Add preflight check for source sequence SELECT privileges

[lghuy05]

Description

Add a second access preflight check that verifies the source role can SELECT from in-scope sequences used by snapshot tables.

This extends pgstream -check --access beyond table read privileges so sequence-value snapshot failures are caught earlier with a direct remediation message.

Related Issue(s)

• Related to Add pgstream check command for pre-migration sanity checks #897

Type of Change

Please select the relevant option(s):

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Refactoring (no functional changes)
• ⚡ Performance improvement
• 🧪 Test coverage improvement
• 🔨 Build/CI changes
• 🧹 Code cleanup

Changes Made

• add SourceSequenceSelectPrivilegesCheck to pkg/stream/preflight/access.go
• query table-to-sequence-relationships from Postgres catalogs and evaluate access with has_sequence_privilege(..., 'SELECT')
• update BuildAccessChecks to run both table and sequence access checks with the same shared source connection

Testing

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed
• All existing tests pass

Checklist

• Code follows project style guidelines
• Self-review completed
• Code is well-commented
• Documentation updated where necessary

Additional Notes

• I didn't fully verify the integration job

[kvch]

Could you please rebase your branch?

[kvch]

Does this condition include generated identity columns? Could you please add a test to verify that those columns are checked as well?

[lghuy05]

Thanks, I missed the identity-column case. I've updated the sequence privilege query to account for identity-backed sequences and added integration test covering GENERATED ALWAYS AS IDENTITY

[kvch]

I've been testing this a bit more, and found that this query cannot find all sequences that are snapshotted. It is missing the sequences that belong to the schema, but not owned by any columns. Sorry for pointing it out now. Could you please make sure the check includes:

• sequences of the table
• generated identity columns of the table
• all sequences in the selected schema

[lghuy05]

Thanks. I've updated the check to cover column-owned sequences, identity-backed sequences and free-standing sequences in selected schemas and added test for those cases.

[kvch]

Thank you for both the contribution and your patience.