mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(vector): verify writer sequence privileges

Browse Source
This commit is contained in:
marcopan
2026-07-12 01:13:56 +02:00
parent e7e948c77c
commit 409f806aae
3 changed files with 96 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
harness/tests/l0/test_pgvector_store.py
+47 -9
View File
@@ -1,4 +1,5 @@
import pytest
from psycopg2.errors import InsufficientPrivilege
from sqlalchemy import create_engine, text
from sqlalchemy.exc import ProgrammingError
from testcontainers.postgres import PostgresContainer
@@ -61,7 +62,11 @@ def vector_configs():
connection.exec_driver_sql("CREATE ROLE vector_l0_reader LOGIN PASSWORD 'reader'")
connection.exec_driver_sql("CREATE ROLE vector_l0_writer LOGIN PASSWORD 'writer'")
connection.exec_driver_sql(
"GRANT USAGE ON SCHEMA vectors TO vector_l0_reader, vector_l0_writer"
"CREATE ROLE vector_l0_no_sequence LOGIN PASSWORD 'no_sequence'"
)
connection.exec_driver_sql(
"GRANT USAGE ON SCHEMA vectors TO vector_l0_reader, vector_l0_writer, "
"vector_l0_no_sequence"
)
connection.exec_driver_sql(
"GRANT SELECT ON ALL TABLES IN SCHEMA vectors TO vector_l0_reader"
@@ -71,11 +76,12 @@ def vector_configs():
)
for table in ("schema_records", "evidence", "memory"):
connection.exec_driver_sql(
f"GRANT INSERT, UPDATE ON vectors.{table} TO vector_l0_writer"
f"GRANT INSERT, UPDATE ON vectors.{table} "
"TO vector_l0_writer, vector_l0_no_sequence"
)
connection.exec_driver_sql(
f"GRANT SELECT (record_key, kind, content_hash) "
f"ON vectors.{table} TO vector_l0_writer"
f"ON vectors.{table} TO vector_l0_writer, vector_l0_no_sequence"
)
engine.dispose()
reader_config = admin_config.model_copy(
@@ -84,14 +90,17 @@ def vector_configs():
writer_config = admin_config.model_copy(
update={"user": "vector_l0_writer", "password": "writer"}
)
yield admin_config, reader_config, writer_config
no_sequence_config = admin_config.model_copy(
update={"user": "vector_l0_no_sequence", "password": "no_sequence"}
)
yield admin_config, reader_config, writer_config, no_sequence_config
@pytest.fixture
def store(vector_configs):
from tht.adapters.vector.pgvector import PgVectorStore
_, reader_config, writer_config = vector_configs
_, reader_config, writer_config, _ = vector_configs
store = PgVectorStore(reader_config, writer_config, expected_dimension=2)
store.upsert("memory", [_record("reset", [0.0, 1.0])])
yield store
@@ -179,7 +188,7 @@ def test_pgvector_rejects_kinds_not_belonging_to_collection(store):
def test_pgvector_separates_read_and_write_credentials(vector_configs):
from tht.adapters.vector.pgvector import PgVectorStore
_, reader_config, writer_config = vector_configs
_, reader_config, writer_config, _ = vector_configs
reader = PgVectorStore(reader_config, expected_dimension=2)
assert reader.capabilities.search is True
assert reader.capabilities.upsert is False
@@ -194,7 +203,7 @@ def test_pgvector_separates_read_and_write_credentials(vector_configs):
def test_pgvector_database_roles_are_least_privilege(vector_configs):
_, reader_config, writer_config = vector_configs
_, reader_config, writer_config, _ = vector_configs
reader_engine = create_engine(
f"postgresql+psycopg2://{reader_config.user}:{reader_config.password}"
f"@{reader_config.host}:{reader_config.port}/{reader_config.database}"
@@ -224,10 +233,39 @@ def test_pgvector_database_roles_are_least_privilege(vector_configs):
writer_engine.dispose()
def test_pgvector_writer_health_requires_sequence_usage(vector_configs):
from tht.adapters.vector.pgvector import PgVectorStore
admin_config, _, _, no_sequence_config = vector_configs
store = PgVectorStore(None, no_sequence_config, expected_dimension=2)
health = store.health()
assert health.ok is False
assert health.write_reachable is False
assert health.write_detail == (
"vector schema incomplete: missing sequence privileges evidence, memory, schema_records"
)
with pytest.raises(InsufficientPrivilege):
store.upsert("memory", [_record("needs-sequence", [1.0, 0.0])])
admin_engine = create_engine(
f"postgresql+psycopg2://{admin_config.user}:{admin_config.password}"
f"@{admin_config.host}:{admin_config.port}/{admin_config.database}"
)
with admin_engine.begin() as connection:
connection.exec_driver_sql(
"GRANT USAGE ON ALL SEQUENCES IN SCHEMA vectors TO vector_l0_no_sequence"
)
admin_engine.dispose()
assert store.health().ok is True
assert store.upsert("memory", [_record("has-sequence", [1.0, 0.0])]) == 1
def test_pgvector_health_reports_dimension_and_each_connection(vector_configs):
from tht.adapters.vector.pgvector import PgVectorStore
_, reader_config, writer_config = vector_configs
_, reader_config, writer_config, _ = vector_configs
health = PgVectorStore(reader_config, writer_config, expected_dimension=2).health()
assert health.ok is True
assert health.read_reachable is True
@@ -247,7 +285,7 @@ def test_pgvector_health_reports_dimension_and_each_connection(vector_configs):
def test_pgvector_health_rejects_clean_and_partial_schemas(vector_configs):
from tht.adapters.vector.pgvector import PgVectorStore
admin_config, _, _ = vector_configs
admin_config, _, _, _ = vector_configs
engine = create_engine(
f"postgresql+psycopg2://{admin_config.user}:{admin_config.password}"
f"@{admin_config.host}:{admin_config.port}/{admin_config.database}"