infra/local/init/postgres/01-init.sql

@@ -41,8 +41,17 @@ ALTER DEFAULT PRIVILEGES FOR ROLE audit_owner IN SCHEMA audit
   GRANT DELETE ON TABLES TO audit_archiver;
 
 -- ---------------------------------------------------------------- Dev convenience
--- The default `portal` superuser bypasses these grants anyway, but
+-- The dev superuser (created by Postgres from POSTGRES_USER, default
--- granting the audit roles explicitly lets us test role-based access
+-- `portal` but overridable in infra/local/.env) bypasses these grants
--- with `SET ROLE audit_writer;` etc. from a psql session against the
+-- anyway, but granting the audit roles explicitly lets us test
--- dev DB. Production never grants all four to one user.
+-- role-based access with `SET ROLE audit_writer;` etc. from a psql
-GRANT audit_owner, audit_writer, audit_reader, audit_archiver TO portal;
+-- session against the dev DB.
+--
+-- `current_user` resolves at script execution time to whoever is
+-- running the init SQL — i.e. the superuser created from POSTGRES_USER,
+-- whatever its name happens to be. Hard-coding `portal` here was
+-- wrong: it broke any setup where the contributor changed
+-- POSTGRES_USER in their .env.
+--
+-- Production never grants all four roles to one user.
+GRANT audit_owner, audit_writer, audit_reader, audit_archiver TO current_user;