use customer/package/unixuser only as test data structure (DB part)
This commit is contained in:
parent
817c1a9e58
commit
a33cb4ec29
10
README.md
10
README.md
@ -65,22 +65,22 @@ If you have at least Docker, the Java JDK and Gradle installed in appropriate ve
|
||||
|
||||
# the following command should return a JSON array with just all customers:
|
||||
curl \
|
||||
-H 'current-user: mike@hostsharing.net' \
|
||||
-H 'current-user: mike@example.org' \
|
||||
http://localhost:8080/api/customers
|
||||
|
||||
# the following command should return a JSON array with just all packages visible for the admin of the customer yyy:
|
||||
curl \
|
||||
-H 'current-user: mike@hostsharing.net' -H 'assumed-roles: customer#yyy.admin' \
|
||||
-H 'current-user: mike@example.org' -H 'assumed-roles: test_customer#yyy.admin' \
|
||||
http://localhost:8080/api/packages
|
||||
|
||||
# add a new customer
|
||||
curl \
|
||||
-H 'current-user: mike@hostsharing.net' -H "Content-Type: application/json" \
|
||||
-H 'current-user: mike@example.org' -H "Content-Type: application/json" \
|
||||
-d '{ "prefix":"ttt", "reference":80001, "adminUserName":"admin@ttt.example.com" }' \
|
||||
-X POST http://localhost:8080/api/customers
|
||||
|
||||
If you wonder who 'mike@hostsharing.net' and 'sven@hostsharing.net' are and where the data comes from:
|
||||
Mike and Sven are just example Hostsharing hostmaster accounts as part of the example data which is automatically inserted in Testcontainers and Development environments.
|
||||
If you wonder who 'mike@example.org' and 'sven@example.org' are and where the data comes from:
|
||||
Mike and Sven are just example global admin accounts as part of the example data which is automatically inserted in Testcontainers and Development environments.
|
||||
Also try for example 'admin@xxx.example.com' or 'unknown@example.org'.
|
||||
|
||||
If you want a formatted JSON output, you can pipe the result to `jq` or similar.
|
||||
|
@ -64,7 +64,7 @@ begin
|
||||
domainOwnerRoleUuid = createRole(
|
||||
domainOwner(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
|
||||
beneathRole(packageAdmin(parentPackage))
|
||||
beneathRole(testPackageAdmin(parentPackage))
|
||||
);
|
||||
|
||||
-- a domain admin role is created and assigned to the domain's owner role
|
||||
|
@ -17,21 +17,21 @@ BEGIN
|
||||
|
||||
-- hostmaster accessing a single customer
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = '';
|
||||
-- SELECT *
|
||||
SELECT count(*) INTO resultCount
|
||||
from customer_rv c
|
||||
from test_customer_rv c
|
||||
where c.prefix='aab';
|
||||
call expectBetween(resultCount, 1, 1);
|
||||
|
||||
-- hostmaster listing all customers
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = '';
|
||||
-- SELECT *
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM customer_rv;
|
||||
FROM test_customer_rv;
|
||||
call expectBetween(resultCount, 10, 20000);
|
||||
|
||||
-- customer admin listing all their packages
|
||||
@ -40,7 +40,7 @@ BEGIN
|
||||
SET LOCAL hsadminng.assumedRoles = '';
|
||||
-- SELECT *
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM package_rv;
|
||||
FROM test_package_rv;
|
||||
call expectBetween(resultCount, 2, 10);
|
||||
|
||||
-- cutomer admin listing all their unix users
|
||||
@ -54,49 +54,49 @@ BEGIN
|
||||
|
||||
-- hostsharing admin assuming customer role and listing all accessible packages
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.assumedRoles = 'customer#aaa.admin;customer#aab.admin';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = 'test_customer#aaa.admin;test_customer#aab.admin';
|
||||
-- SELECT *
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM package_rv p;
|
||||
FROM test_package_rv p;
|
||||
call expectBetween(resultCount, 2, 10);
|
||||
|
||||
-- hostsharing admin assuming two customer admin roles and listing all accessible unixusers
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.assumedRoles = 'customer#aab.admin;customer#aac.admin';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = 'test_customer#aab.admin;test_customer#aac.admin';
|
||||
-- SELECT c.prefix, c.reference, uu.*
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM unixuser_rv uu
|
||||
JOIN package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN customer_rv c ON c.uuid = p.customeruuid;
|
||||
JOIN test_package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
|
||||
call expectBetween(resultCount, 40, 60);
|
||||
|
||||
-- hostsharing admin assuming two customer admin roles and listing all accessible domains
|
||||
-- ABORT; START TRANSACTION;
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.assumedRoles = 'customer#aac.admin;customer#aad.admin';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = 'test_customer#aac.admin;test_customer#aad.admin';
|
||||
-- SELECT p.name, uu.name, dom.name
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM domain_rv dom
|
||||
JOIN unixuser_rv uu ON uu.uuid = dom.unixuseruuid
|
||||
JOIN package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN customer_rv c ON c.uuid = p.customeruuid;
|
||||
JOIN test_package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
|
||||
call expectBetween(resultCount, 20, 40);
|
||||
|
||||
-- hostsharing admin assuming two customer admin roles and listing all accessible email addresses
|
||||
-- ABORT; START TRANSACTION;
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
SET LOCAL hsadminng.currentUser = 'mike@hostsharing.net';
|
||||
SET LOCAL hsadminng.assumedRoles = 'customer#aae.admin;customer#aaf.admin';
|
||||
SET LOCAL hsadminng.currentUser = 'mike@example.org';
|
||||
SET LOCAL hsadminng.assumedRoles = 'test_customer#aae.admin;test_customer#aaf.admin';
|
||||
-- SELECT c.prefix, p.name as "package", ema.localPart || '@' || dom.name as "email-address"
|
||||
SELECT count(*) INTO resultCount
|
||||
FROM emailaddress_rv ema
|
||||
JOIN domain_rv dom ON dom.uuid = ema.domainuuid
|
||||
JOIN unixuser_rv uu ON uu.uuid = dom.unixuseruuid
|
||||
JOIN package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN customer_rv c ON c.uuid = p.customeruuid;
|
||||
JOIN test_package_rv p ON p.uuid = uu.packageuuid
|
||||
JOIN test_customer_rv c ON c.uuid = p.customeruuid;
|
||||
call expectBetween(resultCount, 100, 300);
|
||||
|
||||
-- ~170ms
|
||||
|
@ -3,16 +3,16 @@
|
||||
-- --------------------------------------------------------
|
||||
|
||||
|
||||
select isGranted(findRoleId('administrators'), findRoleId('package#aaa00.owner'));
|
||||
select isGranted(findRoleId('package#aaa00.owner'), findRoleId('administrators'));
|
||||
-- call grantRoleToRole(findRoleId('package#aaa00.owner'), findRoleId('administrators'));
|
||||
-- call grantRoleToRole(findRoleId('administrators'), findRoleId('package#aaa00.owner'));
|
||||
select isGranted(findRoleId('administrators'), findRoleId('test_package#aaa00.owner'));
|
||||
select isGranted(findRoleId('test_package#aaa00.owner'), findRoleId('administrators'));
|
||||
-- call grantRoleToRole(findRoleId('test_package#aaa00.owner'), findRoleId('administrators'));
|
||||
-- call grantRoleToRole(findRoleId('administrators'), findRoleId('test_package#aaa00.owner'));
|
||||
|
||||
select count(*)
|
||||
FROM queryAllPermissionsOfSubjectIdForObjectUuids(findRbacUser('sven@hostsharing.net'),
|
||||
FROM queryAllPermissionsOfSubjectIdForObjectUuids(findRbacUser('sven@example.org'),
|
||||
ARRAY(select uuid from customer where reference < 1100000));
|
||||
select count(*)
|
||||
FROM queryAllPermissionsOfSubjectId(findRbacUser('sven@hostsharing.net'));
|
||||
FROM queryAllPermissionsOfSubjectId(findRbacUser('sven@example.org'));
|
||||
select *
|
||||
FROM queryAllPermissionsOfSubjectId(findRbacUser('alex@example.com'));
|
||||
select *
|
||||
@ -33,7 +33,7 @@ $$
|
||||
userId uuid;
|
||||
result bool;
|
||||
BEGIN
|
||||
userId = findRbacUser('mike@hostsharing.net');
|
||||
userId = findRbacUser('mike@example.org');
|
||||
result = (SELECT * FROM isPermissionGrantedToSubject(findPermissionId('package', 94928, 'add-package'), userId));
|
||||
IF (result) THEN
|
||||
RAISE EXCEPTION 'expected permission NOT to be granted, but it is';
|
||||
|
@ -20,7 +20,7 @@ CREATE POLICY customer_policy ON customer
|
||||
TO restricted
|
||||
USING (
|
||||
-- id=1000
|
||||
isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid())
|
||||
isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid())
|
||||
);
|
||||
|
||||
SET SESSION AUTHORIZATION restricted;
|
||||
@ -35,10 +35,10 @@ SELECT * FROM customer;
|
||||
CREATE OR REPLACE RULE "_RETURN" AS
|
||||
ON SELECT TO cust_view
|
||||
DO INSTEAD
|
||||
SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid());
|
||||
SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid());
|
||||
SELECT * from cust_view LIMIT 10;
|
||||
|
||||
select queryAllPermissionsOfSubjectId(findRbacUser('mike@hostsharing.net'));
|
||||
select queryAllPermissionsOfSubjectId(findRbacUser('mike@example.org'));
|
||||
|
||||
-- access control via view-rule with join to recursive permissions - really fast (38ms for 1 million rows)
|
||||
SET SESSION SESSION AUTHORIZATION DEFAULT;
|
||||
@ -52,7 +52,7 @@ CREATE OR REPLACE RULE "_RETURN" AS
|
||||
DO INSTEAD
|
||||
SELECT c.uuid, c.reference, c.prefix FROM customer AS c
|
||||
JOIN queryAllPermissionsOfSubjectId(currentUserUuid()) AS p
|
||||
ON p.objectTable='customer' AND p.objectUuid=c.uuid AND p.op in ('*', 'view');
|
||||
ON p.objectTable='test_customer' AND p.objectUuid=c.uuid AND p.op in ('*', 'view');
|
||||
GRANT ALL PRIVILEGES ON cust_view TO restricted;
|
||||
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
@ -73,7 +73,7 @@ GRANT ALL PRIVILEGES ON cust_view TO restricted;
|
||||
|
||||
SET SESSION SESSION AUTHORIZATION restricted;
|
||||
-- SET hsadminng.currentUser TO 'alex@example.com';
|
||||
SET hsadminng.currentUser TO 'mike@hostsharing.net';
|
||||
SET hsadminng.currentUser TO 'mike@example.org';
|
||||
-- SET hsadminng.currentUser TO 'aaaaouq@example.com';
|
||||
SELECT * from cust_view where reference=1144150;
|
||||
|
||||
@ -81,9 +81,9 @@ select rr.uuid, rr.type from RbacGrants g
|
||||
join RbacReference RR on g.ascendantUuid = RR.uuid
|
||||
where g.descendantUuid in (
|
||||
select uuid from queryAllPermissionsOfSubjectId(findRbacUser('alex@example.com'))
|
||||
where objectTable='customer' and op in ('*', 'view'));
|
||||
where objectTable='test_customer' and op in ('*', 'view'));
|
||||
|
||||
call grantRoleToUser(findRoleId('customer#aaa.admin'), findRbacUser('aaaaouq@example.com'));
|
||||
call grantRoleToUser(findRoleId('test_customer#aaa.admin'), findRbacUser('aaaaouq@example.com'));
|
||||
|
||||
select queryAllPermissionsOfSubjectId(findRbacUser('aaaaouq@example.com'));
|
||||
|
||||
|
@ -9,7 +9,7 @@ import javax.persistence.*;
|
||||
import java.util.UUID;
|
||||
|
||||
@Entity
|
||||
@Table(name = "customer_rv")
|
||||
@Table(name = "test_customer_rv")
|
||||
@Getter
|
||||
@Setter
|
||||
@NoArgsConstructor
|
||||
|
@ -10,7 +10,7 @@ import javax.persistence.*;
|
||||
import java.util.UUID;
|
||||
|
||||
@Entity
|
||||
@Table(name = "package_rv")
|
||||
@Table(name = "test_package_rv")
|
||||
@Getter
|
||||
@Setter
|
||||
@NoArgsConstructor
|
||||
|
@ -152,8 +152,14 @@ create or replace function pureIdentifier(rawIdentifier varchar)
|
||||
returns varchar
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
declare
|
||||
cleanIdentifier varchar;
|
||||
begin
|
||||
return regexp_replace(rawIdentifier, '\W+', '');
|
||||
cleanIdentifier := regexp_replace(rawIdentifier, '[^A-Za-z0-9\-._]+', '', 'g');
|
||||
if cleanIdentifier != rawIdentifier then
|
||||
raise exception 'identifier "%" contains invalid characters, maybe use "%"', rawIdentifier, cleanIdentifier;
|
||||
end if;
|
||||
return cleanIdentifier;
|
||||
end; $$;
|
||||
|
||||
create or replace function findObjectUuidByIdName(objectTable varchar, objectIdName varchar)
|
||||
|
@ -228,6 +228,9 @@ begin
|
||||
roleTypeFromRoleIdName = split_part(roleParts, '#', 3);
|
||||
objectUuidOfRole = findObjectUuidByIdName(objectTableFromRoleIdName, objectNameFromRoleIdName);
|
||||
|
||||
raise notice $sql$findObjectUuidByIdName('%', '%') = %;$sql$, objectTableFromRoleIdName, objectNameFromRoleIdName, objectUuidOfRole;
|
||||
raise notice 'finding %, % (%), %', objectTableFromRoleIdName, objectNameFromRoleIdName, objectUuidOfRole, roleTypeFromRoleIdName;
|
||||
|
||||
select uuid
|
||||
from RbacRole
|
||||
where objectUuid = objectUuidOfRole
|
||||
|
@ -1,7 +1,7 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-base-GLOBAL-OBJECT:1 endDelimiter:--//
|
||||
--changeset test-base-GLOBAL-OBJECT:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/**
|
||||
@ -12,32 +12,32 @@ begin transaction;
|
||||
insert
|
||||
into RbacObject (objecttable) values ('global');
|
||||
insert
|
||||
into Global (uuid, name) values ((select uuid from RbacObject where objectTable = 'global'), 'hostsharing');
|
||||
into Global (uuid, name) values ((select uuid from RbacObject where objectTable = 'global'), 'test-global');
|
||||
commit;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-base-ADMIN-ROLE:1 endDelimiter:--//
|
||||
--changeset test-base-ADMIN-ROLE:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
A global administrator role.
|
||||
*/
|
||||
create or replace function hostsharingAdmin()
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
create or replace function testGlobalAdmin()
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
stable leakproof
|
||||
language sql as $$
|
||||
select 'global', (select uuid from RbacObject where objectTable = 'global'), 'admin'::RbacRoleType;
|
||||
$$;
|
||||
|
||||
begin transaction;
|
||||
call defineContext('creating Hostsharing admin role', null, null, null);
|
||||
select createRole(hostsharingAdmin());
|
||||
call defineContext('creating test-global admin role', null, null, null);
|
||||
select createRole(testGlobalAdmin());
|
||||
commit;
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-base-ADMIN-USERS:1 context:dev,tc endDelimiter:--//
|
||||
--changeset test-base-ADMIN-USERS:1 context:dev,tc endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Create two users and assign both to the administrators role.
|
||||
@ -46,18 +46,18 @@ do language plpgsql $$
|
||||
declare
|
||||
admins uuid ;
|
||||
begin
|
||||
call defineContext('creating fake Hostsharing admin users', null, null, null);
|
||||
call defineContext('creating fake test-realm admin users', null, null, null);
|
||||
|
||||
admins = findRoleId(hostsharingAdmin());
|
||||
call grantRoleToUserUnchecked(admins, admins, createRbacUser('mike@hostsharing.net'));
|
||||
call grantRoleToUserUnchecked(admins, admins, createRbacUser('sven@hostsharing.net'));
|
||||
admins = findRoleId(testGlobalAdmin());
|
||||
call grantRoleToUserUnchecked(admins, admins, createRbacUser('mike@example.org'));
|
||||
call grantRoleToUserUnchecked(admins, admins, createRbacUser('sven@example.org'));
|
||||
end;
|
||||
$$;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-base-hostsharing-TEST:1 context:dev,tc runAlways:true endDelimiter:--//
|
||||
--changeset test-base-hostsharing-TEST:1 context:dev,tc runAlways:true endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
@ -68,15 +68,15 @@ do language plpgsql $$
|
||||
declare
|
||||
userName varchar;
|
||||
begin
|
||||
call defineContext('testing currentUserUuid', null, 'sven@hostsharing.net', null);
|
||||
call defineContext('testing currentUserUuid', null, 'sven@example.org', null);
|
||||
select userName from RbacUser where uuid = currentUserUuid() into userName;
|
||||
if userName <> 'sven@hostsharing.net' then
|
||||
if userName <> 'sven@example.org' then
|
||||
raise exception 'setting or fetching initial currentUser failed, got: %', userName;
|
||||
end if;
|
||||
|
||||
call defineContext('testing currentUserUuid', null, 'mike@hostsharing.net', null);
|
||||
call defineContext('testing currentUserUuid', null, 'mike@example.org', null);
|
||||
select userName from RbacUser where uuid = currentUserUuid() into userName;
|
||||
if userName = 'mike@hostsharing.net' then
|
||||
if userName = 'mike@example.org' then
|
||||
raise exception 'currentUser should not change in one transaction, but did change, got: %', userName;
|
||||
end if;
|
||||
end; $$;
|
@ -1,10 +1,10 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-MAIN-TABLE:1 endDelimiter:--//
|
||||
--changeset test-customer-MAIN-TABLE:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create table if not exists customer
|
||||
create table if not exists test_customer
|
||||
(
|
||||
uuid uuid unique references RbacObject (uuid),
|
||||
reference int not null unique check (reference between 10000 and 99999),
|
@ -1,64 +1,64 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
|
||||
*/
|
||||
drop trigger if exists createRbacObjectForCustomer_Trigger on customer;
|
||||
drop trigger if exists createRbacObjectForCustomer_Trigger on test_customer;
|
||||
create trigger createRbacObjectForCustomer_Trigger
|
||||
before insert
|
||||
on customer
|
||||
on test_customer
|
||||
for each row
|
||||
execute procedure createRbacObject();
|
||||
--//
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create or replace function customerOwner(customer customer)
|
||||
create or replace function testCustomerOwner(customer test_customer)
|
||||
returns RbacRoleDescriptor
|
||||
language plpgsql
|
||||
strict as $$
|
||||
begin
|
||||
return roleDescriptor('customer', customer.uuid, 'owner');
|
||||
return roleDescriptor('test_customer', customer.uuid, 'owner');
|
||||
end; $$;
|
||||
|
||||
create or replace function customerAdmin(customer customer)
|
||||
create or replace function testCustomerAdmin(customer test_customer)
|
||||
returns RbacRoleDescriptor
|
||||
language plpgsql
|
||||
strict as $$
|
||||
begin
|
||||
return roleDescriptor('customer', customer.uuid, 'admin');
|
||||
return roleDescriptor('test_customer', customer.uuid, 'admin');
|
||||
end; $$;
|
||||
|
||||
create or replace function customerTenant(customer customer)
|
||||
create or replace function testCustomerTenant(customer test_customer)
|
||||
returns RbacRoleDescriptor
|
||||
language plpgsql
|
||||
strict as $$
|
||||
begin
|
||||
return roleDescriptor('customer', customer.uuid, 'tenant');
|
||||
return roleDescriptor('test_customer', customer.uuid, 'tenant');
|
||||
end; $$;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-ROLES-CREATION:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-ROLES-CREATION:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Creates the roles and their assignments for a new customer for the AFTER INSERT TRIGGER.
|
||||
*/
|
||||
|
||||
create or replace function createRbacRolesForCustomer()
|
||||
create or replace function createRbacRolesForTestCustomer()
|
||||
returns trigger
|
||||
language plpgsql
|
||||
strict as $$
|
||||
declare
|
||||
customerOwnerUuid uuid;
|
||||
testCustomerOwnerUuid uuid;
|
||||
customerAdminUuid uuid;
|
||||
begin
|
||||
if TG_OP <> 'INSERT' then
|
||||
@ -66,27 +66,27 @@ begin
|
||||
end if;
|
||||
|
||||
-- the owner role with full access for Hostsharing administrators
|
||||
customerOwnerUuid = createRole(
|
||||
customerOwner(NEW),
|
||||
testCustomerOwnerUuid = createRole(
|
||||
testCustomerOwner(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
|
||||
beneathRole(hostsharingAdmin())
|
||||
beneathRole(testGlobalAdmin())
|
||||
);
|
||||
|
||||
-- the admin role for the customer's admins, who can view and add products
|
||||
customerAdminUuid = createRole(
|
||||
customerAdmin(NEW),
|
||||
testCustomerAdmin(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view', 'add-package']),
|
||||
-- NO auto assume for customer owner to avoid exploding permissions for administrators
|
||||
withUser(NEW.adminUserName, 'create'), -- implicitly ignored if null
|
||||
grantedByRole(hostsharingAdmin())
|
||||
grantedByRole(testGlobalAdmin())
|
||||
);
|
||||
|
||||
-- allow the customer owner role (thus administrators) to assume the customer admin role
|
||||
call grantRoleToRole(customerAdminUuid, customerOwnerUuid, false);
|
||||
call grantRoleToRole(customerAdminUuid, testCustomerOwnerUuid, false);
|
||||
|
||||
-- the tenant role which later can be used by owners+admins of sub-objects
|
||||
perform createRole(
|
||||
customerTenant(NEW),
|
||||
testCustomerTenant(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view'])
|
||||
);
|
||||
|
||||
@ -97,32 +97,32 @@ end; $$;
|
||||
An AFTER INSERT TRIGGER which creates the role structure for a new customer.
|
||||
*/
|
||||
|
||||
drop trigger if exists createRbacRolesForCustomer_Trigger on customer;
|
||||
create trigger createRbacRolesForCustomer_Trigger
|
||||
drop trigger if exists createRbacRolesForTestCustomer_Trigger on test_customer;
|
||||
create trigger createRbacRolesForTestCustomer_Trigger
|
||||
after insert
|
||||
on customer
|
||||
on test_customer
|
||||
for each row
|
||||
execute procedure createRbacRolesForCustomer();
|
||||
execute procedure createRbacRolesForTestCustomer();
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-ROLES-REMOVAL:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-ROLES-REMOVAL:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Deletes the roles and their assignments of a deleted customer for the BEFORE DELETE TRIGGER.
|
||||
*/
|
||||
|
||||
create or replace function deleteRbacRulesForCustomer()
|
||||
create or replace function deleteRbacRulesForTestCustomer()
|
||||
returns trigger
|
||||
language plpgsql
|
||||
strict as $$
|
||||
begin
|
||||
if TG_OP = 'DELETE' then
|
||||
call deleteRole(findRoleId(customerOwner(OLD)));
|
||||
call deleteRole(findRoleId(customerAdmin(OLD)));
|
||||
call deleteRole(findRoleId(customerTenant(OLD)));
|
||||
call deleteRole(findRoleId(testCustomerOwner(OLD)));
|
||||
call deleteRole(findRoleId(testCustomerAdmin(OLD)));
|
||||
call deleteRole(findRoleId(testCustomerTenant(OLD)));
|
||||
else
|
||||
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
|
||||
end if;
|
||||
@ -132,93 +132,93 @@ end; $$;
|
||||
An BEFORE DELETE TRIGGER which deletes the role structure of a customer.
|
||||
*/
|
||||
|
||||
drop trigger if exists deleteRbacRulesForCustomer_Trigger on customer;
|
||||
create trigger deleteRbacRulesForCustomer_Trigger
|
||||
drop trigger if exists deleteRbacRulesForTestCustomer_Trigger on test_customer;
|
||||
create trigger deleteRbacRulesForTestCustomer_Trigger
|
||||
before delete
|
||||
on customer
|
||||
on test_customer
|
||||
for each row
|
||||
execute procedure deleteRbacRulesForCustomer();
|
||||
execute procedure deleteRbacRulesForTestCustomer();
|
||||
--//
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-IDENTITY-VIEW:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-IDENTITY-VIEW:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Creates a view to the customer main table which maps the identifying name
|
||||
(in this case, the prefix) to the objectUuid.
|
||||
*/
|
||||
drop view if exists customer_iv;
|
||||
create or replace view customer_iv as
|
||||
drop view if exists test_customer_iv;
|
||||
create or replace view test_customer_iv as
|
||||
select target.uuid, target.prefix as idName
|
||||
from customer as target;
|
||||
from test_customer as target;
|
||||
-- TODO: Is it ok that everybody has access to this information?
|
||||
grant all privileges on customer_iv to restricted;
|
||||
grant all privileges on test_customer_iv to restricted;
|
||||
|
||||
/*
|
||||
Returns the objectUuid for a given identifying name (in this case the prefix).
|
||||
*/
|
||||
create or replace function customerUuidByIdName(idName varchar)
|
||||
create or replace function test_customerUuidByIdName(idName varchar)
|
||||
returns uuid
|
||||
language sql
|
||||
strict as $$
|
||||
select uuid from customer_iv iv where iv.idName = customerUuidByIdName.idName;
|
||||
select uuid from test_customer_iv iv where iv.idName = test_customerUuidByIdName.idName;
|
||||
$$;
|
||||
|
||||
/*
|
||||
Returns the identifying name for a given objectUuid (in this case the prefix).
|
||||
*/
|
||||
create or replace function customerIdNameByUuid(uuid uuid)
|
||||
create or replace function test_customerIdNameByUuid(uuid uuid)
|
||||
returns varchar
|
||||
language sql
|
||||
strict as $$
|
||||
select idName from customer_iv iv where iv.uuid = customerIdNameByUuid.uuid;
|
||||
select idName from test_customer_iv iv where iv.uuid = test_customerIdNameByUuid.uuid;
|
||||
$$;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates a view to the customer main table with row-level limitation
|
||||
based on the 'view' permission of the current user or assumed roles.
|
||||
*/
|
||||
set session session authorization default;
|
||||
drop view if exists customer_rv;
|
||||
create or replace view customer_rv as
|
||||
drop view if exists test_customer_rv;
|
||||
create or replace view test_customer_rv as
|
||||
select target.*
|
||||
from customer as target
|
||||
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'customer', currentSubjectsUuids()));
|
||||
grant all privileges on customer_rv to restricted;
|
||||
from test_customer as target
|
||||
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'test_customer', currentSubjectsUuids()));
|
||||
grant all privileges on test_customer_rv to restricted;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-rbac-ADD-CUSTOMER:1 endDelimiter:--//
|
||||
--changeset test-customer-rbac-ADD-CUSTOMER:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates a global permission for add-customer and assigns it to the hostsharing admins role.
|
||||
*/
|
||||
do language plpgsql $$
|
||||
declare
|
||||
addCustomerPermissions uuid[];
|
||||
hostsharingObjectUuid uuid;
|
||||
hsAdminRoleUuid uuid ;
|
||||
addCustomerPermissions uuid[];
|
||||
globalObjectUuid uuid;
|
||||
globalAdminRoleUuid uuid ;
|
||||
begin
|
||||
call defineContext('granting global add-customer permission to Hostsharing admin role', null, null, null);
|
||||
call defineContext('granting global add-customer permission to global admin role', null, null, null);
|
||||
|
||||
hsAdminRoleUuid := findRoleId(hostsharingAdmin());
|
||||
hostsharingObjectUuid := (select uuid from global);
|
||||
addCustomerPermissions := createPermissions(hostsharingObjectUuid, array ['add-customer']);
|
||||
call grantPermissionsToRole(hsAdminRoleUuid, addCustomerPermissions);
|
||||
globalAdminRoleUuid := findRoleId(testGlobalAdmin());
|
||||
globalObjectUuid := (select uuid from global);
|
||||
addCustomerPermissions := createPermissions(globalObjectUuid, array ['add-customer']);
|
||||
call grantPermissionsToRole(globalAdminRoleUuid, addCustomerPermissions);
|
||||
end;
|
||||
$$;
|
||||
|
||||
/**
|
||||
Used by the trigger to prevent the add-customer to current user respectively assumed roles.
|
||||
*/
|
||||
create or replace function addCustomerNotAllowedForCurrentSubjects()
|
||||
create or replace function addTestCustomerNotAllowedForCurrentSubjects()
|
||||
returns trigger
|
||||
language PLPGSQL
|
||||
as $$
|
||||
@ -230,11 +230,11 @@ end; $$;
|
||||
/**
|
||||
Checks if the user or assumed roles are allowed to add a new customer.
|
||||
*/
|
||||
create trigger customer_insert_trigger
|
||||
create trigger test_customer_insert_trigger
|
||||
before insert
|
||||
on customer
|
||||
on test_customer
|
||||
for each row
|
||||
when ( currentUser() <> 'mike@hostsharing.net' or not hasGlobalPermission('add-customer') )
|
||||
execute procedure addCustomerNotAllowedForCurrentSubjects();
|
||||
when ( currentUser() <> 'mike@example.org' or not hasGlobalPermission('add-customer') )
|
||||
execute procedure addTestCustomerNotAllowedForCurrentSubjects();
|
||||
--//
|
||||
|
@ -2,7 +2,7 @@
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-TEST-DATA-GENERATOR:1 endDelimiter:--//
|
||||
--changeset test-customer-TEST-DATA-GENERATOR:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Generates a customer reference number for a given test data counter.
|
||||
@ -19,7 +19,7 @@ end; $$;
|
||||
/*
|
||||
Creates a single customer test record with dist.
|
||||
*/
|
||||
create or replace procedure createCustomerTestData(
|
||||
create or replace procedure createTestCustomerTestData(
|
||||
custReference integer,
|
||||
custPrefix varchar
|
||||
)
|
||||
@ -30,7 +30,7 @@ declare
|
||||
custAdminName varchar;
|
||||
begin
|
||||
currentTask = 'creating RBAC test customer #' || custReference || '/' || custPrefix;
|
||||
call defineContext(currentTask, null, 'mike@hostsharing.net', 'global#hostsharing.admin');
|
||||
call defineContext(currentTask, null, 'mike@example.org', 'global#test-global.admin');
|
||||
execute format('set local hsadminng.currentTask to %L', currentTask);
|
||||
|
||||
custRowId = uuid_generate_v4();
|
||||
@ -38,7 +38,7 @@ begin
|
||||
|
||||
raise notice 'creating customer %:%', custReference, custPrefix;
|
||||
insert
|
||||
into customer (reference, prefix, adminUserName)
|
||||
into test_customer (reference, prefix, adminUserName)
|
||||
values (custReference, custPrefix, custAdminName);
|
||||
end; $$;
|
||||
--//
|
||||
@ -46,7 +46,7 @@ end; $$;
|
||||
/*
|
||||
Creates a range of test customers for mass data generation.
|
||||
*/
|
||||
create or replace procedure createCustomerTestData(
|
||||
create or replace procedure createTestCustomerTestData(
|
||||
startCount integer, -- count of auto generated rows before the run
|
||||
endCount integer -- count of auto generated rows after the run
|
||||
)
|
||||
@ -54,7 +54,7 @@ create or replace procedure createCustomerTestData(
|
||||
begin
|
||||
for t in startCount..endCount
|
||||
loop
|
||||
call createCustomerTestData(testCustomerReference(t), intToVarChar(t, 3));
|
||||
call createTestCustomerTestData(testCustomerReference(t), intToVarChar(t, 3));
|
||||
commit;
|
||||
end loop;
|
||||
end; $$;
|
||||
@ -62,14 +62,14 @@ end; $$;
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-customer-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
|
||||
--changeset test-customer-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
do language plpgsql $$
|
||||
begin
|
||||
call createCustomerTestData(99901, 'xxx');
|
||||
call createCustomerTestData(99902, 'yyy');
|
||||
call createCustomerTestData(99903, 'zzz');
|
||||
call createTestCustomerTestData(99901, 'xxx');
|
||||
call createTestCustomerTestData(99902, 'yyy');
|
||||
call createTestCustomerTestData(99903, 'zzz');
|
||||
end;
|
||||
$$;
|
||||
--//
|
@ -1,14 +1,14 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-MAIN-TABLE:1 endDelimiter:--//
|
||||
--changeset test-package-MAIN-TABLE:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create table if not exists package
|
||||
create table if not exists test_package
|
||||
(
|
||||
uuid uuid unique references RbacObject (uuid),
|
||||
version int not null default 0,
|
||||
customerUuid uuid references customer (uuid),
|
||||
customerUuid uuid references test_customer (uuid),
|
||||
name varchar(5),
|
||||
description varchar(96)
|
||||
);
|
@ -1,62 +1,62 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
|
||||
*/
|
||||
drop trigger if exists createRbacObjectForPackage_Trigger on package;
|
||||
drop trigger if exists createRbacObjectForPackage_Trigger on test_package;
|
||||
create trigger createRbacObjectForPackage_Trigger
|
||||
before insert
|
||||
on package
|
||||
on test_package
|
||||
for each row
|
||||
execute procedure createRbacObject();
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create or replace function packageOwner(pac package)
|
||||
create or replace function testPackageOwner(pac test_package)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('package', pac.uuid, 'owner');
|
||||
return roleDescriptor('test_package', pac.uuid, 'owner');
|
||||
end; $$;
|
||||
|
||||
create or replace function packageAdmin(pac package)
|
||||
create or replace function testPackageAdmin(pac test_package)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('package', pac.uuid, 'admin');
|
||||
return roleDescriptor('test_package', pac.uuid, 'admin');
|
||||
end; $$;
|
||||
|
||||
create or replace function packageTenant(pac package)
|
||||
create or replace function testPackageTenant(pac test_package)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('package', pac.uuid, 'tenant');
|
||||
return roleDescriptor('test_package', pac.uuid, 'tenant');
|
||||
end; $$;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-ROLES-CREATION:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-ROLES-CREATION:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates the roles and their assignments for a new package for the AFTER INSERT TRIGGER.
|
||||
*/
|
||||
create or replace function createRbacRolesForPackage()
|
||||
create or replace function createRbacRolesForTestPackage()
|
||||
returns trigger
|
||||
language plpgsql
|
||||
strict as $$
|
||||
declare
|
||||
parentCustomer customer;
|
||||
parentCustomer test_customer;
|
||||
packageOwnerRoleUuid uuid;
|
||||
packageAdminRoleUuid uuid;
|
||||
begin
|
||||
@ -64,28 +64,28 @@ begin
|
||||
raise exception 'invalid usage of TRIGGER AFTER INSERT';
|
||||
end if;
|
||||
|
||||
select * from customer as c where c.uuid = NEW.customerUuid into parentCustomer;
|
||||
select * from test_customer as c where c.uuid = NEW.customerUuid into parentCustomer;
|
||||
|
||||
-- an owner role is created and assigned to the customer's admin role
|
||||
packageOwnerRoleUuid = createRole(
|
||||
packageOwner(NEW),
|
||||
testPackageOwner(NEW),
|
||||
withoutPermissions(),
|
||||
beneathRole(customerAdmin(parentCustomer))
|
||||
beneathRole(testCustomerAdmin(parentCustomer))
|
||||
);
|
||||
|
||||
-- an owner role is created and assigned to the package owner role
|
||||
packageAdminRoleUuid = createRole(
|
||||
packageAdmin(NEW),
|
||||
testPackageAdmin(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['add-unixuser', 'add-domain']),
|
||||
beneathRole(packageOwnerRoleUuid)
|
||||
);
|
||||
|
||||
-- and a package tenant role is created and assigned to the package admin as well
|
||||
perform createRole(
|
||||
packageTenant(NEW),
|
||||
testPackageTenant(NEW),
|
||||
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['view']),
|
||||
beneathRole(packageAdminRoleUuid),
|
||||
beingItselfA(customerTenant(parentCustomer))
|
||||
beingItselfA(testCustomerTenant(parentCustomer))
|
||||
);
|
||||
|
||||
return NEW;
|
||||
@ -95,31 +95,31 @@ end; $$;
|
||||
An AFTER INSERT TRIGGER which creates the role structure for a new package.
|
||||
*/
|
||||
|
||||
drop trigger if exists createRbacRolesForPackage_Trigger on package;
|
||||
create trigger createRbacRolesForPackage_Trigger
|
||||
drop trigger if exists createRbacRolesForTestPackage_Trigger on test_package;
|
||||
create trigger createRbacRolesForTestPackage_Trigger
|
||||
after insert
|
||||
on package
|
||||
on test_package
|
||||
for each row
|
||||
execute procedure createRbacRolesForPackage();
|
||||
execute procedure createRbacRolesForTestPackage();
|
||||
--//
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-ROLES-REMOVAL:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-ROLES-REMOVAL:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Deletes the roles and their assignments of a deleted package for the BEFORE DELETE TRIGGER.
|
||||
*/
|
||||
|
||||
create or replace function deleteRbacRulesForPackage()
|
||||
create or replace function deleteRbacRulesForTestPackage()
|
||||
returns trigger
|
||||
language plpgsql
|
||||
strict as $$
|
||||
begin
|
||||
if TG_OP = 'DELETE' then
|
||||
call deleteRole(findRoleId(packageOwner(OLD)));
|
||||
call deleteRole(findRoleId(packageAdmin(OLD)));
|
||||
call deleteRole(findRoleId(packageTenant(OLD)));
|
||||
call deleteRole(findRoleId(testPackageOwner(OLD)));
|
||||
call deleteRole(findRoleId(testPackageAdmin(OLD)));
|
||||
call deleteRole(findRoleId(testPackageTenant(OLD)));
|
||||
else
|
||||
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
|
||||
end if;
|
||||
@ -129,66 +129,66 @@ end; $$;
|
||||
An BEFORE DELETE TRIGGER which deletes the role structure of a package.
|
||||
*/
|
||||
|
||||
drop trigger if exists deleteRbacRulesForPackage_Trigger on package;
|
||||
create trigger deleteRbacRulesForPackage_Trigger
|
||||
drop trigger if exists deleteRbacRulesForTestPackage_Trigger on test_package;
|
||||
create trigger deleteRbacRulesForTestPackage_Trigger
|
||||
before delete
|
||||
on package
|
||||
on test_package
|
||||
for each row
|
||||
execute procedure deleteRbacRulesForPackage();
|
||||
execute procedure deleteRbacRulesForTestPackage();
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-IDENTITY-VIEW:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-IDENTITY-VIEW:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Creates a view to the package main table which maps the identifying name
|
||||
(in this case, actually the column `name`) to the objectUuid.
|
||||
*/
|
||||
drop view if exists package_iv;
|
||||
create or replace view package_iv as
|
||||
drop view if exists test_package_iv;
|
||||
create or replace view test_package_iv as
|
||||
select distinct target.uuid, target.name as idName
|
||||
from package as target;
|
||||
from test_package as target;
|
||||
-- TODO: Is it ok that everybody has access to this information?
|
||||
grant all privileges on package_iv to restricted;
|
||||
grant all privileges on test_package_iv to restricted;
|
||||
|
||||
/*
|
||||
Returns the objectUuid for a given identifying name (in this case, actually the column `name`).
|
||||
*/
|
||||
create or replace function packageUuidByIdName(idName varchar)
|
||||
create or replace function test_packageUuidByIdName(idName varchar)
|
||||
returns uuid
|
||||
language sql
|
||||
strict as $$
|
||||
select uuid from package_iv iv where iv.idName = packageUuidByIdName.idName;
|
||||
select uuid from test_package_iv iv where iv.idName = test_packageUuidByIdName.idName;
|
||||
$$;
|
||||
|
||||
/*
|
||||
Returns the identifying name for a given objectUuid (in this case the name).
|
||||
*/
|
||||
create or replace function packageIdNameByUuid(uuid uuid)
|
||||
create or replace function test_packageIdNameByUuid(uuid uuid)
|
||||
returns varchar
|
||||
stable leakproof
|
||||
language sql
|
||||
strict as $$
|
||||
select idName from package_iv iv where iv.uuid = packageIdNameByUuid.uuid;
|
||||
select idName from test_package_iv iv where iv.uuid = test_packageIdNameByUuid.uuid;
|
||||
$$;
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
/*
|
||||
Creates a view to the customer main table which maps the identifying name
|
||||
(in this case, the prefix) to the objectUuid.
|
||||
*/
|
||||
drop view if exists package_rv;
|
||||
create or replace view package_rv as
|
||||
drop view if exists test_package_rv;
|
||||
create or replace view test_package_rv as
|
||||
select target.*
|
||||
from package as target
|
||||
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'package', currentSubjectsUuids()))
|
||||
from test_package as target
|
||||
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'test_package', currentSubjectsUuids()))
|
||||
order by target.name;
|
||||
grant all privileges on package_rv to restricted;
|
||||
grant all privileges on test_package_rv to restricted;
|
||||
--//
|
@ -1,7 +1,7 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-TEST-DATA-GENERATOR:1 endDelimiter:--//
|
||||
--changeset test-package-TEST-DATA-GENERATOR:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates the given number of test packages for the given customer.
|
||||
@ -9,14 +9,14 @@
|
||||
create or replace procedure createPackageTestData(customerPrefix varchar, pacCount int)
|
||||
language plpgsql as $$
|
||||
declare
|
||||
cust customer;
|
||||
cust test_customer;
|
||||
custAdminUser varchar;
|
||||
custAdminRole varchar;
|
||||
pacName varchar;
|
||||
currentTask varchar;
|
||||
pac package;
|
||||
pac test_package;
|
||||
begin
|
||||
select * from customer where customer.prefix = customerPrefix into cust;
|
||||
select * from test_customer where test_customer.prefix = customerPrefix into cust;
|
||||
|
||||
for t in 0..(pacCount-1)
|
||||
loop
|
||||
@ -25,18 +25,18 @@ begin
|
||||
cust.uuid;
|
||||
|
||||
custAdminUser = 'customer-admin@' || cust.prefix || '.example.com';
|
||||
custAdminRole = 'customer#' || cust.prefix || '.admin';
|
||||
custAdminRole = 'test_customer#' || cust.prefix || '.admin';
|
||||
call defineContext(currentTask, null, custAdminUser, custAdminRole);
|
||||
raise notice 'task: % by % as %', currentTask, custAdminUser, custAdminRole;
|
||||
|
||||
insert
|
||||
into package (customerUuid, name, description)
|
||||
into test_package (customerUuid, name, description)
|
||||
values (cust.uuid, pacName, 'Here can add your own description of package ' || pacName || '.')
|
||||
returning * into pac;
|
||||
|
||||
call grantRoleToUser(
|
||||
getRoleId(customerAdmin(cust), 'fail'),
|
||||
findRoleId(packageAdmin(pac)),
|
||||
getRoleId(testCustomerAdmin(cust), 'fail'),
|
||||
findRoleId(testPackageAdmin(pac)),
|
||||
createRbacUser('pac-admin-' || pacName || '@' || cust.prefix || '.example.com'),
|
||||
true);
|
||||
|
||||
@ -49,9 +49,9 @@ end; $$;
|
||||
create or replace procedure createPackageTestData()
|
||||
language plpgsql as $$
|
||||
declare
|
||||
cust customer;
|
||||
cust test_customer;
|
||||
begin
|
||||
for cust in (select * from customer)
|
||||
for cust in (select * from test_customer)
|
||||
loop
|
||||
continue when cust.reference >= 90000; -- reserved for functional testing
|
||||
call createPackageTestData(cust.prefix, 3);
|
||||
@ -64,7 +64,7 @@ $$;
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
|
||||
--changeset test-package-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
do language plpgsql $$
|
@ -4,10 +4,10 @@
|
||||
--changeset hs-unixuser-MAIN-TABLE:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create table if not exists UnixUser
|
||||
create table if not exists test_unixuser
|
||||
(
|
||||
uuid uuid unique references RbacObject (uuid),
|
||||
packageUuid uuid references package (uuid),
|
||||
packageUuid uuid references test_package (uuid),
|
||||
name character varying(32),
|
||||
description character varying(96)
|
||||
);
|
@ -1,49 +1,49 @@
|
||||
--liquibase formatted sql
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
--changeset test-package-rbac-CREATE-OBJECT:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
/*
|
||||
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
|
||||
*/
|
||||
drop trigger if exists createRbacObjectForUnixUser_Trigger on UnixUser;
|
||||
create trigger createRbacObjectForUnixUser_Trigger
|
||||
drop trigger if exists createRbacObjectFortest_unixuser_Trigger on test_unixuser;
|
||||
create trigger createRbacObjectFortest_unixuser_Trigger
|
||||
before insert
|
||||
on UnixUser
|
||||
on test_unixuser
|
||||
for each row
|
||||
execute procedure createRbacObject();
|
||||
--//
|
||||
|
||||
|
||||
-- ============================================================================
|
||||
--changeset hs-unixuser-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
--changeset test-unixuser-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
|
||||
-- ----------------------------------------------------------------------------
|
||||
|
||||
create or replace function unixUserOwner(uu UnixUser)
|
||||
create or replace function testUnixUserOwner(uu test_unixuser)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('unixuser', uu.uuid, 'owner');
|
||||
return roleDescriptor('test_unixuser', uu.uuid, 'owner');
|
||||
end; $$;
|
||||
|
||||
create or replace function unixUserAdmin(uu UnixUser)
|
||||
create or replace function testUnixUserAdmin(uu test_unixuser)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('unixuser', uu.uuid, 'admin');
|
||||
return roleDescriptor('test_unixuser', uu.uuid, 'admin');
|
||||
end; $$;
|
||||
|
||||
create or replace function unixUserTenant(uu UnixUser)
|
||||
create or replace function testUnixUserTenant(uu test_unixuser)
|
||||
returns RbacRoleDescriptor
|
||||
returns null on null input
|
||||
language plpgsql as $$
|
||||
begin
|
||||
return roleDescriptor('unixuser', uu.uuid, 'tenant');
|
||||
return roleDescriptor('test_unixuser', uu.uuid, 'tenant');
|
||||
end; |