diff --git a/database/README.md b/database/README.md index a16f9c5..33c300f 100644 --- a/database/README.md +++ b/database/README.md @@ -45,7 +45,7 @@ Requires the Flyway CLI (needs a JDK 17+) and Docker. ```zsh # 1. Start a local Postgres docker container -docker run --name=eventgate_db -e POSTGRES_PASSWORD=changeme -e POSTGRES_DB=eventgate_db -p 5432:5432 -d postgres:16 +docker run --name=eventgate_db -e POSTGRES_PASSWORD=changeme -e POSTGRES_DB=eventgate -p 5432:5432 -d postgres:16 # 2. Apply the migrations (run from the repo root, where flyway.toml lives) export FLYWAY_PLACEHOLDERS_EVENTGATE_OWNER_PASSWORD=changeme diff --git a/database/migrations/00_databases.ddl b/database/migrations/00_databases.ddl index 710ed5d..808213d 100644 --- a/database/migrations/00_databases.ddl +++ b/database/migrations/00_databases.ddl @@ -18,7 +18,7 @@ -- Flyway connects to an existing database, so it cannot create the database it migrates. -- This script is intentionally NOT prefixed with `V`, so Flyway ignores it. -CREATE DATABASE eventgate_db +CREATE DATABASE eventgate WITH ENCODING = 'UTF8' CONNECTION LIMIT = -1; diff --git a/database/migrations/V1.4.0.3__grants.ddl b/database/migrations/V1.4.0.3__grants.ddl index 7282e9a..c61b563 100644 --- a/database/migrations/V1.4.0.3__grants.ddl +++ b/database/migrations/V1.4.0.3__grants.ddl @@ -49,10 +49,17 @@ TO eventgate_writer; -- Writer needs the SERIAL sequence (public_cps_za_runs_jobs.internal_id) to insert. GRANT USAGE, SELECT ON SEQUENCE public.public_cps_za_runs_jobs_internal_id_seq TO eventgate_writer; --- Default privileges -ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public +-- Default privileges for objects the owner creates in the future. +-- Executed as eventgate_owner: on managed Postgres (Aurora/RDS) the migration user is not a true superuser +-- and holds only non-inherited membership in eventgate_owner, so "ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner" +-- is refused. SET ROLE assumes the owner identity, for which membership suffices. +SET ROLE eventgate_owner; + +ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO eventgate_reader; -ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public +ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT, INSERT, UPDATE ON TABLES TO eventgate_writer; -ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public +ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT USAGE, SELECT ON SEQUENCES TO eventgate_writer; + +RESET ROLE; diff --git a/flyway.toml b/flyway.toml index e252d13..5f34acd 100644 --- a/flyway.toml +++ b/flyway.toml @@ -23,6 +23,6 @@ locations = ["filesystem:database/migrations"] sqlMigrationSuffixes = [".ddl", ".sql"] [environments.default] -url = "jdbc:postgresql://localhost:5432/eventgate_db" +url = "jdbc:postgresql://localhost:5432/eventgate" user = "postgres" password = "changeme"