mainsequence-metatable 0.1.9.dev19__tar.gz → 0.1.10.dev20__tar.gz

{mainsequence_metatable-0.1.9.dev19/src/mainsequence_metatable.egg-info → mainsequence_metatable-0.1.10.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.9.dev19
+Version: 0.1.10.dev20
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/docs/adr/api/0001-unified-api-storage-and-local-sqlite.md

@@ -103,8 +103,10 @@ hosted runtime database is now declared by the deployment:
   keeps its own file, so each Environment's deployment reads its own file and
   Secret.
 - **Secret.** The database administrator creates it in each Environment, for
-  example `postgresql://login:password@host:5432/database`. Host, port, database,
-  login and password come only from the URI, certificates only from the named
+  example `postgresql://metatables:password@host:5432/database`. The login is the
+  code constant `metatables`, one per database server and shared by every
+  Environment's database on it; a URI with another login is refused. Host, port,
+  database and password come only from the URI, certificates only from the named
   Secrets. The runtime DataSource's `password_secret_uid` is the URI Secret's UID
   ([ADR 0009](0009-shared-credential-store.md)).
 - **Deployment.** On every deployment the `migrate-system` Job reads the

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/docs/api/data-sources.md

@@ -187,8 +187,10 @@ Preparing the database, its login and these privileges is the database
 administrator's responsibility. On every deployment, the hosted migration Job checks
 the PostgreSQL requirements before any migration runs: `CREATEROLE`, `CREATE` on the
 database or ownership of the `metatables` schema, and `CREATE` on the default schema.
-A missing one fails the Job with the reason, for example `metatables_dev lacks
-CREATEROLE`; nothing is written and the API does not roll out.
+A missing one fails the Job with the reason, for example `metatables lacks
+CREATEROLE`; nothing is written and the API does not roll out. The hosted login is
+always `metatables`, one per database server; see
+[Set up a hosted runtime database](../operations/hosted-runtime.md#set-up-a-hosted-runtime-database).
 
 The database may be shared with other applications. Setup revokes `PUBLIC` access
 only on objects MetaTables owns: its `metatables` schema, the tables it manages and

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/docs/operations/hosted-runtime.md

@@ -62,7 +62,8 @@ runtime_database:
 ```
 
 The Secret named by `uri_secret` holds a URI such as
-`postgresql://login:password@host:5432/database`. Use `postgresql://` or
+`postgresql://metatables:password@host:5432/database`. The login is always
+`metatables`; the Job and the API refuse any other. Use `postgresql://` or
 `postgres://` for `postgresql` and `timescale_db`, `mysql://` for MySQL and
 `mssql://` for SQL Server, and percent-encode special characters in the password.
 Host, port, database, login and password come only from the URI. It takes no
@@ -75,16 +76,33 @@ rejects them and maps `tls.mode` to its driver: `disable` turns encryption off,
 
 ## Set up a hosted runtime database
 
-The database, its login and the login's privileges are the database
-administrator's responsibility. [DataSource database privileges](../api/data-sources.md#database-privileges-and-sql-behavior)
+Every Environment's runtime database is opened by the same login, `metatables`.
+Database roles are server-wide, so each database server has one `metatables`
+login, shared by every Environment's database on it. Its role names are the
+same everywhere: the login and `mt_owner`, which setup creates. The database,
+the login and its privileges are the database administrator's responsibility.
+[DataSource database privileges](../api/data-sources.md#database-privileges-and-sql-behavior)
 lists what MetaTables requires.
 
-1. Create the Environment Secret named by `uri_secret` in each Environment that
-   deploys the API, holding the connection URI.
-2. Set `runtime_database` in the API's `configuration.yaml`: engine, Secret name,
+1. Once per database server, create the login. On PostgreSQL and TimescaleDB:
+
+   ```sql
+   CREATE ROLE metatables LOGIN CREATEROLE PASSWORD '...';
+   ```
+
+2. For each Environment's database, let the login create the `metatables` schema:
+
+   ```sql
+   GRANT CREATE ON DATABASE production TO metatables;
+   ```
+
+   It also needs `CREATE` on the default schema.
+3. Create the Environment Secret named by `uri_secret` in that Environment, holding
+   `postgresql://metatables:password@host:5432/<database>`.
+4. Set `runtime_database` in the API's `configuration.yaml`: engine, Secret name,
    schema and TLS.
-3. Deploy the API. The migration Job initializes the database before the API rolls out.
-4. Open **Settings** and check the declaration, the resolved connection, the
+5. Deploy the API. The migration Job initializes the database before the API rolls out.
+6. Open **Settings** and check the declaration, the resolved connection, the
    `ready` status and the applied migration revisions.
 
 ## Deployment gate

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence-metatable"
-version = "0.1.9.dev19"
+version = "0.1.10.dev20"
 description = "Main Sequence MetaTables Python client and standalone API"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20/src/mainsequence_metatable.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence-metatable
-Version: 0.1.9.dev19
+Version: 0.1.10.dev20
 Summary: Main Sequence MetaTables Python client and standalone API
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/src/metatables/api/app/runtime_database.py

@@ -15,12 +15,16 @@ from metatables.api.app.configuration import DEPLOYMENT_CONFIGURATION, Deploymen
 from metatables.api.backend.integrations.catalog_data_sources import parse_configuration
 from metatables.api.backend.integrations.credential_store import CredentialStoreError
 
+# Every Environment's runtime database is opened by this one login. Database
+# roles are server-wide, so one `metatables` login per database server serves
+# every Environment's database on it; no Environment chooses its own.
+RUNTIME_LOGIN = "metatables"
 URI_SCHEMES = {"postgresql": {"postgresql", "postgres"}, "timescale_db": {"postgresql", "postgres"},
                "mysql": {"mysql"}, "mssql": {"mssql"}}
-URI_EXAMPLES = {"postgresql": "postgresql://login:password@host:5432/database",
-                "timescale_db": "postgresql://login:password@host:5432/database",
-                "mysql": "mysql://login:password@host:3306/database",
-                "mssql": "mssql://login:password@host:1433/database"}
+URI_EXAMPLES = {"postgresql": f"postgresql://{RUNTIME_LOGIN}:password@host:5432/database",
+                "timescale_db": f"postgresql://{RUNTIME_LOGIN}:password@host:5432/database",
+                "mysql": f"mysql://{RUNTIME_LOGIN}:password@host:3306/database",
+                "mssql": f"mssql://{RUNTIME_LOGIN}:password@host:1433/database"}
 DEPLOYMENT_MANAGED = ("The deployment manages the hosted runtime database. Change runtime_database in the API's "
                       "configuration.yaml or its Environment Secret, then deploy the API.")
 
@@ -96,6 +100,9 @@ def declared_database(config, store):
         raise RuntimeDatabaseError("incompatible", f"The Environment Secret {declared.uri_secret} must hold a URI "
                                    f"such as {URI_EXAMPLES[declared.engine]}, with no query options; TLS and the "
                                    "schema are set in configuration.yaml.")
+    if url.username != RUNTIME_LOGIN:
+        raise RuntimeDatabaseError("incompatible", f"The Environment Secret {declared.uri_secret} must log in as "
+                                   f"{RUNTIME_LOGIN}, the login every Environment's runtime database uses.")
     values = dict(host=url.host, database_name=url.database, database_user=url.username,
                   password_secret_uid=str(uri_uid))
     if url.port is not None:

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/tests/auth/test_runtime_database.py

@@ -42,7 +42,7 @@ BASE = SimpleNamespace(resolve=lambda uid, purpose: f"base:{purpose}", create=la
 def test_uri_supplies_the_connection_and_configuration_the_rest(declare):
     config, secrets = declare(POSTGRESQL + "  default_schema: tables\n  tls:\n    mode: verify-full\n"
                               "    ca_secret: DATABASE_CA\n",
-                              uri="postgres://metatables_dev:p%40ss%3Aword@db.example.invalid/development",
+                              uri="postgres://metatables:p%40ss%3Aword@db.example.invalid/development",
                               DATABASE_CA="-----BEGIN CERTIFICATE-----")
     declared, candidate, credentials = declared_database(config, BASE)
     uri_uid = secrets["METATABLES_RUNTIME_DATABASE"][0]
@@ -52,7 +52,7 @@ def test_uri_supplies_the_connection_and_configuration_the_rest(declare):
         "host", "port", "database_name", "database_user", "default_schema", "ssl_mode",
         "password_secret_uid", "tls_ca_secret_uid")} == {
         "host": "db.example.invalid", "port": 5432, "database_name": "development",
-        "database_user": "metatables_dev", "default_schema": "tables", "ssl_mode": "verify-full",
+        "database_user": "metatables", "default_schema": "tables", "ssl_mode": "verify-full",
         "password_secret_uid": str(uri_uid), "tls_ca_secret_uid": str(secrets["DATABASE_CA"][0])}
     assert "p@ss" not in repr(candidate)
     # The URI Secret supplies only the login password; other references use the base store.
@@ -65,8 +65,8 @@ def test_uri_supplies_the_connection_and_configuration_the_rest(declare):
 
 
 @pytest.mark.parametrize(("engine", "uri", "expected"), [
-    ("mysql", "mysql://app:pw@mysql.example.invalid/tables", {"port": 3306, "default_schema": "tables", "ssl_mode": "require"}),
-    ("mssql", "mssql://app:pw@sql.example.invalid:1444/tables", {"port": 1444, "encrypt": True, "trust_server_certificate": True}),
+    ("mysql", "mysql://metatables:pw@mysql.example.invalid/tables", {"port": 3306, "default_schema": "tables", "ssl_mode": "require"}),
+    ("mssql", "mssql://metatables:pw@sql.example.invalid:1444/tables", {"port": 1444, "encrypt": True, "trust_server_certificate": True}),
 ])
 def test_engines_take_their_own_defaults(declare, engine, uri, expected):
     config, _ = declare(f"runtime_database:\n  engine: {engine}\n  uri_secret: METATABLES_RUNTIME_DATABASE\n", uri=uri)
@@ -84,6 +84,13 @@ def test_invalid_uri_is_explained_without_its_value(declare, uri):
     assert "hunter2" not in str(raised.value)
 
 
+def test_every_environment_logs_in_as_the_shared_runtime_login(declare):
+    config, _ = declare(POSTGRESQL, uri="postgresql://metatables_dev:hunter2@db/production")
+    with pytest.raises(RuntimeDatabaseError, match="must log in as metatables") as raised:
+        declared_database(config, BASE)
+    assert raised.value.status == "incompatible" and "hunter2" not in str(raised.value)
+
+
 def test_missing_declaration_and_missing_secret_name_the_fix(declare):
     config, _ = declare("")
     with pytest.raises(RuntimeDatabaseError, match="declares no runtime database") as raised:

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/tests/auth/test_runtime_selection.py

@@ -135,7 +135,7 @@ def test_hosted_mode_uses_the_deployment_declared_database(tmp_path, monkeypatch
     reads = []
     def read_secret(name):
         reads.append(name)
-        return secret_uid, "postgresql://metatables_dev:s3cr%40t@tunnel.example.invalid:20989/development"
+        return secret_uid, "postgresql://metatables:s3cr%40t@tunnel.example.invalid:20989/development"
     monkeypatch.setattr("metatables.api.app.runtime_database.read_secret", read_secret)
     def inspect_without_remote_connection(self):
         self.status, self.error, self.current = "migration_required", None, []
@@ -157,7 +157,7 @@ def test_hosted_mode_uses_the_deployment_declared_database(tmp_path, monkeypatch
             assert {key: bootstrap["candidate"]["configuration"][key] for key in (
                 "host", "port", "database_name", "database_user", "password_secret_uid", "ssl_mode", "default_schema")} == {
                 "host": "tunnel.example.invalid", "port": 20989, "database_name": "development",
-                "database_user": "metatables_dev", "password_secret_uid": str(secret_uid), "ssl_mode": "require",
+                "database_user": "metatables", "password_secret_uid": str(secret_uid), "ssl_mode": "require",
                 "default_schema": "public"}
             credentials = app.state.runtime.credential_store
             assert credentials.resolve(secret_uid, "database_password") == "s3cr@t"

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/tests/database_backend/test_runtime_bootstrap.py

@@ -75,6 +75,8 @@ def test_runtime_bootstrap_is_explicit_and_uses_one_source(
         uri_uid = uuid4()
         monkeypatch.setattr(declared, "read_secret",
                             lambda name: (uri_uid, uri.render_as_string(hide_password=False)))
+        # The disposable server's login stands in for the shared runtime login.
+        monkeypatch.setattr(declared, "RUNTIME_LOGIN", engine.url.username)
         configuration.write_text(
             "local_mode_available: false\nruntime_database:\n"
             f"  engine: {engine_kind}\n  uri_secret: METATABLES_RUNTIME_DATABASE\n"

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/tests/e2e/test_runtime_transition.py

@@ -11,6 +11,7 @@ from uuid import uuid4
 
 import httpx
 import pytest
+from sqlalchemy.engine import make_url
 
 from metatables.api.app.development import DevelopmentSupervisor
 
@@ -34,6 +35,9 @@ Secret.get=classmethod(lambda cls, name=None, **kwargs: SimpleNamespace(uid=os.e
     value=SecretStr(os.environ['FIXTURE_RUNTIME_DATABASE_URI'])))
 from metatables.api.app import runtime_database
 runtime_database.DEPLOYMENT_CONFIGURATION=Path(os.environ['FIXTURE_DEPLOYMENT_CONFIGURATION'])
+# The disposable server's login stands in for the shared runtime login.
+from sqlalchemy.engine import make_url
+runtime_database.RUNTIME_LOGIN=make_url(os.environ['FIXTURE_RUNTIME_DATABASE_URI']).username
 User.get_authenticated_user_details=classmethod(lambda cls: SimpleNamespace(
     uid=os.environ['FIXTURE_USER_UID'], is_active=True, is_organization_admin=True, active_team_uids=[]))
 runpy.run_module('metatables.api.app.development', run_name='__main__')
@@ -79,6 +83,7 @@ def test_switch_local_hosted_and_back_restarts_worker_and_preserves_stores(tmp_p
     # The deployment gate below runs in this process against the same declaration.
     monkeypatch.setattr("metatables.api.app.configuration.DEPLOYMENT_CONFIGURATION", deployed)
     monkeypatch.setattr("metatables.api.app.runtime_database.read_secret", lambda name: (secret_uid, catalog))
+    monkeypatch.setattr("metatables.api.app.runtime_database.RUNTIME_LOGIN", make_url(catalog).username)
     real_popen = subprocess.Popen
     workers = []
     log = (tmp_path / "workers.log").open("wb")

{mainsequence_metatable-0.1.9.dev19 → mainsequence_metatable-0.1.10.dev20}/uv.lock

@@ -632,7 +632,7 @@ server = [
 
 [[package]]
 name = "mainsequence-metatable"
-version = "0.1.9"
+version = "0.1.10"
 source = { editable = "." }
 dependencies = [
     { name = "alembic" },