Metadata-Version: 2.4
Name: dbwarden-pgsql-rbac
Version: 0.1.1
Summary: PostgreSQL RBAC management for DBWarden
Project-URL: Homepage, https://github.com/dbwarden-org/dbwarden-pgsql-rbac
Project-URL: Source, https://github.com/dbwarden-org/dbwarden-pgsql-rbac
Requires-Python: >=3.12.7
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: dbwarden>=0.16.0
Dynamic: license-file

# dbwarden-pgsql-rbac

PostgreSQL RBAC object handlers for [DBWarden](https://github.com/dbwarden-org/dbwarden).

Brings roles, grants, default privileges, and row-level security policies into DBWarden's schema diff, so access control is versioned and migrated alongside your tables.

## Object types

| Object type | Manages |
|---|---|
| `role` | `CREATE/ALTER/DROP ROLE`, including `LOGIN`, `SUPERUSER`, and connection limits |
| `default_privileges` | `ALTER DEFAULT PRIVILEGES` |
| `policies` | `CREATE/ALTER/DROP POLICY` and `ROW LEVEL SECURITY` state |
| `grants` | `GRANT` / `REVOKE` on tables and other objects |

Roles register first: nothing can be granted to a role that does not exist yet, and both policies and default privileges reference roles by name.

## Installation

```bash
dbwarden plugin add dbwarden-pgsql-rbac
```

## Trust tier

This is an **official** DBWarden plugin. Its distribution name is classified before any of its code is imported, and `dbwarden plugin add` verifies the PyPI Trusted-Publishing attestation (PEP 740) against `dbwarden-org/dbwarden-pgsql-rbac` before installing. It loads automatically once installed, with no `dbwarden plugin trust` step.

## Development

```bash
uv venv && uv pip install -e . -e ../dbwarden pytest
pytest -q
```

The `tests/test_conformance.py` suite runs DBWarden's shared conformance harness (`dbwarden.plugin_conformance`): entry point resolution, no import-time side effects, hook signatures, public-API-only imports, and idempotent `setup()`.

## License

MIT
