From 97911f99aed29e8b32f4f21694a3856ce6ead885 Mon Sep 17 00:00:00 2001 From: Yorick de Wid Date: Wed, 29 Jul 2026 12:12:23 +0000 Subject: [PATCH] chore(grants): SELECT on report.inquiry for the TS Webservice (#1003) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /v4/product/facade_scan and /v4/product/foundation-research join report.inquiry onto report.inquiry_sample. fundermaps_webservice held SELECT on inquiry_sample but not on inquiry, so both endpoints returned 500 "permission denied for table inquiry" for every request — live and broken on ws-staging since #22 shipped. Production drift, not a schema gap: sql/init/grants.sql already grants SELECT on ALL TABLES in report, but prod never ran init_db.sh and only incident + inquiry_sample carry the grant. Same pattern as #997. Applied to prod 2026-07-29; both endpoints verified returning 200 with data and 404 no_data_available where no fresh report exists. Co-Authored-By: Claude Opus 5 (1M context) --- sql/migrate/grant_inquiry_webservice_read.sql | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 sql/migrate/grant_inquiry_webservice_read.sql diff --git a/sql/migrate/grant_inquiry_webservice_read.sql b/sql/migrate/grant_inquiry_webservice_read.sql new file mode 100644 index 0000000..9e59f2a --- /dev/null +++ b/sql/migrate/grant_inquiry_webservice_read.sql @@ -0,0 +1,27 @@ +-- Read access for the TS Webservice on report.inquiry (FunderMaps issue #1003). +-- +-- The /v4/product/facade_scan and /v4/product/foundation-research endpoints join +-- report.inquiry (for type, document_date and attribution) onto +-- report.inquiry_sample. fundermaps_webservice held SELECT on inquiry_sample but +-- not on inquiry, so both endpoints returned 500 ("permission denied for table +-- inquiry") for every request — including on ws-staging, where they have been +-- live and broken since #22 shipped. +-- +-- sql/init/grants.sql already covers this for fresh DBs (GRANT SELECT ON ALL +-- TABLES IN SCHEMA ... report plus ALTER DEFAULT PRIVILEGES), but production +-- drifted: only incident and inquiry_sample carry the grant, while inquiry, +-- recovery, recovery_sample and dossier_event do not. Same drift pattern as +-- issue #997 (application.contractor). Idempotent — safe to re-run. +-- +-- psql "$DB_URL" -f sql/migrate/grant_inquiry_webservice_read.sql +-- +-- Scoped to inquiry only, deliberately. This is a billable, internet-facing, +-- read-only role; the remaining report.* tables are not read by any v4 endpoint, +-- so they stay ungranted rather than being restored to the grants.sql baseline +-- wholesale. Widen this if a future product endpoint needs recovery data. + +BEGIN; + +GRANT SELECT ON report.inquiry TO fundermaps_webservice; + +COMMIT;