dbwarden-ch-rbac 0.1.0

ClickHouse RBAC object hooks for DBWarden.

dbwarden-ch-rbac

ClickHouse roles and access control for DBWarden.

dbwarden-ch-rbac is an official DBWarden plugin. It is discovered automatically through its dbwarden.plugins entry point and loaded without a consent prompt once installed.

What It Provides

Object handlers that bring ClickHouse role-based access control into DBWarden's schema diff pipeline:

• ch_role: roles.
• ch_user: users.
• ch_grant: privilege grants.
• ch_quota: resource quotas.
• ch_row_policy: row policies.
• ch_settings_profile: settings profiles.

Each handler participates in extract, canonicalize, diff, and emit, and orders itself with public anchors so profiles and roles are created before the users and grants that reference them.

Install

dbwarden plugin add dbwarden-ch-rbac

plugin add verifies the package provenance (a PyPI PEP 740 attestation from the official repository) before installing. You can also install it directly:

uv add dbwarden-ch-rbac
# or
pip install dbwarden-ch-rbac

ClickHouse only.

Use

Declare your ClickHouse roles, users, quotas, policies, and profiles in your DBWarden configuration. With the plugin loaded, dbwarden make-migrations diffs them against the live database and emits the appropriate DDL in dependency order. Confirm the plugin is loaded:

dbwarden plugin list

Development

pip install -e . pytest
pytest -q

See the object-plugin docs.

License

MIT