teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Normalize Cloud SQL identity addresses

Browse source
This commit is contained in:
fwazb 2026-07-23 18:56:39 -07:00
parent f3a7650a2d
commit 75ee585814
5 changed files with 13 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
hermes-agent/leoclean-bin/cloudsql_memory_tool.py
View file

@ -879,7 +879,7 @@ def database_read_marker(args: argparse.Namespace) -> dict[str, Any]:
select jsonb_build_object(
'database', current_database(),
'database_user', current_user,
'server_addr', inet_server_addr()::text,
'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),
'server_port', inet_server_port(),
'ssl', coalesce((select ssl from pg_catalog.pg_stat_ssl where pid = pg_backend_pid()), false),
'ssl_version', (select version from pg_catalog.pg_stat_ssl where pid = pg_backend_pid()),

2
ops/derive_leoclean_runtime_query_contract.py
View file

@ -48,7 +48,7 @@ DYNAMIC_SQL_VALUE = "__teleo_dynamic_sql_value__"
UNREVIEWED_DYNAMIC_SQL = "__teleo_unreviewed_dynamic_sql__"
REVIEWED_SQL_INTERPOLATION_CALLS = frozenset({"sql_array", "sql_integer", "sql_json_array", "sql_literal"})
QUERY_RUNNERS = frozenset({"run_psql", "psql_json_lines"})
REVIEWED_RUNTIME_SOURCE_SHA256 = "5f98218622803e0a1bbedc1e23e538d1f152ecb516e31a387a5eb39080aaf2cd"
REVIEWED_RUNTIME_SOURCE_SHA256 = "f86bf2236a4b47ec8af29c83e1fd1a4b6e7ef27dd894f62f4acf5985fe3277d4"
DYNAMIC_CALL_BUILTINS = frozenset({"eval", "exec", "globals", "locals"})
READ_CAPABILITY = "read"
STAGE_PROPOSAL_CAPABILITY = "stage-proposal"

2
ops/verify_gcp_leoclean_runtime_permissions.py
View file

@ -1028,7 +1028,7 @@ select pg_catalog.jsonb_build_object(
'database', pg_catalog.current_database(),
'current_user', current_user,
'session_user', session_user,
'server_addr', pg_catalog.inet_server_addr()::text,
'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),
'server_port', pg_catalog.inet_server_port(),
'ssl', coalesce(
(select ssl from pg_catalog.pg_stat_ssl where pid = pg_catalog.pg_backend_pid()),

5
tests/test_gcp_leoclean_runtime_permissions.py
View file

@ -1513,6 +1513,11 @@ def test_catalog_queries_use_exact_regprocedure_signatures_and_both_membership_d
catalog_sql = verifier._catalog_privilege_posture_sql()
assert "lo_compat_privileges" in identity_sql
assert (
"'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),"
in identity_sql
)
assert "pg_catalog.inet_server_addr()::text" not in identity_sql
assert "pg_catalog.to_regprocedure(signature)" in function_sql
for _name, signature, _exists, _execute in verifier.FUNCTION_PRIVILEGE_EXPECTATIONS:
assert signature in function_sql

6
tests/test_hermes_leoclean_kb_bridge_source.py
View file

@ -1072,7 +1072,11 @@ def test_cloudsql_runtime_read_marker_binds_database_user_private_server_and_ssl
assert module.database_read_marker(args) == marker
assert captured["db"] == module.RUNTIME_CLOUDSQL_DB
assert "inet_server_addr()" in str(captured["sql"])
assert (
"'server_addr', pg_catalog.host(pg_catalog.inet_server_addr()),"
in str(captured["sql"])
)
assert "inet_server_addr()::text" not in str(captured["sql"])
assert "pg_stat_ssl" in str(captured["sql"])