Skip to content
deedglassdocs

database_role_unsafe

The Postgres connector’s DSN logs in as a role that isn’t least privilege: a superuser, a role with BYPASSRLS, REPLICATION, CREATEROLE or CREATEDB, a member of pgwritealldata, rdssuperuser…

HTTP 503 · api_error · safe to retry

What happened

Section titled “What happened”

The Postgres connector’s DSN logs in as a role that isn’t least privilege: a superuser, a role with BYPASSRLS, REPLICATION, CREATEROLE or CREATEDB, a member of pg_write_all_data, rds_superuser, cloudsqlsuperuser, azure_pg_admin, neon_superuser, supabase_admin or a server-file role, or any role other than deedglass_agent. Every new connection is checked. In prod the connection is refused and nothing runs; in dev Deedglass logs a warning and deedglass connector postgres check fails its agent_role line.

What to do

Section titled “What to do”

Run deedglass connector postgres init --connector <name> to create deedglass_agent and store its DSN, then deedglass connector postgres check.

Example

Section titled “Example”
HTTP 503 · database_role_unsafe
{
  "error": {
    "type": "api_error",
    "code": "database_role_unsafe",
    "message": "The connector's database role is a superuser. Deedglass refuses to run agent SQL with it. Run deedglass connector postgres init to create deedglass_agent.",
    "param": null,
    "request_id": "req_01j9zr3m5k8q2w7x4t6v0b1c9d",
    "doc_url": "https://docs.deedglass.com/errors/database_role_unsafe"
  }
}

The message is for a person and can get more exact over time: branch on type and code, never on the message.

In the SDKs

Section titled “In the SDKs”
SDK Raised as
TypeScript (@deedglass/sdk) APIError with code === "database_role_unsafe"
Python (deedglass) deedglass.APIError with .code == "database_role_unsafe"
Section titled “Related”