#201: flyway post-migration improvements

database/README.md

@@ -45,7 +45,7 @@ Requires the Flyway CLI (needs a JDK 17+) and Docker.
 
 ```zsh
 # 1. Start a local Postgres docker container
-docker run --name=eventgate_db -e POSTGRES_PASSWORD=changeme -e POSTGRES_DB=eventgate_db -p 5432:5432 -d postgres:16
+docker run --name=eventgate_db -e POSTGRES_PASSWORD=changeme -e POSTGRES_DB=eventgate -p 5432:5432 -d postgres:16
 
 # 2. Apply the migrations (run from the repo root, where flyway.toml lives)
 export FLYWAY_PLACEHOLDERS_EVENTGATE_OWNER_PASSWORD=changeme

database/migrations/00_databases.ddl

@@ -18,7 +18,7 @@
 -- Flyway connects to an existing database, so it cannot create the database it migrates.
 -- This script is intentionally NOT prefixed with `V`, so Flyway ignores it.
 
-CREATE DATABASE eventgate_db
+CREATE DATABASE eventgate
     WITH
     ENCODING = 'UTF8'
     CONNECTION LIMIT = -1;

database/migrations/V1.4.0.3__grants.ddl

@@ -49,10 +49,17 @@ TO eventgate_writer;
 -- Writer needs the SERIAL sequence (public_cps_za_runs_jobs.internal_id) to insert.
 GRANT USAGE, SELECT ON SEQUENCE public.public_cps_za_runs_jobs_internal_id_seq TO eventgate_writer;
 
--- Default privileges
-ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public
+-- Default privileges for objects the owner creates in the future.
+-- Executed as eventgate_owner: on managed Postgres (Aurora/RDS) the migration user is not a true superuser
+-- and holds only non-inherited membership in eventgate_owner, so "ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner"
+-- is refused. SET ROLE assumes the owner identity, for which membership suffices.
+SET ROLE eventgate_owner;
+
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
     GRANT SELECT ON TABLES TO eventgate_reader;
-ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
     GRANT SELECT, INSERT, UPDATE ON TABLES TO eventgate_writer;
-ALTER DEFAULT PRIVILEGES FOR ROLE eventgate_owner IN SCHEMA public
+ALTER DEFAULT PRIVILEGES IN SCHEMA public
     GRANT USAGE, SELECT ON SEQUENCES TO eventgate_writer;
+
+RESET ROLE;

flyway.toml

@@ -23,6 +23,6 @@ locations = ["filesystem:database/migrations"]
 sqlMigrationSuffixes = [".ddl", ".sql"]
 
 [environments.default]
-url = "jdbc:postgresql://localhost:5432/eventgate_db"
+url = "jdbc:postgresql://localhost:5432/eventgate"
 user = "postgres"
 password = "changeme"