CXH-2461: enforce unique role_name in Postgres test fixture - #154
al-conductorone wants to merge 1 commit into
Conversation
The shipped Postgres specs key the role resource id on role_name (id: ".role_name") and build feature-grant entitlement ids as 'role:' + .role_name + ':member', both assuming role_name is unique. The roles table had no UNIQUE constraint, so re-applying the init script against an existing DB appended a second admin/user/reader set, producing two role_name='user' rows and an ambiguous role:user:member entitlement that blocked the grant_replace path. Add UNIQUE to roles.role_name (matching sqlserver-init.sql) so a duplicate role name is rejected at the schema level and each role maps 1:1 to an entitlement.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| CREATE TABLE roles ( | ||
| id SERIAL PRIMARY KEY, | ||
| role_name VARCHAR(100) NOT NULL | ||
| role_name VARCHAR(100) NOT NULL UNIQUE |
There was a problem hiding this comment.
🟡 Suggestion: This matches what examples/postgres-test.yml already assumes (role resource id: ".role_name"), and the seeded values admin/user/reader are already distinct, so the constraint is safe. For parity, test/mysql-init.sql:66 has the same roles.role_name column without UNIQUE while examples/mysql-test.yml:310 also derives the role resource ID from .role_name — worth adding the same constraint there (test/sqlserver-init.sql:23 already has it).
Connector PR Review: CXH-2461: enforce unique role_name in Postgres test fixtureBlocking Issues: 0 | Suggestions: 1 | Threads Resolved: 0 Review SummaryScanned the full PR diff for security and correctness: it is a one-line change adding Security IssuesNone found. Correctness IssuesNone found. Suggestions
Prompt for AI agents |
3 participants
Makes each role in the Postgres test database unique, so a role maps 1:1 to its access grant and the connector's grant-replacement test can run against the repo's own fixture (CXH-2461).