stackrox · davdhacs · Apr 11, 2026 · Apr 11, 2026 · Apr 11, 2026 · Apr 11, 2026
diff --git a/central/alert/datastore/bench_postgres_test.go b/central/alert/datastore/bench_postgres_test.go
@@ -300,7 +300,7 @@ func runSearchRawAlerts(ctx context.Context, t testing.TB, datastore DataStore,
 
 func runSelectQuery(ctx context.Context, t testing.TB, testDB *pgtest.TestPostgres, q *v1.Query, expected []*violationsBySeverity) {
 	var results []*violationsBySeverity
-	err := postgres.RunSelectRequestForSchemaFn[violationsBySeverity](ctx, testDB.DB, schema.AlertsSchema, q, func(r *violationsBySeverity) error {
+	err := postgres.RunSelectRequestForSchemaFn[violationsBySeverity](ctx, testDB.DB, schema.AlertsSchema(), q, func(r *violationsBySeverity) error {
 		results = append(results, r)
 		return nil
 	})

diff --git a/central/alert/datastore/datastore_impl.go b/central/alert/datastore/datastore_impl.go
@@ -106,7 +106,7 @@ func (ds *datastoreImpl) SearchAlertPolicyNamesAndSeverities(ctx context.Context
 	}
 
 	var results []*alertviews.PolicyNameAndSeverity
-	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema, clonedQuery, func(r *alertviews.PolicyNameAndSeverity) error {
+	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema(), clonedQuery, func(r *alertviews.PolicyNameAndSeverity) error {
 		results = append(results, r)
 		return nil
 	})
@@ -129,7 +129,7 @@ func (ds *datastoreImpl) SearchAlertPolicySeverityCounts(ctx context.Context, q
 	emptyResult := &alertviews.PolicySeverityCounts{}
 	results := make([]*alertviews.PolicySeverityCounts, 0)
 	// TODO(ROX-33425): replace call with one specific for counts that only returns a single row
-	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema, countQuery, func(r *alertviews.PolicySeverityCounts) error {
+	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema(), countQuery, func(r *alertviews.PolicySeverityCounts) error {
 		results = append(results, r)
 		return nil
 	})
@@ -162,7 +162,7 @@ func (ds *datastoreImpl) SearchAlertPolicyGroups(ctx context.Context, q *v1.Quer
 	groupQuery := alertviews.WithAlertPolicyGroupQuery(q)
 
 	var results []*alertviews.AlertPolicyGroup
-	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema, groupQuery, func(r *alertviews.AlertPolicyGroup) error {
+	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema(), groupQuery, func(r *alertviews.AlertPolicyGroup) error {
 		results = append(results, r)
 		return nil
 	})
@@ -183,7 +183,7 @@ func (ds *datastoreImpl) SearchAlertTimeseriesEvents(ctx context.Context, q *v1.
 	timeseriesQuery := alertviews.WithAlertTimeseriesQuery(q)
 
 	var results []*alertviews.AlertTimeseriesEvent
-	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema, timeseriesQuery, func(r *alertviews.AlertTimeseriesEvent) error {
+	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema(), timeseriesQuery, func(r *alertviews.AlertTimeseriesEvent) error {
 		results = append(results, r)
 		return nil
 	})
@@ -209,7 +209,7 @@ func (ds *datastoreImpl) SearchAlertDeploymentIDs(ctx context.Context, q *v1.Que
 	clonedQuery.Pagination = nil
 
 	var ids []string
-	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema, clonedQuery, func(r *alertviews.DeploymentIDResult) error {
+	err := pgSearch.RunSelectRequestForSchemaFn(ctx, ds.db, schema.AlertsSchema(), clonedQuery, func(r *alertviews.DeploymentIDResult) error {
 		if id := r.GetDeploymentID(); id != "" {
 			ids = append(ids, id)
 		}

diff --git a/central/alert/datastore/datastore_sac_test.go b/central/alert/datastore/datastore_sac_test.go
@@ -48,7 +48,7 @@ func (s *alertDatastoreSACTestSuite) SetupSuite() {
 	s.Require().NotNil(pgtestbase)
 	s.pool = pgtestbase.DB
 	s.datastore = GetTestPostgresDataStore(s.T(), s.pool)
-	s.optionsMap = schema.AlertsSchema.OptionsMap
+	s.optionsMap = schema.AlertsSchema().OptionsMap
 
 	s.testContexts = testutils.GetNamespaceScopedTestContexts(context.Background(), s.T(), resources.Alert)
 }

diff --git a/central/alert/datastore/internal/store/postgres/store.go b/central/alert/datastore/internal/store/postgres/store.go
diff --git a/central/apitoken/datastore/internal/schedulestore/postgres/store.go b/central/apitoken/datastore/internal/schedulestore/postgres/store.go
diff --git a/central/apitoken/datastore/internal/store/postgres/store.go b/central/apitoken/datastore/internal/store/postgres/store.go
diff --git a/central/apitoken/service/service_impl_test.go b/central/apitoken/service/service_impl_test.go
@@ -42,7 +42,7 @@ func TestServiceImpl_ListAllowedRoles_SortsRoleAlphabetically(t *testing.T) {
 	s := &serviceImpl{roles: mockDatastore}
 
 	ctx := context.Background()
-	ctx = authn.ContextWithIdentity(ctx, mockIdentity, t)
+	ctx = authn.ContextWithIdentity(ctx, mockIdentity)
 
 	actual, err := s.ListAllowedTokenRoles(ctx, &v1.Empty{})
 

diff --git a/central/audit/audit_test.go b/central/audit/audit_test.go
@@ -112,8 +112,7 @@ func (suite *AuditLogTestSuite) TestPermissionsRemoval() {
 	suite.identityMock.EXPECT().Service().Return(nil).AnyTimes()
 	suite.identityMock.EXPECT().User().Return(userInfo).AnyTimes()
 
-	ctxWithMockIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock,
-		suite.T())
+	ctxWithMockIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock)
 
 	a := &audit{}
 	withPermissions := a.newAuditMessage(ctxWithMockIdentity, "this is a test", "/v1./Test",
@@ -140,7 +139,7 @@ func (suite *AuditLogTestSuite) TestServiceRequestsForInternalTokenEndpointAreAu
 	suite.identityMock.EXPECT().Service().Return(serviceIdentity).AnyTimes()
 	suite.identityMock.EXPECT().User().Return(nil).AnyTimes()
 
-	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock, suite.T())
+	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock)
 	ctxWithAuth := interceptor.ContextWithAuthStatus(ctxWithServiceIdentity, nil)
 
 	a := &audit{notifications: suite.notifierMock}
@@ -169,7 +168,7 @@ func (suite *AuditLogTestSuite) TestServiceRequestsForOtherEndpointsAreNotAudite
 	}
 	suite.identityMock.EXPECT().Service().Return(serviceIdentity).AnyTimes()
 
-	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock, suite.T())
+	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock)
 	ctxWithAuth := interceptor.ContextWithAuthStatus(ctxWithServiceIdentity, nil)
 
 	a := &audit{notifications: suite.notifierMock}
@@ -191,7 +190,7 @@ func (suite *AuditLogTestSuite) TestServiceRequestsForInternalTokenEndpointWithA
 	suite.identityMock.EXPECT().Service().Return(serviceIdentity).AnyTimes()
 	suite.identityMock.EXPECT().User().Return(nil).AnyTimes()
 
-	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock, suite.T())
+	ctxWithServiceIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock)
 	ctxWithAuth := interceptor.ContextWithAuthStatus(ctxWithServiceIdentity, nil)
 
 	a := &audit{notifications: suite.notifierMock}
@@ -219,7 +218,7 @@ func (suite *AuditLogTestSuite) TestUserRequestsContinueToBeAudited() {
 	suite.identityMock.EXPECT().Service().Return(nil).AnyTimes()
 	suite.identityMock.EXPECT().User().Return(userInfo).AnyTimes()
 
-	ctxWithUserIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock, suite.T())
+	ctxWithUserIdentity := authn.ContextWithIdentity(context.Background(), suite.identityMock)
 	ctxWithAuth := interceptor.ContextWithAuthStatus(ctxWithUserIdentity, nil)
 
 	a := &audit{notifications: suite.notifierMock}

@@ -265,7 +265,7 @@ func TestEnforce(t *testing.T) {
 		ctrl := gomock.NewController(t)
 		mockIdentity := authnMocks.NewMockIdentity(ctrl)
 		mockIdentity.EXPECT().Service().Return(nil).AnyTimes()
-		ctx := authn.ContextWithIdentity(t.Context(), mockIdentity, t)
+		ctx := authn.ContextWithIdentity(t.Context(), mockIdentity)
 
 		req := &v1.GenerateTokenForPermissionsAndScopeRequest{
 			Permissions:   map[string]v1.Access{"Deployment": v1.Access_READ_ACCESS},
@@ -284,7 +284,7 @@ func TestEnforce(t *testing.T) {
 			Id:   "some-service-id",
 			Type: storage.ServiceType_CENTRAL_SERVICE,
 		}).AnyTimes()
-		ctx := authn.ContextWithIdentity(t.Context(), mockIdentity, t)
+		ctx := authn.ContextWithIdentity(t.Context(), mockIdentity)
 
 		req := &v1.GenerateTokenForPermissionsAndScopeRequest{
 			Permissions:   map[string]v1.Access{"Deployment": v1.Access_READ_ACCESS},

@@ -46,7 +46,7 @@ func sensorContext(t testing.TB, ctrl *gomock.Controller, clusterID string) cont
 		Id:   clusterID,
 		Type: storage.ServiceType_SENSOR_SERVICE,
 	}).AnyTimes()
-	return authn.ContextWithIdentity(t.Context(), mockIdentity, t)
+	return authn.ContextWithIdentity(t.Context(), mockIdentity)
 }
 
 func TestGetExpiresAt(t *testing.T) {

@@ -81,10 +81,10 @@ func (s *authServiceAccessControlTestSuite) SetupSuite() {
 	)
 	s.Require().NoError(err)
 	s.authProvider = authProvider
-	s.withAdminRoleCtx = basic.ContextWithAdminIdentity(s.T(), s.authProvider)
-	s.withNoneRoleCtx = basic.ContextWithNoneIdentity(s.T(), s.authProvider)
-	s.withNoAccessCtx = basic.ContextWithNoAccessIdentity(s.T(), s.authProvider)
-	s.withNoRoleCtx = basic.ContextWithNoRoleIdentity(s.T(), s.authProvider)
+	s.withAdminRoleCtx = basic.ContextWithAdminIdentity(s.authProvider)
+	s.withNoneRoleCtx = basic.ContextWithNoneIdentity(s.authProvider)
+	s.withNoAccessCtx = basic.ContextWithNoAccessIdentity(s.authProvider)
+	s.withNoRoleCtx = basic.ContextWithNoRoleIdentity(s.authProvider)
 	s.anonymousCtx = context.Background()
 
 	s.accessCtx = sac.WithGlobalAccessScopeChecker(context.Background(),

diff --git a/central/authprovider/datastore/internal/store/postgres/store.go b/central/authprovider/datastore/internal/store/postgres/store.go
diff --git a/central/baseimage/datastore/repository/datastore_impl_test.go b/central/baseimage/datastore/repository/datastore_impl_test.go
@@ -67,10 +67,10 @@ func (s *BaseImageRepositoryDatastoreTestSuite) SetupSuite() {
 			sac.AccessModeScopeKeys(storage.Access_READ_ACCESS, storage.Access_READ_WRITE_ACCESS),
 			sac.ResourceScopeKeys(resources.ImageAdministration),
 		))
-	s.imgAdminCtx = authn.ContextWithIdentity(ctx, mockID, s.T())
+	s.imgAdminCtx = authn.ContextWithIdentity(ctx, mockID)
 
 	ctx = sac.WithGlobalAccessScopeChecker(context.Background(), sac.DenyAllAccessScopeChecker())
-	s.normalUserCtx = authn.ContextWithIdentity(ctx, mockID, s.T())
+	s.normalUserCtx = authn.ContextWithIdentity(ctx, mockID)
 }
 
 func (s *BaseImageRepositoryDatastoreTestSuite) SetupTest() {
@@ -183,7 +183,7 @@ func (s *BaseImageRepositoryDatastoreTestSuite) TestListRepositoriesAccessDenied
 	)
 	s.Require().NoError(err)
 
-	noAccessCtx := sac.WithNoAccess(basic.ContextWithNoAccessIdentity(s.T(), authProvider))
+	noAccessCtx := sac.WithNoAccess(basic.ContextWithNoAccessIdentity(authProvider))
 
 	repos, err := s.datastore.ListRepositories(noAccessCtx)
 	s.Error(err, "ListRepositories should fail for user with no access")

diff --git a/central/baseimage/store/postgres/store.go b/central/baseimage/store/postgres/store.go
diff --git a/central/baseimage/store/repository/postgres/store.go b/central/baseimage/store/repository/postgres/store.go
diff --git a/central/baseimage/store/tag/postgres/store.go b/central/baseimage/store/tag/postgres/store.go
diff --git a/central/baseimagelayer/store/postgres/store.go b/central/baseimagelayer/store/postgres/store.go
diff --git a/central/blob/datastore/store/postgres/store.go b/central/blob/datastore/store/postgres/store.go
diff --git a/central/cluster/datastore/datastore_sac_test.go b/central/cluster/datastore/datastore_sac_test.go
@@ -49,7 +49,7 @@ func (s *clusterDatastoreSACSuite) SetupSuite() {
 	s.NotNil(s.pgTestBase)
 	s.datastore, err = GetTestPostgresDataStore(s.T(), s.pgTestBase.DB)
 	s.Require().NoError(err)
-	s.optionsMap = schema.ClustersSchema.OptionsMap
+	s.optionsMap = schema.ClustersSchema().OptionsMap
 	s.testContexts = testutils.GetNamespaceScopedTestContexts(context.Background(), s.T(), resources.Cluster)
 }
 

diff --git a/central/cluster/store/cluster/postgres/store.go b/central/cluster/store/cluster/postgres/store.go
diff --git a/central/cluster/store/clusterhealth/postgres/store.go b/central/cluster/store/clusterhealth/postgres/store.go
diff --git a/central/clustercveedge/datastore/store/postgres/store.go b/central/clustercveedge/datastore/store/postgres/store.go
diff --git a/central/clusterinit/store/postgres/store.go b/central/clusterinit/store/postgres/store.go
diff --git a/central/compliance/aggregation/aggregation.go b/central/compliance/aggregation/aggregation.go
@@ -611,17 +611,17 @@ func (a *aggregatorImpl) getSearchFuncs() map[storage.ComplianceAggregation_Scop
 		storage.ComplianceAggregation_CLUSTER: {
 			searchFunc: a.clusters.Search,
 			countFunc:  a.clusters.Count,
-			optionsMap: schema.ClustersSchema.OptionsMap,
+			optionsMap: schema.ClustersSchema().OptionsMap,
 		},
 		storage.ComplianceAggregation_NODE: {
 			searchFunc: a.nodes.Search,
 			countFunc:  a.nodes.Count,
-			optionsMap: schema.NodesSchema.OptionsMap,
+			optionsMap: schema.NodesSchema().OptionsMap,
 		},
 		storage.ComplianceAggregation_NAMESPACE: {
 			searchFunc: a.namespaces.Search,
 			countFunc:  a.namespaces.Count,
-			optionsMap: schema.NamespacesSchema.OptionsMap,
+			optionsMap: schema.NamespacesSchema().OptionsMap,
 		},
 		storage.ComplianceAggregation_CONTROL: {
 			searchFunc: wrapContextLessSearchFunc(a.standards.SearchControls),

diff --git a/central/compliance/datastore/internal/store/postgres/compliance_config/store.go b/central/compliance/datastore/internal/store/postgres/compliance_config/store.go
diff --git a/central/compliance/datastore/internal/store/postgres/domain/store.go b/central/compliance/datastore/internal/store/postgres/domain/store.go
diff --git a/central/compliance/datastore/internal/store/postgres/metadata/store.go b/central/compliance/datastore/internal/store/postgres/metadata/store.go