Roles

See https://github.com/linz/linz-bde-schema/issues/62

There are currently 3 roles being defined:

bde_user

cannot create databases nor roles,

gets bde schema in search_path

• has USAGE ON SCHEMA bde
• has SELECT ON all tables in bde SCHEMA and their revisions (table_version)
• has EXECUTE on all functions in bde SCHEMA (could find 21 GRANT vs. 23 functions so there may be a discrepancy here)

bde_admin

cannot create databases nor roles, gets bde schema in search_path (same as bde_user)

has same grants as bde_user plus:

• has UPDATE, INSERT, DELETE ON all tables in bde SCHEMA and their revisions

bde_dba

can create both databases and roles, gets bde and bde_control schemas in search_path

Used to be SUPERUSER as of linz-bde-schema version < 1.1.0

• has ALL ON SCHEMA bde (not sure what this implies)
• get OWNERSHIP of all bde schemas, tables and functions

It looks like it never gets explicit permission on table revisions (which bde_admin and bde_user get via sql/versioning/01-version_tables.sql)