mainsequence-metatable 0.1.35.dev65__tar.gz → 0.1.36.dev66__tar.gz

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.35.dev65
+Version: 0.1.36.dev66
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/docs/adr/api/0007-database-enforced-table-access.md

@@ -60,6 +60,20 @@
 > full repair. An explicit admin repair remains a full sweep. A routine catalog
 > update must not establish a new native baseline for unverified outside drift.
 
+> Amendment (2026-10-15, [MetaTables #66](https://github.com/mainsequence-projects/MetaTables/issues/66)):
+> On PostgreSQL/TimescaleDB, deployment and the admin repair compare what
+> MetaTables' roles actually hold with the plan and change only what differs. One
+> query reads those roles' attributes, memberships and grants on the database,
+> on schemas and on relations the login owns or the plan names; table policies
+> are read in one query as well. Statements go out in batches, one round trip
+> each. This replaces the native-security fingerprint, which hashed every object
+> the shared login owns and so changed with any application table, column, index
+> or new data, and the full repair that revoked every grant and granted it back.
+> TimescaleDB's internal schemas are never read or changed: chunks inherit their
+> hypertable's grants. Schema `USAGE` and `CONNECT` are granted only where the
+> login may grant them. Login passwords are set again only on credential
+> rotation, failed login validation, pending or uninitialized state.
+
 > Amendment (2026-10-09): [ADR 0022](0022-concurrent-requests-and-connection-reuse.md)
 > reuses login-role connections within a pod, only by the login role that opened them
 > and never through `SET ROLE`; no session state carries over from one use to the next.

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/docs/adr/api/0014-main-sequence-release-jobs-and-production-migrations.md

@@ -62,9 +62,9 @@ resolve declaration and Secret
        yes: fresh physical system-schema validation; preserve journal
        no: existing Alembic execution and durable recovery; validate schema
   -> reconcile runtime registration if changed
-  -> security-state lock; fresh native security and login validation
-  -> unchanged evidence? fresh table-policy checks; apply only grant differences
-       otherwise: full security repair, including credential rotation
+  -> security-state lock; fresh login validation
+  -> fresh table-policy checks; compare the managed roles' actual grants with
+     the plan and apply only the differences; set passwords only when needed
   -> commit; fresh registration/reference verification; release bootstrap lock
 ```
 
@@ -83,40 +83,37 @@ of unknown outcomes. A completed journal records its original execution; a
 source-code change without new revisions does not reset that history. Schema
 drift still blocks deployment and is not silently repaired by replaying Alembic.
 
-On PostgreSQL/TimescaleDB, the existing private `SQLSecurityState.manifest` stores
-versioned native-security evidence and a domain-separated credential checksum,
-alongside roles, memberships, privileges and routine evidence. No schema revision
-is needed. Initialization compares fresh database evidence: role attributes and
-memberships; schema, relation, column, routine, database and default ACLs; owners,
-routine definitions and row-security policies. Table data and statistics are
-excluded. Declared schemas and grant-target tables are included even when the
-login has grant authority without owning them. Fresh per-login authentication
-uses the configured TLS material and a new connection, never a pooled session
-that could conceal a password change.
+On PostgreSQL/TimescaleDB (amended 2026-10-15, [MetaTables #66](https://github.com/mainsequence-projects/MetaTables/issues/66)),
+initialization reads what MetaTables' roles actually hold in one query: their
+attributes, memberships, and grants on the database, on schemas and on the
+relations the login owns or the plan names. It compares that with the plan and
+sends only the differences, in batches. TimescaleDB's internal schemas are never
+read or changed. The manifest keeps a domain-separated credential checksum and
+the routine evidence. Fresh per-login authentication uses the configured TLS
+material and a new connection, never a pooled session that could conceal a
+password change.
 The security-state row stays locked until commit to serialize with catalog
 changes and caller admission.
 
 All registered table policies are freshly checked even on the unchanged path.
 Unchanged table owners and `PUBLIC` grants cause no ownership/revoke writes.
 Policies and grant differences still apply when a trigger or catalog change
-affects access. Native drift, credential rotation, pending/unready state or
-missing evidence invokes full repair. Login authentication failures likewise
-require repair. Exhausted login connection capacity conservatively falls back
+affects access. Grants changed outside MetaTables are found by the comparison
+and repaired. Credential rotation, pending/unready state or missing evidence sets
+login passwords again; so do login authentication failures. Exhausted login connection capacity conservatively falls back
 to the existing repair. libpq can omit SQLSTATE on a connection/authentication
 failure; these ambiguous driver connection errors also require repair rather
-than allowing a skip. Other probe failures fail deployment. An old installation
-therefore performs one full repair to establish evidence, then converges.
+than allowing a skip. Other probe failures fail deployment.
 Explicit admin repair remains a full sweep; MySQL/SQL Server keep their existing
 security initialization behavior.
 
 The complete manifest is compared and persisted once, including backend fields;
-reconciliation must not remove and then restore the routine fingerprint. Ordinary
-incremental changes cannot checkpoint unverified native drift as success. Failed
+reconciliation must not remove and then restore the routine fingerprint. Failed
 security work rolls back its catalog checkpoint and remains repairable on retry.
 
 Named timings cover declaration/Secret resolution, bootstrap/security lock waits,
 preflight, catalog/Alembic execution, system-schema validation, registration,
-native security and login authentication validation, routine repair, table
+login authentication validation, routine repair, table
 policies, roles/grants, credential-store setup, commit and final registration
 verification. Each timing
 reports completion/failure without connection strings, passwords, checksums or
@@ -125,7 +122,7 @@ reason, including first-run evidence establishment.
 
 Focused verification uses disposable SQLite catalog transactions and recording
 PostgreSQL adapters: unchanged deployments invoke no Alembic or catalog/journal
-DML; unchanged native security emits no role/grant DDL or manifest UPDATE;
+DML; an unchanged database emits no role/grant DDL or manifest UPDATE;
 schema drift, interrupted/ambiguous recovery, credential rotation, permission
 drift and failed repair remain checked. Live PostgreSQL/TimescaleDB validation is
 separate from these non-container checks.

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.35.dev65"
+version = "0.1.36.dev66"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/src/mainsequence_metatable.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.35.dev65
+Version: 0.1.36.dev66
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.35.dev65 → mainsequence_metatable-0.1.36.dev66}/src/metatables/api/backend/backends/access.py

@@ -152,6 +152,13 @@ class DatabaseAccess:
         deleted or their keys updated, as (schema, table, on_delete, on_update)."""
         raise NotImplementedError
 
+    def inspect_tables(self, connection, tables):
+        """Each table's (writable, cascade targets), keyed by UID; may repair owners or PUBLIC grants."""
+        return {
+            table.uid: (self.validate_table(connection, table), self.cascade_targets(connection, table))
+            for table in tables
+        }
+
     def refresh_policies(self, session, tables=None):
         """Inspect every table's policy, or only those of the table UIDs in ``tables``."""
         query = (
@@ -168,13 +175,16 @@ class DatabaseAccess:
         for old in session.scalars(policies):
             if old.table_uid not in current:
                 session.delete(old)
+        inspected = self.inspect_tables(
+            session.connection(), [t for t in tables if t.provisioning_status == "active"]
+        )
         for table in tables:
             if table.provisioning_status != "active":
                 old = session.get(SQLTablePolicy, table.uid)
                 if old:
                     session.delete(old)
                 continue
-            writable = self.validate_table(session.connection(), table)
+            writable, targets = inspected[table.uid]
             # The provider root is its Alembic version table.
             if (
                 table.schema_management_mode == "alembic_managed"
@@ -192,9 +202,7 @@ class DatabaseAccess:
             # Recorded for every table: the impact pre-flight shows them to readers too.
             policy.cascade_targets = [
                 dict(schema=schema, table=name, on_delete=on_delete, on_update=on_update)
-                for schema, name, on_delete, on_update in sorted(
-                    self.cascade_targets(session.connection(), table)
-                )
+                for schema, name, on_delete, on_update in sorted(targets)
             ]
         session.flush()