feat(access, backup): one Grants view showing everything held; routine grants; run and list backups

[huyplb]

The five recommendations left open in the 2026-10-04 UX review of Database Access and backups. Stacked on tedious-code/foxSchema#483; retargets to main when that merges.

Access

1. One Grants view. "Desired matrix" and "Live catalog" answered the same question two ways once the matrix opened on what is held. The view is now:

• the grid;
• "<principal> also holds, outside this grid: …";
• the database- and schema-wide section for granting those (DbAccessPermissionSections with a new generalOnly).

The Utilities Database Access modal, the component's other user, is unchanged.

2. What the grid can't draw, listed under it.

• splitHeldPrivileges() returns { held, elsewhere }; heldGridPermissions() now delegates to it.
• elsewhere is everything the grid doesn't show: database, schema and server-wide grants, DENY rows, grants on objects that aren't rows, and privileges no column shows.
• describeHeldPrivilege() words each one, e.g. "CONNECT on database shop".

3. Routine privileges are read.

• New sources: Postgres information_schema.role_routine_grants, MySQL and MariaDB mysql.procs_priv (only on the query variant that may read mysql.*), and Db2 SYSCAT.ROUTINEAUTH joined to SYSCAT.ROUTINES for the routine's name.
• A procedure or function row now opens ticked when EXECUTE is held.
• New object types PROCEDURE, FUNCTION and ROUTINE (Postgres doesn't say which). Revokes use each engine's syntax: ON ROUTINE / ON FUNCTION / ON PROCEDURE, and ON OBJECT:: on SQL Server. MySQL and Db2 refuse an unknown kind rather than guess.
• Fixed in passing: Oracle object grants said ON TABLE, which Oracle rejects. It's GRANT … ON schema.object.

Backup & Restore

4. Run the backup from the panel.

• Offered where the backup is SQL the database server runs: SQL Server, CockroachDB, ClickHouse and DuckDB.
• A confirmation first names the file it writes on the server and the connection.
• Runs through /sql/execute like the editor does. The server classifies BACKUP as a schema change, so it needs editor.ddl, and the button is disabled without it.
• Restores are never run from here; they still only open in the SQL editor.

5. List existing backups and restore one.

• history(conn) on the engines that record them: SQL Server (msdb backupset/mediafamily), Db2 (SYSIBMADM.DB_HISTORY) and ClickHouse (system.backups).
• Picking a row sets restoreFrom, and the restore command reads that backup.
• Each engine checks the key and re-quotes it, never pasting it:
  • SQL Server: the path, as N'…';
  • Db2: a 14-digit TAKEN AT timestamp only;
  • ClickHouse: Disk('…','…'), parsed and rebuilt.
• An unreadable pick leaves the restore as it was.
• CockroachDB writes each backup into its own collection, so a history of one collection would show one backup; it isn't offered there.

Verification

• Static checks: typecheck and ESLint are clean; the test-ID catalog was regenerated (1,630 IDs, 0 controls without an ID).
• Unit and web-ui: all 5,434 pass. New tests, each A/B'd:
  • the single Grants view: also-holds line, General section, no mode switch;
  • splitHeldPrivileges agrees with heldGridPermissions;
  • a function row ticks from a held EXECUTE;
  • the routine sources per engine, the kind kept, and revoke syntax per engine;
  • the Oracle fix;
  • the backup history queries, including a quote in a database name;
  • a picked backup reaching the restore, and unreadable picks ignored (an injection attempt via the ClickHouse name);
  • the panel: confirm before running, run, list, pick and restore; nothing for client-side tools; run disabled without editor.ddl.
• Not verified live. The Docker VM's disk went read-only (the host disk is full), so every database container is down, and Docker's own metadata store is read-only too.
  • The new SQL is written to each engine's documented syntax, but hasn't run against Postgres, MySQL, Db2, SQL Server, ClickHouse or Oracle.
  • Worth a live pass once Docker is back: the three routine-grant queries, the three history queries, and an Oracle revoke.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes GRANT/REVOKE generation and catalog reads across engines, and introduces server-executed BACKUP SQL with permission checks—important for auth and data safety but guarded by confirmation and DDL capability.

Overview
Access Grants drops the “Desired matrix” / “Live catalog” toggle in favor of one flow: permission matrix (still seeded from current holds), a new also holds outside this grid line via splitHeldPrivileges / describeHeldPrivilege, and database/schema-wide grants below via DbAccessPermissionSections with generalOnly.

Privilege SQL layer adds routine object types (PROCEDURE, FUNCTION, ROUTINE), reads EXECUTE from Postgres/MySQL/Db2 catalogs, maps EXECUTE onto grid rows, and emits dialect-correct revokes; Oracle object grants no longer use invalid ON TABLE syntax.

Backup & Restore for server-side SQL backups adds BackupServerActions: confirm-then-run backup through executeSql (gated on editor.ddl and connection password), optional backup history for SQL Server/Db2/ClickHouse with pick → restoreFrom on generated restore SQL (validated/re-quoted per engine). Client-side tools (e.g. Postgres) still only show commands; restores are never auto-run.

^{Reviewed by Cursor Bugbot for commit e2feb10. Bugbot is set up for automated code reviews on this repo. Configure here.}

[github-actions]

Test IDs

Removed (2) · a test or recorded flow outside this repo may still use these

• access-grants-mode
• access-grants-mode-{…}

Added (15)

• access-grants-also-holds
• backup-history
• backup-history-clear-pick
• backup-history-empty
• backup-history-error
• backup-history-load
• backup-history-pick-{…}
• backup-history-row-{…}
• backup-run
• backup-run-cancel
• backup-run-confirm
• backup-run-confirm-box
• backup-run-error
• backup-run-status
• backup-server-actions

{…} is a part filled in at run time. The full tree: docs/testing/TEST_IDS.md.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: af571612-65fc-4bfa-828a-b0d08069751a)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 056fd4fa-716e-4dd7-bc69-9317be756606)