fix: Reduce postgres user grants

lib/realtime/tenants/migrations.ex

@@ -59,7 +59,8 @@ defmodule Realtime.Tenants.Migrations do
     FixWalrusRoleHandling,
     UnloggedMessagesTable,
     LoggedMessagesTable,
-    FilterDeletePostgresChanges
+    FilterDeletePostgresChanges,
+    ReduceGrantsPostgresUser
   }
 
   @migrations [
@@ -109,7 +110,8 @@ defmodule Realtime.Tenants.Migrations do
     {20_240_618_124_746, FixWalrusRoleHandling},
     {20_240_801_235_015, UnloggedMessagesTable},
     {20_240_805_133_720, LoggedMessagesTable},
-    {20_240_827_160_934, FilterDeletePostgresChanges}
+    {20_240_827_160_934, FilterDeletePostgresChanges},
+    {20_240_919_140_541, ReduceGrantsPostgresUser}
   ]
   defstruct [:tenant_external_id, :settings]
   @spec run_migrations(map()) :: :ok | {:error, any()}

lib/realtime/tenants/repo/migrations/20240919140541_reduce_grants_postgres_user.ex

@@ -0,0 +1,17 @@
+defmodule Realtime.Tenants.Migrations.ReduceGrantsPostgresUser do
+  @moduledoc false
+  use Ecto.Migration
+
+  def change do
+    execute("revoke supabase_realtime_admin from postgres")
+
+    execute("revoke all on table realtime.schema_migrations from postgres")
+    execute("grant select on table realtime.schema_migrations to postgres with grant option")
+
+    execute("revoke all on table realtime.messages from postgres")
+    execute("grant select on table realtime.messages to postgres with grant option")
+
+    execute("revoke all on table realtime.subscription from postgres")
+    execute("grant select on table realtime.subscription to postgres with grant option")
+  end
+end

mix.exs

@@ -4,7 +4,7 @@ defmodule Realtime.MixProject do
   def project do
     [
       app: :realtime,
-      version: "2.32.11",
+      version: "2.32.12",
       elixir: "~> 1.16.0",
       elixirc_paths: elixirc_paths(Mix.env()),
       start_permanent: Mix.env() == :prod,