RolesCopy page

roles names migration, app, and optional reporting grants.

A name in managed is a role the plan creates. A name outside that list is external and has to exist already. schema() has no roles field. The grants are added when the config sets roles.

Grants are on managed objects.

Default privileges are ALTER DEFAULT PRIVILEGES for the migration role, in each schema those objects use. With no such schema, they are issued in public.

The plan revokes INSERT, UPDATE, and DELETE on a materialized view granted to app. After the plan, app receives SELECT on okm_meta. When this run creates the migration role, that role receives USAGE and CREATE on the schema, and SELECT, INSERT, and UPDATE on okm_meta, okm_history, and okm_backfill. Apply then issues SET ROLE.

reporting also receives a default SELECT on later tables, for the migration role.

import { defineConfig } from "okmodel/migrate";

export default defineConfig({
  schema: "./schema.ts",
  database: process.env.DATABASE_URL!,
  roles: {
    migration: "okm_migrate", 
    app: "okm_app", 
    reporting: "okm_read", 
  },
});

Managed

managed lists roles the plan creates and alters. A role is never dropped. The statement is NOSUPERUSER NOCREATEDB NOCREATEROLE. An external role emits no CREATE ROLE and no ALTER ROLE. login and inherit are altered only when the role is already managed.

A managed role that pg_roles does not have is created. okm doctor skips that absence. The role that applies a CREATE ROLE or ALTER ROLE needs CREATEROLE. A superuser passes the same check. The message names that role: Role postgres lacks CREATEROLE. Nothing was changed. A role another session created first does not fail the create.

Columns

columns grants SELECT or UPDATE on named columns. on is the SQL name of one table, view, or materialized view. A column may be the field name or the SQL name. An empty list adds no grant. A role named only here receives those column grants.

On a table with a hidden column, reporting receives SELECT on the visible columns. hidden({ filterable: true }) stays in that hidden set. A select list for reporting adds those columns, including a hidden one. On a table with no hidden column, reporting receives SELECT on the table. On a view or a materialized view, a select list for reporting is the SELECT grant for those columns.

import { defineConfig } from "okmodel/migrate";

export default defineConfig({
  schema: "./schema.ts",
  database: process.env.DATABASE_URL!,
  roles: {
    migration: "okm_migrate",
    app: "okm_app",
    reporting: "okm_read",
    managed: [{ name: "okm_app", login: true }], 
    columns: [{ role: "okm_app", on: "users", select: ["email"] }], 
  },
});