{"record":{"id":"5929b4a554a180fb","repo":"JuliusBrussee/caveman","slug":"postgres-inspect-runtime-identity-w","errorCode":null,"errorMessage":"postgres: inspect runtime identity: %w","messagePattern":"postgres: inspect runtime identity: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/postgresconfig/postgresconfig.go","lineNumber":166,"sourceCode":"\t\t       r.rolbypassrls,\n\t\t       pg_has_role(current_user, $1, 'MEMBER'),\n\t\t       EXISTS (\n\t\t         SELECT 1\n\t\t         FROM pg_class c\n\t\t         JOIN pg_namespace n ON n.oid=c.relnamespace\n\t\t         JOIN information_schema.columns col\n\t\t           ON col.table_schema=n.nspname\n\t\t          AND col.table_name=c.relname\n\t\t          AND col.column_name='organization_id'\n\t\t         WHERE n.nspname='public'\n\t\t           AND c.relkind IN ('r','p')\n\t\t           AND pg_get_userbyid(c.relowner)=current_user\n\t\t       )\n\t\tFROM pg_roles r\n\t\tWHERE r.rolname=current_user\n\t`, expectedRole).Scan(&currentUser, &sessionUser, &superuser, &bypassRLS, &member, &ownsTenantTable)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"postgres: inspect runtime identity: %w\", err)\n\t}\n\treturn validateRuntimeIdentity(currentUser, sessionUser, expectedRole, superuser, bypassRLS, member, ownsTenantTable)\n}\n\nfunc validateRuntimeIdentity(currentUser, sessionUser, expectedRole string, superuser, bypassRLS, member, ownsTenantTable bool) error {\n\t// A safe SET ROLE is not a safe login: session_user may execute SET ROLE\n\t// NONE later and recover its original privileges. Runtime pools therefore\n\t// require the authenticated identity and effective identity to be identical.\n\tif currentUser != sessionUser {\n\t\treturn fmt.Errorf(\"postgres: runtime current_user %q differs from session_user %q\", currentUser, sessionUser)\n\t}\n\tif superuser || bypassRLS || ownsTenantTable {\n\t\treturn fmt.Errorf(\"postgres: unsafe runtime identity %q (session_user=%q superuser=%t bypassrls=%t owns_tenant_table=%t)\", currentUser, sessionUser, superuser, bypassRLS, ownsTenantTable)\n\t}\n\tif !member {\n\t\treturn fmt.Errorf(\"postgres: runtime identity %q is not a member of %q\", currentUser, expectedRole)\n\t}\n\treturn nil","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/postgresconfig/postgresconfig.go#L148-L184","documentation":"ValidateRuntimeIdentity runs a query against pg_roles (and pg_class ownership) to inspect the session's actual identity and privileges. If that inspection query itself fails — connection issue, missing privileges to read pg_roles, syntax/permission error — the underlying error is wrapped with this message.","triggerScenarios":"NewRuntimePool calls ValidateRuntimeIdentity with an expected role; the single-row inspection query errors, e.g. the expected role is empty (query parameter issue), the connection dropped, or pg_roles is unreadable from the current database.","commonSituations":"Connecting to a database where the app role lacks access to system catalogs; network interruption mid-startup; calling with expectedRole=\"\" so the role-membership subquery cannot resolve.","solutions":["Inspect the wrapped %w error for the root cause (connection refused, permission denied, etc.) and fix that first.","Ensure ValidateRuntimeIdentity is called with a non-empty expected role name.","Verify the role can read pg_roles/pg_get_userbyid output (default for any connected role) and that you connected to the intended database.","Check pool health/credentials and retry if it was a transient connection error."],"exampleFix":"// before\nerr := postgresconfig.ValidateRuntimeIdentity(ctx, pool, \"\")\n// after\nerr := postgresconfig.ValidateRuntimeIdentity(ctx, pool, \"app_tenant_role\")","handlingStrategy":"try-catch","validationCode":"var exists bool\nerr := pool.QueryRow(ctx, \"SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname=$1)\", role).Scan(&exists)","typeGuard":null,"tryCatchPattern":"if err := postgresconfig.ValidateRuntimeIdentity(ctx, pool, role); err != nil {\n\tvar pgErr *pgconn.PgError\n\tif errors.As(err, &pgErr) {\n\t\tlog.Printf(\"identity inspection pg error %s: %s\", pgErr.Code, pgErr.Message)\n\t}\n\treturn fmt.Errorf(\"runtime identity: %w\", err)\n}","preventionTips":["Pass a verified, non-empty expected role name.","Gate pool startup on database readiness checks.","Retry transient pgconn errors before failing startup."],"tags":["postgres","security","database","identity"],"backgroundTag":"database-query-failed","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}