mainsequence-metatable 0.1.8.dev16__tar.gz → 0.1.8.dev17__tar.gz

{mainsequence_metatable-0.1.8.dev16/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.8.dev17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev16
+Version: 0.1.8.dev17
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -174,12 +174,12 @@ never activates a partially initialized runtime. A database already initialized
 and compatible can be selected without running migrations.
 
 Amended 2026-10-02: before any runtime is registered, inspection also checks,
-read-only, that the login can secure the database under
-[ADR 0007](0007-database-enforced-table-access.md): it owns the database, has
-`CREATEROLE`, and owns every non-system object. Unmet prerequisites make the
-target incompatible, with each reason shown in Settings, so setup never leaves a
-database half-initialized. A registered runtime is not rechecked, because it may
-hold imported external objects.
+read-only, the login's prerequisites under
+[ADR 0007](0007-database-enforced-table-access.md): `CREATEROLE`, and permission to
+create the `metatables` schema and tables in the default schema. Unmet
+prerequisites make the target incompatible, with each reason shown in Settings,
+so setup never leaves a database half-initialized. A registered runtime is not
+rechecked.
 
 Settings, runtime context, mode selection and bootstrap actions do not depend on
 catalog sessions or catalog memberships. They retain the existing request admission.

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/docs/adr/api/0007-database-enforced-table-access.md

@@ -6,6 +6,14 @@
 > conflicting application-migration execution and credential restrictions;
 > governed API operations and MetaTables system migrations remain separate.
 
+> Amendment (2026-10-02): MetaTables secures only what it owns: its `metatables`
+> schema, the tables it manages and the roles it creates. Database-wide defaults
+> and `PUBLIC` access to other owners' objects, including extensions and other
+> applications sharing the database, are the database administrator's
+> responsibility. The login needs `CREATEROLE` and permission to create the
+> `metatables` schema and tables in the DataSource's default schema; it need not
+> own the database.
+
 
 Date: 2026-09-29
 
@@ -160,12 +168,14 @@ client.
 - **Ownership.** Tables are owned by `mt_owner`, a role that cannot log in, because
   an owner holds every privilege. The API's own role manages grants and schema
   changes and never runs caller SQL.
-- **Defaults.** PostgreSQL's default `PUBLIC` privileges are revoked: connecting,
-  creating objects and temporary tables, and executing new functions.
+- **Defaults.** On objects MetaTables owns, PostgreSQL's default `PUBLIC`
+  privileges are revoked, including for future tables and routines. Database-wide
+  defaults (connecting, creating objects and temporary tables) and other owners'
+  objects belong to the database administrator.
 - **Privileged routines.** Restricted caller roles must not be able to execute
   application routines with elevated owner privileges, including
   `SECURITY DEFINER` routines. Initialization establishes this restriction for
-  existing routines as well as future defaults, covering direct grants, inherited
+  the routines MetaTables owns, existing and future, covering direct grants, inherited
   roles and `PUBLIC`. Revoking a direct User grant alone is insufficient if
   another grant still permits execution. Schema changes and extension installation
   preserve the restriction before exposing new or changed routines to callers.
@@ -261,7 +271,8 @@ and [MySQL implicit commits](https://dev.mysql.com/doc/refman/8.4/en/implicit-co
 
 - The explorer can run any PostgreSQL query, and the API has no SQL parser left
   to get wrong.
-- The DataSource login needs `CREATEROLE`.
+- The DataSource login needs `CREATEROLE` and the right to create the `metatables`
+  schema; it does not need to own the database.
 - Physical table names become visible to explorer users.
 - Cascading foreign keys are unavailable where the explorer is enabled.
 - Team membership reaches the database at the pace of the existing one-hour

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/docs/api/data-sources.md

@@ -173,32 +173,25 @@ uses the selected database as its SQL schema. SQL Server 2022 uses `dbo` for the
 system schema; application providers may use approved schemas in that database.
 
 The API database login manages native caller identities as well as schema. PostgreSQL
-requires `CREATEROLE`, ownership of the runtime database and management rights on
-`mt_owner` if it already exists. It stores the catalog in the private `metatables`
+requires `CREATEROLE`, permission to create the `metatables` schema in the runtime
+database and tables in its default schema, and management rights on `mt_owner` if
+it already exists. It does not need to own the database. It stores the catalog in the private `metatables`
 schema. MySQL requires account/role administration, privilege disclosure and grant
 rights on the selected database, `TRIGGER` visibility, and permission to cancel
 other caller sessions. SQL Server requires login/user/role administration,
 `VIEW DEFINITION` and grant management. Managed database services must provide
 these capabilities; missing permissions leave caller SQL disabled.
 
-Settings checks the PostgreSQL requirements as soon as you select a database
-without a MetaTables runtime, before any migration runs. The login must own the
-database, have `CREATEROLE`, and own, directly or through role membership, every
-schema, table, view, sequence and routine outside the system catalogs, because
-setup revokes `PUBLIC` access on each of them. Otherwise Settings shows
-**Needs attention** with each reason, for example
-`metatables_dev does not own database "development"` or
-`291 object(s) are owned by postgres (extension timescaledb)`, and
-**Run MetaTables migrations** stays unavailable. Nothing is written to that database.
-
-A database operator prepares a qualifying database for the login, for example
-`CREATE DATABASE metatables OWNER metatables_dev TEMPLATE template0;`. On
-PostgreSQL 14 and earlier the `public` schema belongs to the bootstrap superuser,
-so also run `ALTER SCHEMA public OWNER TO metatables_dev;` in that database.
-Extensions such as TimescaleDB and pgvector install their objects as the
-bootstrap superuser, so a database with those extensions cannot currently be
-secured by a non-superuser login. Do not select a database other applications
-share: setup would change their objects' `PUBLIC` access.
+Settings checks these PostgreSQL requirements as soon as you select a database
+without a MetaTables runtime, before any migration runs. A missing one shows
+**Needs attention** with the reason, for example `metatables_dev lacks CREATEROLE`;
+**Run MetaTables migrations** stays unavailable and nothing is written.
+
+The database may be shared with other applications. Setup revokes `PUBLIC` access
+only on objects MetaTables owns: its `metatables` schema, the tables it manages and
+the roles it creates. Database-wide defaults and other owners' objects, including
+extensions such as TimescaleDB and pgvector, are the database administrator's
+responsibility.
 
 Hosted sources require a password Secret to derive per-User database credentials.
 MySQL global mandatory roles are unsupported. Registration admits ordinary tables

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.8.dev16"
+version = "0.1.8.dev17"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.8.dev16
+Version: 0.1.8.dev17
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/src/metatables/api/backend/backends/postgresql_access.py

@@ -13,51 +13,34 @@ def quote(value):
     return '"' + str(value).replace('"', '""') + '"'
 
 
-# Objects outside the system catalogs that the login neither owns nor inherits.
-# Setup revokes PUBLIC access and changes default privileges on every one of
-# them, which PostgreSQL permits only to their owner.
-FOREIGN_OBJECTS = """
-WITH objects AS (
-    SELECT 'schema' AS kind, n.nspname AS name, n.nspowner AS owner,
-           'pg_namespace'::regclass AS classid, n.oid AS objid
-    FROM pg_namespace n
-    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
-    UNION ALL
-    SELECT 'table', n.nspname || '.' || c.relname, c.relowner, 'pg_class'::regclass, c.oid
-    FROM pg_class c JOIN pg_namespace n ON n.oid = c.relnamespace
-    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
-      AND c.relkind IN ('r', 'p', 'v', 'm', 'S', 'f')
-    UNION ALL
-    SELECT 'routine', n.nspname || '.' || p.proname, p.proowner, 'pg_proc'::regclass, p.oid
-    FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
-    WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'
-)
-SELECT pg_get_userbyid(o.owner) AS owner, e.extname AS extension, count(*) AS objects,
-       min(o.kind || ' ' || o.name) AS example
-FROM objects o
-LEFT JOIN pg_depend d ON d.classid = o.classid AND d.objid = o.objid AND d.deptype = 'e'
-LEFT JOIN pg_extension e ON e.oid = d.refobjid
-WHERE NOT pg_has_role(current_user, o.owner, 'MEMBER')
-GROUP BY 1, 2
-ORDER BY 3 DESC, 1
-"""
+# MetaTables secures only objects this login owns, directly or through
+# membership (mt_owner). PUBLIC access to anything else in the database is its
+# administrator's responsibility (ADR 0007, amended 2026-10-02).
+OWNED = "pg_has_role(current_user, {owner}, 'MEMBER')"
+USER_SCHEMA = "{schema} !~ '^pg_' AND {schema} <> 'information_schema'"
 
 
 class PostgreSQLAccess(DatabaseAccess):
     def prerequisite_problems(self, connection):
-        login, database, owns_database, creates_roles = connection.execute(text(
-            "SELECT current_user, current_database(), pg_has_role(current_user, d.datdba, 'MEMBER'), "
-            "r.rolcreaterole OR r.rolsuper FROM pg_database d JOIN pg_roles r ON r.rolname = current_user "
-            "WHERE d.datname = current_database()"
-        )).one()
+        schema = getattr(self.source.connection, "default_schema", None) or "public"
+        login, database, creates_roles, creates_schemas, catalog_owner, tables = connection.execute(text(
+            "SELECT current_user, current_database(), r.rolcreaterole OR r.rolsuper, "
+            "has_database_privilege(current_database(), 'CREATE'), "
+            "(SELECT pg_get_userbyid(nspowner) FROM pg_namespace WHERE nspname = 'metatables' "
+            "AND NOT pg_has_role(current_user, nspowner, 'MEMBER')), "
+            "(SELECT has_schema_privilege(oid, 'USAGE') AND has_schema_privilege(oid, 'CREATE') "
+            "FROM pg_namespace WHERE nspname = :schema) "
+            "FROM pg_roles r WHERE r.rolname = current_user"
+        ), {"schema": schema}).one()
         problems = []
-        if not owns_database:
-            problems.append(f'{login} does not own database "{database}"')
         if not creates_roles:
             problems.append(f"{login} lacks CREATEROLE")
-        for owner, extension, count, example in connection.execute(text(FOREIGN_OBJECTS)).all()[:3]:
-            source = f" (extension {extension})" if extension else ""
-            problems.append(f"{count} object(s) are owned by {owner}{source}, e.g. {example}")
+        if catalog_owner:
+            problems.append(f'schema "metatables" belongs to {catalog_owner}')
+        elif not creates_schemas:
+            problems.append(f'{login} cannot create schemas in database "{database}"')
+        if not tables:
+            problems.append(f'{login} cannot create tables in schema "{schema}"')
         return problems
 
     def initialize(self, session):
@@ -66,11 +49,11 @@ class PostgreSQLAccess(DatabaseAccess):
         self._role(connection, "mt_owner")
         api = connection.exec_driver_sql("SELECT current_user").scalar()
         connection.exec_driver_sql(f"GRANT mt_owner TO {quote(api)}")
-        database = connection.exec_driver_sql("SELECT current_database()").scalar()
-        connection.exec_driver_sql("GRANT USAGE, CREATE ON SCHEMA public TO mt_owner")
-        connection.exec_driver_sql(f"REVOKE ALL ON DATABASE {quote(database)} FROM PUBLIC")
+        if connection.exec_driver_sql(
+            "SELECT has_schema_privilege(oid, 'CREATE WITH GRANT OPTION') FROM pg_namespace WHERE nspname='public'"
+        ).scalar():
+            connection.exec_driver_sql("GRANT USAGE, CREATE ON SCHEMA public TO mt_owner")
         connection.exec_driver_sql("REVOKE ALL ON SCHEMA metatables FROM PUBLIC")
-        connection.exec_driver_sql("REVOKE CREATE ON SCHEMA public FROM PUBLIC")
         state = session.get(SQLSecurityState, 1)
         if state is None:
             state = SQLSecurityState(id=1, ready=True, pending=True, manifest={})
@@ -105,39 +88,46 @@ class PostgreSQLAccess(DatabaseAccess):
         else:
             connection.exec_driver_sql(f"ALTER ROLE {quote(name)} NOLOGIN")
 
+    def owned_schemas(self, connection):
+        return connection.exec_driver_sql(
+            "SELECT nspname FROM pg_namespace WHERE " + USER_SCHEMA.format(schema="nspname")
+            + " AND " + OWNED.format(owner="nspowner")
+        ).scalars().all()
+
     def secure_routines(self, connection, managed_roles):
-        """Inspect only at initialization/schema changes/reconciliation."""
+        """Inspect only at initialization/schema changes/reconciliation.
+
+        Covers the objects this login owns; other owners' objects are left to
+        the database administrator.
+        """
         invoker = self.role("invoker", "routines")
         self._role(connection, invoker)
-        schemas = (
-            connection.exec_driver_sql(
-                "SELECT nspname FROM pg_namespace WHERE nspname !~ '^pg_' AND nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
-        for schema in schemas:
-            connection.exec_driver_sql(
-                f"REVOKE ALL ON ALL TABLES IN SCHEMA {quote(schema)} FROM PUBLIC"
-            )
+        for schema in self.owned_schemas(connection):
             if schema != "metatables":
                 connection.exec_driver_sql(
                     f"GRANT USAGE ON SCHEMA {quote(schema)} TO {quote(invoker)}"
                 )
+        public_tables = connection.exec_driver_sql(
+            "SELECT DISTINCT n.nspname, c.relname FROM pg_class c JOIN pg_namespace n ON n.oid=c.relnamespace "
+            "CROSS JOIN LATERAL aclexplode(c.relacl) acl WHERE acl.grantee=0 AND c.relkind IN ('r','p','v','m','f') AND "
+            + USER_SCHEMA.format(schema="n.nspname") + " AND " + OWNED.format(owner="c.relowner")
+        ).all()
+        for schema, table in public_tables:
+            connection.exec_driver_sql(f"REVOKE ALL ON TABLE {quote(schema)}.{quote(table)} FROM PUBLIC")
         public_columns = connection.exec_driver_sql(
-            "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl WHERE acl.grantee=0 AND n.nspname !~ '^pg_'"
+            "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid "
+            "JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl "
+            "WHERE acl.grantee=0 AND n.nspname !~ '^pg_' AND " + OWNED.format(owner="c.relowner")
         ).all()
         for schema, table, column in public_columns:
             connection.exec_driver_sql(
                 f"REVOKE ALL ({quote(column)}) ON TABLE {quote(schema)}.{quote(table)} FROM PUBLIC"
             )
-        owners = (
-            connection.exec_driver_sql(
-                "SELECT DISTINCT r.rolname FROM pg_proc p JOIN pg_roles r ON r.oid=p.proowner JOIN pg_namespace n ON n.oid=p.pronamespace WHERE n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
+        owners = connection.exec_driver_sql(
+            "SELECT DISTINCT r.rolname FROM pg_proc p JOIN pg_roles r ON r.oid=p.proowner "
+            "JOIN pg_namespace n ON n.oid=p.pronamespace WHERE " + USER_SCHEMA.format(schema="n.nspname")
+            + " AND " + OWNED.format(owner="p.proowner")
+        ).scalars().all()
         owners = set(owners) | {
             "mt_owner",
             connection.exec_driver_sql("SELECT current_user").scalar(),
@@ -154,24 +144,17 @@ class PostgreSQLAccess(DatabaseAccess):
         grantees = "PUBLIC, " + ", ".join(
             quote(role) for role in sorted((set(managed_roles) | {invoker}) & existing)
         )
-        for schema in schemas:
-            for noun in ("FUNCTIONS", "PROCEDURES"):
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL {noun} IN SCHEMA {quote(schema)} FROM {grantees}"
-                )
-                if schema != "metatables":
-                    connection.exec_driver_sql(
-                        f"GRANT EXECUTE ON ALL {noun} IN SCHEMA {quote(schema)} TO {quote(invoker)}"
-                    )
-        # Revoke elevated routines within the same transaction before publishing
-        # permissions. Batch schema grants avoid an objects-by-principals loop.
+        # Restricted callers never execute routines with elevated owner privileges.
         routines = connection.exec_driver_sql(
-            "SELECT n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.prokind FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace WHERE p.prosecdef AND n.nspname !~ '^pg_' AND n.nspname <> 'information_schema'"
+            "SELECT n.nspname, p.proname, pg_get_function_identity_arguments(p.oid), p.prosecdef "
+            "FROM pg_proc p JOIN pg_namespace n ON n.oid=p.pronamespace WHERE "
+            + USER_SCHEMA.format(schema="n.nspname") + " AND " + OWNED.format(owner="p.proowner")
         ).all()
-        for schema, name, arguments, kind in routines:
-            noun = "PROCEDURE" if kind == "p" else "FUNCTION"
+        for schema, name, arguments, elevated in routines:
             target = f"{quote(schema)}.{quote(name)}({arguments})"
-            connection.exec_driver_sql(f"REVOKE ALL ON {noun} {target} FROM {quote(invoker)}")
+            connection.exec_driver_sql(f"REVOKE ALL ON ROUTINE {target} FROM {grantees}")
+            if schema != "metatables" and not elevated:
+                connection.exec_driver_sql(f"GRANT EXECUTE ON ROUTINE {target} TO {quote(invoker)}")
 
     def validate_table(self, connection, table):
         schema = table.physical_schema or "public"
@@ -181,7 +164,7 @@ class PostgreSQLAccess(DatabaseAccess):
             raise SQLExecutionError(code="catalog_table_registration_denied")
         relation = f"{quote(schema)}.{quote(table.physical_table_name)}"
         row = connection.execute(
-            text("SELECT oid, relkind FROM pg_class WHERE oid=to_regclass(:relation)"),
+            text("SELECT oid, relkind, " + OWNED.format(owner="relowner") + " AS owned FROM pg_class WHERE oid=to_regclass(:relation)"),
             {"relation": relation},
         ).first()
         if row is not None and row.relkind == "v":
@@ -205,7 +188,8 @@ class PostgreSQLAccess(DatabaseAccess):
             ),
             {"oid": row.oid},
         ).first()
-        connection.exec_driver_sql(f"REVOKE ALL ON TABLE {relation} FROM PUBLIC")
+        if row.owned:
+            connection.exec_driver_sql(f"REVOKE ALL ON TABLE {relation} FROM PUBLIC")
         if table.management_mode == "platform_managed":
             connection.exec_driver_sql(f"ALTER TABLE {relation} OWNER TO mt_owner")
         return trigger is None
@@ -229,13 +213,7 @@ class PostgreSQLAccess(DatabaseAccess):
         for name, definition in roles.items():
             self._role(connection, name, self.password(name) if definition["login"] else None)
         names = set(roles) | set(previous.get("roles", {})) | {invoker}
-        schemas = (
-            connection.exec_driver_sql(
-                "SELECT nspname FROM pg_namespace WHERE nspname !~ '^pg_' AND nspname <> 'information_schema'"
-            )
-            .scalars()
-            .all()
-        )
+        schemas = self.owned_schemas(connection)
         for name in sorted(names):
             owned = connection.execute(
                 text(
@@ -261,20 +239,25 @@ class PostgreSQLAccess(DatabaseAccess):
             connection.exec_driver_sql(
                 f"REVOKE ALL ON DATABASE {quote(database)} FROM {quote(name)}"
             )
-            for schema in schemas:
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL SEQUENCES IN SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
-                connection.exec_driver_sql(
-                    f"REVOKE ALL ON ALL TABLES IN SCHEMA {quote(schema)} FROM {quote(name)}"
-                )
+            # Revoke this role's grants on owned objects; other owners' grants are theirs.
+            granted = connection.execute(
+                text(
+                    "SELECT 'SCHEMA', quote_ident(n.nspname) FROM pg_namespace n CROSS JOIN LATERAL aclexplode(n.nspacl) acl "
+                    "JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND " + OWNED.format(owner="n.nspowner")
+                    + " UNION SELECT CASE WHEN c.relkind='S' THEN 'SEQUENCE' ELSE 'TABLE' END, "
+                    "quote_ident(n.nspname) || '.' || quote_ident(c.relname) FROM pg_class c "
+                    "JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(c.relacl) acl "
+                    "JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND " + OWNED.format(owner="c.relowner")
+                ),
+                {"name": name},
+            ).all()
+            for kind, target in granted:
+                connection.exec_driver_sql(f"REVOKE ALL ON {kind} {target} FROM {quote(name)}")
             # Table-level REVOKE does not remove separately granted column ACLs.
             columns = connection.execute(
                 text(
-                    "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND n.nspname !~ '^pg_'"
+                    "SELECT n.nspname, c.relname, a.attname FROM pg_attribute a JOIN pg_class c ON c.oid=a.attrelid JOIN pg_namespace n ON n.oid=c.relnamespace CROSS JOIN LATERAL aclexplode(a.attacl) acl JOIN pg_roles r ON r.oid=acl.grantee WHERE r.rolname=:name AND n.nspname !~ '^pg_' AND "
+                    + OWNED.format(owner="c.relowner")
                 ),
                 {"name": name},
             ).all()

{mainsequence_metatable-0.1.8.dev16 → mainsequence_metatable-0.1.8.dev17}/tests/auth/test_data_source_identity.py

@@ -169,3 +169,22 @@ def test_securable_fresh_database_still_requires_migrations(tmp_path):
         assert bootstrap.status == "migration_required" and bootstrap.error is None
     finally:
         bootstrap.close()
+
+
+def test_postgresql_prerequisites_name_only_what_metatables_needs():
+    from metatables.api.backend.backends.postgresql_access import PostgreSQLAccess
+
+    def check(row, schema="public"):
+        access = PostgreSQLAccess.__new__(PostgreSQLAccess)
+        access.source = SimpleNamespace(connection=SimpleNamespace(default_schema=schema))
+        connection = SimpleNamespace(execute=lambda *args: SimpleNamespace(one=lambda: row))
+        return access.prerequisite_problems(connection)
+
+    # A shared database qualifies: the login need not own it or anyone else's objects.
+    assert check(("metatables_dev", "development", True, True, None, True)) == []
+    assert check(("app", "shared", False, False, None, False), schema="tables") == [
+        "app lacks CREATEROLE",
+        'app cannot create schemas in database "shared"',
+        'app cannot create tables in schema "tables"',
+    ]
+    assert check(("app", "shared", True, False, "someone", True)) == ['schema "metatables" belongs to someone']