Should a migration create a root OWNER user in SurrealDB?
Root OWNER user defined in a migration
Warning: the statement succeeds, then writes fail, access changes, or the table is held up.
What happens
A root user with the OWNER role controls every namespace and database on the server, including removing them and defining other users. Created from an application migration, it exists wherever that migration runs, with credentials that live wherever the migration does.
Why it is dangerous on a populated table
Table size does not change this one: the user controls every namespace and database on the server from the moment the migration runs.
Fires on
DEFINE USER ops ON ROOT PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES OWNER;The safe pattern
Scope the user to the database the application needs, with the least role that works (VIEWER or EDITOR), and create root users from provisioning.
DEFINE USER app ON DATABASE PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES EDITOR;Fixtures
The rule ships with these files and the test suite runs them on every change: the first set must fire, the second must stay silent.
Fires (2)
DEFINE USER ops ON ROOT PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES VIEWER, OWNER;DEFINE USER ops ON ROOT PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES OWNER;Stays silent (2)
DEFINE USER app ON DATABASE PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES EDITOR;DEFINE USER monitoring ON ROOT PASSHASH '$argon2id$v=19$m=19456,t=2,p=1$c2FsdA$aGFzaA' ROLES VIEWER;How to check locally
SurrealDB support is in beta: this rule runs locally in the free CLI over .surql migrations, static only, and not in the hosted service yet. No install, nothing leaves your machine:
npx bolvrk check migration.surql --engine=surrealdb