ConusAI vendor v0.1.0-dev.20261027+9b1131fb

2026-10-27 18:05:17 +00:00
commit 3102273ec7
538 changed files with 80203 additions and 0 deletions
@@ -0,0 +1,46 @@
+-- SPDX-License-Identifier: LicenseRef-ConusAI-Template-1.0
+-- The three roles a linked managed Postgres exposes, created the way the platform creates them
+-- (docs/architecture/managed-postgres-roles.md, data-services DS21). Development only: on the
+-- platform these statements are the provider's, and the passwords are derived, not written down.
+--
+-- Owner    appdev_owner   owns the database and schema public; the migrate job's role
+-- Runtime  appdev_app     owns nothing, so row-level security binds it; web and worker
+-- Reader   appdev_reader  holds no table privilege until this app's own migrations grant one
+
+CREATE ROLE appdev_owner  LOGIN PASSWORD 'appdev_owner'  NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS NOINHERIT NOREPLICATION;
+CREATE ROLE appdev_app    LOGIN PASSWORD 'appdev_app'    NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS NOINHERIT NOREPLICATION;
+CREATE ROLE appdev_reader LOGIN PASSWORD 'appdev_reader' NOSUPERUSER NOCREATEDB NOCREATEROLE NOBYPASSRLS NOINHERIT NOREPLICATION;
+
+ALTER DATABASE "appdev" OWNER TO "appdev_owner";
+REVOKE ALL ON DATABASE "appdev" FROM PUBLIC;
+GRANT CONNECT, TEMPORARY ON DATABASE "appdev" TO "appdev_owner";
+GRANT CONNECT ON DATABASE "appdev" TO "appdev_app";
+GRANT CONNECT ON DATABASE "appdev" TO "appdev_reader";
+
+\connect appdev
+
+-- pgvector is not a trusted extension, so the owner role cannot create it; the platform's provider
+-- creates it as the administrator where the server offers it, and so does this script. The
+-- knowledge module's `create extension if not exists vector` is then a no-op.
+DO $$ BEGIN
+  IF EXISTS (SELECT 1 FROM pg_available_extensions WHERE name = 'vector') THEN
+    CREATE EXTENSION IF NOT EXISTS vector;
+  END IF;
+END $$;
+
+ALTER SCHEMA public OWNER TO "appdev_owner";
+REVOKE ALL ON SCHEMA public FROM PUBLIC;
+GRANT ALL ON SCHEMA public TO "appdev_owner";
+GRANT USAGE ON SCHEMA public TO "appdev_app";
+GRANT USAGE ON SCHEMA public TO "appdev_reader";
+
+-- No IN SCHEMA clause: every table the owner creates, in any schema a migration adds, is granted
+-- to the runtime role as it is created. There is no grant pass left to run after a migration.
+ALTER DEFAULT PRIVILEGES FOR ROLE "appdev_owner" GRANT USAGE ON SCHEMAS TO "appdev_app";
+ALTER DEFAULT PRIVILEGES FOR ROLE "appdev_owner" GRANT USAGE ON SCHEMAS TO "appdev_reader";
+ALTER DEFAULT PRIVILEGES FOR ROLE "appdev_owner" GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO "appdev_app";
+ALTER DEFAULT PRIVILEGES FOR ROLE "appdev_owner" GRANT USAGE, SELECT ON SEQUENCES TO "appdev_app";
+ALTER DEFAULT PRIVILEGES FOR ROLE "appdev_owner" GRANT EXECUTE ON FUNCTIONS TO "appdev_app";
+
+-- The reader gets nothing here. What it may read is this app's decision, and it is a GRANT in
+-- migrations/postgres/0002_reader_grants (apps/worker/src/migrations.ts).