Grant readonly USAGE + SELECT on the ord and rdkit schemas

The readonly role only had grants on `public`, but the ord search database
keeps its tables in non-public schemas: ord-schema's ORM tables live in `ord`
and the RDKit cartridge tables in `rdkit`. As a result the role could connect
to the `ord` database but `permission denied for schema ord` on every query —
it could not read any of the actual data.

Extend the grants so the readonly role gets USAGE + SELECT (current and future
tables) on `ord` and `rdkit` in the ord database, matching what it already has
on `public`. The per-schema grants are factored into `grant_schema_read()`;
public keeps its existing resource names, so no existing grants churn (preview:
6 to create, 27 unchanged). The app/editor/app_staging databases are public-only
and are unaffected.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: skearnes

stacks/database/README.md

@@ -20,7 +20,9 @@ dependency is quarantined here, in the one stack that actually needs it.
 - The **`readonly`** role (LOGIN), password sourced from the `rds_ro_password`
   secret that `backend` owns.
 - `CONNECT` + `USAGE` + `SELECT` on `public`, plus default privileges for future
-  tables, across all four databases.
+  tables, across all four databases. The `ord` search database also keeps tables
+  in the `ord` (ord-schema ORM) and `rdkit` (cartridge) schemas, so the role gets
+  the same USAGE + SELECT there.
 
 ## Deploying
 

stacks/database/__main__.py

@@ -35,6 +35,14 @@
 DATABASES = ["app", "ord", "editor", "app_staging"]
 PROD_DATABASES = {"app", "ord", "editor"}
 
+# Every database exposes readable tables in public; the readonly role is granted
+# there for all of them. The ord search database additionally keeps tables in two
+# non-public schemas — ord-schema's ORM tables in `ord` and the RDKit cartridge
+# tables in `rdkit` — so the role needs USAGE + SELECT on those too. The
+# Alembic-managed app databases (app, app_staging) and the editor database use
+# public only.
+EXTRA_READONLY_SCHEMAS = {"ord": ["ord", "rdkit"]}
+
 # Credentials come from the secrets the backend stack manages: the master user to
 # connect as, and the generated password the `readonly` role should have.
 master_password = aws.secretsmanager.get_secret_version_output(
@@ -106,31 +114,31 @@
     ),
 )
 
-for db, provider in providers.items():
-    opts = pulumi.ResourceOptions(
-        provider=provider, depends_on=[readonly, databases[db]]
-    )
-    postgresql.Grant(
-        f"{db}_connect",
-        database=db,
-        role=readonly.name,
-        object_type="database",
-        privileges=["CONNECT"],
-        opts=opts,
-    )
+
+def grant_schema_read(name_prefix: str, db: str, schema: str, opts) -> None:
+    """Grants the readonly role USAGE + SELECT (current and future tables) on a schema.
+
+    Args:
+        name_prefix: Prefix for the Pulumi resource names. `public` uses the bare
+            database name to preserve existing resource URNs; other schemas qualify
+            it with the schema name.
+        db: Database the grants apply to.
+        schema: Schema to grant on.
+        opts: Resource options carrying the database's provider and dependencies.
+    """
     postgresql.Grant(
-        f"{db}_usage",
+        f"{name_prefix}_usage",
         database=db,
-        schema="public",
+        schema=schema,
         role=readonly.name,
         object_type="schema",
         privileges=["USAGE"],
         opts=opts,
     )
     postgresql.Grant(
-        f"{db}_select",
+        f"{name_prefix}_select",
         database=db,
-        schema="public",
+        schema=schema,
         role=readonly.name,
         object_type="table",
         objects=[],  # empty list = all tables currently in the schema
@@ -140,12 +148,29 @@
     # Future tables created by the master user are readable too, so loads don't
     # silently leave the readonly role unable to see new tables.
     postgresql.DefaultPrivileges(
-        f"{db}_select_future",
+        f"{name_prefix}_select_future",
         database=db,
-        schema="public",
+        schema=schema,
         owner="ord",
         role=readonly.name,
         object_type="table",
         privileges=["SELECT"],
         opts=opts,
     )
+
+
+for db, provider in providers.items():
+    opts = pulumi.ResourceOptions(
+        provider=provider, depends_on=[readonly, databases[db]]
+    )
+    postgresql.Grant(
+        f"{db}_connect",
+        database=db,
+        role=readonly.name,
+        object_type="database",
+        privileges=["CONNECT"],
+        opts=opts,
+    )
+    grant_schema_read(db, db, "public", opts)
+    for schema in EXTRA_READONLY_SCHEMAS.get(db, []):
+        grant_schema_read(f"{db}_{schema}", db, schema, opts)