fix: sanitize db schema identifiers

[ntrevino-virtru]

Proposed Changes

• Sanitize db identifiers

I think I tried passing these as parameters to the query but that didn't work if I recall.

Checklist

• I have added or updated unit tests
• I have added or updated integration tests (if appropriate)
• I have added or updated documentation

Testing Instructions

[github-actions]

Benchmark results, click to expand

Benchmark authorization.GetDecisions Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	209.579707ms

Benchmark authorization.v2.GetMultiResourceDecision Results:

Metric	Value
Approved Decision Requests	1000
Denied Decision Requests	0
Total Time	103.500274ms

Standard Benchmark Metrics Skipped or Failed

Bulk Benchmark Results

Metric	Value
Total Decrypts	100
Successful Decrypts	100
Failed Decrypts	0
Total Time	358.889117ms
Throughput	278.64 requests/second

TDF3 Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	38.633647879s
Average Latency	384.626296ms
Throughput	129.42 requests/second

NANOTDF Benchmark Results:

Metric	Value
Total Requests	5000
Successful Requests	5000
Failed Requests	0
Concurrent Requests	50
Total Time	25.897882886s
Average Latency	257.886098ms
Throughput	193.07 requests/second

[Copilot]

Pull Request Overview

This PR sanitizes database schema identifiers to prevent SQL injection vulnerabilities by using pgx's built-in Identifier.Sanitize() method instead of direct string concatenation.

• Replaces unsafe string concatenation with pgx.Identifier sanitization for schema names
• Adds import for pgx package to support the Identifier type

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
service/pkg/db/db_migration.go	Sanitizes schema identifier in CREATE SCHEMA statement and adds pgx import
service/pkg/db/db.go	Sanitizes schema identifier in SET search_path statement

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[gemini-code-assist]

Code Review

This pull request correctly addresses a critical SQL injection vulnerability by sanitizing database schema identifiers. The use of pgx.Identifier{...}.Sanitize() is an effective fix. I've added a couple of suggestions for further refinement to use pgx's parameter binding for identifiers, which is a more idiomatic approach and improves code clarity and maintainability.