2023-07-21 23:59:12 +00:00
|
|
|
-- Deploy camper:ensure_role_exists to pg
|
Move the user role down to company_user relation
I was starting to add the public page for campsite types, creating more
granular row-level security policies for select, insert, update, and
delete, because now the guest users needed to SELECT them and they have
no related company to filter the rows with. Suddenly, i realized that
the role was wrong in the user relation: a user can be an admin to one
company, and employee to another, and guess to yet another company;
the role should be in the company_user relation instead.
That means that to know the role to set to, the user alone is not enough
and have to know the company as well. Had to change all the
cookie-related function to accept also the company’s host name, as this
is the information that the Go application has.
2023-08-08 00:22:16 +00:00
|
|
|
-- requires: roles
|
|
|
|
-- requires: schema_camper
|
|
|
|
-- requires: company_user
|
2023-07-21 23:59:12 +00:00
|
|
|
|
|
|
|
begin;
|
|
|
|
|
Move the user role down to company_user relation
I was starting to add the public page for campsite types, creating more
granular row-level security policies for select, insert, update, and
delete, because now the guest users needed to SELECT them and they have
no related company to filter the rows with. Suddenly, i realized that
the role was wrong in the user relation: a user can be an admin to one
company, and employee to another, and guess to yet another company;
the role should be in the company_user relation instead.
That means that to know the role to set to, the user alone is not enough
and have to know the company as well. Had to change all the
cookie-related function to accept also the company’s host name, as this
is the information that the Go application has.
2023-08-08 00:22:16 +00:00
|
|
|
set search_path to camper, public;
|
2023-07-21 23:59:12 +00:00
|
|
|
|
|
|
|
create or replace function ensure_role_exists() returns trigger as
|
|
|
|
$$
|
|
|
|
begin
|
|
|
|
if not exists (select 1 from pg_roles where rolname = new.role) then
|
|
|
|
raise foreign_key_violation using message = 'role not found: ' || new.role;
|
|
|
|
end if;
|
|
|
|
return new;
|
|
|
|
end;
|
|
|
|
$$
|
|
|
|
language plpgsql;
|
|
|
|
|
|
|
|
comment on function ensure_role_exists() is
|
|
|
|
'Makes sure that a role given to a user is a valid, existing role in the cluster.';
|
|
|
|
|
|
|
|
revoke execute on function ensure_role_exists() from public;
|
|
|
|
|
|
|
|
create trigger ensure_role_exists
|
|
|
|
after insert or update
|
Move the user role down to company_user relation
I was starting to add the public page for campsite types, creating more
granular row-level security policies for select, insert, update, and
delete, because now the guest users needed to SELECT them and they have
no related company to filter the rows with. Suddenly, i realized that
the role was wrong in the user relation: a user can be an admin to one
company, and employee to another, and guess to yet another company;
the role should be in the company_user relation instead.
That means that to know the role to set to, the user alone is not enough
and have to know the company as well. Had to change all the
cookie-related function to accept also the company’s host name, as this
is the information that the Go application has.
2023-08-08 00:22:16 +00:00
|
|
|
on company_user
|
2023-07-21 23:59:12 +00:00
|
|
|
for each row
|
|
|
|
execute procedure ensure_role_exists();
|
|
|
|
|
|
|
|
|
|
|
|
commit;
|