feat(store): add Area admission and audit outbox [T-010]

2026-08-07 18:23:24 +08:00
parent 8abff0a566
commit 36786723e3
23 changed files with 1346 additions and 99 deletions
@@ -0,0 +1,18 @@
+-- Extend the T-009 least-privilege boundary to the Area projection and new
+-- Sense-owned state. Reapplying this file is intentional and safe.
+
+REVOKE ALL ON TABLE bell.area_policy_v1 FROM PUBLIC;
+REVOKE ALL ON TABLE bell.areas FROM PUBLIC;
+REVOKE ALL ON FUNCTION bell.bump_area_version() FROM PUBLIC;
+
+GRANT USAGE ON SCHEMA bell TO sense_app;
+GRANT SELECT ON TABLE bell.area_policy_v1 TO sense_app;
+REVOKE ALL ON TABLE bell.areas FROM sense_app;
+REVOKE ALL ON FUNCTION bell.bump_area_version() FROM sense_app;
+
+REVOKE ALL ON TABLE sense.area_policy_projection_state FROM PUBLIC;
+REVOKE ALL ON TABLE sense.device_operation_outbox FROM PUBLIC;
+GRANT SELECT, INSERT, UPDATE, DELETE ON TABLE
+    sense.area_policy_projection_state,
+    sense.device_operation_outbox
+TO sense_app;