🔒 Raise error if migration is done by wrong user

[fredericenard]

No description provided.

[github-actions]

🚀 Deployed on https://66afacc643ec4dc2edf6f5a8--lamindb-setup-htry.netlify.app

[falexwolf]

This goes in a good direction, but I don't think we should merge anything until we triple checked that we have a final naming scheme.

Also, we already have this check running before migration deployment. It's only based on the permission table but of course these things should be in sync. Let's see whether some of the logic that this is in sync is client side or not. As usual, we won't be able to change it if it's client-side.

lamindb-setup/lamindb_setup/_migrate.py

Lines 84 to 93 in 93a9fbf

	collaborator = call_with_fallback_auth(
	select_collaborator,
	instance_id=settings.instance._id,
	account_id=settings.user._uuid,
	)
	if collaborator is None or collaborator["role"] != "admin":
	raise SystemExit(
	"❌ Only admins can deploy migrations, please ensure that you're an"
	f" admin: https://lamin.ai/{settings.instance.slug}/settings"
	)

[fredericenard]

I don't think we should merge anything until we triple checked that we have a final naming scheme.

Yes I agree,

Also, we already have this check running before migration deployment. It's only based on the permission table but of course these things should be in sync.

There is no way to be 100% the right connection string will be used

Maybe a better approach is having a external process ensuring all tables are owned by the root user 🤔

I see several ways to do that, one pretty simple would be to use a postgres trigger, but we would still have the problem with logic living client side.

Another way is to have a cron performing regular checks for this. This could be part of a bigger piece of logic including health checks for the instance and storage diagnostic (to verify policy is properly attached).