@team-semicolon/semicolony-cli 4.18.85 → 4.18.87
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bundle.js +776 -776
- package/migrations/188_skill_retirement_gateway_grants.sql +54 -0
- package/package.json +1 -1
|
@@ -0,0 +1,54 @@
|
|
|
1
|
+
-- 188_skill_retirement_gateway_grants.sql
|
|
2
|
+
--
|
|
3
|
+
-- `semo skill retire` was unreachable through the Gateway. The CLI command,
|
|
4
|
+
-- the `/v1/skill-governance/retirements` route, the service authorization, and
|
|
5
|
+
-- the repository INSERT all exist, but sc_app held only SELECT on
|
|
6
|
+
-- skill_release_retirements, so every governed retirement died as an
|
|
7
|
+
-- unhandled 42501 surfaced to the caller as HTTP 500 (measured 2026-08-03 on
|
|
8
|
+
-- the live operator database).
|
|
9
|
+
--
|
|
10
|
+
-- How the gap survived:
|
|
11
|
+
--
|
|
12
|
+
-- * 165_skill_release_retirements.sql granted SELECT, INSERT, but the ledger
|
|
13
|
+
-- shows it was never applied — applied versions jump 163 -> 167. The table
|
|
14
|
+
-- and view exist from another path that granted SELECT only.
|
|
15
|
+
-- * 182_skill_governance_gateway_runtime_grants.sql re-asserted the runtime
|
|
16
|
+
-- grant contract for every other governed table and omitted the
|
|
17
|
+
-- retirement table and its view entirely.
|
|
18
|
+
-- * The four retirements on record (2026-07-20) were written out of band by
|
|
19
|
+
-- an owner role — their approval_reference carries a `migration-log:`
|
|
20
|
+
-- prefix — so no Gateway retirement had ever run against this grant.
|
|
21
|
+
--
|
|
22
|
+
-- Re-assert the retirement half of the same runtime contract additively, in
|
|
23
|
+
-- 182's shape. INSERT is the whole mutation surface a retirement needs: the
|
|
24
|
+
-- table is append-only and 165's `protect_skill_release_retirements` trigger
|
|
25
|
+
-- already rejects UPDATE and DELETE, so no wider grant is warranted and the
|
|
26
|
+
-- REVOKE below strips any that drifted in.
|
|
27
|
+
--
|
|
28
|
+
-- The runner owns the transaction boundary, so no BEGIN/COMMIT here, and it
|
|
29
|
+
-- retargets the `semicolony.` qualifier to the active schema.
|
|
30
|
+
|
|
31
|
+
DO $$
|
|
32
|
+
BEGIN
|
|
33
|
+
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sc_app') THEN
|
|
34
|
+
RAISE EXCEPTION 'sc_app role missing; cannot grant skill retirement privileges';
|
|
35
|
+
END IF;
|
|
36
|
+
|
|
37
|
+
IF (SELECT rolsuper FROM pg_roles WHERE rolname = 'sc_app') THEN
|
|
38
|
+
RAISE EXCEPTION 'sc_app unexpectedly holds superuser; refusing to widen an already-privileged role';
|
|
39
|
+
END IF;
|
|
40
|
+
END
|
|
41
|
+
$$;
|
|
42
|
+
|
|
43
|
+
REVOKE ALL ON TABLE
|
|
44
|
+
semicolony.skill_release_retirements,
|
|
45
|
+
semicolony.v_current_skill_release_retirements
|
|
46
|
+
FROM PUBLIC, sc_app;
|
|
47
|
+
|
|
48
|
+
GRANT SELECT, INSERT ON TABLE
|
|
49
|
+
semicolony.skill_release_retirements
|
|
50
|
+
TO sc_app;
|
|
51
|
+
|
|
52
|
+
GRANT SELECT ON TABLE
|
|
53
|
+
semicolony.v_current_skill_release_retirements
|
|
54
|
+
TO sc_app;
|