-- 023_canonical_grants.sql — app-role privileges for 022 canonical tables.
--
-- Tables created by a manual psql migration are owned by the migrating role
-- (0pt_edge); the running application connects as 0pt_app. Existing 0pt tables
-- carry explicit grants rather than default ACLs, so the canonical tables need
-- the same treatment. RLS still applies to 0pt_app (FORCE is on); this only
-- grants the statement privileges, not row visibility.
--
-- Idempotent and role-guarded: no-op in environments without the app role.

DO $$
BEGIN
  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '0pt_app') THEN
    GRANT SELECT, INSERT, UPDATE, DELETE
      ON opt_canonical_entities, opt_canonical_facts, opt_canonical_relations
      TO "0pt_app";
  END IF;
END
$$;