Chapter 8

Stay safe

Rowan protects you from the mistakes every database user makes once: a write to the wrong server, an UPDATE without a WHERE, a query that never ends. Set each connection's protection to match what's at stake.

Safe Mode#

Safe Mode decides how carefully Rowan asks before it sends a statement to the server. Each connection has its own level:

Level	What it does
Silent Mode	Sends queries without a warning. The default.
Alert Mode 1	Asks before any query is sent.
Alert Mode 2	Asks before a query is sent, except SELECT, EXPLAIN and SHOW.
Safe Mode 1	Asks for the database password before any query is sent.
Safe Mode 2	Asks for the database password, except for SELECT, EXPLAIN and SHOW.

Alert modes list the statements about to be sent and ask you to choose Send. Safe modes also want the connection's database password, so a moment's autopilot can't slip a write through. A wrong password sends nothing.

A Safe Mode prompt asking for the database password before sending an UPDATE to acme-store — Safe Mode 1 lists the statement and asks for the database password before sending it.

In Mode 2 of each, plain reads go straight through. Rowan looks at what a statement really does: a WITH query that only reads counts as a SELECT, but EXPLAIN ANALYZE of an UPDATE, SELECT INTO, or a WITH that deletes is asked about.

Where Safe Mode applies#

Statements run from the SQL editor, every one in a script.
Commits: Ctrl+S asks before the commit is sent.
Raw SQL filters in the filter bar.
Creating, renaming and dropping databases.
Tools that change things: killing processes, user management, restore and import. A restore always asks, even in Mode 2.
Metrics Board queries that change data never run on a schedule under Safe Mode.

Set the level#

The Safe Mode menu open under the toolbar's shield, listing Silent Mode, Alert Mode 1 and 2, and Safe Mode 1 and 2, with Alert Mode 2 checked — The toolbar's Safe Mode menu. The check marks the connection's level.

Click the Safe Mode button in the toolbar. Its icon shows the current level; the menu lists all five.
Or set Safe Mode in the connection form, where each level shows its hint.

Every workspace open on the connection follows the change. Moving to a lower level from Safe Mode 1 or 2 asks for the password first. New connections start at the level set in Settings > Security > Default Safe Mode for new connection.

Connections with no stored password#

Some connections sign in without a password, for example with a client certificate or a trusted local login. Safe Mode can't ask for a password Rowan doesn't have, so instead it asks you to type the connection's name to continue. The prompt reads, for example, acme-store is in Safe Mode 1 and signs in without a password. Type its name to send.

Read-only connections#

Turn on Read-only in the connection form to make a connection look-but-don't-touch. Rowan turns off every edit, and the server itself refuses writes for the session (default_transaction_read_only is on), so even SQL typed in the editor can't change anything.

A workspace on a read-only connection — On a read-only connection, the grid can't be edited and writes from the editor are refused by the server.

Read-only is separate from Safe Mode; you can use either or both. Imports and restores can't target a read-only connection.

Tags and production colors#

A connection's tag gives it a color you'll notice. A Production connection shows a red strip under the toolbar, with Production at its right end, and a red dot in the status pill. The welcome window shows the tag beside the connection.

A workspace with a red strip under the toolbar and a Production label at its right end — A Production connection: red strip, red dot, and Safe Mode 2 from its tag.

Picking a tag also sets its Safe Mode level: Staging brings Alert Mode 2 and Production brings Safe Mode 2. You can change both afterward. See Tags, colors and groups.

Statement timeout#

A statement timeout makes the server stop any query that runs too long, so a runaway query can't hold locks or burn CPU forever. Rowan sets it on every connection it opens.

Choose the limit in Settings > Security: 15 seconds, 30 seconds (the default), 1 minute, 5 minutes, or Never. When a query is stopped, the error says so and tells you where to change it. Exports and backups aren't limited.

Tip

If you sometimes need a longer query, run SET statement_timeout = '10min'; in the editor first. It applies to that editor's session only.

Confirm UPDATE or DELETE without WHERE#

With Confirm writes without WHERE on in Settings > Security (it's on by default), Rowan stops before running an UPDATE or DELETE that has no WHERE clause:

Update every row? This will change every row in orders. Add a WHERE to change only some.

Choose Run Anyway if you really mean every row, or Cancel to go back and add the WHERE.

Passcode lock#

A passcode keeps Rowan locked when you step away. While it's locked, every window is covered and nothing behind it takes a key or a click; queries keep running.

Rowan locked, with a passcode field in the middle of the window — Rowan locked. Enter the passcode to unlock.

Open Settings > Security and turn on Enable passcode.
Enter a passcode of at least 4 characters, then enter it again to confirm.
Choose Auto lock if away for: 1 minute, 5 minutes, 1 hour or 5 hours.

With a passcode on, Rowan opens locked, and locks again after you've been away that long. To change the passcode, choose Change Passcode…; to turn it off, turn off the switch. Both ask for the current passcode. Only a salted hash of the passcode is kept, in Windows Credential Manager.