fix(db): correct backend_reader grants to real indexer tables (#1524) - #1672
Open
ogaziedaniel80-droid wants to merge 1 commit into
Open
ogaziedaniel80-droid wants to merge 1 commit into
ogaziedaniel80-droid wants to merge 1 commit into
Conversation
…dstudio#1524) The DO $$ block in db/baseline-schema.sql was granting SELECT on 'raffle' and 'participant', neither of which exist. Because every GRANT was wrapped in IF EXISTS, the block silently did nothing, leaving the ownership boundary from crackedstudio#1468 completely unenforced. Changes: - db/baseline-schema.sql: replace the two phantom table names with the 12 real names sourced from each @entity(...) decorator; swap the silent IF-EXISTS skip for RAISE WARNING so missing tables are visible rather than swallowed. - indexer migration 1780000000000-GrantBackendReaderRole: applies the correct grants at deploy time; throws a hard error (not a silent skip) if any listed table is absent when it runs. - all-migrations.ts: register the new migration in canonical order. - migration-smoke.integration.spec.ts: add the new migration name to the ordered assertion. - backend-reader-role.integration.spec.ts (new): spins up a Testcontainers Postgres instance, creates a backend_reader_login user with the role granted, then asserts SELECT succeeds and INSERT is rejected with PG error 42501 on every indexer-owned table.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Closes #1524
db/baseline-schema.sqlgranted SELECT tobackend_readeron'raffle'and
'participant'. Neither table exists. Because every grant was wrappedin
IF EXISTS, the block silently did nothing — the ownership boundaryfrom #1468 was completely unenforced in every environment.
Changes
db/baseline-schema.sql@Entity(...)decorators). Replace silentIF EXISTSskip withRAISE WARNING ... CONTINUEso missing tables are visible.indexer/.../1780000000000-GrantBackendReaderRole.tsindexer/.../helpers/all-migrations.tsindexer/.../migration-smoke.integration.spec.tsindexer/.../backend-reader-role.integration.spec.tsbackend_reader_loginwith the role granted, assertsSELECT COUNT(*)passes andINSERT … DEFAULT VALUESis rejected with PG error42501(insufficient_privilege) on every indexer-owned table.Testing
cd indexer && npx jest --config jest.integration.config.js
New spec:
backend-reader-role.integration.spec.ts— SELECT allowed / INSERT denied for all 12 tables.Acceptance criteria (from #1524)
backend_readeris granted SELECT on every real indexer-owned table42501)