test(rectification): product-domain open wrapper is SECURITY INVOKER in the immutable Skill ACL contract (BUG-1131)

Original value: the 12-arg wrapper expected definer=true. New value: definer
is true for the six historical signatures and false for the 12-arg wrapper.
Reason: a definer wrapper runs as schema_owner, which the ACL reconciliation
leaves without EXECUTE on the 11-arg open, so homepage/new opens hit 42501.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017eEAG8HD3mm8gsKXgk8uU8
This commit is contained in:
Jesse_Chen
2026-10-01 08:04:05 +08:00
co-authored by Claude Opus 5.5
parent eded9c724e
commit 700b903d3e
@@ -164,7 +164,9 @@ test("immutable Skill migration enforces RPC-only identity, legacy adoption, and
where r.rolname='service_runtime' and a.privilege_type='EXECUTE')
) from pg_catalog.pg_proc p where p.oid='${signature}'::regprocedure;
`));
assert.deepEqual(row, { owner: "schema_owner", definer: true, config: ['search_path=""'], owner_execute: signature === segmentOpenSignature,
// 原值:12 参数包装 definer: true;新值:12 参数包装 definer: false,旧 6 签名仍为 true;
// 原因:BUG-1131——definer 包装以属主身份调用只授权 service_role 的 11 参数开案,首页/新建开案 42501。
assert.deepEqual(row, { owner: "schema_owner", definer: signature !== segmentOpenSignature, config: ['search_path=""'], owner_execute: signature === segmentOpenSignature,
legacy: false, service: true, anon: false, authenticated: false, public: false, runtime_direct: false }, signature);
}
};