From 18be804ba001cbe1a2d6e3536983769ab36e32ed Mon Sep 17 00:00:00 2001 From: Jeroen Schweitzer Date: Tue, 11 Aug 2026 10:04:41 +0200 Subject: [PATCH] fix: report the database's refusal instead of guessing its cause MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The health report's InsufficientPrivilege handler said 'the scheduler's database user lacks INSERT on check_history'. That grant was in place. What was actually missing was USAGE on check_history_id_seq — the sequence behind the table's serial id — so an INSERT was refused for a reason the message did not mention and actively contradicted. Verified by attempting the insert directly as scheduler_user: ERROR: permission denied for sequence check_history_id_seq A diagnostic that names a cause it did not observe is worse than a generic one: it sends the reader to a fix that is already applied, and reads as evidence the grant did not work. The message now prints psycopg2's own first line. Co-Authored-By: Claude --- CHANGELOG.md | 10 ++++++++++ src/executors/health_report.py | 20 ++++++++++++++------ 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 910f250..87d4f67 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/). ## [Unreleased] +### Fixed +- The health report's permission diagnostic prints the database's own message instead of + asserting a cause. It claimed the user lacked INSERT on `check_history` when that grant was + present and the missing one was USAGE on the sequence behind its serial id. + ## [1.5.0] - 2026-08-11 ### Added @@ -282,6 +287,11 @@ TOTAL 80% 🎯 ## [Unreleased] +### Fixed +- The health report's permission diagnostic prints the database's own message instead of + asserting a cause. It claimed the user lacked INSERT on `check_history` when that grant was + present and the missing one was USAGE on the sequence behind its serial id. + ## [1.5.0] - 2026-08-11 ### Added diff --git a/src/executors/health_report.py b/src/executors/health_report.py index 2327d03..9e3afe2 100644 --- a/src/executors/health_report.py +++ b/src/executors/health_report.py @@ -97,14 +97,22 @@ def report( ) logger.info("health report: %s=%s recorded", domain, status) return True - except psycopg2.errors.InsufficientPrivilege: + except psycopg2.errors.InsufficientPrivilege as exc: # Named separately because it is the expected first failure and the fix - # is a one-line grant, not a code change: - # GRANT INSERT ON check_history TO ; + # is a grant rather than a code change. The database's own message is + # printed verbatim rather than summarised: the first version of this + # asserted "lacks INSERT on check_history" and was wrong — the table + # grant was present and what was actually missing was USAGE on + # check_history_id_seq, the sequence behind its serial id. A diagnostic + # that names a cause it did not observe sends the reader to the wrong + # fix with confidence. + # + # GRANT INSERT ON check_history TO ; + # GRANT USAGE ON SEQUENCE check_history_id_seq TO ; logger.warning( - "health report for %s refused: the scheduler's database user lacks INSERT on " - "check_history. The task itself succeeded; only the report was lost.", - domain, + "health report for %s refused by the database: %s. The task itself succeeded; " + "only the report was lost.", + domain, str(exc).strip().splitlines()[0], ) return False except Exception as exc: # noqa: BLE001 - reporting must not raise