{"record":{"id":"9838c9e72abcf245","repo":"JuliusBrussee/caveman","slug":"postgres-expected-runtime-role-is-required","errorCode":null,"errorMessage":"postgres: expected runtime role is required","messagePattern":"postgres: expected runtime role is required","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/postgresconfig/postgresconfig.go","lineNumber":140,"sourceCode":"\t\treturn nil, err\n\t}\n\tif err := ValidateRuntimeIdentity(ctx, pool, expectedRole); err != nil {\n\t\tpool.Close()\n\t\treturn nil, err\n\t}\n\tif err := ValidateTenantSchema(ctx, pool); err != nil {\n\t\tpool.Close()\n\t\treturn nil, err\n\t}\n\treturn pool, nil\n}\n\n// ValidateRuntimeIdentity rejects database identities that can bypass RLS or\n// do not inherit the service's audited privilege group.\nfunc ValidateRuntimeIdentity(ctx context.Context, pool *pgxpool.Pool, expectedRole string) error {\n\texpectedRole = strings.TrimSpace(expectedRole)\n\tif expectedRole == \"\" {\n\t\treturn errors.New(\"postgres: expected runtime role is required\")\n\t}\n\tvar currentUser, sessionUser string\n\tvar superuser, bypassRLS, member, ownsTenantTable bool\n\terr := pool.QueryRow(ctx, `\n\t\tSELECT current_user,\n\t\t       session_user,\n\t\t       r.rolsuper,\n\t\t       r.rolbypassrls,\n\t\t       pg_has_role(current_user, $1, 'MEMBER'),\n\t\t       EXISTS (\n\t\t         SELECT 1\n\t\t         FROM pg_class c\n\t\t         JOIN pg_namespace n ON n.oid=c.relnamespace\n\t\t         JOIN information_schema.columns col\n\t\t           ON col.table_schema=n.nspname\n\t\t          AND col.table_name=c.relname\n\t\t          AND col.column_name='organization_id'\n\t\t         WHERE n.nspname='public'","sourceCodeStart":122,"sourceCodeEnd":158,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/27d5a3981a347890211bb1bf2439e5c821a63bc9/shared/platform/postgresconfig/postgresconfig.go#L122-L158","documentation":"Error \"postgres: expected runtime role is required\" thrown in JuliusBrussee/caveman.","triggerScenarios":"Thrown at shared/platform/postgresconfig/postgresconfig.go:140 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Set the expected runtime role."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"27d5a3981a347890211bb1bf2439e5c821a63bc9","analyzedAt":"2026-08-15T09:26:11.751Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}