fix: migrate as durable database owner

Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028f0-a42f-7582-89a8-ebaad7343834

src/sbom_nexus/config.py

@@ -3,8 +3,11 @@
 from __future__ import annotations
 
 import os
+import re
 from pathlib import Path
 
+POSTGRES_IDENTIFIER = re.compile(r"^[a-z_][a-z0-9_]*$")
+
 
 def database_target(default: str | Path | None = None) -> str | Path:
     """Return the configured database target, preferring a mounted secret file."""
@@ -33,3 +36,13 @@ def database_target(default: str | Path | None = None) -> str | Path:
             "or SBOM_NEXUS_DATABASE_PATH"
         )
     return default
+
+
+def migration_role() -> str | None:
+    """Return the durable PostgreSQL role that must own migrated objects."""
+    role = os.getenv("SBOM_NEXUS_MIGRATION_ROLE")
+    if not role:
+        return None
+    if not POSTGRES_IDENTIFIER.fullmatch(role):
+        raise RuntimeError("SBOM_NEXUS_MIGRATION_ROLE must be a PostgreSQL identifier")
+    return role