CREATE TABLE data_source_grants (

data_source_id UUID NOT NULL REFERENCES data_sources(id) ON DELETE CASCADE,

workspace_id UUID NOT NULL REFERENCES workspaces(id) ON DELETE CASCADE,

granted_at TIMESTAMPTZ NOT NULL DEFAULT now(),

-- 授权的人。**裸外键**，与 entity_merges.merged_by 那几处一致：

-- 用户是软删除的，生产代码里没有 DELETE FROM users，所以归因保得住

granted_by UUID REFERENCES users(id),

PRIMARY KEY (data_source_id, workspace_id)

);

CREATE INDEX data_source_grants_workspace_idx ON data_source_grants (workspace_id);

INSERT INTO data_source_grants (data_source_id, workspace_id)

SELECT DISTINCT kds.data_source_id, kb.workspace_id

FROM kb_data_sources kds

JOIN knowledge_bases kb ON kb.id = kds.kb_id

ON CONFLICT DO NOTHING;