teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Revoke creator execute before ownership transfer
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source 
After CREATE FUNCTION, the creator (postgres) has an explicit EXECUTE
entry. ALTER FUNCTION OWNER does not remove it, leaving a stale ACL
that the verification rejects. Revoke from all principals before the
single runtime grant.
This commit is contained in:
fwazb 2026-07-24 12:20:26 -07:00
parent 5c506b6ed1
commit 674985181e
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ops/gcp_leoclean_runtime_role.sql
View file

@ -800,8 +800,11 @@ begin
end
$function$;
-- Revoke default PUBLIC execute, grant only to runtime, then transfer ownership.
revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb) from public;
-- Strip all ACLs (including default PUBLIC and creator execute), grant only
-- runtime, then transfer ownership. The owner transfer leaves the creator's
-- stale explicit entry if not revoked first.
revoke all on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
from public, leoclean_kb_runtime, leoclean_kb_stage_owner, current_user;
grant execute on function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)
to leoclean_kb_runtime;
alter function kb_stage.stage_leoclean_proposal(text, text, text, text, jsonb)