From 026bbd3642f57dacc9c86c7fc29b979f3627bb44 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Sun, 14 Jun 2026 04:10:48 +0000 Subject: [PATCH 1/2] fix(grants): add DEFAULT PRIVILEGES for authenticated/anonymous + error logging - Add ALTER DEFAULT PRIVILEGES for authenticated (SELECT, INSERT, UPDATE, DELETE) and anonymous (SELECT only) on constructive_compute_public and constructive_platform_function_graph_public schemas - Update standalone_schema_access.sql to grant anonymous role USAGE + SELECT on all public schemas (for unauthenticated GraphQL requests) - Add console.error logging to pollExecutionStatus catch blocks so GraphQL failures are visible in browser dev tools instead of silently swallowed - Regenerate sql/ packages for constructive-compute, constructive-platform- function-graph, and constructive-infra-seed --- .../schema/default_table_privs/anonymous.sql | 7 ++++ .../default_table_privs/authenticated.sql | 7 ++++ pgpm/constructive-compute/pgpm.plan | 2 ++ .../schema/default_table_privs/anonymous.sql | 4 +++ .../default_table_privs/authenticated.sql | 4 +++ .../sql/constructive-compute--0.0.1.sql | 6 ++++ .../schema/default_table_privs/anonymous.sql | 1 + .../default_table_privs/authenticated.sql | 1 + .../grants/standalone_schema_access.sql | 35 ++++++++++++++++++- .../sql/constructive-infra-seed--0.0.1.sql | 32 +++++++++++++++++ .../schema/default_table_privs/anonymous.sql | 7 ++++ .../default_table_privs/authenticated.sql | 7 ++++ .../pgpm.plan | 2 ++ .../schema/default_table_privs/anonymous.sql | 4 +++ .../default_table_privs/authenticated.sql | 4 +++ ...ructive-platform-function-graph--0.0.1.sql | 6 ++++ .../schema/default_table_privs/anonymous.sql | 1 + .../default_table_privs/authenticated.sql | 1 + www/src/components/FlowsPanel.tsx | 12 +++---- 19 files changed, 136 insertions(+), 7 deletions(-) create mode 100644 pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql create mode 100644 pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql create mode 100644 pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql create mode 100644 pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql create mode 100644 pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql create mode 100644 pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql create mode 100644 pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql diff --git a/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..b7046266b --- /dev/null +++ b/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1,7 @@ +-- Deploy: schemas/constructive_compute_public/schema/default_table_privs/anonymous +-- made with <3 @ constructive.io + +-- requires: schemas/constructive_compute_public/schema + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" GRANT SELECT ON TABLES TO anonymous; diff --git a/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..eca2cd724 --- /dev/null +++ b/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1,7 @@ +-- Deploy: schemas/constructive_compute_public/schema/default_table_privs/authenticated +-- made with <3 @ constructive.io + +-- requires: schemas/constructive_compute_public/schema + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; diff --git a/pgpm/constructive-compute/pgpm.plan b/pgpm/constructive-compute/pgpm.plan index 0e6585061..54c258b80 100644 --- a/pgpm/constructive-compute/pgpm.plan +++ b/pgpm/constructive-compute/pgpm.plan @@ -17,6 +17,8 @@ schemas/constructive_compute_public/schema/default_function_privs/authenticated schemas/constructive_compute_public/schema/default_seq_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_compute_public/schema/default_seq_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_compute_public/schema/default_table_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables +schemas/constructive_compute_public/schema/default_table_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables +schemas/constructive_compute_public/schema/default_table_privs/anonymous [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add create_partitioned_table schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002636 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add disable_row_level_security schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002637 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add set_comment diff --git a/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..9cd2a4d36 --- /dev/null +++ b/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1,4 @@ +-- Revert: schemas/constructive_compute_public/schema/default_table_privs/anonymous + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" REVOKE SELECT ON TABLES FROM anonymous; diff --git a/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..34239ed77 --- /dev/null +++ b/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1,4 @@ +-- Revert: schemas/constructive_compute_public/schema/default_table_privs/authenticated + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM authenticated; diff --git a/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql b/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql index ea6557f2a..d179ee927 100644 --- a/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql +++ b/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql @@ -41,6 +41,12 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public GRANT ALL ON TABLES TO administrator; +ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public + GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; + +ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public + GRANT SELECT ON TABLES TO anonymous; + CREATE TABLE constructive_compute_public.platform_function_graph_execution_outputs ( created_at timestamptz NOT NULL DEFAULT now() ) PARTITION BY RANGE (created_at); diff --git a/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..d2d50bf64 --- /dev/null +++ b/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1 @@ +-- Verify: schemas/constructive_compute_public/schema/default_table_privs/anonymous diff --git a/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..469126dcd --- /dev/null +++ b/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1 @@ +-- Verify: schemas/constructive_compute_public/schema/default_table_privs/authenticated diff --git a/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql b/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql index 195bc638d..6c95665e6 100644 --- a/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql +++ b/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql @@ -1,7 +1,7 @@ -- Deploy: grants/standalone_schema_access -- made with <3 @ constructive.io -- --- Standalone dev-mode grants for the authenticated role. +-- Standalone dev-mode grants for the authenticated and anonymous roles. -- -- In the monolith, schema USAGE and table SELECT are granted at provisioning -- time by the RLS module. In standalone mode there is no provisioning step, @@ -13,6 +13,10 @@ BEGIN; +-- ═══════════════════════════════════════════════════════════════════════════════ +-- AUTHENTICATED role (full CRUD) +-- ═══════════════════════════════════════════════════════════════════════════════ + -- ─── Schema USAGE ──────────────────────────────────────────────────────────── GRANT USAGE ON SCHEMA constructive_compute_public TO authenticated; GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO authenticated; @@ -46,4 +50,33 @@ GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO a GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_private TO authenticated; GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated; +-- ═══════════════════════════════════════════════════════════════════════════════ +-- ANONYMOUS role (read-only — used by PostGraphile for unauthenticated requests) +-- ═══════════════════════════════════════════════════════════════════════════════ + +-- ─── Schema USAGE ──────────────────────────────────────────────────────────── +GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous; +GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous; +GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous; +GRANT USAGE ON SCHEMA constructive_users_public TO anonymous; + +-- ─── Table SELECT ──────────────────────────────────────────────────────────── +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous; +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous; +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous; +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous; + +-- ─── Sequences (needed if any SELECT depends on sequence currval) ──────────── +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous; +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous; +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous; +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous; + +-- ─── Private schema function execution (for SECURITY DEFINER callers) ──────── +GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous; +GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous; + +GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous; +GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous; + COMMIT; diff --git a/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql b/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql index 0ae55d46b..b6297fe1e 100644 --- a/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql +++ b/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql @@ -193,4 +193,36 @@ GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_privat GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated; +GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous; + +GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous; + +GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous; + +GRANT USAGE ON SCHEMA constructive_users_public TO anonymous; + +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous; + +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous; + +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous; + +GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous; + +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous; + +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous; + +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous; + +GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous; + +GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous; + +GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous; + +GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous; + +GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous; + UPDATE services_public.apis SET anon_role = 'authenticated' WHERE database_id = '00000000-0000-0000-0000-000000000000'; \ No newline at end of file diff --git a/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..8e732122c --- /dev/null +++ b/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1,7 @@ +-- Deploy: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous +-- made with <3 @ constructive.io + +-- requires: schemas/constructive_platform_function_graph_public/schema + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" GRANT SELECT ON TABLES TO anonymous; diff --git a/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..e139da811 --- /dev/null +++ b/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1,7 @@ +-- Deploy: schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated +-- made with <3 @ constructive.io + +-- requires: schemas/constructive_platform_function_graph_public/schema + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; diff --git a/pgpm/constructive-platform-function-graph/pgpm.plan b/pgpm/constructive-platform-function-graph/pgpm.plan index 9c21dc06d..4d374f31e 100644 --- a/pgpm/constructive-platform-function-graph/pgpm.plan +++ b/pgpm/constructive-platform-function-graph/pgpm.plan @@ -16,6 +16,8 @@ schemas/constructive_platform_function_graph_public/schema/default_function_priv schemas/constructive_platform_function_graph_public/schema/default_seq_privs/administrator [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_platform_function_graph_public/schema/default_seq_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_platform_function_graph_public/schema/default_table_privs/administrator [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables +schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables +schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add create_table schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002579 [schemas/constructive_platform_function_graph_public/schema schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table] 2017-08-11T08:11:51Z Constructive # add disable_row_level_security schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002580 [schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add set_comment diff --git a/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..bd44cb9a9 --- /dev/null +++ b/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1,4 @@ +-- Revert: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" REVOKE SELECT ON TABLES FROM anonymous; diff --git a/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..35976907b --- /dev/null +++ b/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1,4 @@ +-- Revert: schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated + + +ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" REVOKE SELECT, INSERT, UPDATE, DELETE ON TABLES FROM authenticated; diff --git a/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql b/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql index 95b12afde..9908124fc 100644 --- a/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql +++ b/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql @@ -39,6 +39,12 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public GRANT ALL ON TABLES TO administrator; +ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public + GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; + +ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public + GRANT SELECT ON TABLES TO anonymous; + CREATE TABLE constructive_platform_function_graph_public.platform_function_graph_commit (); ALTER TABLE constructive_platform_function_graph_public.platform_function_graph_commit diff --git a/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql new file mode 100644 index 000000000..ee4359810 --- /dev/null +++ b/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql @@ -0,0 +1 @@ +-- Verify: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous diff --git a/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql b/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql new file mode 100644 index 000000000..93153bce7 --- /dev/null +++ b/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated.sql @@ -0,0 +1 @@ +-- Verify: schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated diff --git a/www/src/components/FlowsPanel.tsx b/www/src/components/FlowsPanel.tsx index 6a39b4bae..a1eac2de5 100644 --- a/www/src/components/FlowsPanel.tsx +++ b/www/src/components/FlowsPanel.tsx @@ -488,8 +488,8 @@ async function pollExecutionStatus(executionId: string): Promise<{ ? (new Date(n.completedAt || Date.now()).getTime() - new Date(n.startedAt).getTime()) : null, })); - } catch { - // node_states query may fail if schema not yet available + } catch (err) { + console.error('[pollExecutionStatus] node_states query failed:', err); } // Also query invocations for detailed payload/result data @@ -501,8 +501,8 @@ async function pollExecutionStatus(executionId: string): Promise<{ orderBy: ['CREATED_AT_ASC'], }).unwrap(); invocationsArr = invResult?.platformFunctionInvocations?.nodes ?? []; - } catch { - // Invocations query may fail if graphExecutionId filter isn't supported yet + } catch (err) { + console.error('[pollExecutionStatus] invocations query failed:', err); } const nodeStates: Record = {}; @@ -807,8 +807,8 @@ export function FlowsPanel() { pollRef.current = null; setIsExecuting(false); } - } catch { - // Keep polling on transient errors + } catch (pollErr) { + console.error('[execution-poll] transient error:', pollErr); } }, EXECUTION_POLL_MS); } catch (err: unknown) { From 41f33c600f27ec07094746d39d0854a2d170fdf0 Mon Sep 17 00:00:00 2001 From: Dan Lynch Date: Sun, 14 Jun 2026 04:39:02 +0000 Subject: [PATCH 2/2] fix: remove unnecessary anonymous role grants MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Anonymous grants are pointless — standalone mode sets anon_role='authenticated' so all requests (even unauthenticated) use the authenticated role. Only the authenticated DEFAULT PRIVILEGES are needed. --- .../schema/default_table_privs/anonymous.sql | 7 ---- pgpm/constructive-compute/pgpm.plan | 1 - .../schema/default_table_privs/anonymous.sql | 4 --- .../sql/constructive-compute--0.0.1.sql | 3 -- .../schema/default_table_privs/anonymous.sql | 1 - .../grants/standalone_schema_access.sql | 29 ----------------- .../sql/constructive-infra-seed--0.0.1.sql | 32 ------------------- .../schema/default_table_privs/anonymous.sql | 7 ---- .../pgpm.plan | 1 - .../schema/default_table_privs/anonymous.sql | 4 --- ...ructive-platform-function-graph--0.0.1.sql | 3 -- .../schema/default_table_privs/anonymous.sql | 1 - 12 files changed, 93 deletions(-) delete mode 100644 pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql delete mode 100644 pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql delete mode 100644 pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql delete mode 100644 pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql delete mode 100644 pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql delete mode 100644 pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql diff --git a/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index b7046266b..000000000 --- a/pgpm/constructive-compute/deploy/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1,7 +0,0 @@ --- Deploy: schemas/constructive_compute_public/schema/default_table_privs/anonymous --- made with <3 @ constructive.io - --- requires: schemas/constructive_compute_public/schema - - -ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" GRANT SELECT ON TABLES TO anonymous; diff --git a/pgpm/constructive-compute/pgpm.plan b/pgpm/constructive-compute/pgpm.plan index 54c258b80..1e85b59ed 100644 --- a/pgpm/constructive-compute/pgpm.plan +++ b/pgpm/constructive-compute/pgpm.plan @@ -18,7 +18,6 @@ schemas/constructive_compute_public/schema/default_seq_privs/administrator [sche schemas/constructive_compute_public/schema/default_seq_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_compute_public/schema/default_table_privs/administrator [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_compute_public/schema/default_table_privs/authenticated [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables -schemas/constructive_compute_public/schema/default_table_privs/anonymous [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table [schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add create_partitioned_table schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002636 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add disable_row_level_security schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/alterations/alt0000002637 [schemas/constructive_compute_public/tables/platform_function_graph_execution_outputs/table schemas/constructive_compute_public/schema] 2017-08-11T08:11:51Z Constructive # add set_comment diff --git a/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index 9cd2a4d36..000000000 --- a/pgpm/constructive-compute/revert/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1,4 +0,0 @@ --- Revert: schemas/constructive_compute_public/schema/default_table_privs/anonymous - - -ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_compute_public" REVOKE SELECT ON TABLES FROM anonymous; diff --git a/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql b/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql index d179ee927..540187826 100644 --- a/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql +++ b/pgpm/constructive-compute/sql/constructive-compute--0.0.1.sql @@ -44,9 +44,6 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; -ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_compute_public - GRANT SELECT ON TABLES TO anonymous; - CREATE TABLE constructive_compute_public.platform_function_graph_execution_outputs ( created_at timestamptz NOT NULL DEFAULT now() ) PARTITION BY RANGE (created_at); diff --git a/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index d2d50bf64..000000000 --- a/pgpm/constructive-compute/verify/schemas/constructive_compute_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1 +0,0 @@ --- Verify: schemas/constructive_compute_public/schema/default_table_privs/anonymous diff --git a/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql b/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql index 6c95665e6..4b5d911cb 100644 --- a/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql +++ b/pgpm/constructive-infra-seed/deploy/grants/standalone_schema_access.sql @@ -50,33 +50,4 @@ GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO a GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_private TO authenticated; GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated; --- ═══════════════════════════════════════════════════════════════════════════════ --- ANONYMOUS role (read-only — used by PostGraphile for unauthenticated requests) --- ═══════════════════════════════════════════════════════════════════════════════ - --- ─── Schema USAGE ──────────────────────────────────────────────────────────── -GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous; -GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous; -GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous; -GRANT USAGE ON SCHEMA constructive_users_public TO anonymous; - --- ─── Table SELECT ──────────────────────────────────────────────────────────── -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous; -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous; -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous; -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous; - --- ─── Sequences (needed if any SELECT depends on sequence currval) ──────────── -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous; -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous; -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous; -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous; - --- ─── Private schema function execution (for SECURITY DEFINER callers) ──────── -GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous; -GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous; - -GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous; -GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous; - COMMIT; diff --git a/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql b/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql index b6297fe1e..0ae55d46b 100644 --- a/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql +++ b/pgpm/constructive-infra-seed/sql/constructive-infra-seed--0.0.1.sql @@ -193,36 +193,4 @@ GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_privat GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO authenticated; -GRANT USAGE ON SCHEMA constructive_compute_public TO anonymous; - -GRANT USAGE ON SCHEMA constructive_platform_function_graph_public TO anonymous; - -GRANT USAGE ON SCHEMA constructive_infra_public TO anonymous; - -GRANT USAGE ON SCHEMA constructive_users_public TO anonymous; - -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_compute_public TO anonymous; - -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_platform_function_graph_public TO anonymous; - -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_infra_public TO anonymous; - -GRANT SELECT ON ALL TABLES IN SCHEMA constructive_users_public TO anonymous; - -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_compute_public TO anonymous; - -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_platform_function_graph_public TO anonymous; - -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_infra_public TO anonymous; - -GRANT USAGE ON ALL SEQUENCES IN SCHEMA constructive_users_public TO anonymous; - -GRANT USAGE ON SCHEMA constructive_compute_private TO anonymous; - -GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_compute_private TO anonymous; - -GRANT USAGE ON SCHEMA constructive_platform_function_graph_private TO anonymous; - -GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA constructive_platform_function_graph_private TO anonymous; - UPDATE services_public.apis SET anon_role = 'authenticated' WHERE database_id = '00000000-0000-0000-0000-000000000000'; \ No newline at end of file diff --git a/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index 8e732122c..000000000 --- a/pgpm/constructive-platform-function-graph/deploy/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1,7 +0,0 @@ --- Deploy: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous --- made with <3 @ constructive.io - --- requires: schemas/constructive_platform_function_graph_public/schema - - -ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" GRANT SELECT ON TABLES TO anonymous; diff --git a/pgpm/constructive-platform-function-graph/pgpm.plan b/pgpm/constructive-platform-function-graph/pgpm.plan index 4d374f31e..843be5638 100644 --- a/pgpm/constructive-platform-function-graph/pgpm.plan +++ b/pgpm/constructive-platform-function-graph/pgpm.plan @@ -17,7 +17,6 @@ schemas/constructive_platform_function_graph_public/schema/default_seq_privs/adm schemas/constructive_platform_function_graph_public/schema/default_seq_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_sequences schemas/constructive_platform_function_graph_public/schema/default_table_privs/administrator [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_platform_function_graph_public/schema/default_table_privs/authenticated [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables -schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add alter_default_privileges_grant_on_tables schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table [schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add create_table schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002579 [schemas/constructive_platform_function_graph_public/schema schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table] 2017-08-11T08:11:51Z Constructive # add disable_row_level_security schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/alterations/alt0000002580 [schemas/constructive_platform_function_graph_public/tables/platform_function_graph_commit/table schemas/constructive_platform_function_graph_public/schema] 2017-08-11T08:11:51Z Constructive # add set_comment diff --git a/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index bd44cb9a9..000000000 --- a/pgpm/constructive-platform-function-graph/revert/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1,4 +0,0 @@ --- Revert: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous - - -ALTER DEFAULT PRIVILEGES IN SCHEMA "constructive_platform_function_graph_public" REVOKE SELECT ON TABLES FROM anonymous; diff --git a/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql b/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql index 9908124fc..51bd7e885 100644 --- a/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql +++ b/pgpm/constructive-platform-function-graph/sql/constructive-platform-function-graph--0.0.1.sql @@ -42,9 +42,6 @@ ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO authenticated; -ALTER DEFAULT PRIVILEGES IN SCHEMA constructive_platform_function_graph_public - GRANT SELECT ON TABLES TO anonymous; - CREATE TABLE constructive_platform_function_graph_public.platform_function_graph_commit (); ALTER TABLE constructive_platform_function_graph_public.platform_function_graph_commit diff --git a/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql b/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql deleted file mode 100644 index ee4359810..000000000 --- a/pgpm/constructive-platform-function-graph/verify/schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous.sql +++ /dev/null @@ -1 +0,0 @@ --- Verify: schemas/constructive_platform_function_graph_public/schema/default_table_privs/anonymous