From 40d33d05871cec4008bb8d789d9b9677dd6fb756 Mon Sep 17 00:00:00 2001 From: Alex Dunmow Date: Fri, 3 Jul 2026 16:36:58 +0800 Subject: [PATCH] rawsql: allow `FROM pg_roles` admin catalog lookup The wasm per-plugin role provisioner (cms role_provisioner.go, WO-WZ-007) checks role existence with a parameterized `SELECT ... FROM pg_roles`. That is a Postgres administrative catalog lookup (DCL provisioning, not sqlc-able), the same category as the already-allowed `FROM pg_database`. Co-Authored-By: Claude Fable 5 --- rawsql.go | 1 + 1 file changed, 1 insertion(+) diff --git a/rawsql.go b/rawsql.go index f1de8fd..ac92015 100644 --- a/rawsql.go +++ b/rawsql.go @@ -36,6 +36,7 @@ func isRawSQLAllowed(path string) bool { var allowedSQLPatterns = []string{ "pg_terminate_backend", // backup_service.go — kills connections before restore "FROM pg_database", // Administrative catalog lookup for tenant database existence + "FROM pg_roles", // role_provisioner.go — per-plugin role existence lookup (DCL, not sqlc-able) } func isSQLAllowed(sql string) bool {