DongHyeonkaandClaude Opus 5
0e61f86eb5
Implements the Stable and Experimental JPA persistence platform designs against real PostgreSQL, adapted to this repository's fail-closed 19-leaf registry. The design models the platform as 25 Gradle projects. `src/settings.gradle` throws unless the registry holds exactly 19 leaves, so the plan's modules become packages inside `:adapter:outbound:persistence-jpa` (starter in `:app-bootstrap`, testkit in its own source set). The full mapping, the renames this repository's naming gate required, and every deliberate substitution are recorded in `docs/jpa/repository-adaptation.md`. Seven Docker-backed lanes replace the plan's seven JVM test suites. Each fails closed: a lane that discovers nothing, or a container that cannot start, is an error rather than a skip. Three defects the contracts found against a real server: - `CommitFailureClassifier` treated only SQLSTATE 40003, class 08, and transport breaks as completion-unknown. A backend terminated mid-commit reports 57P01, and the commit record may already be in the WAL — so a possibly-committed transaction could be re-run. 57P01/57P02/57P03 now classify as completion-unknown. - `SchemaTenantMigrationOrchestrator` recorded `MigrateResult`'s target version, which is empty for a tenant already current, reporting migrated tenants as unmigrated during a partial rollout. It now reads the applied version back from the tenant's schema history. - `JpaStreamExecutor` checked only the declared return type for reactive publishers, and `RegisteredPostgreSqlCopyLoader` passed the COPY timeout to `SET`, which is parsed before parameter binding. `JpaModuleBoundaryTest` enforces the plan's module map as package rules; `verifyCleanArchitectureDependencies` governs edges between leaves and cannot see these. Its first assertion is that the import is non-empty, because every rule under it is a `noClasses()` rule and would pass vacuously on an empty import. Verified: 128 container tests across all seven lanes, 1183 unit tests, `:adapter:outbound:persistence-jpa:check`, `:app-bootstrap:check`, `verifyCleanArchitectureDependencies`, `verifyOneTypePerFile`. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
55 lines
3.1 KiB
SQL
55 lines
3.1 KiB
SQL
-- Runtime / migration / admin credential separation for the JPA persistence platform.
|
|
-- Design §36; enforced at startup by PostgreSqlRuntimeRoleVerifier + DatabaseRolePolicy.
|
|
--
|
|
-- The separation is what makes "Flyway owns schema change" enforceable rather than aspirational.
|
|
-- If the application's own credential cannot execute DDL, then no code path, no library, and no
|
|
-- injected statement can alter the schema at runtime — regardless of what the application intended.
|
|
--
|
|
-- Run as a superuser once per database. Replace the placeholder passwords with values from the
|
|
-- deployment's secret store; they are intentionally not committed.
|
|
|
|
-- 1. The schema the application owns. Owned by the migration role, not the runtime role.
|
|
create schema if not exists app authorization app_migration;
|
|
|
|
-- 2. Roles.
|
|
-- app_migration : owns the schema, applies Flyway migrations. DDL.
|
|
-- app_runtime : the application's credential. DML only, no DDL, no CREATE.
|
|
-- app_admin : J4 operations — COPY, backfill, maintenance. Never used by request paths.
|
|
create role app_migration login password 'REPLACE_FROM_SECRET_STORE';
|
|
create role app_runtime login password 'REPLACE_FROM_SECRET_STORE';
|
|
create role app_admin login password 'REPLACE_FROM_SECRET_STORE';
|
|
|
|
-- 3. Revoke the PUBLIC grants that make the checks in DatabaseRolePolicy necessary.
|
|
-- Before PostgreSQL 15, PUBLIC held CREATE on the public schema — which is how an unprivileged
|
|
-- role ends up able to plant an object that shadows a real one through search_path.
|
|
revoke all on database current_database() from public;
|
|
revoke create on schema public from public;
|
|
|
|
-- 4. Runtime: read and write rows in the application schema. Nothing else.
|
|
grant connect on database current_database() to app_runtime;
|
|
grant usage on schema app to app_runtime;
|
|
grant select, insert, update, delete on all tables in schema app to app_runtime;
|
|
grant usage, select on all sequences in schema app to app_runtime;
|
|
|
|
-- Tables created by future migrations must inherit the same grants, or the first deployment after
|
|
-- a new table silently fails at runtime with a permission error.
|
|
alter default privileges for role app_migration in schema app
|
|
grant select, insert, update, delete on tables to app_runtime;
|
|
alter default privileges for role app_migration in schema app
|
|
grant usage, select on sequences to app_runtime;
|
|
|
|
-- 5. Explicitly deny the two privileges the startup verifier checks for.
|
|
revoke create on schema app from app_runtime;
|
|
revoke create on database current_database() from app_runtime;
|
|
|
|
-- 6. Admin: bulk operations under an audited identity, still without schema ownership.
|
|
grant connect on database current_database() to app_admin;
|
|
grant usage on schema app to app_admin;
|
|
grant select, insert, update, delete on all tables in schema app to app_admin;
|
|
alter default privileges for role app_migration in schema app
|
|
grant select, insert, update, delete on tables to app_admin;
|
|
|
|
-- 7. Pin the runtime search_path so an unqualified name cannot resolve anywhere unexpected.
|
|
alter role app_runtime set search_path = app, pg_catalog;
|
|
alter role app_admin set search_path = app, pg_catalog;
|