fix: enforce postgres least privilege

2026-07-21 07:45:14 +08:00
parent 92cc635b45
commit 53d9aaf846
5 changed files with 139 additions and 17 deletions
@@ -15,6 +15,7 @@ export type PostgresFixture = {
  hostPort: number;
  connectionUrl(role: string, password: string): string;
  psql(sql: string): string;
+  psqlAs(role: string, password: string, sql: string): string;
  stop(): void;
 };

@@ -145,6 +146,29 @@ export function startPostgresFixture(): PostgresFixture {
        .trim()
        .replace(/(^|:)false(?=:|$)/gm, "$1f");
    },
+    psqlAs(role, password, sql) {
+      return execFileSync(
+        "docker",
+        [
+          ...composeArguments,
+          "exec",
+          "-T",
+          "-e",
+          `PGPASSWORD=${password}`,
+          "postgres",
+          "psql",
+          "-v",
+          "ON_ERROR_STOP=1",
+          "-U",
+          role,
+          "-d",
+          "jyotisha",
+          "-Atc",
+          sql,
+        ],
+        { encoding: "utf8", env: environment },
+      ).trim();
+    },
    stop() {
      try {
        execFileSync(