teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Merge pull request #244 from living-ip/fix/cloudsql-staging-function-provision-order
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source 
Fix Cloud SQL staging-function provisioning order
This commit is contained in:
Fawaz 2026-07-23 22:42:17 -07:00 committed by GitHub
commit 15219d7116
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 6 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
ops/gcp_leoclean_runtime_role.sql
View file

@ -799,15 +799,11 @@ begin
end end
$function$; $function$;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
owner to leoclean_kb_stage_owner;
revoke create on schema kb_stage from leoclean_kb_stage_owner;
-- Normalize explicit ACL entries left by CREATE OR REPLACE or an earlier grant. -- Normalize explicit ACL entries left by CREATE OR REPLACE or an earlier grant.
-- A newly-created function starts with owner EXECUTE, while CREATE OR REPLACE -- A newly-created function starts with owner EXECUTE, while CREATE OR REPLACE
-- preserves an existing ACL on reruns. Revoke every scoped/default entry here -- preserves an existing ACL on reruns. Revoke every scoped/default entry here
-- so the first successful provision already has the same runtime-only ACL as -- while postgres still owns the function, so Cloud SQL's cloudsqlsuperuser
-- every later provision. -- privilege is sufficient for the revoke.
revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
from public, leoclean_kb_runtime, leoclean_kb_stage_owner; from public, leoclean_kb_runtime, leoclean_kb_stage_owner;
select format( select format(
@ -828,6 +824,10 @@ select format(
grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
to leoclean_kb_runtime; to leoclean_kb_runtime;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
owner to leoclean_kb_stage_owner;
revoke create on schema kb_stage from leoclean_kb_stage_owner;
select format('revoke leoclean_kb_stage_owner from %I', current_user) select format('revoke leoclean_kb_stage_owner from %I', current_user)
where current_user <> 'leoclean_kb_stage_owner' where current_user <> 'leoclean_kb_stage_owner'
\gexec \gexec