Metadata-Version: 2.4
Name: dbwarden-ch-rbac
Version: 0.1.0
Summary: ClickHouse RBAC object hooks for DBWarden.
Requires-Python: >=3.12.7
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: dbwarden>=0.15.0
Dynamic: license-file

# dbwarden-ch-rbac

ClickHouse roles and access control for [DBWarden](https://github.com/dbwarden/dbwarden).

`dbwarden-ch-rbac` is an official DBWarden plugin. It is discovered automatically through its `dbwarden.plugins` entry point and loaded without a consent prompt once installed.

## What It Provides

Object handlers that bring ClickHouse role-based access control into DBWarden's schema diff pipeline:

- `ch_role`: roles.
- `ch_user`: users.
- `ch_grant`: privilege grants.
- `ch_quota`: resource quotas.
- `ch_row_policy`: row policies.
- `ch_settings_profile`: settings profiles.

Each handler participates in extract, canonicalize, diff, and emit, and orders itself with public anchors so profiles and roles are created before the users and grants that reference them.

## Install

```bash
dbwarden plugin add dbwarden-ch-rbac
```

`plugin add` verifies the package provenance (a PyPI PEP 740 attestation from the official repository) before installing. You can also install it directly:

```bash
uv add dbwarden-ch-rbac
# or
pip install dbwarden-ch-rbac
```

ClickHouse only.

## Use

Declare your ClickHouse roles, users, quotas, policies, and profiles in your DBWarden configuration. With the plugin loaded, `dbwarden make-migrations` diffs them against the live database and emits the appropriate DDL in dependency order. Confirm the plugin is loaded:

```bash
dbwarden plugin list
```

## Development

```bash
pip install -e . pytest
pytest -q
```

See the [object-plugin docs](https://github.com/dbwarden/dbwarden/blob/main/docs/plugins/developing/object-plugins.md).

## License

MIT
