BDMS-471-472-473

[jirhiker]

Why

This PR addresses the following problem / context:

• Use bullet points here

How

Implementation summary - the following was changed / added / removed:

• Use bullet points here

Notes

Any special considerations, workarounds, or follow-up work to note?

• Use bullet points here

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[Copilot]

Pull request overview

This PR refactors the database role granting logic by replacing a parameterized SQL statement with an inline f-string approach for granting the app_read role to members.

Changes:

• Removed the GRANT_MEMBER_SQL constant that used SQL parameters
• Implemented inline SQL statement construction with string escaping in the grant_app_read_members function

[Copilot]

Using string replacement for SQL escaping is insufficient and creates SQL injection vulnerabilities. The original parameterized approach with bindparams was secure. Revert to using parameterized queries with proper SQL parameter binding instead of f-strings.

Suggested change

	safe_member = member.replace("'", "''")
	stmt = text(
	f"""
	DO $$
	BEGIN
	IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{safe_member}') THEN
	EXECUTE 'GRANT app_read TO {safe_member}';
	END IF;
	END $$;
	"""
	)
	executor.execute(stmt)
	stmt = text(
	"""
	DO $$
	BEGIN
	IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :member) THEN
	EXECUTE format('GRANT app_read TO %I', :member);
	END IF;
	END $$;
	"""
	)
	executor.execute(stmt, {"member": member})

[Copilot]

The EXECUTE statement uses single quotes which treats the content as a literal string rather than an identifier. This should use format() with %I to properly quote the identifier, similar to the original implementation.

Suggested change

	safe_member = member.replace("'", "''")
	stmt = text(
	f"""
	DO $$
	BEGIN
	IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '{safe_member}') THEN
	EXECUTE 'GRANT app_read TO {safe_member}';
	END IF;
	END $$;
	"""
	)
	executor.execute(stmt)
	stmt = text(
	"""
	DO $$
	DECLARE
	role_name text := :role_name;
	BEGIN
	IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = role_name) THEN
	EXECUTE format('GRANT app_read TO %I', role_name);
	END IF;
	END $$;
	"""
	)
	executor.execute(stmt, {"role_name": member})