fix(db): give each database its own app role and keep the queue schema the owner's

Roles are cluster-wide. Two HealthLog databases on one server shared
healthlog_app: each start set its own password, locking the other
instance out, and the role held grants on both databases. The role is
now healthlog_app_<database>_<hash>, marked with a comment naming its
database, its password is derived per database, and a role holding an
explicit CONNECT on another database is not used.

The role owned the pgboss schema, so it could plant a trigger, a rule or
a function body that a later owner session (a rollback, DB_APP_ROLE=off,
a fallback start) would run with the owner's rights. pg-boss changes its
schema only on install, on migration and for partitioned queues, which
the app does not use. The start now installs and migrates the schema as
the owner with pg-boss's own plans, and the worker runs pg-boss with
migrate: false when it does not own the schema. The role gets rows only,
read-only on pgboss.bam (SQL the migration runner executes) and on the
version column. Every start, on every path, takes back what a
HealthLog role owns there, drops triggers and rules, and after a
take-back restores the queue functions to pg-boss's own definitions and
retires the legacy role. Bloated queue indexes, which pg-boss only
reports when it does not own them, are rebuilt at start.

src/lib/jobs/boss-instance.ts

@@ -89,20 +89,25 @@ function databaseOptions(
 }
 
 /**
- * The worker's pg-boss. `createSchema` says whether pg-boss's first install
- * may run `CREATE SCHEMA IF NOT EXISTS pgboss`. Postgres checks the database's
- * CREATE privilege before it checks whether the schema exists, so under the
- * app's restricted role (`scripts/db-app-role.mjs`), which may not create
- * schemas, that statement fails even though the boot already created the
- * schema for it. The caller passes false when the schema is there.
+ * The worker's pg-boss. `ownsQueueSchema` is false when the connection does
+ * not own the `pgboss` schema, which is how the app's restricted role
+ * (`scripts/db-app-role.mjs`) runs: the boot installed and migrated the
+ * schema as the owner, so pg-boss neither installs, migrates nor runs the
+ * index builds a migration queues (`migrate: false`), and never sends
+ * `CREATE SCHEMA IF NOT EXISTS` (`createSchema: false`), which Postgres
+ * refuses without the database's CREATE privilege even when the schema is
+ * there. With `migrate: false`, pg-boss refuses to start on a schema that is
+ * not at its version, rather than run on it.
  */
 export function createWorkerBoss(
   connectionString: string,
-  options: { createSchema?: boolean } = {},
+  options: { ownsQueueSchema?: boolean } = {},
 ): PgBoss {
   return new PgBoss({
     ...databaseOptions(connectionString, "worker"),
-    ...(options.createSchema === false ? { createSchema: false } : {}),
+    ...(options.ownsQueueSchema === false
+      ? { createSchema: false, migrate: false }
+      : {}),
   });
 }
 

src/lib/jobs/reminder-worker.ts

@@ -48,13 +48,17 @@ export async function startReminderWorker() {
     return;
   }
 
-  // The queue schema exists once a worker has started, and on every boot
-  // the restricted database role runs under (the entrypoint creates it for
-  // that role); only a fresh database without either needs pg-boss to
-  // create it.
-  const [{ present }] = await prisma.$queryRaw<{ present: boolean }[]>`
-    SELECT to_regnamespace('pgboss') IS NOT NULL AS present`;
-  const boss = createWorkerBoss(DATABASE_URL, { createSchema: !present });
+  // Under the restricted database role the boot installed and migrated the
+  // queue schema as its owner, and the role owns nothing there; pg-boss then
+  // only reads and writes rows. A connection that owns the schema, or a fresh
+  // database without one, lets pg-boss install and migrate it itself.
+  const [{ owned }] = await prisma.$queryRaw<{ owned: boolean | null }[]>`
+    SELECT pg_has_role(current_user, n.nspowner, 'USAGE') AS owned
+      FROM (SELECT 1) one
+      LEFT JOIN pg_namespace n ON n.nspname = 'pgboss'`;
+  const boss = createWorkerBoss(DATABASE_URL, {
+    ownsQueueSchema: owned !== false,
+  });
 
   boss.on("error", (error: unknown) => {
     workerLog("error", "boss emitted error", error);