From fd4f48c2cb544e55c4148689aa6711da519fc6f0 Mon Sep 17 00:00:00 2001
From: Story Crater Bot <19826264+Riotpiaole@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:36:23 -0700
Subject: [PATCH] fix(ddb): add database-level CREATE privilege for schema
 creation

Authentik migrations need to CREATE SCHEMA (not just tables in public schema).
This requires GRANT CREATE ON DATABASE, not just schema-level permissions.

Added to PostSync Job:
- GRANT CREATE ON DATABASE authentik TO authentik
- GRANT CREATE ON DATABASE temporal TO temporal
- GRANT CREATE ON DATABASE temporal_visibility TO temporal

App user can grant these (it owns the databases).
---
 k8s/data/schemas/grant-schema-permissions-job.yaml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/k8s/data/schemas/grant-schema-permissions-job.yaml b/k8s/data/schemas/grant-schema-permissions-job.yaml
index 33d345a..1813d5d 100644
--- a/k8s/data/schemas/grant-schema-permissions-job.yaml
+++ b/k8s/data/schemas/grant-schema-permissions-job.yaml
@@ -75,6 +75,9 @@ spec:
           # Grant for authentik database
           echo "Granting to authentik role in authentik database..."
           psql -h "$PGHOST" -U "$PGUSER" -d authentik << 'SQL'
+          -- Database-level permission (needed for CREATE SCHEMA)
+          GRANT CREATE ON DATABASE authentik TO authentik;
+          -- Schema-level permissions
           GRANT ALL ON SCHEMA public TO authentik;
           GRANT ALL ON ALL TABLES IN SCHEMA public TO authentik;
           GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO authentik;
@@ -85,6 +88,9 @@ spec:
           # Grant for temporal database
           echo "Granting to temporal role in temporal database..."
           psql -h "$PGHOST" -U "$PGUSER" -d temporal << 'SQL'
+          -- Database-level permission
+          GRANT CREATE ON DATABASE temporal TO temporal;
+          -- Schema-level permissions
           GRANT ALL ON SCHEMA public TO temporal;
           GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
           GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;
@@ -95,6 +101,9 @@ spec:
           # Grant for temporal_visibility database
           echo "Granting to temporal role in temporal_visibility database..."
           psql -h "$PGHOST" -U "$PGUSER" -d temporal_visibility << 'SQL'
+          -- Database-level permission
+          GRANT CREATE ON DATABASE temporal_visibility TO temporal;
+          -- Schema-level permissions
           GRANT ALL ON SCHEMA public TO temporal;
           GRANT ALL ON ALL TABLES IN SCHEMA public TO temporal;
           GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO temporal;