HAULDR-4: desarmar o trigger de auditoria e ensinar o cutover a atravessá-lo (#32)

O trigger de DDL da 0004 é SECURITY INVOKER: grava o ddl_log como quem emitiu
a DDL — o que é o ponto (o `actor` tem de ser o autor real, e por isso
SECURITY DEFINER não serve). O custo é a escrita ficar sujeita ao privilégio
do invocante, e a 0004 não concede nenhum.

No pg16 isso ficou dormente porque o autor da DDL é `postgres`, superuser lá,
que passa por cima da ACL. Duas situações não têm essa cobertura: um app que é
DONO das suas tabelas e migra como `<app>_authenticator` (heimdall, brokk — os
dois que caíram), e QUALQUER projeto no supabase/postgres 17, onde `postgres`
é deprivilegiado. Nesses, DDL no boot morre com 42501 e o container crashloopa.

- migrations/0005: os três grants (schema + tabela + sequence — `id` é
  bigserial, faltar um dá um 42501 DIFERENTE de cada vez). Migration nova, não
  edição da 0004: as aplicadas nunca re-rodam, e o applyMigrations do provision
  e do sampler propaga esta pela frota.

- cutover.ts: o stageA abortava em TODO app com auditoria. pg_dump sempre emite
  os event triggers (são globais do banco — `-N hauldr_audit` NÃO os exclui, e
  usá-lo sozinho piora: sobrariam a apontar para funções ausentes), e no v17 um
  event trigger superuser-owned não pode executar função de não-superuser. O
  pg_restore falhava essas 4 entradas, restaurava todo o resto e ainda assim
  saía != 0 — abortando um stageA cujos DADOS tinham chegado intactos.
  dumpRestore passa a filtrar o TOC (-L, por isso ficheiro em vez de pipe) e
  repairAudit reconstrói os triggers no destino, re-owned para o superuser do
  cluster e com os grants.

Provado ao vivo: `cli cutover zztest --stage a` de origem ARMADA termina exit 0
(antes abortava no passo 4); destino fica com paridade de linhas, triggers
owned by supabase_admin e os três grants. O vetor exato do Heimdall — ALTER
TABLE ADD COLUMN IF NOT EXISTS de coluna existente, que o PG pula mas o trigger
regista — passa no v17 como `postgres` não-superuser, auditado com o ator real.

Os 29 bancos do pg16 + 3 do v17 já foram desarmados à mão (GRANT é idempotente;
a 0005 reconcilia).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: valvesss

control-plane/src/cutover.ts

@@ -1,4 +1,7 @@
 import { spawn } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
 import { controlPool } from "./db";
 import { config } from "./config";
 import {
@@ -52,61 +55,122 @@ function connOf(url: string): Conn {
   };
 }
 
-/** Pipe `pg_dump` (source) → `pg_restore` (target), resolving on clean exit. */
-function dumpRestore(src: Conn, dst: Conn, database: string): Promise<void> {
+/** Run a pg CLI to completion; resolves with stdout, rejects on non-zero exit. */
+function runPg(cmd: string, args: string[], password: string): Promise<string> {
   return new Promise((resolve, reject) => {
+    const p = spawn(cmd, args, { env: { ...process.env, PGPASSWORD: password } });
+    let out = "";
+    let err = "";
+    p.stdout.on("data", (b) => (out += b.toString()));
+    p.stderr.on("data", (b) => (err += b.toString()));
+    p.on("error", (e) => reject(new Error(`${cmd} spawn failed: ${e.message}`)));
+    p.on("close", (code) =>
+      code === 0
+        ? resolve(out)
+        : reject(new Error(`${cmd} exited ${code}: ${err.slice(-2000)}`)),
+    );
+  });
+}
+
+/**
+ * `pg_dump` (source) → `pg_restore` (target), through a temp file.
+ *
+ * Deliberately NOT a pipe: the restore runs from a filtered TOC (`-L`), and
+ * pg_restore cannot seek a stream. The filter drops the DDL-audit event triggers
+ * (migrations/0004), which cannot survive the crossing as dumped:
+ *   - pg_dump ALWAYS emits them. Event triggers are database-global, so
+ *     `-N hauldr_audit` excludes the schema's functions but not the triggers
+ *     that call them — excluding the schema alone makes it worse, not better.
+ *   - their functions arrive owned by `postgres`, and on the supabase image
+ *     `postgres` is not a superuser. A superuser-owned event trigger may not
+ *     execute a non-superuser-owned function, so the CREATE fails.
+ * pg_restore is best-effort: it fails those four TOC entries, restores
+ * everything else, and still exits non-zero — which used to abort a stageA whose
+ * DATA had in fact landed intact. Skipping them here and rebuilding them in
+ * `repairAudit` keeps the exit code meaningful: it now means a real failure.
+ */
+async function dumpRestore(src: Conn, dst: Conn, database: string): Promise<void> {
+  const dir = await mkdtemp(join(tmpdir(), `cutover-${database}-`));
+  const archive = join(dir, "archive.dump");
+  const toc = join(dir, "restore.toc");
+  try {
     // -Fc custom format; -N realtime EXCLUDES the service-managed realtime schema
     // (Realtime rebuilds it on tenant register; carrying it over causes
     // `SET log_min_messages` permission errors + supabase_realtime_admin grant
-    // failures on the v17 restore). Plain restore into the v17 db owned by postgres.
-    const dump = spawn(
+    // failures on the v17 restore).
+    await runPg(
       "pg_dump",
       [
         "-h", src.host, "-p", src.port, "-U", src.user,
-        "-Fc", "-N", "realtime", database,
+        "-Fc", "-N", "realtime", "-f", archive, database,
       ],
-      { env: { ...process.env, PGPASSWORD: src.password } },
+      src.password,
     );
-    const restore = spawn(
+
+    // TOC line shape: `<dumpId>; <tableoid> <oid> <desc> <schema> <name> <owner>`.
+    // Anchor on the `desc` field so a table whose NAME merely contains the words
+    // is not silently dropped from the restore.
+    const listed = await runPg("pg_restore", ["-l", archive], dst.password);
+    const kept = listed
+      .split("\n")
+      .filter((l) => !/^\s*\d+;\s+\d+\s+\d+\s+EVENT TRIGGER\b/.test(l));
+    await writeFile(toc, kept.join("\n"));
+
+    await runPg(
       "pg_restore",
       [
         "-h", dst.host, "-p", dst.port, "-U", dst.user,
-        "-d", database,
+        "-d", database, "-L", toc, archive,
       ],
-      { env: { ...process.env, PGPASSWORD: dst.password } },
+      dst.password,
     );
+  } finally {
+    await rm(dir, { recursive: true, force: true });
+  }
+}
 
-    let dumpErr = "";
-    let restoreErr = "";
-    dump.stderr.on("data", (b) => (dumpErr += b.toString()));
-    restore.stderr.on("data", (b) => (restoreErr += b.toString()));
-
-    dump.stdout.pipe(restore.stdin);
-
-    let dumpDone = false;
-    let restoreDone = false;
-    let failed = false;
-    const fail = (msg: string) => {
-      if (failed) return;
-      failed = true;
-      reject(new Error(msg));
-    };
+/**
+ * Rebuild the DDL-audit event triggers on the target cluster (see dumpRestore for
+ * why they are not restored), and leave the ledger writable by the app roles.
+ *
+ * Re-owning the functions is what legalises the triggers: created by this
+ * cluster's admin (a superuser), they may only execute a superuser-owned
+ * function, and the restore left them owned by the deprivileged `postgres`.
+ *
+ * The grants mirror migrations/0005 and are re-applied because they are a
+ * PRECONDITION of the move, not a nicety: the trigger writes `ddl_log` as
+ * whoever emitted the DDL, and on pg17 that is a `postgres` which no longer
+ * bypasses the ACL — the first DDL-on-boot (GoTrue, storage-api) would die 42501
+ * and crashloop the sidecar. Applied here too so a project whose db predates
+ * 0005 still lands on v17 disarmed.
+ */
+async function repairAudit(cluster: Cluster, database: string): Promise<void> {
+  const c = dbClientForCluster(cluster, database);
+  await c.connect();
+  try {
+    const { rowCount } = await c.query(
+      "select 1 from pg_namespace where nspname = 'hauldr_audit'",
+    );
+    if (!rowCount) return; // db predates migrations/0004 — nothing to rebuild
 
-    dump.on("error", (e) => fail(`pg_dump spawn failed: ${e.message}`));
-    restore.on("error", (e) => fail(`pg_restore spawn failed: ${e.message}`));
-    dump.on("close", (code) => {
-      dumpDone = true;
-      if (code !== 0) return fail(`pg_dump exited ${code}: ${dumpErr.slice(-2000)}`);
-      if (restoreDone && !failed) resolve();
-    });
-    restore.on("close", (code) => {
-      restoreDone = true;
-      // pg_restore returns non-zero on ANY error; surface its stderr. (It emits
-      // warnings on stderr too, but a non-zero exit is a real failure here.)
-      if (code !== 0) return fail(`pg_restore exited ${code}: ${restoreErr.slice(-2000)}`);
-      if (dumpDone && !failed) resolve();
-    });
-  });
+    await c.query("alter function hauldr_audit.on_ddl_end() owner to current_user");
+    await c.query("alter function hauldr_audit.on_ddl_drop() owner to current_user");
+    await c.query("drop event trigger if exists hauldr_audit_ddl_end");
+    await c.query(
+      `create event trigger hauldr_audit_ddl_end on ddl_command_end
+         execute function hauldr_audit.on_ddl_end()`,
+    );
+    await c.query("drop event trigger if exists hauldr_audit_ddl_drop");
+    await c.query(
+      `create event trigger hauldr_audit_ddl_drop on sql_drop
+         execute function hauldr_audit.on_ddl_drop()`,
+    );
+    await c.query("grant usage  on schema   hauldr_audit                to public");
+    await c.query("grant insert on          hauldr_audit.ddl_log        to public");
+    await c.query("grant usage  on sequence hauldr_audit.ddl_log_id_seq to public");
+  } finally {
+    await c.end();
+  }
 }
 
 /** Per-table row counts for schemas public + auth, keyed `schema.table`. */
@@ -211,10 +275,16 @@ export async function stageA(name: string): Promise<void> {
     await v17admin.end();
   }
 
-  // 4. Data move: pg_dump (pg16) → pg_restore (pg17), excluding `realtime`.
+  // 4. Data move: pg_dump (pg16) → pg_restore (pg17), excluding `realtime` and
+  //    the DDL-audit event triggers (rebuilt in 5 — see dumpRestore).
   console.log(`[cutover ${name}] stageA 4/7 pg_dump → pg_restore (excluding realtime)`);
   await dumpRestore(src, dst, database);
 
+  // 4b. Rebuild the audit event triggers the restore had to skip, owned by this
+  //     cluster's superuser + granted, so DDL-on-boot does not 42501 on v17.
+  console.log(`[cutover ${name}] stageA 4b/7 rebuild DDL-audit event triggers on pg17`);
+  await repairAudit("pg17", database);
+
   // 5. Apply the v17 compat baseline as supabase_admin: default extensions, the
   //    Supabase-dialect auth helpers (reused verbatim from gotrue.ts), and the
   //    GoTrue search_path crash-loop fix.

migrations/0005_audit_grants.sql

@@ -0,0 +1,30 @@
+-- Let the DDL audit (0004) record DDL emitted by non-superusers.
+--
+-- 0004's event triggers are SECURITY INVOKER: the ledger row is written as
+-- whoever emitted the DDL. That is the point — `actor` must be the real author,
+-- so SECURITY DEFINER is NOT the alternative (it would log the function owner
+-- every time and defeat the audit). The cost is that the write is subject to the
+-- invoker's privileges, and the ledger ships with none granted.
+--
+-- On the pg16 cluster the DDL author is `postgres`, a superuser there, which
+-- bypasses the ACL — which is why the ungranted ledger has worked so far. Two
+-- cases do not have that cover:
+--   - an app that OWNS its tables and migrates as `<app>_authenticator`
+--     (heimdall, brokk) — never a superuser, even on pg16;
+--   - ANY project on supabase/postgres 17, where `postgres` is deprivileged.
+-- In both, DDL-on-boot (GoTrue, storage-api, ensureSchema) dies with `42501
+-- permission denied` and the container crashloops. This is a prerequisite of the
+-- pg16 → pg17 cutover, not a nicety.
+--
+-- All three grants are required, not just the INSERT: `ddl_log.id` is a
+-- bigserial, so the insert touches the schema, the table AND the sequence. A
+-- missing one fails with a DIFFERENT 42501 each time (schema → table →
+-- sequence), which reads like progress but is only the next lock.
+--
+-- PUBLIC is the correct scope: the trigger fires for every role that can emit
+-- DDL, so every such role must be able to append. It stays append-only for them
+-- — no select, no update, no delete.
+
+grant usage  on schema   hauldr_audit                to public;
+grant insert on          hauldr_audit.ddl_log        to public;
+grant usage  on sequence hauldr_audit.ddl_log_id_seq to public;