Repository navigation
fix(blackbox): a branch's start no longer writes 82 entries into its Blackbox - #229
Merged
Merged
Conversation
…Blackbox Each start revoked EXECUTE on dblink's 41 functions from PUBLIC and from db_client again, and the Blackbox records every REVOKE, held or not. Each REVOKE is now issued only while the grant it removes is there.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the two
make integration-v2failures on main since #221/#222 (401/403 → 403/403).Cause
Every time a branch starts,
healDblinkrunsensureDblinkSQL. Since #221 that revokes EXECUTE on each of dblink's 41 functions, once from PUBLIC and once fromdb_client. The Blackbox records every GRANT and REVOKE, even one that changes nothing, so each start added 82 entries with no actor.fox ledger branch-before <id>starts once it's made, so it held 82 entries numbered after the entry it was made before.Fix
Each REVOKE now runs only while the grant it removes exists. The check reads the function's ACL directly, with PUBLIC as grantee 0 and the default ACL for a function that has none.
Tests
Checked on the test VM: a branch's restart now adds 0 entries. A branch given 2 dblink grants lost both on restart, and the Blackbox recorded exactly those 2 REVOKEs.