mainsequence-metatable 0.1.52.dev82__tar.gz → 0.1.52.dev83__tar.gz

{mainsequence_metatable-0.1.52.dev82/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.52.dev83}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.52.dev82
+Version: 0.1.52.dev83
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/docs/client/deploy-application-migrations.md

@@ -207,7 +207,9 @@ the database.
 - **`table_not_editable`**: the table already exists and the caller lacks
   `tables.update` on it. An owner of the table or its namespace grants `editor`.
 
-After the grant, re-run the Job. Do not run the Job as an Organization admin
+After the grant, or after adding the workload User to a Team that holds the role,
+re-run the Job. A refusal is rechecked against current Team membership before it
+stands, so the re-run needs no wait. Do not run the Job as an Organization admin
 or change physical names to get around a refusal.
 
 ## What the Job guarantees

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/docs/operations/recovery-and-observability.md

@@ -17,6 +17,11 @@ per-table finalization result, physical schema, provider identity, and registry
 state. Reuse only a compatible registry resolved by physical identity. Preserve
 Alembic's applied history; write new revisions for further changes.
 
+The API logs each `finalize-managed` batch's phases: `physical inspection`,
+`reconciling N tables (M with catalog writes)`, `commit and security refresh`, and
+the total. An already-current run reads the catalog a fixed number of times per
+batch, however many tables it holds, and writes nothing (`0 with catalog writes`).
+
 ## Failed security check
 
 The daily security check ([ADR 0023](../adr/api/0023-daily-security-check.md)) records

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/docs/security/index.md

@@ -117,7 +117,11 @@ to. Each pod reuses an answer for 24 hours, so a person removed from a Team can
 keep reading through that Team's grants for up to a day. Writes act on an answer
 at most a minute old. Migration credentials, table deletion, finalization and
 permission changes always ask the platform at once, and a login's database role
-memberships change only on such a fresh answer. A failed check fails the request;
+memberships change only on such a fresh answer. A table registration that would be
+refused asks the platform at once before it refuses, so a workload just added to a
+Team is accepted on its next run. A fresh answer also rereads which Teams the
+grants name, so a Team granted through another API pod counts at once; otherwise a
+pod learns of it within a minute. A failed check fails the request;
 it never counts as "not a member". Local admission resolves facts for the running SDK user,
 whose platform User response must supply `is_organization_admin` and
 `active_team_uids`.

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.52.dev82"
+version = "0.1.52.dev83"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.52.dev82
+Version: 0.1.52.dev83
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/app/auth/team_membership.py

@@ -9,7 +9,11 @@ request does:
   can keep reading through that team's grants for up to 24 hours;
 - data and SQL writes accept an answer at most a minute old;
 - issuing migration credentials, deleting tables, finalizing and changing
-  permissions always ask the platform now.
+  permissions always ask the platform now;
+- a registration that would be refused asks the platform now before it refuses (#80).
+
+Asking now also rereads which teams the grants name, so a team granted on another
+API pod counts at once (#81).
 """
 
 from __future__ import annotations
@@ -57,8 +61,12 @@ event.listen(Session, "after_commit", _grants_committed)
 event.listen(Session, "after_rollback", lambda session: session.info.pop("grant_teams_changed", None))
 
 
-def grant_teams(request: Request) -> frozenset[str]:
-    """The teams this catalog's grants name; none before a catalog is active."""
+def grant_teams(request: Request, *, fresh: bool = False) -> frozenset[str]:
+    """The teams this catalog's grants name; none before a catalog is active.
+
+    ``fresh`` rereads them from the catalog and refreshes this pod's copy: another
+    pod may have granted a team since this one cached its set (#81).
+    """
     from metatables.api.app.auth.local_actor import active_catalog_factory
 
     factory = active_catalog_factory(request.app)
@@ -73,21 +81,28 @@ def grant_teams(request: Request) -> frozenset[str]:
         with factory() as session:
             return frozenset(str(uid) for uid in session.scalars(query))
 
+    cache, generation = request.app.state.runtime.grant_teams, _grant_generation
     try:
-        return request.app.state.runtime.grant_teams.get(_grant_generation, load)
+        if not fresh:
+            return cache.get(generation, load)
+        teams = load()
     except Exception as exc:
         raise HTTPException(503, "MetaTables catalog is unavailable.") from exc
+    cache.seed(generation, teams, expires_at=cache.clock() + cache.ttl)
+    return teams
 
 
 def team_checker(request: Request, person) -> Callable[[float | None], frozenset[UUID]]:
     """Ask which of the grant teams ``person`` belongs to, no older than ``max_age``.
 
-    ``None`` reuses the day-long answer; failures fail the request and are never
-    read as "not a member".
+    ``None`` reuses the day-long answer. ``0`` asks the platform now, at most once per
+    request, about the teams the catalog's grants name now. Failures fail the request
+    and are never read as "not a member".
     """
-    teams = grant_teams(request)
+    teams: frozenset[str] | None = None
+    fresh: frozenset[UUID] | None = None
 
-    def check(max_age: float | None) -> frozenset[UUID]:
+    def ask(max_age: float | None) -> frozenset[UUID]:
         if not teams:
             return frozenset()
         try:
@@ -96,6 +111,17 @@ def team_checker(request: Request, person) -> Callable[[float | None], frozenset
             raise HTTPException(503, "Team membership is unavailable.") from exc
         return frozenset(UUID(uid) for uid in members)
 
+    def check(max_age: float | None) -> frozenset[UUID]:
+        nonlocal teams, fresh
+        if max_age == 0:
+            if fresh is None:
+                teams = grant_teams(request, fresh=True)
+                fresh = ask(0)
+            return fresh
+        if teams is None:
+            teams = grant_teams(request)
+        return ask(max_age)
+
     return check
 
 

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/app/platform_cache.py

@@ -7,7 +7,8 @@ from threading import Lock
 from time import monotonic
 
 PLATFORM_FACTS_TTL_SECONDS = 60 * 60
-# Other pods see a new team grant within this time; the pod that wrote it at once.
+# Other pods see a new team grant within this time; the pod that wrote it, and any
+# pod checking membership fresh, at once.
 GRANT_TEAMS_SECONDS = 60
 
 

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/app/routes/managed_finalize.py

@@ -3,14 +3,16 @@
 from __future__ import annotations
 
 import logging
+from collections import defaultdict
 from collections.abc import Callable
+from contextlib import nullcontext
 from time import perf_counter
 from typing import Any
 from uuid import UUID
 
 from fastapi import APIRouter, Depends, HTTPException, Response
 from pydantic import BaseModel, ConfigDict, Field, field_validator
-from sqlalchemy import delete
+from sqlalchemy import delete, select
 from sqlalchemy.exc import IntegrityError, SQLAlchemyError
 from sqlalchemy.orm import Session
 
@@ -35,7 +37,10 @@ from metatables.api.backend.domain.label_rules import LabelInvariantError, norma
 from metatables.api.backend.domain.permission_rules import TrustedActorFacts
 from metatables.api.backend.integrations.data_source_provider import DataSourceProvider
 from metatables.api.backend.integrations.runtime_data_sources import DataSourceIntegrationError
-from metatables.api.backend.operations.finalize_managed import contract_from_physical_snapshot
+from metatables.api.backend.operations.finalize_managed import (
+    contract_from_physical_snapshot,
+    foreign_key_target_names,
+)
 from metatables.api.backend.operations.register_catalog import time_index_spec_from_contract
 from metatables.api.backend.persistence.grants import GrantRepository
 from metatables.api.backend.persistence.labels import LabelRepository
@@ -178,15 +183,21 @@ def finalize_managed(
     rows = []
     eligible = []
     source_uid = None
+    # One query each for the whole batch, never one per table: an unchanged
+    # provider pays a round trip per statement (MetaTables #63).
+    tables = {table.uid: table for table in session.scalars(
+        select(MetaTable).where(MetaTable.uid.in_(requested)).order_by(MetaTable.uid).with_for_update())}
+    migratable = set(session.scalars(select(MetaTable.uid).where(
+        MetaTable.uid.in_(list(tables)), GrantRepository.table_access_predicate(actor, "tables.migrate"))))
+    specializations = {row.meta_table_uid: row for row in session.scalars(
+        select(TimeIndexTable).where(TimeIndexTable.meta_table_uid.in_(list(tables))))}
     for uid in requested:
-        table = session.get(MetaTable, uid, with_for_update=True)
-        if (
-            table is None or not GrantRepository(session).may_access_table(table_uid=uid, actor=actor, action="tables.migrate")
-        ):
+        table = tables.get(uid)
+        if table is None or uid not in migratable:
             rows.append(_row(None, uid, error={"code": "meta_table_not_found", "detail": "MetaTable was not found."}))
             continue
         previous = table.provisioning_status
-        specialization = session.get(TimeIndexTable, uid)
+        specialization = specializations.get(uid)
         if source_uid is None:
             source_uid = table.data_source_uid
         if source_uid != table.data_source_uid or (
@@ -226,6 +237,16 @@ def finalize_managed(
             logger.info("Managed finalization: physical inspection of %s tables took %.3fs",
                         len(eligible), perf_counter() - inspection_started)
     projections = load_contract_projections(session, [uid for uid, *_ in eligible])
+    # Foreign-key targets and their key columns are read once for the batch (#63).
+    registered = defaultdict(list)
+    names = set().union(*(foreign_key_target_names(snapshot) for snapshot in snapshots.values()
+                          if isinstance(snapshot, dict)))
+    if names:
+        for target in session.scalars(select(MetaTable).where(
+                MetaTable.data_source_uid == source_uid, MetaTable.physical_table_name.in_(names))):
+            registered[target.physical_table_name].append(target)
+    shapes = {}
+    reconcile_started, written = perf_counter(), 0
     for uid, table, previous, specialization in eligible:
         try:
             snapshot = snapshots[(table.physical_schema, table.physical_table_name)]
@@ -258,65 +279,72 @@ def finalize_managed(
                                     "detail": "The table's owner is a role the MetaTables login can't use."}))
             continue
         try:
-            with session.begin_nested():
-                authored = (payload.authored_metadata or {}).get(uid)
-                contract = contract_from_physical_snapshot(
-                    session=session, table=table, snapshot=snapshot,
-                    authored_metadata=authored.model_dump() if authored else None,
-                )
-                targets = resolved_foreign_key_targets(
-                    session, data_source_uid=table.data_source_uid, contract=contract,
-                    source_table_uid=uid,
+            authored = (payload.authored_metadata or {}).get(uid)
+            contract = contract_from_physical_snapshot(
+                session=session, table=table, snapshot=snapshot,
+                authored_metadata=authored.model_dump() if authored else None, registered=registered,
+            )
+            targets = resolved_foreign_key_targets(
+                session, data_source_uid=table.data_source_uid, contract=contract,
+                source_table_uid=uid, shapes=shapes,
+            )
+            replace_projection = not contract_projection_matches(projections[uid], contract, targets)
+            updates = {
+                "contract_version": contract["version"],
+                "physical_schema": contract["physical"]["schema"] or table.physical_schema,
+                "provisioning_status": "active",
+                "protect_from_deletion": True,
+            }
+            if authored is not None and authored.description and authored.description.strip():
+                updates["description"] = authored.description
+            if not same_contract_state(table.table_contract, contract):
+                updates["table_contract"] = contract
+            if not same_contract_state(table.introspection_snapshot, snapshot):
+                updates["introspection_snapshot"] = snapshot
+            authoring = contract.get("authoring") or {}
+            has_time_profile = (
+                contract.get("table_kind") == "time_indexed"
+                or isinstance(authoring, dict) and isinstance(authoring.get("time_indexed"), dict)
+            )
+            new_specialization = None
+            if specialization is None and has_time_profile:
+                spec = time_index_spec_from_contract({}, contract)
+                new_specialization = TimeIndexTable(
+                    meta_table_uid=uid,
+                    time_index_name=spec.time_index_name,
+                    index_names=list(spec.index_names),
+                    storage_layout=spec.normalized_layout(),
+                    cadence=spec.cadence,
                 )
-                replace_projection = not contract_projection_matches(projections[uid], contract, targets)
+                updates["kind"] = "time_index"
+            if "alembic_revision" in payload.model_fields_set:
+                updates["alembic_revision"] = payload.alembic_revision
+            if version_root is not None and uid != version_root:
+                updates["alembic_version_meta_table_uid"] = version_root
+            # Do not dirty equal-valued rows: pre-flush hooks see assignments
+            # before SQLAlchemy decides whether they need an UPDATE.
+            changes = {field: value for field, value in updates.items() if getattr(table, field) != value}
+            labels = authored.labels if authored is not None else None
+            # Only a table with catalog writes needs a savepoint (two round trips).
+            writes = bool(replace_projection or changes or labels or new_specialization is not None)
+            written += writes
+            with session.begin_nested() if writes else nullcontext():
                 if replace_projection:
+                    shapes.clear()
                     session.execute(delete(MetaTableForeignKey).where(MetaTableForeignKey.source_table_uid == uid))
                     session.execute(delete(MetaTableIndex).where(MetaTableIndex.meta_table_uid == uid))
                     session.execute(delete(MetaTableColumn).where(MetaTableColumn.meta_table_uid == uid))
                     session.flush()
-                updates = {
-                    "contract_version": contract["version"],
-                    "physical_schema": contract["physical"]["schema"] or table.physical_schema,
-                    "provisioning_status": "active",
-                    "protect_from_deletion": True,
-                }
-                if authored is not None:
-                    if authored.description and authored.description.strip():
-                        updates["description"] = authored.description
-                    if authored.labels:
-                        LabelRepository(session).mutate_target(
-                            kind="meta_table", target_uid=uid, mode="replace",
-                            names=authored.labels, created_by_user_uid=actor.user_uid,
-                        )
-                if not same_contract_state(table.table_contract, contract):
-                    updates["table_contract"] = contract
-                if not same_contract_state(table.introspection_snapshot, snapshot):
-                    updates["introspection_snapshot"] = snapshot
-                authoring = contract.get("authoring") or {}
-                has_time_profile = (
-                    contract.get("table_kind") == "time_indexed"
-                    or isinstance(authoring, dict) and isinstance(authoring.get("time_indexed"), dict)
-                )
-                if specialization is None and has_time_profile:
-                    spec = time_index_spec_from_contract({}, contract)
-                    specialization = TimeIndexTable(
-                        meta_table_uid=uid,
-                        time_index_name=spec.time_index_name,
-                        index_names=list(spec.index_names),
-                        storage_layout=spec.normalized_layout(),
-                        cadence=spec.cadence,
+                if labels:
+                    LabelRepository(session).mutate_target(
+                        kind="meta_table", target_uid=uid, mode="replace",
+                        names=labels, created_by_user_uid=actor.user_uid,
                     )
+                if new_specialization is not None:
+                    specialization = new_specialization
                     session.add(specialization)
-                    updates["kind"] = "time_index"
-                if "alembic_revision" in payload.model_fields_set:
-                    updates["alembic_revision"] = payload.alembic_revision
-                if version_root is not None and uid != version_root:
-                    updates["alembic_version_meta_table_uid"] = version_root
-                # Do not dirty equal-valued rows: pre-flush hooks see assignments
-                # before SQLAlchemy decides whether they need an UPDATE.
-                for field, value in updates.items():
-                    if getattr(table, field) != value:
-                        setattr(table, field, value)
+                for field, value in changes.items():
+                    setattr(table, field, value)
                 convert_time_index_table(source, table, specialization, convert=make_hypertable)
                 if replace_projection:
                     materialize_contract_projection(
@@ -345,11 +373,17 @@ def finalize_managed(
                 },
             ))
             continue
+    logger.info("Managed finalization: reconciling %s tables (%s with catalog writes) took %.3fs",
+                len(eligible), written, perf_counter() - reconcile_started)
+    commit_started = perf_counter()
     try:
         session.commit()
     except (IntegrityError, SQLAlchemyError) as exc:
         session.rollback()
         raise HTTPException(status_code=503, detail="MetaTables catalog is unavailable.") from exc
+    finally:
+        logger.info("Managed finalization: commit and security refresh took %.3fs",
+                    perf_counter() - commit_started)
     by_uid = {row["meta_table_uid"]: row for row in rows}
     rows = [by_uid[str(uid)] for uid in requested]
     finalized_count = sum(row["finalized"] for row in rows)

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/app/routes/table_registration.py

@@ -27,7 +27,7 @@ from metatables.api.backend.contracts.storage_layouts import StorageLayoutValida
 from metatables.api.backend.contracts.table_contracts import ContractValidationError
 from metatables.api.backend.domain.catalog_rules import CatalogAccessError, CatalogInvariantError
 from metatables.api.backend.domain.data_source_rules import DataSourceAdmissionError
-from metatables.api.backend.domain.permission_rules import TrustedActorFacts
+from metatables.api.backend.domain.permission_rules import TrustedActorFacts, allowing
 from metatables.api.backend.integrations.runtime_data_sources import DataSourceIntegrationError
 from metatables.api.backend.operations.register_catalog import register_catalog_entry
 from metatables.api.backend.persistence.grants import GrantRepository
@@ -94,8 +94,11 @@ def _registration(payload, *, indexed, actor, session, sources, creator, introsp
         schema=payload.physical_schema, contract=raw['table_contract'], create=create)
     for fk in raw['table_contract'].get('foreign_keys', []):
         target_uid = UUID(str(fk['target_meta_table_uid']))
-        if not GrantRepository(session).may_access_table(table_uid=target_uid, actor=actor, action="tables.get_data"):
+        current = allowing(actor, lambda candidate: GrantRepository(session).may_access_table(
+            table_uid=target_uid, actor=candidate, action="tables.get_data"))
+        if current is None:
             raise HTTPException(404, 'Foreign-key target was not found.')
+        actor = current
     result = register_catalog_entry(session=session, actor=actor, source=source, payload=raw,
                                     time_indexed=indexed, allow_new=True)
     table = result.table
@@ -104,7 +107,7 @@ def _registration(payload, *, indexed, actor, session, sources, creator, introsp
         root_uid = payload.alembic_version_meta_table_uid
         if root_uid is not None:
             root = session.get(MetaTable, root_uid)
-            if (root is None or root.data_source_uid != source.uid or root.alembic_version_meta_table_uid is not None or (root.schema_management_mode != 'alembic_managed') or (root.migration_provider_key != table.migration_provider_key) or (not GrantRepository(session).may_access_table(table_uid=root_uid, actor=actor, action="tables.migrate"))):
+            if (root is None or root.data_source_uid != source.uid or root.alembic_version_meta_table_uid is not None or (root.schema_management_mode != 'alembic_managed') or (root.migration_provider_key != table.migration_provider_key) or allowing(actor, lambda candidate: GrantRepository(session).may_access_table(table_uid=root_uid, actor=candidate, action="tables.migrate")) is None):
                 raise HTTPException(404, 'Alembic version table was not found.')
             if root_uid != table.uid:
                 table.alembic_version_meta_table_uid = root_uid

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/backend/domain/permission_rules.py

@@ -32,6 +32,22 @@ def is_workload(actor: TrustedActorFacts) -> bool:
     return actor.check_workload is not None and actor.check_workload()
 
 
+def allowing(actor: TrustedActorFacts,
+             allowed: Callable[[TrustedActorFacts], bool]) -> TrustedActorFacts | None:
+    """The actor ``allowed`` accepts, or None. Before refusing, asks the platform for the
+    actor's current Team membership: an answer up to a day old must not keep refusing
+    someone just added to a Team (#80). Accepted requests keep the cached answer."""
+    if allowed(actor):
+        return actor
+    if actor.check_teams is None:
+        return None
+    teams = actor.check_teams(0)
+    if teams == actor.active_team_uids:
+        return None
+    current = replace(actor, active_team_uids=teams)
+    return current if allowed(current) else None
+
+
 def current_team_facts(actor: TrustedActorFacts, *, write: bool) -> TrustedActorFacts:
     """The actor for one SQL admission: a write's teams at most a minute old, and at
     most one fresh check however often the admission repeats."""

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/backend/operations/finalize_managed.py

@@ -6,7 +6,7 @@ from collections.abc import Mapping
 from typing import Any
 from uuid import UUID
 
-from sqlalchemy import or_, select
+from sqlalchemy import inspect, or_, select
 from sqlalchemy.orm import Session
 
 from metatables.api.backend.contracts.table_contracts import normalize_table_contract
@@ -14,11 +14,25 @@ from metatables.api.backend.domain.catalog_rules import CatalogInvariantError
 from metatables.api.backend.persistence.models import MetaTable
 
 
+def foreign_key_target_names(snapshot: Mapping[str, Any]) -> set[str]:
+    """The physical table names a snapshot's foreign keys reference."""
+    return {
+        str(item.get("target_table_name") or "")
+        for item in snapshot.get("constraints") or ()
+        if isinstance(item, Mapping) and item.get("constraint_type") == "f"
+    }
+
+
 def contract_from_physical_snapshot(
     *, session: Session, table: MetaTable, snapshot: Mapping[str, Any],
     authored_metadata: Mapping[str, Any] | None = None,
+    registered: Mapping[str, list[MetaTable]] | None = None,
 ) -> dict[str, Any]:
-    """Use physical column, index, and FK facts; preserve declared semantic metadata."""
+    """Use physical column, index, and FK facts; preserve declared semantic metadata.
+
+    ``registered`` holds the DataSource's MetaTables by physical name, read once for
+    a batch; without it each foreign key's target is read here.
+    """
     schema = str(snapshot.get("schema_name") or table.physical_schema or "").strip()
     name = str(snapshot.get("table_name") or table.physical_table_name or "").strip()
     if name != table.physical_table_name or (table.physical_schema and schema != table.physical_schema):
@@ -83,14 +97,23 @@ def contract_from_physical_snapshot(
         target_name = str(item.get("target_table_name") or "")
         # A reserved row may store an empty schema while the DataSource's
         # default schema is only known after physical introspection.
-        schema_predicate = MetaTable.physical_schema == target_schema
-        if target_schema == schema:
-            schema_predicate = or_(schema_predicate, MetaTable.physical_schema == "")
-        targets = list(session.scalars(select(MetaTable).where(
-            MetaTable.data_source_uid == table.data_source_uid,
-            schema_predicate,
-            MetaTable.physical_table_name == target_name,
-        )))
+        if registered is None:
+            schema_predicate = MetaTable.physical_schema == target_schema
+            if target_schema == schema:
+                schema_predicate = or_(schema_predicate, MetaTable.physical_schema == "")
+            targets = list(session.scalars(select(MetaTable).where(
+                MetaTable.data_source_uid == table.data_source_uid,
+                schema_predicate,
+                MetaTable.physical_table_name == target_name,
+            )))
+        else:
+            targets = [
+                candidate for candidate in registered.get(target_name, ())
+                if candidate.data_source_uid == table.data_source_uid
+                and (candidate.physical_schema == target_schema
+                     or target_schema == schema and candidate.physical_schema == "")
+                and not inspect(candidate).was_deleted and candidate not in session.deleted
+            ]
         if len(targets) != 1:
             raise CatalogInvariantError("Physical foreign-key target is not uniquely registered")
         target = targets[0]

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/backend/operations/register_catalog.py

@@ -16,7 +16,7 @@ from metatables.api.backend.domain.catalog_rules import (
     TableRegistration,
     TimeIndexSpec,
 )
-from metatables.api.backend.domain.permission_rules import TrustedActorFacts, is_workload
+from metatables.api.backend.domain.permission_rules import TrustedActorFacts, allowing, is_workload
 from metatables.api.backend.integrations.runtime_data_sources import RuntimeDataSource
 from metatables.api.backend.persistence.catalog import CatalogRepository
 from metatables.api.backend.persistence.grants import GrantRepository
@@ -230,10 +230,13 @@ def register_catalog_entry(
         MetaTable.physical_table_name == name,
     ).with_for_update())
     if existing is not None:
-        if not GrantRepository(session).may_access_table(table_uid=existing.uid, actor=actor, action="tables.update"):
+        current = allowing(actor, lambda candidate: GrantRepository(session).may_access_table(
+            table_uid=existing.uid, actor=candidate, action="tables.update"))
+        if current is None:
             requested = payload.get("namespace")
             raise not_editable(session, existing, actor=actor, requested_namespace=(
                 requested.strip().lower() if isinstance(requested, str) else None))
+        actor = current
         if existing.management_mode != management_mode or (existing.kind == "time_index") != time_indexed:
             raise CatalogInvariantError("Existing MetaTable has incompatible kind or management mode")
         if time_index_spec is not None:
@@ -254,8 +257,10 @@ def register_catalog_entry(
     if isinstance(namespace_name, str) and namespace_name.strip():
         requested = namespace_name.strip().lower()
         namespace = session.scalar(select(Namespace).where(Namespace.name == requested))
-        if namespace is not None and not GrantRepository(session).may_access_namespace(
-                namespace_uid=namespace.uid, actor=actor, action="tables.create"):
+        current = actor if namespace is None else allowing(
+            actor, lambda candidate: GrantRepository(session).may_access_namespace(
+                namespace_uid=namespace.uid, actor=candidate, action="tables.create"))
+        if current is None:
             raise CatalogAccessError(
                 "namespace_access_required",
                 f"Caller {caller} lacks tables.create on namespace {requested!r}. Ask an owner of the "
@@ -264,6 +269,7 @@ def register_catalog_entry(
                 caller_user_uid=caller, namespace=requested, action="tables.create",
                 owners=namespace_owners(session, namespace, actor),
             )
+        actor = current
         # A missing namespace is created by whoever registers into it (ADR 0024). A person
         # owns it; a workload gets editor, and the people who manage that workload manage
         # the namespace's access.

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/src/metatables/api/backend/persistence/projections.py

@@ -106,17 +106,25 @@ def _target_for_foreign_key(
 
 
 def _check_target_columns(
-    session: Session, *, foreign_key: dict, target: MetaTable, contract: dict | None = None
+    session: Session, *, foreign_key: dict, target: MetaTable, contract: dict | None = None,
+    shapes: dict | None = None,
 ) -> None:
     if contract is None:
-        columns = [{"name": row.name, "primary_key": row.primary_key, "unique": row.unique}
-                   for row in session.scalars(
-            select(MetaTableColumn)
-            .where(MetaTableColumn.meta_table_uid == target.uid)
-            .order_by(MetaTableColumn.ordinal_position)
-        )]
-        indexes = [index.columns for index in session.scalars(select(MetaTableIndex).where(
-            MetaTableIndex.meta_table_uid == target.uid, MetaTableIndex.unique.__eq__(True)))]
+        shape = shapes.get(target.uid) if shapes is not None else None
+        if shape is None:
+            shape = (
+                [{"name": row.name, "primary_key": row.primary_key, "unique": row.unique}
+                 for row in session.scalars(
+                    select(MetaTableColumn)
+                    .where(MetaTableColumn.meta_table_uid == target.uid)
+                    .order_by(MetaTableColumn.ordinal_position)
+                )],
+                [index.columns for index in session.scalars(select(MetaTableIndex).where(
+                    MetaTableIndex.meta_table_uid == target.uid, MetaTableIndex.unique.__eq__(True)))],
+            )
+            if shapes is not None:
+                shapes[target.uid] = shape
+        columns, indexes = shape
     else:
         # A self-reference must validate against its freshly observed contract,
         # not a damaged projection that this finalization is about to repair.
@@ -151,8 +159,13 @@ def resolved_foreign_key_targets(
     data_source_uid: UUID,
     contract: dict,
     source_table_uid: UUID | None = None,
+    shapes: dict | None = None,
 ) -> list[UUID]:
-    """Preflight all targets before registering the new source table."""
+    """Preflight all targets before registering the new source table.
+
+    ``shapes`` keeps each target's key columns across calls of one request; the
+    caller clears it when it replaces a projection.
+    """
     targets = []
     for foreign_key in contract["foreign_keys"]:
         target = _target_for_foreign_key(
@@ -161,7 +174,8 @@ def resolved_foreign_key_targets(
             foreign_key=foreign_key,
         )
         _check_target_columns(session, foreign_key=foreign_key, target=target,
-                              contract=contract if target.uid == source_table_uid else None)
+                              contract=contract if target.uid == source_table_uid else None,
+                              shapes=shapes)
         targets.append(target.uid)
     return targets
 

{mainsequence_metatable-0.1.52.dev82 → mainsequence_metatable-0.1.52.dev83}/tests/auth/test_platform_fact_cache.py

@@ -114,7 +114,7 @@ def test_hosted_admin_comes_from_the_assertion_and_teams_from_membership_checks(
     monkeypatch.setattr(User, "get_authenticated_user_details", classmethod(lookup))
     workload, team, other = uuid4(), uuid4(), uuid4()
     granted = frozenset({str(team), str(other)})
-    monkeypatch.setattr(team_membership, "grant_teams", lambda request: granted)
+    monkeypatch.setattr(team_membership, "grant_teams", lambda request, fresh=False: granted)
     asked = []
 
     class Caller: