warn-grant-widening

What It Detects

GRANT to PUBLIC, GRANT ALL, or a blanket schema-wide grant hands out more privilege than the migration needs.

Why It's Dangerous

Privileges granted in a migration are permanent and almost never revisited. TO PUBLIC is the one that resists auditing: it does not grant to the roles that exist, it grants to the role every user implicitly has, including users created long after the migration ran. GRANT ALL also confers TRUNCATE, which empties the table in one statement, and a schema-wide grant covers only the tables that happened to exist when it ran.

Bad Example

GRANT ALL ON users TO app;
-- app can now TRUNCATE users

GRANT SELECT ON users TO PUBLIC;
-- every role in the cluster, including ones created next year

Good Example

-- Name the privileges, name the role.
GRANT SELECT, INSERT, UPDATE ON users TO app_role;

-- If PUBLIC access was inherited from an older migration, take it back.
REVOKE ALL ON users FROM PUBLIC;

Configuration

Disable this rule:

# .migrationpilotrc.yml
rules:
  MP085: false

Or change its severity:

# .migrationpilotrc.yml
rules:
  MP085:
    severity: warning