test: review features on every engine (unit, component, live, e2e), and the bugs that found

[huyplb]

Implements docs/plans/2026-10-06-review-features-test-plan.md on top of #484. Every layer ran here against real servers: 11 docker-compose engines (Db2 included), plus DuckDB and SQLite.

What was added

Unit (packages/sql)
Each matrix names every engine, and a test fails when an engine is added without an answer.

• routine-privileges.matrix.test.ts: per engine:
  • which catalog the first rung reads routine grants from
  • the exact REVOKE for PROCEDURE / FUNCTION / ROUTINE, or the refusal
  • how each catalog spelling normalises
  • where splitHeldPrivileges puts each object type, including DENY
• backup-history.matrix.test.ts: per engine:
  • whether it keeps a history (and that the query classifies as a read)
  • whether its backup can be run from the panel (and that it needs editor.ddl)
  • that hostile restore keys (injection attempts, 13- and 15-digit Db2 stamps) never reach the restore as written
• schema-compare.matrix.test.ts: the light Compare check equals dialectFeatures().schemaCompare for every engine, spelling and non-engine.

Component (web-ui)

• AccessGrantsStage.dialects.test.tsx: one render per grant-capable engine.
• BackupRestorePanel.dialects.test.tsx: run and list offered exactly where they should be; the password, error and empty states; pick, then "Restore the newest instead".

Live (FOX_IT_DB=1)
Each engine is skipped by name, with the server's message, when its own probe fails.

• access-live.test.ts, per engine:
  • create a role, a table, a function and a procedure
  • grant on each, plus one database- or schema-wide privilege
  • read them back through probeDbAccess and split them as the Grants view does
  • revoke with both the Database Access SQL and the Grants grid SQL, then read again
• backup-live.test.ts:
  • SQL Server: BACKUP → msdb → RESTORE VERIFYONLY on the picked file
  • Db2: CLP backup → DB_HISTORY → TAKEN AT → db2ckbkp
  • ClickHouse: backup to the allowed disk → system.backups → restore under _restored
  • DuckDB: EXPORT / IMPORT
  • CockroachDB: nodelocal BACKUP / RESTORE
• History queries run through the same pager as /sql/execute.
• The Db2 case takes an offline backup, so run this file on its own or with --no-file-parallelism.

E2E (apps/e2e)

• Every seed gains fox_reader: SELECT on a table, EXECUTE on fn_get_discount (Db2's seed gains the function), and one wide grant.
• access-assistant-dialects: Grants opens on that role with the boxes ticked and the wide grant listed under the grid.
• backup-restore-ui: on SQL Server, run → confirm → listed → pick → restore names that file.

Bugs found and fixed

Each failed before its fix and passes after. That was checked by reverting each fix (or mutating the SQL) and rerunning.

Engine	Bug	From
SQL Server	Privileges never read: collation conflict in the UNION (permission_name vs a role name on a default-collation database)	earlier
SQL Server	"List backups" always failed in the app: TOP (20) next to the pager's OFFSET … FETCH	#484
TiDB	First rung read mysql.procs_priv, which TiDB lacks, so it fell back and lost role memberships	#484
TiDB	information_schema TABLE_ and SCHEMA_PRIVILEGES are empty even for root; now read from mysql.tables_priv and mysql.db	earlier
CockroachDB	REVOKE … ON ROUTINE is a syntax error; the routine rung now reports FUNCTION or PROCEDURE from information_schema.routines	#484
Db2	Routine REVOKE needs RESTRICT (both emitters)	#484
Db2	CONNECT granted to a role was filtered out of DBAUTH	earlier
Redis, MongoDB	Were offered SQL GRANT text; they now refuse with the existing non-SQL reason	earlier
all	isKnownEngine('constructor') was true	earlier
seed-all.sh (Db2)	Ran every statement without a connection (bash execs the last command of su -c)	earlier

The local ClickHouse also gets a backup disk (docker/init/clickhouse/backups.xml), so its backup path runs instead of being refused.

Results

• npx vitest run: 5843 passed, 0 failed.
• Typecheck (web and e2e): clean. eslint on changed paths: clean. npm run test-ids: no drift.
• Live: 35 of 35 tests across postgres, yugabytedb, cockroachdb, redshift (Postgres stand-in), mysql, mariadb, tidb, sqlserver, oracle, db2 and clickhouse, plus duckdb.
• E2E:
  • access-assistant-dialects: 45 passed, 1 skipped (ClickHouse has no Grants builder).
  • backup-restore-ui: 4 of 4.
  • lazy-loading: 4 of 4.
  • compare-flow (Postgres): 11 of 11.

Not covered

• Azure SQL: there is no container for it.
• Redshift: only a Postgres stand-in, so its routines are not asserted.
• The plan's Workflow cron preview e2e is not written.
• Pre-existing and out of scope, tracked separately:
  • the SQL editor pages any T-SQL SELECT TOP … ORDER BY into the same TOP + OFFSET error
  • generated-ddl-live fails on SQL Server for "alters a table whose names need quoting" (it fails on the base commit too)
• CI on perf(web): first visit 210 → 140 KB gzip; TS cells compile on the server; cheaper typing and clicks #483/feat(access, backup): one Grants view showing everything held; routine grants; run and list backups #484 is still red on npm audit (source-map-js); this PR does not touch dependencies.

🤖 Generated with Claude Code

https://claude.ai/code/session_016PyNv48vpYUw2HhpjYFNUi

---

Generated by Claude Code

---

Note

Medium Risk
Touches privilege catalog SQL and GRANT/REVOKE generation across many engines (including SQL Server and TiDB), which are security-sensitive paths; most risk is mitigated by extensive new live and matrix tests rather than broad refactors.

Overview
Adds cross-engine test coverage for Access Grants, Backup & Restore, and schema-compare, plus production fixes those tests exposed.

Testing: New unit matrix tests in packages/sql (routine privileges, backup history/run permissions, schema-compare parity). Component tests render AccessGrantsStage and BackupRestorePanel once per dialect. FOX_IT_DB=1 live suites grant/revoke against real containers and exercise backup → history → restore round-trips. E2E gains seeded fox_reader roles in Docker init scripts, a Grants test that asserts held grid cells and “also holds” text, SQL Server backup run/list/pick in the browser, and shared helpers for the Principals/Grants flow.

SQL & infra fixes: TiDB reads grants from mysql.tables_priv / mysql.db and skips routine catalogs; SQL Server privilege UNION uses DATABASE_DEFAULT collation and drops TOP from msdb history for the SQL pager; CockroachDB routine revokes require FUNCTION/PROCEDURE; Db2 routine revokes append RESTRICT and role CONNECT grants are included; Postgres-family routine grants join information_schema.routines; Redis/MongoDB are marked unsupported for SQL GRANT; isKnownEngine uses Object.hasOwn. ClickHouse gets an allowed backup disk config; seed-all.sh keeps a single Db2 CLP session.

A test plan doc describes the layered strategy.

^{Reviewed by Cursor Bugbot for commit 28211f9. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: 0751f9db-c4bc-41e1-ae9f-62d3a1f7288e)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: bd06a775-d06d-486c-ad4b-8f5769b4af79)