feat: restrict customer DB user permissions on provision

src/routes/customers.ts

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createDatabase, createDatabaseUser, deleteDatabase, deleteDatabaseUser } from "../services/do";
 import { addCustomerToPool, removeCustomerFromPool } from "../services/pgbouncer";
 import { addCustomerChart, removeCustomerChart } from "../services/git";
+import { setupCustomerDatabase, teardownCustomerDatabase } from "../services/db";
 
 const ProvisionSchema = z.object({
   name: z.string().min(2).max(32).regex(/^[a-z0-9-]+$/, "lowercase letters, numbers, and hyphens only"),
@@ -21,6 +22,7 @@ export async function customerRoutes(app: FastifyInstance) {
       createDatabaseUser(slug),
     ]);
 
+    await setupCustomerDatabase(slug, user.name);
     await addCustomerToPool(slug, user.password);
     addCustomerChart(slug, body.appVersion);
 
@@ -35,6 +37,7 @@ export async function customerRoutes(app: FastifyInstance) {
 
     removeCustomerChart(slug);
     await removeCustomerFromPool(slug);
+    await teardownCustomerDatabase(slug, slug);
     await Promise.all([
       deleteDatabase(slug),
       deleteDatabaseUser(slug),