20 lines
768 B
SQL
20 lines
768 B
SQL
-- 023_canonical_grants.sql — app-role privileges for 022 canonical tables.
|
|
--
|
|
-- Tables created by a manual psql migration are owned by the migrating role
|
|
-- (0pt_edge); the running application connects as 0pt_app. Existing 0pt tables
|
|
-- carry explicit grants rather than default ACLs, so the canonical tables need
|
|
-- the same treatment. RLS still applies to 0pt_app (FORCE is on); this only
|
|
-- grants the statement privileges, not row visibility.
|
|
--
|
|
-- Idempotent and role-guarded: no-op in environments without the app role.
|
|
|
|
DO $$
|
|
BEGIN
|
|
IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '0pt_app') THEN
|
|
GRANT SELECT, INSERT, UPDATE, DELETE
|
|
ON opt_canonical_entities, opt_canonical_facts, opt_canonical_relations
|
|
TO "0pt_app";
|
|
END IF;
|
|
END
|
|
$$;
|