From 5c506b6ed1ee6c5149880037b65f1949a8a99576 Mon Sep 17 00:00:00 2001 From: fwazb Date: Fri, 24 Jul 2026 12:15:50 -0700 Subject: [PATCH] Revoke default PUBLIC execute on staging function PostgreSQL grants EXECUTE to PUBLIC on every new function by default. The verification block correctly rejects this, so revoke it before granting the runtime role. --- ops/gcp_leoclean_runtime_role.sql | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ops/gcp_leoclean_runtime_role.sql b/ops/gcp_leoclean_runtime_role.sql index 3755124..7ee4e94 100644 --- a/ops/gcp_leoclean_runtime_role.sql +++ b/ops/gcp_leoclean_runtime_role.sql @@ -800,7 +800,8 @@ begin end $function$; --- Fresh function has no stale ACLs. Grant runtime, transfer ownership, done. +-- Revoke default PUBLIC execute, grant only to runtime, then transfer ownership. +revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) from public; grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) to leoclean_kb_runtime; alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)