mirror of
https://gh-proxy.org/https://github.com/klinsmaya/new-api.git
synced 2026-11-11 02:46:58 +08:00
CaIon
043ff99a51
Resolve obsolete PostgreSQL single-column unique constraints by their actual catalog names inside a locked transaction. Preserve unrelated indexes and roll back constraint removal when foreign keys depend on them. Load legacy authorization policies as structured fields. Preserve scoped rows during baseline reseeding and load unsupported own/other scopes as deny, preventing fallback to broader admin grants. Existing global grants remain usable; unsupported scoped grants require administrator review. Validation: fresh databases and rc.37 through rc.27, 60/60 combinations on SQLite 3.50.4, MySQL 5.7.44/8.0.46, and PostgreSQL 9.6.24/16.15. Each ran InitDB, separate InitLogDB, and authz.Init twice with persisted data. Focused schema, foreign-key rollback, and master/slave policy reload regressions passed, along with the authz package tests. Security references: OWASP ASVS 5.0.0 controls 8.2.1, 8.2.2, and 8.3.1; OWASP Authorization Cheat Sheet (least privilege and deny by default).