mainsequence-metatable 0.1.8.dev15__tar.gz → 0.1.8.dev16__tar.gz

{mainsequence_metatable-0.1.8.dev15/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.8.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev15
+Version: 0.1.8.dev16
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -28,7 +28,8 @@ does not cache this API's runtime context or select its runtime mode or DataSour
 Updated 2026-09-28: application Environment policy and relationships are removed.
 Amended 2026-09-29: one enforced runtime binding and explicit bootstrap select one
 database for system and user tables.
-Amended 2026-10-02: each runtime mode lists and selects only its own DataSources.
+Amended 2026-10-02: each runtime mode lists and selects only its own DataSources,
+and inspection checks the login's prerequisites before setup.
 
 Companion decision: [Main Sequence SDK ADR 0035: Independent Git source and platform execution context](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/metatables_removal/docs/adr/0035-independent-git-source-and-platform-context.md).
 The SDK prerequisite is implemented on `metatables_removal`; the current local
@@ -172,6 +173,14 @@ configuration inserted as the runtime DataSource in that database. Failed work
 never activates a partially initialized runtime. A database already initialized
 and compatible can be selected without running migrations.
 
+Amended 2026-10-02: before any runtime is registered, inspection also checks,
+read-only, that the login can secure the database under
+[ADR 0007](0007-database-enforced-table-access.md): it owns the database, has
+`CREATEROLE`, and owns every non-system object. Unmet prerequisites make the
+target incompatible, with each reason shown in Settings, so setup never leaves a
+database half-initialized. A registered runtime is not rechecked, because it may
+hold imported external objects.
+
 Settings, runtime context, mode selection and bootstrap actions do not depend on
 catalog sessions or catalog memberships. They retain the existing request admission.
 The caller who configures a pending target controls its initialization; an existing

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/docs/api/data-sources.md

@@ -181,6 +181,25 @@ other caller sessions. SQL Server requires login/user/role administration,
 `VIEW DEFINITION` and grant management. Managed database services must provide
 these capabilities; missing permissions leave caller SQL disabled.
 
+Settings checks the PostgreSQL requirements as soon as you select a database
+without a MetaTables runtime, before any migration runs. The login must own the
+database, have `CREATEROLE`, and own, directly or through role membership, every
+schema, table, view, sequence and routine outside the system catalogs, because
+setup revokes `PUBLIC` access on each of them. Otherwise Settings shows
+**Needs attention** with each reason, for example
+`metatables_dev does not own database "development"` or
+`291 object(s) are owned by postgres (extension timescaledb)`, and
+**Run MetaTables migrations** stays unavailable. Nothing is written to that database.
+
+A database operator prepares a qualifying database for the login, for example
+`CREATE DATABASE metatables OWNER metatables_dev TEMPLATE template0;`. On
+PostgreSQL 14 and earlier the `public` schema belongs to the bootstrap superuser,
+so also run `ALTER SCHEMA public OWNER TO metatables_dev;` in that database.
+Extensions such as TimescaleDB and pgvector install their objects as the
+bootstrap superuser, so a database with those extensions cannot currently be
+secured by a non-superuser login. Do not select a database other applications
+share: setup would change their objects' `PUBLIC` access.
+
 Hosted sources require a password Secret to derive per-User database credentials.
 MySQL global mandatory roles are unsupported. Registration admits ordinary tables
 only; it does not transfer external ownership. Privileged routines and triggers

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/docs/operations/catalog-migrations.md

@@ -10,7 +10,7 @@ system tables, including `data_source`, alongside user tables. There is no separ
 catalog connection to configure. Local and hosted use the same initialization flow.
 
 1. For Hosted mode, register a PostgreSQL, TimescaleDB, MySQL or MSSQL connection under **MetaTables → Data Sources**. This registration is available before the hosted catalog is initialized.
-2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions.
+2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions. For a database without a MetaTables runtime, selection also checks that the login can secure it; **Needs attention** lists what is missing ([database privileges](../api/data-sources.md#database-privileges-and-sql-behavior)) and no migration can run until another database is selected.
 3. For an empty or outdated database, click **Run MetaTables migrations**. This
    explicitly runs the packaged Alembic history. After success, the API saves the
    proposal as the runtime DataSource inside the newly initialized registry.

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.8.dev15"
+version = "0.1.8.dev16"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev15
+Version: 0.1.8.dev16
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/app/bootstrap.py

@@ -58,6 +58,14 @@ class BootstrapError(RuntimeError):
     pass
 
 
+def insufficient_privilege(exc):
+    """The database's own message for a missing privilege, never SQL text or parameters."""
+    orig = getattr(exc, "orig", None)
+    code = getattr(orig, "pgcode", None) or getattr(orig, "sqlstate", None)
+    message = getattr(getattr(orig, "diag", None), "message_primary", None)
+    return message if code == "42501" and message else None
+
+
 class DestroyLocalInput(BaseModel):
     model_config = ConfigDict(extra="forbid")
     path: str
@@ -254,6 +262,8 @@ class RuntimeBootstrap:
                     return
                 if set(self.current) != set(self.expected):
                     self.status = "migration_required"
+                    if not self.current:
+                        self.require_prerequisites(connection)
                     return
                 from metatables.api.backend.operations.catalog_schema import validate_system_schema
                 validate_system_schema(connection, self.backend.catalog)
@@ -261,6 +271,8 @@ class RuntimeBootstrap:
                 row = session.scalar(select(DataSource).where(DataSource.is_runtime.__eq__(True)))
                 if row is None:
                     self.status = "registration_required"
+                    with engine.connect() as connection:
+                        self.require_prerequisites(connection)
                 elif not self.matches(row):
                     self.status = "incompatible"
                     self.error = "The stored runtime DataSource does not match this connection."
@@ -286,6 +298,15 @@ class RuntimeBootstrap:
             self.status = "unavailable"
             self.error = "Cannot verify the selected database or its Alembic history. Check configuration, Secret access and the API's migration version."
 
+    def require_prerequisites(self, connection):
+        # Before any setup DDL: a database the login cannot secure must never be
+        # half-initialized. A registered runtime may hold external objects.
+        problems = self.backend.access.prerequisite_problems(connection)
+        if problems:
+            self.status = "incompatible"
+            self.error = ("MetaTables cannot secure this database: " + "; ".join(problems) + ". Select a database "
+                          "owned by the DataSource login, as described in DataSource database privileges.")
+
     def matches(self, row):
         return (row.class_type == self.candidate["class_type"]
                 and row.configuration == self.candidate["configuration"]
@@ -347,6 +368,10 @@ class RuntimeBootstrap:
             if isinstance(exc, SQLExecutionError):
                 self.error = f"Database access setup failed ({exc.code}). Check the DataSource password Secret and database permissions, then retry setup."
                 raise BootstrapError(self.error) from None
+            if privilege_error := insufficient_privilege(exc):
+                self.error = (f"Database setup failed: {privilege_error}. The DataSource login must own the runtime "
+                              "database and every object in it; see the DataSource database privileges.")
+                raise BootstrapError(self.error) from None
             self.error = "MetaTables migration or registration failed. The runtime was not activated; inspect the database before retrying."
             raise BootstrapError(self.error) from None
 

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/backend/backends/access.py

@@ -60,6 +60,10 @@ class DatabaseAccess:
             ).hexdigest()
         )
 
+    def prerequisite_problems(self, connection):
+        """Read-only reasons this login cannot secure the database; checked before setup."""
+        return []
+
     def initialize(self, session):
         raise NotImplementedError
 

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/src/metatables/api/backend/backends/postgresql_access.py

@@ -13,7 +13,53 @@ def quote(value):
     return '"' + str(value).replace('"', '""') + '"'
 
 
+# Objects outside the system catalogs that the login neither owns nor inherits.
+# Setup revokes PUBLIC access and changes default privileges on every one of
+# them, which PostgreSQL permits only to their owner.
+FOREIGN_OBJECTS = """
+WITH objects AS (
+    SELECT 'schema' AS kind, n.nspname AS name, n.nspowner AS owner,
+           'pg_namespace'::regclass AS classid, n.oid AS objid
+    FROM pg_namespace n
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+    UNION ALL
+    SELECT 'table', n.nspname || '.' || c.relname, c.relowner, 'pg_class'::regclass, c.oid
+    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+      AND c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
+    UNION ALL
+    SELECT 'routine', n.nspname || '.' || p.proname, p.proowner, 'pg_proc'::regclass, p.oid
+    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
+    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
+)
+SELECT pg_get_userbyid(o.owner) AS owner, e.extname AS extension, count(*) AS objects,
+       min(o.kind || ' ' || o.name) AS example
+FROM objects o
+LEFT JOIN pg_depend d ON d.classid = o.classid AND d.objid = o.objid AND d.deptype = 'e'
+LEFT JOIN pg_extension e ON e.oid = d.refobjid
+WHERE NOT pg_has_role(current_user, o.owner, 'MEMBER')
+GROUP BY 1, 2
+ORDER BY 3 DESC, 1
+"""
+
+
 class PostgreSQLAccess(DatabaseAccess):
+    def prerequisite_problems(self, connection):
+        login, database, owns_database, creates_roles = connection.execute(text(
+            "SELECT current_user, current_database(), pg_has_role(current_user, d.datdba, 'MEMBER'), "
+            "r.rolcreaterole OR r.rolsuper FROM pg_database d JOIN pg_roles r ON r.rolname = current_user "
+            "WHERE d.datname = current_database()"
+        )).one()
+        problems = []
+        if not owns_database:
+            problems.append(f'{login} does not own database "{database}"')
+        if not creates_roles:
+            problems.append(f"{login} lacks CREATEROLE")
+        for owner, extension, count, example in connection.execute(text(FOREIGN_OBJECTS)).all()[:3]:
+            source = f" (extension {extension})" if extension else ""
+            problems.append(f"{count} object(s) are owned by {owner}{source}, e.g. {example}")
+        return problems
+
     def initialize(self, session):
         self.identity_secret()
         connection = session.connection()

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev16}/tests/auth/test_data_source_identity.py

@@ -83,3 +83,89 @@ def test_legacy_runtime_alias_is_reconciled_without_losing_other_sources(tmp_pat
     restarted = RuntimeBootstrap(bootstrap.config, None)
     assert restarted.initial_candidate() == bootstrap.candidate
     assert restarted.selected_source_uid == str(canonical)
+
+
+def test_setup_reports_the_database_privilege_error_without_sql_or_parameters(tmp_path, monkeypatch):
+    import pytest
+    from sqlalchemy.exc import ProgrammingError
+
+    from metatables.api.app.bootstrap import BootstrapError
+
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False,
+        configuration_path=tmp_path / "configuration.yaml"), None)
+    bootstrap.selected_source_uid = str(uuid4())
+    bootstrap.candidate = dict(display_name="Hosted", class_type="timescale_db", configuration={
+        "host": "db.example.invalid", "database_name": "tables", "database_user": "tables"})
+    engine = create_catalog_engine(f"sqlite:///{tmp_path / 'catalog.sqlite'}", allow_sqlite=True)
+    bootstrap.engine = engine
+    bootstrap.factory = sessionmaker(engine, expire_on_commit=False)
+
+    @dataclass
+    class Source:
+        uid: UUID | None = None
+
+    bootstrap.backend = SimpleNamespace(source=Source())
+    monkeypatch.setattr(bootstrap, "migration_lock", nullcontext)
+    monkeypatch.setattr(bootstrap, "inspect", lambda: setattr(bootstrap, "status", "registration_required"))
+    # A TimescaleDB runtime whose extension objects belong to the superuser.
+    denied = SimpleNamespace(pgcode="42501", diag=SimpleNamespace(message_primary="permission denied for table job_errors"))
+
+    def initialize(session):
+        raise ProgrammingError('REVOKE ALL ON ALL TABLES IN SCHEMA "_timescaledb_internal" FROM PUBLIC',
+                               {"password": "do-not-show"}, denied)
+
+    monkeypatch.setattr("metatables.api.backend.backends.registry.backend_for", lambda source:
+        SimpleNamespace(access=SimpleNamespace(initialize=initialize)))
+    try:
+        with pytest.raises(BootstrapError) as raised:
+            bootstrap.migrate(uuid4())
+    finally:
+        bootstrap.close()
+    message = str(raised.value)
+    assert "permission denied for table job_errors" in message
+    assert "must own the runtime database" in message
+    assert "REVOKE" not in message and "do-not-show" not in message
+    assert bootstrap.error == message
+
+
+def _fresh_hosted_bootstrap(tmp_path, problems):
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False,
+        configuration_path=tmp_path / "configuration.yaml"), None)
+    bootstrap.candidate = dict(display_name="Development", class_type="timescale_db", configuration={
+        "host": "db.example.invalid", "database_name": "development", "database_user": "metatables_dev"})
+    engine = create_catalog_engine(f"sqlite:///{tmp_path / 'catalog.sqlite'}", allow_sqlite=True)
+    bootstrap.engine = engine
+    bootstrap.factory = sessionmaker(engine, expire_on_commit=False)
+    bootstrap.backend = SimpleNamespace(access=SimpleNamespace(prerequisite_problems=lambda connection: problems))
+    return bootstrap
+
+
+def test_unsecurable_database_is_blocked_before_any_setup_ddl(tmp_path, monkeypatch):
+    import pytest
+
+    from metatables.api.app.bootstrap import BootstrapError
+
+    bootstrap = _fresh_hosted_bootstrap(tmp_path, [
+        'metatables_dev does not own database "development"',
+        "312 object(s) are owned by postgres (extension timescaledb), e.g. schema _timescaledb_internal",
+    ])
+    monkeypatch.setattr("metatables.api.app.bootstrap.upgrade_catalog",
+                        lambda engine: pytest.fail("Setup DDL ran on a database the login cannot secure"))
+    try:
+        bootstrap.inspect()
+        assert bootstrap.status == "incompatible"
+        assert 'metatables_dev does not own database "development"' in bootstrap.error
+        assert "extension timescaledb" in bootstrap.error
+        with pytest.raises(BootstrapError, match="cannot secure this database"):
+            bootstrap.migrate(uuid4())
+    finally:
+        bootstrap.close()
+
+
+def test_securable_fresh_database_still_requires_migrations(tmp_path):
+    bootstrap = _fresh_hosted_bootstrap(tmp_path, [])
+    try:
+        bootstrap.inspect()
+        assert bootstrap.status == "migration_required" and bootstrap.error is None
+    finally:
+        bootstrap.close()