From 82267bbc5dd58244d22dfb2c993a79a48c6b9492 Mon Sep 17 00:00:00 2001
From: huyplb <huyplb@live.com>
Date: Fri, 25 Sep 2026 23:14:11 -0600
Subject: [PATCH] refactor(access): simplify the roles and allow-all code from
 #435

No behaviour change; a /simplify pass over #435 for readability.

- Allow-all is worked out once per catalog read: findAllowAllByName indexes
  privileges by grantee and answers each role once, instead of re-reading
  the whole privilege list per account (70M comparisons for 1,000 MySQL
  accounts with *.* grants). Both lists use it.
- One name key, principalKey, shared by privilegesForPrincipal,
  reconcileDbAccess and the allow-all index; reconcile uses Sets, not list
  scans, for widely held roles.
- SQL Server's implied fixed-role rows are their own function, called
  beside reconcile, instead of hiding inside "make the catalogs agree".
- MySQL account quoting has one home: formatDbGrantee and the new
  SET DEFAULT ROLE statements use mysqlQuote / mysqlAccount / mysqlRoleRef
  from user-sql-helpers, the same helpers CREATE USER uses.
- The MySQL and ClickHouse GRANT branches shared a copied target rule; now
  one branch. allPrivilegeTargets returns its lists directly and drops the
  always-null objectSchema.
- DatabaseAccessModal: the privilege table is a file-local
  PrivilegeGroupRows; one confirmRevoke replaces three copies of the revoke
  flow; the membership role is derived instead of synced by an effect; the
  confirm field resets where the confirmation opens; granteeKindOf, which
  returned its input, is gone.
- UserManagement: any MySQL-family name parses as user@host (a MariaDB role
  has no @ and parses to itself), so the role special case goes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../access/components/UserManagement.tsx      |  35 +-
 .../components/DatabaseAccessModal.tsx        | 411 +++++++++---------
 .../src/features/access/db-access.service.ts  |   9 +-
 packages/sql/src/index.ts                     |   3 +
 .../sql/src/modules/access/db-access.test.ts  |  20 +-
 packages/sql/src/modules/access/db-access.ts  | 193 ++++----
 .../modules/access/privilege-groups.test.ts   |  23 +-
 .../src/modules/access/privilege-groups.ts    | 194 ++++++---
 .../src/modules/access/user-sql-helpers.ts    |   2 +-
 packages/sql/src/modules/access/user-sql.ts   |  36 +-
 10 files changed, 490 insertions(+), 436 deletions(-)

diff --git a/apps/web/src/frontend/features/access/components/UserManagement.tsx b/apps/web/src/frontend/features/access/components/UserManagement.tsx
index 8c8848db..1283a7e5 100644
--- a/apps/web/src/frontend/features/access/components/UserManagement.tsx
+++ b/apps/web/src/frontend/features/access/components/UserManagement.tsx
@@ -75,7 +75,7 @@ import {
 } from '../lib/accountAlterations';
 import type { AccessPrincipalDraft } from '../lib/access';
 import { writeClipboard } from '@/shared/utils/clipboard';
-import { describeAllowAll, dialectFamily, findAllowAll, type AllowAll } from '@foxschema/sql';
+import { describeAllowAll, dialectFamily, findAllowAllByName, type AllowAll } from '@foxschema/sql';
 
 type Mode = 'idle' | 'add' | 'edit' | 'drop' | 'list';
 
@@ -299,15 +299,11 @@ export const UserManagement: React.FC<{
   }, [principals, filter, kindFilter]);
 
   /** Accounts allowed everything — superuser, all of `*.*`, or the whole database. */
-  const allowAllByName = useMemo(() => {
-    const map = new Map<string, AllowAll>();
-    if (!dialect) return map;
-    for (const p of principals) {
-      const allow = findAllowAll({ principal: p.name, principals, privileges, dialect });
-      if (allow) map.set(p.name, allow);
-    }
-    return map;
-  }, [principals, privileges, dialect]);
+  const allowAllByName = useMemo(
+    () =>
+      dialect ? findAllowAllByName({ principals, privileges, dialect }) : new Map<string, AllowAll>(),
+    [principals, privileges, dialect]
+  );
 
   const nameOptions = useMemo(
     () =>
@@ -595,9 +591,9 @@ export const UserManagement: React.FC<{
     setMode('drop');
     setSelectedName(p.name);
     setPrincipalType(principalTypeOf(p));
-    // A MySQL or TiDB role is an account too, listed as name@host; a MariaDB
-    // role has no host and no @ in its name.
-    if (isMysqlFamily && (p.kind === 'user' || p.name.includes('@'))) {
+    // Users and MySQL/TiDB roles are listed as name@host; a MariaDB role has
+    // no @ and parses to its bare name.
+    if (isMysqlFamily) {
       const parsed = parseMysqlAccount(p.name);
       setName(parsed.name);
       setHost(parsed.host || '%');
@@ -611,9 +607,9 @@ export const UserManagement: React.FC<{
     setMode('edit');
     setSelectedName(p.name);
     setPrincipalType(principalTypeOf(p));
-    // A MySQL or TiDB role is an account too, listed as name@host; a MariaDB
-    // role has no host and no @ in its name.
-    if (isMysqlFamily && (p.kind === 'user' || p.name.includes('@'))) {
+    // Users and MySQL/TiDB roles are listed as name@host; a MariaDB role has
+    // no @ and parses to its bare name.
+    if (isMysqlFamily) {
       const parsed = parseMysqlAccount(p.name);
       setName(parsed.name);
       setHost(parsed.host || '%');
@@ -991,6 +987,7 @@ export const UserManagement: React.FC<{
                     )}
                     {filtered.map((p) => {
                       const active = selectedName === p.name;
+                      const allow = allowAllByName.get(p.name);
                       return (
                         <tr
                           key={`${p.kind}:${p.name}`}
@@ -1011,13 +1008,13 @@ export const UserManagement: React.FC<{
                         >
                           <td className="px-2.5 py-1.5 font-mono text-[12px]">
                             {p.name}
-                            {allowAllByName.get(p.name) && (
+                            {allow && (
                               <span
                                 data-testid={`user-allow-all-${p.name}`}
-                                title={describeAllowAll(allowAllByName.get(p.name)!)}
+                                title={describeAllowAll(allow)}
                                 className="ml-1.5 inline-block rounded border border-rose-500/40 bg-rose-500/10 px-1 font-sans text-[9px] font-bold uppercase tracking-wide text-rose-200"
                               >
-                                {allowAllByName.get(p.name)!.kind === 'superuser' ? 'superuser' : 'allow-all'}
+                                {allow.kind === 'superuser' ? 'superuser' : 'allow-all'}
                               </span>
                             )}
                           </td>
diff --git a/apps/web/src/frontend/features/utilities/components/DatabaseAccessModal.tsx b/apps/web/src/frontend/features/utilities/components/DatabaseAccessModal.tsx
index 3839b822..81898218 100644
--- a/apps/web/src/frontend/features/utilities/components/DatabaseAccessModal.tsx
+++ b/apps/web/src/frontend/features/utilities/components/DatabaseAccessModal.tsx
@@ -22,7 +22,7 @@ import {
   buildGrantRevokeSql,
   describeAllowAll,
   dialectSupportsDbAccess,
-  findAllowAll,
+  findAllowAllByName,
   groupDbPrincipals,
   groupPrivileges,
   privilegeTargetLabel,
@@ -31,6 +31,7 @@ import {
   type DbPrincipal,
   type DbPrivilege,
   type DbPrivilegeObjectType,
+  type PrivilegeGroup,
 } from '@foxschema/sql';
 import { PERMISSION_META } from '@foxschema/shared';
 import { PasswordInput } from '@/shared/components/PasswordInput';
@@ -78,20 +79,141 @@ function privilegeSummary(names: readonly string[]): string {
   return `${names.slice(0, 3).join(', ')} +${names.length - 3}`;
 }
 
-function granteeKindOf(p: DbPrincipal): 'user' | 'role' | 'group' {
-  return p.kind === 'group' ? 'group' : p.kind === 'role' ? 'role' : 'user';
-}
-
 /** Marks an account allowed everything. The word, not a colour, carries it. */
-const AllowAllTag: React.FC<{ allow: AllowAll; testId: string }> = ({ allow, testId }) => (
-  <span
-    data-testid={testId}
-    title={describeAllowAll(allow)}
-    className="ml-1.5 inline-block rounded border border-rose-500/40 bg-rose-500/10 px-1 text-[9px] font-bold uppercase tracking-wide text-rose-200"
-  >
-    {allow.kind === 'superuser' ? 'superuser' : 'allow-all'}
-  </span>
-);
+const PrincipalAllowAllTag: React.FC<{ allow: AllowAll | undefined; name: string }> = ({ allow, name }) =>
+  allow ? (
+    <span
+      data-testid={`db-access-allow-all-${name}`}
+      title={describeAllowAll(allow)}
+      className="ml-1.5 inline-block rounded border border-rose-500/40 bg-rose-500/10 px-1 text-[9px] font-bold uppercase tracking-wide text-rose-200"
+    >
+      {allow.kind === 'superuser' ? 'superuser' : 'allow-all'}
+    </span>
+  ) : null;
+
+/** What one Revoke button takes away. */
+type RevokeTarget = Pick<DbPrivilege, 'privilege' | 'objectType' | 'objectSchema' | 'objectName'>;
+
+const revokeButtonCls =
+  'text-[10px] font-bold uppercase tracking-wide text-rose-300 hover:text-rose-100 disabled:opacity-40';
+
+/**
+ * One object's privileges in the table.
+ *
+ * One privilege is one row. More than one collapses into a header that
+ * expands, and a complete set says ALL PRIVILEGES — seventy rows for `ON *.*`
+ * hid the one fact that mattered.
+ */
+const PrivilegeGroupRows: React.FC<{
+  group: PrivilegeGroup;
+  /** Position among the groups, for test ids. */
+  index: number;
+  open: boolean;
+  onToggle: () => void;
+  /** Where a privilege sits in the principal's list, for test ids. */
+  rowIndex: (priv: DbPrivilege) => number;
+  revokeDisabled: boolean;
+  onRevoke: (target: RevokeTarget, title: string) => void;
+}> = ({ group, index, open, onToggle, rowIndex, revokeDisabled, onRevoke }) => {
+  const on = privilegeTargetLabel(group);
+  const single = group.privileges.length === 1 && !group.all;
+  const expanded = single || open;
+  const implied = group.privileges.some((p) => p.source === 'implied');
+  const names = group.privileges.map((p) => p.privilege);
+  const Chevron = expanded ? ChevronDown : ChevronRight;
+  return (
+    <>
+      {!single && (
+        <tr
+          data-testid={`db-access-privgroup-${index}`}
+          data-all={group.all ? 'true' : 'false'}
+          className="border-t border-slate-800"
+        >
+          <td className="py-1.5 text-slate-200">
+            <button
+              type="button"
+              data-testid={`db-access-privgroup-toggle-${index}`}
+              onClick={onToggle}
+              aria-expanded={expanded}
+              className="inline-flex items-center gap-1 text-left font-semibold hover:text-slate-50"
+              title={names.join(', ')}
+            >
+              <Chevron className="w-3 h-3 text-slate-500" />
+              {group.state === 'deny' ? 'DENY ' : ''}
+              {group.all ? 'ALL PRIVILEGES' : privilegeSummary(names)}
+            </button>
+            <span className="ml-1 text-[10px] text-slate-500">({group.privileges.length})</span>
+          </td>
+          <td className="py-1.5 text-slate-400 font-mono">{on}</td>
+          <td className="py-1.5 text-right">
+            {group.all && !implied && group.state !== 'deny' && (
+              <button
+                type="button"
+                data-testid={`db-access-revoke-all-${index}`}
+                disabled={revokeDisabled}
+                onClick={() =>
+                  onRevoke(
+                    {
+                      // A lone ALL / CONTROL row is revoked by its own name; an
+                      // expanded set by the engine's ALL.
+                      privilege: group.privileges.length === 1 ? group.privileges[0]!.privilege : 'ALL',
+                      objectType: group.objectType,
+                      objectSchema: group.objectSchema,
+                      objectName: group.objectName,
+                    },
+                    'Revoke all privileges'
+                  )
+                }
+                className={revokeButtonCls}
+              >
+                Revoke all
+              </button>
+            )}
+          </td>
+        </tr>
+      )}
+      {expanded &&
+        group.privileges.map((priv) => {
+          const i = rowIndex(priv);
+          return (
+            <tr key={`${priv.privilege}-${i}`} className={single ? 'border-t border-slate-800' : ''}>
+              <td className={`py-1.5 text-slate-200 ${single ? '' : 'pl-5'}`}>
+                {priv.state === 'deny' ? 'DENY ' : ''}
+                {priv.privilege}
+                {priv.grantable && (
+                  <span
+                    data-testid="db-access-grantable"
+                    title="May pass this privilege on to others (WITH GRANT OPTION)"
+                    className="ml-1.5 rounded border border-amber-500/40 px-1 text-[9px] font-bold uppercase tracking-wide text-amber-200"
+                  >
+                    grantable
+                  </span>
+                )}
+                {priv.source === 'implied' && (
+                  <span className="ml-1.5 text-[10px] text-slate-500">implied by this fixed role</span>
+                )}
+              </td>
+              <td className="py-1.5 text-slate-400 font-mono">{single ? on : ''}</td>
+              <td className="py-1.5 text-right">
+                {priv.source !== 'implied' && (
+                  <button
+                    type="button"
+                    data-testid={`db-access-revoke-${i}`}
+                    disabled={revokeDisabled}
+                    onClick={() => onRevoke(priv, 'Revoke privilege')}
+                    className={revokeButtonCls}
+                  >
+                    Revoke
+                  </button>
+                )}
+              </td>
+            </tr>
+          );
+        })}
+    </>
+  );
+};
+
 const GRANT_PRIV_META = PERMISSION_META.find((m) => m.id === 'editor.grant');
 
 export const DatabaseAccessModal: React.FC<Props> = ({
@@ -198,15 +320,11 @@ export const DatabaseAccessModal: React.FC<Props> = ({
    * Who may do anything, and through whom. Worked out once per catalog read:
    * the tag in the list, the filter and the banner all read this.
    */
-  const allowAllByName = useMemo(() => {
-    const map = new Map<string, AllowAll>();
-    if (!dialect) return map;
-    for (const p of principals) {
-      const allow = findAllowAll({ principal: p.name, principals, privileges, dialect });
-      if (allow) map.set(p.name, allow);
-    }
-    return map;
-  }, [principals, privileges, dialect]);
+  const allowAllByName = useMemo(
+    () =>
+      dialect ? findAllowAllByName({ principals, privileges, dialect }) : new Map<string, AllowAll>(),
+    [principals, privileges, dialect]
+  );
 
   const groups = useMemo(() => {
     const q = filter.trim().toLowerCase();
@@ -253,17 +371,18 @@ export const DatabaseAccessModal: React.FC<Props> = ({
   );
   const [roleChoice, setRoleChoice] = useState('');
   const typingRole = roleChoices.length === 0 || roleChoice === OTHER_ROLE;
+  /** The role the membership form grants: typed under "Other…", else picked (the first by default). */
+  const membershipRole = typingRole
+    ? grantName
+    : roleChoices.includes(roleChoice)
+      ? roleChoice
+      : roleChoices[0] ?? '';
   useEffect(() => {
-    // A new principal means a new list; start on its first role, not a stale one.
+    // A new principal means a new list, and a name typed for the last one
+    // must not carry over.
     setRoleChoice('');
     setGrantName('');
   }, [selectedName]);
-  useEffect(() => {
-    if (grantKind !== 'membership' || typingRole) return;
-    const pick = roleChoices.includes(roleChoice) ? roleChoice : roleChoices[0] ?? '';
-    if (pick !== roleChoice) setRoleChoice(pick);
-    if (pick !== grantName) setGrantName(pick);
-  }, [grantKind, typingRole, roleChoices, roleChoice, grantName]);
 
   const togglePrivGroup = (key: string) => {
     setOpenPrivGroups((prev) => {
@@ -279,12 +398,12 @@ export const DatabaseAccessModal: React.FC<Props> = ({
     const built = buildGrantRevokeSql({
       dialect,
       action: 'grant',
-      privilege: grantName || grantPrivilege,
+      privilege: membershipRole || grantPrivilege,
       objectType: 'ROLE',
       objectSchema: grantSchema || conn?.schema || null,
-      objectName: grantName || null,
+      objectName: membershipRole || null,
       grantee: selected.name,
-      granteeKind: selected.kind === 'group' ? 'group' : selected.kind === 'role' ? 'role' : 'user',
+      granteeKind: selected.kind,
       withGrantOption: grantWithOption,
     });
     return built;
@@ -294,7 +413,7 @@ export const DatabaseAccessModal: React.FC<Props> = ({
     grantKind,
     grantPrivilege,
     grantSchema,
-    grantName,
+    membershipRole,
     grantWithOption,
     conn?.schema,
   ]);
@@ -312,17 +431,29 @@ export const DatabaseAccessModal: React.FC<Props> = ({
       action: 'grant',
       privilege: allTarget.privilege,
       objectType: allTarget.objectType,
-      objectSchema: allTarget.objectSchema,
+      objectSchema: null,
       objectName: allTarget.objectName,
       grantee: selected.name,
-      granteeKind: granteeKindOf(selected),
+      granteeKind: selected.kind,
     });
   }, [dialect, selected, grantKind, allTarget]);
-  useEffect(() => {
-    // A new confirmation starts empty: a name typed for the last one must not
-    // arm this one.
-    setConfirmTyped('');
-  }, [confirm]);
+
+  /** Build a REVOKE for the selected principal and ask before running it. */
+  const confirmRevoke = (target: RevokeTarget, title: string) => {
+    if (!selected) return;
+    const built = buildGrantRevokeSql({
+      dialect,
+      action: 'revoke',
+      ...target,
+      grantee: selected.name,
+      granteeKind: selected.kind,
+    });
+    if ('error' in built) {
+      setError(built.error);
+      return;
+    }
+    setConfirm({ title, sql: built.sql, kind: 'revoke' });
+  };
 
   const runSql = async (sql: string, kind: 'grant' | 'revoke') => {
     if (!connectionId || !canGrant) return;
@@ -530,12 +661,7 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                             }`}
                           >
                             <span className="font-mono">{p.name}</span>
-                            {allowAllByName.get(p.name) && (
-                              <AllowAllTag
-                                allow={allowAllByName.get(p.name)!}
-                                testId={`db-access-allow-all-${p.name}`}
-                              />
-                            )}
+                            <PrincipalAllowAllTag allow={allowAllByName.get(p.name)} name={p.name} />
                             {p.kind !== 'user' && p.members.length > 0 && (
                               <span className="block text-[10px] text-slate-500">
                                 {p.members.length} member{p.members.length === 1 ? '' : 's'}
@@ -607,140 +733,18 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                       </tr>
                     </thead>
                     <tbody>
-                      {selectedPrivGroups.map((group, gi) => {
-                        const on = privilegeTargetLabel(group);
-                        const deny = group.state === 'deny' ? 'DENY ' : '';
-                        // One privilege on an object needs no group row. More
-                        // than one collapses, and a complete set says ALL —
-                        // thirty rows for `ON *.*` hid the one fact that mattered.
-                        const single = group.privileges.length === 1 && !group.all;
-                        const expanded = single || openPrivGroups.has(group.key);
-                        const implied = group.privileges.some((p) => p.source === 'implied');
-                        const Chevron = expanded ? ChevronDown : ChevronRight;
-                        const names = group.privileges.map((p) => p.privilege);
-                        const revokeAll = () => {
-                          // A lone ALL / CONTROL row is revoked by its own name;
-                          // an expanded set by the engine's ALL.
-                          const lone = group.privileges.length === 1 ? group.privileges[0]!.privilege : 'ALL';
-                          const built = buildGrantRevokeSql({
-                            dialect,
-                            action: 'revoke',
-                            privilege: lone,
-                            objectType: group.objectType,
-                            objectSchema: group.objectSchema,
-                            objectName: group.objectName,
-                            grantee: selected.name,
-                            granteeKind: granteeKindOf(selected),
-                          });
-                          if ('error' in built) {
-                            setError(built.error);
-                            return;
-                          }
-                          setConfirm({ title: 'Revoke all privileges', sql: built.sql, kind: 'revoke' });
-                        };
-                        return (
-                          <React.Fragment key={group.key}>
-                            {!single && (
-                              <tr
-                                data-testid={`db-access-privgroup-${gi}`}
-                                data-all={group.all ? 'true' : 'false'}
-                                className="border-t border-slate-800"
-                              >
-                                <td className="py-1.5 text-slate-200">
-                                  <button
-                                    type="button"
-                                    data-testid={`db-access-privgroup-toggle-${gi}`}
-                                    onClick={() => togglePrivGroup(group.key)}
-                                    aria-expanded={expanded}
-                                    className="inline-flex items-center gap-1 text-left font-semibold hover:text-slate-50"
-                                    title={names.join(', ')}
-                                  >
-                                    <Chevron className="w-3 h-3 text-slate-500" />
-                                    {deny}
-                                    {group.all ? 'ALL PRIVILEGES' : privilegeSummary(names)}
-                                  </button>
-                                  <span className="ml-1 text-[10px] text-slate-500">
-                                    ({group.privileges.length})
-                                  </span>
-                                </td>
-                                <td className="py-1.5 text-slate-400 font-mono">{on}</td>
-                                <td className="py-1.5 text-right">
-                                  {group.all && !implied && group.state !== 'deny' && (
-                                    <button
-                                      type="button"
-                                      data-testid={`db-access-revoke-all-${gi}`}
-                                      disabled={!canGrant || running || !support?.grant}
-                                      onClick={revokeAll}
-                                      className="text-[10px] font-bold uppercase tracking-wide text-rose-300 hover:text-rose-100 disabled:opacity-40"
-                                    >
-                                      Revoke all
-                                    </button>
-                                  )}
-                                </td>
-                              </tr>
-                            )}
-                            {expanded &&
-                              group.privileges.map((priv) => {
-                                const i = selectedPrivs.indexOf(priv);
-                                return (
-                                  <tr
-                                    key={`${priv.privilege}-${i}`}
-                                    className={single ? 'border-t border-slate-800' : ''}
-                                  >
-                                    <td className={`py-1.5 text-slate-200 ${single ? '' : 'pl-5'}`}>
-                                      {priv.state === 'deny' ? 'DENY ' : ''}
-                                      {priv.privilege}
-                                      {priv.grantable && (
-                                        <span
-                                          data-testid="db-access-grantable"
-                                          title="May pass this privilege on to others (WITH GRANT OPTION)"
-                                          className="ml-1.5 rounded border border-amber-500/40 px-1 text-[9px] font-bold uppercase tracking-wide text-amber-200"
-                                        >
-                                          grantable
-                                        </span>
-                                      )}
-                                      {priv.source === 'implied' && (
-                                        <span className="ml-1.5 text-[10px] text-slate-500">
-                                          implied by this fixed role
-                                        </span>
-                                      )}
-                                    </td>
-                                    <td className="py-1.5 text-slate-400 font-mono">{single ? on : ''}</td>
-                                    <td className="py-1.5 text-right">
-                                      {priv.source !== 'implied' && (
-                                        <button
-                                          type="button"
-                                          data-testid={`db-access-revoke-${i}`}
-                                          disabled={!canGrant || running || !support?.grant}
-                                          onClick={() => {
-                                            const built = buildGrantRevokeSql({
-                                              dialect,
-                                              action: 'revoke',
-                                              privilege: priv.privilege,
-                                              objectType: priv.objectType,
-                                              objectSchema: priv.objectSchema,
-                                              objectName: priv.objectName,
-                                              grantee: selected.name,
-                                              granteeKind: granteeKindOf(selected),
-                                            });
-                                            if ('error' in built) {
-                                              setError(built.error);
-                                              return;
-                                            }
-                                            setConfirm({ title: 'Revoke privilege', sql: built.sql, kind: 'revoke' });
-                                          }}
-                                          className="text-[10px] font-bold uppercase tracking-wide text-rose-300 hover:text-rose-100 disabled:opacity-40"
-                                        >
-                                          Revoke
-                                        </button>
-                                      )}
-                                    </td>
-                                  </tr>
-                                );
-                              })}
-                          </React.Fragment>
-                        );
-                      })}
+                      {selectedPrivGroups.map((group, gi) => (
+                        <PrivilegeGroupRows
+                          key={group.key}
+                          group={group}
+                          index={gi}
+                          open={openPrivGroups.has(group.key)}
+                          onToggle={() => togglePrivGroup(group.key)}
+                          rowIndex={(priv) => selectedPrivs.indexOf(priv)}
+                          revokeDisabled={!canGrant || running || !support?.grant}
+                          onRevoke={confirmRevoke}
+                        />
+                      ))}
                     </tbody>
                   </table>
                 )}
@@ -784,33 +788,18 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                                 type="button"
                                 data-testid={`db-access-remove-member-${i}`}
                                 disabled={!canGrant || running || !support?.grant}
-                                onClick={() => {
-                                  const built = buildGrantRevokeSql({
-                                    dialect,
-                                    action: 'revoke',
-                                    privilege: priv.privilege,
-                                    objectType: 'ROLE',
-                                    objectSchema: priv.objectSchema,
-                                    objectName: priv.objectName,
-                                    grantee: selected.name,
-                                    granteeKind:
-                                      selected.kind === 'group'
-                                        ? 'group'
-                                        : selected.kind === 'role'
-                                          ? 'role'
-                                          : 'user',
-                                  });
-                                  if ('error' in built) {
-                                    setError(built.error);
-                                    return;
-                                  }
-                                  setConfirm({
-                                    title: 'Remove from role',
-                                    sql: built.sql,
-                                    kind: 'revoke',
-                                  });
-                                }}
-                                className="text-[10px] font-bold uppercase tracking-wide text-rose-300 hover:text-rose-100 disabled:opacity-40"
+                                onClick={() =>
+                                  confirmRevoke(
+                                    {
+                                      privilege: priv.privilege,
+                                      objectType: 'ROLE',
+                                      objectSchema: priv.objectSchema,
+                                      objectName: priv.objectName,
+                                    },
+                                    'Remove from role'
+                                  )
+                                }
+                                className={revokeButtonCls}
                               >
                                 Remove
                               </button>
@@ -933,6 +922,8 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                       }
                       onClick={() => {
                         if (!allPreview || 'error' in allPreview || !selected) return;
+                        // A name typed for an earlier confirmation must not arm this one.
+                        setConfirmTyped('');
                         setConfirm({
                           title: 'Grant all privileges',
                           sql: allPreview.sql,
@@ -956,7 +947,7 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                         Role
                         <select
                           data-testid="db-access-grant-role"
-                          value={typingRole ? OTHER_ROLE : roleChoice}
+                          value={typingRole ? OTHER_ROLE : membershipRole}
                           onChange={(e) => {
                             setRoleChoice(e.target.value);
                             if (e.target.value === OTHER_ROLE) setGrantName('');
@@ -1012,7 +1003,7 @@ export const DatabaseAccessModal: React.FC<Props> = ({
                         !grantPreview ||
                         'error' in grantPreview ||
                         !support?.grant ||
-                        !grantName.trim()
+                        !membershipRole.trim()
                       }
                       onClick={() => {
                         if (!grantPreview || 'error' in grantPreview) return;
diff --git a/packages/server/src/features/access/db-access.service.ts b/packages/server/src/features/access/db-access.service.ts
index 6d1b206e..be7b14a2 100644
--- a/packages/server/src/features/access/db-access.service.ts
+++ b/packages/server/src/features/access/db-access.service.ts
@@ -14,6 +14,7 @@ import {
   principalsFromPrivileges,
   normalizeDbPrivileges,
   reconcileDbAccess,
+  impliedFixedRolePrivileges,
   type ConnectionOptions,
   type DbAccessSupport,
   type DbPrincipal,
@@ -119,11 +120,9 @@ export async function probeDbAccess(opts: {
     }
     // One answer about membership for every screen: the catalogs report it two
     // ways, and on several engines only one of them was filled.
-    const reconciled = reconcileDbAccess({
-      dialect: opts.dialect,
-      principals: resolved,
-      privileges,
-    });
+    const reconciled = reconcileDbAccess({ principals: resolved, privileges });
+    // SQL Server's fixed roles confer permissions no row lists (db_owner).
+    reconciled.privileges.push(...impliedFixedRolePrivileges(opts.dialect, reconciled.principals));
     return {
       ok: true,
       value: {
diff --git a/packages/sql/src/index.ts b/packages/sql/src/index.ts
index a6fdb99f..2f12e7bd 100644
--- a/packages/sql/src/index.ts
+++ b/packages/sql/src/index.ts
@@ -202,6 +202,8 @@ export {
   formatDbGrantee,
   buildGrantRevokeSql,
   reconcileDbAccess,
+  impliedFixedRolePrivileges,
+  principalKey,
   DB_OBJECT_PRIVILEGES,
 } from './modules/access/db-access.js';
 export {
@@ -209,6 +211,7 @@ export {
   groupPrivileges,
   privilegeTargetLabel,
   findAllowAll,
+  findAllowAllByName,
   describeAllowAll,
   allPrivilegeTargets,
 } from './modules/access/privilege-groups.js';
diff --git a/packages/sql/src/modules/access/db-access.test.ts b/packages/sql/src/modules/access/db-access.test.ts
index 9e8c40e2..c6d962a8 100644
--- a/packages/sql/src/modules/access/db-access.test.ts
+++ b/packages/sql/src/modules/access/db-access.test.ts
@@ -16,6 +16,7 @@ import {
   principalsFromPrivileges,
   privilegesForPrincipal,
   reconcileDbAccess,
+  impliedFixedRolePrivileges,
   type DbPrincipal,
   type DbPrivilege,
 } from './db-access.js';
@@ -603,7 +604,6 @@ describe('reconcileDbAccess', () => {
     // MySQL before this fix: member_of filled, no ROLE row, so the detail pane
     // said "Belongs to no roles" under a list that said otherwise.
     const out = reconcileDbAccess({
-      dialect: 'mysql',
       principals: [
         principal('zz_app@%', { memberOf: ['zz_reader@%'] }),
         principal('zz_reader@%', { kind: 'role', members: ['zz_app@%'] }),
@@ -624,12 +624,10 @@ describe('reconcileDbAccess', () => {
     // MariaDB before this fix filled member_of and left members empty; other
     // catalogs fill only a role's members. Each side alone is enough.
     const fromMemberOf = reconcileDbAccess({
-      dialect: 'mariadb',
       principals: [principal('app@%', { memberOf: ['reader'] }), principal('reader', { kind: 'role' })],
       privileges: [],
     });
     const fromMembers = reconcileDbAccess({
-      dialect: 'mariadb',
       principals: [principal('app@%'), principal('reader', { kind: 'role', members: ['app@%'] })],
       privileges: [],
     });
@@ -642,7 +640,6 @@ describe('reconcileDbAccess', () => {
 
   it('fills memberOf and members from ROLE rows only the privilege catalog reported', () => {
     const out = reconcileDbAccess({
-      dialect: 'postgres',
       principals: [principal('alice'), principal('reader', { kind: 'role', canLogin: false })],
       privileges: [
         {
@@ -665,7 +662,6 @@ describe('reconcileDbAccess', () => {
 
   it('matches quoted grantees against principal names', () => {
     const out = reconcileDbAccess({
-      dialect: 'mysql',
       principals: [principal('zz_app@%', { memberOf: ['zz_reader@%'] })],
       privileges: normalizeDbPrivileges([
         { grantee: "'zz_app'@'%'", privilege: 'zz_reader@%', object_type: 'ROLE', object_name: 'zz_reader@%' },
@@ -674,13 +670,11 @@ describe('reconcileDbAccess', () => {
     expect(out.privileges.filter((p) => p.objectType === 'ROLE')).toHaveLength(1);
   });
 
-  it("gives SQL Server's fixed roles the permissions they imply", () => {
-    const out = reconcileDbAccess({
-      dialect: 'sqlserver',
-      principals: [principal('db_owner', { kind: 'role' }), principal('db_datareader', { kind: 'role' })],
-      privileges: [],
-    });
-    expect(out.privileges.map((p) => [p.grantee, p.privilege, p.objectType, p.source])).toEqual([
+  it("gives SQL Server's fixed roles the permissions they imply, and nothing elsewhere", () => {
+    const roles = [principal('db_owner', { kind: 'role' }), principal('db_datareader', { kind: 'role' })];
+    expect(impliedFixedRolePrivileges('postgres', roles)).toEqual([]);
+    const implied = impliedFixedRolePrivileges('sqlserver', roles);
+    expect(implied.map((p) => [p.grantee, p.privilege, p.objectType, p.source])).toEqual([
       ['db_owner', 'CONTROL', 'DATABASE', 'implied'],
       ['db_datareader', 'SELECT', 'DATABASE', 'implied'],
     ]);
@@ -688,7 +682,7 @@ describe('reconcileDbAccess', () => {
 
   it('does not change its inputs', () => {
     const input = [principal('alice', { memberOf: ['r'] })];
-    reconcileDbAccess({ dialect: 'postgres', principals: input, privileges: [] });
+    reconcileDbAccess({ principals: input, privileges: [] });
     expect(input[0]!.memberOf).toEqual(['r']);
   });
 });
diff --git a/packages/sql/src/modules/access/db-access.ts b/packages/sql/src/modules/access/db-access.ts
index 771ff2ee..fa0a8c11 100644
--- a/packages/sql/src/modules/access/db-access.ts
+++ b/packages/sql/src/modules/access/db-access.ts
@@ -13,6 +13,7 @@
 
 import { quoteSqlIdentifier } from '../sql-text/sql-template.js';
 import { accessFamily } from './intent.js';
+import { mysqlAccount, mysqlQuote, mysqlRoleRef } from './user-sql-helpers.js';
 
 export type DbAccessProbeMode = 'native' | 'estimated' | 'unsupported';
 
@@ -266,10 +267,9 @@ export function buildDbAccessPrivilegeQueries(opts: {
     // Most complete first. A login that may not read mysql.* loses the role
     // rows only; global grants come from information_schema, which every
     // login may read (it shows each its own).
-    const roles = fam === 'mariadb' ? 'mariadb' : 'mysql';
     const ladder = (filter: boolean): DbAccessQuery[] =>
       [
-        mysqlPrivilegesQuery({ schemaFilter: filter, global: true, roles }),
+        mysqlPrivilegesQuery({ schemaFilter: filter, global: true, roles: fam }),
         mysqlPrivilegesQuery({ schemaFilter: filter, global: true, roles: null }),
         mysqlPrivilegesQuery({ schemaFilter: filter, global: false, roles: null }),
       ].map((sql) => ({ sql, params: filter ? [schema, schema] : [] }));
@@ -362,12 +362,21 @@ export function principalsFromPrivileges(privileges: readonly DbPrivilege[]): Db
   return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
 }
 
+/**
+ * How two spellings of one principal are matched: quotes off, case folded.
+ * `'app'@'%'` from information_schema and `app@%` from the principal list are
+ * the same account; Oracle and Db2 fold names to upper case.
+ */
+export function principalKey(name: string): string {
+  return stripQuotes(name).toLowerCase();
+}
+
 export function privilegesForPrincipal(
   privileges: readonly DbPrivilege[],
   principal: string
 ): DbPrivilege[] {
-  const key = stripQuotes(principal).toLowerCase();
-  return privileges.filter((p) => stripQuotes(p.grantee).toLowerCase() === key);
+  const key = principalKey(principal);
+  return privileges.filter((p) => principalKey(p.grantee) === key);
 }
 
 export function groupDbPrincipals(principals: readonly DbPrincipal[]): Array<{
@@ -384,23 +393,7 @@ export function groupDbPrincipals(principals: readonly DbPrincipal[]): Array<{
 }
 
 /**
- * What SQL Server's fixed database roles confer with no permission row to say
- * so. Without these, `db_owner` — allowed everything in the database — listed
- * no privileges at all.
- */
-const SQLSERVER_FIXED_ROLE_PRIVILEGES: Record<string, string[]> = {
-  db_owner: ['CONTROL'],
-  db_datareader: ['SELECT'],
-  db_datawriter: ['INSERT', 'UPDATE', 'DELETE'],
-};
-
-function memberKey(name: string): string {
-  return stripQuotes(name).toLowerCase();
-}
-
-/**
- * Make the two catalogs agree about role membership, and add what fixed roles
- * imply.
+ * Make the two catalogs agree about role membership.
  *
  * Membership arrives two ways: `memberOf` / `members` on each principal, and
  * ROLE rows in the privilege list. Postgres, SQL Server and Oracle fill both;
@@ -410,7 +403,6 @@ function memberKey(name: string): string {
  * this way carry `source: 'derived'`.
  */
 export function reconcileDbAccess(opts: {
-  dialect: string;
   principals: readonly DbPrincipal[];
   privileges: readonly DbPrivilege[];
 }): { principals: DbPrincipal[]; privileges: DbPrivilege[] } {
@@ -419,16 +411,15 @@ export function reconcileDbAccess(opts: {
     memberOf: [...p.memberOf],
     members: [...p.members],
   }));
-  const byName = new Map(principals.map((p) => [memberKey(p.name), p]));
   const privileges = [...opts.privileges];
-  const edges = new Set<string>();
-  const edgeKey = (member: string, role: string) => `${memberKey(member)}\u0000${memberKey(role)}`;
 
+  // Side 1: a ROLE row for every membership the principal list names.
+  const edges = new Set<string>();
+  const edgeKey = (member: string, role: string) => `${principalKey(member)}\u0000${principalKey(role)}`;
   for (const priv of privileges) {
-    if (priv.objectType !== 'ROLE') continue;
-    edges.add(edgeKey(priv.grantee, priv.objectName ?? priv.privilege));
+    if (priv.objectType === 'ROLE') edges.add(edgeKey(priv.grantee, priv.objectName ?? priv.privilege));
   }
-  const addEdge = (member: string, role: string) => {
+  const addRoleRow = (member: string, role: string) => {
     const k = edgeKey(member, role);
     if (edges.has(k)) return;
     edges.add(k);
@@ -445,42 +436,66 @@ export function reconcileDbAccess(opts: {
     });
   };
   for (const p of principals) {
-    for (const role of p.memberOf) addEdge(p.name, role);
-    for (const member of p.members) addEdge(member, p.name);
+    for (const role of p.memberOf) addRoleRow(p.name, role);
+    for (const member of p.members) addRoleRow(member, p.name);
   }
 
-  const has = (list: string[], name: string) => list.some((n) => memberKey(n) === memberKey(name));
+  // Side 2: memberOf / members for every ROLE row. Sets, not list scans: a
+  // widely held role has thousands of members.
+  const byName = new Map(principals.map((p) => [principalKey(p.name), p]));
+  const memberOfKeys = new Map(principals.map((p) => [p, new Set(p.memberOf.map(principalKey))]));
+  const membersKeys = new Map(principals.map((p) => [p, new Set(p.members.map(principalKey))]));
   for (const priv of privileges) {
     if (priv.objectType !== 'ROLE') continue;
     const role = priv.objectName ?? priv.privilege;
-    const member = byName.get(memberKey(priv.grantee));
-    if (member && !has(member.memberOf, role)) member.memberOf.push(role);
-    const rolePrincipal = byName.get(memberKey(role));
-    if (rolePrincipal && !has(rolePrincipal.members, priv.grantee)) {
-      rolePrincipal.members.push(member?.name ?? stripQuotes(priv.grantee));
+    const member = byName.get(principalKey(priv.grantee));
+    if (member && !memberOfKeys.get(member)!.has(principalKey(role))) {
+      memberOfKeys.get(member)!.add(principalKey(role));
+      member.memberOf.push(role);
     }
-  }
-
-  if (family(opts.dialect) === 'sqlserver') {
-    for (const p of principals) {
-      for (const privilege of SQLSERVER_FIXED_ROLE_PRIVILEGES[p.name.toLowerCase()] ?? []) {
-        privileges.push({
-          grantee: p.name,
-          privilege,
-          objectType: 'DATABASE',
-          objectSchema: null,
-          objectName: null,
-          grantable: false,
-          grantor: null,
-          state: 'grant',
-          source: 'implied',
-        });
-      }
+    const rolePrincipal = byName.get(principalKey(role));
+    if (rolePrincipal && !membersKeys.get(rolePrincipal)!.has(principalKey(priv.grantee))) {
+      membersKeys.get(rolePrincipal)!.add(principalKey(priv.grantee));
+      rolePrincipal.members.push(member?.name ?? stripQuotes(priv.grantee));
     }
   }
   return { principals, privileges };
 }
 
+/**
+ * What SQL Server's fixed database roles confer with no permission row to say
+ * so. Without these, `db_owner` — allowed everything in the database — listed
+ * no privileges at all.
+ */
+const SQLSERVER_FIXED_ROLE_PRIVILEGES: Record<string, string[]> = {
+  db_owner: ['CONTROL'],
+  db_datareader: ['SELECT'],
+  db_datawriter: ['INSERT', 'UPDATE', 'DELETE'],
+};
+
+/** The rows SQL Server's fixed roles imply, tagged `source: 'implied'`. Empty elsewhere. */
+export function impliedFixedRolePrivileges(
+  dialect: string,
+  principals: readonly DbPrincipal[]
+): DbPrivilege[] {
+  if (family(dialect) !== 'sqlserver') return [];
+  return principals.flatMap((p) =>
+    (SQLSERVER_FIXED_ROLE_PRIVILEGES[p.name.toLowerCase()] ?? []).map(
+      (privilege): DbPrivilege => ({
+        grantee: p.name,
+        privilege,
+        objectType: 'DATABASE',
+        objectSchema: null,
+        objectName: null,
+        grantable: false,
+        grantor: null,
+        state: 'grant',
+        source: 'implied',
+      })
+    )
+  );
+}
+
 /** Quote a principal for GRANT/REVOKE (MySQL `'user'@'host'`, Db2 `USER "x"`). */
 export function formatDbGrantee(
   dialect: string,
@@ -490,26 +505,19 @@ export function formatDbGrantee(
   const fam = family(dialect);
   const raw = stripQuotes(name);
   if (fam === 'mysql' || fam === 'mariadb') {
-    // Same escaping as account DDL in user-sql: MySQL treats `\` as an escape
-    // inside string literals, so a name like `al\'ice` would otherwise close
-    // the quote early and turn the rest of the GRANT into free SQL. Double
-    // backslashes before doubling quotes.
-    const quote = (v: string) => `'${v.replace(/\\/g, '\\\\').replace(/'/g, "''")}'`;
-    // A MariaDB role has no host: `'r'@'%'` names a user that does not exist.
-    if (fam === 'mariadb' && kind === 'role') {
-      return quote(raw.endsWith('@') ? raw.slice(0, -1) : raw);
-    }
+    // Quoted exactly as the account DDL in user-sql quotes it (backslashes
+    // doubled before quotes, so `al\'ice` cannot close the literal early).
+    // The catalog spells an account user@host.
     const at = raw.lastIndexOf('@');
-    if (at > 0) {
-      return `${quote(raw.slice(0, at))}@${quote(raw.slice(at + 1))}`;
-    }
-    // MySQL accounts are name@host. A bare name used to become `` `alice` ``,
-    // which is not a user account — CREATE USER / our catalog use 'alice'@'%',
-    // and GRANT TO `alice` either fails or hits a role of that name instead.
-    // Default the host for users (and for roles our DDL creates as name@'%').
-    if (kind === 'user' || kind === 'role') {
-      return `${quote(raw)}@'%'`;
-    }
+    const user = at > 0 ? raw.slice(0, at) : raw;
+    const host = at > 0 ? raw.slice(at + 1) : undefined;
+    // A MariaDB role has no host: `'r'@'%'` names a user that does not exist.
+    if (fam === 'mariadb' && kind === 'role') return mysqlRoleRef(user, host, dialect);
+    if (host !== undefined) return `${mysqlQuote(user)}@${mysqlQuote(host)}`;
+    // A bare name used to become `` `alice` ``, which is not an account —
+    // CREATE USER and our catalog use 'alice'@'%', and GRANT TO `alice` either
+    // fails or hits a role of that name. Default the host for users and roles.
+    if (kind === 'user' || kind === 'role') return mysqlAccount(raw, undefined);
     return quoteSqlIdentifier(raw, dialect);
   }
   const ident = quoteSqlIdentifier(raw, dialect);
@@ -575,11 +583,9 @@ export function buildGrantRevokeSql(args: DbAccessGrantArgs): { sql: string } |
     const roleName = (args.objectName || privilege).trim();
     if (!roleName) return { error: 'role name is required.' };
     // A MySQL role is an account, `'r'@'%'`; the catalog names it `r@%`, and a
-    // backtick-quoted `r@%` is a role nobody created.
-    const roleSql =
-      fam === 'mysql' || fam === 'mariadb'
-        ? formatDbGrantee(args.dialect, roleName, 'role')
-        : ident(roleName);
+    // backtick-quoted `r@%` is a role nobody created. Named like a grantee.
+    const mysqlFamily = fam === 'mysql' || fam === 'mariadb';
+    const roleSql = mysqlFamily ? formatDbGrantee(args.dialect, roleName, 'role') : ident(roleName);
     // SQL Server does not grant a role, it adds a member to one.
     if (fam === 'sqlserver') {
       const member = ident(stripQuotes(grantee));
@@ -625,27 +631,10 @@ export function buildGrantRevokeSql(args: DbAccessGrantArgs): { sql: string } |
     return emitGrant({ action, privilege: privSql, on, grantee: granteeSql, grantOption });
   }
 
-  if (fam === 'mysql' || fam === 'mariadb') {
-    // MySQL names a whole database as `db`.* — a bare `db` is a table
-    // reference, so a database-level grant landed on a table of that name.
-    const target =
-      objectType === 'GLOBAL'
-        ? '*.*'
-        : objectType === 'DATABASE' || objectType === 'SCHEMA'
-          ? `${objectSql || namedObject()}.*`
-          : objectSql || '*.*';
-    return emitGrant({
-      action,
-      privilege: privSql === 'ALL' ? 'ALL PRIVILEGES' : privSql,
-      on: `ON ${target}`,
-      grantee: granteeSql,
-      grantOption,
-    });
-  }
-
-  if (fam === 'clickhouse') {
-    // ClickHouse takes no object keyword; `db.table` or `db.*` is the target.
-    // A database is `db.*` here as on MySQL; a bare `db` names a table.
+  if (fam === 'mysql' || fam === 'mariadb' || fam === 'clickhouse') {
+    // These name the whole server `*.*` and a whole database `db`.* — a bare
+    // `db` is a table reference, so a database-level grant landed on a table
+    // of that name. ClickHouse takes no object keyword either.
     const target =
       objectType === 'GLOBAL'
         ? '*.*'
@@ -654,7 +643,7 @@ export function buildGrantRevokeSql(args: DbAccessGrantArgs): { sql: string } |
           : objectSql || '*.*';
     return emitGrant({
       action,
-      privilege: privSql,
+      privilege: fam !== 'clickhouse' && privSql === 'ALL' ? 'ALL PRIVILEGES' : privSql,
       on: `ON ${target}`,
       grantee: granteeSql,
       grantOption,
@@ -989,7 +978,7 @@ function mysqlPrivilegesQuery(opts: {
   global: boolean;
   roles: 'mysql' | 'mariadb' | null;
 }): string {
-  const where = (col: string) => (opts.schemaFilter ? `\nWHERE ${col} = ?` : '');
+  const inSchema = opts.schemaFilter ? '\nWHERE TABLE_SCHEMA = ?' : '';
   const parts = [
     `SELECT GRANTEE AS grantee,
        PRIVILEGE_TYPE AS privilege,
@@ -998,7 +987,7 @@ function mysqlPrivilegesQuery(opts: {
        TABLE_NAME AS object_name,
        CASE WHEN IS_GRANTABLE = 'YES' THEN 1 ELSE 0 END AS grantable,
        NULL AS grantor
-FROM information_schema.TABLE_PRIVILEGES${where('TABLE_SCHEMA')}`,
+FROM information_schema.TABLE_PRIVILEGES${inSchema}`,
     `SELECT GRANTEE,
        PRIVILEGE_TYPE,
        'SCHEMA',
@@ -1006,7 +995,7 @@ FROM information_schema.TABLE_PRIVILEGES${where('TABLE_SCHEMA')}`,
        NULL,
        CASE WHEN IS_GRANTABLE = 'YES' THEN 1 ELSE 0 END,
        NULL
-FROM information_schema.SCHEMA_PRIVILEGES${where('TABLE_SCHEMA')}`,
+FROM information_schema.SCHEMA_PRIVILEGES${inSchema}`,
   ];
   if (opts.global) {
     parts.push(`SELECT GRANTEE,
diff --git a/packages/sql/src/modules/access/privilege-groups.test.ts b/packages/sql/src/modules/access/privilege-groups.test.ts
index 3e7ed2e9..dabf6568 100644
--- a/packages/sql/src/modules/access/privilege-groups.test.ts
+++ b/packages/sql/src/modules/access/privilege-groups.test.ts
@@ -9,6 +9,7 @@ import {
   allPrivilegeTargets,
   describeAllowAll,
   findAllowAll,
+  findAllowAllByName,
   groupPrivileges,
   isAllPrivilegeSet,
   privilegeTargetLabel,
@@ -202,7 +203,7 @@ describe('allPrivilegeTargets', () => {
       action: 'grant',
       privilege: t.privilege,
       objectType: t.objectType,
-      objectSchema: t.objectSchema,
+      objectSchema: null,
       objectName: t.objectName,
       grantee,
     });
@@ -233,3 +234,23 @@ describe('allPrivilegeTargets', () => {
     expect(allPrivilegeTargets('sqlite', { database: 'x' })).toEqual([]);
   });
 });
+
+describe('findAllowAllByName', () => {
+  it('answers for every principal exactly as findAllowAll does one at a time', () => {
+    const principals = [
+      principal('app@%', { memberOf: ['ops@%'] }),
+      principal('ops@%', { kind: 'role', memberOf: ['admin@%'] }),
+      principal('admin@%', { kind: 'role' }),
+      principal('root@%', { superuser: true }),
+      principal('plain@%'),
+    ];
+    const privileges = TIDB_GLOBAL_ALL.map((p) => priv("'admin'@'%'", p, 'GLOBAL'));
+    const all = findAllowAllByName({ principals, privileges, dialect: 'mysql' });
+    for (const p of principals) {
+      expect(all.get(p.name) ?? null, p.name).toEqual(
+        findAllowAll({ principal: p.name, principals, privileges, dialect: 'mysql' })
+      );
+    }
+    expect([...all.keys()]).toEqual(['app@%', 'ops@%', 'admin@%', 'root@%']);
+  });
+});
diff --git a/packages/sql/src/modules/access/privilege-groups.ts b/packages/sql/src/modules/access/privilege-groups.ts
index 18d4f581..af88adc2 100644
--- a/packages/sql/src/modules/access/privilege-groups.ts
+++ b/packages/sql/src/modules/access/privilege-groups.ts
@@ -15,7 +15,7 @@
  * Pure: it takes rows the probes already fetched.
  */
 import { accessFamily } from './intent.js';
-import type { DbPrincipal, DbPrivilege, DbPrivilegeObjectType } from './db-access.js';
+import { principalKey, type DbPrincipal, type DbPrivilege, type DbPrivilegeObjectType } from './db-access.js';
 import { resolveRoleChain } from './effective.js';
 
 /**
@@ -147,26 +147,75 @@ export interface AllowAll {
   via: string[];
 }
 
-function key(name: string): string {
-  return (name || '').trim().toLowerCase();
+/** What the allow-all check needs, built once per catalog read. */
+interface AllowAllIndex {
+  dialect: string;
+  principals: readonly DbPrincipal[];
+  byName: Map<string, DbPrincipal>;
+  privilegesByGrantee: Map<string, DbPrivilege[]>;
+  /** Each holder's own answer. A role is shared by many accounts; ask once. */
+  direct: Map<string, AllowAllKind | null>;
 }
 
-function directAllowAll(
-  holder: DbPrincipal | undefined,
-  holderName: string,
+function indexForAllowAll(
+  principals: readonly DbPrincipal[],
   privileges: readonly DbPrivilege[],
   dialect: string
-): AllowAllKind | null {
-  if (holder?.superuser === true) return 'superuser';
-  const own = privileges.filter((p) => key(p.grantee) === key(holderName));
-  for (const group of groupPrivileges(own, dialect)) {
-    if (!group.all) continue;
-    if (group.objectType === 'GLOBAL') return 'all-on-server';
-    // SQL Server CONTROL on the database (db_owner) is everything in it.
-    if (group.objectType === 'DATABASE' && accessFamily(dialect) === 'sqlserver') {
-      return 'all-on-database';
+): AllowAllIndex {
+  const privilegesByGrantee = new Map<string, DbPrivilege[]>();
+  for (const p of privileges) {
+    const k = principalKey(p.grantee);
+    const list = privilegesByGrantee.get(k);
+    if (list) list.push(p);
+    else privilegesByGrantee.set(k, [p]);
+  }
+  return {
+    dialect,
+    principals,
+    byName: new Map(principals.map((p) => [principalKey(p.name), p])),
+    privilegesByGrantee,
+    direct: new Map(),
+  };
+}
+
+/** Whether this one principal holds allow-all itself, not through a role. */
+function directAllowAll(name: string, index: AllowAllIndex): AllowAllKind | null {
+  const k = principalKey(name);
+  const cached = index.direct.get(k);
+  if (cached !== undefined) return cached;
+  let kind: AllowAllKind | null = null;
+  if (index.byName.get(k)?.superuser === true) {
+    kind = 'superuser';
+  } else {
+    for (const group of groupPrivileges(index.privilegesByGrantee.get(k) ?? [], index.dialect)) {
+      if (!group.all) continue;
+      if (group.objectType === 'GLOBAL') {
+        kind = 'all-on-server';
+        break;
+      }
+      // SQL Server CONTROL on the database (db_owner) is everything in it.
+      if (group.objectType === 'DATABASE' && accessFamily(index.dialect) === 'sqlserver') {
+        kind = 'all-on-database';
+        break;
+      }
     }
   }
+  index.direct.set(k, kind);
+  return kind;
+}
+
+function allowAllOf(principal: string, index: AllowAllIndex): AllowAll | null {
+  const direct = directAllowAll(principal, index);
+  if (direct) return { kind: direct, holder: principal, via: [] };
+  // Nearest holder wins: a reader tracing "why" wants the closest explanation.
+  const chains = [...resolveRoleChain(principal, index.principals).values()].sort(
+    (a, b) => a.length - b.length
+  );
+  for (const chain of chains) {
+    const role = chain[chain.length - 1]!;
+    const kind = directAllowAll(role, index);
+    if (kind) return { kind, holder: index.byName.get(principalKey(role))?.name ?? role, via: chain };
+  }
   return null;
 }
 
@@ -184,18 +233,28 @@ export function findAllowAll(opts: {
   privileges: readonly DbPrivilege[];
   dialect: string;
 }): AllowAll | null {
-  const byName = new Map(opts.principals.map((p) => [key(p.name), p]));
-  const direct = directAllowAll(byName.get(key(opts.principal)), opts.principal, opts.privileges, opts.dialect);
-  if (direct) return { kind: direct, holder: opts.principal, via: [] };
-  const chains = [...resolveRoleChain(opts.principal, opts.principals).values()].sort(
-    (a, b) => a.length - b.length
-  );
-  for (const chain of chains) {
-    const role = chain[chain.length - 1]!;
-    const kind = directAllowAll(byName.get(key(role)), role, opts.privileges, opts.dialect);
-    if (kind) return { kind, holder: byName.get(key(role))?.name ?? role, via: chain };
+  return allowAllOf(opts.principal, indexForAllowAll(opts.principals, opts.privileges, opts.dialect));
+}
+
+/**
+ * {@link findAllowAll} for every principal at once, keyed by principal name.
+ *
+ * The lists that tag accounts need all of them. Asking one at a time re-read
+ * the whole privilege list per account — some 70 million comparisons for a
+ * MySQL server with a thousand accounts, where `*.*` is seventy rows each.
+ */
+export function findAllowAllByName(opts: {
+  principals: readonly DbPrincipal[];
+  privileges: readonly DbPrivilege[];
+  dialect: string;
+}): Map<string, AllowAll> {
+  const index = indexForAllowAll(opts.principals, opts.privileges, opts.dialect);
+  const out = new Map<string, AllowAll>();
+  for (const p of opts.principals) {
+    const allow = allowAllOf(p.name, index);
+    if (allow) out.set(p.name, allow);
   }
-  return null;
+  return out;
 }
 
 /** One line for a badge's tooltip or a banner. */
@@ -218,7 +277,7 @@ export interface AllPrivilegeTarget {
   /** What it really confers, and what it does not. */
   note: string;
   objectType: DbPrivilegeObjectType;
-  objectSchema: string | null;
+  /** The database or schema it applies to; null for the whole server or a system privilege. */
   objectName: string | null;
   /** The engine's own name for "everything" at this level. */
   privilege: string;
@@ -240,106 +299,107 @@ export function allPrivilegeTargets(
   const fam = accessFamily(dialect);
   const db = ctx.database?.trim() || null;
   const schema = ctx.schema?.trim() || null;
-  const out: AllPrivilegeTarget[] = [];
-  const target = (t: AllPrivilegeTarget) => out.push(t);
 
   if (fam === 'mysql' || fam === 'mariadb' || fam === 'clickhouse') {
-    target({
+    const server: AllPrivilegeTarget = {
       id: 'server',
       label: 'Whole server (*.*)',
       note: 'Every privilege on every database, including creating users and shutting the server down.',
       objectType: 'GLOBAL',
-      objectSchema: null,
       objectName: null,
       privilege: 'ALL',
-    });
+    };
+    // Database and schema are one thing here; the connection's schema is the one in use.
     const name = schema || db;
-    if (name) {
-      target({
+    if (!name) return [server];
+    return [
+      server,
+      {
         id: 'database',
         label: `Database ${name} (${name}.*)`,
         note: `Every privilege on ${name} and every table in it, including tables created later.`,
         objectType: 'DATABASE',
-        objectSchema: null,
         objectName: name,
         privilege: 'ALL',
-      });
-    }
-    return out;
+      },
+    ];
   }
+
   if (fam === 'postgres') {
+    const out: AllPrivilegeTarget[] = [];
     if (db) {
-      target({
+      out.push({
         id: 'database',
         label: `Database ${db}`,
         note: 'CONNECT, CREATE and TEMPORARY on the database. It reads no table: that is granted per schema or table. Server-wide access is superuser (ALTER ROLE … SUPERUSER), not a grant.',
         objectType: 'DATABASE',
-        objectSchema: null,
         objectName: db,
         privilege: 'ALL',
       });
     }
     if (schema) {
-      target({
+      out.push({
         id: 'schema',
         label: `Schema ${schema}`,
         note: 'USAGE and CREATE on the schema. The tables in it are granted separately.',
         objectType: 'SCHEMA',
-        objectSchema: null,
         objectName: schema,
         privilege: 'ALL',
       });
     }
     return out;
   }
+
   if (fam === 'sqlserver') {
+    const out: AllPrivilegeTarget[] = [];
     if (db) {
-      target({
+      out.push({
         id: 'database',
         label: `Database ${db} (CONTROL)`,
         note: 'CONTROL on the database: every permission in it, as db_owner has.',
         objectType: 'DATABASE',
-        objectSchema: null,
         objectName: db,
         privilege: 'CONTROL',
       });
     }
     if (schema) {
-      target({
+      out.push({
         id: 'schema',
         label: `Schema ${schema} (CONTROL)`,
         note: `CONTROL on the schema: every permission on ${schema} and everything in it.`,
         objectType: 'SCHEMA',
-        objectSchema: null,
         objectName: schema,
         privilege: 'CONTROL',
       });
     }
     return out;
   }
+
   if (fam === 'oracle') {
-    target({
-      id: 'system',
-      label: 'Every system privilege (ALL PRIVILEGES)',
-      note: 'Every system privilege, including SELECT ANY TABLE and DROP ANY TABLE on every schema.',
-      objectType: 'SYSTEM',
-      objectSchema: null,
-      objectName: null,
-      privilege: 'ALL PRIVILEGES',
-    });
-    return out;
+    return [
+      {
+        id: 'system',
+        label: 'Every system privilege (ALL PRIVILEGES)',
+        note: 'Every system privilege, including SELECT ANY TABLE and DROP ANY TABLE on every schema.',
+        objectType: 'SYSTEM',
+        objectName: null,
+        privilege: 'ALL PRIVILEGES',
+      },
+    ];
   }
+
   if (fam === 'db2') {
-    target({
-      id: 'database',
-      label: 'Database administrator (DBADM)',
-      note: 'DBADM on this database: create and drop objects, and with DATAACCESS read and write every table.',
-      objectType: 'DATABASE',
-      objectSchema: null,
-      objectName: null,
-      privilege: 'DBADM',
-    });
-    return out;
+    return [
+      {
+        id: 'database',
+        label: 'Database administrator (DBADM)',
+        note: 'DBADM on this database: create and drop objects, and with DATAACCESS read and write every table.',
+        objectType: 'DATABASE',
+        objectName: null,
+        privilege: 'DBADM',
+      },
+    ];
   }
-  return out;
+
+  return [];
 }
diff --git a/packages/sql/src/modules/access/user-sql-helpers.ts b/packages/sql/src/modules/access/user-sql-helpers.ts
index 7d6f2fec..14c2b17e 100644
--- a/packages/sql/src/modules/access/user-sql-helpers.ts
+++ b/packages/sql/src/modules/access/user-sql-helpers.ts
@@ -40,7 +40,7 @@ export const UNSUPPORTED_USER_SQL: UserManagementSupport = {
  */
 
 /** MySQL-family string literals treat `\` as an escape — double it before quotes. */
-function mysqlQuote(value: string): string {
+export function mysqlQuote(value: string): string {
   return `'${value.replace(/\\/g, '\\\\').replace(/'/g, "''")}'`;
 }
 
diff --git a/packages/sql/src/modules/access/user-sql.ts b/packages/sql/src/modules/access/user-sql.ts
index b55dda7c..a6122fef 100644
--- a/packages/sql/src/modules/access/user-sql.ts
+++ b/packages/sql/src/modules/access/user-sql.ts
@@ -57,7 +57,8 @@ export {
 import type { GeneratedUserSql, UserManagementSupport, UserRequest } from './user-sql.types.js';
 import type { GeneratedStatement } from './access-sql.types.js';
 import { resolveUserSql } from './user-sql.registry.js';
-import { buildGrantRevokeSql, formatDbGrantee } from './db-access.js';
+import { buildGrantRevokeSql } from './db-access.js';
+import { mysqlAccount, mysqlRoleRef } from './user-sql-helpers.js';
 import { accessFamily } from './intent.js';
 
 export function userManagementSupport(dialect: string): UserManagementSupport {
@@ -133,23 +134,22 @@ function roleMembershipStatements(
       risk: 'elevated',
     });
   }
-  if (mysqlFamily && isUser) {
-    const account = formatDbGrantee(dialect, grantee, 'user');
-    out.push(
-      fam === 'mariadb'
-        ? {
-            sql: `SET DEFAULT ROLE ${formatDbGrantee(dialect, roles[0]!, 'role')} FOR ${account};`,
-            explanation: `Turns ${roles[0]} on at login. MariaDB keeps one default role${
-              roles.length > 1 ? '; the others are switched on with SET ROLE' : ''
-            }.`,
-            risk: 'low',
-          }
-        : {
-            sql: `SET DEFAULT ROLE ALL TO ${account};`,
-            explanation: 'Turns the granted roles on at login. MySQL leaves a granted role inactive otherwise.',
-            risk: 'low',
-          }
-    );
+  if (!mysqlFamily || !isUser) return out;
+  // The account exactly as the CREATE USER above it names it.
+  const account = mysqlAccount(name, request.host);
+  if (fam === 'mariadb') {
+    const others = roles.length > 1 ? '; the others are switched on with SET ROLE' : '';
+    out.push({
+      sql: `SET DEFAULT ROLE ${mysqlRoleRef(roles[0]!, undefined, dialect)} FOR ${account};`,
+      explanation: `Turns ${roles[0]} on at login. MariaDB keeps one default role${others}.`,
+      risk: 'low',
+    });
+  } else {
+    out.push({
+      sql: `SET DEFAULT ROLE ALL TO ${account};`,
+      explanation: 'Turns the granted roles on at login. MySQL leaves a granted role inactive otherwise.',
+      risk: 'low',
+    });
   }
   return out;
 }