sqlbuild-cli 0.188.0__tar.gz → 0.189.0__tar.gz

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/Cargo.lock

@@ -4184,7 +4184,7 @@ dependencies = [
 
 [[package]]
 name = "sqlbuild-cli"
-version = "0.188.0"
+version = "0.189.0"
 dependencies = [
  "blake3",
  "chrono",
@@ -4337,7 +4337,7 @@ dependencies = [
 
 [[package]]
 name = "sqlbuild-python"
-version = "0.188.0"
+version = "0.189.0"
 dependencies = [
  "chrono",
  "chrono-tz",

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: sqlbuild-cli
-Version: 0.188.0
+Version: 0.189.0
 License-File: LICENSE
 Summary: The native sqb and sqlbuild executables of SQLBuild
 License-Expression: Apache-2.0

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-cli/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sqlbuild-cli"
-version = "0.188.0"
+version = "0.189.0"
 description = "The native `sqb` executable: reused compiles and Python-free commands served without Python, every other command handed to the Python CLI."
 edition.workspace = true
 license-file = "LICENSE"
@@ -31,6 +31,7 @@ sqlbuild-core.workspace = true
 sqlbuild-cursor.workspace = true
 sqlbuild-model-config.workspace = true
 sqlbuild-orchestration.workspace = true
+sqlbuild-process-ownership.workspace = true
 sqlbuild-recall.workspace = true
 sqlbuild-rules.workspace = true
 tokio.workspace = true
@@ -39,9 +40,6 @@ uuid.workspace = true
 [target.'cfg(unix)'.dependencies]
 rustix.workspace = true
 
-[target.'cfg(any(target_os = "linux", target_os = "macos", windows))'.dependencies]
-sqlbuild-process-ownership.workspace = true
-
 [target.'cfg(windows)'.dependencies]
 ctrlc.workspace = true
 same-file.workspace = true

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-cli/src/workers/_helpers/child.rs

@@ -2,7 +2,6 @@
 
 use sqlbuild_orchestration::store::errors::ControlError;
 
-#[cfg(any(target_os = "linux", target_os = "macos", windows))]
 use sqlbuild_process_ownership::ownership::main::{
     stop_worker::stop_worker, worker_exited::worker_exited,
 };
@@ -28,7 +27,6 @@ impl WorkerChild {
             Self::Local(child) => Ok(child
                 .try_wait()?
                 .map(|exit| WorkerExit::Code(exit_code(exit)))),
-            #[cfg(any(target_os = "linux", target_os = "macos", windows))]
             Self::RecoveredLocal(owner) => Ok(worker_exited(owner)?.then_some(WorkerExit::Absent)),
             Self::Docker(child) => child.try_wait().await,
         }
@@ -49,7 +47,6 @@ impl WorkerChild {
     pub(in crate::workers) async fn terminate(&mut self) -> Result<(), ControlError> {
         match self {
             Self::Local(child) => terminate_child(child),
-            #[cfg(any(target_os = "linux", target_os = "macos", windows))]
             Self::RecoveredLocal(owner) => Ok(stop_worker(owner, false)?),
             Self::Docker(child) => child.signal("SIGTERM").await,
         }
@@ -61,7 +58,6 @@ impl WorkerChild {
                 child.start_kill()?;
                 Ok(())
             }
-            #[cfg(any(target_os = "linux", target_os = "macos", windows))]
             Self::RecoveredLocal(owner) => Ok(stop_worker(owner, true)?),
             Self::Docker(child) => child.signal("SIGKILL").await,
         }

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-cli/src/workers/_helpers/recovery.rs

@@ -9,7 +9,6 @@ use sqlbuild_orchestration::scheduler::models::SchedulerLease;
 use sqlbuild_orchestration::store::errors::ControlError;
 use sqlbuild_orchestration::store::models::ControlStore;
 
-#[cfg(any(target_os = "linux", target_os = "macos", windows))]
 use sqlbuild_process_ownership::ownership::main::recover_worker::recover_worker;
 
 use crate::workers::models::{ClaimedWorker, DockerWorker, Launcher, WorkerChild, Workers};
@@ -29,10 +28,6 @@ impl Workers {
             .map(|worker| worker.claim.claim_id)
             .collect();
         for location in self.configuration.locations() {
-            #[cfg(not(any(target_os = "linux", target_os = "macos", windows)))]
-            if matches!(location, Launcher::Local(_)) {
-                continue;
-            }
             let scope = location.scope();
             let mut after = None;
             loop {
@@ -48,12 +43,9 @@ impl Workers {
                         continue;
                     }
                     let child = match location {
-                        #[cfg(any(target_os = "linux", target_os = "macos", windows))]
                         Launcher::Local(location) => Some(WorkerChild::RecoveredLocal(
                             recover_worker(&location.claim(&claim))?,
                         )),
-                        #[cfg(not(any(target_os = "linux", target_os = "macos", windows)))]
-                        Launcher::Local(_) => continue,
                         Launcher::Docker(location) => match DockerWorker::prepare(location, &claim)
                         {
                             Ok(child) => Some(WorkerChild::Docker(child)),

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-cli/src/workers/_helpers/supervisor.rs

@@ -19,7 +19,6 @@ use sqlbuild_orchestration::scheduler::main::renew_lease::renew_lease;
 use sqlbuild_orchestration::scheduler::models::SchedulerLease;
 use sqlbuild_orchestration::store::errors::ControlError;
 use sqlbuild_orchestration::store::models::ControlStore;
-#[cfg(any(target_os = "linux", target_os = "macos", windows))]
 use sqlbuild_process_ownership::ownership::main::{
     prepare_worker::prepare_worker, start_worker::start_worker,
 };
@@ -328,19 +327,13 @@ fn prepare_spawn(
         .stdin(Stdio::null())
         .stdout(Stdio::null())
         .stderr(Stdio::inherit());
-    #[cfg(any(target_os = "linux", target_os = "macos", windows))]
     let (command, ownership) = prepare_worker(command, &location.claim(claim))?;
     let mut command = Command::from(command);
     command.kill_on_drop(true);
-    Ok(LocalSpawn {
-        command,
-        #[cfg(any(target_os = "linux", target_os = "macos", windows))]
-        ownership,
-    })
+    Ok(LocalSpawn { command, ownership })
 }
 
 impl LocalLauncher {
-    #[cfg(any(target_os = "linux", target_os = "macos", windows))]
     pub(in crate::workers) fn claim<'a>(
         &'a self,
         claim: &RunClaim,
@@ -357,7 +350,6 @@ impl LocalSpawn {
     /// A child whose ownership could not be completed is killed before the error is returned.
     fn spawn(mut self) -> Result<tokio::process::Child, ControlError> {
         let mut child = self.command.spawn()?;
-        #[cfg(any(target_os = "linux", target_os = "macos", windows))]
         if let Err(error) = child
             .id()
             .ok_or_else(|| std::io::Error::other("worker exited before it was owned"))

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-cli/src/workers/models.rs

@@ -13,7 +13,6 @@ use uuid::Uuid;
 #[derive(Debug)]
 pub(super) enum WorkerChild {
     Local(Child),
-    #[cfg(any(target_os = "linux", target_os = "macos", windows))]
     RecoveredLocal(sqlbuild_process_ownership::ownership::models::RecoveredOwnership),
     Docker(DockerWorker),
 }
@@ -22,7 +21,6 @@ pub(super) enum WorkerChild {
 #[derive(Debug)]
 pub(super) struct LocalSpawn {
     pub(super) command: tokio::process::Command,
-    #[cfg(any(target_os = "linux", target_os = "macos", windows))]
     pub(super) ownership: sqlbuild_process_ownership::ownership::models::PendingOwnership,
 }
 

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/api/_helpers/authentication/password_sessions.rs

@@ -109,6 +109,18 @@ pub(crate) fn person_routes() -> Router<ControlStore> {
             "/api/control/locations/{location_id}/targets/{target}/nodes/{node_key}/sql",
             get(crate::api::_helpers::resources::person_node_sql::read),
         )
+        .route(
+            "/api/control/locations/{location_id}/targets/{target}/checks",
+            get(crate::api::_helpers::resources::person_checks::list),
+        )
+        .route(
+            "/api/control/locations/{location_id}/targets/{target}/checks/{binding_key}",
+            get(crate::api::_helpers::resources::person_checks::history),
+        )
+        .route(
+            "/api/control/locations/{location_id}/targets/{target}/checks/{binding_key}/sql",
+            get(crate::api::_helpers::resources::person_checks::sql),
+        )
         .layer(DefaultBodyLimit::max(PASSWORD_BODY_BYTES))
 }
 

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/api/_helpers/resources/mod.rs

@@ -5,6 +5,7 @@ pub(crate) mod client;
 pub(crate) mod docker_image;
 pub(crate) mod location_health;
 pub(crate) mod location_work;
+pub(crate) mod person_checks;
 pub(crate) mod person_location_work;
 pub(crate) mod person_node_sql;
 pub(crate) mod person_operations;

sqlbuild_cli-0.189.0/crates/sqlbuild-orchestration/src/api/_helpers/resources/person_checks.rs

@@ -0,0 +1,81 @@
+//! Check reads use live person grants; SQL needs its own permission and is audited.
+
+use axum::extract::{Path, Query, State};
+use axum::{Extension, Json};
+use uuid::Uuid;
+
+use crate::api::errors::ApiError;
+use crate::api::models::ReadQuery;
+use crate::credentials::models::{AuditContext, AuthenticatedPerson, DefaultRole};
+use crate::store::models::ControlStore;
+use crate::warehouse_metadata::main::read_person_check::read_person_check;
+use crate::warehouse_metadata::main::read_person_check_sql::read_person_check_sql;
+use crate::warehouse_metadata::main::read_person_checks::read_person_checks;
+use crate::warehouse_metadata::models::{CheckResult, CheckSql};
+
+#[utoipa::path(get, path = "/api/control/locations/{location_id}/targets/{target}/checks", operation_id = "listPersonChecks",
+    params(("location_id" = Uuid, Path), ("target" = String, Path)),
+    responses((status = 200, body = Vec<CheckResult>, description = "The newest result of every check"),
+        (status = 401, description = "Session rejected"),
+        (status = 403, body = crate::api::models::ApiErrorBody)), security(("session" = []), ("cliSession" = [])))]
+pub(crate) async fn list(
+    (State(store), Extension(context)): (State<ControlStore>, Extension<AuditContext>),
+    Extension(default_role): Extension<DefaultRole>,
+    Path((location_id, target)): Path<(Uuid, String)>,
+    Extension(AuthenticatedPerson(principal, _)): Extension<AuthenticatedPerson>,
+) -> Result<Json<Vec<CheckResult>>, ApiError> {
+    Ok(Json(
+        read_person_checks(
+            &store,
+            (&context, principal),
+            (location_id, &target),
+            default_role,
+        )
+        .await?,
+    ))
+}
+
+#[utoipa::path(get, path = "/api/control/locations/{location_id}/targets/{target}/checks/{binding_key}", operation_id = "readPersonCheckHistory",
+    params(("location_id" = Uuid, Path), ("target" = String, Path), ("binding_key" = String, Path),
+        ("limit" = Option<u32>, Query, description = "Maximum results, newest first; defaults to 50, capped at 1000")),
+    responses((status = 200, body = Vec<CheckResult>, description = "Empty for an unknown check"),
+        (status = 401, description = "Session rejected"),
+        (status = 403, body = crate::api::models::ApiErrorBody)), security(("session" = []), ("cliSession" = [])))]
+pub(crate) async fn history(
+    (State(store), Extension(context)): (State<ControlStore>, Extension<AuditContext>),
+    Extension(default_role): Extension<DefaultRole>,
+    (Path((location_id, target, binding_key)), Query(options)): (
+        Path<(Uuid, String, String)>,
+        Query<ReadQuery>,
+    ),
+    Extension(AuthenticatedPerson(principal, _)): Extension<AuthenticatedPerson>,
+) -> Result<Json<Vec<CheckResult>>, ApiError> {
+    Ok(Json(
+        read_person_check(
+            &store,
+            (&context, principal),
+            (location_id, &target, &binding_key),
+            (options.limit.unwrap_or(50), default_role),
+        )
+        .await?,
+    ))
+}
+
+#[utoipa::path(get, path = "/api/control/locations/{location_id}/targets/{target}/checks/{binding_key}/sql", operation_id = "readPersonCheckSql",
+    params(("location_id" = Uuid, Path), ("target" = String, Path), ("binding_key" = String, Path)),
+    responses((status = 200, body = Option<CheckSql>), (status = 401, description = "Session rejected"),
+        (status = 403, body = crate::api::models::ApiErrorBody)), security(("session" = []), ("cliSession" = [])))]
+pub(crate) async fn sql(
+    (State(store), Extension(context)): (State<ControlStore>, Extension<AuditContext>),
+    Path((location_id, target, binding_key)): Path<(Uuid, String, String)>,
+    Extension(AuthenticatedPerson(principal, _)): Extension<AuthenticatedPerson>,
+) -> Result<Json<Option<CheckSql>>, ApiError> {
+    Ok(Json(
+        read_person_check_sql(
+            &store,
+            (&context, principal),
+            (location_id, &target, &binding_key),
+        )
+        .await?,
+    ))
+}

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/api/models.rs

@@ -5,9 +5,9 @@ use serde::{Deserialize, Serialize};
 use crate::api::_helpers::authentication::password_sessions;
 use crate::api::_helpers::authentication::{cli_login, oidc};
 use crate::api::_helpers::resources::{
-    administrators, audit, changes, location_health, location_work, person_location_work,
-    person_node_sql, person_operations, run_reads, runs, snapshots, trigger_reads,
-    warehouse_metadata,
+    administrators, audit, changes, location_health, location_work, person_checks,
+    person_location_work, person_node_sql, person_operations, run_reads, runs, snapshots,
+    trigger_reads, warehouse_metadata,
 };
 
 #[derive(Debug, utoipa::OpenApi)]
@@ -24,6 +24,9 @@ use crate::api::_helpers::resources::{
     person_operations::statistics,
     person_operations::fingerprint,
     person_operations::node_status,
+    person_checks::list,
+    person_checks::history,
+    person_checks::sql,
     person_location_work::request,
     person_location_work::result,
     person_node_sql::read,

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/store/_helpers/migration.rs

@@ -20,7 +20,9 @@ pub(crate) fn verify_schema(rows: &[Row], digest: &str) -> Result<(), ControlErr
         .any(|row| row.get("checksum").and_then(|value| value.as_str()) != Some(digest))
     {
         return Err(ControlError::Schema(
-            "control store schema checksum mismatch".into(),
+            "control store schema checksum mismatch; recreate the control store, because \
+             pre-release schemas are not upgraded"
+                .into(),
         ));
     }
     Ok(())

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/store/schema.sql

@@ -396,9 +396,11 @@ CREATE TABLE sqb_warehouse_audit_results (
     outcome TEXT NOT NULL,
     record_json {json} NOT NULL,
     received_at {time} NOT NULL,
-    scan_id {uuid}
+    scan_id {uuid},
+    binding_key TEXT
 );
 CREATE INDEX sqb_audit_results_namespace ON sqb_warehouse_audit_results (location_id,target,state_database,state_schema,observed_at,event_id);
+CREATE INDEX sqb_audit_results_binding ON sqb_warehouse_audit_results (location_id,target,binding_key,observed_at,event_id);
 CREATE TABLE sqb_warehouse_janitor_events (
     event_id {uuid} PRIMARY KEY,
     location_id {uuid} NOT NULL REFERENCES sqb_locations(location_id),

sqlbuild_cli-0.189.0/crates/sqlbuild-orchestration/src/warehouse_metadata/_helpers/checks.rs

@@ -0,0 +1,73 @@
+//! Check reads over the audit-result mirror, keyed by binding key on its own index.
+
+use std::collections::BTreeSet;
+
+use serde::Deserialize;
+use uuid::Uuid;
+
+use crate::credentials::models::{Action, PermissionScope};
+use crate::store::errors::ControlError;
+use crate::store::main::{query::query, query_records::query_records};
+use crate::store::models::{ControlTransaction, Parameter};
+use crate::warehouse_metadata::models::WarehouseAuditRecord;
+
+#[derive(Deserialize)]
+pub(crate) struct AuditRow {
+    pub(crate) event_id: Uuid,
+    pub(crate) record: WarehouseAuditRecord,
+}
+
+/// The newest result of every check in the target.
+pub(crate) async fn latest_results(
+    transaction: ControlTransaction,
+    (location_id, target): (Uuid, &str),
+) -> Result<(ControlTransaction, Vec<AuditRow>), ControlError> {
+    query_records(transaction,
+        "SELECT a.event_id,a.record_json AS record FROM sqb_warehouse_audit_results a \
+         WHERE a.location_id=$1 AND a.target=$2 AND NOT EXISTS (SELECT 1 FROM sqb_warehouse_audit_results b \
+           WHERE b.location_id=a.location_id AND b.target=a.target AND b.binding_key=a.binding_key \
+           AND (b.observed_at,b.event_id)>(a.observed_at,a.event_id)) \
+         ORDER BY a.audit_name,a.binding_key",
+        vec![Parameter::Id(location_id), Parameter::Text(target.into())]).await
+}
+
+/// One check's results, newest first.
+pub(crate) async fn check_results(
+    transaction: ControlTransaction,
+    (location_id, target, binding_key): (Uuid, &str, &str),
+    limit: u32,
+) -> Result<(ControlTransaction, Vec<AuditRow>), ControlError> {
+    query_records(transaction,
+        "SELECT event_id,record_json AS record FROM sqb_warehouse_audit_results \
+         WHERE location_id=$1 AND target=$2 AND binding_key=$3 ORDER BY observed_at DESC,event_id DESC LIMIT $4",
+        vec![Parameter::Id(location_id), Parameter::Text(target.into()), Parameter::Text(binding_key.into()),
+            Parameter::Integer(i64::from(limit.clamp(1, 1000)))]).await
+}
+
+/// The check's own node when the current snapshot has it, otherwise every current node.
+pub(crate) async fn check_scope(
+    transaction: ControlTransaction,
+    (location_id, target, attached): (Uuid, &str, Option<&str>),
+    action: Action,
+) -> Result<(ControlTransaction, PermissionScope), ControlError> {
+    let (transaction, rows) = query(transaction,
+        "SELECT n.node_key FROM sqb_snapshot_nodes n JOIN sqb_current_snapshots c ON c.snapshot_id=n.snapshot_id \
+         WHERE c.location_id=$1 AND c.target=$2",
+        vec![Parameter::Id(location_id), Parameter::Text(target.into())]).await?;
+    let mut nodes: BTreeSet<String> = rows
+        .iter()
+        .filter_map(|row| row["node_key"].as_str().map(str::to_owned))
+        .collect();
+    if let Some(attached) = attached.filter(|attached| nodes.contains(*attached)) {
+        nodes = [attached.to_owned()].into();
+    }
+    Ok((
+        transaction,
+        PermissionScope {
+            action,
+            location_id: Some(location_id),
+            target: Some(target.into()),
+            nodes,
+        },
+    ))
+}

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/warehouse_metadata/_helpers/mod.rs

@@ -1,4 +1,5 @@
 pub(crate) mod catalog;
+pub(crate) mod checks;
 pub(crate) mod events;
 pub(crate) mod fingerprint_reads;
 pub(crate) mod fingerprints;

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/warehouse_metadata/main/ingest_audit_results.rs

@@ -35,6 +35,7 @@ pub async fn ingest_audit_results(
                     columns: vec![
                         ("audit_name", Parameter::Text(record.audit_name.clone())),
                         ("outcome", Parameter::Text(record.outcome.clone())),
+                        ("binding_key", Parameter::Text(record.binding_key.clone())),
                     ],
                     record_json: json!(record),
                 })

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/warehouse_metadata/main/mod.rs

@@ -9,6 +9,9 @@ pub mod ingest_source_freshness;
 pub mod ingest_statistics;
 pub(crate) mod prune_statistics;
 pub mod read_person_catalog;
+pub mod read_person_check;
+pub mod read_person_check_sql;
+pub mod read_person_checks;
 pub mod read_person_fingerprint;
 pub mod read_person_node_status;
 pub mod read_person_statistics;

sqlbuild_cli-0.189.0/crates/sqlbuild-orchestration/src/warehouse_metadata/main/read_person_check.rs

@@ -0,0 +1,33 @@
+//! Live view permission over the whole target and one check's results, newest first.
+
+use uuid::Uuid;
+
+use crate::authorization::main::authorize_listing::authorize_listing;
+use crate::credentials::models::{AuditContext, DefaultRole};
+use crate::store::errors::ControlError;
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
+use crate::warehouse_metadata::_helpers::checks::check_results;
+use crate::warehouse_metadata::models::CheckResult;
+
+pub async fn read_person_check(
+    store: &ControlStore,
+    credentials: (&AuditContext, Uuid),
+    (location_id, target, binding_key): (Uuid, &str, &str),
+    (limit, default_role): (u32, DefaultRole),
+) -> Result<Vec<CheckResult>, ControlError> {
+    let (transaction, _) = authorize_listing(
+        begin(store, TransactionMode::Write).await?,
+        credentials,
+        (location_id, target),
+        default_role,
+    )
+    .await?;
+    let (transaction, rows) =
+        check_results(transaction, (location_id, target, binding_key), limit).await?;
+    commit(transaction).await?;
+    Ok(rows
+        .into_iter()
+        .map(|row| CheckResult::new(row.event_id, row.record))
+        .collect())
+}

sqlbuild_cli-0.189.0/crates/sqlbuild-orchestration/src/warehouse_metadata/main/read_person_check_sql.rs

@@ -0,0 +1,60 @@
+//! Live SQL permission on the check's node, its latest SQL and errors, and the sensitive-read audit share one writer fence.
+
+use serde_json::json;
+use uuid::Uuid;
+
+use crate::authorization::main::authorize_person::authorize_person;
+use crate::credentials::main::audit::append_audit::append_audit;
+use crate::credentials::models::{Action, AuditContext, DefaultRole};
+use crate::store::errors::ControlError;
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
+use crate::warehouse_metadata::_helpers::checks::{check_results, check_scope};
+use crate::warehouse_metadata::models::CheckSql;
+
+pub async fn read_person_check_sql(
+    store: &ControlStore,
+    credentials: (&AuditContext, Uuid),
+    (location_id, target, binding_key): (Uuid, &str, &str),
+) -> Result<Option<CheckSql>, ControlError> {
+    let (transaction, mut rows) = check_results(
+        begin(store, TransactionMode::Write).await?,
+        (location_id, target, binding_key),
+        1,
+    )
+    .await?;
+    let latest = rows.pop();
+    let attached = latest
+        .as_ref()
+        .and_then(|row| row.record.attached_target_name.as_deref());
+    let (transaction, scope) = check_scope(
+        transaction,
+        (location_id, target, attached),
+        Action::ViewSql,
+    )
+    .await?;
+    let (transaction, context) =
+        authorize_person(transaction, credentials, &scope, DefaultRole::None).await?;
+    let result = latest.map(|row| CheckSql {
+        event_id: row.event_id,
+        binding_key: row.record.binding_key,
+        executed_sql: row.record.executed_sql,
+        measurement_sql: row.record.measurement_sql,
+        evidence_sql: row.record.evidence_sql,
+        execution_error: row.record.execution_error,
+        evidence_error: row.record.evidence_error,
+    });
+    let transaction = append_audit(
+        transaction,
+        &context,
+        (Uuid::now_v7(), "sql.read"),
+        (
+            json!(scope),
+            json!(null),
+            json!({"binding_key": binding_key, "event_id": result.as_ref().map(|sql| sql.event_id), "found": result.is_some()}),
+        ),
+    )
+    .await?;
+    commit(transaction).await?;
+    Ok(result)
+}

sqlbuild_cli-0.189.0/crates/sqlbuild-orchestration/src/warehouse_metadata/main/read_person_checks.rs

@@ -0,0 +1,32 @@
+//! Live view permission over the whole target and the newest result of every check.
+
+use uuid::Uuid;
+
+use crate::authorization::main::authorize_listing::authorize_listing;
+use crate::credentials::models::{AuditContext, DefaultRole};
+use crate::store::errors::ControlError;
+use crate::store::main::{begin::begin, commit::commit};
+use crate::store::models::{ControlStore, TransactionMode};
+use crate::warehouse_metadata::_helpers::checks::latest_results;
+use crate::warehouse_metadata::models::CheckResult;
+
+pub async fn read_person_checks(
+    store: &ControlStore,
+    credentials: (&AuditContext, Uuid),
+    (location_id, target): (Uuid, &str),
+    default_role: DefaultRole,
+) -> Result<Vec<CheckResult>, ControlError> {
+    let (transaction, _) = authorize_listing(
+        begin(store, TransactionMode::Write).await?,
+        credentials,
+        (location_id, target),
+        default_role,
+    )
+    .await?;
+    let (transaction, rows) = latest_results(transaction, (location_id, target)).await?;
+    commit(transaction).await?;
+    Ok(rows
+        .into_iter()
+        .map(|row| CheckResult::new(row.event_id, row.record))
+        .collect())
+}

{sqlbuild_cli-0.188.0 → sqlbuild_cli-0.189.0}/crates/sqlbuild-orchestration/src/warehouse_metadata/models.rs

@@ -74,6 +74,81 @@ pub struct WarehouseAuditRecord {
     pub audit_meta_json: Option<String>,
 }
 
+/// One stored check result. Its SQL, error texts and evidence rows need their own permissions.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, utoipa::ToSchema)]
+pub struct CheckResult {
+    pub event_id: Uuid,
+    /// Identity of the check; a renamed model or changed severity or thresholds starts a new one.
+    pub binding_key: String,
+    pub audit_name: String,
+    pub audit_definition_name: String,
+    pub audit_description: Option<String>,
+    pub attachment_kind: String,
+    pub attached_target_kind: Option<String>,
+    pub attached_target_name: Option<String>,
+    pub attached_column_name: Option<String>,
+    pub severity: String,
+    pub evaluation_mode: String,
+    pub run_scope_phase: String,
+    pub thresholds_json: Option<String>,
+    pub occurred_at: DateTime<Utc>,
+    pub run_id: String,
+    pub invocation_id: String,
+    pub outcome: String,
+    pub violation_count: Option<i64>,
+    pub measured_value: Option<String>,
+    pub sample_count: Option<i64>,
+    pub sample_unit: Option<String>,
+    pub minimum_samples: Option<i64>,
+    pub evidence_count: Option<i64>,
+    pub evidence_truncated: Option<String>,
+    pub reused: String,
+}
+
+impl CheckResult {
+    pub(crate) fn new(event_id: Uuid, record: WarehouseAuditRecord) -> Self {
+        Self {
+            event_id,
+            binding_key: record.binding_key,
+            audit_name: record.audit_name,
+            audit_definition_name: record.audit_definition_name,
+            audit_description: record.audit_description,
+            attachment_kind: record.attachment_kind,
+            attached_target_kind: record.attached_target_kind,
+            attached_target_name: record.attached_target_name,
+            attached_column_name: record.attached_column_name,
+            severity: record.severity,
+            evaluation_mode: record.evaluation_mode,
+            run_scope_phase: record.run_scope_phase,
+            thresholds_json: record.thresholds_json,
+            occurred_at: record.occurred_at,
+            run_id: record.run_id,
+            invocation_id: record.invocation_id,
+            outcome: record.outcome,
+            violation_count: record.violation_count,
+            measured_value: record.measured_value,
+            sample_count: record.sample_count,
+            sample_unit: record.sample_unit,
+            minimum_samples: record.minimum_samples,
+            evidence_count: record.evidence_count,
+            evidence_truncated: record.evidence_truncated,
+            reused: record.reused,
+        }
+    }
+}
+
+/// A check's latest SQL and error texts, which quote SQL; `view.sql` reads them, audited.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, utoipa::ToSchema)]
+pub struct CheckSql {
+    pub event_id: Uuid,
+    pub binding_key: String,
+    pub executed_sql: Option<String>,
+    pub measurement_sql: Option<String>,
+    pub evidence_sql: Option<String>,
+    pub execution_error: Option<String>,
+    pub evidence_error: Option<String>,
+}
+
 /// Warehouse cleanup facts do not authorize control-plane deletion or worker recovery.
 #[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize, utoipa::ToSchema)]
 #[serde(deny_unknown_fields)]