From 6d1ab03ef7796af62065f5ebc9003b52133f3c3f Mon Sep 17 00:00:00 2001 From: bot-backend Date: Thu, 2 Jul 2026 17:47:02 +0300 Subject: [PATCH] feat(market): grant gendesign_reader SELECT on contract views (#2138 step 1/3) --- .../155_reader_grants_to_contract_views.sql | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 tradein-mvp/backend/data/sql/155_reader_grants_to_contract_views.sql diff --git a/tradein-mvp/backend/data/sql/155_reader_grants_to_contract_views.sql b/tradein-mvp/backend/data/sql/155_reader_grants_to_contract_views.sql new file mode 100644 index 00000000..571cdab8 --- /dev/null +++ b/tradein-mvp/backend/data/sql/155_reader_grants_to_contract_views.sql @@ -0,0 +1,52 @@ +-- 155_reader_grants_to_contract_views.sql +-- Grant gendesign_reader SELECT on the market.v_* contract views (#2138, step 1/3). +-- +-- Context: +-- 154_market_contract_views.sql introduced 5 stable-contract views over the raw +-- producer tables: +-- market.v_houses, market.v_house_sources, market.v_houses_price_dynamics, +-- market.v_house_reliability_checks, market.v_house_reviews. +-- gendesign_reader (101_gendesign_reader_role.sql) currently reads the RAW tables +-- directly (houses, house_sources, houses_price_dynamics, house_reliability_checks, +-- house_reviews — granted in 101). The goal of #2138 is to move the external ETL +-- consumer (#976 newbuilding_crossload.py) onto the views and eventually revoke the +-- raw-table grants. +-- +-- 105_market_schema_yandex_enrichment.sql already ran +-- GRANT USAGE ON SCHEMA market ... +-- GRANT SELECT ON ALL TABLES IN SCHEMA market TO gendesign_reader; +-- BUT `ON ALL TABLES IN SCHEMA` is a one-time snapshot applied at 105 time — it does +-- NOT cover the v_* views, which were created later by 154. So the reader currently +-- has NO access to the contract views. This migration closes that gap explicitly. +-- +-- Scope (INTENTIONAL — additive first step): +-- This PR ONLY ADDS view access. The raw-table SELECT grants from 101 are left +-- UNTOUCHED — reader keeps working against both raw tables AND views during the ETL +-- switchover. Revoking the raw-table grants (101) is a SEPARATE follow-up (#2138 +-- step 3/3), to be applied only AFTER the consumer is confirmed reading the views. +-- No REVOKE here by design. +-- +-- Dependencies: +-- - 101_gendesign_reader_role.sql (role gendesign_reader) +-- - 105_market_schema_yandex_enrichment.sql (CREATE SCHEMA market) +-- - 154_market_contract_views.sql (the v_* views granted below) +-- +-- Idempotent: GRANT is repeatable; USAGE on schema market re-granted defensively +-- (already granted in 105, harmless to repeat). +-- AUTO-APPLIED on prod via deploy-tradein.yml/_schema_migrations (strict). + +BEGIN; + +-- Schema visibility (already granted in 105; repeated for self-containment, idempotent). +GRANT USAGE ON SCHEMA market TO gendesign_reader; + +-- Explicit SELECT on each contract view (NOT covered by 105's snapshot ALL TABLES grant). +GRANT SELECT ON + market.v_houses, + market.v_house_sources, + market.v_houses_price_dynamics, + market.v_house_reliability_checks, + market.v_house_reviews +TO gendesign_reader; + +COMMIT; -- 2.45.3