dbos 1.11.0a1__tar.gz → 1.11.0a2__tar.gz

{dbos-1.11.0a1 → dbos-1.11.0a2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dbos
-Version: 1.11.0a1
+Version: 1.11.0a2
 Summary: Ultra-lightweight durable execution in Python
 Author-Email: "DBOS, Inc." <contact@dbos.dev>
 License: MIT

{dbos-1.11.0a1 → dbos-1.11.0a2}/dbos/_app_db.py

@@ -74,10 +74,19 @@ class ApplicationDatabase:
 
         # Create the dbos schema and transaction_outputs table in the application database
         with self.engine.begin() as conn:
-            schema_creation_query = sa.text(
-                f"CREATE SCHEMA IF NOT EXISTS {ApplicationSchema.schema}"
-            )
-            conn.execute(schema_creation_query)
+            # Check if schema exists first
+            schema_exists = conn.execute(
+                sa.text(
+                    "SELECT 1 FROM information_schema.schemata WHERE schema_name = :schema_name"
+                ),
+                parameters={"schema_name": ApplicationSchema.schema},
+            ).scalar()
+
+            if not schema_exists:
+                schema_creation_query = sa.text(
+                    f"CREATE SCHEMA {ApplicationSchema.schema}"
+                )
+                conn.execute(schema_creation_query)
 
         inspector = inspect(self.engine)
         if not inspector.has_table(

{dbos-1.11.0a1 → dbos-1.11.0a2}/dbos/cli/cli.py

@@ -15,6 +15,7 @@ from rich.prompt import IntPrompt
 from typing_extensions import Annotated, List
 
 from dbos._debug import debug_workflow, parse_start_command
+from dbos.cli.migration import grant_dbos_schema_permissions, migrate_dbos_databases
 
 from .._app_db import ApplicationDatabase
 from .._client import DBOSClient
@@ -278,6 +279,14 @@ def migrate(
             help="Your DBOS system database URL",
         ),
     ] = None,
+    application_role: Annotated[
+        typing.Optional[str],
+        typer.Option(
+            "--app-role",
+            "-r",
+            help="The role with which you will run your DBOS application",
+        ),
+    ] = None,
 ) -> None:
     app_database_url = _get_db_url(app_database_url)
     system_database_url = get_system_database_url(
@@ -293,37 +302,18 @@ def migrate(
     typer.echo(f"System database: {sa.make_url(system_database_url)}")
 
     # First, run DBOS migrations on the system database and the application database
-    app_db = None
-    sys_db = None
-    try:
-        sys_db = SystemDatabase(
-            system_database_url=system_database_url,
-            engine_kwargs={
-                "pool_timeout": 30,
-                "max_overflow": 0,
-                "pool_size": 2,
-            },
+    migrate_dbos_databases(
+        app_database_url=app_database_url, system_database_url=system_database_url
+    )
+
+    # Next, assign permissions on the DBOS schema to the application role, if any
+    if application_role:
+        grant_dbos_schema_permissions(
+            database_url=app_database_url, role_name=application_role
         )
-        app_db = ApplicationDatabase(
-            database_url=app_database_url,
-            engine_kwargs={
-                "pool_timeout": 30,
-                "max_overflow": 0,
-                "pool_size": 2,
-            },
+        grant_dbos_schema_permissions(
+            database_url=system_database_url, role_name=application_role
         )
-        sys_db.run_migrations()
-        app_db.run_migrations()
-    except Exception as e:
-        typer.echo(f"DBOS migrations failed: {e}")
-        raise typer.Exit(code=1)
-    finally:
-        if sys_db:
-            sys_db.destroy()
-        if app_db:
-            app_db.destroy()
-
-    typer.echo(f"DBOS migrations successful")
 
     # Next, run any custom migration commands specified in the configuration
     if os.path.exists("dbos-config.yaml"):

dbos-1.11.0a2/dbos/cli/migration.py

@@ -0,0 +1,91 @@
+import sqlalchemy as sa
+import typer
+
+from dbos._app_db import ApplicationDatabase
+from dbos._sys_db import SystemDatabase
+
+
+def migrate_dbos_databases(app_database_url: str, system_database_url: str) -> None:
+    app_db = None
+    sys_db = None
+    try:
+        sys_db = SystemDatabase(
+            system_database_url=system_database_url,
+            engine_kwargs={
+                "pool_timeout": 30,
+                "max_overflow": 0,
+                "pool_size": 2,
+            },
+        )
+        app_db = ApplicationDatabase(
+            database_url=app_database_url,
+            engine_kwargs={
+                "pool_timeout": 30,
+                "max_overflow": 0,
+                "pool_size": 2,
+            },
+        )
+        sys_db.run_migrations()
+        app_db.run_migrations()
+    except Exception as e:
+        typer.echo(f"DBOS migrations failed: {e}")
+        raise typer.Exit(code=1)
+    finally:
+        if sys_db:
+            sys_db.destroy()
+        if app_db:
+            app_db.destroy()
+
+
+def grant_dbos_schema_permissions(database_url: str, role_name: str) -> None:
+    """
+    Grant all permissions on all entities in the dbos schema to the specified role.
+    """
+    typer.echo(
+        f"Granting permissions for DBOS schema to {role_name} in database {sa.make_url(database_url)}"
+    )
+    engine = None
+    try:
+        engine = sa.create_engine(database_url)
+        with engine.connect() as connection:
+            connection.execution_options(isolation_level="AUTOCOMMIT")
+
+            # Grant usage on the dbos schema
+            sql = f"GRANT USAGE ON SCHEMA dbos TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant all privileges on all existing tables in dbos schema (includes views)
+            sql = f"GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA dbos TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant all privileges on all sequences in dbos schema
+            sql = f"GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA dbos TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant execute on all functions and procedures in dbos schema
+            sql = f"GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA dbos TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            # Grant default privileges for future objects in dbos schema
+            sql = f"ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT ALL ON TABLES TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            sql = f"ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT ALL ON SEQUENCES TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+            sql = f"ALTER DEFAULT PRIVILEGES IN SCHEMA dbos GRANT EXECUTE ON FUNCTIONS TO {role_name}"
+            typer.echo(sql)
+            connection.execute(sa.text(sql))
+
+    except Exception as e:
+        typer.echo(f"Failed to grant permissions to role {role_name}: {e}")
+        raise typer.Exit(code=1)
+    finally:
+        if engine:
+            engine.dispose()

{dbos-1.11.0a1 → dbos-1.11.0a2}/pyproject.toml

@@ -27,7 +27,7 @@ dependencies = [
 ]
 requires-python = ">=3.9"
 readme = "README.md"
-version = "1.11.0a1"
+version = "1.11.0a2"
 
 [project.license]
 text = "MIT"

dbos-1.11.0a2/tests/test_migrate.py

@@ -0,0 +1,79 @@
+import subprocess
+
+import sqlalchemy as sa
+
+from dbos import DBOS, DBOSConfig
+
+
+def test_migrate(postgres_db_engine: sa.Engine) -> None:
+    """Test that you can migrate with a privileged role and run DBOS with a less-privileged role"""
+    database_name = "migrate_test"
+    role_name = "migrate_test_role"
+    role_password = "migrate_test_password"
+
+    db_url = postgres_db_engine.url.set(database=database_name).render_as_string(
+        hide_password=False
+    )
+
+    # Drop the DBOS database if it exists. Create a test role with no permissions.
+    with postgres_db_engine.connect() as connection:
+        connection.execution_options(isolation_level="AUTOCOMMIT")
+        connection.execute(
+            sa.text(f"DROP DATABASE IF EXISTS {database_name} WITH (FORCE)")
+        )
+        connection.execute(sa.text(f"DROP ROLE IF EXISTS {role_name}"))
+        connection.execute(
+            sa.text(f"CREATE ROLE {role_name} WITH LOGIN PASSWORD '{role_password}'")
+        )
+
+    # Using the admin role, create the DBOS database and verify it exists.
+    # Set permissions for the test role.
+    subprocess.check_call(
+        ["dbos", "migrate", "-D", db_url, "-s", db_url, "-r", role_name]
+    )
+    with postgres_db_engine.connect() as c:
+        c.execution_options(isolation_level="AUTOCOMMIT")
+        result = c.execute(
+            sa.text(
+                f"SELECT COUNT(*) FROM pg_database WHERE datname = '{database_name}'"
+            )
+        ).scalar()
+        assert result == 1
+
+    # Initialize DBOS with the test role. Verify various operations work.
+    test_db_url = (
+        postgres_db_engine.url.set(database=database_name)
+        .set(username=role_name)
+        .set(password=role_password)
+    ).render_as_string(hide_password=False)
+    DBOS.destroy(destroy_registry=True)
+    config: DBOSConfig = {
+        "name": "test_migrate",
+        "database_url": test_db_url,
+        "system_database_url": test_db_url,
+    }
+    DBOS(config=config)
+
+    @DBOS.transaction()
+    def test_transaction() -> str:
+        rows = DBOS.sql_session.execute(sa.text("SELECT 1")).fetchall()
+        return str(rows[0][0])
+
+    @DBOS.workflow()
+    def test_workflow() -> str:
+        assert test_transaction() == "1"
+        id = DBOS.workflow_id
+        assert id
+        DBOS.set_event(id, id)
+        return id
+
+    DBOS.launch()
+
+    workflow_id = test_workflow()
+    assert workflow_id
+    assert DBOS.get_event(workflow_id, workflow_id) == workflow_id
+
+    steps = DBOS.list_workflow_steps(workflow_id)
+    assert len(steps) == 2
+    assert steps[0]["function_name"] == test_transaction.__qualname__
+    assert steps[1]["function_name"] == "DBOS.setEvent"