Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

docs(breg): state that the migration role must not hold CREATE on the database in Provision PostgreSQL

Aperta Adatta ai principianti
  • Qualcosa non va?
#2,302 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
82/100
Tipo di issue
Documentazione
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
postgresql
Ambito
databases, documentation

Direzione di ricerca

Leggi la sezione “Provision PostgreSQL” in docs/site/src/content/docs/operate/breg.mdx e confronta le indicazioni sul ruolo con verify_migration_role in crates/registry-breg/src/postgres/roles.rs. Aggiorna la sezione principale per specificare che il ruolo di migrazione non deve essere proprietario del database né disporre di CREATE al suo interno, e aggiungi il commento con le evidenze pertinente. Il lavoro è concluso quando i lettori della configurazione non spaziale possono vedere questo requisito e le autorizzazioni documentate del ruolo corrispondono all’applicazione della regola.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

area:breg area:docs documentation

Problem

docs/site/src/content/docs/operate/breg.mdx, section "Provision PostgreSQL", never says that the migration role must not hold CREATE on the database, and must not own the database (an owner holds CREATE implicitly). The main block revokes database privileges from PUBLIC only (REVOKE ALL ON DATABASE registry FROM PUBLIC;); the only revoke that names the registry roles is REVOKE CREATE ON DATABASE registry FROM PUBLIC, registry_migration, registry_runtime; inside the spatial subsection, so a reader of a non-spatial project has no reason to check it. PostgreSQL does not grant database CREATE to PUBLIC by default, so the risk is an explicit grant or ownership the administrator's own tooling adds (for example CREATE DATABASE registry OWNER registry_migration, or a hosted provider's setup script).

Where

  • Docs: docs/site/src/content/docs/operate/breg.mdx, "Provision PostgreSQL" (lines 140 to 201 on origin/main; identical on jeremi/documents).
  • Enforcement: crates/registry-breg/src/postgres/roles.rs, verify_migration_role (lines 401 to 431 on origin/main). It refuses when has_database_privilege(current_user, current_database(), 'CREATE') is true, as it does for SUPERUSER, BYPASSRLS, CREATEDB and CREATEROLE, with RoleInvariant("migration role has database-level administrative authority"). The same function then requires the migration role to own all five managed schemas (verify_schema_owner).
  • It runs on every apply connection (interlock.rs, acquire_inner, line 286), in schema preparation for bregctl test (schema.rs), and in the maintenance commands.

What goes wrong

The refusal is correct and happens before maintenance, so nothing is written. But the operator is not told why:

  • bregctl apply and bregctl plan report apply.migration.failed with "requires exact-target reconciliation" and suggested action reconcile-failed-migration (see #1381), which sends them to migration reconcile for a database that was never touched.
  • bregctl test most likely reports test.database.unavailable ("recreate the disposable database"), because schema_preparation_error in crates/registry-bregctl/src/test_lifecycle.rs collapses every other StartupError to TestLifecycleError::Database. I did not trace the RoleInvariant to StartupError mapping for this exact case.

During the 2026-10-22 root-cause investigation, the repro databases gave the migration role CREATE on the database and lacked the five managed schemas; the documented setup passed with v0.43.0.

Proposed direction

In the main "Provision PostgreSQL" text (not only the spatial block):

  1. One sentence: the migration role must not own the database or hold CREATE on it; it owns only the five schemas, and test and apply refuse a role with database-level authority.
  2. Optionally add REVOKE CREATE ON DATABASE registry FROM registry_migration, registry_runtime; to the main block, so the spatial block's revoke is not the only one.
  3. Add crates/registry-breg/src/postgres/roles.rs, verify_migration_role to the Evidence comment.

Notes

  • Confirmed in code: the CREATE refusal, its message, where it runs, and the docs text on origin/main.
  • From the triage notes, not reproduced by me: the repro databases' exact grants.
  • Inferred: the bregctl test code for this case.
  • The misleading apply code is #1381; this issue is docs only.
Lingua principale
Rust
Stelle
2
Fork
0
Merge medio
9h 19m
PR unite (30g)
275

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di registrystack/registry-stack

Tutte le issue di registrystack/registry-stack

Issue simili

Altre issue su Rust

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.