From 438a5e1a18ae057c1f69a8b6fcc27f786f01e0c3 Mon Sep 17 00:00:00 2001
From: Diego Imbert <diego@windmill.dev>
Date: Fri, 11 Sep 2026 15:13:50 +0200
Subject: [PATCH] fix: name uncovered roles only on grants made for catalog
 roles

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DsU2Lf6wYQJ9o8ASKRgCmK
---
 .../src/lib/components/datatableAcl/PgAclEditor.svelte     | 2 +-
 frontend/src/lib/components/datatableAcl/aclScopes.test.ts | 7 +++++++
 frontend/src/lib/components/datatableAcl/aclScopes.ts      | 7 ++++---
 3 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
index ca0f801bfb..73f615fc36 100644
--- a/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
+++ b/frontend/src/lib/components/datatableAcl/PgAclEditor.svelte
@@ -206,7 +206,7 @@
 								<Cell wrap
 									><span class="font-mono text-2xs">{grant.privileges.join(', ')}</span></Cell
 								>
-								<Cell>
+								<Cell wrap>
 									{grantScopeLabel(grant)}
 									{#if blocked.length > 0}
 										<span
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
index cc7e4b191f..02e95bc116 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.test.ts
@@ -164,5 +164,12 @@ describe('uncoveredCreators', () => {
 		}
 		expect(uncoveredCreators(future, ['admin', 'analytics', 'late'])).toEqual(['late'])
 		expect(uncoveredCreators({ ...future, future: undefined }, ['late'])).toEqual([])
+		// Set by a role outside the catalog, it was never meant to cover the catalog's roles.
+		expect(
+			uncoveredCreators({ ...future, sources: [by('postgres', ['SELECT'], false)] }, [
+				'admin',
+				'late'
+			])
+		).toEqual([])
 	})
 })
diff --git a/frontend/src/lib/components/datatableAcl/aclScopes.ts b/frontend/src/lib/components/datatableAcl/aclScopes.ts
index 174ff0cd77..edb837a693 100644
--- a/frontend/src/lib/components/datatableAcl/aclScopes.ts
+++ b/frontend/src/lib/components/datatableAcl/aclScopes.ts
@@ -152,10 +152,11 @@ export function blockingSources(grant: GroupedGrant, privileges: string[]): stri
 		.map((s) => s.role)
 }
 
-/** Which of `roles` a "created later" row does not cover. A default privilege binds only the
- * creating roles it was granted for, so what the others create stays out of it. */
+/** Which of `roles` a "created later" row granted for some of them does not cover. A default
+ * privilege binds only the creating roles it was granted for, so what the others create stays out
+ * of it. One no role of `roles` set — the instance's own, say — was never meant to cover them. */
 export function uncoveredCreators(grant: GroupedGrant, roles: string[]): string[] {
-	if (!grant.future) return []
+	if (!grant.future || !grant.sources.some((s) => roles.includes(s.role))) return []
 	return roles.filter((r) => !grant.sources.some((s) => s.role === r))
 }