6 Commits

Include renames

Author	SHA1	Message	Date
jochen	e0e97a96c4	Report as revoked only what the read-back shows gone, and take back what the reader passed on (review of hq issue 337) ... A reader given a privilege WITH GRANT OPTION that passed it on made the plain revoke fail with dependent privileges exist; the pass still listed the table as revoked and logged it every minute. The pass now retries such a change with CASCADE, which reaches only grants that came from the reader, reads the grants back, reports as revoked only what is gone, and says what is still held and why when anything is.	2026-10-08 22:11:06 +02:00
jochen	8bf50f7555	Revoke the reader's grants as their own grantors and read them back, alter its role only on drift, and report definer functions and views (review of hq issue 337) ... A superuser's REVOKE acts as the table owner, so a grant to the reader made by a role holding GRANT OPTION survived it while the report said revoked. Each grant is now revoked under SET ROLE to its grantor, the grants are read back, and anything still held is reported as a failure. The role was altered every minute with its password in the statement, which a server logging DDL would record and which could collide with a first query; it is now altered only when an attribute, a setting or the password has drifted, one ensure at a time. SECURITY DEFINER functions and views the reader may use reach data without a grant on it, so every pass lists them. The README says the name filter is a backstop and that the read-only session default can be turned off by a statement.	2026-10-08 22:01:57 +02:00
jochen	4f44bf1eb5	Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337) ... mesh_store_reader held pg_read_all_data, so every caller of mesh-store.query and postgres_query could read every column the store holds: the signing key nodes trust, sealed secrets, password hashes. The reader now holds no role; each minute, on every database, its memberships are revoked and its grants brought to what the consumer's contribution lists under readable, minus any column or table whose name says it holds a secret. Before a statement runs, the reader's own session is asked which secret columns it can read and the statement is refused if any; a statement naming a known secret table is refused before it is sent.	2026-10-08 21:43:15 +02:00
jochen	2c15074a0b	Retire only once the same answer has held ten minutes as well as five passes ... Five passes are twenty-five seconds, shorter than a controller restart, a store reconnecting or a file half written; the operator asked for both (hq ADR 0230).	2026-10-06 14:28:21 +02:00
jochen	e68ef88333	Retire a consumer the mesh stops asking for, and delete only on a person's word (hq ADR 0230) ... The hourly release of ADR 0229's brake still ended in the mesh acting alone on a mistake. A consumer now stays active until the same unasked set holds for five passes, waits for a person past three or half of those held, is disabled and marked rather than withdrawn, comes back as it was when asked again, and is deleted only through the provider's delete tool. The backend keeps the mark, so a restart forgets nothing and finds what was withdrawn before.	2026-10-06 13:54:10 +02:00
jochen	d8b4d20886	Port postgres to Go and install the extensions a consumer asks for ... letta crash-loops on 'type "vector" does not exist': pgvector is not a trusted extension, so only the provider's superuser can create it, and the provisioner never did. A contribution may now name extensions; the provider creates each (IF NOT EXISTS, available ones only) in the consumer's database on every pass. Go per the standing rule for a TypeScript module that changes. letta asks for vector.	2026-10-05 23:29:55 +02:00