Repository navigation
store: drop bound args from query trace logs; mgmtapi: cache-only module source for read-only validation - #444
Merged
Conversation
…ule source for read-only validation The pgx tracer forwarded every trace-data key to slog, including the bound query arguments of a failed statement. The logger now skips the "args" key; the SQL, error and timing are still logged. ValidatePipeline (org viewer) linted a strict org's import.git blocks with the fetching module source. It now fetches only for a caller who could save the pipeline (org editor or above, or a writer of one of the org's teams) and reads the module cache for everyone else. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAAVzyeV4HSSNjU8xVWWtE
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TAAVzyeV4HSSNjU8xVWWtE
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two small hardening changes.
Query trace logs omit bound parameters (
internal/store/store.go)The pgx tracer copied every trace-data key into slog, including the values bound to a failed
statement. It now skips the
argskey; the statement, error and timing are still logged. New specinternal/store/store_tracer_test.goruns a failing query and checks the bound value neverappears in the log output.
Read-only validation reads pinned modules from the cache (
internal/mgmtapi/rpc_pipeline.go)ValidatePipelineis an org-viewer RPC, but in a strict org it lintedimport.gitblocks with thefetching module source, which a save uses. The new
validationModulesgives the fetching source onlyto a caller who could save the text (org editor or above, or a writer of one of the org's teams) and
pinnedimport.Cachedto everyone else, including on any error. A cached module is linted exactly asbefore; an uncached one is reported as not fetched. New spec in
internal/mgmtapi/strict_tenants_test.gocovers viewer, org admin and owning-team member.CHANGELOG: two lines under Unreleased.
Testing:
go test ./internal/store/ ./internal/mgmtapi/,make lint(incl. guards).🤖 Generated with Claude Code