novox/mesh-catalog
18
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Providers read the seat's plans and retire only on the operator's yes, removing the credential

Browse Source 
ADR 0570 clauses 2 and 5: gitea, keycloak, postgres and route-adapter read mesh-provisioner.plans and
.provisions instead of the controller's assignments. postgres hands the database to a keeper and drops the
login; keycloak replaces the client's secret and keeps the client, so the data stays (issue 1954, V4).
This commit is contained in:
jschoubben
2026-10-30 00:00:00 +01:00
parent 6e5fd647c0
commit 4a329f0443
30 changed files with 347 additions and 97 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/postgres/cmd/postgres-provider/provisioner.go
+9 -6
View File
@@ -35,10 +35,14 @@ func (a provisioner) Create(ctx context.Context, p harness.Provision) error {
if err := a.pg.CreateDatabaseAndRole(ctx, database, p.As, p.Password); err != nil {
return err
}
// A login retired and asked for again takes back what its keeper kept (retire_pg.go).
if err := a.pg.Reclaim(ctx, database, p.As); err != nil {
return err
}
if err := a.pg.EnsureExtensions(ctx, database, extensions); err != nil {
return err
}
// The active mark: a retired consumer asked for again loses its mark to delete here, its LOGIN
// The active mark: a login locked before ADR 0570 and asked for again loses its mark to delete here, its LOGIN
// already set again by the role statement above (novox/hq ADR 0230).
if err := a.pg.MarkActive(ctx, p.As, p.Consumer); err != nil {
return err
@@ -47,11 +51,10 @@ func (a provisioner) Create(ctx context.Context, p harness.Provision) error {
return nil
}
// Retire locks the login, never drops (novox/hq issue 241, ADR 0230): the database is kept under its
// own name, the role marked retired with when and why (retire_pg.go). On 2026-10-04 a misread
// contributions file withdrew every consumer at once, and dropping made that a loss of seven databases.
// Deleting is `cleanup delete`, a person's act; taking a database out of service by hand is
// postgres_retire_database, which renames rather than drops.
// Retire removes the login on the operator's yes (novox/hq ADR 0570 clause 5, ADR 0114 §2): what it owns is handed
// to its keeper, its sessions end and the login is dropped; the database and its data are kept (retire_pg.go).
// Deleting is `cleanup delete`, a person's act; taking a database out of service by hand is postgres_retire_database,
// which renames rather than drops.
func (a provisioner) Retire(ctx context.Context, as string, _ map[string]any, why string, at time.Time) error {
if err := a.pg.RetireRole(ctx, as, why, at); err != nil {
return err