tradein-mvp/backend/data/sql/155_reader_grants_to_contract_views.sql

@@ -0,0 +1,52 @@
+-- 155_reader_grants_to_contract_views.sql
+-- Grant gendesign_reader SELECT on the market.v_* contract views (#2138, step 1/3).
+--
+-- Context:
+--   154_market_contract_views.sql introduced 5 stable-contract views over the raw
+--   producer tables:
+--     market.v_houses, market.v_house_sources, market.v_houses_price_dynamics,
+--     market.v_house_reliability_checks, market.v_house_reviews.
+--   gendesign_reader (101_gendesign_reader_role.sql) currently reads the RAW tables
+--   directly (houses, house_sources, houses_price_dynamics, house_reliability_checks,
+--   house_reviews — granted in 101). The goal of #2138 is to move the external ETL
+--   consumer (#976 newbuilding_crossload.py) onto the views and eventually revoke the
+--   raw-table grants.
+--
+--   105_market_schema_yandex_enrichment.sql already ran
+--     GRANT USAGE ON SCHEMA market ...
+--     GRANT SELECT ON ALL TABLES IN SCHEMA market TO gendesign_reader;
+--   BUT `ON ALL TABLES IN SCHEMA` is a one-time snapshot applied at 105 time — it does
+--   NOT cover the v_* views, which were created later by 154. So the reader currently
+--   has NO access to the contract views. This migration closes that gap explicitly.
+--
+-- Scope (INTENTIONAL — additive first step):
+--   This PR ONLY ADDS view access. The raw-table SELECT grants from 101 are left
+--   UNTOUCHED — reader keeps working against both raw tables AND views during the ETL
+--   switchover. Revoking the raw-table grants (101) is a SEPARATE follow-up (#2138
+--   step 3/3), to be applied only AFTER the consumer is confirmed reading the views.
+--   No REVOKE here by design.
+--
+-- Dependencies:
+--   - 101_gendesign_reader_role.sql (role gendesign_reader)
+--   - 105_market_schema_yandex_enrichment.sql (CREATE SCHEMA market)
+--   - 154_market_contract_views.sql (the v_* views granted below)
+--
+-- Idempotent: GRANT is repeatable; USAGE on schema market re-granted defensively
+--   (already granted in 105, harmless to repeat).
+-- AUTO-APPLIED on prod via deploy-tradein.yml/_schema_migrations (strict).
+
+BEGIN;
+
+-- Schema visibility (already granted in 105; repeated for self-containment, idempotent).
+GRANT USAGE ON SCHEMA market TO gendesign_reader;
+
+-- Explicit SELECT on each contract view (NOT covered by 105's snapshot ALL TABLES grant).
+GRANT SELECT ON
+    market.v_houses,
+    market.v_house_sources,
+    market.v_houses_price_dynamics,
+    market.v_house_reliability_checks,
+    market.v_house_reviews
+TO gendesign_reader;
+
+COMMIT;