Switched permissions internals to enum-based from string-based.

Author: RyanLamansky

docs/claude/permissions.md

@@ -19,7 +19,10 @@ Logins are enforced as connection credentials at both front doors (TDS endpoint
 - `SecurityIdentifierString` (string?) — the deterministic `S-1-9-3-…` SID a `CREATE USER … WITHOUT LOGIN` user reports through `SYSTEM_USER` / Msg 916 (FNV-derived from the name).
 - `EffectiveLoginIdentity` — the `SYSTEM_USER` value while impersonating this user (login ?? SID ?? name).
 
-**`DatabasePermission`** (`src/SqlServerSimulator/DatabasePermission.cs`) carries class + major_id + minor_id + grantee/grantor ids + permission_name + 4-char type code + state (`G`/`W`/`D`/`R`).
+**`DatabasePermission`** (`src/SqlServerSimulator/DatabasePermission.cs`) carries class + major_id + minor_id + grantee/grantor ids + a `Permission` enum + a `PermissionState` enum (Grant / GrantWithGrantOption / Deny / Revoke, projecting the `G`/`W`/`D`/`R` state codes).
+Canonical rows draw their `permission_name` and 4-char `type` code from `PermissionCatalog` at projection; off-catalog names (`Permission.Other`) carry their raw text on `PermissionName` and are never matched by a permission check.
+`PermissionChecker` compares the enum throughout (closure walk, DENY precedence, covering/scope walk, read/write/DDL fixed-role virtual grants) — no permission-name string comparison remains on any check path; `HAS_PERMS_BY_NAME` / GRANT parsing resolve the incoming name to the enum once at the boundary via `Permission.Resolve` (a zero-alloc span switch, a `PermissionCatalog` static extension member).
+The catalog surfaces per-enum lookups as extension members (`permission.CanonicalName` / `.CanonicalTypeCode` / `.Category` / `.Covering(class)`, `state.Code` / `.Description`); row-shaped concerns live on `DatabasePermission` itself (`IsFor` securable+permission identity, `DisplayName` / `DisplayTypeCode` projection).
 
 Both live on `Database`:
 - `Database.Principals` — `ConcurrentDictionary<string, DatabasePrincipal>` keyed by name
@@ -145,9 +148,10 @@ In-process connections never authenticate — login DDL through one is how the r
 
 ## Permission type-code derivation
 
-`Simulation.CanonicalPermissionTypeCode` imports the canonical 4-char `sys.database_permissions.type` codes from `sys.fn_builtin_permissions` for the common OBJECT / SCHEMA / DATABASE / DATABASE_PRINCIPAL permissions (`SELECT` → `SL`, `UPDATE` → `UP`, `EXECUTE` → `EX`, `CONTROL` → `CL`, `IMPERSONATE` → `IM`, `CREATE TABLE` → `CRTB`, …).
-Codes are stored space-padded to 4 chars and the view's `type` column is `char(4)`, matching real's trailing-space-bearing values (`'SL  '`).
-Names outside the imported set (AW's `VIEW ANY COLUMN … DEFINITION` grants) fall back to the first-letter-of-each-word heuristic (`VIEW ANY COLUMN MASTER KEY DEFINITION` → `VACM`), which won't byte-match real for every long name.
+`PermissionCatalog` (`src/SqlServerSimulator/Permission.cs`) is the single source of truth: one static table indexed by the `Permission` enum carries each member's canonical name, 4-char `sys.database_permissions.type` code (imported from `sys.fn_builtin_permissions` for the common OBJECT / SCHEMA / DATABASE / DATABASE_PRINCIPAL permissions — `SELECT` → `SL`, `UPDATE` → `UP`, `EXECUTE` → `EX`, `CONTROL` → `CL`, `IMPERSONATE` → `IM`, `CREATE TABLE` → `CRTB`, …), and read/write/DDL category; the covering graph and name→enum resolver live alongside it.
+Codes are projected space-padded to 4 chars and the view's `type` column is `char(4)`, matching real's trailing-space-bearing values (`'SL  '`).
+Names outside the catalog resolve to `Permission.Other` and project their raw stored text plus a first-letter-of-each-word type-code heuristic (`VIEW ANY COLUMN MASTER KEY DEFINITION` → `VACM`), which won't byte-match real for every long name.
+Canonical names project their catalog spelling regardless of the GRANT's casing (real normalizes them the same way).
 
 `class_desc` / `state_desc` are spelled out per the probe-confirmed enum:
 - `class_desc`: `DATABASE` / `OBJECT_OR_COLUMN` / `SCHEMA` / `DATABASE_PRINCIPAL`

src/SqlServerSimulator/BuiltInResources.Security.cs

@@ -570,25 +570,17 @@ private static IEnumerable<SqlValue[]> EnumerateSysDatabasePermissions(Parser.Ba
                 4 => "DATABASE_PRINCIPAL",
                 _ => "DATABASE",
             };
-            var stateDesc = perm.State switch
-            {
-                "D" => "DENY",
-                "G" => "GRANT",
-                "R" => "REVOKE",
-                "W" => "GRANT_WITH_GRANT_OPTION",
-                _ => "GRANT",
-            };
             yield return [
                 SqlValue.FromByte(perm.Class),
                 SqlValue.FromNVarchar(classDesc),
                 SqlValue.FromInt32(perm.MajorId),
                 SqlValue.FromInt32(perm.MinorId),
                 SqlValue.FromInt32(perm.GranteePrincipalId),
                 SqlValue.FromInt32(perm.GrantorPrincipalId),
-                SqlValue.FromChar(typeChar, perm.TypeCode),
-                SqlValue.FromNVarchar(perm.PermissionName),
-                SqlValue.FromChar(stateChar, perm.State),
-                SqlValue.FromNVarchar(stateDesc),
+                SqlValue.FromChar(typeChar, perm.DisplayTypeCode),
+                SqlValue.FromNVarchar(perm.DisplayName),
+                SqlValue.FromChar(stateChar, perm.State.Code),
+                SqlValue.FromNVarchar(perm.State.Description),
             ];
         }
     }

src/SqlServerSimulator/DatabasePermission.cs

@@ -1,35 +1,32 @@
 namespace SqlServerSimulator;
 
 /// <summary>
-/// One entry in <see cref="Database.Permissions"/> — a GRANT / REVOKE /
-/// DENY statement that's been parsed and stored but never enforced. The
-/// simulator has no permission model; this exists to round-trip the
-/// information into <c>sys.database_permissions</c>.
+/// One entry in <see cref="Database.Permissions"/> — a stored GRANT / DENY
+/// (WITH GRANT OPTION) row. Canonical permissions store their identity as a
+/// <see cref="SqlServerSimulator.Permission"/> enum and draw their name / type
+/// code from <see cref="PermissionCatalog"/> at projection time; off-catalog
+/// names store <see cref="SqlServerSimulator.Permission.Other"/> plus their raw
+/// text on <see cref="PermissionName"/>.
 /// </summary>
 /// <remarks>
-/// Real SQL Server permission rows carry a <c>class</c> tinyint
-/// distinguishing database-scope (0) from object/column (1), schema (3),
-/// principal (4), etc. AW only emits class-0 GRANT statements, so the
-/// simulator's <see cref="Class"/> + <see cref="MajorId"/> + <see cref="MinorId"/>
-/// triple mirrors the catalog-view shape: class=0, major_id=0,
-/// minor_id=0 for database-scope grants; class=1 + major_id=&lt;object_id&gt;
-/// for object-scope grants (when the parser eventually accepts <c>ON
-/// OBJECT::name</c>).
+/// The <see cref="Class"/> + <see cref="MajorId"/> + <see cref="MinorId"/> triple
+/// mirrors the catalog-view shape: class=0, major_id=0 for database-scope grants;
+/// class=1 + major_id=&lt;object_id&gt; for object-scope; class=3 + schema_id for
+/// schema-scope; class=4 + principal_id for the IMPERSONATE gate.
 /// </remarks>
 internal sealed class DatabasePermission(
     byte @class,
     int majorId,
     int minorId,
     int granteePrincipalId,
     int grantorPrincipalId,
-    string permissionName,
-    string typeCode,
-    string state)
+    Permission permission,
+    PermissionState state,
+    string? permissionName = null)
 {
     /// <summary>
     /// Permission target class: 0=database, 1=object/column, 3=schema,
-    /// 4=database principal. The simulator only populates 0 (and 1 once
-    /// object-scope grants land).
+    /// 4=database principal.
     /// </summary>
     public readonly byte Class = @class;
 
@@ -51,34 +48,70 @@ internal sealed class DatabasePermission(
 
     /// <summary>
     /// <see cref="DatabasePrincipal.PrincipalId"/> of the principal that
-    /// issued the GRANT statement. The simulator has no current-user
-    /// concept; defaults to <c>dbo</c> (id 1).
+    /// issued the GRANT statement (the granting session's effective principal;
+    /// <c>dbo</c> = id 1 for an unimpersonated session).
     /// </summary>
     public readonly int GrantorPrincipalId = grantorPrincipalId;
 
     /// <summary>
-    /// Long-form permission name as parsed from the GRANT statement
-    /// (e.g. <c>VIEW ANY COLUMN ENCRYPTION KEY DEFINITION</c>). Stored
-    /// case-preserved; matched case-insensitively at REVOKE/DENY time.
+    /// The canonical permission, or <see cref="SqlServerSimulator.Permission.Other"/>
+    /// for an off-catalog name carried on <see cref="PermissionName"/>.
     /// </summary>
-    public readonly string PermissionName = permissionName;
+    public readonly Permission Permission = permission;
 
     /// <summary>
-    /// 4-character SQL Server permission type code
-    /// (<c>VWCD</c> for VIEW ANY COLUMN MASTER KEY DEFINITION, etc.).
-    /// Derived from the first letter of each word in <see cref="PermissionName"/>,
-    /// right-padded with spaces — accurate for most spelled-out permission
-    /// names but not all (a small lookup table refinement would be needed
-    /// for exact catalog parity).
+    /// Raw permission text for an <see cref="SqlServerSimulator.Permission.Other"/>
+    /// row (e.g. <c>VIEW ANY COLUMN MASTER KEY DEFINITION</c>), stored
+    /// case-preserved and matched case-insensitively; <see langword="null"/> for a
+    /// canonical row, whose name / type code come from <see cref="PermissionCatalog"/>.
     /// </summary>
-    public readonly string TypeCode = typeCode;
+    public readonly string? PermissionName = permissionName;
 
     /// <summary>
-    /// State code: <c>G</c>=Grant, <c>R</c>=Revoke, <c>D</c>=Deny,
-    /// <c>W</c>=Grant_with_grant. Real SQL Server treats REVOKE as a
-    /// row-deletion rather than a stored state; the simulator keeps the
-    /// REVOKE row so DENY ⇄ GRANT toggling can be observed in
-    /// <c>sys.database_permissions</c> for debugging.
+    /// State: Grant / GrantWithGrantOption / Deny / Revoke. Real SQL Server treats
+    /// REVOKE as a row-deletion; the simulator likewise removes rows on REVOKE and
+    /// keeps only live Grant / GrantWithGrantOption / Deny rows.
     /// </summary>
-    public readonly string State = state;
+    public readonly PermissionState State = state;
+
+    /// <summary>The catalog-view <c>permission_name</c> — the canonical catalog spelling, or the raw stored text for an off-catalog (<see cref="SqlServerSimulator.Permission.Other"/>) name.</summary>
+    public string DisplayName => Permission == Permission.Other ? PermissionName! : Permission.CanonicalName;
+
+    /// <summary>The catalog-view <c>type</c> code — the canonical 4-char code, or the first-letter heuristic for an off-catalog name.</summary>
+    public string DisplayTypeCode => Permission == Permission.Other ? DeriveTypeCode(PermissionName!) : Permission.CanonicalTypeCode;
+
+    /// <summary>
+    /// Whether this row names <paramref name="permission"/> on the
+    /// (<paramref name="securableClass"/>, <paramref name="majorId"/>) securable.
+    /// Enum equality except for <see cref="SqlServerSimulator.Permission.Other"/>,
+    /// where collation name-equality against <paramref name="permissionName"/>
+    /// keeps two distinct off-catalog names from colliding.
+    /// </summary>
+    public bool IsFor(byte securableClass, int majorId, Permission permission, string permissionName, Database database) =>
+        Class == securableClass
+        && MajorId == majorId
+        && Permission == permission
+        && (permission != Permission.Other || database.Collation.Equals(PermissionName, permissionName));
+
+    /// <summary>
+    /// First-letter-of-each-word type-code heuristic for off-catalog permission
+    /// names (e.g. <c>VIEW ANY COLUMN MASTER KEY DEFINITION</c> → <c>VACM</c>),
+    /// right-padded with spaces to 4 chars. Accurate for most spelled-out names
+    /// but won't byte-match real for every long name.
+    /// </summary>
+    private static string DeriveTypeCode(string permissionName)
+    {
+        var words = permissionName.Split(' ', StringSplitOptions.RemoveEmptyEntries);
+        Span<char> code = stackalloc char[4];
+        var idx = 0;
+        foreach (var w in words)
+        {
+            if (idx >= 4)
+                break;
+            code[idx++] = char.ToUpperInvariant(w[0]);
+        }
+        while (idx < 4)
+            code[idx++] = ' ';
+        return new string(code);
+    }
 }

src/SqlServerSimulator/Parser/Expressions/PrincipalIdScalars.cs

@@ -264,7 +264,7 @@ public override SqlValue Run(RuntimeContext runtime)
         }
 
         return SqlValue.FromInt32(
-            PermissionChecker.IsGranted(database, principalId, permission, securableClass, majorId, schemaId) ? 1 : 0);
+            PermissionChecker.IsGranted(database, principalId, Permission.Resolve(permission), securableClass, majorId, schemaId) ? 1 : 0);
     }
 
     private static bool TryResolveSchemaByName(Database database, string name, out int schemaId)