I use liquibase for source control of our database. I put there changes to the schema, static data and procedures. So far I've kept permissions out of it; we have just four users with very well defined permissions that don't change. Now, for a new application, I need to create a new user and grant it table and column-specific permissions as they're demanded. Today it needs select permission for table A
, tomorrow also write permission to column description
of table B
.
I think I definitely should somehow keep track of these permission changes. I could keep them also under the same liquibase project, but I'm not sure that's a good idea. Permission changes are in a different level to the other ones, plus, I would need to grant the liquibase user (the one I run liquibase under) permission to grant permissions, which I'd prefer that only the root user has.
Should I then put theses changes in the same database source control project? In a different one? What are some other alternatives?