fix: grant Vault privs to service_role

Author: soedirgo

ansible/files/postgresql_extension_custom_scripts/supabase_vault/after-create.sql

@@ -1,3 +1,8 @@
 grant usage on schema vault to postgres with grant option;
 grant select, delete on vault.secrets, vault.decrypted_secrets to postgres with grant option;
 grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to postgres with grant option;
+
+-- service_role used to be able to manage secrets in Vault <=0.2.8 because it had privileges to pgsodium functions
+grant usage on schema vault to service_role;
+grant select, delete on vault.secrets, vault.decrypted_secrets to service_role;
+grant execute on function vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt to service_role;

nix/tests/expected/roles.out

@@ -575,6 +575,7 @@ order by schema_order, schema_name, privilege_type, grantee, default_for;
  topology           | USAGE          | supabase_admin           | supabase_admin
  vault              | CREATE         | supabase_admin           | supabase_admin
  vault              | USAGE          | postgres                 | supabase_admin
+ vault              | USAGE          | service_role             | supabase_admin
  vault              | USAGE          | supabase_admin           | supabase_admin
-(390 rows)
+(391 rows)