spb/tools-spboucher-ai

1-- Roles are created by scripts/db-roles.ts with generated passwords; this migration only grants privileges if the roles exist.2DO $$ BEGIN3  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname='tools_reader') THEN4    EXECUTE 'GRANT USAGE ON SCHEMA public TO tools_reader';5    EXECUTE 'REVOKE ALL ON ALL TABLES IN SCHEMA public FROM tools_reader';6    EXECUTE 'GRANT SELECT ON public_tools, public_collections, public_link_checks, vendors, categories, tags, tool_categories, tool_tags, tool_alternatives, sources, tool_sources, collection_items TO tools_reader';7    EXECUTE 'GRANT INSERT ON error_reports, search_events TO tools_reader';8    EXECUTE 'GRANT USAGE, SELECT ON SEQUENCE search_events_id_seq TO tools_reader';9  END IF;10  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname='tools_app') THEN11    EXECUTE 'GRANT USAGE ON SCHEMA public TO tools_app';12    EXECUTE 'GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA public TO tools_app';13    EXECUTE 'GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA public TO tools_app';14    EXECUTE 'REVOKE UPDATE, DELETE ON audit_log, tool_revisions FROM tools_app';15  END IF;16END $$;17