jochen 4f44bf1eb5 Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337) ...

mesh_store_reader held pg_read_all_data, so every caller of mesh-store.query
and postgres_query could read every column the store holds: the signing key
nodes trust, sealed secrets, password hashes. The reader now holds no role;
each minute, on every database, its memberships are revoked and its grants
brought to what the consumer's contribution lists under readable, minus any
column or table whose name says it holds a secret. Before a statement runs,
the reader's own session is asked which secret columns it can read and the
statement is refused if any; a statement naming a known secret table is
refused before it is sent.

2026-10-08 21:43:15 +02:00

..

postgres-provider

Give the store's reader only the columns a module declares readable, never a secret, so a query cannot read the controller's signing key (hq issue 337)

2026-10-08 21:43:15 +02:00