fix(page-data): grant agent role set permission

mindspace-userdata-postgres.mjs

@@ -18,6 +18,25 @@ export function quotePgIdentifier(value) {
   return `"${String(value).replaceAll('"', '""')}"`;
 }
 
+function quotePgLiteral(value) {
+  return `'${String(value).replaceAll("'", "''")}'`;
+}
+
+export function buildEnsureCurrentUserCanSetRoleSql(roleName) {
+  const role = String(roleName);
+  const roleLiteral = quotePgLiteral(role);
+  return `DO $$ BEGIN
+         IF NOT EXISTS (
+           SELECT 1 FROM pg_auth_members am
+           JOIN pg_roles r ON r.oid = am.roleid
+           JOIN pg_roles m ON m.oid = am.member
+           WHERE r.rolname = ${roleLiteral} AND m.rolname = CURRENT_USER AND am.set_option
+         ) THEN
+           EXECUTE format('GRANT %I TO %I WITH INHERIT FALSE, SET TRUE', ${roleLiteral}, CURRENT_USER);
+         END IF;
+       END $$`;
+}
+
 export function deriveUserSpaceNames(value) {
   const userId = assertUserId(value);
   const compact = userId.replaceAll('-', '');
@@ -118,6 +137,7 @@ export function buildProvisionUserSql(userId, { sourceSqlitePath = null, quotaBy
            EXECUTE format('GRANT %I TO %I', '${names.ownerRole}', CURRENT_USER);
          END IF;
        END $$`,
+      buildEnsureCurrentUserCanSetRoleSql(names.agentRole),
       `CREATE SCHEMA IF NOT EXISTS ${schema} AUTHORIZATION ${owner}`,
       `REVOKE ALL ON SCHEMA ${schema} FROM PUBLIC`,
       `GRANT USAGE, CREATE ON SCHEMA ${schema} TO ${agent}`,