---
id: w6/m4/t001
title: Fix Postgres ownerId label bug
worker: worker6
status: done
estimate: 20m
depends_on: []
---

## Objective

Fix the label-key mismatch that makes Postgres `ownerId` scoping silently non-functional: `CreatePostgres` stamps `core.LabelWorkspace` on the `Database` CR (correct, for NetworkPolicy) but `pgView`/`ListPostgres` read/filter on `core.LabelTenant` — a different key that's never stamped.

## Context

- `lego/backend/internal/postgres/service.go:239` — `CreatePostgres` sets `d.Labels = map[string]string{core.LabelWorkspace: tenantID}`.
- `lego/backend/internal/postgres/service.go:134` — `pgView` reads `OwnerID: d.Labels[core.LabelTenant]` (always empty today).
- `lego/backend/internal/postgres/service.go:192` — `ListPostgres`'s `ownerID` filter matches `client.MatchingLabels{core.LabelTenant: ownerID}` (always empty match today).
- The correct dual-stamp pattern already exists for Apps: `lego/backend/internal/store/reconciler.go:248-249` stamps both `LabelTenant` (ownerId scoping) and `LabelWorkspace` (NetworkPolicy) on every App CR.
- `core.LabelTenant` / `core.LabelWorkspace` constants + their distinct purposes are documented at `lego/backend/internal/core/base.go:68-85`.

## Steps

1. In `CreatePostgres`, stamp **both** `core.LabelTenant` and `core.LabelWorkspace` on the `Database` CR's labels (same tenant id value for both keys), not just `LabelWorkspace`.
2. Update the doc comment on `PostgresView.OwnerID` (currently says "documented gap, w6 follow-up" — now resolved) to reflect the fix.
3. Confirm `pgView`/`ListPostgres` need no further change (they already read/filter the correct key, `LabelTenant`).

## Files

- `lego/backend/internal/postgres/service.go`

## Acceptance criteria

- [ ] A `Database` CR created via `CreatePostgres` carries both `bex.co/tenant` and `app.bex.co/workspace` labels with the same tenant id
- [ ] `PostgresView.OwnerID` is populated (non-empty) for a workspace-created database
- [ ] `ListPostgres(ownerID)` for a real workspace returns that workspace's databases, not an empty list

## Out of scope

- KeyValue's equivalent fix (t002) — same shape, separate task since KeyValue starts from zero labeling (not a mismatch, an absence).
