audit-3 (critical 1 deploy half): roles.sql rewritten + PG integration test

Browse Source

- one least-privilege role per daemon; cayce_approver is the ONLY writer of
  status=APPROVED / operator_signature / approved columns
- per-table BEFORE triggers reject approval writes from daemon roles
- no literal passwords: refuses to run without the six -v password vars
  (psql exits 3 via missing-table SELECT guard)
- idempotent: revokes + drops trigger/function before recreating
- tests/integration/test_pg_roles.py: applies roles.sql via psql -v, runs a
  full cycle per daemon role (propose -> approve -> execute; compose ->
  approve -> send; plan -> approve -> publish; anchor) and asserts the
  denials; runs the alembic upgrade->downgrade->upgrade round-trip on
  Postgres (point 6). Skips cleanly without a reachable PG.

...

This commit is contained in:

cayce

2026-10-20 02:20:26 +00:00

parent 903c591a06

commit d77409148c

3 changed files with 467 additions and 20 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

tests/integration/__init__.py