GRANT / REVOKE / DENY and various other permissions features are now generally enforced.

Author: RyanLamansky

CLAUDE.md

@@ -135,7 +135,7 @@ Field rosters live in the source XML docs; this captures only identity + load-be
   Holds the object dicts (`HeapTables` / `Functions` / `Views` / `Procedures` / `Sequences` / `Triggers` — DML triggers share the object namespace) + the type namespace (`TableTypes` / `AliasTypes` / `XmlSchemaCollections`).
   Schema-qualified refs route through `Database.Schemas[<schema>]`; unqualified falls back to `DefaultSchemaName` (`"dbo"`).
 - **`SimulatedDbConnection`** = session.
-  Holds `@@`-state (`LastIdentity` = `SCOPE_IDENTITY`/`@@IDENTITY`, `LastStatementRowCount` = `@@ROWCOUNT`, `LastErrorNumber` = `@@ERROR`), `CurrentDatabase` / `CurrentTransaction`, per-session `TempTables` (`#foo`, cleared on Dispose), `NestingLevel` (cap 32), `Spid` (≥51), `SessionIsolationLevel`, `LockTimeoutMillis`, `CurrentExecutingThreadId` (same-thread-deadlock detection).
+  Holds `@@`-state (`LastIdentity` = `SCOPE_IDENTITY`/`@@IDENTITY`, `LastStatementRowCount` = `@@ROWCOUNT`, `LastErrorNumber` = `@@ERROR`), `CurrentDatabase` / `CurrentTransaction`, per-session `TempTables` (`#foo`, cleared on Dispose), `NestingLevel` (cap 32), `Spid` (≥51), `SessionIsolationLevel`, `LockTimeoutMillis`, `CurrentExecutingThreadId` (same-thread-deadlock detection), and `Security` (`SessionSecurityContext`: original login + base database principal + impersonation stack; default = dbo everywhere; read by the identity scalars, mutated by `EXECUTE AS`/`REVERT` and module `WITH EXECUTE AS`, stamped by connection-string / TDS auth; `EffectiveIsDbo` is the restricted-principal `USE` gate and the permission-enforcement bypass — see [`permissions.md`](docs/claude/permissions.md)).
   Full roster in the source XML docs.
 - **`BatchContext`** (internal, `Parser/`) = one command execution.
   Owns the `ParserContext` (parse-time scratch) + batch-lifetime runtime state: `Variables`, `TableVariables` (`@t`), `CurrentUndoLog`, `CurrentTableVarUndoLog` (statement-only, disjoint from the tx-scoped log so `ROLLBACK TRAN` skips `@t`), `UdfFrame` / `ProcFrame` (non-null in a UDF/proc body — gates value-form `RETURN`).
@@ -261,7 +261,7 @@ Each entry below is a trigger: read the linked file on demand when working in th
 - **Locking, MVCC, SNAPSHOT/RCSI, deadlock/timeout, lock-related DMVs** → [`locking.md`](docs/claude/locking.md).
 - **Application locks** (`sp_getapplock` / `sp_releaseapplock` / `APPLOCK_MODE` / `APPLOCK_TEST`, return-code-vs-raised-error asymmetry, EF 9/10 `Database.Migrate()`'s `__EFMigrationsLock`) → [`app-locks.md`](docs/claude/app-locks.md).
 - **`hierarchyid` type** (OrdPath storage, byte-identical CAST/wire/DATALENGTH, tier table + opaque passthrough) → [`hierarchyid.md`](docs/claude/hierarchyid.md).
-- **`GRANT` / `REVOKE` / `DENY`, principal DDL (incl. server logins: `CREATE/ALTER/DROP LOGIN`), fixed-principal seed, principal scalars** (`USER_NAME` / `SUSER_SNAME` / `DATABASE_PRINCIPAL_ID` / `CURRENT_USER` / `SESSION_USER` / `ORIGINAL_LOGIN` / `HAS_PERMS_BY_NAME` / `IS_MEMBER`) → [`permissions.md`](docs/claude/permissions.md).
+- **`GRANT` / `REVOKE` / `DENY` (real securable resolution + covering/scope-walk enforcement of SELECT/INSERT/UPDATE/DELETE/EXECUTE/TRUNCATE=ALTER/CREATE TABLE, role closure, fixed roles, DENY-beats-GRANT, ownership chaining, WGO/CASCADE writer rules), principal DDL (incl. server logins: `CREATE/ALTER/DROP LOGIN`), fixed-principal + nine-fixed-role seed, principal scalars** (`USER_NAME` / `SUSER_SNAME` / `DATABASE_PRINCIPAL_ID` / `CURRENT_USER` / `SESSION_USER` / `ORIGINAL_LOGIN` / `HAS_PERMS_BY_NAME` / `IS_MEMBER`); dbo bypasses every check → [`permissions.md`](docs/claude/permissions.md).
 - **`CREATE FULLTEXT CATALOG`/`INDEX`, `CONTAINS`/`FREETEXT` rejection, FULLTEXTCATALOGPROPERTY / FULLTEXTSERVICEPROPERTY** → [`full-text.md`](docs/claude/full-text.md).
 - **`xml` type, XML schema collections, XML methods (`.value()` / `.nodes()` / `.query()` / `.exist()` via an XQuery-subset evaluator; `.modify()` XML-DML skip-with-diagnostic), XML indexes** → [`xml.md`](docs/claude/xml.md).
 - **`geography` / `geometry` types, spatial methods, spatial indexes** → [`spatial.md`](docs/claude/spatial.md).

docs/claude/permissions.md

@@ -13,6 +13,7 @@ void Sys(string name, HeapColumn[] columns, Func<Parser.BatchContext, Database,
         // Pushdown-aware sys.<view> (see BuiltInResources.CoreObjects.cs::SysP).
         void SysP(string name, HeapColumn[] columns, string[] pushdownColumns, Func<Parser.BatchContext, Database, CatalogFilter, IEnumerable<SqlValue[]>> filtered) =>
             views["sys." + name] = new CatalogView(name, columns, (batch, database) => filtered(batch, database, CatalogFilter.None), filteredRowGenerator: filtered, pushdownColumns: pushdownColumns);
+        var charFour = CharSqlType.Get(4, Collation.Catalog, Coercibility.Implicit);
         // sys.dm_tran_locks: per-Hold rows across every schema-bound
         // SchemaLock, every HeapTable.TableDataLock, and every per-row
         // entry in HeapTable.RowLocks. GRANT entries come from
@@ -144,7 +145,7 @@ void SysP(string name, HeapColumn[] columns, string[] pushdownColumns, Func<Pars
             new("minor_id", SqlType.Int32, null, false),
             new("grantee_principal_id", SqlType.Int32, null, false),
             new("grantor_principal_id", SqlType.Int32, null, false),
-            new("type", charTwo, 2, false),
+            new("type", charFour, 4, false),
             new("permission_name", nvarchar128Catalog, 128, true),
             new("state", charOne, 1, false),
             new("state_desc", nvarchar60Catalog, 60, true),
@@ -221,7 +222,7 @@ void SysP(string name, HeapColumn[] columns, string[] pushdownColumns, Func<Pars
             new("minor_id", SqlType.Int32, null, false),
             new("grantee_principal_id", SqlType.Int32, null, false),
             new("grantor_principal_id", SqlType.Int32, null, false),
-            new("type", charTwo, 2, false),
+            new("type", charFour, 4, false),
             new("permission_name", nvarchar128Catalog, 128, true),
             new("state", charOne, 1, false),
             new("state_desc", nvarchar60Catalog, 60, true),
@@ -317,7 +318,6 @@ void SysP(string name, HeapColumn[] columns, string[] pushdownColumns, Func<Pars
         // carries. server_audits /
         // server_file_audits / cryptographic_providers are server-scoped (the
         // row generator ignores the database). See docs/claude/catalog-views.md.
-        var charFour = CharSqlType.Get(4, Collation.Catalog, Coercibility.Implicit);
         Sys("symmetric_keys",
         [
             new("name", SqlType.SystemName, 128, false),
@@ -558,8 +558,8 @@ private static IEnumerable<SqlValue[]> EnumerateSysDatabasePrincipals(Parser.Bat
 
     private static IEnumerable<SqlValue[]> EnumerateSysDatabasePermissions(Parser.BatchContext batch, Database database)
     {
-        var charTwo = SqlType.GetChar(2);
-        var charOne = SqlType.GetChar(1);
+        var typeChar = SqlType.GetChar(4);
+        var stateChar = SqlType.GetChar(1);
         foreach (var perm in database.Permissions)
         {
             var classDesc = perm.Class switch
@@ -585,9 +585,9 @@ private static IEnumerable<SqlValue[]> EnumerateSysDatabasePermissions(Parser.Ba
                 SqlValue.FromInt32(perm.MinorId),
                 SqlValue.FromInt32(perm.GranteePrincipalId),
                 SqlValue.FromInt32(perm.GrantorPrincipalId),
-                SqlValue.FromChar(charTwo, perm.TypeCode),
+                SqlValue.FromChar(typeChar, perm.TypeCode),
                 SqlValue.FromNVarchar(perm.PermissionName),
-                SqlValue.FromChar(charOne, perm.State),
+                SqlValue.FromChar(stateChar, perm.State),
                 SqlValue.FromNVarchar(stateDesc),
             ];
         }

src/SqlServerSimulator/BuiltInResources.Security.cs

@@ -18,6 +18,19 @@ internal sealed class Database
     /// <summary>The schema name an unqualified table reference resolves through.</summary>
     public const string DefaultSchemaName = "dbo";
 
+    /// <summary>
+    /// Principal id of the database-owning <c>dbo</c> user (1, matching real
+    /// SQL Server). The identity the permission layer treats as the
+    /// bypass-everything owner: a session whose effective principal is this id
+    /// short-circuits every check. Seeded in the constructor's fixed-principal
+    /// block and read by <see cref="SessionSecurityContext"/> and the
+    /// principal scalars in place of a scattered literal <c>1</c>.
+    /// </summary>
+    public const int DboPrincipalId = 1;
+
+    /// <summary>Principal id of the <c>guest</c> user (2) — the fallback identity for a mapped login connecting to <c>master</c>.</summary>
+    public const int GuestPrincipalId = 2;
+
     /// <summary>Database name (the key in <see cref="Simulation.Databases"/>).</summary>
     public readonly string Name;
 
@@ -69,8 +82,35 @@ public Database(string name, Collation collation)
         this.Principals["guest"] = new DatabasePrincipal(2, "guest", "S", "SQL_USER", isFixedRole: false, seedDate);
         this.Principals["INFORMATION_SCHEMA"] = new DatabasePrincipal(3, "INFORMATION_SCHEMA", "S", "SQL_USER", isFixedRole: false, seedDate);
         this.Principals["sys"] = new DatabasePrincipal(4, "sys", "S", "SQL_USER", isFixedRole: false, seedDate);
+        // The nine fixed database roles, with real SQL Server's principal ids
+        // (probe-confirmed 2026-07-21). 16388 is deliberately absent — real
+        // skips it. All type R, is_fixed_role, owned by dbo. Membership is
+        // tracked in RoleMembers like any role; the permission checker reads
+        // the closure and gives db_owner / db_datareader / db_datawriter /
+        // db_ddladmin / db_denydatareader / db_denydatawriter their virtual
+        // capabilities.
+        foreach (var (id, roleName) in FixedDatabaseRoles)
+            this.Principals[roleName] = new DatabasePrincipal(id, roleName, "R", "DATABASE_ROLE", isFixedRole: true, seedDate);
     }
 
+    /// <summary>
+    /// The nine fixed database roles and their real-SQL-Server principal ids.
+    /// Seeded into <see cref="Principals"/> at construction; consulted by the
+    /// permission checker's fixed-role capability rules.
+    /// </summary>
+    public static readonly (int Id, string Name)[] FixedDatabaseRoles =
+    [
+        (16384, "db_owner"),
+        (16385, "db_accessadmin"),
+        (16386, "db_securityadmin"),
+        (16387, "db_ddladmin"),
+        (16389, "db_backupoperator"),
+        (16390, "db_datareader"),
+        (16391, "db_datawriter"),
+        (16392, "db_denydatareader"),
+        (16393, "db_denydatawriter"),
+    ];
+
     /// <summary>
     /// Convenience accessor for the <c>dbo</c> schema's tables — the
     /// unqualified-reference fallback path. Equivalent to

src/SqlServerSimulator/Database.cs

@@ -23,11 +23,42 @@ internal sealed class DatabasePrincipal(
     string typeCode,
     string typeDescription,
     bool isFixedRole,
-    DateTime createDate)
+    DateTime createDate,
+    string? loginName = null,
+    string? securityIdentifierString = null)
 {
     public readonly int PrincipalId = principalId;
     public readonly string Name = name;
 
+    /// <summary>
+    /// The server login this database user is mapped to
+    /// (<c>CREATE USER name FOR LOGIN login</c>), or <c>null</c> when the user
+    /// carries no login link (WITHOUT LOGIN users, the fixed principals, and
+    /// the parse-and-discard <c>CREATE USER</c> forms). Drives login →
+    /// database-user resolution at connect time and the
+    /// <c>SYSTEM_USER</c> / <c>SUSER_SNAME()</c> value while impersonating this
+    /// user.
+    /// </summary>
+    public readonly string? LoginName = loginName;
+
+    /// <summary>
+    /// The synthetic <c>S-1-9-3-…</c> security-identifier string a
+    /// <c>CREATE USER name WITHOUT LOGIN</c> user reports through
+    /// <c>SYSTEM_USER</c> / <c>SUSER_SNAME()</c> and the Msg 916 "server
+    /// principal" wording (real SQL Server has no login name for these users,
+    /// only a SID). Deterministically derived from the user name;
+    /// <c>null</c> for every other principal.
+    /// </summary>
+    public readonly string? SecurityIdentifierString = securityIdentifierString;
+
+    /// <summary>
+    /// The identity string a session impersonating this database user reports
+    /// through <c>SYSTEM_USER</c> / <c>SUSER_SNAME()</c>: the mapped login when
+    /// one exists, the synthetic SID for WITHOUT LOGIN users, else the user
+    /// name itself.
+    /// </summary>
+    public string EffectiveLoginIdentity => this.LoginName ?? this.SecurityIdentifierString ?? this.Name;
+
     /// <summary>
     /// One- or two-character <c>sys.database_principals.type</c> code.
     /// <c>S</c> = SQL_USER, <c>U</c> = WINDOWS_USER, <c>G</c> = WINDOWS_GROUP,

src/SqlServerSimulator/DatabasePrincipal.cs

@@ -0,0 +1,56 @@
+namespace SqlServerSimulator;
+
+/// <summary>
+/// Permission-enforcement error factories (Msg 229 / 262 / 1088 / 4606 /
+/// 4611). The 15151 object-variant and the impersonation errors (15517 /
+/// 15406) live in <c>SimulatedSqlException.SchemaErrors.cs</c> alongside the
+/// principal-resolution factories.
+/// </summary>
+public sealed partial class SimulatedSqlException
+{
+    /// <summary>
+    /// Mimics SQL Server error 229: a DML / EXECUTE permission was denied on an
+    /// object. Severity 14, state 5, probe-confirmed wording. For an EXEC-proc
+    /// denial <paramref name="procedure"/> carries the schema-qualified proc
+    /// name (surfaces through <c>ERROR_PROCEDURE()</c>), matching real; empty
+    /// for table / view / TVF denials.
+    /// </summary>
+    internal static SimulatedSqlException PermissionDenied(string permission, string objectName, string databaseName, string schemaName, string procedure = "") =>
+        new($"The {permission} permission was denied on the object '{objectName}', database '{databaseName}', schema '{schemaName}'.",
+            new SimulatedError(@class: 14, lineNumber: 0,
+                message: $"The {permission} permission was denied on the object '{objectName}', database '{databaseName}', schema '{schemaName}'.",
+                number: 229, procedure: procedure, server: SimulatedDbConnection.DataSourceName, source: SourceName, state: 5));
+
+    /// <summary>
+    /// Mimics SQL Server error 262: <c>CREATE TABLE</c> attempted by a principal
+    /// lacking <c>db_ddladmin</c> / <c>db_owner</c> membership (or an explicit
+    /// CREATE TABLE grant). Severity 14, state 1, probe-confirmed wording.
+    /// </summary>
+    internal static SimulatedSqlException CreateTablePermissionDenied(string databaseName) =>
+        new($"CREATE TABLE permission denied in database '{databaseName}'.", 262, 14, 1);
+
+    /// <summary>
+    /// Mimics SQL Server error 1088: a TRUNCATE (which requires ALTER on the
+    /// object) was denied. Distinct shape from Msg 229 — double-quoted name,
+    /// severity 16, state 7, probe-confirmed wording.
+    /// </summary>
+    internal static SimulatedSqlException CannotFindObjectForAlter(string objectLeafName) =>
+        new($"Cannot find the object \"{objectLeafName}\" because it does not exist or you do not have permissions.", 1088, 16, 7);
+
+    /// <summary>
+    /// Mimics SQL Server error 4606: a permission is incompatible with the
+    /// securable's object kind (SELECT on a procedure, EXECUTE on a table /
+    /// view / TVF). Severity 16, probe-confirmed wording.
+    /// </summary>
+    internal static SimulatedSqlException PermissionIncompatibleWithObject(string permission) =>
+        new($"Granted or revoked privilege {permission} is not compatible with object.", 4606, 16, 1);
+
+    /// <summary>
+    /// Mimics SQL Server error 4611: a plain <c>REVOKE</c> (or REVOKE GRANT
+    /// OPTION FOR) of a grantable (<c>WITH GRANT OPTION</c>) permission that has
+    /// live delegations, without the CASCADE option. Severity 16, catchable,
+    /// probe-confirmed wording.
+    /// </summary>
+    internal static SimulatedSqlException RevokeRequiresCascade() =>
+        new("To revoke or deny grantable privileges, specify the CASCADE option.", 4611, 16, 1);
+}

src/SqlServerSimulator/Errors/SimulatedSqlException.PermissionErrors.cs

@@ -1150,6 +1150,55 @@ internal static SimulatedSqlException ServerPrincipalAlreadyExists(string name)
     internal static SimulatedSqlException CannotAlterOrDropLogin(string verb, string name) =>
         new($"Cannot {verb} the login '{name}', because it does not exist or you do not have permission.", 15151, 16, 1);
 
+    /// <summary>
+    /// Mimics SQL Server error 15517: <c>EXECUTE AS USER = 'x'</c> when the
+    /// target database principal doesn't exist, can't be impersonated, or the
+    /// caller lacks IMPERSONATE. The name is double-quoted. Probe-confirmed
+    /// (2026-07-21) — including the quirk that <c>EXECUTE AS USER = 'dbo'</c>
+    /// raises this even for a sysadmin session.
+    /// </summary>
+    internal static SimulatedSqlException CannotExecuteAsDatabasePrincipal(string name) =>
+        new($"Cannot execute as the database principal because the principal \"{name}\" does not exist, this type of principal cannot be impersonated, or you do not have permission.", 15517, 16, 1);
+
+    /// <summary>
+    /// Mimics SQL Server error 15406: <c>EXECUTE AS LOGIN = 'l'</c> when the
+    /// target server principal doesn't exist, can't be impersonated, or the
+    /// caller lacks IMPERSONATE. The name is double-quoted. Probe-confirmed
+    /// (2026-07-21).
+    /// </summary>
+    internal static SimulatedSqlException CannotExecuteAsServerPrincipal(string name) =>
+        new($"Cannot execute as the server principal because the principal \"{name}\" does not exist, this type of principal cannot be impersonated, or you do not have permission.", 15406, 16, 1);
+
+    /// <summary>
+    /// Mimics SQL Server error 916: a session running under a restricted
+    /// security context (an impersonated database user, or an authenticated
+    /// login mapped to a non-<c>dbo</c> user) tried to switch databases via
+    /// <c>USE</c> / <c>ChangeDatabase</c>. The principal name is a login name,
+    /// or the WITHOUT-LOGIN user's <c>S-1-9-3-…</c> SID string. Session stays in
+    /// the current database. Probe-confirmed (2026-07-21): severity 14, state 2.
+    /// </summary>
+    internal static SimulatedSqlException CannotAccessDatabaseUnderSecurityContext(string principalName, string databaseName) =>
+        new($"The server principal \"{principalName}\" is not able to access the database \"{databaseName}\" under the current security context.", 916, 14, 2);
+
+    /// <summary>
+    /// Mimics SQL Server error 18456: an in-process connection-string login
+    /// (<c>User ID=</c>) failed to authenticate against the <c>CREATE LOGIN</c>
+    /// registry. Same severity-14 / state-1 shape the TDS endpoint writes
+    /// (which emits the token directly rather than through this factory).
+    /// </summary>
+    internal static SimulatedSqlException LoginFailed(string userName) =>
+        new($"Login failed for user '{userName}'.", 18456, 14, 1);
+
+    /// <summary>
+    /// Mimics SQL Server error 4060: a login couldn't open the requested
+    /// database (missing, or not accessible to the mapped principal). The
+    /// database name is double-quoted, severity 11. On the wire this is
+    /// followed by a Msg 18456; the in-process front door surfaces the 4060
+    /// alone (single-error divergence documented in <c>permissions.md</c>).
+    /// </summary>
+    internal static SimulatedSqlException CannotOpenDatabaseRequestedByLogin(string databaseName) =>
+        new($"Cannot open database \"{databaseName}\" requested by the login. The login failed.", 4060, 11, 1);
+
     /// <summary>
     /// Mimics SQL Server error 2749: an <c>ALTER COLUMN</c> on an IDENTITY
     /// column tried to change the underlying type to something outside the