Confine the Postgres driver to bootstrap, bound plugin connections, and gate the storage DDL

2026-08-19 00:08:35 +02:00
parent d2211cf75a
commit 060535c8ab
11 changed files with 313 additions and 129 deletions
@@ -5,3 +5,10 @@
 CREATE DATABASE kratos;
 CREATE DATABASE keto;
 CREATE DATABASE hydra;
+
+-- Postgres grants CONNECT to PUBLIC by default, so every plugin role would otherwise reach the auth
+-- plane: table data stays protected, but pg_catalog and the connection slots do not. Ory connects as
+-- the POSTGRES_USER, which owns these and keeps its access.
+REVOKE CONNECT ON DATABASE kratos FROM PUBLIC;
+REVOKE CONNECT ON DATABASE keto FROM PUBLIC;
+REVOKE CONNECT ON DATABASE hydra FROM PUBLIC;