{"record":{"id":"bacb1f4dac1e95f5","repo":"JuliusBrussee/caveman","slug":"postgres-inspect-resolver-schema-w","errorCode":null,"errorMessage":"postgres: inspect resolver schema: %w","messagePattern":"postgres: inspect resolver schema: %w","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"shared/platform/postgresconfig/postgresconfig.go","lineNumber":753,"sourceCode":"\t\t\tJOIN pg_roles role ON role.rolname=rr.role_name\n\t\t\tCROSS JOIN pg_class c\n\t\t\tJOIN pg_namespace n ON n.oid=c.relnamespace\n\t\t\tJOIN pg_attribute org_col ON org_col.attrelid=c.oid\n\t\t\t  AND org_col.attname='organization_id' AND NOT org_col.attisdropped\n\t\t\tWHERE n.nspname='public' AND c.relkind IN ('r','p')\n\t\t\t  AND has_table_privilege(rr.role_name, c.oid, 'SELECT,INSERT,UPDATE,DELETE')\n\t\t\t  AND NOT EXISTS (\n\t\t\t    SELECT 1 FROM pg_policy policy\n\t\t\t    WHERE policy.polrelid=c.oid\n\t\t\t      AND role.oid=ANY(policy.polroles)\n\t\t\t      AND policy.polqual IS NOT NULL\n\t\t\t      AND policy.polwithcheck IS NOT NULL\n\t\t\t  )\n\t\t)\n\t\tSELECT coalesce(string_agg(violation, '; ' ORDER BY violation), '') FROM violations\n\t`).Scan(&violations)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"postgres: inspect resolver schema: %w\", err)\n\t}\n\tif violations != \"\" {\n\t\treturn fmt.Errorf(\"postgres: resolver isolation incomplete: %s\", violations)\n\t}\n\treturn nil\n}\n\n// WithOrg runs fn inside a transaction whose tenant GUC is transaction-local.\n// Empty scopes are rejected: tenant work must never degrade to an unscoped\n// query when RLS is the hard boundary.\nfunc WithOrg(ctx context.Context, pool *pgxpool.Pool, orgID string, fn func(pgx.Tx) error) error {\n\torgID = strings.TrimSpace(orgID)\n\tif orgID == \"\" {\n\t\treturn errors.New(\"postgres: organization scope is required\")\n\t}\n\ttx, err := pool.Begin(ctx)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":735,"sourceCodeEnd":771,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/shared/platform/postgresconfig/postgresconfig.go#L735-L771","documentation":"validateResolverSchema runs a catalog/RLS-policy query that aggregates resolver-schema violations (e.g. policies missing WITH CHECK). This error wraps a failure executing that query's Scan. It indicates the resolver-isolation inspection query failed to run, not that a violation was found (that is the sibling 'resolver isolation incomplete' error).","triggerScenarios":"ValidateTenantSchema (via NewRuntimePool) calls validateResolverSchema; the aggregate SELECT ... Scan returns an error: missing privileges on pg_policies/policy catalogs, query syntax mismatch on an older Postgres, or a connection/context failure.","commonSituations":"Running against Postgres < 9.5 or an Aurora/compatibility build lacking pg_policies; restricted role without access to policy catalogs; context deadline during startup; extension/compatibility layer rejecting the query.","solutions":["Grant the app role access to pg_policies / the policy catalog views queried","Confirm the Postgres version supports the catalog features used (pg_policies requires 9.5+; row-level security 9.5+)","Inspect the wrapped error for context timeout vs SQL error and address accordingly","Retry after transient connection issues"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"var v string\nif err := db.QueryRow(\"SELECT extversion FROM pg_extension WHERE extname='plpgsql'\").Scan(&v); err != nil { /* verify catalog access / version */ }","typeGuard":null,"tryCatchPattern":"if err := NewRuntimePool(ctx, cfg); err != nil {\n    if strings.Contains(err.Error(), \"inspect resolver schema\") {\n        // check role access to pg_policies and Postgres version support\n    }\n    return err\n}","preventionTips":["Require Postgres >= 9.5 (pg_policies, RLS) in deployment docs and health checks","Grant the app role SELECT on pg_policies / policy catalogs","Smoke-test pool initialization against each supported Postgres version in CI"],"tags":["postgres","row-level-security","schema-inspection","resolver"],"backgroundTag":"database-query-failed","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}