glass beadian
aa5e262f3a
Self-hosted multi-platform broadcast newsroom for activist collectives: publishing pipeline with group approval and DST-proof scheduling, TweetDeck-style column wall with hostile-content-safe rendering, live control room with Auto Director, bridged chat governance with polls and quorum, distributed sandboxed transcode workers, encrypted content-addressed archive, monthly analytics. MIT licensed. See README.md and docs/.
19 lines
815 B
SQL
19 lines
815 B
SQL
-- 003: dedicated non-superuser app role for the runtime pool.
|
|
-- Migrations run as the table owner (superuser in dev); the application and
|
|
-- tests connect as sp_app — neither superuser nor owner — so FORCE ROW LEVEL
|
|
-- SECURITY binds for real.
|
|
DO $$
|
|
BEGIN
|
|
IF NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'sp_app') THEN
|
|
CREATE ROLE sp_app LOGIN PASSWORD 'sp_app_dev' NOSUPERUSER NOCREATEDB NOCREATEROLE;
|
|
END IF;
|
|
END $$;
|
|
|
|
GRANT USAGE ON SCHEMA public TO sp_app;
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO sp_app;
|
|
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO sp_app;
|
|
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO sp_app;
|
|
ALTER DEFAULT PRIVILEGES IN SCHEMA public
|
|
GRANT USAGE, SELECT ON SEQUENCES TO sp_app;
|