insforge.policy_grant_role and insforge.extension_grant_role both already default
to 'project_admin' inside the extension (insforge_pg_utils.c:74-84, :98-103), so
behaviour is unchanged. Pinned explicitly because the default lives in a compiled
.so, invisible to a reader of this file, and a rebuild could shift permission
behaviour with no diff in any config repo.
extension_grant_role was declared nowhere and matters more than it looks: the hook
runs CREATE/DROP EXTENSION as the bootstrap superuser, a broader grant than the
policy one.
Both copies updated; deploy/zeabur/template.yml inlines this file as a YAML
template string.
Verified on ghcr.io/insforge/postgres:v15.13.4 that both report
source=configuration file with value project_admin, and that the preload list is
byte-identical to origin/main.
An earlier revision of this PR also preloaded pg_net. Dropped: cloud has had it
preloaded for seven months with pg_net.database_name unset, meaning async SQL HTTP
never worked there and nobody reported it — so there is no demand to serve, and
preloading costs a permanent background worker per instance.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The WAL settings were annotated "Enable logical replication for Logflare".
Logflare was removed in 2025-10 (dc953b7a3), so the comments pointed at a
dependency that no longer exists.
Settings unchanged. wal_level stays on `logical` because changing it requires a
restart, and nothing consumes it today — realtime uses pg_notify (migration 017),
and backend/src has no references to replication slots, publications, logical
decoding, pgoutput or wal2json.
Both copies updated; deploy/zeabur/template.yml inlines this file as a YAML
template string.
Verified: non-comment settings are byte-identical to origin/main in both files
(diffed with comments stripped), the zeabur template block keeps its 20-space
indentation, prettier passes, and a Postgres started on the edited conf reports
wal_level=logical with unchanged shared_preload_libraries.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
- postgresql.conf: correct stale "migration 055" → 056 and drop the obsolete
"_-prefixed schemas handled separately" note (that rule was removed).
- resolvePostgrestSchema: reject a blank/repeated ?schema= or array-valued
profile header with 400 instead of silently falling back to `public`, and
re-forward the normalized profile header so it cannot disagree with the
schemaName used for metadata lookups.
- Tests for the new guards.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Sources the internal-schema deny-list from a single insforge.internal_schemas
GUC (postgresql.conf) instead of hardcoding it in is_exposed_schema, so it has
one editable source of truth and can change without a migration. The literal
list stays inline only as a fallback when the GUC is unset.
Adds native PostgREST schema selection to the records and RPC proxy routes:
an explicit ?schema= is desugared into Accept-Profile (reads) / Content-Profile
(writes & RPC) and stripped from the forwarded query, a client-sent profile
header is honored as-is, otherwise PostgREST's default schema applies. The
records route now threads the resolved schema into getColumnTypeMap so body
filtering uses the right table's column types instead of always public.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Lyu