26 lines
1.4 KiB
PowerShell
26 lines
1.4 KiB
PowerShell
param(
|
|
[string]$DockerContext = "docker-prod",
|
|
[string]$PostgresContainer = "assistant-postgres-1"
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$environment = docker --context $DockerContext inspect --format '{{range .Config.Env}}{{println .}}{{end}}' $PostgresContainer
|
|
$userLine = $environment | Where-Object { $_.StartsWith("POSTGRES_USER=") } | Select-Object -First 1
|
|
$databaseLine = $environment | Where-Object { $_.StartsWith("POSTGRES_DB=") } | Select-Object -First 1
|
|
if (-not $userLine -or -not $databaseLine) { throw "PostgreSQL bootstrap identity is unavailable" }
|
|
$user = $userLine.Substring("POSTGRES_USER=".Length)
|
|
$database = $databaseLine.Substring("POSTGRES_DB=".Length)
|
|
|
|
$previousErrorAction = $ErrorActionPreference
|
|
$ErrorActionPreference = "Continue"
|
|
$denied = "SET ROLE continuity_role; INSERT INTO work.tasks (task_id, goal_id, scope_id, revision) VALUES ('acl-negative-probe', 'goal', 'scope', 1);" | docker --context $DockerContext exec -i $PostgresContainer psql -U $user -d $database -v ON_ERROR_STOP=1 2>&1
|
|
$deniedExitCode = $LASTEXITCODE
|
|
$ErrorActionPreference = $previousErrorAction
|
|
if ($deniedExitCode -eq 0) { throw "cross-owner write unexpectedly succeeded" }
|
|
|
|
"SET ROLE work_role; SELECT count(*) FROM work.tasks;" | docker --context $DockerContext exec -i $PostgresContainer psql -U $user -d $database -v ON_ERROR_STOP=1 | Out-Null
|
|
if ($LASTEXITCODE -ne 0) { throw "owner-local read failed" }
|
|
|
|
Write-Output "INV-OWN-001 owner ACL verification: PASS"
|