Skip to content

Commit 41f33c6

Browse files
pyramationpyramation
committed
fix: remove unnecessary anonymous role grants
Anonymous grants are pointless — standalone mode sets anon_role='authenticated' so all requests (even unauthenticated) use the authenticated role. Only the authenticated DEFAULT PRIVILEGES are needed.
1 parent 026bbd3 commit 41f33c6

12 files changed

Lines changed: 0 additions & 93 deletions

File tree

‎pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎pgpm/constructive-compute/pgpm.plan‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ schemas/constructive_compute_public/schema/default_seq_privs/administrator [sche
1818
schemas/constructive_compute_public/schema/default_seq_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_sequences
1919
schemas/constructive_compute_public/schema/default_table_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
2020
schemas/constructive_compute_public/schema/default_table_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
21-
schemas/constructive_compute_public/schema/default_table_privs/anonymous [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
2221
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add create_partitioned_table
2322
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002636 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add disable_row_level_security
2423
schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002637 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add set_comment

‎pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

‎pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -44,9 +44,6 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
4444
ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
4545
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated;
4646

47-
ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public
48-
GRANT SELECT ON TABLES TO anonymous;
49-
5047
CREATE TABLE constructive_compute_public.platform_function_graph_execution_outputs (
5148
created_at timestamptz NOT NULL DEFAULT now()
5249
) PARTITION BY RANGE (created_at);

‎pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql‎

Lines changed: 0 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -50,33 +50,4 @@ GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO a
5050
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_private TO authenticated;
5151
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated;
5252

53-
-- ═══════════════════════════════════════════════════════════════════════════════
54-
-- ANONYMOUS role (read-only — used by PostGraphile for unauthenticated requests)
55-
-- ═══════════════════════════════════════════════════════════════════════════════
56-
57-
-- ─── Schema USAGE ────────────────────────────────────────────────────────────
58-
GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous;
59-
GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous;
60-
GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous;
61-
GRANT USAGE ON SCHEMA constructive_users_public TO anonymous;
62-
63-
-- ─── Table SELECT ────────────────────────────────────────────────────────────
64-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous;
65-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
66-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous;
67-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous;
68-
69-
-- ─── Sequences (needed if any SELECT depends on sequence currval) ────────────
70-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous;
71-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
72-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous;
73-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous;
74-
75-
-- ─── Private schema function execution (for SECURITY DEFINER callers) ────────
76-
GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous;
77-
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous;
78-
79-
GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous;
80-
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous;
81-
8253
COMMIT;

‎pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql‎

Lines changed: 0 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -193,36 +193,4 @@ GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_privat
193193

194194
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated;
195195

196-
GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous;
197-
198-
GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous;
199-
200-
GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous;
201-
202-
GRANT USAGE ON SCHEMA constructive_users_public TO anonymous;
203-
204-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous;
205-
206-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
207-
208-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous;
209-
210-
GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous;
211-
212-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous;
213-
214-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous;
215-
216-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous;
217-
218-
GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous;
219-
220-
GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous;
221-
222-
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous;
223-
224-
GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous;
225-
226-
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous;
227-
228196
UPDATE services_public.apis SET anon_role = 'authenticated' WHERE database_id = '00000000-0000-0000-0000-000000000000';

‎pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 0 additions & 7 deletions
This file was deleted.

‎pgpm/constructive-platform-function-graph/pgpm.plan‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,6 @@ schemas/constructive_platform_function_graph_public/schema/default_seq_privs/adm
1717
schemas/constructive_platform_function_graph_public/schema/default_seq_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_sequences
1818
schemas/constructive_platform_function_graph_public/schema/default_table_privs/administrator [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
1919
schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
20-
schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add alter_default_privileges_grant_on_tables
2120
schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add create_table
2221
schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002579 [schemas/constructive_platform_function_graph_public/schema schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add disable_row_level_security
2322
schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002580 [schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive <developers@constructive.io> # add set_comment

‎pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql‎

Lines changed: 0 additions & 4 deletions
This file was deleted.

0 commit comments

Comments
 (0)