pgkiln 0.36.0 → 0.38.0

package/SECURITY.md

@@ -67,7 +67,9 @@ first version (MVP). Every finding below has a regression test in
 | AI services (0.28.0) | Administrators only configure services (anonymous → sign-in, other developers 403, CSRF); API keys are encrypted with `PGKILN_SECRET_KEY`, write-only, never exported, logged or shown; all AI tables are revoked from public and the runtime role. Model, base URL and limits are checked; models are never changed silently. Item values go into prompts as escaped `<data>` text marked as data, never instructions; session ids and password items are never sent. Answers only become item values and are escaped when shown. Usage is logged without prompt or answer text (except at debug level 9). Data in prompts leaves the instance for the chosen provider. AI calls don't use `PGKILN_REST_ALLOWED_HOSTS`: only administrators set the base URL. |
 | AI assistant, NL2IR (0.28.0) | CSRF and region visibility are checked before any AI call; assistants are for signed-in users unless marked public. Conversations belong to one session and region, are deleted with the session and are closed to the runtime and application roles. Context queries and tools run as the app's role (grants, RLS): arguments are bound literals checked against the declared parameters (unknown arguments refused), each tool is one subquery with a row limit and a 15 s timeout and is rolled back unless the developer marks it as writing; tools can be limited by an authorization scheme; REST tool arguments are never `&ITEM.`-substituted. Natural-language report filters only produce filters a user could set by hand, on visible columns. Answers are escaped (paragraphs, lists, bold, code only). A writing tool lets the model change data on the user's behalf within the role's rights: design those with care. |
 | App Builder AI and blueprints (0.28.0) | Developer session and CSRF; only administrators choose the builder's AI service. Generated SQL is shown, never run automatically; page proposals are checked (page types, tables the app role can read, free page numbers) and created only after the developer confirms. The model sees names, types and keys, never rows. A blueprint is validated (identifiers, references, rows) and turned into quoted SQL; Create only accepts the exact text the review showed, signed with the developer's session, in one transaction. `meta.builder_ai`, `meta.ai_table_note` and `meta.blueprint` are closed to the runtime role. |
-| Workspaces (0.29.0) | Every builder request under `/apps/:id` or `/pages/:pid` (GET and POST), a working copy's main application, a boilerplate and the code editor's application are checked against the developer's workspaces in `developer()` and answer 404 outside them; lists are filtered by the current workspace. Switching needs CSRF and membership; managing workspaces needs an administrator and CSRF; names are escaped; subscriptions only reach theme and library applications of the same workspace. Workspace tables are closed to the runtime role. **Not a tenant boundary:** the SQL Workshop runs as the owner and application code on the runtime connection, so developers who write SQL can reach other workspaces; accounts, identity providers, LDAP directories and AI services are installation-wide. |
+| Workspaces (0.29.0) | Every builder request under `/apps/:id` or `/pages/:pid` (GET and POST), a working copy's main application, a boilerplate and the code editor's application are checked against the developer's workspaces in `developer()` and answer 404 outside them; lists are filtered by the current workspace. Switching needs CSRF and membership; managing workspaces needs an administrator and CSRF; names are escaped; subscriptions only reach theme and library applications of the same workspace. Workspace tables are closed to the runtime role. **A shared workspace is not a tenant boundary:** its SQL Workshop runs as the owner and its application code on the shared runtime connection; isolate a workspace for that (below). |
+| Isolated workspaces (sprint 60) | The boundary is the PostgreSQL login (`session_user`, which SQL can't change): an isolated workspace's applications run on its own run login and its developers' SQL on its own developer login (`src/workspace-db.ts`; passwords derived from `PGKILN_SECRET_KEY`, never stored), so `RESET ROLE` or `set_config('role', …)` only reach that login. The run login has `pgkiln_app_code` (the runtime role's rights in `meta`, kept in step after every migration by `meta.sync_app_code_grants()`, checked by a test) and the workspace's roles; the developer login only the workspace's roles. Row-level security on every `meta` table the runtime reads keys on the login (`meta.visible_apps()`), both ways: isolated workspaces don't see others, the shared runtime doesn't see isolated ones; the owner isn't affected. `meta.app_id()` and the eight functions that take an application id (`meta.checked_app`) refuse an application the login may not see. A workspace's database roles are an administrator's list (`meta.workspace_role`): an application there may only run as one of them, a role belongs to one workspace, and superusers, roles with CREATEROLE/BYPASSRLS/REPLICATION and pgkiln's own roles are refused; memberships follow by triggers (`meta.workspace_sync_roles()`). A new application gets a new role and a new or own schema. Every builder tool that runs a developer's SQL uses the workspace's developer login (`workshopDb`, `devDbForApp`); the import check plans the imported SQL on it, outside the import's owner transaction. Saved scripts, runs, blueprints and generators are per workspace. **Not covered:** administrators and developers who also belong to a shared workspace (owner rights there), the `pg_catalog` (definitions are readable by every login), PostgREST (one authenticator), identity providers, LDAP, mail and AI services (installation-wide). |
+| Builder screens like APEX's (sprint 61) | The sign-in page's workspace is checked after the password (only the developer's workspaces; a wrong one answers like a wrong password, failures are throttled and logged as before); *Remember workspace and username* is an HttpOnly cookie for `/builder` holding no secret, read defensively and escaped; the redirect after sign-in is a `/builder` path only. Workspace message and banner: administrators and the workspace's administrators, CSRF, plain text escaped, the banner colour from a fixed list. Utilization: the same. SQL Workshop home: your own recent commands only (by id and username), the schema checked against the schemas the session's connection may use (and set as a parameter of `set_config`). Application groups: every query bound to the current workspace; groups and applications of other workspaces are ignored. App Gallery: keys are names from `examples/gallery/gallery.json`, never paths; sample apps (shipped SQL as the owner, demo accounts with known passwords) are for administrators only; starter apps go through the blueprint review and its signed create step. Cross application reports: fixed SQL per topic, the workspace id as a parameter. |
 | Drawers, built-in template components, Theme Roller additions (0.29.0) | Dialog positions and sizes, base styles, dark-mode colours, item and report-column template options only reach the page from fixed lists (checked when saved and again when rendered: a hand-edited value is ignored); the browser gets dialog shapes as JSON values from those lists. Built-in template components pass the same template checks as plug-ins; *Copy into this application* takes a static id from the fixed list, needs CSRF and the application in the developer's workspace, and never overwrites the application's own component. |
 | Report row selection across pages (0.29.0) | `POST …/report/<id>/select` needs the CSRF token, page access and a visible report region whose `selection` names the item (and the item visible); it only changes that item's session state; values are bounded (5000, 400 characters, no `:`) and treated as user input, like a submit; output is escaped. |
 | Instance settings (0.29.0) | Administrators only, with CSRF; only whole numbers within each setting's range are stored (a bad stored value falls back to the environment variable or default); the configuration overview never shows secrets (connection strings, keys: only whether they are set); changes are logged.
@@ -184,18 +186,19 @@ A second full review, mainly of what end users and API callers can reach. Regres
   can do what the runtime role can: read every application's metadata and sessions, set
   `pgkiln.app_id` / `pgkiln.app_user` and call `meta.page_url()` for any application and user (valid
   checksums), or change sessions. Treat every developer as trusted with all applications of the
-  instance, as the workspace notes say; end users never write SQL. A separate login role per
-  application would close this.
+  instance's shared workspaces, as the workspace notes say; end users never write SQL. An isolated workspace
+  (sprint 60) closes this between workspaces: its SQL resets to a login of its own.
 - **Administrators and developers**: SQL Commands, SQL Scripts and the other SQL Workshop tools run on
-  the owner connection for every developer, so a developer can change anything, including
+  the owner connection for administrators and the developers of shared workspaces, so a developer can change anything, including
   `meta.developer.is_admin`. The administrator-only pages (instance settings, AI services, identity
   providers, LDAP directories, the password policy, developers) prevent mistakes; they are not a
   boundary against a developer who means harm.
-- **App id from SQL (known gap, to fix)**: `meta.app_id()` reads the `pgkiln.app_id` setting, which an
-  application's own SQL can change. Requests queued from SQL (`meta.web_request`, `meta.ai_generate`) could
-  therefore be made under another application's id, using its web credentials or AI services and quota.
-  Page processes are not affected (they use the server's app id). Until this is fixed, treat applications
-  on one instance as mutually trusted for these features.
+- **App id from SQL (shared workspaces)**: `meta.app_id()` reads the `pgkiln.app_id` setting, which an
+  application's own SQL can change. In shared workspaces, requests queued from SQL (`meta.web_request`,
+  `meta.ai_generate`) could therefore be made under another shared application's id, using its web credentials or
+  AI services and quota. Page processes are not affected (they use the server's app id). Since sprint 60,
+  `meta.app_id()` refuses an application outside the login's workspace: isolate a workspace whose applications must
+  not be trusted by the others.
 - **Lockout trade-off**: per-user throttling lets an attacker lock a known
   account for 15 minutes. The per-IP limit and the activity monitor help you
   spot this.

package/db/migrations/090_workspace_isolation.sql

@@ -0,0 +1,512 @@
+-- =====================================================================
+-- 090: isolated workspaces (APEX: workspaces as a tenant boundary)
+--
+-- An administrator can make a workspace *isolated*. Its applications then
+-- run on two PostgreSQL login roles of its own instead of the shared ones:
+--
+--   run_role  application code (pages, processes, REST handlers, jobs): a
+--             member of pgkiln_app_code (what application code may use in
+--             meta, the same grants as pgkiln_runtime) and of the database
+--             roles of the workspace's applications;
+--   dev_role  the SQL Workshop and every other tool that runs a developer's
+--             SQL in the builder: a member of the applications' database
+--             roles only, no rights in meta.
+--
+-- SQL can always RESET ROLE (or set_config('role', ...)) back to the role it
+-- logged in with, so the boundary is the login role: session_user, which SQL
+-- cannot change. Row-level security on the meta tables the runtime reads
+-- shows a workspace's logins the rows of their own applications only, and
+-- hides isolated workspaces from the shared runtime role (pgkiln_runtime);
+-- the owner (the builder) sees everything. meta.app_id() refuses an
+-- application the login may not see, which closes the "app id from SQL" gap
+-- for the functions that trust it (web requests, AI, mail, push, page links).
+--
+-- The server sets the login roles' passwords (derived from PGKILN_SECRET_KEY)
+-- and opens a small pool per isolated workspace (src/workspace-db.ts).
+-- Role memberships follow the workspace's applications automatically
+-- (triggers below). Installation data, not exported.
+-- =====================================================================
+
+alter table meta.workspace
+  add column isolated boolean not null default false,
+  add column run_role text unique,
+  add column dev_role text unique;
+comment on column meta.workspace.isolated is 'Isolated (090): the workspace''s applications and SQL run on its own login roles (run_role, dev_role).';
+
+-- workspace administrators (APEX: workspace administrators): developers who manage their workspace's
+-- name and developers; isolation, its database roles, moving applications and deleting stay with
+-- the installation's administrators
+alter table meta.workspace_member add column is_admin boolean not null default false;
+comment on column meta.workspace_member.is_admin is 'A workspace administrator (090): manages the workspace''s name and developers.';
+
+-- the SQL Workshop's saved work belongs to a workspace (Default for what exists): an isolated
+-- workspace's developers see their own scripts, runs, blueprints and data generators only
+alter table meta.sql_script add column workspace_id int not null default 1 references meta.workspace on delete cascade;
+alter table meta.sql_script drop constraint sql_script_name_key;
+create unique index sql_script_name_key on meta.sql_script (workspace_id, name);
+alter table meta.sql_script_run add column workspace_id int not null default 1 references meta.workspace on delete cascade;
+create index sql_script_run_workspace_idx on meta.sql_script_run (workspace_id, id);
+alter table meta.blueprint add column workspace_id int not null default 1 references meta.workspace on delete cascade;
+alter table meta.data_generator add column workspace_id int not null default 1 references meta.workspace on delete cascade;
+alter table meta.data_generator drop constraint data_generator_name_key;
+create unique index data_generator_name_key on meta.data_generator (workspace_id, name);
+
+-- ---------------------------------------------------------------------
+-- pgkiln_app_code: the rights of application code in meta. pgkiln_runtime
+-- keeps its own grants; meta.sync_app_code_grants() copies them here (also
+-- after every later migration, from src/migrate.ts), so a new grant to
+-- pgkiln_runtime reaches isolated workspaces too.
+-- ---------------------------------------------------------------------
+do $$
+begin
+  if not exists (select 1 from pg_roles where rolname = 'pgkiln_app_code') then
+    create role pgkiln_app_code nologin;
+  end if;
+end $$;
+
+create function meta.sync_app_code_grants() returns void
+language plpgsql set search_path = meta, pg_catalog as $$
+declare
+  rt oid := 'pgkiln_runtime'::regrole;
+  ac oid := 'pgkiln_app_code'::regrole;
+  r  record;
+begin
+  -- schemas
+  for r in
+    select n.nspname, x.privilege_type, x.grantee from pg_namespace n, aclexplode(n.nspacl) x
+     where x.grantee in (rt, ac) and n.nspname not in ('pg_catalog', 'information_schema')
+  loop
+    if r.grantee = rt and not has_schema_privilege(ac, r.nspname, r.privilege_type) then
+      execute format('grant %s on schema %I to pgkiln_app_code', r.privilege_type, r.nspname);
+    elsif r.grantee = ac and not exists (select 1 from pg_namespace n, aclexplode(n.nspacl) y
+                                          where n.nspname = r.nspname and y.grantee = rt and y.privilege_type = r.privilege_type) then
+      execute format('revoke %s on schema %I from pgkiln_app_code', r.privilege_type, r.nspname);
+    end if;
+  end loop;
+  -- tables, views, sequences
+  for r in
+    select c.oid::regclass as rel, c.relkind, x.privilege_type, x.grantee from pg_class c, aclexplode(c.relacl) x
+     where x.grantee in (rt, ac) and c.relnamespace not in ('pg_catalog'::regnamespace, 'information_schema'::regnamespace)
+  loop
+    if r.grantee = rt and not exists (select 1 from pg_class c, aclexplode(c.relacl) y where c.oid = r.rel and y.grantee = ac and y.privilege_type = r.privilege_type) then
+      execute format('grant %s on %s %s to pgkiln_app_code', r.privilege_type, case when r.relkind = 'S' then 'sequence' else 'table' end, r.rel);
+    elsif r.grantee = ac and not exists (select 1 from pg_class c, aclexplode(c.relacl) y where c.oid = r.rel and y.grantee = rt and y.privilege_type = r.privilege_type) then
+      execute format('revoke %s on %s %s from pgkiln_app_code', r.privilege_type, case when r.relkind = 'S' then 'sequence' else 'table' end, r.rel);
+    end if;
+  end loop;
+  -- columns
+  for r in
+    select a.attrelid::regclass as rel, a.attname, x.privilege_type, x.grantee from pg_attribute a, aclexplode(a.attacl) x
+     where x.grantee in (rt, ac) and not a.attisdropped
+  loop
+    if r.grantee = rt and not exists (select 1 from pg_attribute a, aclexplode(a.attacl) y where a.attrelid = r.rel and a.attname = r.attname and y.grantee = ac and y.privilege_type = r.privilege_type) then
+      execute format('grant %s (%I) on table %s to pgkiln_app_code', r.privilege_type, r.attname, r.rel);
+    elsif r.grantee = ac and not exists (select 1 from pg_attribute a, aclexplode(a.attacl) y where a.attrelid = r.rel and a.attname = r.attname and y.grantee = rt and y.privilege_type = r.privilege_type) then
+      execute format('revoke %s (%I) on table %s from pgkiln_app_code', r.privilege_type, r.attname, r.rel);
+    end if;
+  end loop;
+  -- functions
+  for r in
+    select p.oid::regprocedure as fn, x.grantee from pg_proc p, aclexplode(p.proacl) x
+     where x.grantee in (rt, ac) and x.privilege_type = 'EXECUTE' and p.pronamespace not in ('pg_catalog'::regnamespace, 'information_schema'::regnamespace)
+  loop
+    if r.grantee = rt and not exists (select 1 from pg_proc p, aclexplode(p.proacl) y where p.oid = r.fn and y.grantee = ac) then
+      execute format('grant execute on function %s to pgkiln_app_code', r.fn);
+    elsif r.grantee = ac and not exists (select 1 from pg_proc p, aclexplode(p.proacl) y where p.oid = r.fn and y.grantee = rt) then
+      execute format('revoke execute on function %s from pgkiln_app_code', r.fn);
+    end if;
+  end loop;
+end $$;
+revoke all on function meta.sync_app_code_grants() from public;
+
+-- ---------------------------------------------------------------------
+-- Who is asking: the workspace of the login role, and the applications it
+-- may see.
+-- ---------------------------------------------------------------------
+
+-- the isolated workspace whose login role this session signed in with (null: another login)
+create function meta.login_workspace() returns int
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select id from meta.workspace where isolated and session_user::text in (run_role, dev_role)
+$$;
+
+-- the installation's owner (the builder, migrations) or a superuser: sees every application
+create function meta.owner_login() returns boolean
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select coalesce((select r.rolsuper or r.oid = (select nspowner from pg_namespace where nspname = 'meta')
+                     from pg_roles r where r.rolname = session_user), false)
+$$;
+
+-- no isolated workspace: nothing to filter (the common case, checked once per query)
+create function meta.isolation_off() returns boolean
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select not exists (select 1 from meta.workspace where isolated)
+$$;
+
+-- the applications this login may see: its own workspace's (an isolated workspace's
+-- login), every application (the owner), or those outside isolated workspaces (the rest)
+create function meta.visible_apps() returns setof int
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  with me as (select meta.login_workspace() as ws, meta.owner_login() as owner)
+  select a.id from meta.app a, me
+   where case
+           when me.ws is not null then meta.app_workspace(a.id) = me.ws
+           when me.owner then true
+           else not exists (select 1 from meta.workspace w where w.id = meta.app_workspace(a.id) and w.isolated)
+         end
+$$;
+
+create function meta.app_visible(p_app_id int) returns boolean
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select meta.isolation_off() or p_app_id in (select meta.visible_apps())
+$$;
+
+-- p_app_id when this login may see it; otherwise an error (for functions that take an application id)
+create function meta.checked_app(p_app_id int) returns int
+language plpgsql stable security definer set search_path = meta, pg_catalog as $$
+begin
+  if p_app_id is not null and not meta.app_visible(p_app_id) then
+    raise exception 'Application % is not in this workspace.', p_app_id using errcode = '42501';
+  end if;
+  return p_app_id;
+end $$;
+
+-- accounts: those with access to a visible application, or with no access to one it may not see
+create function meta.visible_accounts() returns setof int
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  with vis as (select meta.visible_apps() as app_id)
+  select a.id from meta.account a
+   where exists (select 1 from meta.app_access x where x.account_id = a.id and x.app_id in (select app_id from vis))
+      or not exists (select 1 from meta.app_access x where x.account_id = a.id and x.app_id not in (select app_id from vis))
+$$;
+
+revoke all on function meta.login_workspace(), meta.owner_login(), meta.isolation_off(), meta.visible_apps(),
+  meta.visible_accounts() from public;
+grant execute on function meta.login_workspace(), meta.isolation_off(), meta.visible_apps(), meta.visible_accounts(),
+  meta.owner_login() to pgkiln_runtime;
+-- app_visible and checked_app stay executable by everyone (application code may check an id)
+
+-- meta.app_id(): the application of the request, refused when the login may not see it
+-- (application SQL can set pgkiln.app_id to another application's id)
+create or replace function meta.app_id() returns int
+language plpgsql stable security definer set search_path = meta, pg_catalog as $$
+declare
+  v int := coalesce(nullif(current_setting('pgkiln.app_id', true), '')::int,
+                    (select a.id from meta.app a where a.alias = meta.jwt_claims()->>'app'));
+begin
+  if v is not null and not meta.isolation_off() and not meta.app_visible(v) then
+    raise exception 'Application % is not in this workspace.', v using errcode = '42501';
+  end if;
+  return v;
+end $$;
+
+-- ---------------------------------------------------------------------
+-- Functions the server calls with an application id: the same check.
+-- The originals stay, renamed, for the owner only.
+-- ---------------------------------------------------------------------
+alter function meta.account_roles(int, text) rename to account_roles_unchecked;
+alter function meta.authenticate(int, text, text) rename to authenticate_unchecked;
+alter function meta.change_password(int, text, text, text, uuid) rename to change_password_unchecked;
+alter function meta.debug_save(int, int, text, uuid, text, text, int, int, timestamptz, numeric, jsonb) rename to debug_save_unchecked;
+alter function meta.password_reset_available(int) rename to password_reset_available_unchecked;
+alter function meta.password_reset_user(int, text) rename to password_reset_user_unchecked;
+alter function meta.request_password_reset(int, text, text, text, text, text, text) rename to request_password_reset_unchecked;
+alter function meta.reset_password(int, text, text) rename to reset_password_unchecked;
+revoke all on function meta.account_roles_unchecked(int, text), meta.authenticate_unchecked(int, text, text),
+  meta.change_password_unchecked(int, text, text, text, uuid),
+  meta.debug_save_unchecked(int, int, text, uuid, text, text, int, int, timestamptz, numeric, jsonb),
+  meta.password_reset_available_unchecked(int), meta.password_reset_user_unchecked(int, text),
+  meta.request_password_reset_unchecked(int, text, text, text, text, text, text), meta.reset_password_unchecked(int, text, text)
+  from public, pgkiln_runtime;
+
+create function meta.account_roles(p_app_id int, p_username text) returns text[]
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select meta.account_roles_unchecked(meta.checked_app(p_app_id), p_username)
+$$;
+create function meta.authenticate(p_app_id int, p_username text, p_password text) returns text
+language sql security definer set search_path = meta, pg_catalog as $$
+  select meta.authenticate_unchecked(meta.checked_app(p_app_id), p_username, p_password)
+$$;
+create function meta.change_password(p_app_id int, p_username text, p_old text, p_new text, p_keep_session uuid default null) returns boolean
+language sql security definer set search_path = meta, pg_catalog as $$
+  select meta.change_password_unchecked(meta.checked_app(p_app_id), p_username, p_old, p_new, p_keep_session)
+$$;
+create function meta.debug_save(p_app_id int, p_page_no int, p_username text, p_session_id uuid, p_method text, p_path text,
+  p_status int, p_level int, p_started_at timestamptz, p_elapsed_ms numeric, p_entries jsonb) returns bigint
+language sql security definer set search_path = meta, pg_catalog as $$
+  select meta.debug_save_unchecked(meta.checked_app(p_app_id), p_page_no, p_username, p_session_id, p_method, p_path,
+    p_status, p_level, p_started_at, p_elapsed_ms, p_entries)
+$$;
+create function meta.password_reset_available(p_app_id int) returns boolean
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select meta.password_reset_available_unchecked(meta.checked_app(p_app_id))
+$$;
+create function meta.password_reset_user(p_app_id int, p_token_hash text) returns text
+language sql stable security definer set search_path = meta, pg_catalog as $$
+  select meta.password_reset_user_unchecked(meta.checked_app(p_app_id), p_token_hash)
+$$;
+create function meta.request_password_reset(p_app_id int, p_login text, p_token_hash text, p_ip text, p_subject text,
+  p_body text, p_body_html text) returns void
+language sql security definer set search_path = meta, pg_catalog as $$
+  select meta.request_password_reset_unchecked(meta.checked_app(p_app_id), p_login, p_token_hash, p_ip, p_subject, p_body, p_body_html)
+$$;
+create function meta.reset_password(p_app_id int, p_token_hash text, p_new text) returns text
+language sql security definer set search_path = meta, pg_catalog as $$
+  select meta.reset_password_unchecked(meta.checked_app(p_app_id), p_token_hash, p_new)
+$$;
+revoke all on function meta.account_roles(int, text), meta.authenticate(int, text, text),
+  meta.change_password(int, text, text, text, uuid),
+  meta.debug_save(int, int, text, uuid, text, text, int, int, timestamptz, numeric, jsonb),
+  meta.password_reset_available(int), meta.password_reset_user(int, text),
+  meta.request_password_reset(int, text, text, text, text, text, text), meta.reset_password(int, text, text) from public;
+grant execute on function meta.account_roles(int, text), meta.authenticate(int, text, text),
+  meta.change_password(int, text, text, text, uuid),
+  meta.debug_save(int, int, text, uuid, text, text, int, int, timestamptz, numeric, jsonb),
+  meta.password_reset_available(int), meta.password_reset_user(int, text),
+  meta.request_password_reset(int, text, text, text, text, text, text), meta.reset_password(int, text, text) to pgkiln_runtime;
+
+-- ---------------------------------------------------------------------
+-- Row-level security on the meta tables the runtime role reads or writes.
+-- The owner (table owner) is not affected. Without isolated workspaces the
+-- first condition is true once per query and nothing is filtered.
+-- ---------------------------------------------------------------------
+do $$
+declare
+  t text;
+begin
+  -- tables with the application's id
+  foreach t in array array['account_style', 'app_access', 'app_item', 'app_process', 'authz_scheme', 'build_option',
+    'data_load_def', 'document_template', 'feedback', 'list', 'list_entry', 'lov', 'nav_entry', 'page', 'page_group',
+    'plugin', 'report_layout', 'rest_module', 'rest_source', 'search_config', 'static_file', 'task_definition',
+    'template_component', 'text_message', 'translation', 'workflow_definition', 'web_credential']
+  loop
+    execute format('alter table meta.%I enable row level security', t);
+    execute format($p$create policy workspace on meta.%I using ((select meta.isolation_off()) or app_id in (select meta.visible_apps()))
+                      with check ((select meta.isolation_off()) or app_id in (select meta.visible_apps()))$p$, t);
+  end loop;
+  -- tables of a page
+  foreach t in array array['branch', 'button', 'computation', 'dynamic_action', 'item', 'process', 'region', 'validation']
+  loop
+    execute format('alter table meta.%I enable row level security', t);
+    execute format($p$create policy workspace on meta.%I using ((select meta.isolation_off())
+                        or exists (select 1 from meta.page p where p.id = page_id and p.app_id in (select meta.visible_apps())))$p$, t);
+  end loop;
+end $$;
+
+-- rows without an application (builder sessions, instance activity): not for an isolated workspace's logins
+alter table meta.session enable row level security;
+create policy workspace on meta.session
+  using ((select meta.isolation_off()) or app_id in (select meta.visible_apps()) or (app_id is null and meta.login_workspace() is null))
+  with check ((select meta.isolation_off()) or app_id in (select meta.visible_apps()) or (app_id is null and meta.login_workspace() is null));
+alter table meta.activity_log enable row level security;
+create policy workspace on meta.activity_log
+  using ((select meta.isolation_off()) or app_id in (select meta.visible_apps()) or (app_id is null and meta.login_workspace() is null))
+  with check ((select meta.isolation_off()) or app_id in (select meta.visible_apps()) or (app_id is null and meta.login_workspace() is null));
+alter table meta.app enable row level security;
+create policy workspace on meta.app
+  using ((select meta.isolation_off()) or id in (select meta.visible_apps()));
+alter table meta.account enable row level security;
+create policy workspace on meta.account
+  using ((select meta.isolation_off()) or id in (select meta.visible_accounts()));
+
+-- ---------------------------------------------------------------------
+-- The database roles of an isolated workspace (APEX: the workspace's
+-- schemas). Administrators assign them (isolating a workspace assigns the
+-- roles its applications use); a new application made in the workspace adds
+-- its own new role. Its applications may run as these roles only, so an
+-- import or a settings change can't claim another role of the database.
+-- Installation data, not exported.
+-- ---------------------------------------------------------------------
+create table meta.workspace_role (
+  workspace_id int  not null references meta.workspace on delete cascade,
+  role_name    text not null unique check (role_name ~ '^[A-Za-z_][A-Za-z0-9_$]{0,62}$'),
+  primary key (workspace_id, role_name)
+);
+revoke all on meta.workspace_role from public;
+comment on table meta.workspace_role is 'The database roles of an isolated workspace (090): its applications run as these only. Installation data, not exported.';
+
+-- Role memberships follow the workspaces: a role of an isolated workspace belongs to that
+-- workspace's two login roles and not to pgkiln_runtime; it goes back to pgkiln_runtime when
+-- it leaves the workspace (or the workspace is no longer isolated) and a shared application uses it.
+create function meta.workspace_sync_roles() returns void
+language plpgsql set search_path = meta, pg_catalog as $$
+declare
+  r record;
+begin
+  -- nothing isolated and never was: nothing to do
+  if not exists (select 1 from meta.workspace where isolated or run_role is not null) then
+    return;
+  end if;
+  -- the login roles of isolated workspaces
+  for r in select id, run_role, dev_role from meta.workspace where isolated loop
+    if not exists (select 1 from pg_roles where rolname = r.run_role) then
+      execute format('create role %I login', r.run_role);
+    end if;
+    if not exists (select 1 from pg_roles where rolname = r.dev_role) then
+      execute format('create role %I login', r.dev_role);
+    end if;
+    execute format('alter role %I login inherit nosuperuser nocreatedb nocreaterole noreplication nobypassrls', r.run_role);
+    execute format('alter role %I login inherit nosuperuser nocreatedb nocreaterole noreplication nobypassrls', r.dev_role);
+    if not pg_has_role(r.run_role, 'pgkiln_app_code', 'MEMBER') then
+      execute format('grant pgkiln_app_code to %I', r.run_role);
+    end if;
+  end loop;
+  -- an application of an isolated workspace runs as one of the workspace's roles
+  for r in
+    select a.alias, a.db_role, w.name from meta.app a join meta.workspace w on w.id = meta.app_workspace(a.id)
+     where w.isolated and a.db_role is not null
+       and not exists (select 1 from meta.workspace_role x where x.workspace_id = w.id and x.role_name = a.db_role)
+  loop
+    raise exception 'Application % runs as %, which is not a database role of workspace % (an administrator adds it on the workspace''s page).', r.alias, r.db_role, r.name
+      using errcode = '42501';
+  end loop;
+  -- the workspace's roles: only its logins have them
+  for r in
+    select x.role_name, w.id as ws, w.run_role, w.dev_role,
+           rl.oid is null as missing, coalesce(rl.rolsuper or rl.rolcreaterole or rl.rolbypassrls or rl.rolreplication, false) as powerful
+      from meta.workspace_role x join meta.workspace w on w.id = x.workspace_id and w.isolated
+      left join pg_roles rl on rl.rolname = x.role_name
+  loop
+    continue when r.missing;
+    if r.powerful or r.role_name like 'pgkiln%' or r.role_name = (select nspowner::regrole::text from pg_namespace where nspname = 'meta') then
+      raise exception 'The role % can''t belong to an isolated workspace (a superuser, a role that creates roles or bypasses row-level security, or one of pgkiln''s own).', r.role_name
+        using errcode = '42501';
+    end if;
+    if exists (select 1 from meta.app b where b.db_role = r.role_name and meta.app_workspace(b.id) <> r.ws) then
+      raise exception 'The database role % is used by an application of another workspace; an isolated workspace''s roles are its own.', r.role_name
+        using errcode = '42501';
+    end if;
+    if not exists (select 1 from pg_auth_members m where m.roleid = r.role_name::regrole and m.member = r.run_role::regrole) then
+      execute format('grant %I to %I', r.role_name, r.run_role);
+    end if;
+    if not exists (select 1 from pg_auth_members m where m.roleid = r.role_name::regrole and m.member = r.dev_role::regrole) then
+      execute format('grant %I to %I', r.role_name, r.dev_role);
+    end if;
+    if exists (select 1 from pg_auth_members m where m.roleid = r.role_name::regrole and m.member = 'pgkiln_runtime'::regrole) then
+      execute format('revoke %I from pgkiln_runtime', r.role_name);
+    end if;
+  end loop;
+  -- the developer login starts as the workspace's first role, so what its SQL creates belongs to an
+  -- application role (SET ROLE picks another; RESET ROLE returns to this one)
+  for r in
+    select w.dev_role, (select x.role_name from meta.workspace_role x join pg_roles rl on rl.rolname = x.role_name
+                         where x.workspace_id = w.id order by x.role_name limit 1) as first
+      from meta.workspace w where w.isolated
+  loop
+    if r.first is not null then
+      execute format('alter role %I set role = %L', r.dev_role, r.first);
+    else
+      execute format('alter role %I reset role', r.dev_role);
+    end if;
+  end loop;
+  -- memberships a workspace login no longer should have; a role a shared application uses goes back to pgkiln_runtime
+  for r in
+    select g.rolname as granted, l.rolname as login
+      from meta.workspace w
+      join pg_roles l on l.rolname in (w.run_role, w.dev_role)
+      join pg_auth_members m on m.member = l.oid
+      join pg_roles g on g.oid = m.roleid
+     where not w.isolated
+        or (g.rolname <> 'pgkiln_app_code' and not exists (select 1 from meta.workspace_role x where x.workspace_id = w.id and x.role_name = g.rolname))
+        or (g.rolname = 'pgkiln_app_code' and l.rolname = w.dev_role)
+  loop
+    execute format('revoke %I from %I', r.granted, r.login);
+    if r.granted <> 'pgkiln_app_code'
+       and exists (select 1 from meta.app a join meta.workspace w on w.id = meta.app_workspace(a.id) where a.db_role = r.granted and not w.isolated)
+       and not pg_has_role('pgkiln_runtime', r.granted, 'MEMBER') then
+      execute format('grant %I to pgkiln_runtime', r.granted);
+    end if;
+  end loop;
+  -- logins of workspaces that are no longer isolated can't sign in
+  for r in select run_role, dev_role from meta.workspace where not isolated and run_role is not null loop
+    if exists (select 1 from pg_roles where rolname = r.run_role) then
+      execute format('alter role %I nologin', r.run_role);
+    end if;
+    if exists (select 1 from pg_roles where rolname = r.dev_role) then
+      execute format('alter role %I nologin', r.dev_role);
+    end if;
+  end loop;
+end $$;
+revoke all on function meta.workspace_sync_roles() from public;
+
+-- names for the login roles, given when a workspace is first isolated (unique per installation:
+-- roles are shared by every database of the PostgreSQL server)
+create function meta.workspace_isolate() returns trigger
+language plpgsql set search_path = meta, pg_catalog as $$
+declare
+  suffix text;
+begin
+  if new.isolated and new.run_role is null then
+    loop
+      suffix := substr(md5(random()::text || clock_timestamp()::text), 1, 8);
+      exit when not exists (select 1 from pg_roles where rolname in (format('pgkiln_ws%s_run_%s', new.id, suffix), format('pgkiln_ws%s_dev_%s', new.id, suffix)));
+    end loop;
+    new.run_role := format('pgkiln_ws%s_run_%s', new.id, suffix);
+    new.dev_role := format('pgkiln_ws%s_dev_%s', new.id, suffix);
+  end if;
+  if new.run_role is distinct from old.run_role and old.run_role is not null then
+    raise exception 'The login roles of a workspace can''t be renamed.';
+  end if;
+  return new;
+end $$;
+create trigger workspace_isolate before insert or update of isolated, run_role, dev_role on meta.workspace
+  for each row execute function meta.workspace_isolate();
+
+-- isolating a workspace (an administrator) assigns it the roles its applications use
+create function meta.workspace_take_roles() returns trigger
+language plpgsql set search_path = meta, pg_catalog as $$
+begin
+  if new.isolated and not coalesce(old.isolated, false) then
+    insert into meta.workspace_role (workspace_id, role_name)
+    select distinct new.id, a.db_role from meta.app a
+     where meta.app_workspace(a.id) = new.id and a.db_role is not null
+    on conflict (workspace_id, role_name) do nothing;
+  end if;
+  return null;
+end $$;
+create trigger workspace_take_roles after insert or update of isolated on meta.workspace
+  for each row execute function meta.workspace_take_roles();
+
+-- checked at the commit, on the transaction's final state (an import or a working copy inserts an
+-- application before it places it in its workspace); once per transaction
+create function meta.workspace_sync_roles_once() returns trigger
+language plpgsql set search_path = meta, pg_catalog as $$
+begin
+  if current_setting('pgkiln.workspace_synced', true) is distinct from txid_current()::text then
+    perform set_config('pgkiln.workspace_synced', txid_current()::text, true);
+    perform meta.workspace_sync_roles();
+  end if;
+  return null;
+end $$;
+create constraint trigger workspace_sync_roles after insert or update of isolated on meta.workspace
+  deferrable initially deferred for each row execute function meta.workspace_sync_roles_once();
+create constraint trigger workspace_sync_roles after insert or update or delete on meta.workspace_app
+  deferrable initially deferred for each row execute function meta.workspace_sync_roles_once();
+create constraint trigger workspace_sync_roles after insert or delete or update of db_role on meta.app
+  deferrable initially deferred for each row execute function meta.workspace_sync_roles_once();
+create constraint trigger workspace_sync_roles after insert or update or delete on meta.workspace_role
+  deferrable initially deferred for each row execute function meta.workspace_sync_roles_once();
+
+-- deleting a workspace: its login roles go too (they own nothing; if they do, they stay, unable to sign in)
+create function meta.workspace_drop_roles() returns trigger
+language plpgsql set search_path = meta, pg_catalog as $$
+declare
+  r text;
+begin
+  foreach r in array array[old.run_role, old.dev_role] loop
+    continue when r is null or not exists (select 1 from pg_roles where rolname = r);
+    begin
+      execute format('drop role %I', r);
+    exception when others then
+      execute format('alter role %I nologin', r);
+      raise notice 'The login role % owns objects or has privileges; it stays, unable to sign in.', r;
+    end;
+  end loop;
+  return null;
+end $$;
+create trigger workspace_drop_roles after delete on meta.workspace
+  for each row execute function meta.workspace_drop_roles();
+
+revoke all on function meta.workspace_isolate(), meta.workspace_take_roles(), meta.workspace_sync_roles_once(), meta.workspace_drop_roles() from public;
+
+select meta.sync_app_code_grants();

package/db/migrations/091_workspace_service.sql

@@ -0,0 +1,20 @@
+-- =====================================================================
+-- 091: a workspace's message and environment banner (APEX: Administration
+-- → Manage Service → Define Workspace Message, Define Environment Banner)
+--
+-- message      shown to the workspace's developers on the App Builder home
+--              (plain text, at most 2000 characters)
+-- banner_label a short label (e.g. DEVELOPMENT, TEST) shown in a coloured band
+--              at the top of every builder page while the workspace is current
+-- banner_color one colour of a fixed list (the builder's CSS draws them)
+--
+-- Administrators and the workspace's administrators set them.
+-- Installation data, not exported.
+-- =====================================================================
+alter table meta.workspace
+  add column message text check (length(message) between 1 and 2000),
+  add column banner_label text check (banner_label ~ '^\S(.{0,38}\S)?$'),
+  add column banner_color text not null default 'blue'
+    check (banner_color in ('red', 'orange', 'yellow', 'green', 'teal', 'blue', 'purple', 'gray'));
+comment on column meta.workspace.message is 'Workspace message (091): shown to its developers on the App Builder home.';
+comment on column meta.workspace.banner_label is 'Environment banner (091): a label shown at the top of the builder while the workspace is current.';

package/db/migrations/092_app_groups.sql

@@ -0,0 +1,23 @@
+-- =====================================================================
+-- 092: application groups (APEX: Workspace Utilities → Application Groups)
+--
+-- A workspace's named groups of applications, to organise the App Builder:
+-- the home page filters and labels applications by group. They change
+-- nothing at run time. Installation data (like workspaces): not exported,
+-- kept by an in-place import.
+-- =====================================================================
+create table meta.app_group (
+  id           serial primary key,
+  workspace_id int  not null references meta.workspace on delete cascade,
+  name         text not null check (name ~ '^\S(.{0,58}\S)?$'),
+  description  text check (length(description) <= 2000),
+  unique (workspace_id, name)
+);
+create table meta.app_group_member (
+  app_id   int primary key references meta.app on delete cascade,
+  group_id int not null references meta.app_group on delete cascade
+);
+create index app_group_member_group_idx on meta.app_group_member (group_id);
+revoke all on meta.app_group, meta.app_group_member from public;
+comment on table meta.app_group is 'Application groups (092): a workspace''s named groups of applications, for the App Builder. Not exported.';
+comment on table meta.app_group_member is 'The group of an application (092); none: ungrouped.';