opc/yovision
2
0
Fork 0
Code Issues 1 Pull Requests 8 Actions Packages Projects Releases Wiki Activity

feat(store): add PostgreSQL foundation [T-009]
Harness governance / validate (push) Has been cancelled
Details
Harness governance / validate (pull_request) Has been cancelled
Details

Browse Source
This commit is contained in:
QiuSW
2026-08-07 17:52:50 +08:00
parent 04231d006a
commit 2ff7ff5618
23 changed files with 1593 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
deploy/postgres/004_privileges.sql
+21
View File
@@ -0,0 +1,21 @@
-- Cross-schema privileges are intentionally one-way: Bell publishes one view;
-- Sense cannot read Bell source tables or write any Bell object.
REVOKE ALL ON SCHEMA bell FROM PUBLIC;
REVOKE ALL ON ALL TABLES IN SCHEMA bell FROM PUBLIC;
REVOKE ALL ON ALL FUNCTIONS IN SCHEMA bell FROM PUBLIC;
REVOKE ALL ON SCHEMA sense FROM PUBLIC;
REVOKE ALL ON ALL TABLES IN SCHEMA sense FROM PUBLIC;
GRANT USAGE ON SCHEMA bell TO sense_app;
GRANT SELECT ON TABLE bell.site_quota_v1 TO sense_app;
REVOKE ALL ON TABLE bell.sites FROM sense_app;
REVOKE ALL ON TABLE bell.schema_migrations FROM sense_app;
REVOKE ALL ON FUNCTION bell.bump_site_version() FROM sense_app;
GRANT USAGE ON SCHEMA sense TO sense_app;
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA sense TO sense_app;
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON TABLES FROM PUBLIC;
ALTER DEFAULT PRIVILEGES FOR ROLE bell_app IN SCHEMA bell REVOKE ALL ON FUNCTIONS FROM PUBLIC;
ALTER DEFAULT PRIVILEGES FOR ROLE sense_app IN SCHEMA sense REVOKE ALL ON TABLES FROM PUBLIC;