feat(bell): add immutable event store [T-015]

2026-08-10 23:53:11 +08:00
parent 5b42f58f23
commit 236964d242
28 changed files with 1434 additions and 27 deletions
@@ -0,0 +1,15 @@
+-- Runtime Bell can append/read event facts but cannot rewrite, delete or
+-- truncate them. Object ownership stays with the offline migration role.
+
+REVOKE ALL ON FUNCTION bell.reject_immutable_change() FROM PUBLIC;
+REVOKE ALL ON TABLE bell.events, bell.event_outcomes FROM PUBLIC;
+REVOKE ALL ON TABLE bell.events, bell.event_outcomes FROM bell_runtime;
+
+GRANT USAGE ON SCHEMA bell TO bell_runtime;
+GRANT SELECT ON TABLE bell.schema_migrations TO bell_runtime;
+GRANT SELECT, INSERT ON TABLE bell.events, bell.event_outcomes TO bell_runtime;
+
+ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell
+    REVOKE ALL ON TABLES FROM PUBLIC;
+ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell
+    REVOKE ALL ON FUNCTIONS FROM PUBLIC;