teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Revoke default PUBLIC execute on staging function
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source 
PostgreSQL grants EXECUTE to PUBLIC on every new function by default.
The verification block correctly rejects this, so revoke it before
granting the runtime role.
This commit is contained in:
fwazb 2026-07-24 12:15:50 -07:00
parent 7e1d57ef6f
commit 5c506b6ed1
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
ops/gcp_leoclean_runtime_role.sql
View file

@ -800,7 +800,8 @@ begin
end
$function$;
-- Fresh function has no stale ACLs. Grant runtime, transfer ownership, done.
-- Revoke default PUBLIC execute, grant only to runtime, then transfer ownership.
revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) from public;
grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
to leoclean_kb_runtime;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)