feat(db): 迁移里的数据库角色名改为环境变量注入

backend/alembic/versions/0001_init.py

@@ -12,13 +12,13 @@ import sqlalchemy as sa
 from alembic import op
 from sqlalchemy.dialects import postgresql
 
+from app.roles import APP_ROLE, OWNER_ROLE
+
 revision: str = "0001"
 down_revision: str | None = None
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 
-APP_ROLE = "dadao_app"
-
 # 说明：asyncpg 走"预备语句"执行，**一条 execute 里只能有一条 SQL**，
 # 多条语句会报 `cannot insert multiple commands into a prepared statement`。
 # 所以这里按语句拆成元组，逐条执行。
@@ -76,7 +76,7 @@ POLICY_STATEMENTS: tuple[str, ...] = (
         f"workspace, app_user, member, invitation, audit_log TO {APP_ROLE};"
     ),
     (
-        "ALTER DEFAULT PRIVILEGES FOR ROLE dadao_owner IN SCHEMA public "
+        f"ALTER DEFAULT PRIVILEGES FOR ROLE {OWNER_ROLE} IN SCHEMA public "
         f"GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO {APP_ROLE};"
     ),
 )

backend/alembic/versions/0002_tasks.py

@@ -15,13 +15,13 @@ import sqlalchemy as sa
 from alembic import op
 from sqlalchemy.dialects import postgresql
 
+from app.roles import APP_ROLE
+
 revision: str = "0002"
 down_revision: str | None = "0001"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 
-APP_ROLE = "dadao_app"
-
 TENANT_TABLES_0002: tuple[str, ...] = ("item", "tag", "item_tag", "comment", "activity")
 
 _TIMESTAMP_COLUMNS = (

backend/alembic/versions/0003_tickets.py

@@ -19,13 +19,13 @@ import sqlalchemy as sa
 from alembic import op
 from sqlalchemy.dialects import postgresql
 
+from app.roles import APP_ROLE
+
 revision: str = "0003"
 down_revision: str | None = "0002"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 
-APP_ROLE = "dadao_app"
-
 TENANT_TABLES_0003: tuple[str, ...] = ("ticket_ext", "item_link", "notification")
 
 TASK_STATUSES = ("inbox", "todo", "doing", "done", "blocked", "canceled")

backend/alembic/versions/0004_knowledge.py

@@ -21,13 +21,13 @@ import sqlalchemy as sa
 from alembic import op
 from sqlalchemy.dialects import postgresql
 
+from app.roles import APP_ROLE
+
 revision: str = "0004"
 down_revision: str | None = "0003"
 branch_labels: str | Sequence[str] | None = None
 depends_on: str | Sequence[str] | None = None
 
-APP_ROLE = "dadao_app"
-
 TENANT_TABLES_0004: tuple[str, ...] = ("knowledge_doc",)
 
 TASK_STATUSES = ("inbox", "todo", "doing", "done", "blocked", "canceled")

backend/alembic/versions/0005_attachments.py

@@ -11,6 +11,8 @@ from sqlalchemy.dialects.postgresql import UUID as PgUUID
 
 from alembic import op
 
+from app.roles import APP_ROLE
+
 revision = "0005"
 down_revision = "0004"
 branch_labels = None
@@ -55,7 +57,7 @@ def upgrade() -> None:
         "ALTER TABLE attachment ENABLE ROW LEVEL SECURITY",
         "CREATE POLICY attachment_isolation ON attachment "
         "USING (workspace_id = app_ws_id()) WITH CHECK (workspace_id = app_ws_id())",
-        "GRANT SELECT, INSERT, UPDATE, DELETE ON attachment TO dadao_app",
+        f"GRANT SELECT, INSERT, UPDATE, DELETE ON attachment TO {APP_ROLE}",
     ):
         op.execute(statement)
 

backend/alembic/versions/0006_chunks.py

@@ -82,7 +82,7 @@ POLICY_SQL = (
     "ALTER TABLE chunk ENABLE ROW LEVEL SECURITY",
     "CREATE POLICY chunk_isolation ON chunk "
     "USING (workspace_id = app_ws_id()) WITH CHECK (workspace_id = app_ws_id())",
-    "GRANT SELECT, INSERT, UPDATE, DELETE ON chunk TO dadao_app",
+    f"GRANT SELECT, INSERT, UPDATE, DELETE ON chunk TO {APP_ROLE}",
 )
 
 

backend/alembic/versions/0007_knowledge_categories.py

@@ -60,7 +60,7 @@ POLICY_SQL = (
     "ALTER TABLE knowledge_category ENABLE ROW LEVEL SECURITY",
     "CREATE POLICY knowledge_category_isolation ON knowledge_category "
     "USING (workspace_id = app_ws_id()) WITH CHECK (workspace_id = app_ws_id())",
-    "GRANT SELECT, INSERT, UPDATE, DELETE ON knowledge_category TO dadao_app",
+    f"GRANT SELECT, INSERT, UPDATE, DELETE ON knowledge_category TO {APP_ROLE}",
 )