fix(ci): apply the CI role grants in coreci_ci and FOR ROLE migrator - the app role had no table grants (42501)

2026-10-27 04:57:14 +00:00
parent ab2f4ab942
commit b25e949dbe
1 changed files with 13 additions and 4 deletions
@@ -37,6 +37,15 @@ BEGIN
  END IF;
 END $$;

+-- Create the CI database FIRST (the service container's default is `postgres`;
+-- the migrations and the test run happen in `coreci_ci`). The grants below are
+-- per-database, so they have to be applied in the database the tests use.
+SELECT 'CREATE DATABASE coreci_ci OWNER migrator'
+WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'coreci_ci')\gexec-- Switch to that database. The script connects to `postgres` first (the roles
+-- are cluster-level and the database does not exist yet); schema and table
+-- privileges granted in `postgres` do not reach the tables in `coreci_ci`.
+\connect coreci_ci
+
 -- Grant schema + table privileges. The migrator creates tables; the app
 -- role gets DML (INSERT/SELECT/UPDATE/DELETE) on the tables it owns. RLS
 -- policies enforce tenant scoping (the WITH CHECK clause blocks cross-tenant
@@ -47,9 +56,11 @@ GRANT CREATE ON SCHEMA public TO migrator;
 -- The app role gets DML on all current + future tables in public. The
 -- migrations CREATE TABLE with no explicit owner (migrator owns them); the
 -- app role connects and queries/inserts under RLS.
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
+-- The default privileges are set FOR ROLE migrator: set as another
+-- role they would not apply to the tables the migrations create.
+ALTER DEFAULT PRIVILEGES FOR ROLE migrator IN SCHEMA public
  GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO coreci_app;
-ALTER DEFAULT PRIVILEGES IN SCHEMA public
+ALTER DEFAULT PRIVILEGES FOR ROLE migrator IN SCHEMA public
  GRANT USAGE ON SEQUENCES TO coreci_app;

 -- For tables created by migrations BEFORE this grant took effect, apply
@@ -67,5 +78,3 @@ END $$;
 -- Create the CI database (the service container's default is `postgres`;
 -- the CI workflow creates a separate `coreci_ci` database for the test run).
 -- This is optional — the workflow may set DATABASE_URL to point at any DB.
-SELECT 'CREATE DATABASE coreci_ci OWNER migrator'
-WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = 'coreci_ci')\gexec