Skip to content

Commit 026bbd3

Browse files
pyramationpyramation
committed
fix(grants): add DEFAULT PRIVILEGES for authenticated/anonymous + error logging
- Add ALTER DEFAULT PRIVILEGES for authenticated (SELECT, INSERT, UPDATE, DELETE) and anonymous (SELECT only) on constructive_compute_public and constructive_platform_function_graph_public schemas - Update standalone_schema_access.sql to grant anonymous role USAGE + SELECT on all public schemas (for unauthenticated GraphQL requests) - Add console.error logging to pollExecutionStatus catch blocks so GraphQL failures are visible in browser dev tools instead of silently swallowed - Regenerate sql/ packages for constructive-compute, constructive-platform- function-graph, and constructive-infra-seed
1 parent da4d6a3 commit 026bbd3

19 files changed

Lines changed: 136 additions & 7 deletions

File tree

‎pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
-- Deploy: schemas/constructive_compute_public/schema/default_table_privs/anonymous
2+
-- made with <3 @ constructive.io
3+
4+
-- requires: schemas/constructive_compute_public/schema
5+
6+
7+
ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" GRANT SELECT ON TABLES TO anonymous;

‎pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
-- Deploy: schemas/constructive_compute_public/schema/default_table_privs/authenticated
2+
-- made with <3 @ constructive.io
3+
4+
-- requires: schemas/constructive_compute_public/schema
5+
6+
7+
ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated;

‎pgpm/constructive-compute/pgpm.plan‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@ schemas/constructive_compute_public/schema/default_function_privs/authenticated
1717
schemas/constructive_compute_public/schema/default_seq_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_sequences
1818
schemas/constructive_compute_public/schema/default_seq_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_sequences
1919
schemas/constructive_compute_public/schema/default_table_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
20+
schemas/constructive_compute_public/schema/default_table_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
21+
schemas/constructive_compute_public/schema/default_table_privs/anonymous [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
2022
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add create_partitioned_table
2123
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002636 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add disable_row_level_security
2224
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002637 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add set_comment

‎pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- Revert: schemas/constructive_compute_public/schema/default_table_privs/anonymous
2+
3+
4+
ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" REVOKE SELECT ON TABLES FROM anonymous;

‎pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- Revert: schemas/constructive_compute_public/schema/default_table_privs/authenticated
2+
3+
4+
ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM authenticated;

‎pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
4141
ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
4242
GRANT ALL ON TABLES TO administrator;
4343

44+
ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
45+
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated;
46+
47+
ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
48+
GRANT SELECT ON TABLES TO anonymous;
49+
4450
CREATE TABLE constructive_compute_public.platform_function_graph_execution_outputs (
4551
created_at timestamptz NOT NULL DEFAULT now()
4652
) PARTITION BY RANGE (created_at);

‎pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
-- Verify: schemas/constructive_compute_public/schema/default_table_privs/anonymous

‎pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
-- Verify: schemas/constructive_compute_public/schema/default_table_privs/authenticated

‎pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql‎

Lines changed: 34 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
-- Deploy: grants/standalone_schema_access
22
-- made with <3 @ constructive.io
33
--
4-
-- Standalone dev-mode grants for the authenticated role.
4+
-- Standalone dev-mode grants for the authenticated and anonymous roles.
55
--
66
-- In the monolith, schema USAGE and table SELECT are granted at provisioning
77
-- time by the RLS module. In standalone mode there is no provisioning step,
@@ -13,6 +13,10 @@
1313

1414
BEGIN;
1515

16+
-- ═══════════════════════════════════════════════════════════════════════════════
17+
-- AUTHENTICATED role (full CRUD)
18+
-- ═══════════════════════════════════════════════════════════════════════════════
19+
1620
-- ─── Schema USAGE ────────────────────────────────────────────────────────────
1721
GRANT USAGE ON SCHEMA constructive_compute_public TO authenticated;
1822
GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO authenticated;
@@ -46,4 +50,33 @@ GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO a
4650
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_private TO authenticated;
4751
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated;
4852

53+
-- ═══════════════════════════════════════════════════════════════════════════════
54+
-- ANONYMOUS role (read-only — used by PostGraphile for unauthenticated requests)
55+
-- ═══════════════════════════════════════════════════════════════════════════════
56+
57+
-- ─── Schema USAGE ────────────────────────────────────────────────────────────
58+
GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous;
59+
GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous;
60+
GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous;
61+
GRANT USAGE ON SCHEMA constructive_users_public TO anonymous;
62+
63+
-- ─── Table SELECT ────────────────────────────────────────────────────────────
64+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous;
65+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
66+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous;
67+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous;
68+
69+
-- ─── Sequences (needed if any SELECT depends on sequence currval) ────────────
70+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous;
71+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
72+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous;
73+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous;
74+
75+
-- ─── Private schema function execution (for SECURITY DEFINER callers) ────────
76+
GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous;
77+
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous;
78+
79+
GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous;
80+
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous;
81+
4982
COMMIT;

‎pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,4 +193,36 @@ GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_privat
193193

194194
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated;
195195

196+
GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous;
197+
198+
GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous;
199+
200+
GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous;
201+
202+
GRANT USAGE ON SCHEMA constructive_users_public TO anonymous;
203+
204+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous;
205+
206+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
207+
208+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous;
209+
210+
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous;
211+
212+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous;
213+
214+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
215+
216+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous;
217+
218+
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous;
219+
220+
GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous;
221+
222+
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous;
223+
224+
GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous;
225+
226+
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous;
227+
196228
UPDATE services_public.apis SET anon_role = 'authenticated' WHERE database_id = '00000000-0000-0000-0000-000000000000';

0 commit comments

Comments
 (0)