Merge pull request #3 from cozyGarage/feat/schema-review-views

feat(app): list PostgreSQL views in the sidebar through the policy guard

Author: cozyGarage

PLAN.md

@@ -541,7 +541,14 @@ environment colour on each saved-connection row. Slice 10.3 has a
 capability-declared TSV activity dialog whose in-flight query is cancelled when
 the dialog closes. The typed sessions console and blocking trees are not
 started. Structure edit tabs now restore with the rest of the workspace.
-Slices 10.4 through 10.7 are not started.
+Slice 10.6 has started: PostgreSQL views list through the guard and appear
+in the sidebar as read-only objects. Materialized views, routines, triggers,
+sequences, extensions, roles, and grants are not started. Slices 10.4, 10.5,
+and 10.7 are not started.
+
+Which macOS 0.68–0.69 behavior we reimplement, and in what order, is recorded
+in `linux/docs/upstream-adoption.md`. Review their behavior; do not merge
+their source.
 
 The product is strong on safety and thin on operations. A DBA who manages many
 servers gets one active connection per process, an activity dialog that renders
@@ -661,6 +668,11 @@ sequences, extensions, roles, and grants. The connection trait gains methods
 whose defaults return nothing, matching the existing index and foreign-key
 pattern, so drivers opt in without breaking. PostgreSQL implements all of them.
 
+`list_views` is the first method. PostgreSQL reads `pg_views` through the
+guard. The sidebar shows those rows under Views and offers Open only. A
+failed list does not look like an empty catalog. The remaining object kinds
+follow the same shape.
+
 Database metadata is untrusted input. Identifiers are dialect-quoted and never
 joined into SQL as text.
 

linux/CHANGELOG.md

@@ -4,6 +4,7 @@
 
 ### Added
 
+- PostgreSQL views appear in the sidebar as read-only objects, listed through the same policy and timeout path as tables
 - Saved connections can name a certificate authority, so a server whose certificate is issued privately can be verified with Verify Ca or Verify Full
 - Policy crate with AST SQL classification, PolicyGuard, blast-radius rewrite, column masking, and policy.toml. Statements that read host files, run a program, or send SQL to another server are treated as administrative, so an agent is refused and a read-only connection denies them
 - Environment field on saved connections (Local / Dev / Staging / Prod)

linux/ROADMAP.md

@@ -156,11 +156,13 @@ The repository extraction completed on 2026-08-17. Product planning now follows
 - [ ] A typed sessions and locks console with capability-declared driver support and governed session termination
 - [ ] A PostgreSQL server health panel that degrades cleanly when a statistics extension is absent
 - [ ] Configurable pool size and timeouts per saved connection, honoured by the driver
-- [ ] Read-only review of views, routines, triggers, sequences, extensions, roles, and grants
+- [ ] Read-only review of views, routines, triggers, sequences, extensions, roles, and grants (PostgreSQL views are listing)
 - [ ] A decision record, design, and measured prototype for an out-of-process Python runner
 
 Phase 10 is in progress. Slice 10.2 added connection organisation: groups, tags, favourites, search across name/group/tag/driver, and URL import whose password reaches the keyring and never the saved file. Its first slice retired the one-active-connection limit: activation is additive and every window owns and releases its own connection, proven by two windows writing to two databases in the installed suite. Every connection it exposes stays policy-guarded, and no slice ships DDL or server configuration writes.
 
 ## Next implementation target
 
 The immediate target is the internal Arch RC. The exact-commit hosted jobs first ran fully green on 2026-08-21 at `c8f91f06`, so the Phase 4 soak ledger has started and needs 30 consecutive retry-free attempts across at least six runs. What remains is accumulating that ledger and verifying install/upgrade/rollback on Wayland. Those gates are mostly waiting, so Phase 10 feature work runs in parallel on `linux` while the candidate stays frozen on a release branch. Phase 10 comes before full-table snapshot export and Phase 6 object administration; new drivers come after both.
+
+Which macOS features we take, skip, and in what order is in [docs/upstream-adoption.md](docs/upstream-adoption.md). The next product slice after views is the typed activity console (10.3), then the rest of 10.6.

linux/crates/app/src/services/connection_service.rs

@@ -14,6 +14,7 @@ use super::database_service::{self, ConnectionMetadata, ReconnectParams};
 /// the existing workspace and connection untouched.
 pub struct PreparedConnection {
     pub tables: Vec<tablepro_core::TableInfo>,
+    pub views: Vec<tablepro_core::TableInfo>,
     pub driver_id: String,
     id: uuid::Uuid,
     metadata: ConnectionMetadata,
@@ -29,19 +30,22 @@ impl std::fmt::Debug for PreparedConnection {
             .field("id", &self.id)
             .field("driver_id", &self.driver_id)
             .field("table_count", &self.tables.len())
+            .field("view_count", &self.views.len())
             .finish_non_exhaustive()
     }
 }
 
 pub struct ActivatedConnection {
     pub id: Uuid,
     pub tables: Vec<tablepro_core::TableInfo>,
+    pub views: Vec<tablepro_core::TableInfo>,
     pub driver_id: String,
 }
 
 impl PreparedConnection {
     pub(crate) fn new(
         tables: Vec<tablepro_core::TableInfo>,
+        views: Vec<tablepro_core::TableInfo>,
         driver_id: String,
         metadata: ConnectionMetadata,
         connection: Box<dyn Connection>,
@@ -50,6 +54,7 @@ impl PreparedConnection {
     ) -> Self {
         Self {
             tables,
+            views,
             driver_id,
             id: metadata.id,
             read_only: metadata.read_only,
@@ -73,6 +78,7 @@ impl PreparedConnection {
         ActivatedConnection {
             id,
             tables: self.tables,
+            views: self.views,
             driver_id: self.driver_id,
         }
     }
@@ -100,6 +106,10 @@ pub async fn open_saved(
         .list_tables_controlled(&control)
         .await
         .map_err(|e| format!("list_tables: {e}"))?;
+    let views = conn
+        .list_views_controlled(&control)
+        .await
+        .map_err(|e| format!("list_views: {e}"))?;
     let metadata = ConnectionMetadata {
         id,
         name: saved.name.clone(),
@@ -115,6 +125,7 @@ pub async fn open_saved(
     };
     Ok(PreparedConnection::new(
         tables,
+        views,
         saved.driver_id,
         metadata,
         conn,

linux/crates/app/src/ui/app/connection.rs

@@ -48,7 +48,12 @@ impl App {
         activated: connection_service::ActivatedConnection,
         sender: ComponentSender<Self>,
     ) {
-        let connection_service::ActivatedConnection { id, tables, driver_id } = activated;
+        let connection_service::ActivatedConnection {
+            id,
+            tables,
+            views,
+            driver_id,
+        } = activated;
         self.dismiss_loading_page();
         self.dialog = None;
         self.connected = true;
@@ -64,8 +69,14 @@ impl App {
         // a tab via sidebar click or Ctrl+T.
         self.ensure_workspace_root(sender.clone());
         self.content_holder.set_content(Some(&self.workspace_outer_stack));
-        self.table_names = tables.iter().map(|t| t.name.clone()).collect();
-        tracing::info!(driver = %driver_id, table_count = tables.len(), "workspace ready");
+        self.table_names = tables.iter().chain(views.iter()).map(|t| t.name.clone()).collect();
+        tracing::info!(
+            driver = %driver_id,
+            table_count = tables.len(),
+            view_count = views.len(),
+            "workspace ready"
+        );
+        self.sidebar_views = views;
         self.repopulate_sidebar(&tables);
         self.rebuild_schema_buffer();
         self.refresh_window_title();
@@ -164,6 +175,8 @@ impl App {
         self.refresh_window_title();
         self.table_search.set_text("");
         self.sidebar_schemas.borrow_mut().clear();
+        self.sidebar_kinds.borrow_mut().clear();
+        self.sidebar_views.clear();
         self.sidebar_factory.guard().clear();
         self.show_welcome_page(sender);
         tracing::info!("disconnected");
@@ -518,11 +531,33 @@ impl App {
             let mut schemas = self.sidebar_schemas.borrow_mut();
             schemas.clear();
             schemas.extend(tables.iter().map(|t| t.schema.clone()));
+            schemas.extend(self.sidebar_views.iter().map(|t| t.schema.clone()));
+        }
+        {
+            let mut kinds = self.sidebar_kinds.borrow_mut();
+            kinds.clear();
+            kinds.extend(std::iter::repeat_n(
+                crate::ui::sidebar_row::SidebarObjectKind::Table,
+                tables.len(),
+            ));
+            kinds.extend(std::iter::repeat_n(
+                crate::ui::sidebar_row::SidebarObjectKind::View,
+                self.sidebar_views.len(),
+            ));
         }
         let mut guard = self.sidebar_factory.guard();
         guard.clear();
         for table in tables {
-            guard.push_back(table.clone());
+            guard.push_back(crate::ui::sidebar_row::SidebarRowInit {
+                info: table.clone(),
+                kind: crate::ui::sidebar_row::SidebarObjectKind::Table,
+            });
+        }
+        for view in &self.sidebar_views {
+            guard.push_back(crate::ui::sidebar_row::SidebarRowInit {
+                info: view.clone(),
+                kind: crate::ui::sidebar_row::SidebarObjectKind::View,
+            });
         }
         drop(guard);
         self.sidebar_factory.widget().invalidate_headers();

linux/crates/app/src/ui/app/init_sidebar.rs

@@ -7,17 +7,19 @@ use relm4::prelude::*;
 use relm4::{adw, gtk};
 
 use super::{App, AppMsg, AppWidgets, OpenMode};
-use crate::ui::sidebar_row::{SidebarRow, SidebarRowOutput};
+use crate::ui::sidebar_row::{SidebarObjectKind, SidebarRow, SidebarRowOutput};
 
 /// The sidebar's factory plus the parallel schema list its filter,
 /// header and selection code index by row position.
 pub(super) struct SidebarParts {
     pub(super) factory: FactoryVecDeque<SidebarRow>,
     pub(super) schemas: Rc<RefCell<Vec<Option<String>>>>,
+    pub(super) kinds: Rc<RefCell<Vec<SidebarObjectKind>>>,
 }
 
 pub(super) fn build_sidebar(widgets: &AppWidgets, sender: &ComponentSender<App>) -> SidebarParts {
     let sidebar_schemas: Rc<RefCell<Vec<Option<String>>>> = Rc::new(RefCell::new(Vec::new()));
+    let sidebar_kinds: Rc<RefCell<Vec<SidebarObjectKind>>> = Rc::new(RefCell::new(Vec::new()));
 
     let sidebar_factory: FactoryVecDeque<SidebarRow> = FactoryVecDeque::builder()
         .launch(
@@ -133,9 +135,32 @@ pub(super) fn build_sidebar(widgets: &AppWidgets, sender: &ComponentSender<App>)
         .build();
 
     let schemas_for_header = sidebar_schemas.clone();
+    let kinds_for_header = sidebar_kinds.clone();
     let sender_for_header = sender.clone();
     sidebar_listbox.set_header_func(move |row, before| {
         let schemas = schemas_for_header.borrow();
+        let kinds = kinds_for_header.borrow();
+        let idx = row.index() as usize;
+        let current_kind = kinds.get(idx).copied();
+        let prev_kind = before.and_then(|b| kinds.get(b.index() as usize).copied());
+        if current_kind == Some(SidebarObjectKind::View) && prev_kind != Some(SidebarObjectKind::View) {
+            let header = gtk::Label::builder()
+                .label(crate::tr!("Views"))
+                .xalign(0.0)
+                .margin_top(12)
+                .margin_bottom(6)
+                .margin_start(12)
+                .margin_end(12)
+                .build();
+            header.add_css_class("caption-heading");
+            header.add_css_class("dim-label");
+            row.set_header(Some(&header));
+            return;
+        }
+        if current_kind == Some(SidebarObjectKind::View) {
+            row.set_header(gtk::Widget::NONE);
+            return;
+        }
         let total_distinct: std::collections::BTreeSet<&str> = schemas.iter().filter_map(|s| s.as_deref()).collect();
         // Postgres-style multi-schema connections render a header
         // per schema with a "+" button for "New Table…". Single-
@@ -214,5 +239,6 @@ pub(super) fn build_sidebar(widgets: &AppWidgets, sender: &ComponentSender<App>)
     SidebarParts {
         factory: sidebar_factory,
         schemas: sidebar_schemas,
+        kinds: sidebar_kinds,
     }
 }

linux/crates/app/src/ui/app/mod.rs

@@ -73,6 +73,8 @@ pub struct App {
     disconnect_action: gio::SimpleAction,
     sidebar_factory: FactoryVecDeque<SidebarRow>,
     sidebar_schemas: std::rc::Rc<std::cell::RefCell<Vec<Option<String>>>>,
+    sidebar_kinds: std::rc::Rc<std::cell::RefCell<Vec<crate::ui::sidebar_row::SidebarObjectKind>>>,
+    sidebar_views: Vec<tablepro_core::TableInfo>,
     content_holder: adw::ToolbarView,
     toast_overlay: adw::ToastOverlay,
     /// Persistent "Connecting…" toast handle. Held so we can dismiss it
@@ -411,6 +413,8 @@ impl SimpleComponent for App {
             disconnect_action,
             sidebar_factory: sidebar.factory,
             sidebar_schemas: sidebar.schemas,
+            sidebar_kinds: sidebar.kinds,
+            sidebar_views: Vec::new(),
             content_holder: widgets.content_holder.clone(),
             toast_overlay: widgets.toast_overlay.clone(),
             connect_progress_toast: None,

linux/crates/app/src/ui/connect_dialog/mod.rs

@@ -785,6 +785,10 @@ async fn run_connect(request: ConnectRequest) -> Result<connection_service::Prep
         .list_tables_controlled(&control)
         .await
         .map_err(|e| format!("list_tables: {e}"))?;
+    let views = conn
+        .list_views_controlled(&control)
+        .await
+        .map_err(|e| format!("list_views: {e}"))?;
 
     let existing = find_existing(&driver_id, &opts_clone, driver.is_file_based(), ssh.as_ref()).await;
     let id = existing
@@ -877,6 +881,7 @@ async fn run_connect(request: ConnectRequest) -> Result<connection_service::Prep
     };
     Ok(connection_service::PreparedConnection::new(
         tables,
+        views,
         saved.driver_id.clone(),
         metadata,
         conn,

linux/crates/app/src/ui/sidebar_row.rs

@@ -7,9 +7,29 @@ use relm4::gtk::prelude::*;
 
 use tablepro_core::TableInfo;
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SidebarObjectKind {
+    Table,
+    View,
+}
+
+#[derive(Debug, Clone)]
+pub struct SidebarRowInit {
+    pub info: TableInfo,
+    pub kind: SidebarObjectKind,
+}
+
+fn sidebar_icon(kind: SidebarObjectKind) -> &'static str {
+    match kind {
+        SidebarObjectKind::Table => "view-list-symbolic",
+        SidebarObjectKind::View => "view-paged-symbolic",
+    }
+}
+
 #[derive(Debug)]
 pub struct SidebarRow {
     pub info: TableInfo,
+    kind: SidebarObjectKind,
     open_button: gtk::Button,
     /// The eagerly-parented context-menu popover. Held on the model
     /// so `shutdown` can `unparent()` it before the row's root widget
@@ -68,7 +88,7 @@ pub enum SidebarRowOutput {
 
 #[relm4::factory(pub)]
 impl FactoryComponent for SidebarRow {
-    type Init = TableInfo;
+    type Init = SidebarRowInit;
     type Input = SidebarRowMsg;
     type Output = SidebarRowOutput;
     type CommandOutput = ();
@@ -106,7 +126,7 @@ impl FactoryComponent for SidebarRow {
                 set_margin_bottom: 6,
 
                 gtk::Image {
-                    set_icon_name: Some("view-list-symbolic"),
+                    set_icon_name: Some(sidebar_icon(self.kind)),
                     set_pixel_size: 16,
                 },
 
@@ -122,8 +142,8 @@ impl FactoryComponent for SidebarRow {
         }
     }
 
-    fn init_model(info: Self::Init, _index: &DynamicIndex, _sender: FactorySender<Self>) -> Self {
-        let open_label = crate::tr!("Open {name}").replace("{name}", &info.name);
+    fn init_model(init: Self::Init, _index: &DynamicIndex, _sender: FactorySender<Self>) -> Self {
+        let open_label = crate::tr!("Open {name}").replace("{name}", &init.info.name);
         let open_button = gtk::Button::builder()
             .icon_name("go-next-symbolic")
             .tooltip_text(&open_label)
@@ -132,7 +152,8 @@ impl FactoryComponent for SidebarRow {
             .build();
         open_button.update_property(&[gtk::accessible::Property::Label(&open_label)]);
         Self {
-            info,
+            info: init.info,
+            kind: init.kind,
             open_button,
             popover: None,
         }
@@ -210,16 +231,18 @@ impl FactoryComponent for SidebarRow {
             Some("sidebar-row.open-in-new-tab"),
         );
         menu.append_section(None, &open_section);
-        let structure_section = gtk::gio::Menu::new();
-        structure_section.append(Some(&crate::tr!("Edit Structure")), Some("sidebar-row.edit-structure"));
-        structure_section.append(
-            Some(&crate::tr!("Show CREATE TABLE")),
-            Some("sidebar-row.show-create-table"),
-        );
-        menu.append_section(None, &structure_section);
-        let mutate_section = gtk::gio::Menu::new();
-        mutate_section.append(Some(&crate::tr!("Drop Table\u{2026}")), Some("sidebar-row.drop-table"));
-        menu.append_section(None, &mutate_section);
+        if self.kind == SidebarObjectKind::Table {
+            let structure_section = gtk::gio::Menu::new();
+            structure_section.append(Some(&crate::tr!("Edit Structure")), Some("sidebar-row.edit-structure"));
+            structure_section.append(
+                Some(&crate::tr!("Show CREATE TABLE")),
+                Some("sidebar-row.show-create-table"),
+            );
+            menu.append_section(None, &structure_section);
+            let mutate_section = gtk::gio::Menu::new();
+            mutate_section.append(Some(&crate::tr!("Drop Table\u{2026}")), Some("sidebar-row.drop-table"));
+            menu.append_section(None, &mutate_section);
+        }
 
         let popover = gtk::PopoverMenu::from_model(Some(&menu));
         popover.set_has_arrow(true);