dbos 1.11.0a1__py3-none-any.whl → 1.11.0a3__py3-none-any.whl

dbos/_app_db.py

@@ -74,10 +74,19 @@ class ApplicationDatabase:
 
         # Create the dbos schema and transaction_outputs table in the application database
         with self.engine.begin() as conn:
-            schema_creation_query = sa.text(
-                f"CREATE SCHEMA IF NOT EXISTS {ApplicationSchema.schema}"
-            )
-            conn.execute(schema_creation_query)
+            # Check if schema exists first
+            schema_exists = conn.execute(
+                sa.text(
+                    "SELECT 1 FROM information_schema.schemata WHERE schema_name = :schema_name"
+                ),
+                parameters={"schema_name": ApplicationSchema.schema},
+            ).scalar()
+
+            if not schema_exists:
+                schema_creation_query = sa.text(
+                    f"CREATE SCHEMA {ApplicationSchema.schema}"
+                )
+                conn.execute(schema_creation_query)
 
         inspector = inspect(self.engine)
         if not inspector.has_table(

dbos/cli/cli.py

@@ -15,6 +15,7 @@ from rich.prompt import IntPrompt
 from typing_extensions import Annotated, List
 
 from dbos._debug import debug_workflow, parse_start_command
+from dbos.cli.migration import grant_dbos_schema_permissions, migrate_dbos_databases
 
 from .._app_db import ApplicationDatabase
 from .._client import DBOSClient
@@ -278,6 +279,14 @@ def migrate(
             help="Your DBOS system database URL",
         ),
     ] = None,
+    application_role: Annotated[
+        typing.Optional[str],
+        typer.Option(
+            "--app-role",
+            "-r",
+            help="The role with which you will run your DBOS application",
+        ),
+    ] = None,
 ) -> None:
     app_database_url = _get_db_url(app_database_url)
     system_database_url = get_system_database_url(
@@ -293,37 +302,18 @@ def migrate(
     typer.echo(f"System database: {sa.make_url(system_database_url)}")
 
     # First, run DBOS migrations on the system database and the application database
-    app_db = None
-    sys_db = None
-    try:
-        sys_db = SystemDatabase(
-            system_database_url=system_database_url,
-            engine_kwargs={
-                "pool_timeout": 30,
-                "max_overflow": 0,
-                "pool_size": 2,
-            },
+    migrate_dbos_databases(
+        app_database_url=app_database_url, system_database_url=system_database_url
+    )
+
+    # Next, assign permissions on the DBOS schema to the application role, if any
+    if application_role:
+        grant_dbos_schema_permissions(
+            database_url=app_database_url, role_name=application_role
         )
-        app_db = ApplicationDatabase(
-            database_url=app_database_url,
-            engine_kwargs={
-                "pool_timeout": 30,
-                "max_overflow": 0,
-                "pool_size": 2,
-            },
+        grant_dbos_schema_permissions(
+            database_url=system_database_url, role_name=application_role
         )
-        sys_db.run_migrations()
-        app_db.run_migrations()
-    except Exception as e:
-        typer.echo(f"DBOS migrations failed: {e}")
-        raise typer.Exit(code=1)
-    finally:
-        if sys_db:
-            sys_db.destroy()
-        if app_db:
-            app_db.destroy()
-
-    typer.echo(f"DBOS migrations successful")
 
     # Next, run any custom migration commands specified in the configuration
     if os.path.exists("dbos-config.yaml"):

dbos/cli/migration.py

@@ -0,0 +1,93 @@
+import sqlalchemy as sa
+import typer
+
+from dbos._app_db import ApplicationDatabase
+from dbos._sys_db import SystemDatabase
+
+
+def migrate_dbos_databases(app_database_url: str, system_database_url: str) -> None:
+    app_db = None
+    sys_db = None
+    try:
+        sys_db = SystemDatabase(
+            system_database_url=system_database_url,
+            engine_kwargs={
+                "pool_timeout": 30,
+                "max_overflow": 0,
+                "pool_size": 2,
+            },
+        )
+        app_db = ApplicationDatabase(
+            database_url=app_database_url,
+            engine_kwargs={
+                "pool_timeout": 30,
+                "max_overflow": 0,
+                "pool_size": 2,
+            },
+        )
+        sys_db.run_migrations()
+        app_db.run_migrations()
+    except Exception as e:
+        typer.echo(f"DBOS migrations failed: {e}")
+        raise typer.Exit(code=1)
+    finally:
+        if sys_db:
+            sys_db.destroy()
+        if app_db:
+            app_db.destroy()
+
+
+def grant_dbos_schema_permissions(database_url: str, role_name: str) -> None:
+    """
+    Grant all permissions on all entities in the dbos schema to the specified role.
+    """
+    typer.echo(
+        f"Granting permissions for DBOS schema to {role_name} in database {sa.make_url(database_url)}"
+    )
+    engine = None
+    try:
+        engine = sa.create_engine(database_url)
+        with engine.connect() as connection:
+            connection.execution_options(isolation_level="AUTOCOMMIT")
+
+            # Grant usage on the dbos schema
+            sql = f'GRANT USAGE ON SCHEMA dbos TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant all privileges on all existing tables in dbos schema (includes views)
+            sql = f'GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA dbos TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant all privileges on all sequences in dbos schema
+            sql = (
+                f'GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA dbos TO "{role_name}"'
+            )
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant execute on all functions and procedures in dbos schema
+            sql = f'GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA dbos TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant default privileges for future objects in dbos schema
+            sql = f'ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT ALL ON TABLES TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            sql = f'ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT ALL ON SEQUENCES TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            sql = f'ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT EXECUTE ON FUNCTIONS TO "{role_name}"'
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+    except Exception as e:
+        typer.echo(f"Failed to grant permissions to role {role_name}: {e}")
+        raise typer.Exit(code=1)
+    finally:
+        if engine:
+            engine.dispose()

{dbos-1.11.0a1.dist-info → dbos-1.11.0a3.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dbos
-Version: 1.11.0a1
+Version: 1.11.0a3
 Summary: Ultra-lightweight durable execution in Python
 Author-Email: "DBOS, Inc." <contact@dbos.dev>
 License: MIT

{dbos-1.11.0a1.dist-info → dbos-1.11.0a3.dist-info}/RECORD

@@ -1,11 +1,11 @@
-dbos-1.11.0a1.dist-info/METADATA,sha256=T1r9u-NqfAWkMSlkExVKMRfwVIsYUT-ucsDTYFKTxss,13268
-dbos-1.11.0a1.dist-info/WHEEL,sha256=9P2ygRxDrTJz3gsagc0Z96ukrxjr-LFBGOgv3AuKlCA,90
-dbos-1.11.0a1.dist-info/entry_points.txt,sha256=_QOQ3tVfEjtjBlr1jS4sHqHya9lI2aIEIWkz8dqYp14,58
-dbos-1.11.0a1.dist-info/licenses/LICENSE,sha256=VGZit_a5-kdw9WT6fY5jxAWVwGQzgLFyPWrcVVUhVNU,1067
+dbos-1.11.0a3.dist-info/METADATA,sha256=bYxL7G7Lu7GMz4D-PoDMfFTGF1yL4C4ErS5ns8AjIbI,13268
+dbos-1.11.0a3.dist-info/WHEEL,sha256=9P2ygRxDrTJz3gsagc0Z96ukrxjr-LFBGOgv3AuKlCA,90
+dbos-1.11.0a3.dist-info/entry_points.txt,sha256=_QOQ3tVfEjtjBlr1jS4sHqHya9lI2aIEIWkz8dqYp14,58
+dbos-1.11.0a3.dist-info/licenses/LICENSE,sha256=VGZit_a5-kdw9WT6fY5jxAWVwGQzgLFyPWrcVVUhVNU,1067
 dbos/__init__.py,sha256=NssPCubaBxdiKarOWa-wViz1hdJSkmBGcpLX_gQ4NeA,891
 dbos/__main__.py,sha256=G7Exn-MhGrVJVDbgNlpzhfh8WMX_72t3_oJaFT9Lmt8,653
 dbos/_admin_server.py,sha256=e8ELhcDWqR3_PNobnNgUvLGh5lzZq0yFSF6dvtzoQRI,16267
-dbos/_app_db.py,sha256=htblDPfqrpb_uZoFcvaud7cgQ-PDyn6Bn-cBidxdCTA,10603
+dbos/_app_db.py,sha256=bUXQqzc0C9PHh4Zl2tHfBrQWNBURdI7F7XXjCpYirmw,10959
 dbos/_classproperty.py,sha256=f0X-_BySzn3yFDRKB2JpCbLYQ9tLwt1XftfshvY7CBs,626
 dbos/_client.py,sha256=_wMe4qnRSwiRZo74xdqTBetbHlIVy3vQifdSd7os1ZY,18213
 dbos/_conductor/conductor.py,sha256=3E_hL3c9g9yWqKZkvI6KA0-ZzPMPRo06TOzT1esMiek,24114
@@ -66,8 +66,9 @@ dbos/_utils.py,sha256=uywq1QrjMwy17btjxW4bES49povlQwYwYbvKwMT6C2U,1575
 dbos/_workflow_commands.py,sha256=EmmAaQfRWeOZm_WPTznuU-O3he3jiSzzT9VpYrhxugE,4835
 dbos/cli/_github_init.py,sha256=Y_bDF9gfO2jB1id4FV5h1oIxEJRWyqVjhb7bNEa5nQ0,3224
 dbos/cli/_template_init.py,sha256=7JBcpMqP1r2mfCnvWatu33z8ctEGHJarlZYKgB83cXE,2972
-dbos/cli/cli.py,sha256=BaWqdMZbUsJkq0zEaS2Ez2FgRgD5nTD24hCsrAlitbA,22289
+dbos/cli/cli.py,sha256=ey7E-lNFgvUWhsd-mkFwZvTdYorv6hU2zsMOS23n1yQ,22214
+dbos/cli/migration.py,sha256=vUgBXqde1eYATd1ncBeT1iJZMO6lrcofn8-s9J9__Xo,3244
 dbos/dbos-config.schema.json,sha256=CjaspeYmOkx6Ip_pcxtmfXJTn_YGdSx_0pcPBF7KZmo,6060
 dbos/py.typed,sha256=QfzXT1Ktfk3Rj84akygc7_42z0lRpCq0Ilh8OXI6Zas,44
 version/__init__.py,sha256=L4sNxecRuqdtSFdpUGX3TtBi9KL3k7YsZVIvv-fv9-A,1678
-dbos-1.11.0a1.dist-info/RECORD,,
+dbos-1.11.0a3.dist-info/RECORD,,