Populate service_password_hash at database setup time
Table of Contents
This page is a capture in the discarded bucket of the product backlog.
Resolved (deep backlog refinement, 2026-07-11): projects/ores.sql/create/seed/upsert_functions_create.sql:652 defines ores_iam_service_accounts_upsert_fn which hashes the supplied password with sha256 and stores it in service_password_hash (lines 690-700). This function is called from projects/ores.sql/populate/iam/iam_service_accounts_populate.sql and iam_infrastructure_accounts_populate.sql, which are part of the standard populate/setup pipeline – the column is populated at setup time.
What
(One paragraph: the idea.)
Why
(Motivation, problem being solved, related context.)
References
See also
The service_password_hash column (or equivalent credential store) for each service's database user is not populated by recreate_database.sh or setup_user.sql. Without it, service-to-database authentication via hashed passwords cannot work.
Update the setup scripts to:
- Generate (or accept as a parameter) a password for each service DB user.
- Hash it with the appropriate function (
pgcrypto,bcrypt, or Postgrescrypt). - Store the hash in the credential column at setup time.