Warre (hal-developer)
1e7772ad29
PostgreSQL 15+ revokes CREATE from non-superusers in public schema by default. Child 1's migration created the tables as postgres superuser, leaving the txt_game_scores app user with no privileges — causing "permission denied" on every request in production. Adds a numbered provision migration to GRANT SELECT/INSERT/UPDATE on players and games, plus USAGE/SELECT on games_id_seq, to the app user. Task: d1c49d59-57bd-4eba-9e22-f25a04157ad4
30 lines
847 B
TypeScript
30 lines
847 B
TypeScript
import pg from "pg";
|
|
|
|
const client = new pg.Client({
|
|
host: process.env.PROVISION_HOST,
|
|
port: parseInt(process.env.PROVISION_PORT ?? "5432"),
|
|
user: process.env.PROVISION_USER,
|
|
password: process.env.PROVISION_PASSWORD,
|
|
database: process.env.PROVISION_DATABASE,
|
|
});
|
|
|
|
await client.connect();
|
|
|
|
try {
|
|
// The HAL postgres provisioner names the app user identically to the database.
|
|
// PROVISION_DATABASE = "txt_game_scores" = the app user that server.mjs connects as.
|
|
const appUser = process.env.PROVISION_DATABASE as string;
|
|
|
|
await client.query(
|
|
`GRANT SELECT, INSERT, UPDATE ON TABLE players, games TO "${appUser}"`
|
|
);
|
|
|
|
await client.query(
|
|
`GRANT USAGE, SELECT ON SEQUENCE games_id_seq TO "${appUser}"`
|
|
);
|
|
|
|
console.log(`[txt-game migration-001] permissions granted to ${appUser}`);
|
|
} finally {
|
|
await client.end();
|
|
}
|