fix: migrations do not refer to public schema anymore (#5400)

backend/custom_migrations/grant_all_current_schema.sql

@@ -0,0 +1,27 @@
+DO
+$$
+DECLARE
+    tbl_name text;
+    policy_exists boolean;
+    current_sch text;
+    tbl_names text[] := ARRAY['account', 'app', 'audit', 'capture', 'completed_job', 'flow', 'folder', 'http_trigger', 'queue', 'raw_app', 'resource', 'schedule', 'script', 'usr_to_group', 'variable'];
+BEGIN
+    -- Get the current schema
+    SELECT current_schema() INTO current_sch;
+
+    FOR tbl_name IN SELECT unnest(tbl_names)
+    LOOP
+        SELECT EXISTS (
+            SELECT 1 
+            FROM pg_policies 
+            WHERE schemaname = current_sch
+              AND tablename = tbl_name
+              AND policyname = 'admin_policy'
+        ) INTO policy_exists;
+
+       	IF NOT policy_exists THEN
+        	EXECUTE format('CREATE POLICY admin_policy ON %I.%I TO windmill_admin USING (true);', current_sch, tbl_name);
+       	END IF;
+    END LOOP;
+END;
+$$;

backend/migrations/20250205131523_grant_all_in_current_schema.down.sql

@@ -0,0 +1 @@
+-- Add down migration script here

backend/migrations/20250205131523_grant_all_in_current_schema.up.sql

@@ -0,0 +1,37 @@
+DO
+$do$
+DECLARE
+    current_schema_name TEXT;
+BEGIN
+    -- Get the current schema for the session
+    SELECT current_schema() INTO current_schema_name;
+
+    -- Lock the roles table to prevent race conditions
+    LOCK TABLE pg_catalog.pg_roles;
+
+
+
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO windmill_user', current_schema_name);
+    EXECUTE format('GRANT USAGE ON SCHEMA %I TO windmill_admin', current_schema_name);
+
+
+    -- Grant privileges dynamically to the current schema
+    EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO windmill_user', current_schema_name);
+    EXECUTE format('GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I TO windmill_user', current_schema_name);
+
+    -- Alter default privileges dynamically
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO windmill_user', current_schema_name);
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO windmill_user', current_schema_name);
+
+        -- Grant privileges dynamically to the current schema
+    EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO windmill_admin', current_schema_name);
+    EXECUTE format('GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I TO windmill_admin', current_schema_name);
+
+    -- Alter default privileges dynamically
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO windmill_admin', current_schema_name);
+    EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO windmill_admin', current_schema_name);
+
+EXCEPTION WHEN OTHERS THEN
+    RAISE NOTICE 'Error granting proper permissions to windmill users: %', SQLERRM;
+END
+$do$;

backend/windmill-api/src/db.rs

@@ -32,6 +32,28 @@ async fn current_database(conn: &mut PgConnection) -> Result<String, MigrateErro
         .await?)
 }
 
+lazy_static::lazy_static! {
+    pub static ref OVERRIDDEN_MIGRATIONS: std::collections::HashMap<i64, String> = vec![(20221207103910, include_str!(
+                        "../../custom_migrations/create_workspace_without_md5.sql"
+                    ).to_string()),
+                    (20240216100535, include_str!(
+                        "../../migrations/20240216100535_improve_policies.up.sql"
+                    ).replace("public.", "")),
+                    (20240403083110, include_str!(
+                        "../../migrations/20240403083110_remove_team_id_constraint.up.sql"
+                    ).replace("public.", "")),
+                    (20240613150524, include_str!(
+                        "../../migrations/20240613150524_add_job_perms.up.sql"
+                    ).replace("public.", "")),
+                    (20250102145420, include_str!(
+                        "../../migrations/20250102145420_more_captures.up.sql"
+                    ).replace("public.", "")),
+                    (20241006144414, include_str!(
+                        "../../custom_migrations/grant_all_current_schema.sql"
+                    ).to_string()),
+                    ].into_iter().collect();
+}
+
 struct CustomMigrator {
     inner: PoolConnection<Postgres>,
 }
@@ -132,12 +154,13 @@ impl Migrate for CustomMigrator {
                 migration.version,
                 migration.description
             );
-            if migration.version == 20221207103910 {
-                tracing::info!("Skipping migration 20221207103910 to avoid using md5");
+
+
+            if let Some(migration_sql) = OVERRIDDEN_MIGRATIONS.get(&migration.version) {
+                tracing::info!("Using custom migration for version {}", migration.version);
+
                 self.inner
-                    .execute(include_str!(
-                        "../../custom_migrations/create_workspace_without_md5.sql"
-                    ))
+                    .execute(&**migration_sql)
                     .await?;
                 let _ = sqlx::query(
                     r#"