First section of #23. The console still connects as before; this section
puts in place the role its runtime user will hold.
Each stream's new migration grants its writer, and SELECT on its goose
ledger, to console_runtime, a NOLOGIN role core creates, and revokes the
writer from member_console where an earlier release granted it there.
The five baselines no longer grant a writer to any login, so a fresh
install needs no role of a particular name.
The baselines granted ALL on their tables to the writers, which gave the
runtime path TRUNCATE, REFERENCES, TRIGGER and MAINTAIN as well. With
TRIGGER, a user holding the writer could put a trigger on an ordinary
table; a SECURITY DEFINER function's write to that table then ran the
trigger as the function's owner, which wrote the enclosed tables
directly. Each stream's writer_dml_only migration revokes the four, and
TestRuntimeRolePrivileges fails, naming the relation and the privilege,
when console_runtime holds any of them, holds a column grant that reopens
a write, or is denied a write it needs.
The enclosure tests now drop to console_runtime instead of core_writer
or a copied role, and the conferral enclosure test probes TRUNCATE,
CREATE TRIGGER and LOCK TABLE on the three position tables.
Full suite on reset databases: 4195 pass, 15 skip; one failure,
TestIntegrationSettingsWalkthrough's missing toast (#222), passed when
run alone. make lint passes.
Deliberate breaks, scripts/mutation-check -side new, all CAUGHT (39):
core 00029 without GRANT core_writer TO console_runtime
fedwiki 00005 grants domains_writer in place of fedwiki_writer
stripe 00006 without its revoke from member_console
discourse 00004 without its ledger grant (two tests)
domains 00003 without GRANT domains_writer TO console_runtime
domains 00003's revoke without its guard
core and discourse baselines with the login grant restored
core 00029's Down revokes core_writer from console_runtime
domains 00003's Down revokes domains_writer from console_runtime
core 00029's Down drops the role without its dependency handler
core 00029's Down grants core_writer back to member_console
core 00030 emptied (catalog test, three probes)
core 00030 leaves TRIGGER (catalog test, probe)
core 00030 revokes from two position tables only
the domains, fedwiki, stripe and discourse writer_dml_only emptied
GRANT ALL on integration_config_overrides appended after the revoke
00009's grant loses core_writer
00027's SELECT on acts becomes SELECT, INSERT (two tests)
00005's revoke loses INSERT; 00024's SELECT becomes SELECT, INSERT
core 00029 also grants INSERT, or TRIGGER, on pool_provisions (four)
column UPDATE and REFERENCES grants on pool_provisions, column
UPDATE on the outbox's subject_id
test side: the membership assertion without its fedwiki_writer
exception; a locked entry for a table that does not exist
The two converted checks were not run on the old side.
cgalo5758
028e2ef448