doc/adr/2022-07-18.row-level-security-mechanism.md

@@ -74,7 +74,7 @@ For restricted DB-users, which are used by the backend, access to rows is filter
         FOR SELECT
         TO restricted
         USING (
-            isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentUserUuid())
+            isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid())
         );
     
     SET SESSION AUTHORIZATION restricted;
@@ -101,7 +101,7 @@ We are bound to PostgreSQL, including integration tests and testing the RBAC sys
     CREATE OR REPLACE RULE "_RETURN" AS
         ON SELECT TO cust_view
         DO INSTEAD
-            SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('customer', id, 'view'), currentUserUuid());
+            SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('customer', id, 'view'), currentUserUuid());
 
     SET SESSION AUTHORIZATION restricted;
     SET hsadminng.currentUser TO 'alex@example.com';

sql/rbac-tests.sql

@@ -19,11 +19,11 @@ select *
 FROM queryAllPermissionsOfSubjectId(findRbacUser('rosa@example.com'));
 
 select *
-FROM queryAllRbacUsersWithPermissionsFor(findEffectivePermissionId('customer',
+FROM queryAllRbacUsersWithPermissionsFor(findPermissionId('customer',
                                                           (SELECT uuid FROM RbacObject WHERE objectTable = 'customer' LIMIT 1),
                                                           'add-package'));
 select *
-FROM queryAllRbacUsersWithPermissionsFor(findEffectivePermissionId('package',
+FROM queryAllRbacUsersWithPermissionsFor(findPermissionId('package',
                                                           (SELECT uuid FROM RbacObject WHERE objectTable = 'package' LIMIT 1),
                                                           'delete'));
 
@@ -34,12 +34,12 @@ $$
         result bool;
     BEGIN
         userId = findRbacUser('superuser-alex@hostsharing.net');
-        result = (SELECT * FROM isPermissionGrantedToSubject(findEffectivePermissionId('package', 94928, 'add-package'), userId));
+        result = (SELECT * FROM isPermissionGrantedToSubject(findPermissionId('package', 94928, 'add-package'), userId));
         IF (result) THEN
             RAISE EXCEPTION 'expected permission NOT to be granted, but it is';
         end if;
 
-        result = (SELECT * FROM isPermissionGrantedToSubject(findEffectivePermissionId('package', 94928, 'view'), userId));
+        result = (SELECT * FROM isPermissionGrantedToSubject(findPermissionId('package', 94928, 'view'), userId));
         IF (NOT result) THEN
             RAISE EXCEPTION 'expected permission to be granted, but it is NOT';
         end if;

sql/rbac-view-option-experiments.sql

@@ -20,7 +20,7 @@ CREATE POLICY customer_policy ON customer
     TO restricted
     USING (
         -- id=1000
-        isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'view'), currentUserUuid())
+        isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid())
     );
 
 SET SESSION AUTHORIZATION restricted;
@@ -35,7 +35,7 @@ SELECT * FROM customer;
 CREATE OR REPLACE RULE "_RETURN" AS
     ON SELECT TO cust_view
     DO INSTEAD
-    SELECT * FROM customer WHERE isPermissionGrantedToSubject(findEffectivePermissionId('test_customer', id, 'view'), currentUserUuid());
+    SELECT * FROM customer WHERE isPermissionGrantedToSubject(findPermissionId('test_customer', id, 'view'), currentUserUuid());
 SELECT * from cust_view LIMIT 10;
 
 select queryAllPermissionsOfSubjectId(findRbacUser('superuser-alex@hostsharing.net'));

src/main/resources/db/changelog/050-rbac-base.sql

@@ -438,24 +438,9 @@ create or replace function findPermissionId(forObjectUuid uuid, forOp RbacOp)
 select uuid
     from RbacPermission p
     where p.objectUuid = forObjectUuid
-      and p.op = forOp
+      and p.op in ('*', forOp)
 $$;
 
-create or replace function findEffectivePermissionId(forObjectUuid uuid, forOp RbacOp)
-    returns uuid
-    returns null on null input
-    stable -- leakproof
-    language plpgsql as $$
-declare
-    permissionId uuid;
-begin
-    permissionId := findPermissionId(forObjectUuid, forOp);
-    if permissionId is null and forOp <> '*' then
-        permissionId := findPermissionId(forObjectUuid, '*');
-    end if;
-    return permissionId;
-end $$;
-
 --//
 
 -- ============================================================================
@@ -467,13 +452,12 @@ end $$;
 create table RbacGrants
 (
     uuid                uuid primary key default uuid_generate_v4(),
-    grantedByTriggerOf  uuid references RbacObject (uuid) on delete cascade initially deferred ,
     grantedByRoleUuid   uuid references RbacRole (uuid),
     ascendantUuid       uuid references RbacReference (uuid),
     descendantUuid      uuid references RbacReference (uuid),
     assumed             boolean not null default true,  -- auto assumed (true) vs. needs assumeRoles (false)
-    unique (ascendantUuid, descendantUuid),
+    unique (ascendantUuid, descendantUuid)
-    constraint rbacGrant_createdBy check ( grantedByRoleUuid is null or grantedByTriggerOf is null) );
+);
 create index on RbacGrants (ascendantUuid);
 create index on RbacGrants (descendantUuid);
 
@@ -577,8 +561,8 @@ begin
             perform assertReferenceType('permissionId (descendant)', permissionIds[i], 'RbacPermission');
 
             insert
-                into RbacGrants (grantedByTriggerOf, ascendantUuid, descendantUuid, assumed)
+                into RbacGrants (ascendantUuid, descendantUuid, assumed)
-                values (currentTriggerObjectUuid(), roleUuid, permissionIds[i], true)
+                values (roleUuid, permissionIds[i], true)
             on conflict do nothing; -- allow granting multiple times
         end loop;
 end;
@@ -595,8 +579,8 @@ begin
     end if;
 
     insert
-        into RbacGrants (grantedByTriggerOf, ascendantuuid, descendantUuid, assumed)
+        into RbacGrants (ascendantuuid, descendantUuid, assumed)
-        values (currentTriggerObjectUuid(), superRoleId, subRoleId, doAssume)
+        values (superRoleId, subRoleId, doAssume)
     on conflict do nothing; -- allow granting multiple times
 end; $$;
 
@@ -618,8 +602,8 @@ begin
     end if;
 
     insert
-        into RbacGrants (grantedByTriggerOf, ascendantuuid, descendantUuid, assumed)
+        into RbacGrants (ascendantuuid, descendantUuid, assumed)
-        values (currentTriggerObjectUuid(), superRoleId, subRoleId, doAssume)
+        values (superRoleId, subRoleId, doAssume)
     on conflict do nothing; -- allow granting multiple times
 end; $$;
 
@@ -641,8 +625,8 @@ begin
     end if;
 
     insert
-        into RbacGrants (grantedByTriggerOf, ascendantuuid, descendantUuid, assumed)
+        into RbacGrants (ascendantuuid, descendantUuid, assumed)
-        values (currentTriggerObjectUuid(), superRoleId, subRoleId, doAssume)
+        values (superRoleId, subRoleId, doAssume)
     on conflict do nothing; -- allow granting multiple times
 end; $$;
 

src/main/resources/db/changelog/055-rbac-views.sql

@@ -56,7 +56,6 @@ drop view if exists rbacgrants_ev;
 create or replace view rbacgrants_ev as
     -- @formatter:off
     select x.grantUuid as uuid,
-           x.grantedByTriggerOf as grantedByTriggerOf,
            go.objectTable || '#' || findIdNameByObjectUuid(go.objectTable, go.uuid) || '.' || r.roletype as grantedByRoleIdName,
            x.ascendingIdName as ascendantIdName,
            x.descendingIdName as descendantIdName,
@@ -66,7 +65,6 @@ create or replace view rbacgrants_ev as
            x.assumed
         from (
              select g.uuid as grantUuid,
-                    g.grantedbytriggerof as grantedbytriggerof,
                     g.grantedbyroleuuid, g.ascendantuuid, g.descendantuuid, g.assumed,
 
                     coalesce(

src/main/resources/db/changelog/056-rbac-trigger-context.sql

@@ -1,61 +0,0 @@
---liquibase formatted sql
-
-
--- ============================================================================
---changeset rbac-trigger-context-ENTER:1 endDelimiter:--//
--- ----------------------------------------------------------------------------
-
-create or replace procedure enterTriggerForObjectUuid(currentObjectUuid uuid)
-    language plpgsql as $$
-declare
-    existingObjectUuid text;
-begin
-    existingObjectUuid = current_setting('hsadminng.currentObjectUuid', true);
-    if (existingObjectUuid > '' ) then
-        raise exception '[500] currentObjectUuid already defined, already in trigger of "%"', existingObjectUuid;
-    end if;
-    execute format('set local hsadminng.currentObjectUuid to %L', currentObjectUuid);
-end; $$;
-
-
--- ============================================================================
---changeset rbac-trigger-context-CURRENT-ID:1 endDelimiter:--//
--- ----------------------------------------------------------------------------
-/*
-    Returns the uuid of the object uuid whose trigger is currently executed as set via `enterTriggerForObjectUuid(...)`.
- */
-
-create or replace function currentTriggerObjectUuid()
-    returns uuid
-    stable -- leakproof
-    language plpgsql as $$
-declare
-    currentObjectUuid uuid;
-begin
-    begin
-        currentObjectUuid = current_setting('hsadminng.currentObjectUuid')::uuid;
-        return currentObjectUuid;
-    exception
-        when others then
-            return null::uuid;
-    end;
-end; $$;
---//
-
-
--- ============================================================================
---changeset rbac-trigger-context-LEAVE:1 endDelimiter:--//
--- ----------------------------------------------------------------------------
-
-create or replace procedure leaveTriggerForObjectUuid(currentObjectUuid uuid)
-    language plpgsql as $$
-declare
-    existingObjectUuid uuid;
-begin
-    existingObjectUuid = current_setting('hsadminng.currentObjectUuid', true);
-    if ( existingObjectUuid <> currentObjectUuid ) then
-        raise exception '[500] currentObjectUuid does not match: "%"', existingObjectUuid;
-    end if;
-    execute format('reset hsadminng.currentObjectUuid');
-end; $$;
-

src/main/resources/db/changelog/113-test-customer-rbac.sql

@@ -34,8 +34,6 @@ begin
         raise exception 'invalid usage of TRIGGER AFTER INSERT';
     end if;
 
-    call enterTriggerForObjectUuid(NEW.uuid);
-
     -- the owner role with full access for Hostsharing administrators
     testCustomerOwnerUuid = createRoleWithGrants(
         testCustomerOwner(NEW),
@@ -61,7 +59,6 @@ begin
         permissions =>  array['view']
         );
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/123-test-package-rbac.sql

@@ -26,13 +26,13 @@ create or replace function createRbacRolesForTestPackage()
     strict as $$
 declare
     parentCustomer       test_customer;
+    packageOwnerRoleUuid uuid;
+    packageAdminRoleUuid uuid;
 begin
     if TG_OP <> 'INSERT' then
         raise exception 'invalid usage of TRIGGER AFTER INSERT';
     end if;
 
-    call enterTriggerForObjectUuid(NEW.uuid);
-
     select * from test_customer as c where c.uuid = NEW.customerUuid into parentCustomer;
 
     -- an owner role is created and assigned to the customer's admin role
@@ -57,7 +57,6 @@ begin
             outgoingSubRoles => array[testCustomerTenant(parentCustomer)]
         );
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/133-test-domain-rbac.sql

@@ -53,8 +53,6 @@ begin
         raise exception 'invalid usage of TRIGGER AFTER INSERT';
     end if;
 
-    call enterTriggerForObjectUuid(NEW.uuid);
-
     select * from test_package where uuid = NEW.packageUuid into parentPackage;
 
     -- an owner role is created and assigned to the package's admin group
@@ -74,7 +72,6 @@ begin
 
     -- a tenent role is only created on demand
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/223-hs-office-relationship-rbac.sql

@@ -33,7 +33,6 @@ declare
     oldContact                  hs_office_contact;
     newContact                  hs_office_contact;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     hsOfficeRelationshipTenant := hsOfficeRelationshipTenant(NEW);
 
@@ -97,7 +96,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/233-hs-office-partner-rbac.sql

@@ -36,7 +36,6 @@ declare
     oldContact            hs_office_contact;
     newContact            hs_office_contact;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     select * from hs_office_relationship as r where r.uuid = NEW.partnerroleuuid into newPartnerRole;
     select * from hs_office_person as p where p.uuid = NEW.personUuid into newPerson;
@@ -160,7 +159,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/253-hs-office-sepamandate-rbac.sql

@@ -30,7 +30,6 @@ declare
     newHsOfficeDebitor      hs_office_debitor;
     newHsOfficeBankAccount  hs_office_bankAccount;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     select * from hs_office_debitor as p where p.uuid = NEW.debitorUuid into newHsOfficeDebitor;
     select * from hs_office_bankAccount as c where c.uuid = NEW.bankAccountUuid into newHsOfficeBankAccount;
@@ -76,7 +75,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/273-hs-office-debitor-rbac.sql

@@ -36,7 +36,6 @@ declare
     newBankAccount        hs_office_bankaccount;
     oldBankAccount        hs_office_bankaccount;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     hsOfficeDebitorTenant := hsOfficeDebitorTenant(NEW);
 
@@ -146,7 +145,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/303-hs-office-membership-rbac.sql

@@ -30,7 +30,6 @@ declare
     newHsOfficePartner  hs_office_partner;
     newHsOfficeDebitor  hs_office_debitor;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     select * from hs_office_partner as p where p.uuid = NEW.partnerUuid into newHsOfficePartner;
     select * from hs_office_debitor as c where c.uuid = NEW.mainDebitorUuid into newHsOfficeDebitor;
@@ -75,7 +74,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/313-hs-office-coopshares-rbac.sql

@@ -29,7 +29,6 @@ create or replace function hsOfficeCoopSharesTransactionRbacRolesTrigger()
 declare
     newHsOfficeMembership      hs_office_membership;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     select * from hs_office_membership as p where p.uuid = NEW.membershipUuid into newHsOfficeMembership;
 
@@ -50,7 +49,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/323-hs-office-coopassets-rbac.sql

@@ -29,7 +29,6 @@ create or replace function hsOfficeCoopAssetsTransactionRbacRolesTrigger()
 declare
     newHsOfficeMembership      hs_office_membership;
 begin
-    call enterTriggerForObjectUuid(NEW.uuid);
 
     select * from hs_office_membership as p where p.uuid = NEW.membershipUuid into newHsOfficeMembership;
 
@@ -50,7 +49,6 @@ begin
         raise exception 'invalid usage of TRIGGER';
     end if;
 
-    call leaveTriggerForObjectUuid(NEW.uuid);
     return NEW;
 end; $$;
 

src/main/resources/db/changelog/db.changelog-master.yaml

@@ -25,8 +25,6 @@ databaseChangeLog:
         file: db/changelog/054-rbac-context.sql
     - include:
         file: db/changelog/055-rbac-views.sql
-    - include:
-        file: db/changelog/056-rbac-trigger-context.sql
     - include:
         file: db/changelog/057-rbac-role-builder.sql
     - include:

src/test/java/net/hostsharing/hsadminng/hs/office/migration/ImportOfficeData.java

@@ -278,19 +278,20 @@ public class ImportOfficeData extends ContextBasedTest {
                     2000002=rel(relAnchor='LP Hostsharing eG', relType='PARTNER', relHolder='?? Test PS', contact='Petra Schmidt , Test PS'),
                     2000003=rel(relAnchor='LP Hostsharing eG', relType='PARTNER', relHolder='null null, null'),
                     2000004=rel(relAnchor='NP Mellies, Michael', relType='OPERATIONS', relHolder='NP Mellies, Michael', contact='Herr Michael Mellies '),
-                    2000005=rel(relAnchor='NP Mellies, Michael', relType='REPRESENTATIVE', relHolder='NP Mellies, Michael', contact='Herr Michael Mellies '),
+                    2000005=rel(relAnchor='LP JM GmbH', relType='EX_PARTNER', relHolder='LP JM e.K.', contact='JM e.K.'),
-                    2000006=rel(relAnchor='LP JM GmbH', relType='EX_PARTNER', relHolder='LP JM e.K.', contact='JM e.K.'),
+                    2000006=rel(relAnchor='LP JM GmbH', relType='OPERATIONS', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
-                    2000007=rel(relAnchor='LP JM GmbH', relType='OPERATIONS', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
+                    2000007=rel(relAnchor='LP JM GmbH', relType='VIP_CONTACT', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
-                    2000008=rel(relAnchor='LP JM GmbH', relType='VIP_CONTACT', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
+                    2000008=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='operations-announce', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
-                    2000009=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='operations-announce', relHolder='LP JM GmbH', contact='Herr Andrew Meyer-Operation , JM GmbH'),
+                    2000009=rel(relAnchor='LP JM GmbH', relType='REPRESENTATIVE', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
-                    2000010=rel(relAnchor='LP JM GmbH', relType='REPRESENTATIVE', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
+                    2000010=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='members-announce', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
-                    2000011=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='members-announce', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
+                    2000011=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='customers-announce', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
-                    2000012=rel(relAnchor='LP JM GmbH', relType='SUBSCRIBER', relMark='customers-announce', relHolder='LP JM GmbH', contact='Herr Philip Meyer-Contract , JM GmbH'),
+                    2000012=rel(relAnchor='LP JM GmbH', relType='VIP_CONTACT', relHolder='LP JM GmbH', contact='Frau Tammy Meyer-VIP , JM GmbH'),
-                    2000013=rel(relAnchor='LP JM GmbH', relType='VIP_CONTACT', relHolder='LP JM GmbH', contact='Frau Tammy Meyer-VIP , JM GmbH'),
+                    2000013=rel(relAnchor='?? Test PS', relType='OPERATIONS', relHolder='?? Test PS', contact='Petra Schmidt , Test PS'),
-                    2000014=rel(relAnchor='?? Test PS', relType='OPERATIONS', relHolder='?? Test PS', contact='Petra Schmidt , Test PS'),
+                    2000014=rel(relAnchor='?? Test PS', relType='REPRESENTATIVE', relHolder='?? Test PS', contact='Petra Schmidt , Test PS'),
-                    2000015=rel(relAnchor='?? Test PS', relType='REPRESENTATIVE', relHolder='?? Test PS', contact='Petra Schmidt , Test PS'),
+                    2000015=rel(relAnchor='NP Mellies, Michael', relType='SUBSCRIBER', relMark='operations-announce', relHolder='NP Fanninga, Frauke', contact='Frau Frauke Fanninga '),
-                    2000016=rel(relAnchor='NP Mellies, Michael', relType='SUBSCRIBER', relMark='operations-announce', relHolder='NP Fanninga, Frauke', contact='Frau Frauke Fanninga ')
+                    2000016=rel(relAnchor='NP Mellies, Michael', relType='REPRESENTATIVE', relHolder='NP Mellies, Michael', contact='Herr Michael Mellies '),
-                 }
+                    2000017=rel(relAnchor='null null, null', relType='REPRESENTATIVE', relHolder='null null, null')
+                }
                 """);
     }
 
@@ -411,7 +412,7 @@ public class ImportOfficeData extends ContextBasedTest {
                 idsToRemove.add(id);
             }
         });
-        assertThat(idsToRemove.size()).isEqualTo(1); // only from partner #99 (partner+contractual roles)
+        assertThat(idsToRemove.size()).isEqualTo(2); // only from partner #99 (partner+contractual roles)
         idsToRemove.forEach(id -> relationships.remove(id));
     }
 
@@ -420,7 +421,7 @@ public class ImportOfficeData extends ContextBasedTest {
     void removeEmptyPartners() {
         assumeThatWeAreImportingControlledTestData();
 
-        // avoid a error when persisting the deliberately invalid partner entry #99
+        // avoid a error when persisting the deliberetely invalid partner entry #99
         final var idsToRemove = new HashSet<Integer>();
         partners.forEach( (id, r) -> {
             // such a record
@@ -438,7 +439,7 @@ public class ImportOfficeData extends ContextBasedTest {
     void removeEmptyDebitors() {
         assumeThatWeAreImportingControlledTestData();
 
-        // avoid a error when persisting the deliberately invalid partner entry #99
+        // avoid a error when persisting the deliberetely invalid partner entry #99
         final var idsToRemove = new HashSet<Integer>();
         debitors.forEach( (id, r) -> {
             // such a record
@@ -880,9 +881,11 @@ public class ImportOfficeData extends ContextBasedTest {
             if (relationships.values().stream()
                     .filter(rel -> rel.getRelAnchor() == partnerPerson && rel.getRelType() == HsOfficeRelationshipType.REPRESENTATIVE)
                     .findFirst().isEmpty()) {
+                //addRelationship(partnerPerson, partnerPerson, partner.getContact(), HsOfficeRelationshipType.REPRESENTATIVE);
                 contractualMissing.add(partner.getPartnerNumber());
             }
         });
+        assertThat(contractualMissing).isEmpty(); // comment out if we do want to allow missing contractual contact
     }
     private static boolean containsRole(final Record rec, final String role) {
         final var roles = rec.getString("roles");

src/test/java/net/hostsharing/hsadminng/hs/office/relationship/HsOfficeRelationshipRepositoryIntegrationTest.java

@@ -342,6 +342,10 @@ class HsOfficeRelationshipRepositoryIntegrationTest extends ContextBasedTestWith
             final var initialGrantNames = Array.from(distinctGrantDisplaysOf(rawGrantRepo.findAll()));
             final var givenRelationship = givenSomeTemporaryRelationshipBessler(
                     "Anita", "twelfth");
+            assertThat(distinctRoleNamesOf(rawRoleRepo.findAll()).size()).as("unexpected number of roles created")
+                    .isEqualTo(initialRoleNames.length + 3);
+            assertThat(distinctGrantDisplaysOf(rawGrantRepo.findAll()).size()).as("unexpected number of grants created")
+                    .isEqualTo(initialGrantNames.length + 13);
 
             // when
             final var result = jpaAttempt.transacted(() -> {

src/test/resources/migration/contacts.csv

@@ -1,7 +1,7 @@
 contact_id;	bp_id;	salut;	first_name;	last_name;	title;	firma;	co;	street;			zipcode;city;	country;	phone_private;		phone_office;		phone_mobile;	fax;		email; roles
 
 # eine natürliche Person, implizites contractual
-1101;		17;	Herr;	Michael;	Mellies;		;	;	;	Kleine Freiheit 50;	26524;	Hage;	DE;		;			+49 4931 123456;	+49 1522 123456;;		mih@example.org; partner,contractual,billing,operation
+1101;		17;	Herr;	Michael;	Mellies;		;	;	;	Kleine Freiheit 50;	26524;	Hage;	DE;		;			+49 4931 123456;	+49 1522 123456;;		mih@example.org; partner,billing,operation
 
 # eine juristische Person mit drei separaten Ansprechpartnern, vip-contact und ex-partner
 1200;		20;;	;		;		;	JM e.K.;;	Wiesenweg 15;		12335;	Berlin; DE;		+49 30 6666666;		+49 30 5555555;		;		+49 30 6666666; jm-ex-partner@example.org; ex-partner