feat(security): inventory database catalog assets

apps/api/tests/test_asset_scanner_job.py

@@ -87,8 +87,71 @@ def test_background_scanner_scopes_every_database_operation(monkeypatch) -> None
             duration_ms=10,
             status="success",
             error=None,
+            scope=["k8s", "prometheus", "database_catalog"],
+            scan_depth="shallow",
         )
 
     asyncio.run(exercise_scanner_writes())
 
     assert requested_projects == ["awoooi"] * 6
+
+
+def test_database_catalog_collector_reads_metadata_only(monkeypatch) -> None:
+    requested_projects: list[str | None] = []
+
+    class CatalogResult:
+        def fetchall(self):
+            return [
+                type(
+                    "CatalogRow",
+                    (),
+                    {
+                        "_mapping": {
+                            "database_name": "awoooi",
+                            "schema_name": "public",
+                            "relation_name": "incidents",
+                            "relation_kind": "table",
+                            "row_security_enabled": True,
+                        }
+                    },
+                )()
+            ]
+
+    class CatalogDatabase:
+        async def execute(self, statement, parameters=None):
+            return CatalogResult()
+
+    class CatalogContext:
+        async def __aenter__(self):
+            return CatalogDatabase()
+
+        async def __aexit__(self, exc_type, exc, traceback):
+            return False
+
+    def fake_db_context(project_id: str | None = None):
+        requested_projects.append(project_id)
+        return CatalogContext()
+
+    monkeypatch.setattr("src.db.base.get_db_context", fake_db_context)
+
+    assets, relationships = asyncio.run(
+        asset_scanner_job._collect_database_catalog_assets()
+    )
+
+    assert requested_projects == ["awoooi"]
+    assert [asset["asset_type"] for asset in assets] == ["database", "table"]
+    assert assets[0]["metadata"]["row_data_read"] is False
+    assert assets[1]["metadata"] == {
+        "database": "awoooi",
+        "schema": "public",
+        "relation_kind": "table",
+        "row_security_enabled": True,
+        "row_data_read": False,
+    }
+    assert relationships == [
+        {
+            "from_key": "postgres/relation/awoooi/public/incidents",
+            "to_key": "postgres/database/awoooi",
+            "relationship_type": "depends_on",
+        }
+    ]