add partner business object at db level

This commit is contained in:
Michael Hoennig 2022-09-09 10:40:05 +02:00
parent 35efa40ebb
commit 2f0f18182c
6 changed files with 425 additions and 31 deletions

View File

@ -62,7 +62,7 @@ do language plpgsql $$
call createHsAdminPersonTestData('LEGAL', 'first person'); call createHsAdminPersonTestData('LEGAL', 'first person');
call createHsAdminPersonTestData('NATURAL', null, 'Peter', 'Smith'); call createHsAdminPersonTestData('NATURAL', null, 'Peter', 'Smith');
call createHsAdminPersonTestData('LEGAL', 'Rockshop e.K.', 'Sandra', 'Miller'); call createHsAdminPersonTestData('LEGAL', 'Rockshop e.K.', 'Sandra', 'Miller');
call createHsAdminPersonTestData('SOLE_REPRESENTATION', 'Ostfriesische Stahlhandel OHG'); call createHsAdminPersonTestData('SOLE_REPRESENTATION', 'Ostfriesische Kuhhandel OHG');
call createHsAdminPersonTestData('JOINT_REPRESENTATION', 'Erbengemeinschaft Bessler', 'Mel', 'Bessler'); call createHsAdminPersonTestData('JOINT_REPRESENTATION', 'Erbengemeinschaft Bessler', 'Mel', 'Bessler');
end; end;
$$; $$;

View File

@ -0,0 +1,18 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-admin-partner-MAIN-TABLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists hs_admin_partner
(
uuid uuid unique references RbacObject (uuid),
personUuid uuid not null references hs_admin_person(uuid),
contactUuid uuid not null references hs_admin_contact(uuid),
registrationOffice varchar(96),
registrationNumber varchar(96),
birthName varchar(96),
birthday date,
dateOfDeath date
);
--//

View File

@ -0,0 +1,297 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-admin-partner-rbac-CREATE-OBJECT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
*/
create trigger createRbacObjectForHsAdminPartner_Trigger
before insert
on hs_admin_partner
for each row
execute procedure createRbacObject();
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function hsAdminPartnerOwner(partner hs_admin_partner)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('hs_admin_partner', partner.uuid, 'owner');
end; $$;
create or replace function hsAdminPartnerAdmin(partner hs_admin_partner)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('hs_admin_partner', partner.uuid, 'admin');
end; $$;
create or replace function hsAdminPartnerTenant(partner hs_admin_partner)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('hs_admin_partner', partner.uuid, 'tenant');
end; $$;
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-ROLES-CREATION:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles and their assignments for a new partner for the AFTER INSERT TRIGGER.
*/
create or replace function createRbacRolesForHsAdminContact()
returns trigger
language plpgsql
strict as $$
declare
ownerRole uuid;
adminRole uuid;
begin
if TG_OP <> 'INSERT' then
raise exception 'invalid usage of TRIGGER AFTER INSERT';
end if;
-- the owner role with full access for the global admins
ownerRole = createRole(
hsAdminPartnerOwner(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
beneathRole(globalAdmin())
);
-- the admin role with full access for the global admins
adminRole = createRole(
hsAdminPartnerAdmin(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['edit']),
beneathRole(globalAdmin())
);
-- the tenant role for those related users who can view the data
perform createRole(
hsAdminPartnerTenant(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view']),
beneathRole(ownerRole)
);
return NEW;
end; $$;
/*
An AFTER INSERT TRIGGER which creates the role structure for a new customer.
*/
create trigger createRbacRolesForHsAdminContact_Trigger
after insert
on hs_admin_partner
for each row
execute procedure createRbacRolesForHsAdminContact();
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-ROLES-REMOVAL:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Deletes the roles and their assignments of a deleted partner for the BEFORE DELETE TRIGGER.
*/
create or replace function deleteRbacRulesForHsAdminContact()
returns trigger
language plpgsql
strict as $$
begin
if TG_OP = 'DELETE' then
call deleteRole(findRoleId(hsAdminPartnerOwner(OLD)));
call deleteRole(findRoleId(hsAdminPartnerTenant(OLD)));
else
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
end if;
return old;
end; $$;
/*
An BEFORE DELETE TRIGGER which deletes the role structure of a partner.
*/
create trigger deleteRbacRulesForTestContact_Trigger
before delete
on hs_admin_partner
for each row
execute procedure deleteRbacRulesForHsAdminContact();
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the partner main table which maps the identifying name
(in this case, the prefix) to the objectUuid.
*/
create or replace view hs_admin_partner_iv as
select target.uuid,
cleanIdentifier(
(select idName from hs_admin_person_iv person where person.uuid = target.personuuid)
|| '-' ||
(select idName from hs_admin_contact_iv contact where contact.uuid = target.contactuuid)
)
as idName
from hs_admin_partner as target;
-- TODO.spec: Is it ok that everybody has access to this information?
grant all privileges on hs_admin_partner_iv to restricted;
/*
Returns the objectUuid for a given identifying name (in this case the prefix).
*/
create or replace function hs_admin_partnerUuidByIdName(idName varchar)
returns uuid
language sql
strict as $$
select uuid from hs_admin_partner_iv iv where iv.idName = hs_admin_partnerUuidByIdName.idName;
$$;
/*
Returns the identifying name for a given objectUuid (in this case the label).
*/
create or replace function hs_admin_partnerIdNameByUuid(uuid uuid)
returns varchar
language sql
strict as $$
select idName from hs_admin_partner_iv iv where iv.uuid = hs_admin_partnerIdNameByUuid.uuid;
$$;
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the partner main table with row-level limitation
based on the 'view' permission of the current user or assumed roles.
*/
set session session authorization default;
drop view if exists hs_admin_partner_rv;
create or replace view hs_admin_partner_rv as
select target.*
from hs_admin_partner as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'hs_admin_partner', currentSubjectsUuids()));
grant all privileges on hs_admin_partner_rv to restricted;
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-INSTEAD-OF-INSERT-TRIGGER:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
Instead of insert trigger function for hs_admin_partner_rv.
*/
create or replace function insertHsAdminContact()
returns trigger
language plpgsql as $$
declare
newUser hs_admin_partner;
begin
insert
into hs_admin_partner
values (new.*)
returning * into newUser;
return newUser;
end;
$$;
/*
Creates an instead of insert trigger for the hs_admin_partner_rv view.
*/
create trigger insertHsAdminContact_Trigger
instead of insert
on hs_admin_partner_rv
for each row
execute function insertHsAdminContact();
--//
-- ============================================================================
--changeset hs-admin-partner-rbac-INSTEAD-OF-DELETE-TRIGGER:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
Instead of delete trigger function for hs_admin_partner_rv.
*/
create or replace function deleteHsAdminContact()
returns trigger
language plpgsql as $$
begin
if true or hasGlobalRoleGranted(currentUserUuid()) or
old.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('delete', 'hs_admin_partner', currentSubjectsUuids())) then
delete from hs_admin_partner c where c.uuid = old.uuid;
return old;
end if;
raise exception '[403] User % not allowed to delete partner uuid %', currentUser(), old.uuid;
end; $$;
/*
Creates an instead of delete trigger for the hs_admin_partner_rv view.
*/
create trigger deleteHsAdminContact_Trigger
instead of delete
on hs_admin_partner_rv
for each row
execute function deleteHsAdminContact();
--/
-- ============================================================================
--changeset hs-admin-partner-rbac-NEW-CONTACT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a global permission for new-partner and assigns it to the hostsharing admins role.
*/
do language plpgsql $$
declare
addCustomerPermissions uuid[];
globalObjectUuid uuid;
globalAdminRoleUuid uuid ;
begin
call defineContext('granting global new-partner permission to global admin role', null, null, null);
globalAdminRoleUuid := findRoleId(globalAdmin());
globalObjectUuid := (select uuid from global);
addCustomerPermissions := createPermissions(globalObjectUuid, array ['new-partner']);
call grantPermissionsToRole(globalAdminRoleUuid, addCustomerPermissions);
end;
$$;
/**
Used by the trigger to prevent the add-customer to current user respectively assumed roles.
*/
create or replace function addHsAdminContactNotAllowedForCurrentSubjects()
returns trigger
language PLPGSQL
as $$
begin
raise exception '[403] new-partner not permitted for %',
array_to_string(currentSubjects(), ';', 'null');
end; $$;
/**
Checks if the user or assumed roles are allowed to create a new customer.
*/
create trigger hs_admin_partner_insert_trigger
before insert
on hs_admin_partner
for each row
-- TODO.spec: who is allowed to create new partners
when ( not hasAssumedRole() )
execute procedure addHsAdminContactNotAllowedForCurrentSubjects();
--//

View File

@ -0,0 +1,73 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-admin-partner-TEST-DATA-GENERATOR:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a single partner test record.
*/
create or replace procedure createHsAdminPartnerTestData( personTradeName varchar, contactLabel varchar )
language plpgsql as $$
declare
currentTask varchar;
idName varchar;
person hs_admin_person;
contact hs_admin_contact;
begin
idName := cleanIdentifier( personTradeName|| '-' || contactLabel);
currentTask := 'creating RBAC test partner ' || idName;
call defineContext(currentTask, null, 'alex@hostsharing.net', 'global#global.admin');
execute format('set local hsadminng.currentTask to %L', currentTask);
select p.* from hs_admin_person p where p.tradeName = personTradeName into person;
select c.* from hs_admin_contact c where c.label = contactLabel into contact;
raise notice 'creating test partner: %', idName;
raise notice '- using person (%): %', person.uuid, person;
raise notice '- using contact (%): %', contact.uuid, contact;
insert
into hs_admin_partner (uuid, personuuid, contactuuid)
values (uuid_generate_v4(), person.uuid, contact.uuid);
end; $$;
--//
/*
Creates a range of test partner for mass data generation.
*/
create or replace procedure createTestContactTestData(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
language plpgsql as $$
declare
person hs_admin_person;
contact hs_admin_contact;
begin
for t in startCount..endCount
loop
select p.* from hs_admin_person p where tradeName = intToVarChar(t, 4) into person;
select c.* from hs_admin_contact c where c.label = intToVarChar(t, 4) || '#' || t into contact;
call createHsAdminPartnerTestData(person.uuid, contact.uuid);
commit;
end loop;
end; $$;
--//
-- ============================================================================
--changeset hs-admin-partner-TEST-DATA-GENERATION:1 context=dev,tc endDelimiter:--//
-- ----------------------------------------------------------------------------
do language plpgsql $$
begin
-- call createHsAdminPartnerTestData('first person', 'first contact');
call createHsAdminPartnerTestData('Rockshop e.K.', 'second contact');
call createHsAdminPartnerTestData('Ostfriesische Kuhhandel OHG', 'third contact');
end;
$$;
--//

View File

@ -57,3 +57,9 @@ databaseChangeLog:
file: db/changelog/213-hs-admin-person-rbac.sql file: db/changelog/213-hs-admin-person-rbac.sql
- include: - include:
file: db/changelog/218-hs-admin-person-test-data.sql file: db/changelog/218-hs-admin-person-test-data.sql
- include:
file: db/changelog/220-hs-admin-partner.sql
- include:
file: db/changelog/223-hs-admin-partner-rbac.sql
- include:
file: db/changelog/228-hs-admin-partner-test-data.sql

View File

@ -1,46 +1,46 @@
#!/bin/bash #!/bin/bash
mkdir -p src/test/java/net/hostsharing/hsadminng/hs/admin/person mkdir -p src/test/java/net/hostsharing/hsadminng/hs/admin/partner
sed -e 's/hs-admin-contact/hs-admin-person/g' \ #sed -e 's/hs-admin-contact/hs-admin-partner/g' \
-e 's/hs_admin_contact/hs_admin_person/g' \ # -e 's/hs_admin_contact/hs_admin_partner/g' \
-e 's/HsAdminContact/HsAdminPerson/g' \ # -e 's/HsAdminContact/HsAdminPartner/g' \
-e 's/hsAdminContact/hsAdminPerson/g' \ # -e 's/hsAdminContact/hsAdminPartner/g' \
-e 's/contact/person/g' \ # -e 's/contact/partner/g' \
<src/test/java/net/hostsharing/hsadminng/hs/admin/contact/HsAdminContactRepositoryIntegrationTest.java \ #<src/test/java/net/hostsharing/hsadminng/hs/admin/contact/HsAdminContactRepositoryIntegrationTest.java \
>src/test/java/net/hostsharing/hsadminng/hs/admin/person/HsAdminPersonRepositoryIntegrationTest.java #>src/test/java/net/hostsharing/hsadminng/hs/admin/partner/HsAdminPartnerRepositoryIntegrationTest.java
sed -e 's/hs-admin-contact/hs-admin-person/g' \ sed -e 's/hs-admin-contact/hs-admin-partner/g' \
-e 's/hs_admin_contact/hs_admin_person/g' \ -e 's/hs_admin_contact/hs_admin_partner/g' \
<src/main/resources/db/changelog/200-hs-admin-contact.sql >src/main/resources/db/changelog/210-hs-admin-person.sql <src/main/resources/db/changelog/200-hs-admin-contact.sql >src/main/resources/db/changelog/220-hs-admin-partner.sql
sed -e 's/hs-admin-contact/hs-admin-person/g' \ sed -e 's/hs-admin-contact/hs-admin-partner/g' \
-e 's/hs_admin_contact/hs_admin_person/g' \ -e 's/hs_admin_contact/hs_admin_partner/g' \
-e 's/HsAdminCustomer/HsAdminPerson/g' \ -e 's/HsAdminCustomer/HsAdminPartner/g' \
-e 's/hsAdminContact/hsAdminPerson/g' \ -e 's/hsAdminContact/hsAdminPartner/g' \
-e 's/contact/person/g' \ -e 's/contact/partner/g' \
<src/main/resources/db/changelog/203-hs-admin-contact-rbac.sql >src/main/resources/db/changelog/213-hs-admin-person-rbac.sql <src/main/resources/db/changelog/203-hs-admin-contact-rbac.sql >src/main/resources/db/changelog/223-hs-admin-partner-rbac.sql
sed -e 's/hs-admin-contact/hs-admin-person/g' \ sed -e 's/hs-admin-contact/hs-admin-partner/g' \
-e 's/hs_admin_contact/hs_admin_person/g' \ -e 's/hs_admin_contact/hs_admin_partner/g' \
-e 's/HsAdminCustomer/HsAdminPerson/g' \ -e 's/HsAdminContact/HsAdminPartner/g' \
-e 's/hsAdminContact/hsAdminPerson/g' \ -e 's/hsAdminContact/hsAdminPartner/g' \
-e 's/contact/person/g' \ -e 's/contact/partner/g' \
<src/main/resources/db/changelog/208-hs-admin-contact-test-data.sql >src/main/resources/db/changelog/218-hs-admin-person-test-data.sql <src/main/resources/db/changelog/208-hs-admin-contact-test-data.sql >src/main/resources/db/changelog/228-hs-admin-partner-test-data.sql
# mkdir -p src/main/java/net/hostsharing/hsadminng/hs/admin/person # mkdir -p src/main/java/net/hostsharing/hsadminng/hs/admin/partner
# #
# sed -e 's/HsAdminContactEntity/HsAdminPersonEntity/g' \ # sed -e 's/HsAdminContactEntity/HsAdminPartnerEntity/g' \
# sed -e 's/admin.contact/admin.person/g' \ # sed -e 's/admin.contact/admin.partner/g' \
# <src/main/java/net/hostsharing/hsadminng/hs/admin/contact/HsAdminContactEntity.java >src/main/java/net/hostsharing/hsadminng/hs/admin/person/HsAdminPersonEntity.java # <src/main/java/net/hostsharing/hsadminng/hs/admin/contact/HsAdminContactEntity.java >src/main/java/net/hostsharing/hsadminng/hs/admin/partner/HsAdminPartnerEntity.java
cat >>src/main/resources/db/changelog/db.changelog-master.yaml <<EOF cat >>src/main/resources/db/changelog/db.changelog-master.yaml <<EOF
- include: - include:
file: db/changelog/210-hs-admin-person.sql file: db/changelog/220-hs-admin-partner.sql
- include: - include:
file: db/changelog/213-hs-admin-person-rbac.sql file: db/changelog/223-hs-admin-partner-rbac.sql
- include: - include:
file: db/changelog/218-hs-admin-person-test-data.sql file: db/changelog/228-hs-admin-partner-test-data.sql
EOF EOF