Fix drift SET LOCAL: use string interpolation with UUID validation (SET doesn't support params)

2026-03-02 03:59:26 +00:00
parent d55162a047
commit e0b84f5481
1 changed files with 3 additions and 1 deletions
--- a/products/02-iac-drift-detection/saas/src/data/db.ts
+++ b/products/02-iac-drift-detection/saas/src/data/db.ts
@@ -15,7 +15,9 @@ export function createPool(connectionString: string): pg.Pool {
 * MUST be cleared when returning the connection to the pool.
 */
 export async function setTenantContext(client: pg.PoolClient, tenantId: string): Promise<void> {
-  await client.query('SET LOCAL app.tenant_id = $1', [tenantId]);
+  // SET doesn't support parameterized queries — validate UUID format then interpolate
+  if (!/^[0-9a-f-]{36}$/i.test(tenantId)) throw new Error('Invalid tenant ID');
+  await client.query(`SET LOCAL app.tenant_id = '${tenantId}'`);
 }

 /**