dataplat 0.2.1__tar.gz → 0.2.2__tar.gz

{dataplat-0.2.1 → dataplat-0.2.2}/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## 0.2.2
+
+Closes the six defects 0.2.1's integration suite found and pinned as expected
+failures. No expected failures remain.
+
+### Fixed
+
+- `dp db role show` claimed `Password set: yes` for every role, including a
+  passwordless `NOLOGIN` group. The attribute query read `rolpassword` from
+  `pg_roles`, whose view definition returns the literal `'********'` and can
+  never be NULL. Only `pg_authid` holds the real verifier and it is
+  superuser-only, so the field is now tri-state and reports `unknown` — with a
+  hint saying why — when the connecting role cannot read it. The privilege is
+  probed before the query rather than discovered by catching an error, since a
+  permission failure would abort the surrounding transaction.
+
+- `dp db describe <schema>` never reported `USAGE` grants. The query read
+  `information_schema.usage_privileges`, which on PostgreSQL does not cover
+  schemas at all, so the USAGE half of the union always returned nothing. The
+  PostgreSQL path now reads the schema ACL directly.
+
+- `dp db role show` under-counted a role's tables when it owned a partitioned
+  table. Both `relkind` `'r'` and `'p'` map to the label "table" and the
+  aggregation assigned rather than accumulated, so one group overwrote the
+  other while the total was summed separately and stayed right — the per-schema
+  breakdown contradicted its own total.
+
+- `dp db dbt-orphans purge` aborted the whole batch when a single relation had
+  vanished between scan and purge. The generated statement now uses
+  `IF EXISTS`, matching `top-tables`, so a missing relation is a no-op. When a
+  dependent object genuinely blocks a drop the purge still stops — that
+  all-or-nothing property is deliberate for a destructive batch — but it now
+  names the relation and everything depending on it instead of surfacing a raw
+  driver error, and records the blockage in the audit log.
+
+- `dp db describe <relation>` raised nothing but returned an invalid result for
+  a non-view relation: `pg_get_viewdef()` yields NULL rather than erroring, and
+  the PostgreSQL branch returned a view definition whose `sql` was `None`,
+  violating its own annotation. It now raises, as the Redshift branch already
+  did.
+
+- `dp db long-queries --history` died with a driver traceback on any server
+  where `pg_stat_statements` is installed but not preloaded — the most common
+  misconfiguration. The guard that was meant to catch this probed the view's
+  columns, which PostgreSQL answers from the view definition without invoking
+  the extension, so the probe always succeeded. The failure is now reported as
+  an actionable error naming `shared_preload_libraries` and the required
+  restart.
+
+### Changed
+
+- `RoleAttributes.password_set` widened from `bool` to `bool | None`, where
+  `None` means "not determinable by this connection". Relevant only if you
+  import the dataclass; the CLI renders the third state as `unknown`.
+
+- On PostgreSQL, `dp db describe <schema>` privileges now come from the schema
+  ACL rather than a `has_schema_privilege` scan. A role holding `CREATE` only
+  through membership in a granted role is no longer listed as its own row, and
+  `grantor` and `WITH GRANT OPTION` are now real values where the previous
+  CREATE half hardcoded them.
+
 ## 0.2.1
 
 ### Fixed

{dataplat-0.2.1 → dataplat-0.2.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dataplat
-Version: 0.2.1
+Version: 0.2.2
 Summary: One command to manage any shape of data platform: databases, ingestion, BI, cloud, and CI.
 Project-URL: Homepage, https://github.com/hanslemm/dataplat
 Project-URL: Repository, https://github.com/hanslemm/dataplat

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/cli/db/dbt_orphans.py

@@ -20,6 +20,8 @@ from dataplat.services.db.connection import SqlEngine
 from dataplat.services.db.orphans import (
     DEPRECATED_SUFFIX,
     LIVE_STATUSES,
+    BlockedEntry,
+    DependentObjectsError,
     DropEntry,
     ObjectKind,
     RenameEntry,
@@ -661,7 +663,19 @@ def purge_cmd(
         help="Path to a file with one exclusion token per line.",
     ),
 ) -> None:
-    """Permanently drop every object ending in _deprecated (irreversible)."""
+    """Permanently drop every object ending in _deprecated (irreversible).
+
+    All-or-nothing per target, by design: every drop for one warehouse runs
+    inside a single transaction, so if the warehouse refuses one of them
+    nothing is dropped for that target and the error names the blocking
+    relation. Keeping the drops that already succeeded would need either a
+    SAVEPOINT per object (Redshift has none) or a commit per object (which
+    would break the guarantee that --dry-run writes nothing) — and for a
+    destructive batch, stopping on the first surprise is the safer default. No
+    CASCADE is issued either, so a live view or foreign key still pointing at a
+    _deprecated relation is a real signal: resolve the dependents the error
+    lists, then re-run.
+    """
     if log is None:
         log = _timestamped_log_path(PURGE_LOG_PREFIX)
 
@@ -691,24 +705,48 @@ def purge_cmd(
     )
 
     all_drops: list[DropEntry] = []
+    blocked: list[BlockedEntry] = []
     try:
         for label, engine, env_prefix in engines:
-            all_drops.extend(
-                _purge_for_engine(
-                    label,
-                    engine,
-                    env_prefix=env_prefix,
-                    excluded_user_schemas=excluded_user_schemas,
-                    excluded_user_relations=excluded_user_relations,
-                    dry_run=dry_run,
-                    renamed_at=renamed_at,
-                    cutoff=cutoff,
-                    include_unknown=include_unknown,
+            try:
+                all_drops.extend(
+                    _purge_for_engine(
+                        label,
+                        engine,
+                        env_prefix=env_prefix,
+                        excluded_user_schemas=excluded_user_schemas,
+                        excluded_user_relations=excluded_user_relations,
+                        dry_run=dry_run,
+                        renamed_at=renamed_at,
+                        cutoff=cutoff,
+                        include_unknown=include_unknown,
+                    )
                 )
-            )
+            except DependentObjectsError as exc:
+                # The engine's transaction is already rolled back, so the drops
+                # it had made are (correctly) absent from all_drops. Record the
+                # refused attempt so the audit log shows why this target did
+                # nothing, then re-raise with the [<engine>] prefix every other
+                # error from this command carries.
+                blocked.append(
+                    BlockedEntry(
+                        database=label,
+                        schema=exc.schema,
+                        name=exc.name,
+                        kind=exc.kind,
+                        dependents=exc.dependents,
+                    )
+                )
+                raise ServiceError(f"[{label}] {exc}") from exc
     except ServiceError as exc:
-        _write_purge_log(log, all_drops, dry_run=dry_run)
+        _write_purge_log(log, all_drops, dry_run=dry_run, blocked=blocked)
         console.print(f"[red]{esc(exc)}[/red]")
+        if blocked:
+            console.print(
+                "[yellow]Nothing was dropped for that target: the purge is one "
+                "transaction, so a refused drop rolls the whole batch "
+                "back.[/yellow]"
+            )
         console.print(
             f"[yellow]Partial purge log written to {esc(log)} "
             f"({len(all_drops)} entries).[/yellow]"
@@ -839,12 +877,22 @@ def _drop_one(
     return DropEntry(database=label, schema=schema, name=name, kind=kind)
 
 
-def _write_purge_log(log_path: str, entries: list[DropEntry], *, dry_run: bool) -> None:
+def _write_purge_log(
+    log_path: str,
+    entries: list[DropEntry],
+    *,
+    dry_run: bool,
+    blocked: list[BlockedEntry] | None = None,
+) -> None:
     payload = {
         "generated_at": datetime.now(UTC).isoformat(),
         "dry_run": dry_run,
         "source": "dbt-orphans-purge",
         "drops": entries,
+        # A refused drop rolls its target's transaction back, so "drops" cannot
+        # hold the attempt; recorded separately or the log would show a purge
+        # that raised as having done nothing at all.
+        "blocked": blocked or [],
     }
     with open(log_path, "w") as f:
         json.dump(payload, f, indent=4)

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/cli/db/role.py

@@ -72,6 +72,19 @@ def _more_line(hidden: int) -> str:
     return f"  [dim italic]… and {hidden} more (raise --limit to see all).[/dim italic]"
 
 
+def _password_set_value(password_set: bool | None) -> str:
+    """Render the tri-state ``password_set`` as markup.
+
+    ``None`` means the server refused to say (pg_authid is superuser-only), and
+    the reason travels with the word: a bare "unknown" in a security report
+    reads as a tool defect, and rendering it as "no" would be a false negative
+    on exactly the field an auditor came for.
+    """
+    if password_set is None:
+        return "unknown [dim](needs superuser to read pg_authid)[/dim]"
+    return "yes" if password_set else "no"
+
+
 def _attributes_metadata(attrs: RoleAttributes) -> list[tuple[str, str]]:
     flags: list[str] = []
     if attrs.superuser:
@@ -97,7 +110,11 @@ def _attributes_metadata(attrs: RoleAttributes) -> list[tuple[str, str]]:
         # The title card renders metadata values as markup, and this one is
         # warehouse data (rolvaliduntil rendered by the driver).
         metadata.append(("Valid until", esc(attrs.valid_until)))
-    if attrs.password_set:
+    # `is True` on purpose: password_set is tri-state, and the card has room
+    # only for a bare word. An unexplained "unknown" chip is worse than no
+    # chip, so the unknown case is left to the Attributes table, which has
+    # room to say why.
+    if attrs.password_set is True:
         metadata.append(("Password", "set"))
     return metadata
 
@@ -122,7 +139,7 @@ def _render_attributes(
         "Connection limit",
         "unlimited" if attrs.connection_limit < 0 else str(attrs.connection_limit),
     )
-    table.add_row("Password set", "yes" if attrs.password_set else "no")
+    table.add_row("Password set", _password_set_value(attrs.password_set))
     table.add_row("Valid until", cell(attrs.valid_until or "—"))
     console.print(_indent(table))
 

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/services/db/describe.py

@@ -665,6 +665,12 @@ def fetch_view_definition(cursor: Any, oid: int, engine: SqlEngine) -> ViewDefin
     if row is None:
         raise TargetNotFoundError(f"view with oid {oid} not found")
     sql, is_updatable, check_option = row
+    # pg_get_viewdef() does not error on a non-view oid, it returns NULL, so a
+    # table's oid produces a row whose definition is missing. Reject it the way
+    # the Redshift branch above does: returning ViewDefinition(sql=None) would
+    # break this dataclass's own `sql: str` contract for every caller.
+    if sql is None:
+        raise TargetNotFoundError(f"view with oid {oid} not found")
     updatable = isinstance(is_updatable, str) and is_updatable.upper() == "YES"
     if check_option is None or check_option == "NONE":
         check_option_value: str | None = None
@@ -752,7 +758,40 @@ ORDER BY c.relkind, c.relname
 """
 
 
-_SCHEMA_PRIVILEGES_SQL = """
+# PostgreSQL exposes schema ACLs only through pg_namespace.nspacl; there is no
+# information_schema view for them. usage_privileges reports DOMAIN, COLLATION,
+# FDW, foreign server and sequence object types and never 'SCHEMA', so the
+# USAGE half of the old shared query silently matched zero rows and every
+# GRANT USAGE ON SCHEMA was missing from the report.
+#
+# The COALESCE is load-bearing: nspacl stays NULL until the first GRANT or
+# REVOKE touches the schema, and NULL means "the built-in default" -- the owner
+# holding USAGE + CREATE -- not "nobody holds anything". acldefault('n', owner)
+# materialises that default so a freshly created schema still reports its
+# owner's privileges.
+#
+# Reading the ACL also makes grantor and WITH GRANT OPTION truthful: the CREATE
+# half of the old query derived grantees from has_schema_privilege() and had to
+# hardcode grantor='' and with_grant_option=false.
+_SCHEMA_PRIVILEGES_SQL_POSTGRES = """
+SELECT
+    CASE WHEN (acl).grantee = 0 THEN 'PUBLIC'
+         ELSE pg_get_userbyid((acl).grantee) END AS grantee,
+    (acl).privilege_type AS privilege_type,
+    (acl).is_grantable AS with_grant_option,
+    pg_get_userbyid((acl).grantor) AS grantor
+FROM pg_namespace n
+CROSS JOIN LATERAL aclexplode(COALESCE(n.nspacl, acldefault('n', n.nspowner))) AS acl
+WHERE n.nspname = %s
+ORDER BY grantee, privilege_type
+"""
+
+
+# Unchanged from when this query was shared by both engines, and deliberately
+# NOT switched to the aclexplode form above: Redshift has no aclexplode() and
+# no cluster is available to test a replacement against. Its USAGE reporting is
+# therefore still unverified and probably as empty as PostgreSQL's was.
+_SCHEMA_PRIVILEGES_SQL_REDSHIFT = """
 SELECT grantee, privilege_type, is_grantable = 'YES', grantor
 FROM information_schema.usage_privileges
 WHERE object_schema = %s AND object_type = 'SCHEMA'
@@ -820,9 +859,19 @@ def fetch_schema_contents(
     ]
 
 
-def fetch_schema_privileges(cursor: Any, schema: str) -> list[PrivilegeGrant]:
-    """Return USAGE + CREATE grants for the schema."""
-    cursor.execute(_SCHEMA_PRIVILEGES_SQL, (schema, schema))
+def fetch_schema_privileges(
+    cursor: Any, schema: str, engine: SqlEngine
+) -> list[PrivilegeGrant]:
+    """Return USAGE + CREATE grants for the schema.
+
+    On PostgreSQL these come from ``pg_namespace.nspacl``, which lists explicit
+    ACL entries plus the owner's implicit default; a role that only holds the
+    privilege through membership in a granted role is not a separate row.
+    """
+    if engine == SqlEngine.redshift:
+        cursor.execute(_SCHEMA_PRIVILEGES_SQL_REDSHIFT, (schema, schema))
+    else:
+        cursor.execute(_SCHEMA_PRIVILEGES_SQL_POSTGRES, (schema,))
     return [PrivilegeGrant(*row) for row in cursor.fetchall()]
 
 
@@ -1044,7 +1093,7 @@ def describe_schema(
 ) -> SchemaDescription:
     """Compose a full schema description by invoking each fetcher."""
     header = fetch_schema_header(cursor, ref.schema)
-    privileges = fetch_schema_privileges(cursor, ref.schema)
+    privileges = fetch_schema_privileges(cursor, ref.schema, engine)
     default_privileges = fetch_schema_default_privileges(cursor, ref.schema, engine)
     contents = fetch_schema_contents(cursor, ref.schema, engine)
     return SchemaDescription(

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/services/db/long_queries.py

@@ -294,6 +294,21 @@ class QueryHistoryRow:
     query_text: str
 
 
+# SQLSTATE 55000 (object_not_in_prerequisite_state). pg_stat_statements' C
+# function raises it — "must be loaded via shared_preload_libraries" — when the
+# extension exists in the catalog but was never preloaded. Matched by code
+# rather than by message text or by exception class: the message is not part of
+# any contract, and this module deliberately never imports psycopg so it stays
+# drivable by the fake cursors the unit suite uses.
+_NOT_LOADED_SQLSTATE = "55000"
+
+_PGSS_NOT_LOADED = (
+    "pg_stat_statements is installed but not loaded. Add it to "
+    "shared_preload_libraries in postgresql.conf and RESTART the server "
+    "(a config reload is not enough — it is a preloaded library)."
+)
+
+
 def fetch_query_history_postgres(
     cursor: Any,
     *,
@@ -305,7 +320,8 @@ def fetch_query_history_postgres(
     Column names changed across pg_stat_statements versions
     (``total_time`` -> ``total_exec_time``), so they are discovered from the
     result-set description. Raises :class:`ValidationError` when the
-    extension's columns are missing/incompatible.
+    extension's columns are missing/incompatible, and when the extension is
+    present but was never preloaded.
     """
     cursor.execute("SELECT * FROM pg_stat_statements LIMIT 0")
     column_names = {desc.name.lower() for desc in (cursor.description or [])}
@@ -335,7 +351,18 @@ def fetch_query_history_postgres(
         ORDER BY {_quote(max_col)} DESC
         LIMIT %s
     """
-    cursor.execute(sql, (min_seconds, limit))
+    # The column probe above cannot detect a non-preloaded extension: Postgres
+    # answers `SELECT * FROM pg_stat_statements LIMIT 0` from the view
+    # definition alone, never invoking the extension's C function, so discovery
+    # returns the full and correct column list and only this read fails. Left
+    # unhandled it reaches the user as a traceback instead of the actionable
+    # error the probe was meant to produce.
+    try:
+        cursor.execute(sql, (min_seconds, limit))
+    except Exception as exc:  # narrowed to SQLSTATE 55000 immediately below
+        if getattr(exc, "sqlstate", None) != _NOT_LOADED_SQLSTATE:
+            raise
+        raise ValidationError(_PGSS_NOT_LOADED) from exc
     return [
         QueryHistoryRow(
             calls=int(row[0]),

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/services/db/orphans.py

@@ -17,7 +17,7 @@ from typing import Any, Literal, TypedDict
 import psycopg
 from psycopg import sql
 
-from dataplat.core.errors import ConfigError
+from dataplat.core.errors import ConfigError, ServiceError
 from dataplat.services.db._like import LIKE_ESCAPE_CLAUSE, like_escape
 from dataplat.services.db.connection import (
     DbConnectionParams,
@@ -105,6 +105,45 @@ class DropEntry(TypedDict):
     kind: ObjectKind
 
 
+class BlockedEntry(TypedDict):
+    """Serialized record of a drop the warehouse refused, written to the purge log.
+
+    A refused drop rolls its whole purge transaction back, so the attempt
+    leaves no trace in ``drops``. Without this the audit log would show the
+    purge as a silent no-op for that warehouse.
+    """
+
+    database: str
+    schema: str
+    name: str
+    kind: ObjectKind
+    dependents: str
+
+
+class DependentObjectsError(ServiceError):
+    """A ``DROP`` was refused because other objects still depend on the relation.
+
+    Carries the blocked relation and the server's own dependency listing so the
+    caller can name both in its error output and its audit log, instead of
+    surfacing a bare ``psycopg.errors.DependentObjectsStillExist`` that says
+    nothing the user can act on.
+    """
+
+    def __init__(
+        self, schema: str, name: str, kind: ObjectKind, dependents: str
+    ) -> None:
+        self.schema = schema
+        self.name = name
+        self.kind = kind
+        self.dependents = dependents
+        blockers = f" ({dependents})" if dependents else ""
+        super().__init__(
+            f"Cannot drop {kind} {schema}.{name}: other objects still depend "
+            f"on it{blockers}. Drop or repoint the dependent object(s), then "
+            f"re-run the purge."
+        )
+
+
 def resolve_orphans_connection_params(
     engine: SqlEngine, *, env_prefix: str
 ) -> DbConnectionParams | None:
@@ -238,15 +277,22 @@ def rename_object(
     )
 
 
+# ``IF EXISTS`` is dialect-safe: PostgreSQL and Redshift both accept it on all
+# three kinds this drops, so the keyword can be shared. It is load-bearing
+# because the purge runs every drop of one warehouse inside a single
+# transaction — without it, a relation that vanished between the scan and its
+# DROP raised UndefinedTable and rolled back the drops that had already
+# succeeded. ``IF EXISTS`` only suppresses "does not exist"; a wrong-kind
+# keyword still errors, so each kind keeps its own DROP.
 _DROP_KEYWORDS: dict[ObjectKind, str] = {
-    "table": "DROP TABLE",
-    "view": "DROP VIEW",
-    "matview": "DROP MATERIALIZED VIEW",
+    "table": "DROP TABLE IF EXISTS",
+    "view": "DROP VIEW IF EXISTS",
+    "matview": "DROP MATERIALIZED VIEW IF EXISTS",
 }
 
 
 def build_drop_statement(schema: str, name: str, kind: ObjectKind) -> sql.Composed:
-    """Build a ``DROP …`` statement for the given object kind."""
+    """Build a ``DROP … IF EXISTS`` statement for the given object kind."""
     return sql.SQL("{keyword} {schema}.{name}").format(
         keyword=sql.SQL(_DROP_KEYWORDS[kind]),
         schema=sql.Identifier(schema),
@@ -254,8 +300,31 @@ def build_drop_statement(schema: str, name: str, kind: ObjectKind) -> sql.Compos
     )
 
 
+def _dependents_detail(exc: psycopg.Error) -> str:
+    """Flatten the server's dependency ``DETAIL`` onto one line.
+
+    The server already names every dependent object, so no extra catalog query
+    (which would have to be written twice for Redshift) is needed. The DETAIL
+    is one line per dependent, and the CLI prints errors as single Rich lines.
+    """
+    detail = (exc.diag.message_detail or "").strip()
+    return "; ".join(line.strip() for line in detail.splitlines() if line.strip())
+
+
 def drop_object(cur: Any, schema: str, name: str, kind: ObjectKind) -> None:
-    cur.execute(build_drop_statement(schema, name, kind))
+    """Drop ``schema.name``, reporting a dependency refusal in actionable terms.
+
+    No ``CASCADE`` is issued, so a live view or foreign key still pointing at
+    the relation is a legitimate blocker rather than something to bulldoze —
+    but the raw ``DependentObjectsStillExist`` names neither the relation nor
+    the blockers once it has bubbled up through the purge, so translate it.
+    """
+    try:
+        cur.execute(build_drop_statement(schema, name, kind))
+    except psycopg.errors.DependentObjectsStillExist as exc:
+        raise DependentObjectsError(
+            schema, name, kind, _dependents_detail(exc)
+        ) from exc
 
 
 def fetch_deprecated_objects(

{dataplat-0.2.1 → dataplat-0.2.2}/dataplat/services/db/role.py

@@ -93,15 +93,51 @@ class RoleAttributes:
     replication: bool
     bypass_rls: bool
     connection_limit: int
-    password_set: bool
+    # Tri-state on PostgreSQL: True / False when the real password store was
+    # readable, None for "cannot determine" when it was not. Only pg_authid
+    # knows, and it is superuser-only, so a plain bool would have to guess --
+    # and for a field an auditor reads, "unknown" beats a confident guess.
+    password_set: bool | None
     valid_until: str | None
 
 
+# pg_roles.rolpassword is the literal '********' for every row -- the view
+# definition hard-codes it -- so `rolpassword IS NOT NULL` asked there is
+# always true and says nothing about whether a password exists. pg_authid
+# holds the real verifier and is superuser-only by default.
+#
+# Naming pg_authid at all is what fails: the executor checks privileges for
+# every range table before it runs anything, so no CASE branch or unexecuted
+# subquery can hide the reference. The resulting error aborts the transaction,
+# which would also kill the membership / ownership / privilege queries
+# describe_role issues after this one. Asking first avoids the error entirely:
+# has_table_privilege() is an ordinary function call needing no privileges. It
+# also answers the real question rather than "am I superuser" -- a role that
+# was explicitly GRANTed SELECT on pg_authid gets the true answer.
+_PG_AUTHID_READABLE_SQL = """
+SELECT has_table_privilege('pg_authid', 'SELECT')
+"""
+
 _ATTRS_SQL_POSTGRES = """
+SELECT r.rolcanlogin, r.rolsuper, r.rolcreatedb, r.rolcreaterole,
+       r.rolinherit, r.rolreplication, r.rolbypassrls,
+       r.rolconnlimit,
+       (a.rolpassword IS NOT NULL) AS password_set,
+       r.rolvaliduntil::text
+FROM pg_roles r
+JOIN pg_authid a ON a.oid = r.oid
+WHERE r.rolname = %s
+"""
+
+# Same columns in the same order as _ATTRS_SQL_POSTGRES so one unpack serves
+# both, with password_set pinned to NULL. pg_roles is a view over pg_authid
+# and exposes every row of it, so dropping the join loses nothing but the one
+# column this session may not read.
+_ATTRS_SQL_POSTGRES_NO_AUTHID = """
 SELECT rolcanlogin, rolsuper, rolcreatedb, rolcreaterole,
        rolinherit, rolreplication, rolbypassrls,
        rolconnlimit,
-       (rolpassword IS NOT NULL) AS password_set,
+       NULL::boolean AS password_set,
        rolvaliduntil::text
 FROM pg_roles
 WHERE rolname = %s
@@ -114,6 +150,17 @@ WHERE usename = %s
 """
 
 
+def _pg_authid_readable(cursor: Any) -> bool:
+    """True when this session may ``SELECT`` from ``pg_authid``.
+
+    Split out so the "cannot determine" branch of ``fetch_attributes`` is
+    reachable in a test without giving up superuser on the connection.
+    """
+    cursor.execute(_PG_AUTHID_READABLE_SQL)
+    row = cursor.fetchone()
+    return bool(row and row[0])
+
+
 def fetch_attributes(cursor: Any, name: str, engine: SqlEngine) -> RoleAttributes:
     if engine == SqlEngine.redshift:
         cursor.execute(_ATTRS_SQL_REDSHIFT, (name,))
@@ -145,7 +192,11 @@ def fetch_attributes(cursor: Any, name: str, engine: SqlEngine) -> RoleAttribute
             password_set=False,
             valid_until=str(valid_until) if valid_until is not None else None,
         )
-    cursor.execute(_ATTRS_SQL_POSTGRES, (name,))
+    authid_readable = _pg_authid_readable(cursor)
+    cursor.execute(
+        _ATTRS_SQL_POSTGRES if authid_readable else _ATTRS_SQL_POSTGRES_NO_AUTHID,
+        (name,),
+    )
     row = cursor.fetchone()
     if row is None:
         raise RoleNotFoundError(f'role "{name}" not found')
@@ -170,7 +221,9 @@ def fetch_attributes(cursor: Any, name: str, engine: SqlEngine) -> RoleAttribute
         replication=bool(replication),
         bypass_rls=bool(bypass_rls),
         connection_limit=int(conn_limit),
-        password_set=bool(password_set),
+        # Keyed off the probe, not off the value: only the probe distinguishes
+        # "the store says no password" from "we were not allowed to look".
+        password_set=bool(password_set) if authid_readable else None,
         valid_until=valid_until,
     )
 
@@ -355,7 +408,13 @@ def fetch_owned_objects(
     total = 0
     for schema, relkind, count in cursor.fetchall():
         kind_label = _KIND_LABEL.get(relkind, relkind)
-        by_schema.setdefault(schema, {})[kind_label] = int(count)
+        kinds = by_schema.setdefault(schema, {})
+        # Accumulate, never assign: the query groups by relkind while
+        # _KIND_LABEL folds several relkinds onto one label ('r' and 'p' are
+        # both "table"), so one schema can produce two rows for the same label.
+        # Assigning let the second row overwrite the first, which under-counted
+        # the breakdown and made it disagree with total_relations below.
+        kinds[kind_label] = kinds.get(kind_label, 0) + int(count)
         total += int(count)
     return OwnedObjectsSummary(
         schemas=schemas,

{dataplat-0.2.1 → dataplat-0.2.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dataplat"
-version = "0.2.1"
+version = "0.2.2"
 description = "One command to manage any shape of data platform: databases, ingestion, BI, cloud, and CI."
 readme = "README.md"
 license = "MIT"

{dataplat-0.2.1 → dataplat-0.2.2}/tests/cli/test_role.py

@@ -142,6 +142,9 @@ def test_db_role_cli_smoke() -> None:
     cursor.fetchone.side_effect = [
         # resolve_role
         (16384, True, False),
+        # pg_authid readable? password_set is only knowable to a superuser, so
+        # fetch_attributes probes for the privilege before choosing its query.
+        (True,),
         # attributes
         (True, False, True, True, True, False, False, -1, False, None),
     ]
@@ -250,6 +253,8 @@ def test_db_role_cli_json_flag() -> None:
     cursor = MagicMock()
     cursor.fetchone.side_effect = [
         (16384, True, False),
+        # pg_authid privilege probe (see the smoke test above).
+        (True,),
         (True, False, True, True, True, False, False, -1, False, None),
     ]
     cursor.fetchall.side_effect = [