[ferhatelmas]

What kind of change does this PR introduce?

chore

What is the current behavior?

Explicit postgres grant was added in migration 76 and 79 for internal lifecycle state.

What is the new behavior?

In hosted version, postgres isn't the owner and these are internal to storage, we don't want users to play with them so remove explicit grant.

Additional context

Related to #1620

[Copilot]

🟢 Approval recommended

No active review issues remain for the lifecycle grant cleanup.

No open issues 🎉

What changed in this PR

This PR removes explicit postgres grants on internal lifecycle state introduced by migrations 76 and 79, while preserving access when postgres is a configured role or owns the object.

Changes:

• Adds migration 80 to revoke extra grants on two lifecycle tables and two functions.
• Registers the migration in DBMigration.
• Adds upgrade coverage for role and ownership safeguards, preservation of service-role grants, and repeated execution.

File	Description
src/​test/​lifecycle-migration-upgrade.test.ts	Tests grant removal, access safeguards, and repeated execution.
src/​internal/​database/​migrations/​types.ts	Registers migration 80.
migrations/​tenant/​0080-revoke-extra-lifecycle-postgres-grants.sql	Revokes extra postgres grants while retaining configured-role and owner access.

_{Review effort: Balanced}

[claude]

Findings marked 🟡 are optional suggestions and need no follow-up push.

[coveralls]

Coverage Report for CI Build 42226886497

Coverage remained the same at 87.542%

Details

• Coverage remained the same as the base build.
• Patch coverage: No coverable lines changed in this PR.
• No coverage regressions found.

Uncovered Changes

No uncovered changes found.

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	15991
Covered Lines:	14438
Line Coverage:	90.29%
Relevant Branches:	10169
Covered Branches:	8463
Branch Coverage:	83.22%
Branches in Coverage %:	Yes
Coverage Strength:	1297.55 hits per line

---

💛 - Coveralls

[ferhatelmas]

@claude review always

[claude]

This run found no new bugs. The latest revision grants SELECT back to postgres on both lifecycle tables after the REVOKE ALL, which fixes the dump-read concern from my earlier review. This migration changes role privileges on tenant schemas, and the repo's CODEOWNERS covers these paths, so a maintainer should still look at it.

What was reviewed:

• The early-exit guards in 0080: no postgres role, or postgres configured as super_user or service_role. Also the relowner/proowner checks that skip objects owned by postgres.
• Whether the function revokes take effect. 0079 already revokes EXECUTE on both functions from PUBLIC, so removing postgres's grant actually removes its access.
• The DBMigration entry 80, which matches the file number.

Extended reasoning...

The change adds tenant migration 0080, which changes privileges for the postgres role. It narrows table access to SELECT on storage.bucket_lifecycle_states and storage.lifecycle_abandoned_artifacts, and drops EXECUTE on two lifecycle functions. It also registers the migration in types.ts and adds an integration test. The security-sensitive surface is database permissions. The earlier review raised a read-access concern, and the current diff fixes it with GRANT SELECT. Approval is not appropriate because this is a permissions change on every tenant and a CODEOWNERS team owns the whole repository.