Warn rather than refuse on a storage URL mismatch, and scrub the provisioning DSN before discovery

src/plugin-host/storage-provisioning.ts

@@ -17,7 +17,9 @@ export interface ProvisionResult {
 }
 
 export async function provisionStorage(options: ProvisionOptions): Promise<ProvisionResult> {
-  const sql = postgres(options.adminUrl, { connect_timeout: 10, max: 1, onnotice: () => {} });
+  // Notices are left to surface: a REVOKE the account cannot perform only *warns*, and silencing
+  // that would mean reporting a locked-down database that is still open to PUBLIC.
+  const sql = postgres(options.adminUrl, { connect_timeout: 10, max: 1 });
   try {
     const provisioned: string[] = [];
     for (const pluginId of options.pluginIds) {

src/plugin-host/storage.test.ts

@@ -63,8 +63,6 @@ test("quoting doubles an embedded quote", () => {
   assert.equal(quoteLiteral("we'ird"), "'we''ird'");
 });
 
-// No NOSUPERUSER: naming it in an ALTER is superuser-only, so re-asserting it would break every
-// boot after the first under the least-privilege account the README recommends.
 const ATTRIBUTES = "LOGIN NOCREATEDB NOCREATEROLE CONNECTION LIMIT 10";
 
 test("only the plugins that asked for storage are provisioned", () => {

src/plugin-host/storage.ts

@@ -76,9 +76,7 @@ export function provisionSql(plan: ProvisionPlan): string[] {
     throw new Error(`storage: connectionLimit must be a positive integer, got ${plan.connectionLimit}`);
   }
   const identifier = quoteIdentifier(plan.name);
-  // No NOSUPERUSER: only a superuser may name SUPERUSER in an ALTER, so re-asserting it would fail
-  // every boot after the first under the CREATEDB+CREATEROLE account the README recommends. CREATE
-  // defaults to NOSUPERUSER and a non-superuser cannot grant it, so nothing is given up.
+  // No NOSUPERUSER: naming SUPERUSER in an ALTER is superuser-only, and CREATE defaults to it anyway.
   const attributes = `LOGIN NOCREATEDB NOCREATEROLE CONNECTION LIMIT ${plan.connectionLimit} PASSWORD ${quoteLiteral(plan.password)}`;
   return [
     plan.roleExists ? `ALTER ROLE ${identifier} WITH ${attributes}` : `CREATE ROLE ${identifier} ${attributes}`,