use customer/package/unixuser only as test data structure (DB part)

This commit is contained in:
Michael Hoennig 2022-08-31 09:42:40 +02:00
parent 817c1a9e58
commit a33cb4ec29
33 changed files with 603 additions and 595 deletions

View File

@ -65,22 +65,22 @@ If you have at least Docker, the Java JDK and Gradle installed in appropriate ve
# the following command should return a JSON array with just all customers:
curl \
-H 'current-user: mike@hostsharing.net' \
-H 'current-user: mike@example.org' \
http://localhost:8080/api/customers
# the following command should return a JSON array with just all packages visible for the admin of the customer yyy:
curl \
-H 'current-user: mike@hostsharing.net' -H 'assumed-roles: customer#yyy.admin' \
-H 'current-user: mike@example.org' -H 'assumed-roles: test_customer#yyy.admin' \
http://localhost:8080/api/packages
# add a new customer
curl \
-H 'current-user: mike@hostsharing.net' -H "Content-Type: application/json" \
-H 'current-user: mike@example.org' -H "Content-Type: application/json" \
-d '{ "prefix":"ttt", "reference":80001, "adminUserName":"admin@ttt.example.com" }' \
-X POST http://localhost:8080/api/customers
If you wonder who 'mike@hostsharing.net' and 'sven@hostsharing.net' are and where the data comes from:
Mike and Sven are just example Hostsharing hostmaster accounts as part of the example data which is automatically inserted in Testcontainers and Development environments.
If you wonder who 'mike@example.org' and 'sven@example.org' are and where the data comes from:
Mike and Sven are just example global admin accounts as part of the example data which is automatically inserted in Testcontainers and Development environments.
Also try for example 'admin@xxx.example.com' or 'unknown@example.org'.
If you want a formatted JSON output, you can pipe the result to `jq` or similar.

View File

@ -64,7 +64,7 @@ begin
domainOwnerRoleUuid = createRole(
domainOwner(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
beneathRole(packageAdmin(parentPackage))
beneathRole(testPackageAdmin(parentPackage))
);
-- a domain admin role is created and assigned to the domain's owner role

View File

@ -17,21 +17,21 @@ BEGIN
-- hostmaster accessing a single customer
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = '';
-- SELECT *
SELECT count(*) INTO resultCount
from customer_rv c
from test_customer_rv c
where c.prefix='aab';
call expectBetween(resultCount, 1, 1);
-- hostmaster listing all customers
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = '';
-- SELECT *
SELECT count(*) INTO resultCount
FROM customer_rv;
FROM test_customer_rv;
call expectBetween(resultCount, 10, 20000);
-- customer admin listing all their packages
@ -40,7 +40,7 @@ BEGIN
SET LOCAL hsadminng.assumedRoles = '';
-- SELECT *
SELECT count(*) INTO resultCount
FROM package_rv;
FROM test_package_rv;
call expectBetween(resultCount, 2, 10);
-- cutomer admin listing all their unix users
@ -54,49 +54,49 @@ BEGIN
-- hostsharing admin assuming customer role and listing all accessible packages
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.assumedRoles = 'customer#aaa.admin;customer#aab.admin';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = 'test_customer#aaa.admin;test_customer#aab.admin';
-- SELECT *
SELECT count(*) INTO resultCount
FROM package_rv p;
FROM test_package_rv p;
call expectBetween(resultCount, 2, 10);
-- hostsharing admin assuming two customer admin roles and listing all accessible unixusers
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.assumedRoles = 'customer#aab.admin;customer#aac.admin';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = 'test_customer#aab.admin;test_customer#aac.admin';
-- SELECT c.prefix, c.reference, uu.*
SELECT count(*) INTO resultCount
FROM unixuser_rv uu
JOIN package_rv p ON p.uuid = uu.packageuuid
JOIN customer_rv c ON c.uuid = p.customeruuid;
JOIN test_package_rv p ON p.uuid = uu.packageuuid
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
call expectBetween(resultCount, 40, 60);
-- hostsharing admin assuming two customer admin roles and listing all accessible domains
-- ABORT; START TRANSACTION;
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.assumedRoles = 'customer#aac.admin;customer#aad.admin';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = 'test_customer#aac.admin;test_customer#aad.admin';
-- SELECT p.name, uu.name, dom.name
SELECT count(*) INTO resultCount
FROM domain_rv dom
JOIN unixuser_rv uu ON uu.uuid = dom.unixuseruuid
JOIN package_rv p ON p.uuid = uu.packageuuid
JOIN customer_rv c ON c.uuid = p.customeruuid;
JOIN test_package_rv p ON p.uuid = uu.packageuuid
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
call expectBetween(resultCount, 20, 40);
-- hostsharing admin assuming two customer admin roles and listing all accessible email addresses
-- ABORT; START TRANSACTION;
SET SESSION SESSION AUTHORIZATION restricted;
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
SET LOCAL hsadminng.assumedRoles = 'customer#aae.admin;customer#aaf.admin';
SET LOCAL hsadminng.currentUser = 'mike@example.org';
SET LOCAL hsadminng.assumedRoles = 'test_customer#aae.admin;test_customer#aaf.admin';
-- SELECT c.prefix, p.name as "package", ema.localPart || '@' || dom.name as "email-address"
SELECT count(*) INTO resultCount
FROM emailaddress_rv ema
JOIN domain_rv dom ON dom.uuid = ema.domainuuid
JOIN unixuser_rv uu ON uu.uuid = dom.unixuseruuid
JOIN package_rv p ON p.uuid = uu.packageuuid
JOIN customer_rv c ON c.uuid = p.customeruuid;
JOIN test_package_rv p ON p.uuid = uu.packageuuid
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
call expectBetween(resultCount, 100, 300);
-- ~170ms

View File

@ -3,16 +3,16 @@
-- --------------------------------------------------------
select isGranted(findRoleId('administrators'), findRoleId('package#aaa00.owner'));
select isGranted(findRoleId('package#aaa00.owner'), findRoleId('administrators'));
-- call grantRoleToRole(findRoleId('package#aaa00.owner'), findRoleId('administrators'));
-- call grantRoleToRole(findRoleId('administrators'), findRoleId('package#aaa00.owner'));
select isGranted(findRoleId('administrators'), findRoleId('test_package#aaa00.owner'));
select isGranted(findRoleId('test_package#aaa00.owner'), findRoleId('administrators'));
-- call grantRoleToRole(findRoleId('test_package#aaa00.owner'), findRoleId('administrators'));
-- call grantRoleToRole(findRoleId('administrators'), findRoleId('test_package#aaa00.owner'));
select count(*)
FROM queryAllPermissionsOfSubjectIdForObjectUuids(findRbacUser('sven@hostsharing.net'),
FROM queryAllPermissionsOfSubjectIdForObjectUuids(findRbacUser('sven@example.org'),
ARRAY(select uuid from customer where reference < 1100000));
select count(*)
FROM queryAllPermissionsOfSubjectId(findRbacUser('sven@hostsharing.net'));
FROM queryAllPermissionsOfSubjectId(findRbacUser('sven@example.org'));
select *
FROM queryAllPermissionsOfSubjectId(findRbacUser('alex@example.com'));
select *
@ -33,7 +33,7 @@ $$
userId uuid;
result bool;
BEGIN
userId = findRbacUser('mike@hostsharing.net');
userId = findRbacUser('mike@example.org');
result = (SELECT * FROM isPermissionGrantedToSubject(findPermissionId('package', 94928, 'add-package'), userId));
IF (result) THEN
RAISE EXCEPTION 'expected permission NOT to be granted, but it is';

View File

@ -20,7 +20,7 @@ CREATE POLICY customer_policy ON customer
TO restricted
USING (
-- id=1000
isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid())
isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid())
);
SET SESSION AUTHORIZATION restricted;
@ -35,10 +35,10 @@ SELECT * FROM customer;
CREATE OR REPLACE RULE "_RETURN" AS
ON SELECT TO cust_view
DO INSTEAD
SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid());
SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid());
SELECT * from cust_view LIMIT 10;
select queryAllPermissionsOfSubjectId(findRbacUser('mike@hostsharing.net'));
select queryAllPermissionsOfSubjectId(findRbacUser('mike@example.org'));
-- access control via view-rule with join to recursive permissions - really fast (38ms for 1 million rows)
SET SESSION SESSION AUTHORIZATION DEFAULT;
@ -52,7 +52,7 @@ CREATE OR REPLACE RULE "_RETURN" AS
DO INSTEAD
SELECT c.uuid, c.reference, c.prefix FROM customer AS c
JOIN queryAllPermissionsOfSubjectId(currentUserUuid()) AS p
ON p.objectTable='customer' AND p.objectUuid=c.uuid AND p.op in ('*', 'view');
ON p.objectTable='test_customer' AND p.objectUuid=c.uuid AND p.op in ('*', 'view');
GRANT ALL PRIVILEGES ON cust_view TO restricted;
SET SESSION SESSION AUTHORIZATION restricted;
@ -73,7 +73,7 @@ GRANT ALL PRIVILEGES ON cust_view TO restricted;
SET SESSION SESSION AUTHORIZATION restricted;
-- SET hsadminng.currentUser TO 'alex@example.com';
SET hsadminng.currentUser TO 'mike@hostsharing.net';
SET hsadminng.currentUser TO 'mike@example.org';
-- SET hsadminng.currentUser TO 'aaaaouq@example.com';
SELECT * from cust_view where reference=1144150;
@ -81,9 +81,9 @@ select rr.uuid, rr.type from RbacGrants g
join RbacReference RR on g.ascendantUuid = RR.uuid
where g.descendantUuid in (
select uuid from queryAllPermissionsOfSubjectId(findRbacUser('alex@example.com'))
where objectTable='customer' and op in ('*', 'view'));
where objectTable='test_customer' and op in ('*', 'view'));
call grantRoleToUser(findRoleId('customer#aaa.admin'), findRbacUser('aaaaouq@example.com'));
call grantRoleToUser(findRoleId('test_customer#aaa.admin'), findRbacUser('aaaaouq@example.com'));
select queryAllPermissionsOfSubjectId(findRbacUser('aaaaouq@example.com'));

View File

@ -9,7 +9,7 @@ import javax.persistence.*;
import java.util.UUID;
@Entity
@Table(name = "customer_rv")
@Table(name = "test_customer_rv")
@Getter
@Setter
@NoArgsConstructor

View File

@ -10,7 +10,7 @@ import javax.persistence.*;
import java.util.UUID;
@Entity
@Table(name = "package_rv")
@Table(name = "test_package_rv")
@Getter
@Setter
@NoArgsConstructor

View File

@ -152,8 +152,14 @@ create or replace function pureIdentifier(rawIdentifier varchar)
returns varchar
returns null on null input
language plpgsql as $$
declare
cleanIdentifier varchar;
begin
return regexp_replace(rawIdentifier, '\W+', '');
cleanIdentifier := regexp_replace(rawIdentifier, '[^A-Za-z0-9\-._]+', '', 'g');
if cleanIdentifier != rawIdentifier then
raise exception 'identifier "%" contains invalid characters, maybe use "%"', rawIdentifier, cleanIdentifier;
end if;
return cleanIdentifier;
end; $$;
create or replace function findObjectUuidByIdName(objectTable varchar, objectIdName varchar)

View File

@ -228,6 +228,9 @@ begin
roleTypeFromRoleIdName = split_part(roleParts, '#', 3);
objectUuidOfRole = findObjectUuidByIdName(objectTableFromRoleIdName, objectNameFromRoleIdName);
raise notice $sql$findObjectUuidByIdName('%', '%') = %;$sql$, objectTableFromRoleIdName, objectNameFromRoleIdName, objectUuidOfRole;
raise notice 'finding %, % (%), %', objectTableFromRoleIdName, objectNameFromRoleIdName, objectUuidOfRole, roleTypeFromRoleIdName;
select uuid
from RbacRole
where objectUuid = objectUuidOfRole

View File

@ -1,7 +1,7 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-base-GLOBAL-OBJECT:1 endDelimiter:--//
--changeset test-base-GLOBAL-OBJECT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
@ -12,32 +12,32 @@ begin transaction;
insert
into RbacObject (objecttable) values ('global');
insert
into Global (uuid, name) values ((select uuid from RbacObject where objectTable = 'global'), 'hostsharing');
into Global (uuid, name) values ((select uuid from RbacObject where objectTable = 'global'), 'test-global');
commit;
--//
-- ============================================================================
--changeset hs-base-ADMIN-ROLE:1 endDelimiter:--//
--changeset test-base-ADMIN-ROLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
A global administrator role.
*/
create or replace function hostsharingAdmin()
returns RbacRoleDescriptor
returns null on null input
create or replace function testGlobalAdmin()
returns RbacRoleDescriptor
returns null on null input
stable leakproof
language sql as $$
select 'global', (select uuid from RbacObject where objectTable = 'global'), 'admin'::RbacRoleType;
$$;
begin transaction;
call defineContext('creating Hostsharing admin role', null, null, null);
select createRole(hostsharingAdmin());
call defineContext('creating test-global admin role', null, null, null);
select createRole(testGlobalAdmin());
commit;
-- ============================================================================
--changeset hs-base-ADMIN-USERS:1 context:dev,tc endDelimiter:--//
--changeset test-base-ADMIN-USERS:1 context:dev,tc endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Create two users and assign both to the administrators role.
@ -46,18 +46,18 @@ do language plpgsql $$
declare
admins uuid ;
begin
call defineContext('creating fake Hostsharing admin users', null, null, null);
call defineContext('creating fake test-realm admin users', null, null, null);
admins = findRoleId(hostsharingAdmin());
call grantRoleToUserUnchecked(admins, admins, createRbacUser('mike@hostsharing.net'));
call grantRoleToUserUnchecked(admins, admins, createRbacUser('sven@hostsharing.net'));
admins = findRoleId(testGlobalAdmin());
call grantRoleToUserUnchecked(admins, admins, createRbacUser('mike@example.org'));
call grantRoleToUserUnchecked(admins, admins, createRbacUser('sven@example.org'));
end;
$$;
--//
-- ============================================================================
--changeset hs-base-hostsharing-TEST:1 context:dev,tc runAlways:true endDelimiter:--//
--changeset test-base-hostsharing-TEST:1 context:dev,tc runAlways:true endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
@ -68,15 +68,15 @@ do language plpgsql $$
declare
userName varchar;
begin
call defineContext('testing currentUserUuid', null, 'sven@hostsharing.net', null);
call defineContext('testing currentUserUuid', null, 'sven@example.org', null);
select userName from RbacUser where uuid = currentUserUuid() into userName;
if userName <> 'sven@hostsharing.net' then
if userName <> 'sven@example.org' then
raise exception 'setting or fetching initial currentUser failed, got: %', userName;
end if;
call defineContext('testing currentUserUuid', null, 'mike@hostsharing.net', null);
call defineContext('testing currentUserUuid', null, 'mike@example.org', null);
select userName from RbacUser where uuid = currentUserUuid() into userName;
if userName = 'mike@hostsharing.net' then
if userName = 'mike@example.org' then
raise exception 'currentUser should not change in one transaction, but did change, got: %', userName;
end if;
end; $$;

View File

@ -1,10 +1,10 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-customer-MAIN-TABLE:1 endDelimiter:--//
--changeset test-customer-MAIN-TABLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists customer
create table if not exists test_customer
(
uuid uuid unique references RbacObject (uuid),
reference int not null unique check (reference between 10000 and 99999),

View File

@ -1,64 +1,64 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-customer-rbac-CREATE-OBJECT:1 endDelimiter:--//
--changeset test-customer-rbac-CREATE-OBJECT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
*/
drop trigger if exists createRbacObjectForCustomer_Trigger on customer;
drop trigger if exists createRbacObjectForCustomer_Trigger on test_customer;
create trigger createRbacObjectForCustomer_Trigger
before insert
on customer
on test_customer
for each row
execute procedure createRbacObject();
--//
-- ============================================================================
--changeset hs-customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
--changeset test-customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function customerOwner(customer customer)
create or replace function testCustomerOwner(customer test_customer)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('customer', customer.uuid, 'owner');
return roleDescriptor('test_customer', customer.uuid, 'owner');
end; $$;
create or replace function customerAdmin(customer customer)
create or replace function testCustomerAdmin(customer test_customer)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('customer', customer.uuid, 'admin');
return roleDescriptor('test_customer', customer.uuid, 'admin');
end; $$;
create or replace function customerTenant(customer customer)
create or replace function testCustomerTenant(customer test_customer)
returns RbacRoleDescriptor
language plpgsql
strict as $$
begin
return roleDescriptor('customer', customer.uuid, 'tenant');
return roleDescriptor('test_customer', customer.uuid, 'tenant');
end; $$;
--//
-- ============================================================================
--changeset hs-customer-rbac-ROLES-CREATION:1 endDelimiter:--//
--changeset test-customer-rbac-ROLES-CREATION:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles and their assignments for a new customer for the AFTER INSERT TRIGGER.
*/
create or replace function createRbacRolesForCustomer()
create or replace function createRbacRolesForTestCustomer()
returns trigger
language plpgsql
strict as $$
declare
customerOwnerUuid uuid;
testCustomerOwnerUuid uuid;
customerAdminUuid uuid;
begin
if TG_OP <> 'INSERT' then
@ -66,27 +66,27 @@ begin
end if;
-- the owner role with full access for Hostsharing administrators
customerOwnerUuid = createRole(
customerOwner(NEW),
testCustomerOwnerUuid = createRole(
testCustomerOwner(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
beneathRole(hostsharingAdmin())
beneathRole(testGlobalAdmin())
);
-- the admin role for the customer's admins, who can view and add products
customerAdminUuid = createRole(
customerAdmin(NEW),
testCustomerAdmin(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view', 'add-package']),
-- NO auto assume for customer owner to avoid exploding permissions for administrators
withUser(NEW.adminUserName, 'create'), -- implicitly ignored if null
grantedByRole(hostsharingAdmin())
grantedByRole(testGlobalAdmin())
);
-- allow the customer owner role (thus administrators) to assume the customer admin role
call grantRoleToRole(customerAdminUuid, customerOwnerUuid, false);
call grantRoleToRole(customerAdminUuid, testCustomerOwnerUuid, false);
-- the tenant role which later can be used by owners+admins of sub-objects
perform createRole(
customerTenant(NEW),
testCustomerTenant(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view'])
);
@ -97,32 +97,32 @@ end; $$;
An AFTER INSERT TRIGGER which creates the role structure for a new customer.
*/
drop trigger if exists createRbacRolesForCustomer_Trigger on customer;
create trigger createRbacRolesForCustomer_Trigger
drop trigger if exists createRbacRolesForTestCustomer_Trigger on test_customer;
create trigger createRbacRolesForTestCustomer_Trigger
after insert
on customer
on test_customer
for each row
execute procedure createRbacRolesForCustomer();
execute procedure createRbacRolesForTestCustomer();
--//
-- ============================================================================
--changeset hs-customer-rbac-ROLES-REMOVAL:1 endDelimiter:--//
--changeset test-customer-rbac-ROLES-REMOVAL:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Deletes the roles and their assignments of a deleted customer for the BEFORE DELETE TRIGGER.
*/
create or replace function deleteRbacRulesForCustomer()
create or replace function deleteRbacRulesForTestCustomer()
returns trigger
language plpgsql
strict as $$
begin
if TG_OP = 'DELETE' then
call deleteRole(findRoleId(customerOwner(OLD)));
call deleteRole(findRoleId(customerAdmin(OLD)));
call deleteRole(findRoleId(customerTenant(OLD)));
call deleteRole(findRoleId(testCustomerOwner(OLD)));
call deleteRole(findRoleId(testCustomerAdmin(OLD)));
call deleteRole(findRoleId(testCustomerTenant(OLD)));
else
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
end if;
@ -132,93 +132,93 @@ end; $$;
An BEFORE DELETE TRIGGER which deletes the role structure of a customer.
*/
drop trigger if exists deleteRbacRulesForCustomer_Trigger on customer;
create trigger deleteRbacRulesForCustomer_Trigger
drop trigger if exists deleteRbacRulesForTestCustomer_Trigger on test_customer;
create trigger deleteRbacRulesForTestCustomer_Trigger
before delete
on customer
on test_customer
for each row
execute procedure deleteRbacRulesForCustomer();
execute procedure deleteRbacRulesForTestCustomer();
--//
-- ============================================================================
--changeset hs-customer-rbac-IDENTITY-VIEW:1 endDelimiter:--//
--changeset test-customer-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the customer main table which maps the identifying name
(in this case, the prefix) to the objectUuid.
*/
drop view if exists customer_iv;
create or replace view customer_iv as
drop view if exists test_customer_iv;
create or replace view test_customer_iv as
select target.uuid, target.prefix as idName
from customer as target;
from test_customer as target;
-- TODO: Is it ok that everybody has access to this information?
grant all privileges on customer_iv to restricted;
grant all privileges on test_customer_iv to restricted;
/*
Returns the objectUuid for a given identifying name (in this case the prefix).
*/
create or replace function customerUuidByIdName(idName varchar)
create or replace function test_customerUuidByIdName(idName varchar)
returns uuid
language sql
strict as $$
select uuid from customer_iv iv where iv.idName = customerUuidByIdName.idName;
select uuid from test_customer_iv iv where iv.idName = test_customerUuidByIdName.idName;
$$;
/*
Returns the identifying name for a given objectUuid (in this case the prefix).
*/
create or replace function customerIdNameByUuid(uuid uuid)
create or replace function test_customerIdNameByUuid(uuid uuid)
returns varchar
language sql
strict as $$
select idName from customer_iv iv where iv.uuid = customerIdNameByUuid.uuid;
select idName from test_customer_iv iv where iv.uuid = test_customerIdNameByUuid.uuid;
$$;
--//
-- ============================================================================
--changeset hs-customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
--changeset test-customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the customer main table with row-level limitation
based on the 'view' permission of the current user or assumed roles.
*/
set session session authorization default;
drop view if exists customer_rv;
create or replace view customer_rv as
drop view if exists test_customer_rv;
create or replace view test_customer_rv as
select target.*
from customer as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'customer', currentSubjectsUuids()));
grant all privileges on customer_rv to restricted;
from test_customer as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'test_customer', currentSubjectsUuids()));
grant all privileges on test_customer_rv to restricted;
--//
-- ============================================================================
--changeset hs-customer-rbac-ADD-CUSTOMER:1 endDelimiter:--//
--changeset test-customer-rbac-ADD-CUSTOMER:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a global permission for add-customer and assigns it to the hostsharing admins role.
*/
do language plpgsql $$
declare
addCustomerPermissions uuid[];
hostsharingObjectUuid uuid;
hsAdminRoleUuid uuid ;
addCustomerPermissions uuid[];
globalObjectUuid uuid;
globalAdminRoleUuid uuid ;
begin
call defineContext('granting global add-customer permission to Hostsharing admin role', null, null, null);
call defineContext('granting global add-customer permission to global admin role', null, null, null);
hsAdminRoleUuid := findRoleId(hostsharingAdmin());
hostsharingObjectUuid := (select uuid from global);
addCustomerPermissions := createPermissions(hostsharingObjectUuid, array ['add-customer']);
call grantPermissionsToRole(hsAdminRoleUuid, addCustomerPermissions);
globalAdminRoleUuid := findRoleId(testGlobalAdmin());
globalObjectUuid := (select uuid from global);
addCustomerPermissions := createPermissions(globalObjectUuid, array ['add-customer']);
call grantPermissionsToRole(globalAdminRoleUuid, addCustomerPermissions);
end;
$$;
/**
Used by the trigger to prevent the add-customer to current user respectively assumed roles.
*/
create or replace function addCustomerNotAllowedForCurrentSubjects()
create or replace function addTestCustomerNotAllowedForCurrentSubjects()
returns trigger
language PLPGSQL
as $$
@ -230,11 +230,11 @@ end; $$;
/**
Checks if the user or assumed roles are allowed to add a new customer.
*/
create trigger customer_insert_trigger
create trigger test_customer_insert_trigger
before insert
on customer
on test_customer
for each row
when ( currentUser() <> 'mike@hostsharing.net' or not hasGlobalPermission('add-customer') )
execute procedure addCustomerNotAllowedForCurrentSubjects();
when ( currentUser() <> 'mike@example.org' or not hasGlobalPermission('add-customer') )
execute procedure addTestCustomerNotAllowedForCurrentSubjects();
--//

View File

@ -2,7 +2,7 @@
-- ============================================================================
--changeset hs-customer-TEST-DATA-GENERATOR:1 endDelimiter:--//
--changeset test-customer-TEST-DATA-GENERATOR:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Generates a customer reference number for a given test data counter.
@ -19,7 +19,7 @@ end; $$;
/*
Creates a single customer test record with dist.
*/
create or replace procedure createCustomerTestData(
create or replace procedure createTestCustomerTestData(
custReference integer,
custPrefix varchar
)
@ -30,7 +30,7 @@ declare
custAdminName varchar;
begin
currentTask = 'creating RBAC test customer #' || custReference || '/' || custPrefix;
call defineContext(currentTask, null, 'mike@hostsharing.net', 'global#hostsharing.admin');
call defineContext(currentTask, null, 'mike@example.org', 'global#test-global.admin');
execute format('set local hsadminng.currentTask to %L', currentTask);
custRowId = uuid_generate_v4();
@ -38,7 +38,7 @@ begin
raise notice 'creating customer %:%', custReference, custPrefix;
insert
into customer (reference, prefix, adminUserName)
into test_customer (reference, prefix, adminUserName)
values (custReference, custPrefix, custAdminName);
end; $$;
--//
@ -46,7 +46,7 @@ end; $$;
/*
Creates a range of test customers for mass data generation.
*/
create or replace procedure createCustomerTestData(
create or replace procedure createTestCustomerTestData(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
@ -54,7 +54,7 @@ create or replace procedure createCustomerTestData(
begin
for t in startCount..endCount
loop
call createCustomerTestData(testCustomerReference(t), intToVarChar(t, 3));
call createTestCustomerTestData(testCustomerReference(t), intToVarChar(t, 3));
commit;
end loop;
end; $$;
@ -62,14 +62,14 @@ end; $$;
-- ============================================================================
--changeset hs-customer-TEST-DATA-GENERATION:1 context=dev,tc endDelimiter:--//
--changeset test-customer-TEST-DATA-GENERATION:1 context=dev,tc endDelimiter:--//
-- ----------------------------------------------------------------------------
do language plpgsql $$
begin
call createCustomerTestData(99901, 'xxx');
call createCustomerTestData(99902, 'yyy');
call createCustomerTestData(99903, 'zzz');
call createTestCustomerTestData(99901, 'xxx');
call createTestCustomerTestData(99902, 'yyy');
call createTestCustomerTestData(99903, 'zzz');
end;
$$;
--//

View File

@ -1,14 +1,14 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-package-MAIN-TABLE:1 endDelimiter:--//
--changeset test-package-MAIN-TABLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists package
create table if not exists test_package
(
uuid uuid unique references RbacObject (uuid),
version int not null default 0,
customerUuid uuid references customer (uuid),
customerUuid uuid references test_customer (uuid),
name varchar(5),
description varchar(96)
);

View File

@ -1,62 +1,62 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
--changeset test-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
*/
drop trigger if exists createRbacObjectForPackage_Trigger on package;
drop trigger if exists createRbacObjectForPackage_Trigger on test_package;
create trigger createRbacObjectForPackage_Trigger
before insert
on package
on test_package
for each row
execute procedure createRbacObject();
--//
-- ============================================================================
--changeset hs-package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
--changeset test-package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function packageOwner(pac package)
create or replace function testPackageOwner(pac test_package)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('package', pac.uuid, 'owner');
return roleDescriptor('test_package', pac.uuid, 'owner');
end; $$;
create or replace function packageAdmin(pac package)
create or replace function testPackageAdmin(pac test_package)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('package', pac.uuid, 'admin');
return roleDescriptor('test_package', pac.uuid, 'admin');
end; $$;
create or replace function packageTenant(pac package)
create or replace function testPackageTenant(pac test_package)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('package', pac.uuid, 'tenant');
return roleDescriptor('test_package', pac.uuid, 'tenant');
end; $$;
--//
-- ============================================================================
--changeset hs-package-rbac-ROLES-CREATION:1 endDelimiter:--//
--changeset test-package-rbac-ROLES-CREATION:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles and their assignments for a new package for the AFTER INSERT TRIGGER.
*/
create or replace function createRbacRolesForPackage()
create or replace function createRbacRolesForTestPackage()
returns trigger
language plpgsql
strict as $$
declare
parentCustomer customer;
parentCustomer test_customer;
packageOwnerRoleUuid uuid;
packageAdminRoleUuid uuid;
begin
@ -64,28 +64,28 @@ begin
raise exception 'invalid usage of TRIGGER AFTER INSERT';
end if;
select * from customer as c where c.uuid = NEW.customerUuid into parentCustomer;
select * from test_customer as c where c.uuid = NEW.customerUuid into parentCustomer;
-- an owner role is created and assigned to the customer's admin role
packageOwnerRoleUuid = createRole(
packageOwner(NEW),
testPackageOwner(NEW),
withoutPermissions(),
beneathRole(customerAdmin(parentCustomer))
beneathRole(testCustomerAdmin(parentCustomer))
);
-- an owner role is created and assigned to the package owner role
packageAdminRoleUuid = createRole(
packageAdmin(NEW),
testPackageAdmin(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['add-unixuser', 'add-domain']),
beneathRole(packageOwnerRoleUuid)
);
-- and a package tenant role is created and assigned to the package admin as well
perform createRole(
packageTenant(NEW),
testPackageTenant(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view']),
beneathRole(packageAdminRoleUuid),
beingItselfA(customerTenant(parentCustomer))
beingItselfA(testCustomerTenant(parentCustomer))
);
return NEW;
@ -95,31 +95,31 @@ end; $$;
An AFTER INSERT TRIGGER which creates the role structure for a new package.
*/
drop trigger if exists createRbacRolesForPackage_Trigger on package;
create trigger createRbacRolesForPackage_Trigger
drop trigger if exists createRbacRolesForTestPackage_Trigger on test_package;
create trigger createRbacRolesForTestPackage_Trigger
after insert
on package
on test_package
for each row
execute procedure createRbacRolesForPackage();
execute procedure createRbacRolesForTestPackage();
--//
-- ============================================================================
--changeset hs-package-rbac-ROLES-REMOVAL:1 endDelimiter:--//
--changeset test-package-rbac-ROLES-REMOVAL:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Deletes the roles and their assignments of a deleted package for the BEFORE DELETE TRIGGER.
*/
create or replace function deleteRbacRulesForPackage()
create or replace function deleteRbacRulesForTestPackage()
returns trigger
language plpgsql
strict as $$
begin
if TG_OP = 'DELETE' then
call deleteRole(findRoleId(packageOwner(OLD)));
call deleteRole(findRoleId(packageAdmin(OLD)));
call deleteRole(findRoleId(packageTenant(OLD)));
call deleteRole(findRoleId(testPackageOwner(OLD)));
call deleteRole(findRoleId(testPackageAdmin(OLD)));
call deleteRole(findRoleId(testPackageTenant(OLD)));
else
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
end if;
@ -129,66 +129,66 @@ end; $$;
An BEFORE DELETE TRIGGER which deletes the role structure of a package.
*/
drop trigger if exists deleteRbacRulesForPackage_Trigger on package;
create trigger deleteRbacRulesForPackage_Trigger
drop trigger if exists deleteRbacRulesForTestPackage_Trigger on test_package;
create trigger deleteRbacRulesForTestPackage_Trigger
before delete
on package
on test_package
for each row
execute procedure deleteRbacRulesForPackage();
execute procedure deleteRbacRulesForTestPackage();
--//
-- ============================================================================
--changeset hs-package-rbac-IDENTITY-VIEW:1 endDelimiter:--//
--changeset test-package-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the package main table which maps the identifying name
(in this case, actually the column `name`) to the objectUuid.
*/
drop view if exists package_iv;
create or replace view package_iv as
drop view if exists test_package_iv;
create or replace view test_package_iv as
select distinct target.uuid, target.name as idName
from package as target;
from test_package as target;
-- TODO: Is it ok that everybody has access to this information?
grant all privileges on package_iv to restricted;
grant all privileges on test_package_iv to restricted;
/*
Returns the objectUuid for a given identifying name (in this case, actually the column `name`).
*/
create or replace function packageUuidByIdName(idName varchar)
create or replace function test_packageUuidByIdName(idName varchar)
returns uuid
language sql
strict as $$
select uuid from package_iv iv where iv.idName = packageUuidByIdName.idName;
select uuid from test_package_iv iv where iv.idName = test_packageUuidByIdName.idName;
$$;
/*
Returns the identifying name for a given objectUuid (in this case the name).
*/
create or replace function packageIdNameByUuid(uuid uuid)
create or replace function test_packageIdNameByUuid(uuid uuid)
returns varchar
stable leakproof
language sql
strict as $$
select idName from package_iv iv where iv.uuid = packageIdNameByUuid.uuid;
select idName from test_package_iv iv where iv.uuid = test_packageIdNameByUuid.uuid;
$$;
--//
-- ============================================================================
--changeset hs-package-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
--changeset test-package-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the customer main table which maps the identifying name
(in this case, the prefix) to the objectUuid.
*/
drop view if exists package_rv;
create or replace view package_rv as
drop view if exists test_package_rv;
create or replace view test_package_rv as
select target.*
from package as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'package', currentSubjectsUuids()))
from test_package as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'test_package', currentSubjectsUuids()))
order by target.name;
grant all privileges on package_rv to restricted;
grant all privileges on test_package_rv to restricted;
--//

View File

@ -1,7 +1,7 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-package-TEST-DATA-GENERATOR:1 endDelimiter:--//
--changeset test-package-TEST-DATA-GENERATOR:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the given number of test packages for the given customer.
@ -9,14 +9,14 @@
create or replace procedure createPackageTestData(customerPrefix varchar, pacCount int)
language plpgsql as $$
declare
cust customer;
cust test_customer;
custAdminUser varchar;
custAdminRole varchar;
pacName varchar;
currentTask varchar;
pac package;
pac test_package;
begin
select * from customer where customer.prefix = customerPrefix into cust;
select * from test_customer where test_customer.prefix = customerPrefix into cust;
for t in 0..(pacCount-1)
loop
@ -25,18 +25,18 @@ begin
cust.uuid;
custAdminUser = 'customer-admin@' || cust.prefix || '.example.com';
custAdminRole = 'customer#' || cust.prefix || '.admin';
custAdminRole = 'test_customer#' || cust.prefix || '.admin';
call defineContext(currentTask, null, custAdminUser, custAdminRole);
raise notice 'task: % by % as %', currentTask, custAdminUser, custAdminRole;
insert
into package (customerUuid, name, description)
into test_package (customerUuid, name, description)
values (cust.uuid, pacName, 'Here can add your own description of package ' || pacName || '.')
returning * into pac;
call grantRoleToUser(
getRoleId(customerAdmin(cust), 'fail'),
findRoleId(packageAdmin(pac)),
getRoleId(testCustomerAdmin(cust), 'fail'),
findRoleId(testPackageAdmin(pac)),
createRbacUser('pac-admin-' || pacName || '@' || cust.prefix || '.example.com'),
true);
@ -49,9 +49,9 @@ end; $$;
create or replace procedure createPackageTestData()
language plpgsql as $$
declare
cust customer;
cust test_customer;
begin
for cust in (select * from customer)
for cust in (select * from test_customer)
loop
continue when cust.reference >= 90000; -- reserved for functional testing
call createPackageTestData(cust.prefix, 3);
@ -64,7 +64,7 @@ $$;
-- ============================================================================
--changeset hs-package-TEST-DATA-GENERATION:1 context=dev,tc endDelimiter:--//
--changeset test-package-TEST-DATA-GENERATION:1 context=dev,tc endDelimiter:--//
-- ----------------------------------------------------------------------------
do language plpgsql $$

View File

@ -4,10 +4,10 @@
--changeset hs-unixuser-MAIN-TABLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists UnixUser
create table if not exists test_unixuser
(
uuid uuid unique references RbacObject (uuid),
packageUuid uuid references package (uuid),
packageUuid uuid references test_package (uuid),
name character varying(32),
description character varying(96)
);

View File

@ -1,49 +1,49 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
--changeset test-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
*/
drop trigger if exists createRbacObjectForUnixUser_Trigger on UnixUser;
create trigger createRbacObjectForUnixUser_Trigger
drop trigger if exists createRbacObjectFortest_unixuser_Trigger on test_unixuser;
create trigger createRbacObjectFortest_unixuser_Trigger
before insert
on UnixUser
on test_unixuser
for each row
execute procedure createRbacObject();
--//
-- ============================================================================
--changeset hs-unixuser-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
--changeset test-unixuser-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function unixUserOwner(uu UnixUser)
create or replace function testUnixUserOwner(uu test_unixuser)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('unixuser', uu.uuid, 'owner');
return roleDescriptor('test_unixuser', uu.uuid, 'owner');
end; $$;
create or replace function unixUserAdmin(uu UnixUser)
create or replace function testUnixUserAdmin(uu test_unixuser)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('unixuser', uu.uuid, 'admin');
return roleDescriptor('test_unixuser', uu.uuid, 'admin');
end; $$;
create or replace function unixUserTenant(uu UnixUser)
create or replace function testUnixUserTenant(uu test_unixuser)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('unixuser', uu.uuid, 'tenant');
return roleDescriptor('test_unixuser', uu.uuid, 'tenant');
end; $$;
create or replace function createUnixUserTenantRoleIfNotExists(unixUser UnixUser)
create or replace function createTestUnixUserTenantRoleIfNotExists(unixUser test_unixuser)
returns uuid
returns null on null input
language plpgsql as $$
@ -51,7 +51,7 @@ declare
unixUserTenantRoleDesc RbacRoleDescriptor;
unixUserTenantRoleUuid uuid;
begin
unixUserTenantRoleDesc = unixUserTenant(unixUser);