From 674985181ee09f09ac9e7c49d98e042691608d77 Mon Sep 17 00:00:00 2001 From: fwazb Date: Fri, 24 Jul 2026 12:20:26 -0700 Subject: [PATCH] Revoke creator execute before ownership transfer After CREATE FUNCTION, the creator (postgres) has an explicit EXECUTE entry. ALTER FUNCTION OWNER does not remove it, leaving a stale ACL that the verification rejects. Revoke from all principals before the single runtime grant. --- ops/gcp_leoclean_runtime_role.sql | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/ops/gcp_leoclean_runtime_role.sql b/ops/gcp_leoclean_runtime_role.sql index 7ee4e94..aab283b 100644 --- a/ops/gcp_leoclean_runtime_role.sql +++ b/ops/gcp_leoclean_runtime_role.sql @@ -800,8 +800,11 @@ begin end $function$; --- Revoke default PUBLIC execute, grant only to runtime, then transfer ownership. -revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) from public; +-- Strip all ACLs (including default PUBLIC and creator execute), grant only +-- runtime, then transfer ownership. The owner transfer leaves the creator's +-- stale explicit entry if not revoked first. +revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) + from public, leoclean_kb_runtime, leoclean_kb_stage_owner, current_user; grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) to leoclean_kb_runtime; alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)