remove hasGlobalAdminRole optimization, moved to separate branch

This commit is contained in:
Michael Hoennig 2024-11-23 12:54:06 +01:00
parent 32cc0b9609
commit 35d179cd95
2 changed files with 1 additions and 25 deletions

View File

@ -223,7 +223,7 @@ begin
) )
select target.* select target.*
from %1$s as target from %1$s as target
where rbac.hasGlobalAdminRole() or target.uuid in (select * from accessible_uuids) where target.uuid in (select * from accessible_uuids)
order by %2$s; order by %2$s;
grant all privileges on %1$s_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME}; grant all privileges on %1$s_rv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNAME};

View File

@ -35,30 +35,6 @@ end; $$;
--// --//
-- ============================================================================
--changeset michael.hoennig:rbac-global-HAS-GLOBAL-ADMIN-ROLE endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Returns true if the current user is a global admin and has no assumed role.
*/
create or replace function rbac.hasGlobalAdminRole()
returns boolean
stable -- leakproof
language plpgsql as $$
declare
currentSubjectOrAssumedRolesUuids text;
begin
begin
currentSubjectOrAssumedRolesUuids := current_setting('hsadminng.currentSubjectOrAssumedRolesUuids');
exception
when others then
currentSubjectOrAssumedRolesUuids := null;
end;
return currentSubjectOrAssumedRolesUuids is null or length(currentSubjectOrAssumedRolesUuids) = 0;
end; $$;
--//
-- ============================================================================ -- ============================================================================
--changeset michael.hoennig:rbac-global-HAS-GLOBAL-PERMISSION endDelimiter:--// --changeset michael.hoennig:rbac-global-HAS-GLOBAL-PERMISSION endDelimiter:--//
-- ------------------------------------------------------------------ -- ------------------------------------------------------------------