fix(postgres): only honour a search_path that was deliberately set

Honouring current_schema() unconditionally changed behaviour for every Postgres
connection in order to fix the subset that keeps tables outside `public`. That is
the wrong trade, because the risk is not hypothetical: Postgres ships
`search_path = "$user", public` everywhere, RDS and Aurora included, and the
leading "$user" is inert only while no schema matches the connecting role's name.

  SHOW search_path;         ->  "$user", public
  SELECT current_schema();  ->  public
  CREATE SCHEMA postgres;   -- named after the connecting role
  SELECT current_schema();  ->  postgres

Per-tenant layouts, and the per-user pattern the Postgres docs recommend and
which spread after PG15 hardened `public`, make that live. An untouched
connection would then read an empty user schema and report a healthy, empty
brain — the failure this feature exists to fix, inverted. The warning added
earlier makes that visible after the fact; it does not prevent it.

resolveSchema() now reads search_path and current_user alongside
current_schema(), and ignores a schema that was selected by the implicit "$user"
entry: current_schema() equal to current_user while search_path is still exactly
what Postgres ships. Such a connection introspects `public`, bit for bit as
before.

The blast radius is now the connections that asked for this. Nothing changes
unless an operator sets a search_path — `ALTER ROLE … SET search_path`, or the
JDBC currentSchema parameter — which is how the reported warehouse enabled it,
so that case is unaffected.

The check is deliberately narrow: it matches the shipped default exactly. A path
of `"$user", marts` states an intent and is honoured, verified by test.

No new configuration: DatabaseConnection carries no schema field, so a config
route would mean entity, DTO, API and UI. The database-side search_path is
already the opt-in.

Tests: 16/16, covering the implicit "$user" match, a configured path, "$user"
inside a non-default path, and a NULL current_schema().

Author: geekypunk

backend/src/main/java/com/dbaagent/provider/postgres/PostgresIntrospectionProvider.java

@@ -821,18 +821,52 @@ private Long getExactTableRowCount(Connection connection, String schemaName, Str
 
     /**
      * The schema this session's catalog queries resolve against — the first
-     * existing entry in the search_path. Falls back to {@code public} so a
-     * connection whose search_path names only missing schemas behaves exactly
-     * as it did before, rather than tagging every object with a null schema.
+     * existing entry in the search_path — but only when that search_path was
+     * deliberately set. Falls back to {@code public} otherwise.
+     *
+     * <p>Two distinct fallbacks, for two distinct reasons:
+     *
+     * <ol>
+     *   <li>{@code current_schema()} is null when the search_path names only
+     *       schemas that do not exist. Tagging every object with a null schema
+     *       would be worse than the previous behaviour.
+     *   <li><b>The search_path is still the untouched Postgres default.</b> Every
+     *       Postgres ships {@code "$user", public} — RDS and Aurora included — and
+     *       that leading {@code "$user"} is inert only while no schema matches the
+     *       connecting role's name. Create one (per-tenant layouts, or the per-user
+     *       pattern the Postgres docs recommend and which spread after PG15
+     *       hardened {@code public}) and {@code current_schema()} silently becomes
+     *       that schema. A connection that had been reading {@code public} would
+     *       start reading an empty user schema and report a healthy, empty brain —
+     *       the very failure honouring search_path exists to fix, inverted.
+     * </ol>
+     *
+     * <p>The second case is detected rather than merely logged: an operator who has
+     * not touched search_path gets the historical {@code public} behaviour bit for
+     * bit, and only an explicit setting — {@code ALTER ROLE … SET search_path},
+     * or the JDBC {@code currentSchema} parameter — moves this provider off it.
+     * That keeps the blast radius of this feature to connections that asked for it.
+     *
+     * <p>Deliberately narrow: the check is for the default search_path *exactly*.
+     * Someone who writes {@code "$user", marts} has stated an intent, and it is
+     * honoured.
      */
     private String resolveSchema(Connection connection) {
         try (Statement stmt = connection.createStatement();
-             ResultSet rs = stmt.executeQuery("SELECT current_schema()")) {
+             ResultSet rs = stmt.executeQuery(
+                 "SELECT current_schema(), current_setting('search_path'), current_user")) {
             if (rs.next()) {
                 String schema = rs.getString(1);
-                if (schema != null && !schema.isBlank()) {
-                    return schema;
+                if (schema == null || schema.isBlank()) {
+                    return DEFAULT_SCHEMA;
+                }
+                if (schema.equals(rs.getString(3)) && isUntouchedDefaultSearchPath(rs.getString(2))) {
+                    log.debug("search_path is the Postgres default and '{}' matches the connecting "
+                            + "role, so it was selected by the implicit \"$user\" entry rather than "
+                            + "configured — introspecting '{}' as before", schema, DEFAULT_SCHEMA);
+                    return DEFAULT_SCHEMA;
                 }
+                return schema;
             }
         } catch (SQLException e) {
             log.debug("Could not resolve current_schema(), falling back to {}: {}",
@@ -841,6 +875,16 @@ private String resolveSchema(Connection connection) {
         return DEFAULT_SCHEMA;
     }
 
+    /**
+     * True when search_path is exactly what Postgres ships, ignoring spacing.
+     * Anything else — including a reordered or extended path that still mentions
+     * {@code "$user"} — counts as configured and is honoured.
+     */
+    private boolean isUntouchedDefaultSearchPath(String searchPath) {
+        return searchPath != null
+            && "\"$user\",public".equals(searchPath.replace(" ", ""));
+    }
+
     /**
      * Say which schema this pass is reading, so a switch is never silent.
      *

backend/src/test/java/com/dbaagent/provider/postgres/PostgresIntrospectionProviderTest.java

@@ -59,7 +59,12 @@ void setUp() throws SQLException {
         lenient().when(connection.createStatement()).thenReturn(schemaStatement, statement);
         lenient().when(schemaStatement.executeQuery(anyString())).thenReturn(schemaResultSet);
         lenient().when(schemaResultSet.next()).thenReturn(true);
+        // resolveSchema() reads current_schema(), search_path, current_user.
+        // A schema that differs from the role is an ordinary resolution, so these
+        // fixtures land on "public" exactly as they did before search_path support.
         lenient().when(schemaResultSet.getString(1)).thenReturn("public");
+        lenient().when(schemaResultSet.getString(2)).thenReturn("\"$user\", public");
+        lenient().when(schemaResultSet.getString(3)).thenReturn("app_user");
     }
 
     @Test
@@ -198,6 +203,66 @@ void getTableStats_returnsStats() throws SQLException {
         assertEquals(122880L, stats.getSizeBytes());
     }
 
+    /** Runs getTableColumns and returns the schema it bound (parameter 4). */
+    private String schemaUsedByGetTableColumns() throws SQLException {
+        when(connection.prepareStatement(anyString())).thenReturn(preparedStatement);
+        when(preparedStatement.executeQuery()).thenReturn(resultSet);
+        when(resultSet.next()).thenReturn(false);
+
+        provider.getTableColumns(connection, "db", "orders");
+
+        ArgumentCaptor<String> bound = ArgumentCaptor.forClass(String.class);
+        verify(preparedStatement, atLeastOnce()).setString(eq(4), bound.capture());
+        return bound.getValue();
+    }
+
+    @Test
+    void schemaChosenByTheImplicitDollarUserEntryIsIgnored() throws SQLException {
+        // Every Postgres ships search_path = "$user", public. That leading "$user"
+        // is inert only while no schema matches the connecting role — create one and
+        // current_schema() silently becomes it. Honouring that would move an
+        // untouched RDS/Aurora connection off `public` onto an empty user schema and
+        // report a healthy, empty brain. An operator who never configured a
+        // search_path must keep the historical behaviour exactly.
+        when(schemaResultSet.getString(1)).thenReturn("app_user");        // current_schema()
+        when(schemaResultSet.getString(2)).thenReturn("\"$user\", public"); // untouched default
+        when(schemaResultSet.getString(3)).thenReturn("app_user");        // current_user
+
+        assertEquals("public", schemaUsedByGetTableColumns(),
+            "an implicit \"$user\" match must not move introspection off public");
+    }
+
+    @Test
+    void deliberatelyConfiguredSearchPathIsHonoured() throws SQLException {
+        // ALTER ROLE <user> IN DATABASE <db> SET search_path = marts, public;
+        when(schemaResultSet.getString(1)).thenReturn("marts");
+        when(schemaResultSet.getString(3)).thenReturn("app_user");
+        // lenient: the guard short-circuits on schema != current_user, so the
+        // search_path is never read here. Stated anyway to describe the scenario.
+        lenient().when(schemaResultSet.getString(2)).thenReturn("marts, public");
+
+        assertEquals("marts", schemaUsedByGetTableColumns());
+    }
+
+    @Test
+    void userSchemaIsHonouredWhenTheSearchPathWasSetDeliberately() throws SQLException {
+        // "$user" present but the path is NOT the shipped default — that is a stated
+        // intent, so it is honoured rather than second-guessed.
+        when(schemaResultSet.getString(1)).thenReturn("app_user");
+        when(schemaResultSet.getString(2)).thenReturn("\"$user\", marts");
+        when(schemaResultSet.getString(3)).thenReturn("app_user");
+
+        assertEquals("app_user", schemaUsedByGetTableColumns());
+    }
+
+    @Test
+    void nullCurrentSchemaFallsBackToPublic() throws SQLException {
+        // search_path naming only missing schemas makes current_schema() NULL.
+        when(schemaResultSet.getString(1)).thenReturn(null);
+
+        assertEquals("public", schemaUsedByGetTableColumns());
+    }
+
     @Test
     void getTableColumns_qualifiesThePrimaryKeySubqueryBySchema() throws SQLException {
         // Postgres auto-names primary keys "<table>_pkey", so joining