From 92d60badd3cf8399e463e58c5e6d441b7f8b6d23 Mon Sep 17 00:00:00 2001 From: Agent Zero Date: Tue, 4 Aug 2026 23:02:28 +0200 Subject: [PATCH] fix: Grant DELETE on notification_types to app DB roles (migration 0106) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit unified_search plugin activation calls sync_notification_types() which DELETEs stale rows from notification_types. App DB user (crm_api) lacked DELETE permission, causing plugin activation to fail with InsufficientPrivilegeError. Alembic head: 0105 → 0106 --- ...06_grant_notification_types_permissions.py | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 alembic/versions/0106_grant_notification_types_permissions.py diff --git a/alembic/versions/0106_grant_notification_types_permissions.py b/alembic/versions/0106_grant_notification_types_permissions.py new file mode 100644 index 0000000..8d9fc13 --- /dev/null +++ b/alembic/versions/0106_grant_notification_types_permissions.py @@ -0,0 +1,26 @@ +"""Grant DELETE permission on notification_types to app DB roles. + +The unified_search plugin activation calls sync_notification_types() which +DELETEs stale rows from notification_types. The app DB user (crm_api) lacks +DELETE permission on this table, causing plugin activation to fail with +InsufficientPrivilegeError. + +Revision ID: 0106 +""" + +from alembic import op +import sqlalchemy as sa + +revision = "0106" +down_revision = "0105" + + +def upgrade() -> None: + # Grant all necessary permissions on notification_types to app roles + for role in ["crm_api", "crm_auth", "crm_worker"]: + op.execute(f"GRANT SELECT, INSERT, UPDATE, DELETE ON notification_types TO {role}") + + +def downgrade() -> None: + for role in ["crm_api", "crm_auth", "crm_worker"]: + op.execute(f"REVOKE DELETE ON notification_types FROM {role}")