lcm/src/storage/postgresql/reference/postgresql-runtime-transcript-grants.sql at main · donadiosolutions/lcm · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
\set ON_ERROR_STOP on

\if :{?lcm_runtime_role}
\else
\echo 'Set lcm_runtime_role to the PostgreSQL runtime role before applying transcript grants.'
\quit 3
\endif

BEGIN;

GRANT USAGE ON SCHEMA lcm TO :"lcm_runtime_role";
-- Project-scoped operations fail closed while backend publication is unresolved.
GRANT SELECT ON TABLE lcm.fenced_leases TO :"lcm_runtime_role";

GRANT SELECT (
  project_id,
  conversation_id,
  session_id,
  session_id_sha256,
  created_at
)
ON TABLE lcm.conversations TO :"lcm_runtime_role";

GRANT SELECT (
  project_id,
  conversation_id,
  message_id,
  seq,
  role,
  content
)
ON TABLE lcm.messages TO :"lcm_runtime_role";

GRANT SELECT ON TABLE lcm.native_transcripts TO :"lcm_runtime_role";
GRANT INSERT (
  project_id,
  machine_id,
  client_name,
  format_name,
  format_version,
  native_session_id,
  source_locator,
  source_ordinal,
  observed_at,
  ingested_at,
  scrubber_version,
  content_sha256,
  ingest_key,
  native_payload
)
ON TABLE lcm.native_transcripts TO :"lcm_runtime_role";

GRANT SELECT ON TABLE lcm.transcript_messages TO :"lcm_runtime_role";
GRANT INSERT (
  project_id,
  transcript_id,
  conversation_id,
  message_id,
  source_ordinal
)
ON TABLE lcm.transcript_messages TO :"lcm_runtime_role";

GRANT SELECT ON TABLE lcm.ingest_checkpoints TO :"lcm_runtime_role";
GRANT INSERT (
  project_id,
  machine_id,
  client_name,
  source_locator
),
      UPDATE (
        last_source_ordinal,
        imported_count,
        skipped_count,
        quarantined_count,
        revision,
        checkpoint,
        updated_at
      )
ON TABLE lcm.ingest_checkpoints TO :"lcm_runtime_role";

COMMIT;