Module: Omen::Attributes

Defined in:
lib/omen/attributes.rb

Overview

What the role a statement runs as may and may not be. A role is created with every dangerous attribute already off, so this gem sets only what whoever created it may set, and reads the rest back rather than asserting them: saying NOSUPERUSER needs the SUPERUSER attribute, so a managed database refuses the very statement that would have made the role safe.

Constant Summary collapse

SETTABLE =

Set on the role, because whoever may create a role may set these.

'NOLOGIN NOCREATEDB NOCREATEROLE'
DANGEROUS =

Read back instead, since saying no to one of these needs the attribute itself.

{ rolsuper: 'SUPERUSER', rolbypassrls: 'BYPASSRLS',
rolreplication: 'REPLICATION', }

Class Method Summary collapse

Class Method Details

.dangerous(connection) ⇒ Array<String>

Returns what the role holds that no reading should be able to reach.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

Returns:

  • (Array<String>) —

    what the role holds that no reading should be able to reach.



30
31
32
33
 
# File 'lib/omen/attributes.rb', line 30

def self.dangerous(connection)
  row = held(connection) || {}
  DANGEROUS.filter_map { |column, name| name if row[column.to_s] }
end

.exists?(connection) ⇒ Boolean

Returns whether the role is there at all to be granted anything.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

Returns:

  • (Boolean) —

    whether the role is there at all to be granted anything.



16
 
# File 'lib/omen/attributes.rb', line 16

def self.exists?(connection) = held(connection).present?

.held(connection) ⇒ Hash?

Nil where there is no such role, so that an empty list and a missing role read apart.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

Returns:

  • (Hash, nil) —

    the row of what the role is, or nothing where the role is not.



21
22
23
24
25
26
 
# File 'lib/omen/attributes.rb', line 21

def self.held(connection)
  connection.select_one <<~SQL.squish
    SELECT #{DANGEROUS.keys.join ', '} FROM pg_roles
    WHERE rolname = #{connection.quote Omen.config.narrow_role}
  SQL
end