fix(db): run schema-level grants against the shared database, not postgres

src/lib/db/dbctl.go

@@ -106,7 +106,7 @@ func (c *Client) SyncAuthorization(ctx context.Context) error {
 		script += fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM PUBLIC;\n", quoteIdent(DBName))
 	}
 
-	out, code, err := c.execPSQL(ctx, id, script)
+	out, code, err := c.execPSQL(ctx, id, DBName, script)
 	if err != nil {
 		return fmt.Errorf("apply database authorization: %w", err)
 	}
@@ -128,7 +128,7 @@ func (c *Client) RevokeForService(ctx context.Context, serviceName string) {
 		return
 	}
 	script := fmt.Sprintf("REVOKE CONNECT ON DATABASE %s FROM %s;", quoteIdent(DBName), quoteIdent(serviceName))
-	out, code, err := c.execPSQL(ctx, id, script)
+	out, code, err := c.execPSQL(ctx, id, DBName, script)
 	if err != nil || code != 0 {
 		logger.Warn("Failed to revoke database CONNECT for %s: %v (exit %d): %s", serviceName, err, code, out)
 		return
@@ -261,7 +261,7 @@ func (c *Client) isArmed(ctx context.Context, id string) bool {
 func (c *Client) waitReady(ctx context.Context, id string) error {
 	const attempts = 30
 	for i := 0; i < attempts; i++ {
-		_, code, err := c.execPSQL(ctx, id, "SELECT 1")
+		_, code, err := c.execPSQL(ctx, id, "postgres", "SELECT 1")
 		if err == nil && code == 0 {
 			return nil
 		}
@@ -277,7 +277,7 @@ func (c *Client) waitReady(ctx context.Context, id string) error {
 // existingRoles returns the set of roles currently defined in the database.
 func (c *Client) existingRoles(ctx context.Context, id string) map[string]bool {
 	have := map[string]bool{}
-	out, code, err := c.execPSQL(ctx, id, "SELECT rolname FROM pg_catalog.pg_roles")
+	out, code, err := c.execPSQL(ctx, id, "postgres", "SELECT rolname FROM pg_catalog.pg_roles")
 	if err != nil || code != 0 {
 		return have
 	}
@@ -292,11 +292,15 @@ func (c *Client) existingRoles(ctx context.Context, id string) map[string]bool {
 // execPSQL runs a psql statement over the in-container unix socket as the
 // postgres superuser (bypassing the mTLS enforcement intentionally — Maestro
 // administers the database). It returns trimmed stdout and the exit code.
-func (c *Client) execPSQL(ctx context.Context, id, sql string) (string, int, error) {
+// execPSQL runs a psql statement over the in-container unix socket as the
+// postgres superuser (bypassing the mTLS enforcement intentionally — Maestro
+// administers the database), targeting the named database. It returns trimmed
+// stdout and the exit code.
+func (c *Client) execPSQL(ctx context.Context, id, dbName, sql string) (string, int, error) {
 	created, err := c.dc.ContainerExecCreate(ctx, id, container.ExecOptions{
 		User:         "postgres",
 		AttachStdout: true,
-		Cmd:          []string{"psql", "-U", "postgres", "-d", "postgres", "-v", "ON_ERROR_STOP=1", "-tA", "-c", sql},
+		Cmd:          []string{"psql", "-U", "postgres", "-d", dbName, "-v", "ON_ERROR_STOP=1", "-tA", "-c", sql},
 	})
 	if err != nil {
 		return "", -1, fmt.Errorf("create psql exec: %w", err)

src/lib/db/dbctl_integration_test.go

@@ -68,7 +68,7 @@ func TestSyncAuthorizationIntegration(t *testing.T) {
 	}
 	assert := func(t *testing.T, sql, contains string) {
 		t.Helper()
-		out, code, err := c.execPSQL(context.Background(), id, sql)
+		out, code, err := c.execPSQL(context.Background(), id, "postgres", sql)
 		if err != nil || code != 0 {
 			t.Fatalf("check %q failed (exit %d, err %v): %s", sql, code, err, out)
 		}