-          [id, name, b.description ?? '', content, s.username],
+          'update meta.sql_script set name = $2, description = nullif($3, \'\'), content = $4, updated_by = $5, updated_at = now() where id = $1 and workspace_id = $6 returning id',
+          [id, name, b.description ?? '', content, s.username, currentWorkspace(s)],
         );
         if (!r) return reply.code(404).send('Not found');
         scriptId = r.id;
       } else {
         const r = await owner.one(
-          `insert into meta.sql_script (name, description, content, created_by, updated_by) values ($1, nullif($2, ''), $3, $4, $4) returning id`,
-          [name, b.description ?? '', content, s.username],
+          `insert into meta.sql_script (name, description, content, created_by, updated_by, workspace_id) values ($1, nullif($2, ''), $3, $4, $4, $5) returning id`,
+          [name, b.description ?? '', content, s.username, currentWorkspace(s)],
         );
         scriptId = r!.id;
       }
@@ -260,6 +269,8 @@ export async function scriptRoutes(app: FastifyInstance) {
     if (!s) return;
     if (!/^\d+$/.test(req.params.id)) return reply.code(404).send('Not found');
     const r = await owner.tx(async (c) => {
+      const own = (await c.query('select 1 from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)])).rowCount;
+      if (!own) return undefined;
       await c.query('delete from meta.sql_script_run where script_id = $1', [req.params.id]);
       return (await c.query('delete from meta.sql_script where id = $1 returning name', [req.params.id])).rows[0];
     });
@@ -270,7 +281,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/:id/download`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const row = /^\d+$/.test(req.params.id) ? await owner.one('select name, content from meta.sql_script where id = $1', [req.params.id]) : undefined;
+    const row = /^\d+$/.test(req.params.id) ? await owner.one('select name, content from meta.sql_script where id = $1 and workspace_id = $2', [req.params.id, currentWorkspace(s)]) : undefined;
     if (!row) return reply.code(404).send('Not found');
     return reply
       .header('content-type', 'application/sql; charset=utf-8')
@@ -302,8 +313,8 @@ export async function scriptRoutes(app: FastifyInstance) {
     if (content.includes('\0')) return fail('The file is not a text file.');
     const base = file.filename.replace(/^.*[\\/]/, '').replace(/\.sql$/i, '').slice(0, 180) || 'script';
     let name = base;
-    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1', [name]); n++) name = `${base} (${n})`;
-    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by) values ($1, $2, $3, $3) returning id`, [name, content, s.username]);
+    for (let n = 2; await owner.one('select 1 from meta.sql_script where name = $1 and workspace_id = $2', [name, currentWorkspace(s)]); n++) name = `${base} (${n})`;
+    const r = await owner.one(`insert into meta.sql_script (name, content, created_by, updated_by, workspace_id) values ($1, $2, $3, $3, $4) returning id`, [name, content, s.username, currentWorkspace(s)]);
     flash(s, `Script “${name}” uploaded.`);
     return back(reply, s, `${BASE}/sql/scripts/${r!.id}`);
   });
@@ -312,7 +323,7 @@ export async function scriptRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/scripts/runs/:run`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
-    const run = /^\d+$/.test(req.params.run) ? await owner.one('select * from meta.sql_script_run where id = $1', [req.params.run]) : undefined;
+    const run = /^\d+$/.test(req.params.run) ? await owner.one('select * from meta.sql_script_run where id = $1 and workspace_id = $2', [req.params.run, currentWorkspace(s)]) : undefined;
     if (!run) return reply.code(404).send('Not found');
     const exists = run.script_id ? await owner.one('select id from meta.sql_script where id = $1', [run.script_id]) : undefined;
     const options = `${run.stop_on_error ? 'stop on error' : 'continue on error'}${run.transactional ? ', one transaction' : ''}`;

package/src/builder/sql.ts

@@ -1,6 +1,5 @@
 import type { FastifyInstance, FastifyReply } from 'fastify';
 import pg from 'pg';
-import { owner } from '../db.ts';
 import { html, raw, type Raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { BASE, csrf, developer, region, send, shell, workshopTabs, type Req } from './ui.ts';
@@ -11,8 +10,10 @@ import { quickSqlRoutes } from './quicksql.ts';
 import { queryBuilderRoutes } from './querybuilder.ts';
 import { unloadRoutes } from './unload.ts';
 import { ddlToolRoutes } from './ddl-tools.ts';
+import { workshopDb, workshopRunsAs } from './workspaces.ts';
 
-// SQL Workshop: SQL commands and the object browser (owner connection).
+// SQL Workshop: SQL commands and the object browser (owner connection; an isolated
+// workspace's developer login for its developers, see workshopDb).
 
 export async function sqlRoutes(app: FastifyInstance) {
   // SQL Scripts, Quick SQL and the query builder (sprint 31)
@@ -35,12 +36,13 @@ export async function sqlRoutes(app: FastifyInstance) {
     if (!s) return;
     const sql = req.body?.sql ?? '';
     let result: Raw | '' = '';
+    const db = await workshopDb(s);
     if (req.method === 'POST' && sql.trim()) {
       const started = performance.now();
       try {
         // a connection of its own, closed afterwards: the SQL may SET ROLE or change settings,
         // which must not leak into the builder's pooled owner connections
-        const c = await owner.pool.connect();
+        const c = await db.pool.connect();
         let out;
         try {
           out = await c.query({ text: sql, rowMode: 'array' });
@@ -59,7 +61,7 @@ export async function sqlRoutes(app: FastifyInstance) {
       await logActivity({ username: s.username, event: 'sql_command', ip: clientIp(req), elapsedMs: Math.round(performance.now() - started), detail: sql.length > 2000 ? `${sql.slice(0, 2000)}…` : sql });
     }
     const main = html`<h1 class="u-mb1">SQL Workshop</h1>${workshopTabs('sql')}
-      <p class="muted">Runs as the builder's owner connection (not as an application role). Multiple statements are allowed; results of the last one are shown.</p>
+      <p class="muted">Runs as ${workshopRunsAs(db)} (not as an application role). Multiple statements are allowed; results of the last one are shown.</p>
       <form method="post">${csrf(s)}
         <textarea name="sql" class="code sql-editor" rows="12" spellcheck="false" aria-label="SQL" data-code="plpgsql">${sql || 'select current_user, version();'}</textarea>
         <div class="buttons"><button class="btn btn-hot">${icon('play')} Run (Ctrl+Enter)</button></div>
@@ -73,17 +75,20 @@ export async function sqlRoutes(app: FastifyInstance) {
   app.get(`${BASE}/sql/objects`, async (req: Req, reply) => {
     const s = await developer(req, reply);
     if (!s) return;
+    const db = await workshopDb(s);
     const objects = (
-      await owner.query(
+      await db.query(
         `select n.nspname as schema, c.relname as name, c.oid::regclass::text as qname,
                 case c.relkind when 'r' then 'table' when 'p' then 'table' when 'v' then 'view' when 'm' then 'view' end as kind,
                 c.relrowsecurity as rls
            from pg_class c join pg_namespace n on n.oid = c.relnamespace
           where c.relkind in ('r', 'p', 'v', 'm') and n.nspname !~ '^pg_' and n.nspname not in ('information_schema')
+            and has_schema_privilege(n.oid, 'USAGE')
          union all
          select n.nspname, p.proname || '(' || pg_get_function_identity_arguments(p.oid) || ')', p.oid::regprocedure::text, 'function', false
            from pg_proc p join pg_namespace n on n.oid = p.pronamespace
           where n.nspname !~ '^pg_' and n.nspname not in ('information_schema') and p.prokind in ('f', 'p')
+            and has_schema_privilege(n.oid, 'USAGE')
           order by 1, 4 desc, 2`,
       )
     ).rows;
@@ -92,24 +97,24 @@ export async function sqlRoutes(app: FastifyInstance) {
     let detail: Raw = html`<p class="muted">Select a table, view or function.</p>`;
     if (selected) {
       if (selected.kind === 'function') {
-        const src = await owner.one('select pg_get_functiondef($1::regprocedure) as def', [selected.qname]);
+        const src = await db.one('select pg_get_functiondef($1::regprocedure) as def', [selected.qname]);
         detail = region(selected.qname, html`<pre class="source">${src.def}</pre>`);
       } else {
         const [cols, policies, grants, data] = await Promise.all([
-          owner.query(
+          db.query(
             `select a.attname as column, format_type(a.atttypid, a.atttypmod) as type, not a.attnotnull as nullable,
                     pg_get_expr(d.adbin, d.adrelid) as "default"
                from pg_attribute a left join pg_attrdef d on d.adrelid = a.attrelid and d.adnum = a.attnum
               where a.attrelid = $1::regclass and a.attnum > 0 and not a.attisdropped order by a.attnum`,
             [selected.qname],
           ),
-          owner.query('select policyname as policy, cmd, roles::text, qual as using, with_check from pg_policies where schemaname = $1 and tablename = $2', [selected.schema, selected.name]),
-          owner.query(
+          db.query('select policyname as policy, cmd, roles::text, qual as using, with_check from pg_policies where schemaname = $1 and tablename = $2', [selected.schema, selected.name]),
+          db.query(
             `select grantee, string_agg(privilege_type, ', ' order by privilege_type) as privileges
                from information_schema.role_table_grants where table_schema = $1 and table_name = $2 group by grantee order by grantee`,
             [selected.schema, selected.name],
           ),
-          owner.pool.query({ text: `select * from ${selected.qname} limit 25`, rowMode: 'array' }).catch((e) => e as Error),
+          db.pool.query({ text: `select * from ${selected.qname} limit 25`, rowMode: 'array' }).catch((e) => e as Error),
         ]);
         const asArray = (r: pg.QueryResult) => ({ ...r, rows: r.rows.map((x) => Object.values(x)) }) as unknown as pg.QueryResult<any[]>;
         detail = html`${region(`${selected.kind === 'view' ? 'View' : 'Table'} ${selected.qname}`, resultTable(asArray(cols)),

package/src/builder/unload.ts

@@ -21,6 +21,7 @@ import {
   type UnloadOptions,
 } from '../unload.ts';
 import { BASE, csrf, developer, region, send, shell, workshopTabs, type Body, type Req } from './ui.ts';
+import { workshopDb } from './workspaces.ts';
 
 // SQL Workshop → Unload Data (APEX: Data Workshop → Unload Data): a table or
 // view (chosen columns, an optional WHERE and ORDER BY) or a query, to CSV,
@@ -125,7 +126,7 @@ export async function unloadRoutes(app: FastifyInstance) {
       <a class="ide-tab" href="${BASE}/sql/unload?source=query"${active === 'query' ? raw(' aria-current="page"') : ''}>${icon('code')}<span>Query</span></a></nav>`;
 
   const intro = html`<p class="muted">Download the rows of a table, a view or a query as CSV, JSON, Excel or XML (up to ${DOWNLOAD_MAX_ROWS.toLocaleString('en')} rows).
-    Runs as the builder's owner connection in a read-only transaction. To load a file into a table, use <a href="${BASE}/sql/load">Load Data</a>.</p>`;
+    Runs as the builder's owner connection (an isolated workspace's developer login for its developers) in a read-only transaction. To load a file into a table, use <a href="${BASE}/sql/load">Load Data</a>.</p>`;
 
   const form = async (s: Session, b: Body, error?: string) => {
     const alert = error ? html`<div class="alert alert-error" role="alert">${error}</div>` : '';
@@ -212,7 +213,7 @@ export async function unloadRoutes(app: FastifyInstance) {
     if (typeof opts === 'string') return refuse(opts);
 
     const started = performance.now();
-    const c = await owner.pool.connect();
+    const c = await (await workshopDb(s)).pool.connect();
     let opened;
     try {
       await c.query('begin transaction read only');