Repository: edgedb/edgedb

Issue:
`Unexpected 'OWNED'` migrating access policy from child to parent
<!-- Please search existing issues to avoid creating duplicates. -->

<!--
For the EdgeDB Version: run `edgedb query 'select sys::get_version_as_str()'` from your project directory (or run `select sys::get_version_as_str();` in the EdgeDB interactive shell).
For the EdgeDB CLI Version: Run `edgedb --version` from anywhere
-->

- EdgeDB Version: 3.0
- EdgeDB CLI Version: 3.3.0+3f6a0a0
- OS Version: macos 13

Steps to Reproduce:

1. Object type with access policy
```
    type Child {
        access policy allow_insert
            allow insert
            using (true);
    }
```
2. Move access policy to new parent
```
    abstract type Parent {
        access policy allow_insert
            allow insert
            using (true);
    }

    type Child extending Parent {

    }
```

```
$  edgedb migration create
did you create object type 'default::Parent'? [y,n,l,c,b,s,q,?]
> y
did you alter object type 'default::Child'? [y,n,l,c,b,s,q,?]
> y
error: EdgeQLSyntaxError: Unexpected 'OWNED'
  ┌─ <statement>:3:43
  │
3 │     ALTER ACCESS POLICY allow_insert DROP OWNED;
  │                                           ^^^^^ error

Rolling back last operation...
did you alter object type 'default::Child'? [y,n,l,c,b,s,q,?]
>
```



Discussion:
Renaming (dropping and reintroducing) the AP serves as a workaround

```
CREATE MIGRATION m14urf2qxeanbqdznuilcjttqokpdwnr33h5xp6ipbksrzijovdzja
    ONTO m1bvfgccaq23pjowmpgisp7kejzu27hx6r2wwyohyz3mhiw46aitpa
{
  ALTER TYPE default::Child {
      DROP ACCESS POLICY allow_insert;
  };
  CREATE ABSTRACT TYPE default::Parent {
      CREATE ACCESS POLICY allow_insert_
          ALLOW INSERT USING (true);
  };
  ALTER TYPE default::Child EXTENDING default::Parent LAST;
};
```
~~Workaround fails if you have anything inheriting from `Child`.~~

```
did you rename access policy 'allow_insert' of object type 'default::ChildChild' to 'allow_insert_'? [y,n,l,c,b,s,q,?]
> y
error: InvalidReferenceError: access policy 'allow_insert' does not exist
  ┌─ <statement>:2:5
  │
2 │     ALTER ACCESS POLICY allow_insert RENAME TO allow_insert_;
  │     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ error

Rolling back last operation...
```

**Simply rejecting the rename with `n` seems to do the trick.**

Resolving patch:
diff --git a/edb/schema/policies.py b/edb/schema/policies.py
--- a/edb/schema/policies.py
+++ b/edb/schema/policies.py
@@ -88,6 +88,17 @@ class AccessPolicy(
         str, default=None, compcoef=0.971, allow_ddl_set=True
     )
 
+    # We don't support SET/DROP OWNED owned on policies so we set its
+    # compcoef to 0.0
+    owned = so.SchemaField(
+        bool,
+        default=False,
+        inheritable=False,
+        compcoef=0.0,
+        reflection_method=so.ReflectionMethod.AS_LINK,
+        special_ddl_syntax=True,
+    )
+
     @classmethod
     def get_schema_class_displayname(cls) -> str:
         return 'access policy'


Test patch:
diff --git a/tests/test_edgeql_data_migration.py b/tests/test_edgeql_data_migration.py
--- a/tests/test_edgeql_data_migration.py
+++ b/tests/test_edgeql_data_migration.py
@@ -11229,6 +11229,13 @@ async def test_edgeql_migration_access_policy_01(self):
             }
         """)
 
+        await self.migrate(r"""
+            abstract type Parent {
+                access policy asdf allow all;
+            }
+            type Test2 extending Parent;
+        """)
+
     async def test_edgeql_migration_access_policy_02(self):
         # Make sure policies don't interfere with constraints or indexes
         await self.migrate(r"""