fix(db): provision the runtime login without requiring SUPERUSER - #69
Open
yufoxda wants to merge 2 commits into
Open
fix(db): provision the runtime login without requiring SUPERUSER#69yufoxda wants to merge 2 commits into
yufoxda wants to merge 2 commits into
Conversation
The provisioning runbook restated every role attribute in an ALTER ROLE after creating the role. Changing the SUPERUSER attribute requires SUPERUSER, which the operator role is not on a managed platform: on Supabase the whole runbook failed with "permission denied to alter role", so the dedicated login could never be created and the Workers had to keep connecting as postgres — the BYPASSRLS role the rest of this work exists to stop using. The ALTER now only sets the password. The attributes are already set by the CREATE above, and the branch that handles a pre-existing role verifies them before reaching this point, so nothing is weakened. Also renames the example role from app_runtime_login to app_runtime. In PostgreSQL a role with LOGIN is a login role, so the suffix said nothing, and app_runtime matches both the app_rls/app_api/app_auth naming already in the database and the "runtime role" wording the Workers use when they reject an unsafe login. Found while applying this to the production database, which now runs as app_runtime: not a superuser, no BYPASSRLS, inherits app_rls. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
…secrets Promoting the first admin still joined public.account, which the schema split moved to app_auth, so the runbook failed before it could grant the role. That was an oversight in the split, not a separate change. The deployment order also never said which secrets each Worker needs, and three separate outages during the production rollout came from that: member had no DISCORD_TOKEN or DISCORD_GUILD_ID and answered 500 on every application, and frontend had no JWT_SECRET, so its middleware threw on each request and put the site in a redirect loop between / and /login. Both are new requirements of this release that an existing deployment cannot have. Adds the per-Worker table, notes that a deploy can drop values that were only set through the dashboard, and records that DATABASE_URL should stay unset in production rather than keeping a credential that would bypass the dedicated runtime role. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
本番DBへ適用する作業中に見つかった、runbook のバグ修正です。
何が起きたか
provision_app_runtime_login.sqlはロールを作成した後、ALTER ROLE ... nosuperuser nocreatedb nocreaterole noreplication nobypassrls password ...で全属性を再指定していました。SUPERUSER属性の変更には SUPERUSER 権限が必要です。Supabase のpostgresは superuser ではありません(実測:rolsuper=false)。そのため runbook 全体がで失敗し、専用ログインを作成できませんでした。結果として Workers は
postgres(rolbypassrls=true)で接続し続けるしかなく、今回の一連の作業が防ごうとしていた「RLSを素通りできる資格情報でアプリが動く」状態が解消できません。修正
ALTER ROLEをパスワード設定のみに変更しました。CREATE ROLEで設定済みしたがって安全性は何も緩んでいません。
ロール名の変更
例示ロール名を
app_runtime_login→app_runtimeに変更しました。_loginは重複app_rls/app_api/app_authの命名と揃うUnsafe database runtime role)とも一致runbook のファイル名は据え置きです(「app runtime login を用意する手順書」という意味では正しいため)。
検証
本番DBで実際に適用し、動作を確認しています。
app_runtime作成superuser=false/bypassRLS=false/app_rls継承)gradesgrades🤖 Generated with Claude Code