fix(vector): harden packaged migrations

2026-07-12 01:32:33 +02:00
parent c0d50e9b08
commit 3588a7749b
14 changed files with 337 additions and 54 deletions
@@ -0,0 +1,23 @@
+DO $roles$
+BEGIN
+    IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'vector_reader') THEN
+        CREATE ROLE vector_reader NOLOGIN;
+    END IF;
+    IF NOT EXISTS (SELECT 1 FROM pg_catalog.pg_roles WHERE rolname = 'vector_writer') THEN
+        CREATE ROLE vector_writer NOLOGIN;
+    END IF;
+END
+$roles$;
+
+REVOKE ALL ON SCHEMA vectors FROM vector_reader, vector_writer;
+REVOKE ALL ON ALL TABLES IN SCHEMA vectors FROM vector_reader, vector_writer;
+REVOKE ALL ON ALL SEQUENCES IN SCHEMA vectors FROM vector_reader, vector_writer;
+
+GRANT USAGE ON SCHEMA vectors TO vector_reader, vector_writer;
+GRANT SELECT ON ALL TABLES IN SCHEMA vectors TO vector_reader;
+
+GRANT INSERT, UPDATE
+ON vectors.schema_records, vectors.evidence, vectors.memory TO vector_writer;
+GRANT SELECT (record_key, kind, content_hash)
+ON vectors.schema_records, vectors.evidence, vectors.memory TO vector_writer;
+GRANT USAGE ON ALL SEQUENCES IN SCHEMA vectors TO vector_writer;