Test every definition check in the database and correct the roles table

The database repeats each check NewSimulation and NewReport make, for any
other writer, but only the report year and options checks had a test, so a
mistake in another check's expression would have gone unnoticed. New tests
insert rows directly as the runtime role and expect each of the other
checks to refuse them: the kinds, countries, region code, dataset name,
both v1 IDs, and an economy report without a reform.

The README's roles table still gave the runtime role UPDATE on every table,
and did not say the migrator needs REFERENCES on the Public API tables
before revision 0002 deploys; both are corrected. The unused
REFERENCED_PUBLIC_API_TABLES constant is gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: anth-volk

libs/policyengine-simulation-persistence/README.md

@@ -57,12 +57,18 @@ These rules are registered in `rules/registry.toml` and checked by
 
 | Role | Used by | Privileges |
 | --- | --- | --- |
-| `simulation_migrator` | The deploy workflow's migration job, through `SIMULATION_MIGRATION_DATABASE_URL` | Creates the `simulation` schema if it is missing, and owns every object in it |
-| `simulation_runtime` | The Simulation Entrypoint, through `SIMULATION_DATABASE_URL` | `USAGE` on the schema, `SELECT` on the version table, and `SELECT`, `INSERT` and `UPDATE` on the tables the migrations create |
+| `simulation_migrator` | The deploy workflow's migration job, through `SIMULATION_MIGRATION_DATABASE_URL` | Creates the `simulation` schema if it is missing, and owns every object in it; `REFERENCES` on the Public API tables its foreign keys point to |
+| `simulation_runtime` | The Simulation Entrypoint, through `SIMULATION_DATABASE_URL` | `USAGE` on the schema, `SELECT` on the version table, and `SELECT`, `INSERT` and `UPDATE` on the tables the migrations create, except `UPDATE` on the definition tables (`simulations`, `reports`); never `DELETE`, and nothing on the Public API tables |
 
 The initial revision grants the runtime role its privileges, including default
-privileges on tables the migrator creates later. Both roles must exist before
-the first migration runs; an operator creates them. The migrator needs either
+privileges on tables the migrator creates later; revision 0002 revokes
+`UPDATE` on the definition tables, which never change. Both roles must exist
+before the first migration runs; an operator creates them. Before revision
+0002 is deployed, the owner of the Public API's tables must also grant the
+migrator `REFERENCES` on `policies`, `households` and `dynamics` (the
+operator step grants it on `tax_benefit_model_versions`, `datasets` and
+`regions` too, for later revisions); without it the migration fails and
+applies nothing. The migrator needs either
 `CREATE` on the database or a `simulation` schema created in advance and owned
 by it: the environment creates the schema only when it is missing, because
 PostgreSQL checks `CREATE` on the database even for

libs/policyengine-simulation-persistence/src/policyengine_simulation_persistence/public_api.py

@@ -41,5 +41,3 @@
     public_api_metadata,
     Column("id", Uuid(as_uuid=True), primary_key=True),
 )
-
-REFERENCED_PUBLIC_API_TABLES = tuple(sorted(public_api_metadata.tables))

libs/policyengine-simulation-persistence/tests/test_reports.py

@@ -5,7 +5,12 @@
 from uuid import uuid4
 
 import pytest
-from policyengine_simulation_persistence import ReportKind, ReportRecord
+from policyengine_simulation_persistence import (
+    ReportKind,
+    ReportRecord,
+    create_simulation_engine,
+)
+from policyengine_simulation_persistence.reports import reports
 from public_api_support import superuser_engine
 from report_support import (
     economy_pair,
@@ -14,7 +19,7 @@
     report_store,
 )
 from simulation_support import economy_simulation, simulation_store
-from sqlalchemy import text
+from sqlalchemy import insert, text
 from sqlalchemy.exc import IntegrityError
 
 pytestmark = pytest.mark.postgres
@@ -188,3 +193,37 @@ def test_a_migrated_report_needs_its_legacy_id(
 
 def test_an_unknown_report_reads_as_none(migrated_database) -> None:
     assert report_store(migrated_database).get(uuid4()) is None
+
+
+@pytest.mark.parametrize(
+    ("column", "value", "constraint"),
+    [
+        ("kind", "microsimulation", "ck_reports_kind"),
+        ("country", "GB", "ck_reports_country"),
+        ("legacy_report_id", -4, "ck_reports_legacy_report_id"),
+        ("reform_simulation_id", None, "ck_reports_economy_has_reform"),
+    ],
+)
+def test_the_database_checks_each_report_field(
+    migrated_database, public_api_rows, column, value, constraint
+) -> None:
+    """The database checks what NewReport also checks, for any other writer."""
+    baseline, reform = economy_pair(migrated_database, public_api_rows)
+    values = {
+        "id": uuid4(),
+        "kind": "economy",
+        "country": "us",
+        "baseline_simulation_id": baseline.id,
+        "reform_simulation_id": reform.id,
+        "year": 2026,
+        column: value,
+    }
+    engine = create_simulation_engine(migrated_database.runtime_url)
+    try:
+        with (
+            pytest.raises(IntegrityError, match=constraint),
+            engine.begin() as connection,
+        ):
+            connection.execute(insert(reports).values(**values))
+    finally:
+        engine.dispose()

libs/policyengine-simulation-persistence/tests/test_simulations.py

@@ -9,13 +9,16 @@
     NewSimulation,
     SimulationKind,
     SimulationRecord,
+    create_simulation_engine,
 )
+from policyengine_simulation_persistence.simulations import simulations
 from public_api_support import delete_public_api_row
 from simulation_support import (
     economy_simulation,
     household_simulation,
     simulation_store,
 )
+from sqlalchemy import insert
 from sqlalchemy.exc import IntegrityError
 
 pytestmark = pytest.mark.postgres
@@ -210,3 +213,35 @@ def test_two_simulations_cannot_share_a_legacy_id(
 
 def test_an_unknown_simulation_reads_as_none(migrated_database) -> None:
     assert simulation_store(migrated_database).get(uuid4()) is None
+
+
+@pytest.mark.parametrize(
+    ("column", "value", "constraint"),
+    [
+        ("kind", "microsimulation", "ck_simulations_kind"),
+        ("country", "USA", "ck_simulations_country"),
+        ("region_code", "state ca", "ck_simulations_region_code"),
+        ("dataset_name", "populace us", "ck_simulations_dataset_name"),
+        ("legacy_simulation_id", 0, "ck_simulations_legacy_simulation_id"),
+    ],
+)
+def test_the_database_checks_each_simulation_field(
+    migrated_database, public_api_rows, column, value, constraint
+) -> None:
+    """The database checks what NewSimulation also checks, for any other writer."""
+    values = {
+        "id": uuid4(),
+        "kind": "economy",
+        "country": "us",
+        "region_code": "state/ca",
+        column: value,
+    }
+    engine = create_simulation_engine(migrated_database.runtime_url)
+    try:
+        with (
+            pytest.raises(IntegrityError, match=constraint),
+            engine.begin() as connection,
+        ):
+            connection.execute(insert(simulations).values(**values))
+    finally:
+        engine.dispose()