From 7f78016f0749d19759a26b8ffc2fa5615fa14b93 Mon Sep 17 00:00:00 2001 From: jochen Date: Thu, 8 Oct 2026 22:11:16 +0200 Subject: [PATCH] Issue 337: say that only what is gone is reported revoked, and that a grant the reader passed on is taken back with CASCADE --- .../01-diagnosis.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md b/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md index 5bdbdfa7..105707e4 100644 --- a/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md +++ b/04-ISSUES/337-the-stores-reader-can-read-the-controllers-signing-key/01-diagnosis.md @@ -88,7 +88,10 @@ mesh-catalog pull request 143, in the `postgres` module: 4. **Reconciled every minute, on every database.** Each grant the reader holds that is not declared is revoked as the role that granted it, because a superuser's revoke acts as the table's owner and leaves a grant made by another role holding grant option. The grants are then read back, and anything - the reader still holds that is not declared is reported as a failure, never as revoked. Declared + the reader still holds that is not declared is reported as a failure with its reason, and only what + the read-back shows gone is reported as revoked. If the reader was given a privilege with grant + option and passed it on, a plain revoke fails, and the pass revokes with `CASCADE`, which reaches only + the grants that came from the reader. Declared columns that are missing are granted. The reader's role is altered only when an attribute, a setting or its password has drifted, so its password is not sent every minute. `postgres_reader_grants` answers the last pass, by name only.