fix: name uncovered roles only on grants made for catalog roles

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DsU2Lf6wYQJ9o8ASKRgCmK

frontend/src/lib/components/datatableAcl/PgAclEditor.svelte

@@ -206,7 +206,7 @@
 								<Cell wrap
 									><span class="font-mono text-2xs">{grant.privileges.join(', ')}</span></Cell
 								>
-								<Cell>
+								<Cell wrap>
 									{grantScopeLabel(grant)}
 									{#if blocked.length > 0}
 										<span

frontend/src/lib/components/datatableAcl/aclScopes.test.ts

@@ -164,5 +164,12 @@ describe('uncoveredCreators', () => {
 		}
 		expect(uncoveredCreators(future, ['admin', 'analytics', 'late'])).toEqual(['late'])
 		expect(uncoveredCreators({ ...future, future: undefined }, ['late'])).toEqual([])
+		// Set by a role outside the catalog, it was never meant to cover the catalog's roles.
+		expect(
+			uncoveredCreators({ ...future, sources: [by('postgres', ['SELECT'], false)] }, [
+				'admin',
+				'late'
+			])
+		).toEqual([])
 	})
 })

frontend/src/lib/components/datatableAcl/aclScopes.ts

@@ -152,10 +152,11 @@ export function blockingSources(grant: GroupedGrant, privileges: string[]): stri
 		.map((s) => s.role)
 }
 
-/** Which of `roles` a "created later" row does not cover. A default privilege binds only the
- * creating roles it was granted for, so what the others create stays out of it. */
+/** Which of `roles` a "created later" row granted for some of them does not cover. A default
+ * privilege binds only the creating roles it was granted for, so what the others create stays out
+ * of it. One no role of `roles` set — the instance's own, say — was never meant to cover them. */
 export function uncoveredCreators(grant: GroupedGrant, roles: string[]): string[] {
-	if (!grant.future) return []
+	if (!grant.future || !grant.sources.some((s) => roles.includes(s.role))) return []
 	return roles.filter((r) => !grant.sources.some((s) => s.role === r))
 }