fix: enforce postgres least privilege

2026-07-21 03:45:09 +08:00
parent 92cc635b45
commit 53d9aaf846
5 changed files with 139 additions and 17 deletions
@@ -17,6 +17,18 @@ async function loadMigrationFiles(migrationsDirectory) {
    throw new SafeMigrationError("unable to read migrations directory");
  }

+  const malformedSqlEntry = entries.find(
+    (entry) =>
+      entry.isFile() &&
+      entry.name.endsWith(".sql") &&
+      !migrationFilenamePattern.test(entry.name),
+  );
+  if (malformedSqlEntry) {
+    throw new SafeMigrationError(
+      `invalid migration filename: ${malformedSqlEntry.name}`,
+    );
+  }
+
  return Promise.all(
    entries
      .filter(