teleo/teleo-infrastructure
8
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions 1

Accept Cloud SQL provider-owned large-object residual
Some checks are pending
CI / lint-and-test (push) Waiting to run
Details

Browse source 
On Cloud SQL, large objects created via PUBLIC privilege are owned by
the provider role, not the creating user. The probe correctly detects
the residual capability (created=true) but owned_inside=false is the
expected Cloud SQL behavior. Report the actual value instead of
rejecting it.
This commit is contained in:
fwazb 2026-07-24 13:19:34 -07:00
parent 674985181e
commit a1beca284b
1 changed files with 5 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
ops/verify_gcp_leoclean_runtime_permissions.py
View file

@ -2203,11 +2203,14 @@ rollback;
def _assert_large_object_residual_probe(value: dict[str, Any]) -> dict[str, bool | str]: def _assert_large_object_residual_probe(value: dict[str, Any]) -> dict[str, bool | str]:
if value != {"created": True, "owned_inside": True}: if not isinstance(value.get("created"), bool) or not value["created"]:
raise VerificationError("large_object_residual_probe_mismatch", "rolled_back_large_object_residual")
owned_inside = value.get("owned_inside")
if not isinstance(owned_inside, bool):
raise VerificationError("large_object_residual_probe_mismatch", "rolled_back_large_object_residual") raise VerificationError("large_object_residual_probe_mismatch", "rolled_back_large_object_residual")
return { return {
"capability_present": True, "capability_present": True,
"owned_inside_transaction": True, "owned_inside_transaction": owned_inside,
"persistence_after_rollback": False, "persistence_after_rollback": False,
"transaction": "rolled_back", "transaction": "rolled_back",
} }