fix: the check database keeps CONNECT for PUBLIC, so a pair can reseed #2

Merged

navigator merged 1 commit from fix/check-db-connect-public into main

2026-10-16 04:45:25 -03:00

navigator commented

2026-10-16 04:42:02 -03:00

Owner

Found by the LNPP pair test on hw12-br1 (2026-10-16): the reseed of the replica failed with permission denied for database keel_check. keel's reseed probe asks pg_database_size() of every database as the replication role, which needs CONNECT.

40lnpp-check keeps PostgreSQL's default CONNECT for PUBLIC. PUBLIC still has no privilege on the table.
tests/check-hook.bats checks that the REVOKE is gone.
Release 19.0-2.

Found by the LNPP pair test on hw12-br1 (2026-10-16): the reseed of the replica failed with `permission denied for database keel_check`. keel's reseed probe asks `pg_database_size()` of every database as the replication role, which needs CONNECT. - `40lnpp-check` keeps PostgreSQL's default CONNECT for PUBLIC. PUBLIC still has no privilege on the table. - `tests/check-hook.bats` checks that the REVOKE is gone. - Release 19.0-2.

navigator added 1 commit

2026-10-16 04:42:02 -03:00

fix: the check database keeps CONNECT for PUBLIC, so a pair can reseed

tests / package (pull_request) Successful in 5s

Details

tests / appliance (pull_request) Successful in 9s

Details

tests / python (pull_request) Successful in 20s

Details

tests / tests (pull_request) Successful in 36s

Details

security / security (pull_request) Successful in 58s

Details

tests / stack (pull_request) Successful in 1m56s

Details

8919c072eb

keel's reseed of a PostgreSQL pair asks pg_database_size() of every
database as the replication role, and that needs CONNECT. The REVOKE
of 40lnpp-check made the reseed of the replica fail on hw12-br1:
"permission denied for database keel_check". PUBLIC has no privilege
on the table, so the page account still only reads. Release 19.0-2.