RHINENG-21627: vmaas_sync need to read size of repack tables

[MichaelMraka]

Secure Coding Practices Checklist GitHub Link

• https://github.com/RedHatInsights/secure-coding-checklist

Secure Coding Checklist

• Input Validation
• Output Encoding
• Authentication and Password Management
• Session Management
• Access Control
• Cryptographic Practices
• Error Handling and Logging
• Data Protection
• Communication Security
• System Configuration
• Database Security
• File Management
• Memory Management
• General Coding Practices

Summary by Sourcery

Enhancements:

• Grant repack schema usage to the vmaas_sync role to allow it to access objects within that schema.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates database schema migration version and grants the vmaas_sync role USAGE on the repack schema, with corresponding up/down migration scripts to manage the new privilege.

Flow diagram for migration 139 granting vmaas_sync repack schema usage

flowchart TD
  A["Start migration process"] --> B{"Migration direction?"}

  B -->|"Up (apply)"| C["Run 139_grant_vmaas_sync_repack_schema.up.sql"]
  C --> D["GRANT USAGE ON SCHEMA repack TO vmaas_sync"]
  D --> E["Update schema_migrations version to 139"]
  E --> F["End (vmaas_sync can use repack schema)"]

  B -->|"Down (rollback)"| G["Run 139_grant_vmaas_sync_repack_schema.down.sql"]
  G --> H["REVOKE USAGE ON SCHEMA repack FROM vmaas_sync"]
  H --> I["Update schema_migrations version back from 139"]
  I --> J["End (vmaas_sync cannot use repack schema)"]

Loading

File-Level Changes

Change	Details	Files
Advance schema version and grant vmaas_sync access to the repack schema so it can query repack tables.	Increment the schema_migrations version from 138 to 139 to register a new migration. Grant USAGE on the repack schema to the vmaas_sync role in the base schema creation script so new environments have the correct permissions. Add an up migration script that grants USAGE on the repack schema to vmaas_sync for existing environments. Add a down migration script that revokes USAGE on the repack schema from vmaas_sync to allow rollback of the permission change.	database_admin/schema/create_schema.sql database_admin/migrations/139_grant_vmaas_sync_repack_schema.up.sql database_admin/migrations/139_grant_vmaas_sync_repack_schema.down.sql

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey there - I've reviewed your changes - here's some feedback:

• Given the principle of least privilege, consider whether vmaas_sync truly needs USAGE on the entire repack schema or if access can be restricted to only the specific objects it must query for size information.
• If vmaas_sync needs to actually read from tables in the repack schema and not just reference them, you may also need explicit SELECT grants on those tables/views, since USAGE on the schema alone will not allow data access.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Given the principle of least privilege, consider whether vmaas_sync truly needs USAGE on the entire repack schema or if access can be restricted to only the specific objects it must query for size information.
- If vmaas_sync needs to actually read from tables in the repack schema and not just reference them, you may also need explicit SELECT grants on those tables/views, since USAGE on the schema alone will not allow data access.

## Individual Comments

### Comment 1
<location> `database_admin/schema/create_schema.sql:1045` </location>
<code_context>
+GRANT USAGE ON SCHEMA repack TO vmaas_sync;
</code_context>

<issue_to_address>
**issue:** Consider how this behaves when the `repack` schema is not present in a fresh or minimal environment.

If `repack` is created by an extension or optional component, this GRANT will fail in environments where that schema doesn’t exist yet (e.g., local dev or CI). Please either guard this with a conditional check (e.g., DO block checking `pg_namespace`) or ensure deployment ordering guarantees `repack` is created before this script runs.
</issue_to_address>

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.84%. Comparing base (73960ce) to head (707e957).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1941   +/-   ##
=======================================
  Coverage   58.84%   58.84%           
=======================================
  Files         131      131           
  Lines        8436     8436           
=======================================
  Hits         4964     4964           
  Misses       2937     2937           
  Partials      535      535           

Flag	Coverage Δ
unittests	58.84% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[TenSt]

lgtm

[MichaelMraka]

/retest

[jira-linking]

Referenced Jiras:
https://issues.redhat.com/browse/RHINENG-21627