rowstile 0.1.0-alpha.6 → 0.1.0-alpha.7

package/command/authzlib/__init__.py

@@ -1,18 +1,17 @@
 """authzlib: compile a .authz policy file into PostgreSQL (views, closure tables,
 triggers, row-level security policies and an API for app code)."""
 
-from .devtools import DevMixin
-from .output import OutputMixin
-from .parse import Loc, PolicyError, parse_policy
-from .testing import TestMixin
+from typing import TYPE_CHECKING
 
+from .parse import Loc, PolicyError, parse_policy
 
-class Compiler(TestMixin, DevMixin, OutputMixin):
-    """A policy compiled: each part of the output is one of its bases (OutputMixin assembles them)."""
+if TYPE_CHECKING:
+    from .assembled import Compiler
 
+    BUILD: str
 
 # set with packaging/version.py (the packages copy it); authz.policy_versions records it on each apply
-__version__ = "0.1.0-alpha.6"
+__version__ = "0.1.0-alpha.7"
 
 
 def _build() -> str:
@@ -31,6 +30,17 @@ def _build() -> str:
     return f"{__version__}+{h.hexdigest()[:12]}"
 
 
-BUILD = _build()
+def __getattr__(name: str) -> object:
+    """Compiler and BUILD, made when first asked for: a command that compiles nothing (--version, help, can, fmt)
+    doesn't import the compiler, and only one that records or compares the version reads every source file."""
+    if name == "Compiler":
+        from .assembled import Compiler as value
+    elif name == "BUILD":
+        value = _build()
+    else:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    globals()[name] = value
+    return value
+
 
 __all__ = ["BUILD", "Compiler", "Loc", "PolicyError", "__version__", "parse_policy"]

package/command/authzlib/assembled.py

@@ -0,0 +1,9 @@
+"""The compiler, its parts stacked: authzlib.Compiler, imported when first asked for (see __init__.py)."""
+
+from .devtools import DevMixin
+from .output import OutputMixin
+from .testing import TestMixin
+
+
+class Compiler(TestMixin, DevMixin, OutputMixin):
+    """A policy compiled: each part of the output is one of its bases (OutputMixin assembles them)."""

package/command/authzlib/compiler.py

@@ -33,6 +33,7 @@ from .parse import (
     names_roles,
 )
 from .sqlutil import (
+    CAVEAT_ARG,
     check_stable_condition,
     lit,
     names_this,
@@ -84,13 +85,21 @@ class NextTree(TypedDict):
 
 
 def rule_name(rule: Rule) -> str:
-    if rule.command == "mask":
-        return "mask " + ", ".join(rule.columns)
+    """A write rule's head, as the policy writes it (`update owner_id after`), for messages."""
+    # (two masks of one column are refused as masked twice before two rules alike, and refusals explain writes)
+    assert rule.command != "mask", "a mask is never named in a message about rules"
     if not rule.columns:
         return "update after" if rule.command == "update check" else rule.command
     return "update " + ", ".join(rule.columns) + (" after" if rule.command == "update check" else "")
 
 
+# what AZ302 says of a permission that depends on itself otherwise than by inheriting
+DEPENDS_ON_ITSELF = (
+    "{} depends on itself; a permission can only recurse as 'or rel.perm' (optionally 'and {{condition}}') "
+    "through a relation to objects, and a group only as 'member : group#member'"
+)
+
+
 def only_on(node: Expr) -> list[str] | None:
     """The subject types an arrow the compiler narrowed (arrow_on) follows; None for any other item."""
     match node:
@@ -255,6 +264,12 @@ class Core:
     def T(self, name: str) -> Type:
         return self.types[name]
 
+    def governing(self, table: str) -> Type:
+        """The type whose permissions a table's rules name."""
+        found = [t for t in self.types.values() if t.table == table]
+        assert len(found) == 1, "validate refuses rules for a table no type or two types map to (AZ401)"
+        return found[0]
+
     @staticmethod
     def public_perms(t: Type) -> list[str]:
         """The permissions the policy declares, without the ones the compiler made."""
@@ -429,8 +444,8 @@ class Core:
                         f"{{conditions}} and `not <permission>`, e.g. (viewer or parent.{p.name}) and not denied",
                         "AZ304",
                     )
-                if not rest:
-                    continue  # recursion through a negation: analyze_recursion says why not
+                if not rest:  # it comes back to itself only through a `not`
+                    fail(p.loc, DEPENDS_ON_ITSELF.format(f"{t.name}.{p.name}"), "AZ302")
                 first = rest[0]
                 items = list(first.items) if isinstance(first, Or) else [first]
                 items = [
@@ -492,24 +507,16 @@ class Core:
         """`view = view__base and not denied` means what `(... or parent.view) and not denied` says only if
         denied holds on everything below a denied object: denied inherits through every link view__base
         does (without a condition, or with the same one). Otherwise the deny would cut inheritance at the
-        denied object only, which needs each user's paths, and rowstile stores objects' ancestors."""
+        denied object only, which needs each user's paths, and rowstile stores objects' ancestors. (A deny whose
+        inheritance goes through another type's permission comes back to it: analyze_recursion says so.)"""
         for (tn, pn), negs in self.denies.items():
             t = self.T(tn)
             base_name = t.perms[pn].base
             assert base_name is not None  # split_denies gave every permission with a deny its base
             base = t.perms[base_name]
-            key = self.recursive.get((tn, base.name))
-            if key is None or len(self.scc_members[key]) != 1:
-                fail(
-                    base.loc,
-                    f"{tn}.{pn} has a deny, so it can only inherit within {tn} (like parent.{pn}), "
-                    f"not through permissions of other types",
-                    "AZ306",
-                )
             edges = self.perm_edges(t, base) or frozenset()
             for x in negs:
-                if not (isinstance(x, Not) and isinstance(x.item, Ref)):
-                    continue  # split_denies refused anything else
+                assert isinstance(x, Not) and isinstance(x.item, Ref), "split_denies refuses any other deny (AZ306)"
                 name = x.item.name
                 self.lookup(t, name, base.loc)
                 if name not in t.perms:
@@ -613,6 +620,7 @@ class Core:
                 if (rule.table, c) in masked:
                     fail(rule.loc, f"{rule.table}.{c} is masked twice (also on {masked[rule.table, c]})", "AZ109")
                 masked[rule.table, c] = rule.loc
+        shows: dict[str, str] = {}  # each view, as the SQL names it -> the table it shows
         for table, view in self.pol.views.items():
             view_loc = self.pol.view_locs[table]
             if not any(r.table == table and r.command == "select" and not r.columns for r in self.rules):
@@ -621,6 +629,14 @@ class Core:
                 )
             if view == table or any(t.table == view for t in self.types.values()):
                 fail(view_loc, f"{view} is a table of the policy; name a new view", "AZ402")
+            other = shows.setdefault(qt(view), table)
+            if other != table:
+                fail(
+                    view_loc,
+                    f"{view} is already the view of {other} ({self.pol.view_locs[other]}): give {table} a view of "
+                    f"its own",
+                    "AZ109",
+                )
         for sc in self.pol.scopes.values():
             for kind, qual, word in sc.items:
                 if kind == "cmd" and qual and not any(t.table == qual for t in self.types.values()):
@@ -680,7 +696,8 @@ class Core:
         """The permissions the runtime asks for by name (beside `share`, which shared relations check) are
         declared where it asks: anywhere else nothing would ever use them, or what they allow could never be done."""
         owners_of_roles = {self.role_owner_type(t) for t in self.types.values() if t.roles and t.roles_from}
-        roles_anywhere = any(t.roles and not t.roles_from for t in self.types.values())
+        # the types whose custom roles any owner may make (a roles line without `from`)
+        roles_anywhere = [t for t in self.types.values() if t.roles and not t.roles_from]
         for t in self.types.values():
             if "impersonate" in t.perms and t.name != "user":
                 fail(
@@ -725,7 +742,7 @@ class Core:
                         "AZ307",
                     )
         if roles_anywhere and not any("manage_roles" in t.perms for t in self.types.values()):
-            t = next(t for t in self.types.values() if t.roles and not t.roles_from)
+            t = roles_anywhere[0]
             assert t.roles is not None
             fail(
                 t.roles[2],
@@ -777,18 +794,15 @@ class Core:
         own line: a typo in a relation's only use would otherwise be reported as the relation being unused."""
         used: set[Name] = set()
 
-        def walk(t: Type, node: Expr, loc: Loc | None) -> None:
+        def walk(t: Type, node: Expr, loc: Loc) -> None:
             match node:
                 case ("ref", name):
-                    if loc is not None:
-                        self.lookup(t, name, loc)
+                    self.lookup(t, name, loc)
                     used.add((t.name, name))
                 case ("arrow", rel, perm) | ("arrow_on", rel, perm, _):
-                    if loc is not None:
-                        self.lookup(t, rel, loc)
+                    r, _ = self.targets(t, rel, loc)  # what a dot follows: a relation to objects
                     used.add((t.name, rel))
-                    r = t.relations.get(rel)
-                    for st, _sr in r.subjects() if r else []:
+                    for st, _sr in r.subjects():
                         used.add((st, perm))
                 case ("not", item):
                     walk(t, item, loc)
@@ -806,10 +820,7 @@ class Core:
                     if sr and sr != "*":
                         used.add((st, sr))
         for rule in self.rules:
-            governing = [t for t in self.types.values() if t.table == rule.table]
-            for t in governing:
-                # names are looked up here when one type governs the table (with several, each reads its own)
-                walk(t, rule.expr, rule.loc if len(governing) == 1 else None)
+            walk(self.governing(rule.table), rule.expr, rule.loc)
         for inv in self.pol.invariants:
             walk(self.T(inv.type), inv.expr, inv.loc)
         for test in self.tests:
@@ -921,48 +932,45 @@ class Core:
                 continue
             tnames = [tn for tn, _ in comp]
             first = self.T(comp[0][0]).perms[comp[0][1]]
-            # every dependency inside the component must be a top-level inheritance item
+            # a deny's inheritance (its base, split_denies) that comes back to it through another type's permission
+            for tn, pn in comp:
+                deny = self.T(tn).perms[pn]
+                if deny.base is not None and (tn, deny.base) in members and len(set(tnames)) > 1:
+                    fail(
+                        deny.loc,
+                        f"{tn}.{pn} has a deny, so it can only inherit within {tn} (like parent.{pn}), "
+                        f"not through permissions of other types",
+                        "AZ306",
+                    )
+            # every dependency inside the component must be a top-level inheritance item. split_inherit reads one
+            # (and refuses following a relation to groups, type:*, anyone or links: a tree links objects alone)
             for tn, pn in comp:
                 t, perm = self.T(tn), self.T(tn).perms[pn]
                 for item in self.top_items(perm):
-                    arrow, _conds = self.split_inherit(t, perm, item)
-                    if arrow:
-                        r = t.relations.get(arrow.rel)
-                        if r:
-                            for st, sr in r.subjects():
-                                if not sr and st in self.types and (st, arrow.perm) in members:
-                                    self.check_tree_relation(t, r, perm)
-                    else:
-                        inner: set[Name] = set()
-                        self.deps(t, item, inner)
-                        if inner & members and isinstance(item, And):
-                            for x in item.items:
-                                if (
-                                    isinstance(x, Arrow)
-                                    and x.rel in t.relations
-                                    and any(
-                                        not sr and (st, x.perm) in members for st, sr in t.relations[x.rel].subjects()
-                                    )
-                                ):
-                                    fail(
-                                        perm.loc,
-                                        f"inheritance through {x.rel} can only be narrowed with "
-                                        f"{{conditions}} on the row, e.g. ({x.rel}.{pn} and {{inherit}})",
-                                        "AZ304",
-                                    )
-                        if inner & members:
-                            fail(
-                                perm.loc,
-                                f"{tn}.{pn} depends on itself; a permission can only recurse as "
-                                f"'or rel.perm' (optionally 'and {{condition}}') through a relation "
-                                f"to objects, and a group only as 'member : group#member'",
-                                "AZ302",
-                            )
+                    if self.split_inherit(t, perm, item)[0] is not None:
+                        continue
+                    inner: set[Name] = set()
+                    self.deps(t, item, inner)
+                    if inner & members and isinstance(item, And):
+                        for x in item.items:
+                            if (
+                                isinstance(x, Arrow)
+                                and x.rel in t.relations
+                                and any(not sr and (st, x.perm) in members for st, sr in t.relations[x.rel].subjects())
+                            ):
+                                fail(
+                                    perm.loc,
+                                    f"inheritance through {x.rel} can only be narrowed with "
+                                    f"{{conditions}} on the row, e.g. ({x.rel}.{pn} and {{inherit}})",
+                                    "AZ304",
+                                )
+                    if inner & members:
+                        fail(perm.loc, DEPENDS_ON_ITSELF.format(f"{tn}.{pn}"), "AZ302")
             if len(set(tnames)) != len(tnames):
                 fail(
                     first.loc,
                     "permissions "
-                    + ", ".join(f"{a}.{b}" for a, b in sorted(comp))
+                    + ", ".join([f"{a}.{b}" for a, b in sorted(comp)])
                     + " inherit through each other; a recursion can use one permission per type",
                     "AZ302",
                 )
@@ -971,16 +979,6 @@ class Core:
             for v in comp:
                 self.recursive[v] = key
 
-    def check_tree_relation(self, t: Type, r: Relation, perm: Perm) -> None:
-        for src in r.sources:
-            if src.kind == "shared" and any(sr == "*" or st in ("anyone", "link") for st, sr in src.subjects):
-                fail(
-                    perm.loc,
-                    f"{t.name}.{r.name} is used for inheritance, so it can't be shared with "
-                    f"user:* (or another type:*), anyone or link",
-                    "AZ301",
-                )
-
     @staticmethod
     def top_items(perm: Perm) -> list[Expr]:
         return perm.expr.items if isinstance(perm.expr, Or) else [perm.expr]
@@ -1016,18 +1014,7 @@ class Core:
         members = set(self.scc_members[key])
         arrow, conds = self.split_inherit(t, perm, item)
         if arrow is None or conds is None:
-            # an 'and' with the inheritance arrow and something other than conditions
-            if isinstance(item, And):
-                for x in item.items:
-                    if isinstance(x, Arrow) and x.rel in t.relations:
-                        for st, sr in t.relations[x.rel].subjects():
-                            if not sr and (st, x.perm) in members:
-                                fail(
-                                    perm.loc,
-                                    f"inheritance through {x.rel} can only be narrowed with "
-                                    f"{{conditions}} on the row, e.g. ({x.rel}.{perm.name} and {{inherit}})",
-                                    "AZ304",
-                                )
+            # a plain item: analyze_recursion refused one that narrows the inheritance with more than conditions (AZ304)
             return [], item
         r = t.relations[arrow.rel]
         inside = [st for st, _ in r.subjects() if (st, arrow.perm) in members]
@@ -1137,19 +1124,17 @@ class Core:
 
     @staticmethod
     def caveat_sql(c: Caveat, alias: str = "g") -> str:
-        return with_uid(re.sub(r"\barg\s*\(\s*'([^']*)'\s*\)", rf"({alias}.caveat_args ->> '\1')", c.sql))
+        return with_uid(CAVEAT_ARG.sub(rf"({alias}.caveat_args ->> '\1')", c.sql))
 
     # --- functions over every type: one branch per type, the id converted to its key ----------------
     def id_vars(self) -> str:
         return "".join(f" v_{pt} {pt};" for pt in sorted({t.pktype for t in self.types.values()}))
 
-    def dispatch_type(self, per_type: Callable[[Type], str | None], missing_type: str = NO_SUCH_TYPE) -> str:
+    def dispatch_type(self, per_type: Callable[[Type], str], missing_type: str = NO_SUCH_TYPE) -> str:
         """CASE over types, with p_id checked and converted to the type's key in v_<pktype>."""
         branches = []
         for t in self.types.values():
             body = per_type(t)
-            if body is None:
-                continue
             branches.append(
                 f"    WHEN {lit(t.name)} THEN\n"
                 f"      IF NOT pg_catalog.pg_input_is_valid(p_id, {lit(t.keytype)}) THEN RETURN {self._invalid}; END IF;\n"
@@ -1211,19 +1196,6 @@ class Core:
             return f"{q(self.pk(t))}::text"
         return "ROW(" + ", ".join(f"{q(c)}::{ty}" for c, ty in t.key) + ")::text"
 
-    def subject_text(self, src: Source, a: str) -> str:
-        """A column/table source's subject id as text (for any of its subject types)."""
-        col = self.source_columns(src)
-        if not src.type_col:
-            st = self.types.get(src.subjects[0][0])
-            return self.ref_text(st, a, col) if st else f"{a}.{q(cols(col)[0])}::text"
-        if not any(self.T(st).composite for st, _ in src.subjects if st in self.types):
-            return f"{a}.{q(cols(col)[0])}::text"
-        whens = " ".join(
-            f"WHEN {lit(st)} THEN {self.ref_text(self.T(st), a, col)}" for st, _ in src.subjects if st in self.types
-        )
-        return f"(CASE {a}.{q(src.type_col)} {whens} END)"
-
     def key_text(self, t: Type, a: str) -> str:
         return self.key(t, a) if t.composite else f"{self.key(t, a)}::text"
 
@@ -1392,7 +1364,10 @@ class Core:
         if not direct:
             if loops:
                 fail(r.loc, f"{t.name}.{r.name} only contains itself; add a source of users", "AZ209")
-            if ext:
+            # the column sources left out (row_relation checks them on the row) may give users: then these give none
+            if ext and any(
+                sr or self.is_principal(st) for src in r.sources if src.kind == "column" for st, sr in src.subjects
+            ):
                 direct.append(f"SELECT NULL::{t.pktype} AS id WHERE false")
             else:
                 fail(
@@ -1488,8 +1463,9 @@ class Core:
                         f"AND g.subject_type = {lit(st)} AND g.subject_relation = '' "
                         f"AND g.subject_id {self.ids_in(inner, text=True)} AND {self.live()}"
                     )
-        if not parts:
-            parts.append(f"SELECT NULL::{t.pktype} AS id WHERE false")
+        # each type is named by a source read here: without the column sources (ext, row_arrow), the arrow follows
+        # every type of the relation, which the sources left name some of
+        assert parts, f"no source of {t.name}.{r.name} names {', '.join(targets)}"
         self.add_view(view, union(parts), f"-- {t.name}.{r.name}.{perm_name}\n", t)
         self.view_state[view] = "done"
         return view
@@ -1685,12 +1661,13 @@ class Core:
                 return max(self.item_cost(t, x) for x in items)
             case ("arrow", rel, perm) | ("arrow_on", rel, perm, _):
                 r = t.relations.get(rel)
-                if r is None:
-                    return 2
+                assert r is not None, "validate refuses a dot that follows anything but a relation (AZ301)"
                 on = only_on(item)
                 names = on if on is not None else [st for st, _ in r.subjects()]
                 return max(max(1, self.item_cost(self.T(st), Ref("ref", perm))) for st in names)
-            case ("ref", name):
+            case _:
+                assert isinstance(item, Ref), f"not an expression: {item!r}"
+                name = item.name
                 if name in t.relations:
                     rn = t.relations[name]
                     direct = all(src.kind == "column" for src in rn.sources) and all(
@@ -1701,7 +1678,6 @@ class Core:
                     return 2
                 perm_ = t.perms.get(name)
                 return max((self.item_cost(t, i) for i in self.top_items(perm_)), default=0) if perm_ else 2
-        return 2
 
     def start_function(self, t: Type, perm: Perm, flatten: Flatten) -> str:
         name = f"{t.name}__{perm.name}__start"
@@ -1769,8 +1745,7 @@ class Core:
         permission's view, where one that inherits stays a name (its view walks a tree, which its operands
         written out here would not)."""
         key = (t.name, perm.name)
-        if key in stack:
-            fail(perm.loc, f"{t.name}.{perm.name} depends on itself", "AZ302")
+        assert key not in stack, "analyze_recursion refuses a permission that depends on itself (AZ302)"
         out = []
         for item in self.top_items(perm):
             if isinstance(item, Ref) and item.name in t.perms and not (views and (t.name, item.name) in self.recursive):
@@ -1791,7 +1766,8 @@ class Core:
         return seen
 
     def lookup_key(self, t: Type, item: Expr) -> tuple[str, str, str | None] | None:
-        """(relation, permission, condition) for rel.perm or (rel.perm and {cond})."""
+        """(relation, permission, condition) for rel.perm or (rel.perm and {cond}), where rel links to objects (one
+        to anyone or links is refused where the arrow is made, targets)."""
         cond = None
         if isinstance(item, And) and len(item.items) == 2:
             arrows = [x for x in item.items if isinstance(x, Arrow)]
@@ -1801,7 +1777,7 @@ class Core:
         if (
             isinstance(item, Arrow)
             and item.rel in t.relations
-            and all(not sr for _, sr in t.relations[item.rel].subjects())
+            and all(not sr and st in self.types for st, sr in t.relations[item.rel].subjects())
         ):
             return (item.rel, item.perm, cond)
         return None
@@ -1871,14 +1847,14 @@ class Core:
                 )
             case ("arrow", rel, perm_name) | ("arrow_on", rel, perm_name, _):
                 return self.row_arrow(t, alias, node, rel, perm_name, loc, point, invoker)
-            case ("ref", name):
-                self.lookup(t, name, loc)
-                if name in t.relations:
-                    return self.row_relation(t, t.relations[name], alias, loc, point)
-                perm = t.perms[name]
+            case _:
+                assert isinstance(node, Ref), f"not an expression: {node!r}"
+                self.lookup(t, node.name, loc)
+                if node.name in t.relations:
+                    return self.row_relation(t, t.relations[node.name], alias, loc, point)
+                perm = t.perms[node.name]
                 items = self.cheapest_first(t, self.prune(t, self.flat_items(t, perm, stack)))
                 return or_join([self.row_sql(t, alias, item, perm.loc, point=point, invoker=invoker) for item in items])
-        raise AssertionError(f"not an expression: {node!r}")
 
     def definer_cond(self, t: Type, sql: str, alias: str) -> str:
         """A condition that reads more than its row's columns, where the app role checks it: a call of a function

package/command/authzlib/conditions.py

@@ -10,12 +10,19 @@ which (evaluate.Data.cond).
 The grammar: or < and < not < a comparison (`=`, `<>`, `!=`, `<`, `<=`, `>`, `>=`), `is [not] null`,
 `[not] in (...)`, of a column (`col`, `this.col`) with a constant (`'text'`, a number, `true`, `false`, `null`)
 or `authz.uid()`; a column alone is a boolean. Values follow SQL's three-valued logic: NULL compares to nothing.
+
+Only what means the same whatever the column's type and collation, which a condition doesn't say: no text in
+order (`{name < 'b'}` follows the database's collation), no text Postgres would read as the column's number or
+boolean (`{size = '10'}`, `{done = 't'}`), no order against authz.uid() (the user key's type decides it). Those
+are left to the database too. A column a relation reads holds the linked ids' text: compared with a number, as a
+number (tests/conditions_test.py asks Postgres the same questions).
 """
 
 from __future__ import annotations
 
 import re
 from collections.abc import Mapping
+from decimal import Decimal
 from functools import cache
 from typing import NamedTuple, TypeAlias
 
@@ -156,9 +163,7 @@ class Parser:
                 values.append(self.constant())
             self.take("p", ")")
             return In(left, tuple(values), negated)
-        if negated:
-            raise NotSimple("not")
-        return left
+        return left  # (`not` was taken only before an `in`)
 
     def operand(self) -> Node:
         if self.peek("p", "("):
@@ -178,7 +183,10 @@ class Parser:
             return self.take("str")[1:-1].replace("''", "'")
         if self.peek("num"):
             text = self.take("num")
-            return float(text) if "." in text else int(text)
+            try:
+                return float(text) if "." in text else int(text)
+            except ValueError:  # more digits than Python reads as a whole number (4300): the database's to read
+                raise NotSimple(text[:40]) from None
         if self.peek("word", "true") or self.peek("word", "false"):
             return self.take("word") == "true"
         if self.peek("word", "null"):
@@ -187,6 +195,32 @@ class Parser:
         raise NotSimple(str(self.toks[self.i :]))
 
 
+# text Postgres reads as a number when the column is one ('10', ' 1.5e3', '0x1A', 'NaN'), or as a boolean: these
+# words, any start of them ('t', 'of'), whatever the case
+CASTS = re.compile(
+    r"\s*[+-]?(?:\d[\d_]*(?:\.[\d_]*)?(?:e[+-]?\d+)?|\.\d[\d_]*(?:e[+-]?\d+)?|0[xob][\da-f_]+|nan|inf|infinity)\s*",
+    re.IGNORECASE,
+)
+BOOLEANS = ("true", "false", "yes", "no", "on", "off", "1", "0")
+
+
+def plain(v: Scalar) -> bool:
+    """Whether a constant means the same whatever the column's type: not text Postgres could read as a number or
+    a boolean."""
+    if not isinstance(v, str):
+        return True
+    word = v.strip().lower()
+    return not (CASTS.fullmatch(v) or (word and any(b.startswith(word) for b in BOOLEANS)))
+
+
+def number(v: Scalar) -> Decimal | None:
+    """A number as one, and so a linked id's text that is one ('10': owner_id holds the id of its user)."""
+    if isinstance(v, bool) or v is None:
+        return None
+    # (Decimal reads every int and float as text, and every run of digits, whatever the script)
+    return Decimal(str(v)) if isinstance(v, (int, float)) or re.fullmatch(r"-?\d+", v) else None
+
+
 @cache
 def simple(sql: str) -> Node | None:
     """The condition as facts about its row's columns, or None when it is more than that."""
@@ -198,11 +232,21 @@ def simple(sql: str) -> Node | None:
     # a column compared with a column, or a constant on its own, is not one the evaluator reads
     def fine(n: Node) -> bool:
         match n:
-            case Cmp(left=a, right=b):
-                return sum(isinstance(x, Col) for x in (a, b)) == 1 and all(
-                    isinstance(x, (Col, Const, Uid)) for x in (a, b)
+            case Cmp(op=op, left=a, right=b):
+                ordered = op not in ("=", "<>")
+                return (
+                    sum(isinstance(x, Col) for x in (a, b)) == 1
+                    and all(isinstance(x, (Col, Const, Uid)) for x in (a, b))
+                    and all(
+                        plain(x.value) and not (ordered and isinstance(x.value, str))
+                        for x in (a, b)
+                        if isinstance(x, Const)
+                    )
+                    and not (ordered and any(isinstance(x, Uid) for x in (a, b)))
                 )
-            case IsNull(item=x) | In(item=x):
+            case In(item=x, values=values):
+                return isinstance(x, Col) and all(plain(v) for v in values)
+            case IsNull(item=x):
                 return isinstance(x, Col)
             case Bool(items=items):
                 return all(fine(x) for x in items)
@@ -230,15 +274,17 @@ def columns_of(node: Node) -> dict[str, list[tuple[str, Scalar]]]:
                 assert isinstance(col, Col)
                 if isinstance(other, Uid):
                     add(col.name, "uid")
-                elif isinstance(other, Const):
+                else:
+                    assert isinstance(other, Const)  # (simple() compares a column with a constant or authz.uid())
                     add(col.name, op, other.value)
             case IsNull(item=Col(name=c)):
                 add(c, "null")
             case In(item=Col(name=c), values=values):
                 for v in values:
                     add(c, "in", v)
-            case Bool(items=items):
-                for x in items:
+            case _:
+                assert isinstance(n, Bool), f"not a condition: {n!r}"  # (simple() gives nothing else)
+                for x in n.items:
                     walk(x)
 
     walk(node)
@@ -251,25 +297,27 @@ def order(op: str, sign: int) -> bool:
 
 
 def compare(op: str, a: Scalar, b: Scalar) -> bool | None:
-    """a op b as SQL compares them: NULL with anything is NULL; numbers as numbers, the rest as their text."""
+    """a op b as SQL compares them: NULL with anything is NULL; a number with a number (or an id's text that is
+    one) as numbers, the rest as their text."""
     if a is None or b is None:
         return None
-    if isinstance(a, (int, float)) and isinstance(b, (int, float)):
-        x, y = float(a), float(b)
+    x, y = number(a), number(b)
+    if x is not None and y is not None and not (isinstance(a, str) and isinstance(b, str)):
         return order(op, (x > y) - (x < y))
     s, t = str(a).lower() if isinstance(a, bool) else str(a), str(b).lower() if isinstance(b, bool) else str(b)
     return order(op, (s > t) - (s < t))
 
 
 def value(n: Node, row: Mapping[str, Scalar], uid: str | None) -> Scalar:
+    """An operand's value: a column's, a constant, or the user's id (simple() compares nothing else)."""
     match n:
         case Col(name=c):
             return row.get(c)
         case Const(value=v):
             return v
-        case Uid():
+        case _:
+            assert isinstance(n, Uid), f"not an operand: {n!r}"
             return uid
-    return truth(n, row, uid)
 
 
 def truth(n: Node, row: Mapping[str, Scalar], uid: str | None) -> bool | None:
@@ -296,10 +344,10 @@ def truth(n: Node, row: Mapping[str, Scalar], uid: str | None) -> bool | None:
         case Bool(op="and", items=items):
             got = [truth(x, row, uid) for x in items]
             return False if False in got else (None if None in got else True)
-        case Bool(op="or", items=items):
-            got = [truth(x, row, uid) for x in items]
+        case _:
+            assert isinstance(n, Bool) and n.op == "or", f"not a condition: {n!r}"  # (simple() gives nothing else)
+            got = [truth(x, row, uid) for x in n.items]
             return True if True in got else (None if None in got else False)
-    raise ValueError(f"not a condition: {n!r}")
 
 
 def uses_uid(node: Node) -> bool: