Module: Omen::Grants

Defined in:
lib/omen/grants.rb

Overview

Everything said to a database to make the role a statement runs as: what it may be, what it may read, and what it may not. Kept apart from the task that runs them, which is about a database it has to find and a refusal it has to survive rather than about privileges.

Class Method Summary collapse

Class Method Details

.revoked(connection, role) ⇒ Array<String>

Intersected, so a bare db:create with no table yet to revoke on is not a failure.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

  • role (String) —

    the role to hide this feature's own tables from.

Returns:

  • (Array<String>) —

    one REVOKE per table there is.



34
35
36
37
38
 
# File 'lib/omen/grants.rb', line 34

def self.revoked(connection, role)
  (connection.tables & Omen.tables).map do |table|
    "REVOKE SELECT ON #{connection.quote_table_name table} FROM #{role}"
  end
end

.statements(connection, members) ⇒ Array<String>

DDL, which Active Record has no expression for, and not a query.

Parameters:

  • connection (ActiveRecord::ConnectionAdapters::AbstractAdapter) —

    a writing one.

  • members (Array<String>) —

    the roles that may SET LOCAL ROLE to this one. The owner running the task is one of them, and matters in tests, where Rails swaps the reading pool for the writing one and the test connection is the owner.

Returns:

  • (Array<String>) —

    the statements to run, in order.



12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
 
# File 'lib/omen/grants.rb', line 12

def self.statements(connection, members)
  role = connection.quote_table_name Omen.config.narrow_role
  [
    'DO $$ BEGIN IF NOT EXISTS (SELECT FROM pg_roles WHERE rolname = ' \
      "#{connection.quote Omen.config.narrow_role}) THEN CREATE ROLE #{role} NOLOGIN; " \
      'END IF; END $$',
    "ALTER ROLE #{role} WITH #{Attributes::SETTABLE}",
    "GRANT USAGE ON SCHEMA public TO #{role}",
    "GRANT SELECT ON ALL TABLES IN SCHEMA public TO #{role}",
    "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO #{role}",
    *members.map { |member| "GRANT #{role} TO #{connection.quote_table_name member}" },
    *revoked(connection, role),
    *Omen::Renamed.statements,
    *Omen::TimeZone.statements(connection),
    *Omen::Distance.statements(connection),
  ]
end