Dcntrlized/Maestro
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(db): run schema-level grants against the shared database, not postgres

Browse Source
This commit is contained in:
Admin
2026-08-21 21:05:23 +01:00
parent c916dd4ac8
commit cf51a6be94
2 changed files with 11 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/db/dbctl.go
+10 -6
View File
@@ -106,7 +106,7 @@ func (c *Client) SyncAuthorization(ctx context.Context) error {
script += fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM PUBLIC;\n", quoteIdent(DBName)) script += fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM PUBLIC;\n", quoteIdent(DBName))
} }
out, code, err := c.execPSQL(ctx, id, script) out, code, err := c.execPSQL(ctx, id, DBName, script)
if err != nil { if err != nil {
return fmt.Errorf("apply database authorization: %w", err) return fmt.Errorf("apply database authorization: %w", err)
} }
@@ -128,7 +128,7 @@ func (c *Client) RevokeForService(ctx context.Context, serviceName string) {
return return
} }
script := fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM %s;", quoteIdent(DBName), quoteIdent(serviceName)) script := fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM %s;", quoteIdent(DBName), quoteIdent(serviceName))
out, code, err := c.execPSQL(ctx, id, script) out, code, err := c.execPSQL(ctx, id, DBName, script)
if err != nil || code != 0 { if err != nil || code != 0 {
logger.Warn("Failed to revoke database CONNECT for %s: %v (exit %d): %s", serviceName, err, code, out) logger.Warn("Failed to revoke database CONNECT for %s: %v (exit %d): %s", serviceName, err, code, out)
return return
@@ -261,7 +261,7 @@ func (c *Client) isArmed(ctx context.Context, id string) bool {
func (c *Client) waitReady(ctx context.Context, id string) error { func (c *Client) waitReady(ctx context.Context, id string) error {
const attempts = 30 const attempts = 30
for i := 0; i < attempts; i++ { for i := 0; i < attempts; i++ {
_, code, err := c.execPSQL(ctx, id, "SELECT 1") _, code, err := c.execPSQL(ctx, id, "postgres", "SELECT 1")
if err == nil && code == 0 { if err == nil && code == 0 {
return nil return nil
} }
@@ -277,7 +277,7 @@ func (c *Client) waitReady(ctx context.Context, id string) error {
// existingRoles returns the set of roles currently defined in the database. // existingRoles returns the set of roles currently defined in the database.
func (c *Client) existingRoles(ctx context.Context, id string) map[string]bool { func (c *Client) existingRoles(ctx context.Context, id string) map[string]bool {
have := map[string]bool{} have := map[string]bool{}
out, code, err := c.execPSQL(ctx, id, "SELECT rolname FROM pg_catalog.pg_roles") out, code, err := c.execPSQL(ctx, id, "postgres", "SELECT rolname FROM pg_catalog.pg_roles")
if err != nil || code != 0 { if err != nil || code != 0 {
return have return have
} }
@@ -292,11 +292,15 @@ func (c *Client) existingRoles(ctx context.Context, id string) map[string]bool {
// execPSQL runs a psql statement over the in-container unix socket as the // execPSQL runs a psql statement over the in-container unix socket as the
// postgres superuser (bypassing the mTLS enforcement intentionally — Maestro // postgres superuser (bypassing the mTLS enforcement intentionally — Maestro
// administers the database). It returns trimmed stdout and the exit code. // administers the database). It returns trimmed stdout and the exit code.
func (c *Client) execPSQL(ctx context.Context, id, sql string) (string, int, error) { // execPSQL runs a psql statement over the in-container unix socket as the
// postgres superuser (bypassing the mTLS enforcement intentionally — Maestro
// administers the database), targeting the named database. It returns trimmed
// stdout and the exit code.
func (c *Client) execPSQL(ctx context.Context, id, dbName, sql string) (string, int, error) {
created, err := c.dc.ContainerExecCreate(ctx, id, container.ExecOptions{ created, err := c.dc.ContainerExecCreate(ctx, id, container.ExecOptions{
User: "postgres", User: "postgres",
AttachStdout: true, AttachStdout: true,
Cmd: []string{"psql", "-U", "postgres", "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-tA", "-c", sql}, Cmd: []string{"psql", "-U", "postgres", "-d", dbName, "-v", "ON_ERROR_STOP=1", "-tA", "-c", sql},
}) })
if err != nil { if err != nil {
return "", -1, fmt.Errorf("create psql exec: %w", err) return "", -1, fmt.Errorf("create psql exec: %w", err)
src/lib/db/dbctl_integration_test.go
+1 -1
View File
@@ -68,7 +68,7 @@ func TestSyncAuthorizationIntegration(t *testing.T) {
} }
assert := func(t *testing.T, sql, contains string) { assert := func(t *testing.T, sql, contains string) {
t.Helper() t.Helper()
out, code, err := c.execPSQL(context.Background(), id, sql) out, code, err := c.execPSQL(context.Background(), id, "postgres", sql)
if err != nil || code != 0 { if err != nil || code != 0 {
t.Fatalf("check %q failed (exit %d, err %v): %s", sql, code, err, out) t.Fatalf("check %q failed (exit %d, err %v): %s", sql, code, err, out)
} }