mirror of
https://github.com/hanzoai/datastore.git
synced 2026-09-26 13:55:07 +00:00
zeekayandHanzo Dev
3b44aea20f
The rules named hanzo-cloud as the sink, but IAM provisions the event app as hanzo-event and the o11y app as hanzo-o11y, and the cloud host is hanzo-cloud. hanzo-event is now the sink, hanzo-cloud holds a new `platform` role for the hanzo database it creates and owns, and the three processes hold `observer`, the event plane's cross-org read, for the reads no caller's token speaks for (an API key, a background job, a fleet view). Without these the host was refused everything and the sink's own reads failed. `schema` may also keep the migration runner's ledger and lock (hanzo.migration, hanzo.migration_lock_*), without which the o11y app could not record that 0005 ran, and may create `observer`. `platform` may grant SELECT on its own tables and write their row policies, so the host confines the tables it reads as a person's org the same way. The gtests and the integration test load the image's own directory section instead of a copy, so the deployment's rules are what they test. The integration test adds the host, the ledger, query cache isolation and SET ROLE. contrib/authz is pinned to the v1.10.41 tag. Co-authored-by: Hanzo Dev <[email protected]>
h3
@ e38f58ef05
xz
@ 4b73f2ec19