feat(sense): implement Control API v1 [T-011]

deploy/postgres/tests/assertions.sql

@@ -72,7 +72,7 @@ BEGIN
         RAISE EXCEPTION 'sense_app lacks access to its local audit Outbox';
     END IF;
     IF (SELECT max(version) FROM bell.schema_migrations) <> 2
-       OR (SELECT max(version) FROM sense.schema_migrations) <> 3 THEN
+       OR (SELECT max(version) FROM sense.schema_migrations) <> 4 THEN
         RAISE EXCEPTION 'schema migration version drift';
     END IF;
 
@@ -126,3 +126,28 @@ BEGIN
     WHERE tenant_id = 'assertion-tenant' AND id = 'assertion-site';
 END
 $assertions$;
+
+DO $control_api$
+BEGIN
+    IF NOT has_table_privilege('yovision_t011_sense', 'sense.control_idempotency_receipts', 'SELECT,INSERT,UPDATE,DELETE')
+       OR NOT has_table_privilege('yovision_t011_sense', 'sense.batch_operations', 'SELECT,INSERT,UPDATE,DELETE')
+       OR NOT has_table_privilege('yovision_t011_sense', 'sense.batch_operation_items', 'SELECT,INSERT,UPDATE,DELETE') THEN
+        RAISE EXCEPTION 'Sense runtime lacks Control API table privileges';
+    END IF;
+    IF has_table_privilege('public', 'sense.control_idempotency_receipts', 'SELECT')
+       OR has_table_privilege('public', 'sense.batch_operations', 'SELECT') THEN
+        RAISE EXCEPTION 'Control API durable state leaked to PUBLIC';
+    END IF;
+    IF NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'sense' AND table_name = 'devices'
+          AND column_name = 'resource_version'
+    ) OR NOT EXISTS (
+        SELECT 1 FROM information_schema.columns
+        WHERE table_schema = 'sense' AND table_name = 'devices'
+          AND column_name = 'profile_token'
+    ) THEN
+        RAISE EXCEPTION 'Control API device columns are missing';
+    END IF;
+END
+$control_api$;