pgkiln 0.36.0 → 0.37.0

package/src/builder/workspaces.ts

@@ -1,5 +1,8 @@
 import type { FastifyInstance, FastifyReply } from 'fastify';
-import { owner } from '../db.ts';
+import { owner, type Db } from '../db.ts';
+import { devDbForWorkspace, workspacesChanged } from '../workspace-db.ts';
+import { ownerUrl, runtimeUrl } from '../db.ts';
+import { secretKeyConfigured } from '../secrets.ts';
 import { html, raw } from '../html.ts';
 import { icon } from '../icons.ts';
 import { clientIp, logActivity, type Session } from '../session.ts';
@@ -68,6 +71,19 @@ export async function appAllowed(s: Session, appId: number | string) {
   return true;
 }
 
+/**
+ * The connection for a developer's own SQL (the SQL Workshop's tools): the owner, or in an
+ * isolated workspace (090) its developer login, which reaches the workspace's application
+ * roles only. Administrators keep the owner.
+ */
+export async function workshopDb(s: Session): Promise<Db> {
+  if (!s.workspace || (await isAdmin(s.username))) return owner;
+  return (await devDbForWorkspace(s.workspace.id)) ?? owner;
+}
+
+/** Who the SQL Workshop runs as, for its notes. */
+export const workshopRunsAs = (db: Db) => (db === owner ? 'the builder\'s owner connection' : 'this isolated workspace\'s developer login (its applications\' roles, nothing else)');
+
 /** Put an application in a workspace (inside the caller's transaction, or on the owner pool). */
 export async function placeApp(db: { query: (sql: string, params?: unknown[]) => Promise<unknown> }, appId: number, workspaceId: number) {
   await db.query(
@@ -99,6 +115,18 @@ async function adminOnly(s: Session, reply: FastifyReply) {
   return false;
 }
 
+/** An administrator, or a workspace administrator of this workspace (090). */
+export async function workspaceAdmin(username: string | null, workspaceId: number | string) {
+  if (!username) return false;
+  if (await isAdmin(username)) return true;
+  return !!(await owner.one('select 1 as ok from meta.workspace_member where workspace_id = $1 and username = $2 and is_admin', [workspaceId, username]));
+}
+
+async function workspaceAdminOnly(s: Session, reply: FastifyReply, workspaceId: string) {
+  if (await workspaceAdmin(s.username, workspaceId)) return true;
+  return adminOnly(s, reply);
+}
+
 const crumbs = (extra: [string, string?][] = []): [string, string?][] => [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], ['Workspaces', `${BASE}/workspaces`], ...extra];
 
 const nameError = (e: unknown) => {
@@ -108,6 +136,49 @@ const nameError = (e: unknown) => {
   return m;
 };
 
+const ROLE = /^[A-Za-z_][A-Za-z0-9_$]{0,62}$/;
+
+/** Why this installation can't isolate a workspace (090), or null. */
+export function isolationProblem(): string | null {
+  if (!secretKeyConfigured()) return 'set PGKILN_SECRET_KEY (at least 32 characters) in the server\'s environment: the workspace\'s database logins get passwords derived from it.';
+  if (runtimeUrl === ownerUrl) return 'set RUNTIME_DATABASE_URL: applications run on the owner connection, so no workspace can be isolated.';
+  return null;
+}
+
+/** A role problem from meta.workspace_sync_roles (or a duplicate role) in words. */
+const roleError = (e: unknown) => {
+  const m = (e as Error).message;
+  if (m.includes('workspace_role_role_name_key')) return 'this role belongs to another workspace already.';
+  if (m.includes('workspace_role_pkey')) return 'the workspace has this role already.';
+  return m;
+};
+
+/** The Isolation region of a workspace's page. */
+function isolationRegion(s: Session, w: { id: number; name: string; isolated: boolean; run_role: string | null; dev_role: string | null },
+  roles: { role_name: string; exists: boolean; apps: string | null }[]) {
+  const problem = w.isolated ? null : isolationProblem();
+  const body = w.isolated
+    ? html`<p class="u-mt0"><span class="tag">${icon('lock')} isolated</span> Its applications run as <code>${w.run_role}</code> and its developers' SQL (SQL Workshop, code checks, the Advisor) as <code>${w.dev_role}</code>. Both reach only the roles below, and see only this workspace's applications, sessions and accounts in pgkiln's own tables. Developers who also belong to a shared workspace keep that workspace's rights there.</p>
+      <div class="table-wrap"><table class="report report-reflow"><thead><tr><th>Database role</th><th>Used by</th><th></th></tr></thead><tbody>
+        ${roles.length
+          ? roles.map((r) => html`<tr><td data-label="Database role"><code>${r.role_name}</code>${r.exists ? '' : html` <span class="tag tag-error">missing</span>`}</td>
+              <td data-label="Used by">${r.apps ?? html`<span class="muted">no application</span>`}</td>
+              <td><form method="post" action="${BASE}/workspaces/${w.id}/roles">${csrf(s)}<input type="hidden" name="role" value="${r.role_name}">
+                <button class="btn btn-sm" name="action" value="remove">Remove</button></form></td></tr>`)
+          : html`<tr><td colspan="3" class="empty">No database roles: applications here can't run as a role of their own.</td></tr>`}</tbody></table></div>
+      <form method="post" action="${BASE}/workspaces/${w.id}/roles" class="u-mt1">${csrf(s)}
+        ${input('role', 'Add a database role', '', { help: 'An existing role (not a superuser, not one that creates roles or bypasses row-level security). Its rights become this workspace\'s; it can\'t belong to another workspace.' })}
+        <div class="buttons"><button class="btn" name="action" value="add">${icon('plus')} Add role</button></div></form>
+      <form method="post" action="${BASE}/workspaces/${w.id}/isolation" class="danger-zone">${csrf(s)}<input type="hidden" name="isolated" value="false">
+        <button class="btn btn-danger" data-confirm="Make ${w.name} shared again? Its applications then run on the shared runtime connection, and its developers' SQL as the owner.">Make shared</button></form>`
+    : html`<p class="u-mt0">Shared: the applications run on the shared runtime connection and the developers' SQL as the owner, like every shared workspace's.</p>
+      <p class="muted small">Isolating gives the workspace two database logins of its own and the database roles its applications use now. Application code then reaches only those roles and this workspace's applications; its developers' SQL Workshop runs on the workspace's login instead of the owner. New applications get a new role and schema of their own.</p>
+      ${problem ? html`<div class="alert alert-error" role="alert">To isolate a workspace, ${problem}</div>` : ''}
+      <form method="post" action="${BASE}/workspaces/${w.id}/isolation">${csrf(s)}<input type="hidden" name="isolated" value="true">
+        <div class="buttons"><button class="btn btn-hot"${problem ? raw(' disabled') : ''} data-confirm="Isolate ${w.name}?">${icon('lock')} Isolate this workspace</button></div></form>`;
+  return region('Isolation', body);
+}
+
 export async function workspaceRoutes(app: FastifyInstance) {
   // switch the current workspace (any of the developer's own)
   app.post(`${BASE}/workspace`, async (req: Req, reply) => {
@@ -125,7 +196,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
     if (!s || !(await adminOnly(s, reply))) return;
     const rows = (
       await owner.query(
-        `select w.id, w.name, w.description,
+        `select w.id, w.name, w.description, w.isolated,
                 (select count(*) from meta.app a where meta.app_workspace(a.id) = w.id)::int as apps,
                 (select string_agg(m.username, ', ' order by m.username) from meta.workspace_member m where m.workspace_id = w.id) as members
            from meta.workspace w order by w.id = 1 desc, lower(w.name)`,
@@ -133,12 +204,12 @@ export async function workspaceRoutes(app: FastifyInstance) {
     ).rows;
     const main = html`
       <div class="title-row"><h1>Workspaces</h1></div>
-      <p class="muted u-mt0">A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. Workspaces are not a security boundary between developers who write SQL: the SQL Workshop and application code run with this installation's rights. Give tenants who must not see each other separate installations.</p>
+      <p class="muted u-mt0">A workspace groups applications and the developers who build them. Developers see and change the applications of their own workspaces; administrators see all of them. A shared workspace is not a security boundary between developers who write SQL: its SQL Workshop and application code run with this installation's rights. An <strong>isolated</strong> workspace is: its applications and SQL run on database logins of its own that reach only its database roles and its own applications.</p>
       <div class="columns wide-left">
         ${region('Workspaces', html`<div class="table-wrap"><table class="report report-reflow">
           <thead><tr><th>Workspace</th><th class="num">Applications</th><th>Developers</th></tr></thead>
           <tbody>${rows.map((w) => html`<tr>
-            <td data-label="Workspace"><a href="${BASE}/workspaces/${w.id}">${w.name}</a>${w.description ? html` <span class="muted">${w.description}</span>` : ''}</td>
+            <td data-label="Workspace"><a href="${BASE}/workspaces/${w.id}">${w.name}</a>${w.isolated ? html` <span class="tag">${icon('lock')} isolated</span>` : ''}${w.description ? html` <span class="muted">${w.description}</span>` : ''}</td>
             <td class="num" data-label="Applications">${w.apps}</td>
             <td data-label="Developers">${w.members ?? html`<span class="muted">administrators only</span>`}</td></tr>`)}</tbody></table></div>`)}
         ${region('Add workspace', html`<form method="post" action="${BASE}/workspaces">${csrf(s)}
@@ -175,18 +246,26 @@ export async function workspaceRoutes(app: FastifyInstance) {
 
   app.get(`${BASE}/workspaces/:id(^\\d{1,9}$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
+    const full = await isAdmin(s.username);
     const w = await owner.one('select * from meta.workspace where id = $1', [req.params.id]);
     if (!w) return reply.code(404).send('Not found');
-    const [devs, apps, others] = await Promise.all([
+    const [devs, apps, others, rolesQ] = await Promise.all([
       owner.query(
-        `select d.username, d.is_admin, m.username is not null as member
+        `select d.username, d.is_admin, m.username is not null as member, coalesce(m.is_admin, false) as ws_admin
            from meta.developer d left join meta.workspace_member m on m.username = d.username and m.workspace_id = $1 order by d.username`,
         [w.id],
       ),
       owner.query(`select a.id, a.name, a.alias from meta.app a where meta.app_workspace(a.id) = $1 order by lower(a.name), a.id`, [w.id]),
       owner.query('select id, name from meta.workspace where id <> $1 order by id = 1 desc, lower(name)', [w.id]),
+      owner.query(
+        `select x.role_name, exists (select 1 from pg_roles r where r.rolname = x.role_name) as exists,
+                (select string_agg(a.alias, ', ' order by a.alias) from meta.app a where a.db_role = x.role_name) as apps
+           from meta.workspace_role x where x.workspace_id = $1 order by 1`,
+        [w.id],
+      ),
     ]);
+    const roles = rolesQ;
     const main = html`
       <div class="title-row"><h1>${w.name}</h1></div>
       <div class="columns wide-left">
@@ -194,7 +273,7 @@ export async function workspaceRoutes(app: FastifyInstance) {
             ${input('name', 'Name', w.name, { required: true })}
             ${input('description', 'Description', w.description ?? '')}
             <div class="buttons"><button class="btn btn-hot">Save</button></div></form>
-          ${w.id === 1
+          ${!full ? '' : w.id === 1
             ? html`<p class="muted small">The Default workspace can't be deleted: imported applications and applications made with the command line start here.</p>`
             : html`<form method="post" action="${BASE}/workspaces/${w.id}/delete" class="danger-zone">${csrf(s)}
                 <button class="btn btn-danger" data-confirm="Delete workspace ${w.name}?"${apps.rows.length ? raw(' disabled') : ''}>Delete workspace</button>
@@ -204,9 +283,13 @@ export async function workspaceRoutes(app: FastifyInstance) {
             <fieldset class="field"><legend class="sr-only">Developers</legend><div class="radio-group">
             ${devs.rows.map((d) => html`<label class="check"><input type="checkbox" name="member" value="${d.username}"${d.member ? raw(' checked') : ''}> ${d.username}${d.is_admin ? html` <span class="muted">(administrator)</span>` : ''}</label>`)}
             </div></fieldset>
+            <fieldset class="field"><legend class="label">Workspace administrators</legend><div class="radio-group">
+            ${devs.rows.filter((d) => d.member && !d.is_admin).map((d) => html`<label class="check"><input type="checkbox" name="admin" value="${d.username}"${d.ws_admin ? raw(' checked') : ''}> ${d.username}</label>`)}
+            </div><small class="help">They manage this workspace's name and developers. Isolation, database roles, moving applications and deleting the workspace stay with administrators.</small></fieldset>
             <div class="buttons"><button class="btn">Save developers</button></div></form>`)}
       </div>
-      ${region('Applications', html`<div class="table-wrap"><table class="report report-reflow">
+      ${full ? isolationRegion(s, w, roles.rows) : region('Isolation', html`<p class="u-mt0">${w.isolated ? 'Isolated: its applications and SQL run on database logins of its own.' : 'Shared.'} Administrators change it.</p>`)}
+      ${!full ? '' : region('Applications', html`<div class="table-wrap"><table class="report report-reflow">
         <thead><tr><th>Application</th><th>Move to</th></tr></thead>
         <tbody>${apps.rows.length
           ? apps.rows.map((a) => html`<tr><td data-label="Application"><a href="${BASE}/apps/${a.id}">${a.name}</a> <span class="muted">${a.id} · /a/${a.alias}</span></td>
@@ -217,12 +300,12 @@ export async function workspaceRoutes(app: FastifyInstance) {
                     <button class="btn">Move</button></form>`
                 : html`<span class="muted">no other workspace</span>`}</td></tr>`)
           : html`<tr><td colspan="2" class="empty">No applications.</td></tr>`}</tbody></table></div>`)}`;
-    return send(reply, s, shell(s, w.name, crumbs([[w.name]]), main));
+    return send(reply, s, shell(s, w.name, full ? crumbs([[w.name]]) : [['App Builder', BASE], ['Workspace utilities', `${BASE}/utilities`], [w.name]], main));
   });
 
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
     const name = String(req.body?.name ?? '').trim();
     try {
       if (!NAME.test(name)) throw new Error('The name is 1 to 60 characters.');
@@ -236,16 +319,19 @@ export async function workspaceRoutes(app: FastifyInstance) {
 
   app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/members`, async (req: Req, reply) => {
     const s = await developer(req, reply);
-    if (!s || !(await adminOnly(s, reply))) return;
+    if (!s || !(await workspaceAdminOnly(s, reply, req.params.id))) return;
     if (!(await owner.one('select 1 as ok from meta.workspace where id = $1', [req.params.id]))) return reply.code(404).send('Not found');
     const posted = req.body?.member as unknown;
     const names = (Array.isArray(posted) ? posted : posted == null ? [] : [posted]).map(String).slice(0, 10000);
+    const postedAdmins = req.body?.admin as unknown;
+    const admins = (Array.isArray(postedAdmins) ? postedAdmins : postedAdmins == null ? [] : [postedAdmins]).map(String).slice(0, 10000);
     await owner.tx(async (c) => {
       await c.query('delete from meta.workspace_member where workspace_id = $1', [req.params.id]);
       // only existing developers (unknown names are ignored)
       await c.query(
-        `insert into meta.workspace_member (workspace_id, username) select $1, d.username from meta.developer d where d.username = any($2::text[])`,
-        [req.params.id, names],
+        `insert into meta.workspace_member (workspace_id, username, is_admin)
+         select $1, d.username, d.username = any($3::text[]) from meta.developer d where d.username = any($2::text[])`,
+        [req.params.id, names, admins],
       );
     });
     await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `developers of workspace ${req.params.id}: ${names.join(', ').slice(0, 1000)}` });
@@ -260,7 +346,28 @@ export async function workspaceRoutes(app: FastifyInstance) {
     const appId = /^\d{1,9}$/.test(req.body?.app ?? '') ? Number(req.body!.app) : null;
     const to = (await owner.one<{ id: number; name: string }>('select id, name from meta.workspace where id = $1', [/^\d{1,9}$/.test(req.body?.to ?? '') ? req.body!.to : null]));
     if (appId === null || !to || (await appWorkspace(appId)) !== from) return reply.code(404).send('Not found');
-    await placeApp(owner, appId, to.id);
+    try {
+      await owner.tx(async (c) => {
+        // (090) the application's database role goes along: out of the old workspace's roles (when no other
+        // application there uses it), into the new one's when that one is isolated
+        const role = (await c.query<{ db_role: string | null }>('select db_role from meta.app where id = $1', [appId])).rows[0]?.db_role;
+        if (role) {
+          await c.query(
+            `delete from meta.workspace_role x where x.workspace_id = $1 and x.role_name = $2
+                and not exists (select 1 from meta.app a where a.db_role = $2 and a.id <> $3 and meta.app_workspace(a.id) = $1)`,
+            [from, role, appId],
+          );
+          if ((await c.query('select 1 from meta.workspace where id = $1 and isolated', [to.id])).rowCount)
+            await c.query('insert into meta.workspace_role (workspace_id, role_name) values ($1, $2) on conflict do nothing', [to.id, role]);
+        }
+        await placeApp(c, appId, to.id);
+      });
+    } catch (e) {
+      flash(s, `Not moved: ${roleError(e)}`, 'error');
+      return back(reply, s, `${BASE}/workspaces/${from}`);
+    } finally {
+      await workspacesChanged();
+    }
     await logActivity({ appId, username: s.username, event: 'workspace', ip: clientIp(req), detail: `moved from workspace ${from} to ${to.id}` });
     flash(s, `Application moved to ${to.name}.`);
     return back(reply, s, `${BASE}/workspaces/${from}`);
@@ -274,6 +381,10 @@ export async function workspaceRoutes(app: FastifyInstance) {
       flash(s, 'The Default workspace cannot be deleted.', 'error');
       return back(reply, s, `${BASE}/workspaces/${id}`);
     }
+    if (await owner.one('select 1 as ok from meta.workspace where id = $1 and isolated', [id])) {
+      flash(s, 'Make the workspace shared (not isolated) before deleting it.', 'error');
+      return back(reply, s, `${BASE}/workspaces/${id}`);
+    }
     if (await owner.one('select 1 as ok from meta.workspace_app where workspace_id = $1 limit 1', [id])) {
       flash(s, 'Move the applications of this workspace to another workspace first.', 'error');
       return back(reply, s, `${BASE}/workspaces/${id}`);
@@ -283,4 +394,53 @@ export async function workspaceRoutes(app: FastifyInstance) {
     flash(s, r ? `Workspace ${r.name} deleted.` : 'Not found.', r ? 'ok' : 'error');
     return back(reply, s, `${BASE}/workspaces`);
   });
+
+  // (090) isolate a workspace, or make it shared again
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/isolation`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply))) return;
+    const id = Number(req.params.id);
+    const on = req.body?.isolated === 'true';
+    try {
+      const problem = on ? isolationProblem() : null;
+      if (problem) throw new Error(problem);
+      const r = await owner.query('update meta.workspace set isolated = $2 where id = $1', [id, on]);
+      if (!r.rowCount) return reply.code(404).send('Not found');
+      await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `workspace ${id} ${on ? 'isolated' : 'shared'}` });
+      flash(s, on ? 'The workspace is isolated: its applications and SQL now run on its own database logins.' : 'The workspace is shared again: its applications run on the shared runtime connection.');
+    } catch (e) {
+      flash(s, `${on ? 'Not isolated' : 'Not changed'}: ${roleError(e)}`, 'error');
+    } finally {
+      await workspacesChanged();
+    }
+    return back(reply, s, `${BASE}/workspaces/${id}`);
+  });
+
+  // (090) the database roles of an isolated workspace
+  app.post(`${BASE}/workspaces/:id(^\\d{1,9}$)/roles`, async (req: Req, reply) => {
+    const s = await developer(req, reply);
+    if (!s || !(await adminOnly(s, reply))) return;
+    const id = Number(req.params.id);
+    const role = String(req.body?.role ?? '').trim();
+    const remove = req.body?.action === 'remove';
+    try {
+      if (!ROLE.test(role)) throw new Error('A role name is a letter or _ followed by letters, digits, _ or $ (at most 63).');
+      if (!remove && !(await owner.one('select 1 as ok from pg_roles where rolname = $1', [role]))) throw new Error(`There is no database role ${role}.`);
+      if (remove) {
+        const used = await owner.one<{ aliases: string }>(
+          `select string_agg(alias, ', ') as aliases from meta.app a where a.db_role = $2 and meta.app_workspace(a.id) = $1 having count(*) > 0`,
+          [id, role],
+        );
+        if (used) throw new Error(`${used.aliases} run${used.aliases.includes(',') ? '' : 's'} as ${role}: give ${used.aliases.includes(',') ? 'them' : 'it'} another role first.`);
+        await owner.query('delete from meta.workspace_role where workspace_id = $1 and role_name = $2', [id, role]);
+      } else await owner.query('insert into meta.workspace_role (workspace_id, role_name) values ($1, $2)', [id, role]);
+      await logActivity({ appId: null, username: s.username, event: 'workspace', ip: clientIp(req), detail: `workspace ${id}: ${remove ? 'removed' : 'added'} role ${role}` });
+      flash(s, remove ? `Role ${role} removed.` : `Role ${role} added.`);
+    } catch (e) {
+      flash(s, `Not saved: ${roleError(e)}`, 'error');
+    } finally {
+      await workspacesChanged();
+    }
+    return back(reply, s, `${BASE}/workspaces/${id}`);
+  });
 }

package/src/db.ts

@@ -13,7 +13,7 @@ const inTx = new AsyncLocalStorage<ReadonlySet<string>>();
 /** Waiting for a free connection fails after this, instead of hanging the request forever. */
 const ACQUIRE_TIMEOUT_MS = Number(process.env.DB_ACQUIRE_TIMEOUT_MS ?? 30_000);
 
-function makePool(connectionString: string | undefined, name: string) {
+export function makePool(connectionString: string | undefined, name: string, max = Number(process.env.DB_POOL_SIZE ?? 10)) {
   const opts = {
     connectionString,
     application_name: name,
@@ -21,7 +21,7 @@ function makePool(connectionString: string | undefined, name: string) {
     // a transaction left open (a bug, a hung client) is ended by the database and frees its connection
     idle_in_transaction_session_timeout: Number(process.env.DB_IDLE_IN_TRANSACTION_MS ?? 300_000),
   };
-  const pool = new pg.Pool({ ...opts, max: Number(process.env.DB_POOL_SIZE ?? 10) });
+  const pool = new pg.Pool({ ...opts, max });
   // A query issued while this async chain already holds a connection of this pool
   // (in tx()) must not wait for a second one from the same pool: with every
   // connection held by requests doing that, none would ever be released. Those
@@ -72,11 +72,36 @@ if (!process.env.RUNTIME_DATABASE_URL)
 
 /** Owner connection: builder, SQL Workshop, migrations. */
 export const owner = makePool(ownerUrl, 'pgkiln-builder');
-/** Least-privilege connection (pgkiln_runtime) that runs applications. */
-export const runtime = makePool(process.env.RUNTIME_DATABASE_URL ?? ownerUrl, 'pgkiln-runtime');
+export type Db = ReturnType<typeof makePool>;
+
+export const runtimeUrl = process.env.RUNTIME_DATABASE_URL ?? ownerUrl;
+/** The shared least-privilege connection (pgkiln_runtime): applications outside isolated workspaces. */
+export const sharedRuntime = makePool(runtimeUrl, 'pgkiln-runtime');
+
+/**
+ * The runtime connection of the current request or job: an isolated workspace's
+ * own login (src/workspace-db.ts sets it with runtimeScope.run) or the shared one.
+ */
+export const runtimeScope = new AsyncLocalStorage<Db>();
+const currentRuntime = () => runtimeScope.getStore() ?? sharedRuntime;
+
+/** Least-privilege connection that runs applications: the current scope's (see runtimeScope). */
+export const runtime: Db = {
+  get pool() {
+    return currentRuntime().pool;
+  },
+  query: (sql, params) => currentRuntime().query(sql, params),
+  one: (sql, params) => currentRuntime().one(sql, params),
+  tx: (fn) => currentRuntime().tx(fn),
+  end: () => sharedRuntime.end(),
+};
+
+const closers: (() => Promise<void>)[] = [];
+/** Pools made elsewhere (the workspaces' own) close with the others. */
+export const onClosePools = (fn: () => Promise<void>) => closers.push(fn);
 
 export async function closePools() {
-  await Promise.all([owner.end(), runtime.end()]);
+  await Promise.all([owner.end(), sharedRuntime.end(), ...closers.map((f) => f())]);
 }
 
 export interface AppContext {
@@ -123,8 +148,13 @@ export async function appTx<T>(ctx: AppContext, fn: (c: Client) => Promise<T>):
 
 const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 
+let appRuntime: (appId: number) => Promise<Db> = async () => currentRuntime();
+/** How appTx finds an application's runtime connection (src/workspace-db.ts: an isolated workspace's own). */
+export const setAppRuntime = (fn: (appId: number) => Promise<Db>) => (appRuntime = fn);
+
 async function appTxInner<T>(ctx: AppContext, fn: (c: Client) => Promise<T>): Promise<T> {
-  return runtime.tx(async (c) => {
+  const db = await appRuntime(ctx.appId);
+  return db.tx(async (c) => {
     await c.query(
       `select set_config('pgkiln.app_user', $1, true),
               set_config('pgkiln.session_id', $2, true),

package/src/ddl.ts

@@ -69,11 +69,12 @@ const lit = (s: string) => `'${s.replace(/'/g, "''")}'`;
 const end = (s: string) => (s.trimEnd().endsWith(';') ? s.trimEnd() : `${s.trimEnd()};`);
 
 /** The schemas a developer can pick: not PostgreSQL's own, not pgkiln's metadata. */
-export async function userSchemas(c: { query: (sql: string) => Promise<{ rows: { name: string }[] }> }) {
+export async function userSchemas(c: { query: (sql: string) => Promise<{ rows: { name: string }[] }> }, opts: { usable?: boolean } = {}) {
   const r = await c.query(
     `select nspname as name from pg_namespace
       where nspname !~ '^pg_' and nspname not in ('information_schema', 'meta')
         and not exists (select 1 from pg_depend d where d.classid = 'pg_namespace'::regclass and d.objid = pg_namespace.oid and d.deptype = 'e')
+        ${opts.usable ? `and has_schema_privilege(oid, 'USAGE')` : ''}
       order by 1`,
   );
   return r.rows.map((x) => x.name);

package/src/debug.ts

@@ -9,6 +9,7 @@
 // Item values are only written at level 9, and never those of password items.
 import type { FastifyRequest } from 'fastify';
 import { runtime } from './db.ts';
+import { withAppDb } from './workspace-db.ts';
 
 export const DEBUG_LEVELS: [number, string][] = [
   [0, 'Off'],
@@ -92,10 +93,10 @@ export class DebugLog {
     if (this.saved) return;
     this.saved = true;
     if (this.dropped) this.entries.push({ ms: round(performance.now() - this.started), level: 1, component: 'debug', text: `${this.dropped} more entries left out (at most ${MAX_ENTRIES} per request)` });
-    await runtime.query('select meta.debug_save($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::jsonb)', [
+    await withAppDb(this.appId, () => runtime.query('select meta.debug_save($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11::jsonb)', [
       this.appId, this.pageNo, this.username, this.sessionId, this.method, this.path, status, this.level,
       this.startedAt.toISOString(), round(performance.now() - this.started), JSON.stringify(this.entries),
-    ]);
+    ]));
   }
 }
 

package/src/migrate.ts

@@ -103,6 +103,9 @@ export async function migrate(o: MigrateOptions): Promise<string[]> {
       else await apply('examples/hr', 'pgkiln_seed');
     }
     if (o.example) await apply(`examples/${o.example}`, 'pgkiln_seed');
+    // (090) application code in isolated workspaces gets what later migrations granted pgkiln_runtime
+    if (applied.length && (await client.query(`select to_regprocedure('meta.sync_app_code_grants()') is not null as ok`)).rows[0].ok)
+      await client.query('select meta.sync_app_code_grants()');
   } finally {
     if (applied.length || failure) await recordRun(client, o.root, { startedAt, fresh, applied, failure }).catch(() => {});
     await client.end();

package/src/process-jobs.ts

@@ -3,6 +3,7 @@ import pg from 'pg';
 import type { FastifyRequest } from 'fastify';
 import { PageCss } from './css.ts';
 import { owner, runtime } from './db.ts';
+import { withAppDb } from './workspace-db.ts';
 import { loadApp, loadPage } from './metadata.ts';
 import type { Session } from './session.ts';
 import { publicError, type PageContext } from './runtime/context.ts';
@@ -61,8 +62,12 @@ async function finish(id: string, state: 'completed' | 'failed', message: string
   );
 }
 
-/** Run one claimed job. */
-async function runJob(job: Job) {
+/** Run one claimed job (on its application's runtime connection: an isolated workspace's own). */
+function runJob(job: Job) {
+  return withAppDb(job.app_id, () => runJobIn(job));
+}
+
+async function runJobIn(job: Job) {
   const app = await loadApp(job.alias);
   const page = app ? await loadPage(app.id, job.page_no) : undefined;
   const chain = page?.processes.find((p) => p.id === job.process_id && p.type === 'chain');

package/src/restsync.ts

@@ -1,6 +1,7 @@
 import pg from 'pg';
 import { nextRun, parseCron } from './automations.ts';
 import { owner, runtime, type Client } from './db.ts';
+import { withAppDb } from './workspace-db.ts';
 import { fetchSource, sourceParamValues, toRows, type RestSource } from './websources.ts';
 
 // REST data source synchronisation (APEX: REST Source Synchronization):
@@ -148,7 +149,7 @@ export async function runSync(sourceId: number, trigger: 'manual' | 'schedule' |
         // background: no page items; &NAME. substitutions in parameter defaults are empty
         const { json } = await fetchSource({ ...s, cache_seconds: 0 }, sourceParamValues(s, undefined, () => ''));
         const { columns, rows, truncated } = toRows(json, s);
-        const counts = await runtime.tx(async (c) => {
+        const counts = await withAppDb(s.app_id, () => runtime.tx(async (c) => {
           await c.query(
             `select set_config('pgkiln.app_user', $1, true), set_config('pgkiln.app_id', $2, true), set_config('pgkiln.session_id', '', true),
                     set_config('statement_timeout', '300s', true)`,
@@ -157,7 +158,7 @@ export async function runSync(sourceId: number, trigger: 'manual' | 'schedule' |
           if (s.db_role) await c.query(`set local role ${ident(s.db_role)}`);
           // a cut-off response (maximum rows) must not delete the rows beyond the cut
           return writeRows(c, s, columns.map((x) => x.name), rows, !truncated);
-        });
+        }));
         const note = truncated ? ` Only the first ${s.max_rows} rows were read (maximum rows)${s.sync_mode === 'merge' && s.sync_delete ? '; nothing was deleted' : ''}.` : '';
         result = { status: 'ok', log, rows: rows.length, ...counts, ...(note ? { message: note.trim() } : {}) };
       } catch (e) {

package/src/runtime/routes.ts

@@ -9,6 +9,7 @@ import { headerValue, HeaderAuthError, peerAddress, resolveHeaderAccount, truste
 import type { FastifyInstance, FastifyReply, FastifyRequest } from 'fastify';
 import { applyBinds } from '../binds.ts';
 import { appTx, runtime, savepoint } from '../db.ts';
+import { withAppDb } from '../workspace-db.ts';
 import { html } from '../html.ts';
 import { documentShell } from '../layout.ts';
 import { accountRoles, loadApp, loadPage, type App, type Page, type Region } from '../metadata.ts';
@@ -1274,7 +1275,9 @@ export async function runtimeRoutes(app: FastifyInstance) {
   });
 
   /** The end of a single sign-on (OpenID Connect or SAML): the app's access rules, then the session. */
-  const finishSso = async (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) => {
+  const finishSso = (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) =>
+    withAppDb(result.appId, () => finishSsoForApp(req, reply, p, result, ip));
+  const finishSsoForApp = async (req: FastifyRequest, reply: FastifyReply, p: { name: string }, result: SsoResult, ip: string) => {
     const alias = (await runtime.one<{ alias: string }>('select alias from meta.app where id = $1', [result.appId]))?.alias;
     const loaded = alias ? await appWithLocale(req, alias) : undefined;
     if (!loaded || loaded.app.authentication !== 'app_users' || !loaded.app.sso_providers.includes(p.name)) return simplePage(reply, 403, english('login.sso_failed'), english('login.method_unavailable'));

package/src/sampledata.ts

@@ -169,10 +169,10 @@ type Db = pg.ClientBase | pg.Pool;
 /** Schemas with at least one ordinary table, the allowed ones only. */
 export async function schemas(db: Db) {
   return (
-    await db.query<{ name: string; tables: number }>(
-      `select n.nspname as name, count(*)::int as tables from pg_namespace n join pg_class c on c.relnamespace = n.oid
+    await db.query<{ name: string; tables: number; usable: boolean }>(
+      `select n.nspname as name, count(*)::int as tables, has_schema_privilege(n.oid, 'USAGE') as usable from pg_namespace n join pg_class c on c.relnamespace = n.oid
         where c.relkind in ('r', 'p') and not c.relispartition and n.nspname !~ '^pg_' and n.nspname not in ('meta', 'information_schema')
-        group by n.nspname order by n.nspname`,
+        group by n.oid, n.nspname order by n.nspname`,
     )
   ).rows;
 }

package/src/session.ts

@@ -1,5 +1,6 @@
 import type { FastifyReply, FastifyRequest } from 'fastify';
-import { runtime } from './db.ts';
+import { runtime, sharedRuntime } from './db.ts';
+import { runtimeForApp } from './workspace-db.ts';
 import { hashToken, loginMaxFailuresPerIp, loginMaxFailuresPerUser, loginWindowMinutes, newToken } from './security.ts';
 import { instanceSetting } from './instance.ts';
 
@@ -96,7 +97,9 @@ export async function logActivity(entry: {
   detail?: string;
 }) {
   try {
-    const r = await runtime.one<{ id: string }>(
+    // (090) on the connection of the entry's application (an isolated workspace's own); without one, the shared one
+    const db = entry.appId != null ? await runtimeForApp(entry.appId) : sharedRuntime;
+    const r = await db.one<{ id: string }>(
       `insert into meta.activity_log (app_id, page_no, username, event, ip, elapsed_ms, detail)
        values ($1, $2, $3, $4, $5, $6, $7) returning id`,
       [entry.appId ?? null, entry.pageNo ?? null, entry.username ?? null, entry.event, entry.ip ?? null, entry.elapsedMs ?? null, entry.detail?.slice(0, 2000) ?? null],

package/src/websources.ts

@@ -1,6 +1,7 @@
 import { createHash } from 'node:crypto';
 import pg from 'pg';
 import { owner, runtime } from './db.ts';
+import { runtimeForApp } from './workspace-db.ts';
 import { decryptSecret, encryptSecret } from './secrets.ts';
 import { WebError, webRequest, type WebResponse } from './webclient.ts';
 
@@ -372,7 +373,8 @@ export const withRest = (rowsQuery: string, sql: string | null | undefined) =>
 // ---------------------------------------------------------------- loading
 
 export async function loadSource(appId: number, name: string) {
-  const s = await runtime.one<RestSource>(
+  // the application's own connection (an isolated workspace's), also from a workflow or job (090)
+  const s = await (await runtimeForApp(appId)).one<RestSource>(
     `select id, app_id, name, url, method, credential, headers, params, body, row_selector, columns, cache_seconds, timeout_s, max_rows, key_columns, operations
        from meta.rest_source where app_id = $1 and name = $2`,
     [appId, name.toUpperCase()],