fix: word grant sources per privilege and name database-wide defaults

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BRoYE5ZeAVvrDYdfhDAYXb

backend/windmill-api/openapi.yaml

@@ -32943,7 +32943,8 @@ components:
           type: array
           description: >-
             the roles the grant comes from, each once — who granted it, or for a default privilege
-            the role whose future objects it covers. A revoke takes it back from every one of them.
+            the role whose future objects it covers. A revoke of some of the grant's privileges
+            takes them back from every source that gave them.
           items:
             $ref: "#/components/schemas/AclSource"
 
@@ -32965,8 +32966,8 @@ components:
           description: >-
             whether the data table's connection can take back what role gave. On an object that is
             the owner, when the connection acts for the owner, and otherwise the connection itself;
-            for a default privilege, a creating role the connection acts for. A grant with a source
-            out of reach is not revocable from here.
+            for a default privilege, a creating role the connection acts for. What a source out of
+            reach gave is not revocable from here; privileges only other sources gave still are.
 
     DatatableAclInfo:
       type: object

frontend/src/lib/components/datatableAcl/PgAclEditor.svelte

@@ -165,7 +165,7 @@
 				<span class="text-xs font-semibold text-emphasis">Grants</span>
 				<span class="text-xs text-secondary">
 					{target.kind === 'database'
-						? 'What each role may do on the database itself: CREATE is the right to create schemas in it.'
+						? 'What each role may do on the database itself — CREATE is the right to create schemas in it — and what default privileges set database-wide give it on what is created later, in every schema. No schema can take those back.'
 						: 'What each role may do here, beyond what it owns.'}
 				</span>
 			</div>
@@ -221,7 +221,8 @@
 											class="text-2xs text-secondary"
 											title="A default privilege covers only the roles it was granted for: grant it again to cover these"
 										>
-											· not for what {uncovered.join(', ')} create
+											· not for what {uncovered.join(', ')}
+											{uncovered.length === 1 ? 'creates' : 'create'}
 										</span>
 									{/if}
 								</Cell>

frontend/src/lib/components/datatableAcl/aclScopes.ts

@@ -154,7 +154,8 @@ export function blockingSources(grant: GroupedGrant, privileges: string[]): stri
 
 /** Which of `roles` a "created later" row granted for some of them does not cover. A default
  * privilege binds only the creating roles it was granted for, so what the others create stays out
- * of it. One no role of `roles` set — the instance's own, say — was never meant to cover them. */
+ * of it. A row none of `roles` set — the instance's own, say — was never meant to cover them, and
+ * names none. */
 export function uncoveredCreators(grant: GroupedGrant, roles: string[]): string[] {
 	if (!grant.future || !grant.sources.some((s) => roles.includes(s.role))) return []
 	return roles.filter((r) => !grant.sources.some((s) => s.role === r))