WikiDeck/wikideck
3
0
Fork 1
Code Issues 8 Pull Requests Actions Packages Projects 2 Releases Wiki Activity

Separate one-shot utility

Browse Source
This commit is contained in:
eric
2026-10-20 23:04:29 -04:00
parent ccc6eef951
commit 5b21074462
18 changed files with 462 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/custody-deployment-init.ts
+12 -3
View File
@@ -11,17 +11,26 @@ try {
const admin = new Pool(await config('admin'));
try {
const ownerConfig = await config('owner'), runtimeConfig = await config('runtime');
for (const [role, password] of [['custody_owner', ownerConfig.password], ['custody_runtime', runtimeConfig.password]] as const) {
const backupConfig = await postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: '/secrets/backup/url',
WIKIDECK_CUSTODY_PG_CA_FILE: '/secrets/backup/ca.crt' });
for (const [role, password] of [['custody_owner', ownerConfig.password], ['custody_runtime', runtimeConfig.password],
['custody_backup', backupConfig.password]] as const) {
// Static role allowlist; password is a generated hex token. Values are never printed, even on error.
if (typeof password !== 'string' || !/^[a-f0-9]{64}$/.test(password)) throw new Error('Invalid generated credential');
const exists = await admin.query('SELECT 1 FROM pg_roles WHERE rolname=$1', [role]);
if (!exists.rowCount) await admin.query(`CREATE ROLE ${role} LOGIN PASSWORD '${password}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`);
}
await admin.query('REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE ALL ON DATABASE wikideck_custody FROM PUBLIC');
await admin.query('GRANT CONNECT,CREATE ON DATABASE wikideck_custody TO custody_owner; GRANT CONNECT ON DATABASE wikideck_custody TO custody_runtime');
await admin.query(`GRANT CONNECT,CREATE ON DATABASE wikideck_custody TO custody_owner;
GRANT CONNECT ON DATABASE wikideck_custody TO custody_runtime,custody_backup`);
} finally { await admin.end(); }
const owner = new Pool(await config('owner'));
try { await migrateCustody(owner); await grantCustodyRuntime(owner, 'custody_runtime'); }
try {
await migrateCustody(owner); await grantCustodyRuntime(owner, 'custody_runtime');
await owner.query(`GRANT USAGE ON SCHEMA wk_custody TO custody_backup;
GRANT SELECT ON ALL TABLES IN SCHEMA wk_custody TO custody_backup;
GRANT SELECT ON ALL SEQUENCES IN SCHEMA wk_custody TO custody_backup`);
}
finally { await owner.end(); }
console.log('Local PostgreSQL schema and restricted runtime grants ready. Sandbox payments only.');
} catch {