From ac935b6743edce18520c7ccc577b6a72ae89d82d Mon Sep 17 00:00:00 2001 From: Colin Megill Date: Tue, 13 Oct 2026 19:29:33 -0700 Subject: [PATCH] docs: the import source login's grants match the test harness, including comments Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_018NVGBuYCk4EZmiz4csUv9s --- delphi/docs/PRODUCTION_DYNAMO_IMPORT.md | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/delphi/docs/PRODUCTION_DYNAMO_IMPORT.md b/delphi/docs/PRODUCTION_DYNAMO_IMPORT.md index 4f7980c6e8..626feadc6f 100644 --- a/delphi/docs/PRODUCTION_DYNAMO_IMPORT.md +++ b/delphi/docs/PRODUCTION_DYNAMO_IMPORT.md @@ -38,8 +38,12 @@ this patch changes no IAM, deployment, service, or instance configuration. Supply these settings privately inside AWS, never in an image, checkout or CI log: -- `IMPORT_SOURCE_DATABASE_URL`: read-only primary Postgres login; `SELECT(zid)` on - `conversations` and `SELECT(report_id,zid)` on `reports`. Its sessions are explicitly +- `IMPORT_SOURCE_DATABASE_URL`: read-only primary Postgres login with exactly the grants + the import test harness uses (`scripts/test-production-import.sh`): + `SELECT(zid,topic,description,participant_count)` on `conversations`, + `SELECT(zid,zinvite,created)` on `zinvites`, `SELECT(report_id,zid)` on `reports`, and + `SELECT(zid,tid,txt)` on `comments` (for each comment embedding's text digest). The + login is provisioned by the operator, not by a migration. Its sessions are explicitly read-only. Production requires `sslmode=verify-full` and the approved CA. - `QUEUE_DATABASE_URL`: dedicated non-admin login that is a member of `polis_queue_executor`, without membership in `polis_queue_owner`, superuser,