31 lines
2.2 KiB
TypeScript
Executable File
31 lines
2.2 KiB
TypeScript
Executable File
import { Pool } from 'pg';
|
|
import { postgresConfig } from '../server/market/postgres-config.ts';
|
|
import { migrateCustody, grantCustodyRuntime } from '../server/market/postgres-schema.ts';
|
|
import { IS_MAINNET } from '../shared/network.ts';
|
|
|
|
// Explicit one-shot service in the local persistent sandbox stack, NOT HTTP-startup migrations.
|
|
if (IS_MAINNET || process.env.WIKIDECK_LOCAL_PG_BOOTSTRAP !== 'sandbox-only') throw new Error('Local sandbox bootstrap only');
|
|
const ca = '/secrets/admin/ca.crt';
|
|
const config = (role: string) => postgresConfig({ WIKIDECK_CUSTODY_PG_URL_FILE: `/secrets/${role}/url`, WIKIDECK_CUSTODY_PG_CA_FILE: ca });
|
|
try {
|
|
const admin = new Pool(await config('admin'));
|
|
try {
|
|
const ownerConfig = await config('owner'), runtimeConfig = await config('runtime');
|
|
for (const [role, password] of [['custody_owner', ownerConfig.password], ['custody_runtime', runtimeConfig.password]] as const) {
|
|
// Static role allowlist; password is a generated hex token. Values are never printed, even on error.
|
|
if (typeof password !== 'string' || !/^[a-f0-9]{64}$/.test(password)) throw new Error('Invalid generated credential');
|
|
const exists = await admin.query('SELECT 1 FROM pg_roles WHERE rolname=$1', [role]);
|
|
if (!exists.rowCount) await admin.query(`CREATE ROLE ${role} LOGIN PASSWORD '${password}' NOSUPERUSER NOCREATEDB NOCREATEROLE NOREPLICATION NOBYPASSRLS`);
|
|
}
|
|
await admin.query('REVOKE CREATE ON SCHEMA public FROM PUBLIC; REVOKE ALL ON DATABASE wikideck_custody FROM PUBLIC');
|
|
await admin.query('GRANT CONNECT,CREATE ON DATABASE wikideck_custody TO custody_owner; GRANT CONNECT ON DATABASE wikideck_custody TO custody_runtime');
|
|
} finally { await admin.end(); }
|
|
const owner = new Pool(await config('owner'));
|
|
try { await migrateCustody(owner); await grantCustodyRuntime(owner, 'custody_runtime'); }
|
|
finally { await owner.end(); }
|
|
console.log('Local PostgreSQL schema and restricted runtime grants ready. Sandbox payments only.');
|
|
} catch {
|
|
console.error('Local PostgreSQL bootstrap failed; inspect roles, secret volumes, TLS and schema privately. No reset or fallback performed.');
|
|
process.exitCode = 1;
|
|
}
|