Skip to content

Develop #1725

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
abhishek8shankar wants to merge 2 commits into
base: develop
Choose a base branch
from
Open

Develop #1725

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
14768d1
[DSD-37808] Updated db scripts ida
abhishek8shankar May 11, 2026
e58b7cf
Update deploy.sh
abhishek8shankar May 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions db_scripts/README.MD
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
## MOSIP ID Authentication Database (mosip_ida) scripts inventory and deployment guidelines on postgresql database.
## MOSIP ID Authentication Database (:mosipdbname) scripts inventory and deployment guidelines on postgresql database.

#### The details disclosed below gives a clear information on complete database script structure with the instructions for database scripts deployments.

Expand All @@ -14,7 +14,7 @@

* Database objects related to MOSIP modules are placed in "**mosip_base_directory**>>db_scripts>>mosip_<schema_name> folder on git/repository

**Example:** the id-authentication module script folder is /**mosip_base_directory**>>db_scripts>>mosip_ida where all the database scripts related to id authentication are available.
**Example:** the id-authentication module script folder is /**mosip_base_directory**>>db_scripts>>:mosipdbname where all the database scripts related to id authentication are available.

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

Clarify the distinction between psql variables and filesystem paths.

The example path uses :mosipdbname as if it were an actual directory name, but this is a psql variable placeholder used within SQL scripts, not a filesystem directory. The actual directory on disk is still db_scripts/mosip_ida. This creates confusion between the parameterized database name (used at runtime) and the physical script location.

Consider revising to clarify: "the id-authentication module script folder is db_scripts/mosip_ida where scripts for the :mosipdbname database are available."

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/README.MD` at line 17, Update the README example to clarify that
:mosipdbname is a psql variable used inside SQL scripts and not a filesystem
directory; explicitly state that the physical script directory is
db_scripts/mosip_ida and that this folder contains scripts intended to be run
against the :mosipdbname database, so readers understand the distinction between
the runtime parameter (:mosipdbname) and the on-disk location
(db_scripts/mosip_ida).


* Create a log file directory on DB deployment server before updating the properties file. Please follow the steps to create the same:

Expand Down
34 changes: 17 additions & 17 deletions db_scripts/createIdaNewDB.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,32 +8,32 @@ if [[ $# -ne 3 ]]; then
fi

## set variables
oldDB=$1; ## mosip_ida
newDB=$2; ## mosip_ida_1
oldDB=$1; ## :mosipdbname
newDB=$2; ## :mosipdbname_1
dbPwd=$3

## create new DB directory
rm -rf $newDB
cp -r $oldDB $newDB
Comment on lines 16 to 17

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical | ⚡ Quick win

Guard and quote destructive filesystem operations.

Line 16 can delete unintended paths (/, ., empty-like values after expansion) and both lines perform word splitting/globbing due to unquoted vars. Add validation and quote all path expansions before rm/cp.

Suggested fix 
+set -euo pipefail
+
+if [[ -z "${oldDB}" || -z "${newDB}" || "${newDB}" == "/" || "${newDB}" == "." ]]; then
+  echo "Refusing unsafe path values for oldDB/newDB; EXITING"
+  exit 1
+fi
+
-rm -rf $newDB
-cp -r $oldDB $newDB
+rm -rf -- "$newDB"
+cp -r -- "$oldDB" "$newDB"
🧰 Tools
🪛 Shellcheck (0.11.0)

[info] 16-16: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 17-17: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 17-17: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/createIdaNewDB.sh` around lines 16 - 17, The rm -rf $newDB and cp
-r $oldDB $newDB operations are unsafe and unquoted; update the script to
validate and quote the path variables (newDB, oldDB) before use: ensure newDB
and oldDB are non-empty, not "/" or "." (or other dangerous values), and that
oldDB exists and is a directory; only then run the destructive commands, quoting
expansions (e.g., use "$newDB" and "$oldDB") and consider using safer rm flags
or a targeted delete routine to avoid accidental deletions.


## update DB
sed -i "s/$oldDB\>/$newDB/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_ida_db.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_ida_ddl_deploy.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_ida_dml_deploy.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_ida_grants.sql;
sed -i "s/$oldDB\>/$newDB/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/$oldDB/$newDB/g" $newDB/:mosipdbname_db.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/:mosipdbname_ddl_deploy.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/:mosipdbname_dml_deploy.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/:mosipdbname_grants.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_role_common.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_role_idauser.sql;
sed -i "s/$oldDB/$newDB/g" $newDB/mosip_role_:dbuname.sql;
Comment on lines +20 to +26

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Escape sed search/replacement inputs before interpolation.

Lines 20-26 and 31-37 inject raw variables into sed patterns/replacements. Values containing /, &, \, or regex chars can corrupt output or make replacements fail. Escape values once and reuse.

Suggested fix 
+escape_sed_pattern() { printf '%s' "$1" | sed 's/[.[\*^$()+?{|\\]/\\&/g'; }
+escape_sed_repl() { printf '%s' "$1" | sed 's/[&/\\]/\\&/g'; }
+
+oldDB_pat="$(escape_sed_pattern "$oldDB")"
+newDB_repl="$(escape_sed_repl "$newDB")"
+dbPwd_repl="$(escape_sed_repl "$dbPwd")"
+
-sed -i "s/$oldDB\>/$newDB/g" $newDB/:mosipdbname_deploy.properties;
+sed -i "s/${oldDB_pat}\>/${newDB_repl}/g" "$newDB/:mosipdbname_deploy.properties"
...
-sed -i "s/SYSADMIN_PWD=.*/SYSADMIN_PWD=$dbPwd/g" $newDB/:mosipdbname_deploy.properties;
+sed -i "s/SYSADMIN_PWD=.*/SYSADMIN_PWD=${dbPwd_repl}/g" "$newDB/:mosipdbname_deploy.properties"

Also applies to: 31-37

🧰 Tools
🪛 Shellcheck (0.11.0)

[info] 20-20: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 21-21: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 22-22: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 23-23: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 24-24: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 26-26: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/createIdaNewDB.sh` around lines 20 - 26, The sed invocations
inject raw $oldDB and $newDB which can break patterns if they contain /, &, or
backslashes; create escaped variables (e.g., escaped_oldDB and escaped_newDB) by
escaping backslashes, ampersands and the chosen sed delimiter, reuse those
escaped variables in all sed commands (including the blocks at lines 20-26 and
31-37), and optionally switch sed to a safe delimiter (e.g., |) so substitutions
like sed -i "s|$escaped_oldDB|$escaped_newDB|g"
$newDB/:mosipdbname_deploy.properties are robust.


## update DB properties
sed -i "s/DB_SERVERIP=.*/DB_SERVERIP=mzworker0.sb/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/DB_PORT=.*/DB_PORT=30090/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/SYSADMIN_PWD=.*/SYSADMIN_PWD=$dbPwd/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/DBADMIN_PWD=.*/DBADMIN_PWD=$dbPwd/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/APPADMIN_PWD=.*/APPADMIN_PWD=$dbPwd/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/DBUSER_PWD=.*/DBUSER_PWD=$dbPwd/g" $newDB/mosip_ida_deploy.properties;
sed -i "s:BASEPATH=.*:BASEPATH=$PWD:g" $newDB/mosip_ida_deploy.properties;
sed -i "s/LOG_PATH=.*/LOG_PATH=..\/..\/..\/logs\//g" $newDB/mosip_ida_deploy.properties;
sed -i "s/DML_FLAG=.*/DML_FLAG=1/g" $newDB/mosip_ida_deploy.properties;
sed -i "s/DB_SERVERIP=.*/DB_SERVERIP=mzworker0.sb/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/DB_PORT=.*/DB_PORT=30090/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/SYSADMIN_PWD=.*/SYSADMIN_PWD=$dbPwd/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/DBADMIN_PWD=.*/DBADMIN_PWD=$dbPwd/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/APPADMIN_PWD=.*/APPADMIN_PWD=$dbPwd/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/DBUSER_PWD=.*/DBUSER_PWD=$dbPwd/g" $newDB/:mosipdbname_deploy.properties;
sed -i "s:BASEPATH=.*:BASEPATH=$PWD:g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/LOG_PATH=.*/LOG_PATH=..\/..\/..\/logs\//g" $newDB/:mosipdbname_deploy.properties;
sed -i "s/DML_FLAG=.*/DML_FLAG=1/g" $newDB/:mosipdbname_deploy.properties;

echo "success";
8 changes: 4 additions & 4 deletions db_scripts/mosip_ida/db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,15 +1,15 @@
CREATE DATABASE mosip_ida
CREATE DATABASE :mosipdbname
ENCODING = 'UTF8'
LC_COLLATE = 'en_US.UTF-8'
LC_CTYPE = 'en_US.UTF-8'
TABLESPACE = pg_default
OWNER = postgres
TEMPLATE = template0;
COMMENT ON DATABASE mosip_ida IS 'ID Authorization related requests, transactions and mapping related data like virtual ids, tokens, etc. will be stored in this database';
COMMENT ON DATABASE :mosipdbname IS 'ID Authorization related requests, transactions and mapping related data like virtual ids, tokens, etc. will be stored in this database';

\c mosip_ida
\c :mosipdbname

DROP SCHEMA IF EXISTS ida CASCADE;
CREATE SCHEMA ida;
ALTER SCHEMA ida OWNER TO postgres;
ALTER DATABASE mosip_ida SET search_path TO ida,pg_catalog,public;
ALTER DATABASE :mosipdbname SET search_path TO ida,pg_catalog,public;
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
\c mosip_ida
\c :mosipdbname

\ir ddl/ida-auth_transaction.sql
\ir ddl/ida-uin_auth_lock.sql
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-anonymous_profile.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.anonymous_profile
-- Purpose : anonymous_profile: Anonymous profiling information for reporting purpose.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-api_key_data.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.api_key_data

-- Purpose :
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-auth_transaction.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.auth_transaction
-- Purpose : Authentication Transaction : To track all authentication transactions steps / stages in the process flow.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-ca_cert_store.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.ca_cert_store
-- Purpose : Certificate Authority Certificate Store: Store details of all the certificate provided by certificate authority which will be used by MOSIP
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-credential_event_store.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.credential_event_store
-- Purpose :
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-data_encrypt_keystore.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.data_encrypt_keystore
-- Purpose : Data Encrypt Keystore: Table is used to store the encryption key aliases which is used encrypt the data stored in identity cache table store.
--
Expand Down
4 changes: 2 additions & 2 deletions db_scripts/mosip_ida/ddl/ida-fk.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name :
-- Purpose : All the FKs are created separately, not part of create table scripts to ease the deployment process
--
Expand All @@ -18,4 +18,4 @@ CREATE SEQUENCE BATCH_JOB_SEQ MAXVALUE 9223372036854775807 NO CYCLE;
-- grants to access all sequences
GRANT usage, SELECT ON ALL SEQUENCES
IN SCHEMA ida
TO idauser;
TO :dbuname;
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-ident_binding_cert_store.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.ident_binding_cert_store
-- Purpose : ident_binding_cert_store : To store Identity binding certificates.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-identity_cache.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.identity_cache
-- Purpose : Identity Cache: Details of UIN stored along with uin data and biometric details, This data is synched from ID Repo whenever it is needed and used for authentication request during validation and response to authentication
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-key_store.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.key_store
-- Purpose : Key Store: In MOSIP, data related to an individual in stored in encrypted form. This table is to manage all the keys(private and public keys) used.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-misp_license_data.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.misp_license_data
-- Purpose : misp_license_data :
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-oidc_client_data.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.oidc_client_data
-- Purpose : oidc_client_data : To store OIDC client details.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-otp_transaction.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.otp_transaction
-- Purpose : OTP Transaction: All OTP related data and validation details are maintained here for ID Authentication.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-partner_data.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.partner_data

-- Purpose :
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-partner_mapping.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.partner_mapping

-- Purpose :
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-uin_auth_lock.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.uin_auth_lock
-- Purpose : UIN Authentication Lock: An individual is provided an option to lock or unlock any of the authentication types that are provided by the system. When an individual locks a particular type of authentication, any requests received by the system will be rejected. The details of the locked authentication types are stored in this table.
--
Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/ddl/ida-uin_hash_salt.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
-- -------------------------------------------------------------------------------------------------
-- Database Name: mosip_ida
-- Database Name: :mosipdbname
-- Table Name : ida.uin_hash_salt
-- Purpose : UIN Hash Salt: Stores the salt used to hash uin of an individual in the hashing algorithm.
--
Expand Down
1 change: 1 addition & 0 deletions db_scripts/mosip_ida/deploy.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,4 +3,5 @@ DB_PORT=5432
SU_USER=postgres
DEFAULT_DB_NAME=postgres
MOSIP_DB_NAME=mosip_ida
DB_UNAME=idauser
DML_FLAG=1
15 changes: 7 additions & 8 deletions db_scripts/mosip_ida/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,27 +22,26 @@ echo "Terminated connections"

## Drop db and role
echo "Dropping DB"
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f drop_db.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f drop_db.sql -v mosipdbname=$MOSIP_DB_NAME

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify unquoted variable expansions in changed psql invocation lines.
nl -ba db_scripts/mosip_ida/deploy.sh | sed -n '20,50p'
rg -nP 'psql .*--(username|host|port|dbname)=\$| -v [a-zA-Z_]+=\\?\$' db_scripts/mosip_ida/deploy.sh

Repository: mosip/id-authentication

Length of output: 1722

Quote all shell expansions in psql calls; current form breaks on special characters.

Multiple psql invocations pass unquoted variables to arguments and the PGPASSWORD environment variable, risking word splitting and globbing failures. Line 32 uses a fragile escaped-quote pattern that is error-prone.

Suggested fix (pattern) 
-PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f drop_db.sql -v mosipdbname=$MOSIP_DB_NAME
+PGPASSWORD="$SU_USER_PWD" psql -v ON_ERROR_STOP=1 --username="$SU_USER" --host="$DB_SERVERIP" --port="$DB_PORT" --dbname="$DEFAULT_DB_NAME" -f drop_db.sql -v "mosipdbname=$MOSIP_DB_NAME"

-PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f role_dbuser.sql -v dbuserpwd=\'$DBUSER_PWD\' -v dbuname=$DB_UNAME
+PGPASSWORD="$SU_USER_PWD" psql -v ON_ERROR_STOP=1 --username="$SU_USER" --host="$DB_SERVERIP" --port="$DB_PORT" --dbname="$DEFAULT_DB_NAME" -f role_dbuser.sql -v "dbuserpwd=$DBUSER_PWD" -v "dbuname=$DB_UNAME"

Also applies to: 28-28, 36-36, 37-37, 40-40, 46-46

🧰 Tools
🪛 Shellcheck (0.11.0)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

[info] 25-25: Double quote to prevent globbing and word splitting.

(SC2086)

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/mosip_ida/deploy.sh` at line 25, The psql invocations (e.g., the
line setting PGPASSWORD and calling psql) pass shell variables unquoted which
breaks on special characters and allows word-splitting/globbing; update each
psql invocation (references: PGPASSWORD, SU_USER_PWD, SU_USER, DB_SERVERIP,
DB_PORT, DEFAULT_DB_NAME, MOSIP_DB_NAME and the psql -f calls like drop_db.sql)
to properly quote expansions: export or set the PGPASSWORD value quoted, and
wrap all variable expansions in double quotes when used as arguments to psql
(including --username, --host, --port, --dbname and -v mosipdbname) and remove
fragile escaped-quote patterns so the commands are robust against spaces and
special chars.


echo "Dropping user"
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f drop_role.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f drop_role.sql -v dbuname=$DB_UNAME

## Create users
echo `date "+%m/%d/%Y %H:%M:%S"` ": Creating database users"
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f role_dbuser.sql -v dbuserpwd=\'$DBUSER_PWD\'
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f role_dbuser.sql -v dbuserpwd=\'$DBUSER_PWD\' -v dbuname=$DB_UNAME

## Create DB
echo "Creating DB"
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f db.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f ddl.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f db.sql -v mosipdbname=$MOSIP_DB_NAME
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f ddl.sql -v mosipdbname=$MOSIP_DB_NAME -v dbuname=$DB_UNAME

## Grants
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f grants.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -f grants.sql -v mosipdbname=$MOSIP_DB_NAME -v dbuname=$DB_UNAME

## Populate tables
if [ ${DML_FLAG} == 1 ]
then
echo `date "+%m/%d/%Y %H:%M:%S"` ": Deploying DML for ${MOSIP_DB_NAME} database"
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -a -b -f dml.sql
PGPASSWORD=$SU_USER_PWD psql -v ON_ERROR_STOP=1 --username=$SU_USER --host=$DB_SERVERIP --port=$DB_PORT --dbname=$DEFAULT_DB_NAME -a -b -f dml.sql -v mosipdbname=$MOSIP_DB_NAME
fi

2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/dml.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
\c mosip_ida
\c :mosipdbname

TRUNCATE TABLE ida.key_policy_def cascade ;

Expand Down
2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/drop_db.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
DROP DATABASE IF EXISTS mosip_ida;
DROP DATABASE IF EXISTS :mosipdbname;

2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/drop_role.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
drop role if exists idauser;
drop role if exists :dbuname;

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify identifier interpolation style for db/user placeholders in SQL scripts.
rg -nP '(:dbuname|:mosipdbname)\b' db_scripts/mosip_ida/*.sql db_scripts/mosip_ida/ddl/*.sql
rg -nP ':"(dbuname|mosipdbname)"' db_scripts/mosip_ida/*.sql db_scripts/mosip_ida/ddl/*.sql

Repository: mosip/id-authentication

Length of output: 2590

Use identifier-safe psql interpolation for role name.

Line 1 interpolates :dbuname raw in identifier context. Use :"dbuname" to avoid invalid SQL for non-simple names and reduce injection risk from malformed values.

Suggested fix 
-drop role if exists :dbuname;
+drop role if exists :"dbuname";
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
drop role if exists :dbuname;
drop role if exists :"dbuname";
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/mosip_ida/drop_role.sql` at line 1, The DROP ROLE statement
interpolates the variable :dbuname as a raw identifier which can break for
non-simple names or allow malformed input; change the interpolation to use the
identifier-safe form by quoting the bind as :"dbuname" in the DROP ROLE
statement (the symbol to update is the DROP ROLE line containing :dbuname) so
psql treats it as an identifier and avoids invalid SQL or injection issues.

12 changes: 6 additions & 6 deletions db_scripts/mosip_ida/grants.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,17 @@
\c mosip_ida
\c :mosipdbname

@coderabbitai coderabbitai Bot May 13, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

❓ Verification inconclusive

Script executed:

find . -name "grants.sql" -path "*/mosip_ida/*" -type f

Repository: mosip/id-authentication

Repository: mosip/id-authentication
Exit code: 0

stdout:

./db_scripts/mosip_ida/grants.sql

Script executed:

cat -n db_scripts/mosip_ida/grants.sql | head -30

Repository: mosip/id-authentication

Repository: mosip/id-authentication
Exit code: 0

stdout:

     1	\c :mosipdbname
     2	
     3	GRANT CONNECT
     4	   ON DATABASE :mosipdbname
     5	   TO :dbuname;
     6	
     7	GRANT USAGE
     8	   ON SCHEMA ida
     9	   TO :dbuname;
    10	
    11	GRANT SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES
    12	   ON ALL TABLES IN SCHEMA ida
    13	   TO :dbuname;
    14	
    15	ALTER DEFAULT PRIVILEGES IN SCHEMA ida 
    16		GRANT SELECT,INSERT,UPDATE,DELETE,REFERENCES ON TABLES TO :dbuname;
    17

psql identifier quoting :"variable" interpolation best practices

In psql, use variable interpolation with specific quoting syntax for identifiers and literals to ensure safe substitution. For identifiers (table/column names needing double quotes), use:"varname" which applies proper double-quoting [1][2][3][4]. For SQL literals (string values), use:'varname' which applies single-quoting [1][5][3]. Example: \set table_name 'MyTable' \set col_name 'UserId' SELECT * FROM:"table_name" WHERE:"col_name" = 123; -- becomes SELECT * FROM "MyTable" WHERE "UserId" = 123; [3] This handles case sensitivity, keywords, and special characters automatically, equivalent to quote_ident and quote_literal [6][4]. Unquoted:varname substitutes raw value, suitable only for simple identifiers without specials [1]. Best practices: - Always use:"var" for identifiers to avoid parse errors with keywords/case [6][7][3]. - Use:'var' for values to prevent SQL injection-like issues [5][8]. - Avoid mixed-case or keyword identifiers; use lowercase unquoted for portability [6][9][10]. - Set variables with \set var 'value' or psql -v var=value [5][3]. - Interpolation is syntax-aware and skips strings/blocks [11][3]. For \f (field separator), it sets output formatting, unrelated to identifier quoting [1].

Citations:

Use identifier-quoted psql variables consistently in grants script.

Raw :var substitution is unsafe for identifiers that may contain mixed case, reserved keywords, or special characters. Apply the psql identifier-quoting syntax :"var" to all database and role name placeholders (lines 1, 4–5, 9, 13, 16) for robust, portable execution aligned with PostgreSQL best practices.

Suggested fix 
-\c :mosipdbname
+\c :"mosipdbname"
-   ON DATABASE :mosipdbname
-   TO :dbuname;
+   ON DATABASE :"mosipdbname"
+   TO :"dbuname";
-   TO :dbuname;
+   TO :"dbuname";
-   TO :dbuname;
+   TO :"dbuname";
-	GRANT SELECT,INSERT,UPDATE,DELETE,REFERENCES ON TABLES TO :dbuname;
+	GRANT SELECT,INSERT,UPDATE,DELETE,REFERENCES ON TABLES TO :"dbuname";
📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
\c :mosipdbname
\c :"mosipdbname"
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@db_scripts/mosip_ida/grants.sql` at line 1, The script uses raw psql variable
substitution for identifiers (e.g., :mosipdbname and other role/database
placeholders referenced on lines 1,4–5,9,13,16); replace each raw form with the
psql identifier-quoting syntax (e.g., :"mosipdbname") so identifiers are safely
quoted when used as database/role names in commands like \c, CREATE DATABASE,
CREATE ROLE, GRANT, and ALTER DEFAULT PRIVILEGES; update every occurrence of
:<var> to :"<var>" for those identifier variables to ensure correct, portable
identifier handling.


GRANT CONNECT
ON DATABASE mosip_ida
TO idauser;
ON DATABASE :mosipdbname
TO :dbuname;

GRANT USAGE
ON SCHEMA ida
TO idauser;
TO :dbuname;

GRANT SELECT,INSERT,UPDATE,DELETE,TRUNCATE,REFERENCES
ON ALL TABLES IN SCHEMA ida
TO idauser;
TO :dbuname;

ALTER DEFAULT PRIVILEGES IN SCHEMA ida
GRANT SELECT,INSERT,UPDATE,DELETE,REFERENCES ON TABLES TO idauser;
GRANT SELECT,INSERT,UPDATE,DELETE,REFERENCES ON TABLES TO :dbuname;

2 changes: 1 addition & 1 deletion db_scripts/mosip_ida/role_dbuser.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
CREATE ROLE idauser WITH
CREATE ROLE :dbuname WITH
INHERIT
LOGIN
PASSWORD :dbuserpwd;
Loading