feat(bell): add immutable event store [T-015]

2026-08-10 23:53:11 +08:00
parent 5b42f58f23
commit 236964d242
28 changed files with 1434 additions and 27 deletions
@@ -58,6 +58,8 @@ class PostgresContractTests(unittest.TestCase):
                "009_privileges_control_api.sql",
                "010_reconcile_safety.sql",
                "011_privileges_reconcile_safety.sql",
+                "012_bell_events.sql",
+                "013_privileges_bell_events.sql",
            ],
            names,
        )
@@ -71,6 +73,15 @@ class PostgresContractTests(unittest.TestCase):
            )
        self.assertNotRegex(text, r"\bpassword\b")

+    def test_bell_runtime_role_is_separate_from_migration_owner(self) -> None:
+        text = normalized(migration_text("012_bell_events.sql"))
+        self.assertIn(
+            "create role bell_runtime nologin nosuperuser nocreatedb nocreaterole noreplication",
+            text,
+        )
+        self.assertNotIn("grant bell_app to bell_runtime", text)
+        self.assertIn("pg_has_role('bell_runtime', 'bell_app', 'member')", text)
+
    def test_bell_quota_contract_and_version_are_enforced(self) -> None:
        text = normalized(migration_text("002_bell.sql"))
        expected_signature = (