chore: update database permissions and verification scripts

- Added instructions in `DB-MIGRATIONS.md` to run `rebootstrap-roles` after `drop-everything`.
- Enhanced `0001_create_app_db_users.sh` and `0002_setup_management_database.sh` to conditionally grant schema USAGE privileges.
- Updated `rebootstrap-full-bootstrap.sh` to include conditional grants for schema USAGE.
- Modified `verify-bootstrap-contract.sh` to check for schema USAGE privileges and added verification for querying `linear_migration_history`.

Author: mitchdowney

docs/development/DB-MIGRATIONS.md

@@ -30,6 +30,7 @@ Rules:
 - Prefix must be four digits.
 - Filename format must be `^[0-9]{4}_[a-z0-9_]+\.sql$`.
 - Previously applied files are immutable.
+- After **drop-everything**, run **rebootstrap-roles** before migrate jobs. Rebootstrap must grant **`USAGE ON SCHEMA public`** to read/read_write roles **as the DB owner** (migrator cannot delegate schema USAGE on Postgres 15+ after `DROP SCHEMA public`; see Podverse-aligned bootstrap scripts).
 
 ## Validate
 

infra/k8s/base/db/source/bootstrap/0001_create_app_db_users.sh

@@ -47,10 +47,22 @@ END
 
 GRANT CONNECT ON DATABASE ${DB_APP_NAME} TO ${DB_APP_MIGRATOR_USER}, ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
 GRANT USAGE, CREATE ON SCHEMA public TO ${DB_APP_MIGRATOR_USER};
+-- OWNER must grant schema USAGE (MIGRATOR cannot delegate USAGE without WITH GRANT OPTION; recreated public after DROP SCHEMA has no PUBLIC grant).
+GRANT USAGE ON SCHEMA public TO ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
 SQL
 
 psql -v ON_ERROR_STOP=1 --username "$DB_APP_MIGRATOR_USER" -d "$DB_APP_NAME" <<SQL
-GRANT USAGE ON SCHEMA public TO ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
+DO \$\$
+BEGIN
+    IF NOT has_schema_privilege('${DB_APP_READ_WRITE_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_APP_READ_WRITE_USER}');
+    END IF;
+
+    IF NOT has_schema_privilege('${DB_APP_READ_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_APP_READ_USER}');
+    END IF;
+END
+\$\$;
 
 GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};
 GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};

infra/k8s/base/db/source/bootstrap/0002_setup_management_database.sh

@@ -66,6 +66,8 @@ psql -v ON_ERROR_STOP=1 --username "$DB_APP_OWNER_USER" --dbname "$DB_APP_NAME"
 psql -v ON_ERROR_STOP=1 --username "$DB_MANAGEMENT_OWNER_USER" --dbname "$MANAGEMENT_DB_NAME" <<SQL
 GRANT CONNECT ON DATABASE ${MANAGEMENT_DB_NAME} TO ${DB_MANAGEMENT_MIGRATOR_USER}, ${DB_MANAGEMENT_READ_WRITE_USER}, ${DB_MANAGEMENT_READ_USER};
 GRANT USAGE, CREATE ON SCHEMA public TO ${DB_MANAGEMENT_MIGRATOR_USER};
+-- Same rationale as 0001 app owner block (public recreated without PUBLIC USAGE; OWNER must grant).
+GRANT USAGE ON SCHEMA public TO ${DB_MANAGEMENT_READ_WRITE_USER}, ${DB_MANAGEMENT_READ_USER};
 SQL
 
 psql -v ON_ERROR_STOP=1 --username "$DB_MANAGEMENT_MIGRATOR_USER" --dbname "$MANAGEMENT_DB_NAME" <<SQL

infra/k8s/base/ops/source/database/runner/rebootstrap-full-bootstrap.sh

@@ -70,11 +70,22 @@ END
 
 GRANT CONNECT ON DATABASE ${DB_APP_NAME} TO ${DB_APP_MIGRATOR_USER}, ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
 GRANT USAGE, CREATE ON SCHEMA public TO ${DB_APP_MIGRATOR_USER};
+GRANT USAGE ON SCHEMA public TO ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
 SQL
 
 export PGPASSWORD="${DB_APP_MIGRATOR_PASSWORD}"
 psql -v ON_ERROR_STOP=1 --username "${DB_APP_MIGRATOR_USER}" --dbname "${DB_APP_NAME}" <<SQL
-GRANT USAGE ON SCHEMA public TO ${DB_APP_READ_WRITE_USER}, ${DB_APP_READ_USER};
+DO \$\$
+BEGIN
+    IF NOT has_schema_privilege('${DB_APP_READ_WRITE_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_APP_READ_WRITE_USER}');
+    END IF;
+
+    IF NOT has_schema_privilege('${DB_APP_READ_USER}', 'public', 'USAGE') THEN
+        EXECUTE format('GRANT USAGE ON SCHEMA public TO %I', '${DB_APP_READ_USER}');
+    END IF;
+END
+\$\$;
 
 GRANT SELECT, INSERT, UPDATE, DELETE, TRUNCATE ON ALL TABLES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};
 GRANT SELECT, USAGE, UPDATE ON ALL SEQUENCES IN SCHEMA public TO ${DB_APP_READ_WRITE_USER};
@@ -143,6 +154,7 @@ export PGPASSWORD="${DB_MANAGEMENT_OWNER_PASSWORD}"
 psql -v ON_ERROR_STOP=1 --username "${DB_MANAGEMENT_OWNER_USER}" --dbname "${DB_MANAGEMENT_NAME}" <<SQL
 GRANT CONNECT ON DATABASE ${DB_MANAGEMENT_NAME} TO ${DB_MANAGEMENT_MIGRATOR_USER}, ${DB_MANAGEMENT_READ_WRITE_USER}, ${DB_MANAGEMENT_READ_USER};
 GRANT USAGE, CREATE ON SCHEMA public TO ${DB_MANAGEMENT_MIGRATOR_USER};
+GRANT USAGE ON SCHEMA public TO ${DB_MANAGEMENT_READ_WRITE_USER}, ${DB_MANAGEMENT_READ_USER};
 SQL
 
 export PGPASSWORD="${DB_MANAGEMENT_MIGRATOR_PASSWORD}"

infra/k8s/base/ops/source/database/runner/verify-bootstrap-contract.sh

@@ -4,7 +4,8 @@
 # - uuid-ossp extension exists
 # - linear_migration_history table exists
 # - public schema has tables
-# - read_write/read roles have expected table privileges
+# - read_write/read roles have schema USAGE and expected table privileges
+# - read_write/read can query linear_migration_history (runtime access, not catalog-only)
 
 set -euo pipefail
 
@@ -17,13 +18,15 @@ DB_PORT="${DB_PORT:-${METABOOST_DB_SERVICE_PORT:-5432}}"
 : "${DB_APP_READ_WRITE_USER:?Missing DB_APP_READ_WRITE_USER}"
 : "${DB_APP_READ_WRITE_PASSWORD:?Missing DB_APP_READ_WRITE_PASSWORD}"
 : "${DB_APP_READ_USER:?Missing DB_APP_READ_USER}"
+: "${DB_APP_READ_PASSWORD:?Missing DB_APP_READ_PASSWORD}"
 
 : "${DB_MANAGEMENT_OWNER_USER:?Missing DB_MANAGEMENT_OWNER_USER}"
 : "${DB_MANAGEMENT_OWNER_PASSWORD:?Missing DB_MANAGEMENT_OWNER_PASSWORD}"
 : "${DB_MANAGEMENT_NAME:?Missing DB_MANAGEMENT_NAME}"
 : "${DB_MANAGEMENT_READ_WRITE_USER:?Missing DB_MANAGEMENT_READ_WRITE_USER}"
 : "${DB_MANAGEMENT_READ_WRITE_PASSWORD:?Missing DB_MANAGEMENT_READ_WRITE_PASSWORD}"
 : "${DB_MANAGEMENT_READ_USER:?Missing DB_MANAGEMENT_READ_USER}"
+: "${DB_MANAGEMENT_READ_PASSWORD:?Missing DB_MANAGEMENT_READ_PASSWORD}"
 
 run_query() {
   local password="$1"
@@ -63,8 +66,10 @@ check_database_contract() {
   local role_user="$2"
   local db_name="$3"
   local read_write_role="$4"
-  local read_role="$5"
-  local label="$6"
+  local read_write_password="$5"
+  local read_role="$6"
+  local read_password="$7"
+  local label="$8"
 
   echo "Verifying ${label} database bootstrap contract (${db_name})..."
 
@@ -80,6 +85,12 @@ check_database_contract() {
   table_count="$(run_query "$role_password" "$role_user" "$db_name" "SELECT count(*) FROM pg_catalog.pg_tables WHERE schemaname = 'public';")"
   assert_positive_int "${label}: public schema table count" "$table_count"
 
+  local rw_schema_usage ro_schema_usage
+  rw_schema_usage="$(run_query "$role_password" "$role_user" "$db_name" "SELECT has_schema_privilege('${read_write_role}', 'public', 'USAGE');")"
+  ro_schema_usage="$(run_query "$role_password" "$role_user" "$db_name" "SELECT has_schema_privilege('${read_role}', 'public', 'USAGE');")"
+  assert_equals "${label}: read_write schema USAGE" "$rw_schema_usage" "t"
+  assert_equals "${label}: read schema USAGE" "$ro_schema_usage" "t"
+
   local rw_select rw_insert rw_update rw_delete ro_select
   rw_select="$(run_query "$role_password" "$role_user" "$db_name" "SELECT has_table_privilege('${read_write_role}', 'public.linear_migration_history', 'SELECT');")"
   rw_insert="$(run_query "$role_password" "$role_user" "$db_name" "SELECT has_table_privilege('${read_write_role}', 'public.linear_migration_history', 'INSERT');")"
@@ -92,22 +103,38 @@ check_database_contract() {
   assert_equals "${label}: read_write UPDATE" "$rw_update" "t"
   assert_equals "${label}: read_write DELETE" "$rw_delete" "t"
   assert_equals "${label}: read SELECT" "$ro_select" "t"
+
+  local rw_history_count ro_history_count
+  rw_history_count="$(run_query "$read_write_password" "$read_write_role" "$db_name" "SELECT count(*) FROM linear_migration_history;")"
+  ro_history_count="$(run_query "$read_password" "$read_role" "$db_name" "SELECT count(*) FROM linear_migration_history;")"
+  assert_positive_int "${label}: read_write linear_migration_history row count" "$rw_history_count"
+  assert_positive_int "${label}: read linear_migration_history row count" "$ro_history_count"
+
+  if [[ "$label" == "management" ]]; then
+    local can_query_management_user
+    can_query_management_user="$(run_query "$read_write_password" "$read_write_role" "$db_name" "SELECT EXISTS (SELECT 1 FROM management_user LIMIT 1);")"
+    assert_equals "${label}: read_write can query management_user" "$can_query_management_user" "t"
+  fi
 }
 
 check_database_contract \
   "$DB_APP_OWNER_PASSWORD" \
   "$DB_APP_OWNER_USER" \
   "$DB_APP_NAME" \
   "$DB_APP_READ_WRITE_USER" \
+  "$DB_APP_READ_WRITE_PASSWORD" \
   "$DB_APP_READ_USER" \
+  "$DB_APP_READ_PASSWORD" \
   "app"
 
 check_database_contract \
   "$DB_MANAGEMENT_OWNER_PASSWORD" \
   "$DB_MANAGEMENT_OWNER_USER" \
   "$DB_MANAGEMENT_NAME" \
   "$DB_MANAGEMENT_READ_WRITE_USER" \
+  "$DB_MANAGEMENT_READ_WRITE_PASSWORD" \
   "$DB_MANAGEMENT_READ_USER" \
+  "$DB_MANAGEMENT_READ_PASSWORD" \
   "management"
 
-echo "Bootstrap contract verification passed for app and management databases."
+echo "Bootstrap contract verification passed for app and management databases."