mainsequence-metatable 0.1.8.dev15__tar.gz → 0.1.8.dev17__tar.gz

{mainsequence_metatable-0.1.8.dev15/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.8.dev17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev15
+Version: 0.1.8.dev17
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -28,7 +28,8 @@ does not cache this API's runtime context or select its runtime mode or DataSour
 Updated 2026-09-28: application Environment policy and relationships are removed.
 Amended 2026-09-29: one enforced runtime binding and explicit bootstrap select one
 database for system and user tables.
-Amended 2026-10-02: each runtime mode lists and selects only its own DataSources.
+Amended 2026-10-02: each runtime mode lists and selects only its own DataSources,
+and inspection checks the login's prerequisites before setup.
 
 Companion decision: [Main Sequence SDK ADR 0035: Independent Git source and platform execution context](https://github.com/mainsequence-sdk/mainsequence-sdk/blob/metatables_removal/docs/adr/0035-independent-git-source-and-platform-context.md).
 The SDK prerequisite is implemented on `metatables_removal`; the current local
@@ -172,6 +173,14 @@ configuration inserted as the runtime DataSource in that database. Failed work
 never activates a partially initialized runtime. A database already initialized
 and compatible can be selected without running migrations.
 
+Amended 2026-10-02: before any runtime is registered, inspection also checks,
+read-only, the login's prerequisites under
+[ADR 0007](0007-database-enforced-table-access.md): `CREATEROLE`, and permission to
+create the `metatables` schema and tables in the default schema. Unmet
+prerequisites make the target incompatible, with each reason shown in Settings,
+so setup never leaves a database half-initialized. A registered runtime is not
+rechecked.
+
 Settings, runtime context, mode selection and bootstrap actions do not depend on
 catalog sessions or catalog memberships. They retain the existing request admission.
 The caller who configures a pending target controls its initialization; an existing

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/docs/adr/api/0007-database-enforced-table-access.md

@@ -6,6 +6,14 @@
 > conflicting application-migration execution and credential restrictions;
 > governed API operations and MetaTables system migrations remain separate.
 
+> Amendment (2026-10-02): MetaTables secures only what it owns: its `metatables`
+> schema, the tables it manages and the roles it creates. Database-wide defaults
+> and `PUBLIC` access to other owners' objects, including extensions and other
+> applications sharing the database, are the database administrator's
+> responsibility. The login needs `CREATEROLE` and permission to create the
+> `metatables` schema and tables in the DataSource's default schema; it need not
+> own the database.
+
 
 Date: 2026-09-29
 
@@ -160,12 +168,14 @@ client.
 - **Ownership.** Tables are owned by `mt_owner`, a role that cannot log in, because
   an owner holds every privilege. The API's own role manages grants and schema
   changes and never runs caller SQL.
-- **Defaults.** PostgreSQL's default `PUBLIC` privileges are revoked: connecting,
-  creating objects and temporary tables, and executing new functions.
+- **Defaults.** On objects MetaTables owns, PostgreSQL's default `PUBLIC`
+  privileges are revoked, including for future tables and routines. Database-wide
+  defaults (connecting, creating objects and temporary tables) and other owners'
+  objects belong to the database administrator.
 - **Privileged routines.** Restricted caller roles must not be able to execute
   application routines with elevated owner privileges, including
   `SECURITY DEFINER` routines. Initialization establishes this restriction for
-  existing routines as well as future defaults, covering direct grants, inherited
+  the routines MetaTables owns, existing and future, covering direct grants, inherited
   roles and `PUBLIC`. Revoking a direct User grant alone is insufficient if
   another grant still permits execution. Schema changes and extension installation
   preserve the restriction before exposing new or changed routines to callers.
@@ -261,7 +271,8 @@ and [MySQL implicit commits](https://dev.mysql.com/doc/refman/8.4/en/implicit-co
 
 - The explorer can run any PostgreSQL query, and the API has no SQL parser left
   to get wrong.
-- The DataSource login needs `CREATEROLE`.
+- The DataSource login needs `CREATEROLE` and the right to create the `metatables`
+  schema; it does not need to own the database.
 - Physical table names become visible to explorer users.
 - Cascading foreign keys are unavailable where the explorer is enabled.
 - Team membership reaches the database at the pace of the existing one-hour

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/docs/api/data-sources.md

@@ -173,14 +173,26 @@ uses the selected database as its SQL schema. SQL Server 2022 uses `dbo` for the
 system schema; application providers may use approved schemas in that database.
 
 The API database login manages native caller identities as well as schema. PostgreSQL
-requires `CREATEROLE`, ownership of the runtime database and management rights on
-`mt_owner` if it already exists. It stores the catalog in the private `metatables`
+requires `CREATEROLE`, permission to create the `metatables` schema in the runtime
+database and tables in its default schema, and management rights on `mt_owner` if
+it already exists. It does not need to own the database. It stores the catalog in the private `metatables`
 schema. MySQL requires account/role administration, privilege disclosure and grant
 rights on the selected database, `TRIGGER` visibility, and permission to cancel
 other caller sessions. SQL Server requires login/user/role administration,
 `VIEW DEFINITION` and grant management. Managed database services must provide
 these capabilities; missing permissions leave caller SQL disabled.
 
+Settings checks these PostgreSQL requirements as soon as you select a database
+without a MetaTables runtime, before any migration runs. A missing one shows
+**Needs attention** with the reason, for example `metatables_dev lacks CREATEROLE`;
+**Run MetaTables migrations** stays unavailable and nothing is written.
+
+The database may be shared with other applications. Setup revokes `PUBLIC` access
+only on objects MetaTables owns: its `metatables` schema, the tables it manages and
+the roles it creates. Database-wide defaults and other owners' objects, including
+extensions such as TimescaleDB and pgvector, are the database administrator's
+responsibility.
+
 Hosted sources require a password Secret to derive per-User database credentials.
 MySQL global mandatory roles are unsupported. Registration admits ordinary tables
 only; it does not transfer external ownership. Privileged routines and triggers

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/docs/operations/catalog-migrations.md

@@ -10,7 +10,7 @@ system tables, including `data_source`, alongside user tables. There is no separ
 catalog connection to configure. Local and hosted use the same initialization flow.
 
 1. For Hosted mode, register a PostgreSQL, TimescaleDB, MySQL or MSSQL connection under **MetaTables → Data Sources**. This registration is available before the hosted catalog is initialized.
-2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions.
+2. Open **Settings**, choose Hosted runtime mode, and select that registered DataSource from the list. Local mode prefills the single local SQLite runtime file, shared across Git branches, and uses **Check DataSource**. Choosing a hosted DataSource and switching modes are separate actions. For a database without a MetaTables runtime, selection also checks that the login can secure it; **Needs attention** lists what is missing ([database privileges](../api/data-sources.md#database-privileges-and-sql-behavior)) and no migration can run until another database is selected.
 3. For an empty or outdated database, click **Run MetaTables migrations**. This
    explicitly runs the packaged Alembic history. After success, the API saves the
    proposal as the runtime DataSource inside the newly initialized registry.

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.8.dev15"
+version = "0.1.8.dev17"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev15
+Version: 0.1.8.dev17
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/src/metatables/api/app/bootstrap.py

@@ -58,6 +58,14 @@ class BootstrapError(RuntimeError):
     pass
 
 
+def insufficient_privilege(exc):
+    """The database's own message for a missing privilege, never SQL text or parameters."""
+    orig = getattr(exc, "orig", None)
+    code = getattr(orig, "pgcode", None) or getattr(orig, "sqlstate", None)
+    message = getattr(getattr(orig, "diag", None), "message_primary", None)
+    return message if code == "42501" and message else None
+
+
 class DestroyLocalInput(BaseModel):
     model_config = ConfigDict(extra="forbid")
     path: str
@@ -254,6 +262,8 @@ class RuntimeBootstrap:
                     return
                 if set(self.current) != set(self.expected):
                     self.status = "migration_required"
+                    if not self.current:
+                        self.require_prerequisites(connection)
                     return
                 from metatables.api.backend.operations.catalog_schema import validate_system_schema
                 validate_system_schema(connection, self.backend.catalog)
@@ -261,6 +271,8 @@ class RuntimeBootstrap:
                 row = session.scalar(select(DataSource).where(DataSource.is_runtime.__eq__(True)))
                 if row is None:
                     self.status = "registration_required"
+                    with engine.connect() as connection:
+                        self.require_prerequisites(connection)
                 elif not self.matches(row):
                     self.status = "incompatible"
                     self.error = "The stored runtime DataSource does not match this connection."
@@ -286,6 +298,15 @@ class RuntimeBootstrap:
             self.status = "unavailable"
             self.error = "Cannot verify the selected database or its Alembic history. Check configuration, Secret access and the API's migration version."
 
+    def require_prerequisites(self, connection):
+        # Before any setup DDL: a database the login cannot secure must never be
+        # half-initialized. A registered runtime may hold external objects.
+        problems = self.backend.access.prerequisite_problems(connection)
+        if problems:
+            self.status = "incompatible"
+            self.error = ("MetaTables cannot secure this database: " + "; ".join(problems) + ". Select a database "
+                          "owned by the DataSource login, as described in DataSource database privileges.")
+
     def matches(self, row):
         return (row.class_type == self.candidate["class_type"]
                 and row.configuration == self.candidate["configuration"]
@@ -347,6 +368,10 @@ class RuntimeBootstrap:
             if isinstance(exc, SQLExecutionError):
                 self.error = f"Database access setup failed ({exc.code}). Check the DataSource password Secret and database permissions, then retry setup."
                 raise BootstrapError(self.error) from None
+            if privilege_error := insufficient_privilege(exc):
+                self.error = (f"Database setup failed: {privilege_error}. The DataSource login must own the runtime "
+                              "database and every object in it; see the DataSource database privileges.")
+                raise BootstrapError(self.error) from None
             self.error = "MetaTables migration or registration failed. The runtime was not activated; inspect the database before retrying."
             raise BootstrapError(self.error) from None
 

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/src/metatables/api/backend/backends/access.py

@@ -60,6 +60,10 @@ class DatabaseAccess:
             ).hexdigest()
         )
 
+    def prerequisite_problems(self, connection):
+        """Read-only reasons this login cannot secure the database; checked before setup."""
+        return []
+
     def initialize(self, session):
         raise NotImplementedError
 

{mainsequence_metatable-0.1.8.dev15 → mainsequence_metatable-0.1.8.dev17}/src/metatables/api/backend/backends/postgresql_access.py

@@ -13,18 +13,47 @@ def quote(value):
     return '"' + str(value).replace('"', '""') + '"'
 
 
+# MetaTables secures only objects this login owns, directly or through
+# membership (mt_owner). PUBLIC access to anything else in the database is its
+# administrator's responsibility (ADR 0007, amended 2026-10-02).
+OWNED = "pg_has_role(current_user, {owner}, 'MEMBER')"
+USER_SCHEMA = "{schema} !~ '^pg_' AND {schema} <> 'information_schema'"
+
+
 class PostgreSQLAccess(DatabaseAccess):
+    def prerequisite_problems(self, connection):
+        schema = getattr(self.source.connection, "default_schema", None) or "public"
+        login, database, creates_roles, creates_schemas, catalog_owner, tables = connection.execute(text(
+            "SELECT current_user, current_database(), r.rolcreaterole OR r.rolsuper, "
+            "has_database_privilege(current_database(), 'CREATE'), "
+            "(SELECT pg_get_userbyid(nspowner) FROM pg_namespace WHERE nspname = 'metatables' "
+            "AND NOT pg_has_role(current_user, nspowner, 'MEMBER')), "
+            "(SELECT has_schema_privilege(oid, 'USAGE') AND has_schema_privilege(oid, 'CREATE') "
+            "FROM pg_namespace WHERE nspname = :schema) "
+            "FROM pg_roles r WHERE r.rolname = current_user"
+        ), {"schema": schema}).one()
+        problems = []
+        if not creates_roles:
+            problems.append(f"{login} lacks CREATEROLE")
+        if catalog_owner:
+            problems.append(f'schema "metatables" belongs to {catalog_owner}')
+        elif not creates_schemas:
+            problems.append(f'{login} cannot create schemas in database "{database}"')
+        if not tables:
+            problems.append(f'{login} cannot create tables in schema "{schema}"')
+        return problems
+
     def initialize(self, session):
         self.identity_secret()
         connection = session.connection()
         self._role(connection, "mt_owner")
         api = connection.exec_driver_sql("SELECT current_user").scalar()
         connection.exec_driver_sql(f"GRANT mt_owner TO {quote(api)}")
-        database = connection.exec_driver_sql("SELECT current_database()").scalar()
-        connection.exec_driver_sql("GRANT USAGE, CREATE ON SCHEMA public TO mt_owner")
-        connection.exec_driver_sql(f"REVOKE ALL ON DATABASE {quote(database)} FROM PUBLIC")
+        if connection.exec_driver_sql(
+            "SELECT has_schema_privilege(oid, 'CREATE WITH GRANT OPTION') FROM pg_namespace WHERE nspname='public'"
+        ).scalar():
+            connection.exec_driver_sql("GRANT USAGE, CREATE ON SCHEMA public TO mt_owner")
         connection.exec_driver_sql("REVOKE ALL ON SCHEMA metatables FROM PUBLIC")
-        connection.exec_driver_sql("REVOKE CREATE ON SCHEMA public FROM PUBLIC")
         state = session.get(SQLSecurityState, 1)
         if state is None:
             state = SQLSecurityState(id=1, ready=True, pending=True, manifest={})
@@ -59,39 +88,46 @@ class PostgreSQLAccess(DatabaseAccess):
         else:
             connection.exec_driver_sql(f"ALTER ROLE {quote(name)} NOLOGIN")
 
+    def owned_schemas(self, connection):
+        return connection.exec_driver_sql(
+            "SELECT nspname FROM pg_namespace WHERE " + USER_SCHEMA.format(schema="nspname")
+            + " AND " + OWNED.format(owner="nspowner")
+        ).scalars().all()
+
     def secure_routines(self, connection, managed_roles):
-        """Inspect only at initialization/schema changes/reconciliation."""
+        """Inspect only at initialization/schema changes/reconciliation.
+
+        Covers the objects this login owns; other owners' objects are left to
+        the database administrator.
+        """
         invoker = self.role("invoker", "routines")
         self._role(connection, invoker)
-        schemas = (
-            connection.exec_driver_sql(
-                "SELECT nspname FROM pg_namespace WHERE nspname !~ '^pg_' AND nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
-        for schema in schemas:
-            connection.exec_driver_sql(
-                f"REVOKE ALL ON ALL TABLES IN SCHEMA {quote(schema)} FROM PUBLIC"
-            )
+        for schema in self.owned_schemas(connection):
             if schema != "metatables":
                 connection.exec_driver_sql(
                     f"GRANT USAGE ON SCHEMA {quote(schema)} TO {quote(invoker)}"
                 )
+        public_tables = connection.exec_driver_sql(
+            "SELECT DISTINCT n.nspname, c.relname FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace "
+            "CROSS JOIN LATERAL aclexplode(c.relacl) acl WHERE acl.grantee=0 AND c.relkind IN ('r','p','v','m','f') AND "
+            + USER_SCHEMA.format(schema="n.nspname") + " AND " + OWNED.format(owner="c.relowner")
+        ).all()
+        for schema, table in public_tables:
+            connection.exec_driver_sql(f"REVOKE ALL ON TABLE {quote(schema)}.{quote(table)} FROM PUBLIC")
         public_columns = connection.exec_driver_sql(
-            "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl WHERE acl.grantee=0 AND n.nspname !~ '^pg_'"
+            "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid "
+            "JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl "
+            "WHERE acl.grantee=0 AND n.nspname !~ '^pg_' AND " + OWNED.format(owner="c.relowner")
         ).all()
         for schema, table, column in public_columns:
             connection.exec_driver_sql(
                 f"REVOKE ALL ({quote(column)}) ON TABLE {quote(schema)}.{quote(table)} FROM PUBLIC"
             )
-        owners = (
-            connection.exec_driver_sql(
-                "SELECT DISTINCT r.rolname FROM pg_proc p JOIN pg_roles r ON r.oid=p.proowner JOIN pg_namespace n ON n.oid=p.pronamespace WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
+        owners = connection.exec_driver_sql(
+            "SELECT DISTINCT r.rolname FROM pg_proc p JOIN pg_roles r ON r.oid=p.proowner "
+            "JOIN pg_namespace n ON n.oid=p.pronamespace WHERE " + USER_SCHEMA.format(schema="n.nspname")
+            + " AND " + OWNED.format(owner="p.proowner")
+        ).scalars().all()
         owners = set(owners) | {
             "mt_owner",
             connection.exec_driver_sql("SELECT current_user").scalar(),
@@ -108,24 +144,17 @@ class PostgreSQLAccess(DatabaseAccess):
         grantees = "PUBLIC, " + ", ".join(
             quote(role) for role in sorted((set(managed_roles) | {invoker}) & existing)
         )
-        for schema in schemas:
-            for noun in ("FUNCTIONS", "PROCEDURES"):
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL {noun} IN SCHEMA {quote(schema)} FROM {grantees}"
-                )
-                if schema != "metatables":
-                    connection.exec_driver_sql(
-                        f"GRANT EXECUTE ON ALL {noun} IN SCHEMA {quote(schema)} TO {quote(invoker)}"
-                    )
-        # Revoke elevated routines within the same transaction before publishing
-        # permissions. Batch schema grants avoid an objects-by-principals loop.
+        # Restricted callers never execute routines with elevated owner privileges.
         routines = connection.exec_driver_sql(
-            "SELECT n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.prokind FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace WHERE p.prosecdef AND n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'"
+            "SELECT n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.prosecdef "
+            "FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace WHERE "
+            + USER_SCHEMA.format(schema="n.nspname") + " AND " + OWNED.format(owner="p.proowner")
         ).all()
-        for schema, name, arguments, kind in routines:
-            noun = "PROCEDURE" if kind == "p" else "FUNCTION"
+        for schema, name, arguments, elevated in routines:
             target = f"{quote(schema)}.{quote(name)}({arguments})"
-            connection.exec_driver_sql(f"REVOKE ALL ON {noun} {target} FROM {quote(invoker)}")
+            connection.exec_driver_sql(f"REVOKE ALL ON ROUTINE {target} FROM {grantees}")
+            if schema != "metatables" and not elevated:
+                connection.exec_driver_sql(f"GRANT EXECUTE ON ROUTINE {target} TO {quote(invoker)}")
 
     def validate_table(self, connection, table):
         schema = table.physical_schema or "public"
@@ -135,7 +164,7 @@ class PostgreSQLAccess(DatabaseAccess):
             raise SQLExecutionError(code="catalog_table_registration_denied")
         relation = f"{quote(schema)}.{quote(table.physical_table_name)}"
         row = connection.execute(
-            text("SELECT oid, relkind FROM pg_class WHERE oid=to_regclass(:relation)"),
+            text("SELECT oid, relkind, " + OWNED.format(owner="relowner") + " AS owned FROM pg_class WHERE oid=to_regclass(:relation)"),
             {"relation": relation},
         ).first()
         if row is not None and row.relkind == "v":
@@ -159,7 +188,8 @@ class PostgreSQLAccess(DatabaseAccess):
             ),
             {"oid": row.oid},
         ).first()
-        connection.exec_driver_sql(f"REVOKE ALL ON TABLE {relation} FROM PUBLIC")
+        if row.owned:
+            connection.exec_driver_sql(f"REVOKE ALL ON TABLE {relation} FROM PUBLIC")
         if table.management_mode == "platform_managed":
             connection.exec_driver_sql(f"ALTER TABLE {relation} OWNER TO mt_owner")
         return trigger is None
@@ -183,13 +213,7 @@ class PostgreSQLAccess(DatabaseAccess):
         for name, definition in roles.items():
             self._role(connection, name, self.password(name) if definition["login"] else None)
         names = set(roles) | set(previous.get("roles", {})) | {invoker}
-        schemas = (
-            connection.exec_driver_sql(
-                "SELECT nspname FROM pg_namespace WHERE nspname !~ '^pg_' AND nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
+        schemas = self.owned_schemas(connection)
         for name in sorted(names):
             owned = connection.execute(
                 text(
@@ -215,20 +239,25 @@ class PostgreSQLAccess(DatabaseAccess):
             connection.exec_driver_sql(
                 f"REVOKE ALL ON DATABASE {quote(database)} FROM {quote(name)}"
             )
-            for schema in schemas:
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL SEQUENCES IN SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL TABLES IN SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
+            # Revoke this role's grants on owned objects; other owners' grants are theirs.
+            granted = connection.execute(
+                text(
+                    "SELECT 'SCHEMA', quote_ident(n.nspname) FROM pg_namespace n CROSS JOIN LATERAL aclexplode(n.nspacl) acl "
+                    "JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND " + OWNED.format(owner="n.nspowner")
+                    + " UNION SELECT CASE WHEN c.relkind='S' THEN 'SEQUENCE' ELSE 'TABLE' END, "
+                    "quote_ident(n.nspname) || '.' || quote_ident(c.relname) FROM pg_class c "
+                    "JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(c.relacl) acl "
+                    "JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND " + OWNED.format(owner="c.relowner")
+                ),
+                {"name": name},
+            ).all()
+            for kind, target in granted:
+                connection.exec_driver_sql(f"REVOKE ALL ON {kind} {target} FROM {quote(name)}")
             # Table-level REVOKE does not remove separately granted column ACLs.
             columns = connection.execute(
                 text(
-                    "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND n.nspname !~ '^pg_'"
+                    "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND n.nspname !~ '^pg_' AND "
+                    + OWNED.format(owner="c.relowner")
                 ),
                 {"name": name},
             ).all()

mainsequence_metatable-0.1.8.dev17/tests/auth/test_data_source_identity.py

@@ -0,0 +1,190 @@
+"""A DataSource keeps its registration identity when its catalog is initialized."""
+from contextlib import nullcontext
+from dataclasses import dataclass
+from types import SimpleNamespace
+from uuid import UUID, uuid4
+
+from sqlalchemy import select
+from sqlalchemy.orm import sessionmaker
+
+from metatables.api.app.bootstrap import RuntimeBootstrap
+from metatables.api.app.runtime import RuntimeConfig
+from metatables.api.app.runtime_control import write_state
+from metatables.api.app.source_registrations import read_registry, reconcile_runtime
+from metatables.api.backend.persistence.database import create_catalog_engine, upgrade_catalog
+from metatables.api.backend.persistence.models import DataSource
+
+
+def test_hosted_bootstrap_preserves_registered_datasource_uid(tmp_path, monkeypatch):
+    configuration = tmp_path / "configuration.yaml"
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False, configuration_path=configuration), None)
+    uid, user = uuid4(), uuid4()
+    bootstrap.selected_source_uid = str(uid)
+    bootstrap.candidate = dict(display_name="Hosted", class_type="postgresql", configuration={
+        "host": "db.example.invalid", "database_name": "tables", "database_user": "tables"})
+    engine = create_catalog_engine(f"sqlite:///{tmp_path / 'catalog.sqlite'}", allow_sqlite=True)
+    upgrade_catalog(engine)
+    bootstrap.engine = engine
+    bootstrap.factory = sessionmaker(engine, expire_on_commit=False)
+
+    @dataclass
+    class Source:
+        uid: UUID | None = None
+
+    bootstrap.backend = SimpleNamespace(source=Source())
+    # Keep the actual migration/registration transaction; isolate hosted driver
+    # and schema-access setup, which the engine contract tests cover separately.
+    monkeypatch.setattr(bootstrap, "migration_lock", nullcontext)
+    monkeypatch.setattr("metatables.api.backend.backends.registry.backend_for", lambda source:
+        SimpleNamespace(access=SimpleNamespace(initialize=lambda session: None)))
+
+    def inspect_registration():
+        with bootstrap.factory() as session:
+            row = session.scalar(select(DataSource).where(DataSource.is_runtime.is_(True)))
+            bootstrap.status = "ready" if row else "registration_required"
+            bootstrap.uid = row.uid if row else None
+    monkeypatch.setattr(bootstrap, "inspect", inspect_registration)
+    try:
+        bootstrap.migrate(user)
+        with bootstrap.factory() as session:
+            rows = session.scalars(select(DataSource)).all()
+            assert len(rows) == 1
+            assert rows[0].uid == uid
+            assert rows[0].is_runtime and rows[0].is_default
+        assert bootstrap.uid == uid
+        bootstrap.migrate(user)
+        with bootstrap.factory() as session:
+            assert session.scalar(select(DataSource.uid)) == uid
+    finally:
+        bootstrap.close()
+
+
+def test_legacy_runtime_alias_is_reconciled_without_losing_other_sources(tmp_path):
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False,
+        configuration_path=tmp_path / "configuration.yaml"), None)
+    alias, canonical, other = uuid4(), uuid4(), uuid4()
+    config = {"host": "db.example.invalid", "database_name": "tables", "database_user": "tables"}
+    bootstrap.candidate = dict(display_name="Hosted", class_type="postgresql", configuration=config)
+    bootstrap.selected_source_uid = str(alias)
+    from datetime import datetime, timezone
+    row = DataSource(uid=canonical, display_name="Hosted", class_type="postgresql", configuration=config,
+        status="AVAILABLE", storage_access_mode="read_write", created_at=datetime.now(timezone.utc))
+    path = bootstrap.saved_path.with_name("runtime-source-candidates.json")
+    path.parent.mkdir(parents=True)
+    original = {"uid": str(alias), **bootstrap.candidate}
+    untouched = {"uid": str(other), "display_name": "Another source"}
+    write_state(path, {str(alias): original, str(other): untouched})
+    reconcile_runtime(bootstrap, row, persist=False)
+    saved = read_registry(path)
+    assert set(saved) == {str(canonical), str(other)}
+    assert saved[str(other)] == untouched
+    assert saved[str(canonical)]["configuration"] == config
+    assert bootstrap.selected_source_uid == str(canonical)
+    restarted = RuntimeBootstrap(bootstrap.config, None)
+    assert restarted.initial_candidate() == bootstrap.candidate
+    assert restarted.selected_source_uid == str(canonical)
+
+
+def test_setup_reports_the_database_privilege_error_without_sql_or_parameters(tmp_path, monkeypatch):
+    import pytest
+    from sqlalchemy.exc import ProgrammingError
+
+    from metatables.api.app.bootstrap import BootstrapError
+
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False,
+        configuration_path=tmp_path / "configuration.yaml"), None)
+    bootstrap.selected_source_uid = str(uuid4())
+    bootstrap.candidate = dict(display_name="Hosted", class_type="timescale_db", configuration={
+        "host": "db.example.invalid", "database_name": "tables", "database_user": "tables"})
+    engine = create_catalog_engine(f"sqlite:///{tmp_path / 'catalog.sqlite'}", allow_sqlite=True)
+    bootstrap.engine = engine
+    bootstrap.factory = sessionmaker(engine, expire_on_commit=False)
+
+    @dataclass
+    class Source:
+        uid: UUID | None = None
+
+    bootstrap.backend = SimpleNamespace(source=Source())
+    monkeypatch.setattr(bootstrap, "migration_lock", nullcontext)
+    monkeypatch.setattr(bootstrap, "inspect", lambda: setattr(bootstrap, "status", "registration_required"))
+    # A TimescaleDB runtime whose extension objects belong to the superuser.
+    denied = SimpleNamespace(pgcode="42501", diag=SimpleNamespace(message_primary="permission denied for table job_errors"))
+
+    def initialize(session):
+        raise ProgrammingError('REVOKE ALL ON ALL TABLES IN SCHEMA "_timescaledb_internal" FROM PUBLIC',
+                               {"password": "do-not-show"}, denied)
+
+    monkeypatch.setattr("metatables.api.backend.backends.registry.backend_for", lambda source:
+        SimpleNamespace(access=SimpleNamespace(initialize=initialize)))
+    try:
+        with pytest.raises(BootstrapError) as raised:
+            bootstrap.migrate(uuid4())
+    finally:
+        bootstrap.close()
+    message = str(raised.value)
+    assert "permission denied for table job_errors" in message
+    assert "must own the runtime database" in message
+    assert "REVOKE" not in message and "do-not-show" not in message
+    assert bootstrap.error == message
+
+
+def _fresh_hosted_bootstrap(tmp_path, problems):
+    bootstrap = RuntimeBootstrap(RuntimeConfig(local_mode=False,
+        configuration_path=tmp_path / "configuration.yaml"), None)
+    bootstrap.candidate = dict(display_name="Development", class_type="timescale_db", configuration={
+        "host": "db.example.invalid", "database_name": "development", "database_user": "metatables_dev"})
+    engine = create_catalog_engine(f"sqlite:///{tmp_path / 'catalog.sqlite'}", allow_sqlite=True)
+    bootstrap.engine = engine
+    bootstrap.factory = sessionmaker(engine, expire_on_commit=False)
+    bootstrap.backend = SimpleNamespace(access=SimpleNamespace(prerequisite_problems=lambda connection: problems))
+    return bootstrap
+
+
+def test_unsecurable_database_is_blocked_before_any_setup_ddl(tmp_path, monkeypatch):
+    import pytest
+
+    from metatables.api.app.bootstrap import BootstrapError
+
+    bootstrap = _fresh_hosted_bootstrap(tmp_path, [
+        'metatables_dev does not own database "development"',
+        "312 object(s) are owned by postgres (extension timescaledb), e.g. schema _timescaledb_internal",
+    ])
+    monkeypatch.setattr("metatables.api.app.bootstrap.upgrade_catalog",
+                        lambda engine: pytest.fail("Setup DDL ran on a database the login cannot secure"))
+    try:
+        bootstrap.inspect()
+        assert bootstrap.status == "incompatible"
+        assert 'metatables_dev does not own database "development"' in bootstrap.error
+        assert "extension timescaledb" in bootstrap.error
+        with pytest.raises(BootstrapError, match="cannot secure this database"):
+            bootstrap.migrate(uuid4())
+    finally:
+        bootstrap.close()
+
+
+def test_securable_fresh_database_still_requires_migrations(tmp_path):
+    bootstrap = _fresh_hosted_bootstrap(tmp_path, [])
+    try:
+        bootstrap.inspect()
+        assert bootstrap.status == "migration_required" and bootstrap.error is None
+    finally:
+        bootstrap.close()
+
+
+def test_postgresql_prerequisites_name_only_what_metatables_needs():
+    from metatables.api.backend.backends.postgresql_access import PostgreSQLAccess
+
+    def check(row, schema="public"):
+        access = PostgreSQLAccess.__new__(PostgreSQLAccess)
+        access.source = SimpleNamespace(connection=SimpleNamespace(default_schema=schema))
+        connection = SimpleNamespace(execute=lambda *args: SimpleNamespace(one=lambda: row))
+        return access.prerequisite_problems(connection)
+
+    # A shared database qualifies: the login need not own it or anyone else's objects.
+    assert check(("metatables_dev", "development", True, True, None, True)) == []
+    assert check(("app", "shared", False, False, None, False), schema="tables") == [
+        "app lacks CREATEROLE",
+        'app cannot create schemas in database "shared"',
+        'app cannot create tables in schema "tables"',
+    ]
+    assert check(("app", "shared", True, False, "someone", True)) == ['schema "metatables" belongs to someone']