fix(cpb): add identifier validation to init-db.sh and fix production note

- Add validate_pg_identifier to init-db.sh matching cpb-setup-db.sh pattern
- Validate all 7 database/user identifiers before SQL execution
- Fix .env.example production note: correct line range (30-48), add CPB_POSTGRES_PASSWORD

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: SashkoMarchuk

.env.example

@@ -116,7 +116,7 @@ MN_SERVICE_SA_GOOGLE_AUTH_PROVIDER_X509_CERT_URL=https://www.googleapis.com/oaut
 MN_SERVICE_SA_GOOGLE_CLIENT_X509_CERT_URL=https://www.googleapis.com/robot/v1/metadata/x509/mock-service-account%40mock-project-id.iam.gserviceaccount.com
 MN_SERVICE_SA_GOOGLE_UNIVERSE_DOMAIN=googleapis.com
 # CPB (Connecting People Bot) — Production overrides
-# Variables are defined in the Development section above (lines 30-46).
+# Variables are defined in the Development section above (lines 30-48).
 # For production: set real values for POSTGRES_PASSWORD_CPB, CPB_POSTGRES_HOST,
-# CPB_SLACK_BOT_TOKEN, CPB_CHANNEL_ID, CPB_REPORT_CHANNEL_ID,
-# CPB_ADMIN_SLACK_ID, and CPB_DEV_SLACK_ID in your .env file.
+# CPB_POSTGRES_PASSWORD, CPB_SLACK_BOT_TOKEN, CPB_CHANNEL_ID,
+# CPB_REPORT_CHANNEL_ID, CPB_ADMIN_SLACK_ID, and CPB_DEV_SLACK_ID in your .env file.

scripts/init-db.sh

@@ -1,6 +1,29 @@
 #!/bin/bash
 set -e
 
+# Validate PostgreSQL identifiers (prevent SQL injection via crafted names)
+validate_pg_identifier() {
+    local value="$1" name="$2"
+    if [[ -z "$value" ]]; then
+        echo "ERROR: ${name} cannot be empty" >&2; exit 1
+    fi
+    if [[ ${#value} -gt 63 ]]; then
+        echo "ERROR: ${name} exceeds PostgreSQL's 63-char identifier limit" >&2; exit 1
+    fi
+    if [[ ! "$value" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
+        echo "ERROR: ${name} contains invalid characters (must match ^[a-zA-Z_][a-zA-Z0-9_]*$)" >&2; exit 1
+    fi
+    return 0
+}
+
+validate_pg_identifier "$POSTGRES_USER_N8N" "POSTGRES_USER_N8N"
+validate_pg_identifier "$POSTGRES_DB_N8N" "POSTGRES_DB_N8N"
+validate_pg_identifier "$POSTGRES_USER_TEMPORAL" "POSTGRES_USER_TEMPORAL"
+validate_pg_identifier "$POSTGRES_DB_TEMPORAL" "POSTGRES_DB_TEMPORAL"
+validate_pg_identifier "$POSTGRES_DB_TEMPORAL_VISIBILITY" "POSTGRES_DB_TEMPORAL_VISIBILITY"
+validate_pg_identifier "$POSTGRES_USER_CPB" "POSTGRES_USER_CPB"
+validate_pg_identifier "$POSTGRES_DB_CPB" "POSTGRES_DB_CPB"
+
 # Escape single quotes in passwords for SQL safety
 ESCAPED_POSTGRES_PASSWORD_N8N="${POSTGRES_PASSWORD_N8N//\'/''}"
 ESCAPED_POSTGRES_PASSWORD_TEMPORAL="${POSTGRES_PASSWORD_TEMPORAL//\'/''}"