Repository navigation
File Search worker finds no work when the database user has neither superuser nor BYPASSRLS #1418
Description
Problem
The file_* tables use FORCE ROW LEVEL SECURITY; tenant queries go through FileSearchRepository.withTenant (app.current_org, optionally SET LOCAL ROLE amcp_files). The worker's cross-workspace maintenance queries do not set app.current_org:
- scheduler lease claim, extend and release;
- share sweep;
- closing interrupted runs (Close File Search sync runs a stopped worker left open (#1383) #1417).
They rely on the application user bypassing RLS: superuser, which is the case on AnythingMCP Cloud and in the default Docker Compose setup.
On a self-hosted install whose application user is neither superuser nor BYPASSRLS (some managed PostgreSQL offerings), those queries see no rows. Syncs then never start, and expired share files are not swept. Nothing errors.
Proposal
- A new migration extends the
org_isolationpolicies with an explicit maintenance switch, for exampleOR current_setting('app.files_maintenance', true) = 'on'. - The worker's cross-workspace queries run inside a transaction with
set_config('app.files_maintenance', 'on', true). - Add an integration test as a non-superuser role, like the one used for Add File Search and File Share (#1379) #1395's CREATEROLE check.
Found while hardening File Search on 2026-11-01. Relates to #1379, #1380, #1383.
Activity
Document the database role File Search needs on self-hosted (#1418)
Close File Search sync runs a stopped worker left open (#1383) (#1417)
Document the database role File Search needs on self-hosted (#1418)
aj-codespy commentedon Nov 6, 2026
Hi, I'd like to take this one (I did the SonarQube adapter in #1317 and the satellites docs in #1276). I'd make the worker's cross-workspace maintenance queries work without superuser or BYPASSRLS, and add a test that runs the worker as a non-superuser role. Could I have it?
helpcodeai commentedon Nov 6, 2026
Thanks for offering, @aj-codespy, and for the SonarQube adapter and the satellites docs.
We'll keep this one in house, though. The fix changes the row-level security policies that keep workspaces apart, and the worker's scheduler lives under
ee/, which is under our commercial license and not open to outside contributions. Both are things we want to change and test ourselves.If you'd like another one, these adapter requests are free and fit your SonarQube experience:
Pick one and comment there, and I'll assign it to you.
helpcodeai commentedon Nov 6, 2026
Plan update after auditing every File Search query that runs outside
withTenant.No maintenance switch in the RLS policies. An
app.files_maintenancesetting inorg_isolationcould be set by any code on the application connection, and a single bug would then open every workspace at once, document contents included. Instead, maintenance runs one workspace at a time insidewithTenant, the same way tenant queries do, and the policies stay unchanged.Affected code (worse than the issue lists):
pickScans()closeInterruptedRuns()FileShareService.sweep()byToken()andopenSigned()FileSearchEngine.scopeFor()Plan
Workspace list.
SELECT DISTINCT organization_id FROM connectors WHERE type = 'FILE_SEARCH'.connectorshas no RLS.Scheduler claim.
withTenant.next_sync_at.FOR UPDATE SKIP LOCKEDclaims.This keeps today's rules: most overdue first, never two of one workspace, several workers safe.
Leases. Renew, release and stop use the claimed
organizationId. Scans, sweeps andcloseInterruptedRuns()also run per workspace.Folder rules.
scopeFor()reads them insidewithTenantand fails closed.Share links. One additive SELECT-only policy on
file_shares, matchingtoken_hash = current_setting('app.share_token_hash', true). It only reveals the row to someone who already holds its secret token. The signed download carries the workspace id inside its HMAC.Startup logging. The worker logs which RLS mode it runs in, and warns when File Search connectors exist but it sees no source.
Tests. A new integration spec runs in CI as a
NOSUPERUSER NOBYPASSRLSrole. It covers:A second run as superuser shows unchanged behaviour.
Cloud and self-hosted. No visible change on Cloud. On managed PostgreSQL, File Search works and folder rules apply again.
Regenerate llms-full.txt (#1418)
Run File Search maintenance per workspace under RLS (#1418) (#1557)