dbwarden-ch-rbac 0.1.1

ClickHouse RBAC management for DBWarden

dbwarden-ch-rbac

ClickHouse RBAC object handlers for DBWarden.

Teaches DBWarden's schema diff to manage ClickHouse access control the same way it manages tables: extracted from a live snapshot, diffed against your models, and emitted as reversible migration SQL.

Object types

Object type	Manages
ch_settings_profile	CREATE/ALTER/DROP SETTINGS PROFILE
ch_role	CREATE/ALTER/DROP ROLE
ch_user	CREATE/ALTER/DROP USER, including auth, host, and default roles
ch_quota	CREATE/ALTER/DROP QUOTA
ch_row_policy	CREATE/ALTER/DROP ROW POLICY
ch_named_collection	CREATE/ALTER/DROP NAMED COLLECTION, with secret values redacted in snapshots
ch_grant	GRANT / REVOKE

Handlers register in ClickHouse's RBAC dependency order (profiles, then roles, then users, then everything that references them) so a single migration applies cleanly in one pass.

Installation

dbwarden plugin add dbwarden-ch-rbac

Trust tier

This is an official DBWarden plugin. Its distribution name is classified before any of its code is imported, and dbwarden plugin add verifies the PyPI Trusted-Publishing attestation (PEP 740) against dbwarden-org/dbwarden-ch-rbac before installing. It loads automatically once installed, with no dbwarden plugin trust step.

Development

uv venv && uv pip install -e . -e ../dbwarden pytest
pytest -q

The tests/test_conformance.py suite runs DBWarden's shared conformance harness (dbwarden.plugin_conformance): entry point resolution, no import-time side effects, hook signatures, public-API-only imports, and idempotent setup().

License

MIT