SIAX Agent
4dbabd14ac
masterplan-lock / check (push) Successful in 7s
CI (SIAX Cloud) / sonar (pull_request) Skipped
masterplan-lock / check (pull_request) Successful in 6s
CI (SIAX Cloud) / security (pull_request) Successful in 19s
CI (SIAX Cloud) / integration (pull_request) Successful in 45s
Security Scan (SIAX Cloud) / security (pull_request) Successful in 1m7s
CI (SIAX Cloud) / quality (pull_request) Successful in 10m7s
022 skapade tabellerna som 0pt_edge; appen kör som 0pt_app och fick 'permission denied'. Övriga 0pt-tabeller har explicita grants (inga default ACL), så kanoniska tabeller behöver samma. Idempotent och rollskyddad; RLS (FORCE) gäller fortfarande för 0pt_app.
20 lines
766 B
SQL
20 lines
766 B
SQL
-- 023_canonical_grants.sql — app-role privileges for 022 canonical tables.
|
|
--
|
|
-- Tables created by a manual psql migration are owned by the migrating role
|
|
-- (0pt_edge); the running application connects as 0pt_app. Existing 0pt tables
|
|
-- carry explicit grants rather than default ACLs, so the canonical tables need
|
|
-- the same treatment. RLS still applies to 0pt_app (FORCE is on); this only
|
|
-- grants the statement privileges, not row visibility.
|
|
--
|
|
-- Idempotent and role-guarded: no-op in environments without the app role.
|
|
|
|
DO $$
|
|
BEGIN
|
|
IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '0pt_app') THEN
|
|
GRANT SELECT, INSERT, UPDATE, DELETE
|
|
ON opt_canonical_entities, opt_canonical_facts, opt_canonical_relations
|
|
TO 0pt_app;
|
|
END IF;
|
|
END
|
|
$$;
|