hostsharing/hs.hsadmin.ng
1
0
Fork 0
Code Activity

introduce-separate-database-schema-hs-office-and-amend-generators (#105)

Browse Source 
Co-authored-by: Michael Hoennig <michael@hoennig.de>
Reviewed-on: https://dev.hostsharing.net/hostsharing/hs.hsadmin.ng/pulls/105
Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>
This commit is contained in:
Michael Hoennig
2024-09-18 10:28:21 +02:00
parent 285e6fbeb5
commit 23b60641e3
91 changed files with 1015 additions and 1002 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/main/resources/db/changelog/5-hs-office/500-hs-office-schema.sql Normal file
View File

@ -0,0 +1,8 @@
--liquibase formatted sql
-- ============================================================================
--changeset michael.hoennig:hs-office-SCHEMA endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SCHEMA hs_office;
--//

4
src/main/resources/db/changelog/5-hs-office/501-contact/5010-hs-office-contact.sql
View File

@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-office-contact-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists hs_office_contact
create table if not exists hs_office.contact
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
@ -20,5 +20,5 @@ create table if not exists hs_office_contact
--changeset michael.hoennig:hs-office-contact-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_contact');
call base.create_journal('hs_office.contact');
--//

36
src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql
View File

@ -3,29 +3,29 @@
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-rbac-OBJECT endDelimiter:--//
--changeset RbacObjectGenerator:hs-office-contact-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_contact');
call rbac.generateRelatedRbacObject('hs_office.contact');
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-rbac-ROLE-DESCRIPTORS endDelimiter:--//
--changeset RbacRoleDescriptorsGenerator:hs-office-contact-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeContact', 'hs_office_contact');
call rbac.generateRbacRoleDescriptors('hsOfficeContact', 'hs_office.contact');
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-rbac-insert-trigger endDelimiter:--//
--changeset RolesGrantsAndPermissionsGenerator:hs-office-contact-rbac-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeContact(
NEW hs_office_contact
create or replace procedure hs_office.contact_build_rbac_system(
NEW hs_office.contact
)
language plpgsql as $$
@ -37,7 +37,7 @@ begin
perform rbac.defineRoleWithGrants(
hsOfficeContactOWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalAdmin()],
incomingSuperRoles => array[rbac.globalADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
@ -57,30 +57,30 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_contact row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.contact row.
*/
create or replace function insertTriggerForHsOfficeContact_tf()
create or replace function hs_office.contact_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeContact(NEW);
call hs_office.contact_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeContact_tg
after insert on hs_office_contact
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.contact
for each row
execute procedure insertTriggerForHsOfficeContact_tf();
execute procedure hs_office.contact_build_rbac_system_after_insert_tf();
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-rbac-IDENTITY-VIEW endDelimiter:--//
--changeset RbacIdentityViewGenerator:hs-office-contact-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_contact',
call rbac.generateRbacIdentityViewFromProjection('hs_office.contact',
$idName$
caption
$idName$);
@ -88,9 +88,9 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_contact',
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-rbac-RESTRICTED-VIEW endDelimiter:--//
--changeset RbacRestrictedViewGenerator:hs-office-contact-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_contact',
call rbac.generateRbacRestrictedView('hs_office.contact',
$orderBy$
caption
$orderBy$,

26
src/main/resources/db/changelog/5-hs-office/501-contact/5016-hs-office-contact-migration.sql
View File

@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-contact-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office_contact_legacy_id
CREATE TABLE hs_office.contact_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office_contact(uuid),
uuid uuid NOT NULL REFERENCES hs_office.contact(uuid),
contact_id integer NOT NULL
);
--//
@ -19,10 +19,10 @@ CREATE TABLE hs_office_contact_legacy_id
--changeset michael.hoennig:hs-office-contact-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office_contact_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.contact_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office_contact_legacy_id.contact_id;
OWNED BY hs_office.contact_legacy_id.contact_id;
--//
@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office_contact_legacy_id_seq
--changeset michael.hoennig:hs-office-contact-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office_contact_legacy_id
ALTER TABLE hs_office.contact_legacy_id
ALTER COLUMN contact_id
SET DEFAULT nextVal('hs_office_contact_legacy_id_seq');
SET DEFAULT nextVal('hs_office.contact_legacy_id_seq');
--/
@ -41,8 +41,8 @@ ALTER TABLE hs_office_contact_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office_contact_legacy_id(uuid, contact_id)
SELECT uuid, nextVal('hs_office_contact_legacy_id_seq') FROM hs_office_contact;
INSERT INTO hs_office.contact_legacy_id(uuid, contact_id)
SELECT uuid, nextVal('hs_office.contact_legacy_id_seq') FROM hs_office.contact;
--/
@ -58,14 +58,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office_contact_legacy_id VALUES
(NEW.uuid, nextVal('hs_office_contact_legacy_id_seq'));
INSERT INTO hs_office.contact_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.contact_legacy_id_seq'));
return NEW;
end; $$;
create trigger createContactLegacyIdMapping
after insert on hs_office_contact
after insert on hs_office.contact
for each row
execute procedure insertContactLegacyIdMapping();
--/
@ -83,14 +83,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office_contact_legacy_id
DELETE FROM hs_office.contact_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removeContactLegacyIdMapping
before delete on hs_office_contact
before delete on hs_office.contact
for each row
execute procedure deleteContactLegacyIdMapping();
--/

2
src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql
View File

@ -23,7 +23,7 @@ begin
raise notice 'creating test contact: %', contCaption;
insert
into hs_office_contact (caption, postaladdress, emailaddresses, phonenumbers)
into hs_office.contact (caption, postaladdress, emailaddresses, phonenumbers)
values (
contCaption,
postalAddr,

4
src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql
View File

@ -14,7 +14,7 @@ CREATE TYPE HsOfficePersonType AS ENUM (
CREATE CAST (character varying as HsOfficePersonType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office_person
create table if not exists hs_office.person
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
@ -31,5 +31,5 @@ create table if not exists hs_office_person
--changeset michael.hoennig:hs-office-person-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_person');
call base.create_journal('hs_office.person');
--//

24
src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-person-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_person');
call rbac.generateRelatedRbacObject('hs_office.person');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-person-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePerson', 'hs_office_person');
call rbac.generateRbacRoleDescriptors('hsOfficePerson', 'hs_office.person');
--//
@ -24,8 +24,8 @@ call rbac.generateRbacRoleDescriptors('hsOfficePerson', 'hs_office_person');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficePerson(
NEW hs_office_person
create or replace procedure hs_office.person_build_rbac_system(
NEW hs_office.person
)
language plpgsql as $$
@ -57,22 +57,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_person row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.person row.
*/
create or replace function insertTriggerForHsOfficePerson_tf()
create or replace function hs_office.person_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficePerson(NEW);
call hs_office.person_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficePerson_tg
after insert on hs_office_person
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.person
for each row
execute procedure insertTriggerForHsOfficePerson_tf();
execute procedure hs_office.person_build_rbac_system_after_insert_tf();
--//
@ -80,7 +80,7 @@ execute procedure insertTriggerForHsOfficePerson_tf();
--changeset RbacIdentityViewGenerator:hs-office-person-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_person',
call rbac.generateRbacIdentityViewFromProjection('hs_office.person',
$idName$
concat(tradeName, familyName, givenName)
$idName$);
@ -90,7 +90,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_person',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-person-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_person',
call rbac.generateRbacRestrictedView('hs_office.person',
$orderBy$
concat(tradeName, familyName, givenName)
$orderBy$,

2
src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql
View File

@ -27,7 +27,7 @@ begin
raise notice 'creating test person: % by %', fullName, emailAddr;
insert
into hs_office_person (persontype, tradename, givenname, familyname)
into hs_office.person (persontype, tradename, givenname, familyname)
values (newPersonType, newTradeName, newGivenName, newFamilyName);
end; $$;
--//

10
src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql
View File

@ -16,13 +16,13 @@ CREATE TYPE HsOfficeRelationType AS ENUM (
CREATE CAST (character varying as HsOfficeRelationType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office_relation
create table if not exists hs_office.relation
(
uuid uuid unique references rbac.object (uuid) initially deferred, -- on delete cascade
version int not null default 0,
anchorUuid uuid not null references hs_office_person(uuid),
holderUuid uuid not null references hs_office_person(uuid),
contactUuid uuid references hs_office_contact(uuid),
anchorUuid uuid not null references hs_office.person(uuid),
holderUuid uuid not null references hs_office.person(uuid),
contactUuid uuid references hs_office.contact(uuid),
type HsOfficeRelationType not null,
mark varchar(24)
);
@ -33,5 +33,5 @@ create table if not exists hs_office_relation
--changeset michael.hoennig:hs-office-relation-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_relation');
call base.create_journal('hs_office.relation');
--//

120
src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
View File

@ -3,54 +3,54 @@
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-OBJECT endDelimiter:--//
--changeset RbacObjectGenerator:hs-office-relation-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_relation');
call rbac.generateRelatedRbacObject('hs_office.relation');
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-ROLE-DESCRIPTORS endDelimiter:--//
--changeset RbacRoleDescriptorsGenerator:hs-office-relation-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeRelation', 'hs_office_relation');
call rbac.generateRbacRoleDescriptors('hsOfficeRelation', 'hs_office.relation');
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-insert-trigger endDelimiter:--//
--changeset RolesGrantsAndPermissionsGenerator:hs-office-relation-rbac-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeRelation(
NEW hs_office_relation
create or replace procedure hs_office.relation_build_rbac_system(
NEW hs_office.relation
)
language plpgsql as $$
declare
newHolderPerson hs_office_person;
newAnchorPerson hs_office_person;
newContact hs_office_contact;
newHolderPerson hs_office.person;
newAnchorPerson hs_office.person;
newContact hs_office.contact;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_person WHERE uuid = NEW.holderUuid INTO newHolderPerson;
SELECT * FROM hs_office.person WHERE uuid = NEW.holderUuid INTO newHolderPerson;
assert newHolderPerson.uuid is not null, format('newHolderPerson must not be null for NEW.holderUuid = %s', NEW.holderUuid);
SELECT * FROM hs_office_person WHERE uuid = NEW.anchorUuid INTO newAnchorPerson;
SELECT * FROM hs_office.person WHERE uuid = NEW.anchorUuid INTO newAnchorPerson;
assert newAnchorPerson.uuid is not null, format('newAnchorPerson must not be null for NEW.anchorUuid = %s', NEW.anchorUuid);
SELECT * FROM hs_office_contact WHERE uuid = NEW.contactUuid INTO newContact;
SELECT * FROM hs_office.contact WHERE uuid = NEW.contactUuid INTO newContact;
assert newContact.uuid is not null, format('newContact must not be null for NEW.contactUuid = %s', NEW.contactUuid);
perform rbac.defineRoleWithGrants(
hsOfficeRelationOWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalAdmin()],
incomingSuperRoles => array[rbac.globalADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
@ -90,162 +90,162 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_relation row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.relation row.
*/
create or replace function insertTriggerForHsOfficeRelation_tf()
create or replace function hs_office.relation_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeRelation(NEW);
call hs_office.relation_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeRelation_tg
after insert on hs_office_relation
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.relation
for each row
execute procedure insertTriggerForHsOfficeRelation_tf();
execute procedure hs_office.relation_build_rbac_system_after_insert_tf();
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-update-trigger endDelimiter:--//
--changeset RolesGrantsAndPermissionsGenerator:hs-office-relation-rbac-update-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Called from the AFTER UPDATE TRIGGER to re-wire the grants.
*/
create or replace procedure updateRbacRulesForHsOfficeRelation(
OLD hs_office_relation,
NEW hs_office_relation
create or replace procedure hs_office.relation_update_rbac_system(
OLD hs_office.relation,
NEW hs_office.relation
)
language plpgsql as $$
begin
if NEW.contactUuid is distinct from OLD.contactUuid then
delete from rbac.grants g where g.grantedbytriggerof = OLD.uuid;
call buildRbacSystemForHsOfficeRelation(NEW);
call hs_office.relation_build_rbac_system(NEW);
end if;
end; $$;
/*
AFTER INSERT TRIGGER to re-wire the grant structure for a new hs_office_relation row.
AFTER UPDATE TRIGGER to re-wire the grant structure for a new hs_office.relation row.
*/
create or replace function updateTriggerForHsOfficeRelation_tf()
create or replace function hs_office.relation_update_rbac_system_after_update_tf()
returns trigger
language plpgsql
strict as $$
begin
call updateRbacRulesForHsOfficeRelation(OLD, NEW);
call hs_office.relation_update_rbac_system(OLD, NEW);
return NEW;
end; $$;
create trigger updateTriggerForHsOfficeRelation_tg
after update on hs_office_relation
create trigger update_rbac_system_after_update_tg
after update on hs_office.relation
for each row
execute procedure updateTriggerForHsOfficeRelation_tf();
execute procedure hs_office.relation_update_rbac_system_after_update_tf();
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-relation-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office_person ----------------------------
-- granting INSERT permission to hs_office.person ----------------------------
/*
Grants INSERT INTO hs_office_relation permissions to specified role of pre-existing hs_office_person rows.
Grants INSERT INTO hs_office.relation permissions to specified role of pre-existing hs_office.person rows.
*/
do language plpgsql $$
declare
row hs_office_person;
row hs_office.person;
begin
call base.defineContext('create INSERT INTO hs_office_relation permissions for pre-exising hs_office_person rows');
call base.defineContext('create INSERT INTO hs_office.relation permissions for pre-exising hs_office.person rows');
FOR row IN SELECT * FROM hs_office_person
FOR row IN SELECT * FROM hs_office.person
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_relation'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.relation'),
hsOfficePersonADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office_relation INSERT permission to specified role of new hs_office_person rows.
Grants hs_office.relation INSERT permission to specified role of new person rows.
*/
create or replace function new_hs_office_relation_grants_insert_to_hs_office_person_tf()
create or replace function hs_office.new_relation_grants_insert_to_person_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_relation'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.relation'),
hsOfficePersonADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_relation_grants_insert_to_hs_office_person_tg
after insert on hs_office_person
create trigger z_new_relation_grants_after_insert_tg
after insert on hs_office.person
for each row
execute procedure new_hs_office_relation_grants_insert_to_hs_office_person_tf();
execute procedure hs_office.new_relation_grants_insert_to_person_tf();
-- ============================================================================
--changeset michael.hoennig:hs_office_relation-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-relation-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_relation.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.relation.
*/
create or replace function hs_office_relation_insert_permission_check_tf()
create or replace function hs_office.relation_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT permission via direct foreign key: NEW.anchorUuid
if rbac.hasInsertPermission(NEW.anchorUuid, 'hs_office_relation') then
if rbac.hasInsertPermission(NEW.anchorUuid, 'hs_office.relation') then
return NEW;
end if;
raise exception '[403] insert into hs_office_relation not allowed for current subjects % (%)',
base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
raise exception '[403] insert into hs_office.relation values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_relation_insert_permission_check_tg
before insert on hs_office_relation
create trigger relation_insert_permission_check_tg
before insert on hs_office.relation
for each row
execute procedure hs_office_relation_insert_permission_check_tf();
execute procedure hs_office.relation_insert_permission_check_tf();
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-IDENTITY-VIEW endDelimiter:--//
--changeset RbacIdentityViewGenerator:hs-office-relation-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_relation',
call rbac.generateRbacIdentityViewFromProjection('hs_office.relation',
$idName$
(select idName from hs_office_person_iv p where p.uuid = anchorUuid)
(select idName from hs_office.person_iv p where p.uuid = anchorUuid)
|| '-with-' || target.type || '-'
|| (select idName from hs_office_person_iv p where p.uuid = holderUuid)
|| (select idName from hs_office.person_iv p where p.uuid = holderUuid)
$idName$);
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-relation-rbac-RESTRICTED-VIEW endDelimiter:--//
--changeset RbacRestrictedViewGenerator:hs-office-relation-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_relation',
call rbac.generateRbacRestrictedView('hs_office.relation',
$orderBy$
(select idName from hs_office_person_iv p where p.uuid = target.holderUuid)
(select idName from hs_office.person_iv p where p.uuid = target.holderUuid)
$orderBy$,
$updates$
contactUuid = new.contactUuid

22
src/main/resources/db/changelog/5-hs-office/503-relation/5038-hs-office-relation-test-data.sql
View File

@ -17,16 +17,16 @@ create or replace procedure createHsOfficeRelationTestData(
language plpgsql as $$
declare
idName varchar;
anchorPerson hs_office_person;
holderPerson hs_office_person;
contact hs_office_contact;
anchorPerson hs_office.person;
holderPerson hs_office.person;
contact hs_office.contact;
begin
idName := base.cleanIdentifier( anchorPersonName || '-' || holderPersonName);
select p.*
into anchorPerson
from hs_office_person p
from hs_office.person p
where p.tradeName = anchorPersonName or p.familyName = anchorPersonName;
if anchorPerson is null then
raise exception 'anchorPerson "%" not found', anchorPersonName;
@ -34,13 +34,13 @@ begin
select p.*
into holderPerson
from hs_office_person p
from hs_office.person p
where p.tradeName = holderPersonName or p.familyName = holderPersonName;
if holderPerson is null then
raise exception 'holderPerson "%" not found', holderPersonName;
end if;
select c.* into contact from hs_office_contact c where c.caption = contactCaption;
select c.* into contact from hs_office.contact c where c.caption = contactCaption;
if contact is null then
raise exception 'contact "%" not found', contactCaption;
end if;
@ -50,7 +50,7 @@ begin
raise notice '- using holder person (%): %', holderPerson.uuid, holderPerson;
raise notice '- using contact (%): %', contact.uuid, contact;
insert
into hs_office_relation (uuid, anchoruuid, holderuuid, type, mark, contactUuid)
into hs_office.relation (uuid, anchoruuid, holderuuid, type, mark, contactUuid)
values (uuid_generate_v4(), anchorPerson.uuid, holderPerson.uuid, relationType, mark, contact.uuid);
end; $$;
--//
@ -64,13 +64,13 @@ create or replace procedure createHsOfficeRelationTestData(
)
language plpgsql as $$
declare
person hs_office_person;
contact hs_office_contact;
person hs_office.person;
contact hs_office.contact;
begin
for t in startCount..endCount
loop
select p.* from hs_office_person p where tradeName = base.intToVarChar(t, 4) into person;
select c.* from hs_office_contact c where c.caption = base.intToVarChar(t, 4) || '#' || t into contact;
select p.* from hs_office.person p where tradeName = base.intToVarChar(t, 4) into person;
select c.* from hs_office.contact c where c.caption = base.intToVarChar(t, 4) || '#' || t into contact;
call createHsOfficeRelationTestData(person.uuid, contact.uuid, 'REPRESENTATIVE');
commit;

24
src/main/resources/db/changelog/5-hs-office/504-partner/5040-hs-office-partner.sql
View File

@ -5,7 +5,7 @@
--changeset michael.hoennig:hs-office-partner-DETAILS-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table hs_office_partner_details
create table hs_office.partner_details
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
@ -23,20 +23,20 @@ create table hs_office_partner_details
--changeset michael.hoennig:hs-office-partner-DETAILS-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_partner_details');
call base.create_journal('hs_office.partner_details');
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-partner-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table hs_office_partner
create table hs_office.partner
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
partnerNumber numeric(5) unique not null,
partnerRelUuid uuid not null references hs_office_relation(uuid), -- deleted in after delete trigger
detailsUuid uuid not null references hs_office_partner_details(uuid) -- deleted in after delete trigger
partnerRelUuid uuid not null references hs_office.relation(uuid), -- deleted in after delete trigger
detailsUuid uuid not null references hs_office.partner_details(uuid) -- deleted in after delete trigger
);
--//
@ -48,20 +48,20 @@ create table hs_office_partner
/**
Trigger function to delete related details of a partner to delete.
*/
create or replace function deleteHsOfficeDependentsOnPartnerDelete()
create or replace function hs_office.partner_delete_dependents_tf()
returns trigger
language PLPGSQL
as $$
declare
counter integer;
begin
DELETE FROM hs_office_partner_details d WHERE d.uuid = OLD.detailsUuid;
DELETE FROM hs_office.partner_details d WHERE d.uuid = OLD.detailsUuid;
GET DIAGNOSTICS counter = ROW_COUNT;
if counter = 0 then
raise exception 'partner details % could not be deleted', OLD.detailsUuid;
end if;
DELETE FROM hs_office_relation r WHERE r.uuid = OLD.partnerRelUuid;
DELETE FROM hs_office.relation r WHERE r.uuid = OLD.partnerRelUuid;
GET DIAGNOSTICS counter = ROW_COUNT;
if counter = 0 then
raise exception 'partner relation % could not be deleted', OLD.partnerRelUuid;
@ -73,15 +73,15 @@ end; $$;
/**
Triggers deletion of related rows of a partner to delete.
*/
create trigger hs_office_partner_delete_dependents_trigger
create trigger delete_dependents_tg
after delete
on hs_office_partner
on hs_office.partner
for each row
execute procedure deleteHsOfficeDependentsOnPartnerDelete();
execute procedure hs_office.partner_delete_dependents_tf();
-- ============================================================================
--changeset michael.hoennig:hs-office-partner-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_partner');
call base.create_journal('hs_office.partner');
--//

96
src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-partner-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_partner');
call rbac.generateRelatedRbacObject('hs_office.partner');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-partner-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePartner', 'hs_office_partner');
call rbac.generateRbacRoleDescriptors('hsOfficePartner', 'hs_office.partner');
--//
@ -24,22 +24,22 @@ call rbac.generateRbacRoleDescriptors('hsOfficePartner', 'hs_office_partner');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficePartner(
NEW hs_office_partner
create or replace procedure hs_office.partner_build_rbac_system(
NEW hs_office.partner
)
language plpgsql as $$
declare
newPartnerRel hs_office_relation;
newPartnerDetails hs_office_partner_details;
newPartnerRel hs_office.relation;
newPartnerDetails hs_office.partner_details;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_relation WHERE uuid = NEW.partnerRelUuid INTO newPartnerRel;
SELECT * FROM hs_office.relation WHERE uuid = NEW.partnerRelUuid INTO newPartnerRel;
assert newPartnerRel.uuid is not null, format('newPartnerRel must not be null for NEW.partnerRelUuid = %s', NEW.partnerRelUuid);
SELECT * FROM hs_office_partner_details WHERE uuid = NEW.detailsUuid INTO newPartnerDetails;
SELECT * FROM hs_office.partner_details WHERE uuid = NEW.detailsUuid INTO newPartnerDetails;
assert newPartnerDetails.uuid is not null, format('newPartnerDetails must not be null for NEW.detailsUuid = %s', NEW.detailsUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hsOfficeRelationOWNER(newPartnerRel));
@ -53,22 +53,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_partner row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.partner row.
*/
create or replace function insertTriggerForHsOfficePartner_tf()
create or replace function hs_office.partner_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficePartner(NEW);
call hs_office.partner_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficePartner_tg
after insert on hs_office_partner
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.partner
for each row
execute procedure insertTriggerForHsOfficePartner_tf();
execute procedure hs_office.partner_build_rbac_system_after_insert_tf();
--//
@ -80,31 +80,31 @@ execute procedure insertTriggerForHsOfficePartner_tf();
Called from the AFTER UPDATE TRIGGER to re-wire the grants.
*/
create or replace procedure updateRbacRulesForHsOfficePartner(
OLD hs_office_partner,
NEW hs_office_partner
create or replace procedure hs_office.partner_update_rbac_system(
OLD hs_office.partner,
NEW hs_office.partner
)
language plpgsql as $$
declare
oldPartnerRel hs_office_relation;
newPartnerRel hs_office_relation;
oldPartnerDetails hs_office_partner_details;
newPartnerDetails hs_office_partner_details;
oldPartnerRel hs_office.relation;
newPartnerRel hs_office.relation;
oldPartnerDetails hs_office.partner_details;
newPartnerDetails hs_office.partner_details;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_relation WHERE uuid = OLD.partnerRelUuid INTO oldPartnerRel;
SELECT * FROM hs_office.relation WHERE uuid = OLD.partnerRelUuid INTO oldPartnerRel;
assert oldPartnerRel.uuid is not null, format('oldPartnerRel must not be null for OLD.partnerRelUuid = %s', OLD.partnerRelUuid);
SELECT * FROM hs_office_relation WHERE uuid = NEW.partnerRelUuid INTO newPartnerRel;
SELECT * FROM hs_office.relation WHERE uuid = NEW.partnerRelUuid INTO newPartnerRel;
assert newPartnerRel.uuid is not null, format('newPartnerRel must not be null for NEW.partnerRelUuid = %s', NEW.partnerRelUuid);
SELECT * FROM hs_office_partner_details WHERE uuid = OLD.detailsUuid INTO oldPartnerDetails;
SELECT * FROM hs_office.partner_details WHERE uuid = OLD.detailsUuid INTO oldPartnerDetails;
assert oldPartnerDetails.uuid is not null, format('oldPartnerDetails must not be null for OLD.detailsUuid = %s', OLD.detailsUuid);
SELECT * FROM hs_office_partner_details WHERE uuid = NEW.detailsUuid INTO newPartnerDetails;
SELECT * FROM hs_office.partner_details WHERE uuid = NEW.detailsUuid INTO newPartnerDetails;
assert newPartnerDetails.uuid is not null, format('newPartnerDetails must not be null for NEW.detailsUuid = %s', NEW.detailsUuid);
@ -134,22 +134,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to re-wire the grant structure for a new hs_office_partner row.
AFTER UPDATE TRIGGER to re-wire the grant structure for a new hs_office.partner row.
*/
create or replace function updateTriggerForHsOfficePartner_tf()
create or replace function hs_office.partner_update_rbac_system_after_update_tf()
returns trigger
language plpgsql
strict as $$
begin
call updateRbacRulesForHsOfficePartner(OLD, NEW);
call hs_office.partner_update_rbac_system(OLD, NEW);
return NEW;
end; $$;
create trigger updateTriggerForHsOfficePartner_tg
after update on hs_office_partner
create trigger update_rbac_system_after_update_tg
after update on hs_office.partner
for each row
execute procedure updateTriggerForHsOfficePartner_tf();
execute procedure hs_office.partner_update_rbac_system_after_update_tf();
--//
@ -160,45 +160,45 @@ execute procedure updateTriggerForHsOfficePartner_tf();
-- granting INSERT permission to rbac.global ----------------------------
/*
Grants INSERT INTO hs_office_partner permissions to specified role of pre-existing rbac.global rows.
Grants INSERT INTO hs_office.partner permissions to specified role of pre-existing rbac.global rows.
*/
do language plpgsql $$
declare
row rbac.global;
begin
call base.defineContext('create INSERT INTO hs_office_partner permissions for pre-exising rbac.global rows');
call base.defineContext('create INSERT INTO hs_office.partner permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_partner'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.partner'),
rbac.globalADMIN());
END LOOP;
end;
$$;
/**
Grants hs_office_partner INSERT permission to specified role of new global rows.
Grants hs_office.partner INSERT permission to specified role of new global rows.
*/
create or replace function new_hsof_partner_grants_insert_to_global_tf()
create or replace function hs_office.new_partner_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_partner'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.partner'),
rbac.globalADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_partner_grants_after_insert_tg
create trigger z_new_partner_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure new_hsof_partner_grants_insert_to_global_tf();
execute procedure hs_office.new_partner_grants_insert_to_global_tf();
-- ============================================================================
@ -206,27 +206,27 @@ execute procedure new_hsof_partner_grants_insert_to_global_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_partner.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.partner.
*/
create or replace function hs_office_partner_insert_permission_check_tf()
create or replace function hs_office.partner_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT INSERT if rbac.global ADMIN
-- check INSERT permission if rbac.global ADMIN
if rbac.isGlobalAdmin() then
return NEW;
end if;
raise exception '[403] insert into hs_office_partner values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.partner values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_partner_insert_permission_check_tg
before insert on hs_office_partner
create trigger partner_insert_permission_check_tg
before insert on hs_office.partner
for each row
execute procedure hs_office_partner_insert_permission_check_tf();
execute procedure hs_office.partner_insert_permission_check_tf();
--//
@ -234,7 +234,7 @@ create trigger hs_office_partner_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-partner-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_partner',
call rbac.generateRbacIdentityViewFromProjection('hs_office.partner',
$idName$
'P-' || partnerNumber
$idName$);
@ -244,7 +244,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_partner',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-partner-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_partner',
call rbac.generateRbacRestrictedView('hs_office.partner',
$orderBy$
'P-' || partnerNumber
$orderBy$,

60
src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-partner-details-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_partner_details');
call rbac.generateRelatedRbacObject('hs_office.partner_details');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-partner-details-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePartnerDetails', 'hs_office_partner_details');
call rbac.generateRbacRoleDescriptors('hsOfficePartnerDetails', 'hs_office.partner_details');
--//
@ -24,8 +24,8 @@ call rbac.generateRbacRoleDescriptors('hsOfficePartnerDetails', 'hs_office_partn
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficePartnerDetails(
NEW hs_office_partner_details
create or replace procedure hs_office.partner_details_build_rbac_system(
NEW hs_office.partner_details
)
language plpgsql as $$
@ -38,22 +38,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_partner_details row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.partner_details row.
*/
create or replace function insertTriggerForHsOfficePartnerDetails_tf()
create or replace function hs_office.partner_details_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficePartnerDetails(NEW);
call hs_office.partner_details_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficePartnerDetails_tg
after insert on hs_office_partner_details
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.partner_details
for each row
execute procedure insertTriggerForHsOfficePartnerDetails_tf();
execute procedure hs_office.partner_details_build_rbac_system_after_insert_tf();
--//
@ -64,45 +64,45 @@ execute procedure insertTriggerForHsOfficePartnerDetails_tf();
-- granting INSERT permission to rbac.global ----------------------------
/*
Grants INSERT INTO hs_office_partner_details permissions to specified role of pre-existing rbac.global rows.
Grants INSERT INTO hs_office.partner_details permissions to specified role of pre-existing rbac.global rows.
*/
do language plpgsql $$
declare
row rbac.global;
begin
call base.defineContext('create INSERT INTO hs_office_partner_details permissions for pre-exising rbac.global rows');
call base.defineContext('create INSERT INTO hs_office.partner_details permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_partner_details'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.partner_details'),
rbac.globalADMIN());
END LOOP;
end;
$$;
/**
Grants hs_office_partner_details INSERT permission to specified role of new global rows.
Grants hs_office.partner_details INSERT permission to specified role of new global rows.
*/
create or replace function new_hsof_partner_details_grants_insert_to_global_tf()
create or replace function hs_office.new_partner_details_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_partner_details'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.partner_details'),
rbac.globalADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_partner_details_grants_after_insert_tg
create trigger z_new_partner_details_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure new_hsof_partner_details_grants_insert_to_global_tf();
execute procedure hs_office.new_partner_details_grants_insert_to_global_tf();
-- ============================================================================
@ -110,27 +110,27 @@ execute procedure new_hsof_partner_details_grants_insert_to_global_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_partner_details.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.partner_details.
*/
create or replace function hs_office_partner_details_insert_permission_check_tf()
create or replace function hs_office.partner_details_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT INSERT if rbac.global ADMIN
-- check INSERT permission if rbac.global ADMIN
if rbac.isGlobalAdmin() then
return NEW;
end if;
raise exception '[403] insert into hs_office_partner_details values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.partner_details values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_partner_details_insert_permission_check_tg
before insert on hs_office_partner_details
create trigger partner_details_insert_permission_check_tg
before insert on hs_office.partner_details
for each row
execute procedure hs_office_partner_details_insert_permission_check_tf();
execute procedure hs_office.partner_details_insert_permission_check_tf();
--//
@ -138,12 +138,12 @@ create trigger hs_office_partner_details_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-partner-details-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromQuery('hs_office_partner_details',
call rbac.generateRbacIdentityViewFromQuery('hs_office.partner_details',
$idName$
SELECT partnerDetails.uuid as uuid, partner_iv.idName as idName
FROM hs_office_partner_details AS partnerDetails
JOIN hs_office_partner partner ON partner.detailsUuid = partnerDetails.uuid
JOIN hs_office_partner_iv partner_iv ON partner_iv.uuid = partner.uuid
FROM hs_office.partner_details AS partnerDetails
JOIN hs_office.partner partner ON partner.detailsUuid = partnerDetails.uuid
JOIN hs_office.partner_iv partner_iv ON partner_iv.uuid = partner.uuid
$idName$);
--//
@ -151,7 +151,7 @@ call rbac.generateRbacIdentityViewFromQuery('hs_office_partner_details',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-partner-details-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_partner_details',
call rbac.generateRbacRestrictedView('hs_office.partner_details',
$orderBy$
uuid
$orderBy$,

26
src/main/resources/db/changelog/5-hs-office/504-partner/5046-hs-office-partner-migration.sql
View File

@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-partner-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office_partner_legacy_id
CREATE TABLE hs_office.partner_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office_partner(uuid),
uuid uuid NOT NULL REFERENCES hs_office.partner(uuid),
bp_id integer NOT NULL
);
--//
@ -19,10 +19,10 @@ CREATE TABLE hs_office_partner_legacy_id
--changeset michael.hoennig:hs-office-partner-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office_partner_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.partner_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office_partner_legacy_id.bp_id;
OWNED BY hs_office.partner_legacy_id.bp_id;
--//
@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office_partner_legacy_id_seq
--changeset michael.hoennig:hs-office-partner-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office_partner_legacy_id
ALTER TABLE hs_office.partner_legacy_id
ALTER COLUMN bp_id
SET DEFAULT nextVal('hs_office_partner_legacy_id_seq');
SET DEFAULT nextVal('hs_office.partner_legacy_id_seq');
--/
-- ============================================================================
@ -40,8 +40,8 @@ ALTER TABLE hs_office_partner_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office_partner_legacy_id(uuid, bp_id)
SELECT uuid, nextVal('hs_office_partner_legacy_id_seq') FROM hs_office_partner;
INSERT INTO hs_office.partner_legacy_id(uuid, bp_id)
SELECT uuid, nextVal('hs_office.partner_legacy_id_seq') FROM hs_office.partner;
--/
@ -57,14 +57,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office_partner_legacy_id VALUES
(NEW.uuid, nextVal('hs_office_partner_legacy_id_seq'));
INSERT INTO hs_office.partner_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.partner_legacy_id_seq'));
return NEW;
end; $$;
create trigger createPartnerLegacyIdMapping
after insert on hs_office_partner
after insert on hs_office.partner
for each row
execute procedure insertPartnerLegacyIdMapping();
--/
@ -82,14 +82,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office_partner_legacy_id
DELETE FROM hs_office.partner_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removePartnerLegacyIdMapping
before delete on hs_office_partner
before delete on hs_office.partner
for each row
execute procedure deletePartnerLegacyIdMapping();
--/

18
src/main/resources/db/changelog/5-hs-office/504-partner/5048-hs-office-partner-test-data.sql
View File

@ -16,25 +16,25 @@ create or replace procedure createHsOfficePartnerTestData(
language plpgsql as $$
declare
idName varchar;
mandantPerson hs_office_person;
partnerRel hs_office_relation;
relatedPerson hs_office_person;
mandantPerson hs_office.person;
partnerRel hs_office.relation;
relatedPerson hs_office.person;
relatedDetailsUuid uuid;
begin
idName := base.cleanIdentifier( partnerPersonName|| '-' || contactCaption);
select p.* from hs_office_person p
select p.* from hs_office.person p
where p.tradeName = mandantTradeName
into mandantPerson;
if mandantPerson is null then
raise exception 'mandant "%" not found', mandantTradeName;
end if;
select p.* from hs_office_person p
select p.* from hs_office.person p
where p.tradeName = partnerPersonName or p.familyName = partnerPersonName
into relatedPerson;
select r.* from hs_office_relation r
select r.* from hs_office.relation r
where r.type = 'PARTNER'
and r.anchoruuid = mandantPerson.uuid and r.holderuuid = relatedPerson.uuid
into partnerRel;
@ -48,18 +48,18 @@ begin
if relatedPerson.persontype = 'NP' then
insert
into hs_office_partner_details (uuid, birthName, birthday, birthPlace)
into hs_office.partner_details (uuid, birthName, birthday, birthPlace)
values (uuid_generate_v4(), 'Meyer', '1987-10-31', 'Hamburg')
returning uuid into relatedDetailsUuid;
else
insert
into hs_office_partner_details (uuid, registrationOffice, registrationNumber)
into hs_office.partner_details (uuid, registrationOffice, registrationNumber)
values (uuid_generate_v4(), 'Hamburg', 'RegNo123456789')
returning uuid into relatedDetailsUuid;
end if;
insert
into hs_office_partner (uuid, partnerNumber, partnerRelUuid, detailsUuid)
into hs_office.partner (uuid, partnerNumber, partnerRelUuid, detailsUuid)
values (uuid_generate_v4(), newPartnerNumber, partnerRel.uuid, relatedDetailsUuid);
end; $$;
--//

4
src/main/resources/db/changelog/5-hs-office/505-bankaccount/5050-hs-office-bankaccount.sql
View File

@ -3,7 +3,7 @@
--changeset michael.hoennig:hs-office-bankaccount-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table hs_office_bankaccount
create table hs_office.bankaccount
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
@ -18,5 +18,5 @@ create table hs_office_bankaccount
--changeset michael.hoennig:hs-office-bankaccount-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_bankaccount');
call base.create_journal('hs_office.bankaccount');
--//

24
src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-bankaccount-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_bankaccount');
call rbac.generateRelatedRbacObject('hs_office.bankaccount');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-bankaccount-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeBankAccount', 'hs_office_bankaccount');
call rbac.generateRbacRoleDescriptors('hsOfficeBankAccount', 'hs_office.bankaccount');
--//
@ -24,8 +24,8 @@ call rbac.generateRbacRoleDescriptors('hsOfficeBankAccount', 'hs_office_bankacco
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeBankAccount(
NEW hs_office_bankaccount
create or replace procedure hs_office.bankaccount_build_rbac_system(
NEW hs_office.bankaccount
)
language plpgsql as $$
@ -57,22 +57,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_bankaccount row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.bankaccount row.
*/
create or replace function insertTriggerForHsOfficeBankAccount_tf()
create or replace function hs_office.bankaccount_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeBankAccount(NEW);
call hs_office.bankaccount_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeBankAccount_tg
after insert on hs_office_bankaccount
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.bankaccount
for each row
execute procedure insertTriggerForHsOfficeBankAccount_tf();
execute procedure hs_office.bankaccount_build_rbac_system_after_insert_tf();
--//
@ -80,7 +80,7 @@ execute procedure insertTriggerForHsOfficeBankAccount_tf();
--changeset RbacIdentityViewGenerator:hs-office-bankaccount-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_bankaccount',
call rbac.generateRbacIdentityViewFromProjection('hs_office.bankaccount',
$idName$
iban
$idName$);
@ -90,7 +90,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_bankaccount',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-bankaccount-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_bankaccount',
call rbac.generateRbacRestrictedView('hs_office.bankaccount',
$orderBy$
iban
$orderBy$,

2
src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql
View File

@ -19,7 +19,7 @@ begin
raise notice 'creating test bankaccount: %', givenHolder;
insert
into hs_office_bankaccount(uuid, holder, iban, bic)
into hs_office.bankaccount(uuid, holder, iban, bic)
values (uuid_generate_v4(), givenHolder, givenIBAN, givenBIC);
end; $$;
--//

20
src/main/resources/db/changelog/5-hs-office/506-debitor/5060-hs-office-debitor.sql
View File

@ -4,18 +4,18 @@
--changeset michael.hoennig:hs-office-debitor-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table hs_office_debitor
create table hs_office.debitor
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
debitorNumberSuffix char(2) not null check (debitorNumberSuffix::text ~ '^[0-9][0-9]$'),
debitorRelUuid uuid not null references hs_office_relation(uuid),
debitorRelUuid uuid not null references hs_office.relation(uuid),
billable boolean not null default true,
vatId varchar(24),
vatCountryCode varchar(2),
vatBusiness boolean not null,
vatReverseCharge boolean not null,
refundBankAccountUuid uuid references hs_office_bankaccount(uuid),
refundBankAccountUuid uuid references hs_office.bankaccount(uuid),
defaultPrefix char(3) not null unique
constraint check_default_prefix check (
defaultPrefix::text ~ '^([a-z]{3}|al0|bh1|c4s|f3k|k8i|l3d|mh1|o13|p2m|s80|t4w)$'
@ -29,16 +29,16 @@ create table hs_office_debitor
-- ----------------------------------------------------------------------------
/**
Trigger function to delete related rows of a debitor to delete.
Trigger function to delete related relations of a debitor to delete.
*/
create or replace function deleteHsOfficeDependentsOnDebitorDelete()
create or replace function hs_office.debitor_delete_dependents_tf()
returns trigger
language PLPGSQL
as $$
declare
counter integer;
begin
DELETE FROM hs_office_relation r WHERE r.uuid = OLD.debitorRelUuid;
DELETE FROM hs_office.relation r WHERE r.uuid = OLD.debitorRelUuid;
GET DIAGNOSTICS counter = ROW_COUNT;
if counter = 0 then
raise exception 'debitor relation % could not be deleted', OLD.debitorRelUuid;
@ -50,16 +50,16 @@ end; $$;
/**
Triggers deletion of related details of a debitor to delete.
*/
create trigger hs_office_debitor_delete_dependents_trigger
create trigger debitor_delete_dependents_tg
after delete
on hs_office_debitor
on hs_office.debitor
for each row
execute procedure deleteHsOfficeDependentsOnDebitorDelete();
execute procedure hs_office.debitor_delete_dependents_tf();
-- ============================================================================
--changeset michael.hoennig:hs-office-debitor-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_debitor');
call base.create_journal('hs_office.debitor');
--//

96
src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-debitor-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_debitor');
call rbac.generateRelatedRbacObject('hs_office.debitor');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-debitor-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeDebitor', 'hs_office_debitor');
call rbac.generateRbacRoleDescriptors('hsOfficeDebitor', 'hs_office.debitor');
--//
@ -24,32 +24,32 @@ call rbac.generateRbacRoleDescriptors('hsOfficeDebitor', 'hs_office_debitor');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeDebitor(
NEW hs_office_debitor
create or replace procedure hs_office.debitor_build_rbac_system(
NEW hs_office.debitor
)
language plpgsql as $$
declare
newPartnerRel hs_office_relation;
newDebitorRel hs_office_relation;
newRefundBankAccount hs_office_bankaccount;
newPartnerRel hs_office.relation;
newDebitorRel hs_office.relation;
newRefundBankAccount hs_office.bankaccount;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT partnerRel.*
FROM hs_office_relation AS partnerRel
JOIN hs_office_relation AS debitorRel
FROM hs_office.relation AS partnerRel
JOIN hs_office.relation AS debitorRel
ON debitorRel.type = 'DEBITOR' AND debitorRel.anchorUuid = partnerRel.holderUuid
WHERE partnerRel.type = 'PARTNER'
AND NEW.debitorRelUuid = debitorRel.uuid
INTO newPartnerRel;
assert newPartnerRel.uuid is not null, format('newPartnerRel must not be null for NEW.debitorRelUuid = %s', NEW.debitorRelUuid);
SELECT * FROM hs_office_relation WHERE uuid = NEW.debitorRelUuid INTO newDebitorRel;
SELECT * FROM hs_office.relation WHERE uuid = NEW.debitorRelUuid INTO newDebitorRel;
assert newDebitorRel.uuid is not null, format('newDebitorRel must not be null for NEW.debitorRelUuid = %s', NEW.debitorRelUuid);
SELECT * FROM hs_office_bankaccount WHERE uuid = NEW.refundBankAccountUuid INTO newRefundBankAccount;
SELECT * FROM hs_office.bankaccount WHERE uuid = NEW.refundBankAccountUuid INTO newRefundBankAccount;
call rbac.grantRoleToRole(hsOfficeBankAccountREFERRER(newRefundBankAccount), hsOfficeRelationAGENT(newDebitorRel));
call rbac.grantRoleToRole(hsOfficeRelationADMIN(newDebitorRel), hsOfficeRelationADMIN(newPartnerRel));
@ -65,22 +65,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_debitor row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.debitor row.
*/
create or replace function insertTriggerForHsOfficeDebitor_tf()
create or replace function hs_office.debitor_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeDebitor(NEW);
call hs_office.debitor_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeDebitor_tg
after insert on hs_office_debitor
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.debitor
for each row
execute procedure insertTriggerForHsOfficeDebitor_tf();
execute procedure hs_office.debitor_build_rbac_system_after_insert_tf();
--//
@ -92,9 +92,9 @@ execute procedure insertTriggerForHsOfficeDebitor_tf();
Called from the AFTER UPDATE TRIGGER to re-wire the grants.
*/
create or replace procedure updateRbacRulesForHsOfficeDebitor(
OLD hs_office_debitor,
NEW hs_office_debitor
create or replace procedure hs_office.debitor_update_rbac_system(
OLD hs_office.debitor,
NEW hs_office.debitor
)
language plpgsql as $$
begin
@ -102,27 +102,27 @@ begin
if NEW.debitorRelUuid is distinct from OLD.debitorRelUuid
or NEW.refundBankAccountUuid is distinct from OLD.refundBankAccountUuid then
delete from rbac.grants g where g.grantedbytriggerof = OLD.uuid;
call buildRbacSystemForHsOfficeDebitor(NEW);
call hs_office.debitor_build_rbac_system(NEW);
end if;
end; $$;
/*
AFTER INSERT TRIGGER to re-wire the grant structure for a new hs_office_debitor row.
AFTER UPDATE TRIGGER to re-wire the grant structure for a new hs_office.debitor row.
*/
create or replace function updateTriggerForHsOfficeDebitor_tf()
create or replace function hs_office.debitor_update_rbac_system_after_update_tf()
returns trigger
language plpgsql
strict as $$
begin
call updateRbacRulesForHsOfficeDebitor(OLD, NEW);
call hs_office.debitor_update_rbac_system(OLD, NEW);
return NEW;
end; $$;
create trigger updateTriggerForHsOfficeDebitor_tg
after update on hs_office_debitor
create trigger update_rbac_system_after_update_tg
after update on hs_office.debitor
for each row
execute procedure updateTriggerForHsOfficeDebitor_tf();
execute procedure hs_office.debitor_update_rbac_system_after_update_tf();
--//
@ -133,45 +133,45 @@ execute procedure updateTriggerForHsOfficeDebitor_tf();
-- granting INSERT permission to rbac.global ----------------------------
/*
Grants INSERT INTO hs_office_debitor permissions to specified role of pre-existing rbac.global rows.
Grants INSERT INTO hs_office.debitor permissions to specified role of pre-existing rbac.global rows.
*/
do language plpgsql $$
declare
row rbac.global;
begin
call base.defineContext('create INSERT INTO hs_office_debitor permissions for pre-exising rbac.global rows');
call base.defineContext('create INSERT INTO hs_office.debitor permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_debitor'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.debitor'),
rbac.globalADMIN());
END LOOP;
end;
$$;
/**
Grants hs_office_debitor INSERT permission to specified role of new global rows.
Grants hs_office.debitor INSERT permission to specified role of new global rows.
*/
create or replace function new_hsof_debitor_grants_insert_to_global_tf()
create or replace function hs_office.new_debitor_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_debitor'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.debitor'),
rbac.globalADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_debitor_grants_after_insert_tg
create trigger z_new_debitor_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure new_hsof_debitor_grants_insert_to_global_tf();
execute procedure hs_office.new_debitor_grants_insert_to_global_tf();
-- ============================================================================
@ -179,27 +179,27 @@ execute procedure new_hsof_debitor_grants_insert_to_global_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_debitor.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.debitor.
*/
create or replace function hs_office_debitor_insert_permission_check_tf()
create or replace function hs_office.debitor_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT INSERT if rbac.global ADMIN
-- check INSERT permission if rbac.global ADMIN
if rbac.isGlobalAdmin() then
return NEW;
end if;
raise exception '[403] insert into hs_office_debitor values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.debitor values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_debitor_insert_permission_check_tg
before insert on hs_office_debitor
create trigger debitor_insert_permission_check_tg
before insert on hs_office.debitor
for each row
execute procedure hs_office_debitor_insert_permission_check_tf();
execute procedure hs_office.debitor_insert_permission_check_tf();
--//
@ -207,18 +207,18 @@ create trigger hs_office_debitor_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-debitor-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromQuery('hs_office_debitor',
call rbac.generateRbacIdentityViewFromQuery('hs_office.debitor',
$idName$
SELECT debitor.uuid AS uuid,
'D-' || (SELECT partner.partnerNumber
FROM hs_office_partner partner
JOIN hs_office_relation partnerRel
FROM hs_office.partner partner
JOIN hs_office.relation partnerRel
ON partnerRel.uuid = partner.partnerRelUUid AND partnerRel.type = 'PARTNER'
JOIN hs_office_relation debitorRel
JOIN hs_office.relation debitorRel
ON debitorRel.anchorUuid = partnerRel.holderUuid AND debitorRel.type = 'DEBITOR'
WHERE debitorRel.uuid = debitor.debitorRelUuid)
|| debitorNumberSuffix as idName
FROM hs_office_debitor AS debitor
FROM hs_office.debitor AS debitor
$idName$);
--//
@ -226,7 +226,7 @@ call rbac.generateRbacIdentityViewFromQuery('hs_office_debitor',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-debitor-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_debitor',
call rbac.generateRbacRestrictedView('hs_office.debitor',
$orderBy$
defaultPrefix
$orderBy$,

8
src/main/resources/db/changelog/5-hs-office/506-debitor/5068-hs-office-debitor-test-data.sql
View File

@ -24,21 +24,21 @@ begin
select debitorRel.uuid
into relatedDebitorRelUuid
from hs_office_relation debitorRel
join hs_office_person person on person.uuid = debitorRel.holderUuid
from hs_office.relation debitorRel
join hs_office.person person on person.uuid = debitorRel.holderUuid
and (person.tradeName = forPartnerPersonName or person.familyName = forPartnerPersonName)
where debitorRel.type = 'DEBITOR';
select b.uuid
into relatedBankAccountUuid
from hs_office_bankaccount b
from hs_office.bankaccount b
where b.holder = forPartnerPersonName;
raise notice 'creating test debitor: % (#%)', idName, withDebitorNumberSuffix;
-- raise exception 'creating test debitor: (uuid=%, debitorRelUuid=%, debitornumbersuffix=%, billable=%, vatbusiness=%, vatreversecharge=%, refundbankaccountuuid=%, defaultprefix=%)',
-- uuid_generate_v4(), relatedDebitorRelUuid, withDebitorNumberSuffix, true, true, false, relatedBankAccountUuid, withDefaultPrefix;
insert
into hs_office_debitor (uuid, debitorRelUuid, debitornumbersuffix, billable, vatbusiness, vatreversecharge, refundbankaccountuuid, defaultprefix)
into hs_office.debitor (uuid, debitorRelUuid, debitornumbersuffix, billable, vatbusiness, vatreversecharge, refundbankaccountuuid, defaultprefix)
values (uuid_generate_v4(), relatedDebitorRelUuid, withDebitorNumberSuffix, true, true, false, relatedBankAccountUuid, withDefaultPrefix);
end; $$;
--//

8
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5070-hs-office-sepamandate.sql
View File

@ -4,12 +4,12 @@
--changeset michael.hoennig:hs-office-sepamandate-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists hs_office_sepamandate
create table if not exists hs_office.sepamandate
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
debitorUuid uuid not null references hs_office_debitor(uuid),
bankAccountUuid uuid not null references hs_office_bankaccount(uuid),
debitorUuid uuid not null references hs_office.debitor(uuid),
bankAccountUuid uuid not null references hs_office.bankaccount(uuid),
reference varchar(96) not null,
agreement date not null,
validity daterange not null
@ -21,5 +21,5 @@ create table if not exists hs_office_sepamandate
--changeset michael.hoennig:hs-office-sepamandate-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_sepamandate');
call base.create_journal('hs_office.sepamandate');
--//

82
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-sepamandate-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_sepamandate');
call rbac.generateRelatedRbacObject('hs_office.sepamandate');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-sepamandate-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeSepaMandate', 'hs_office_sepamandate');
call rbac.generateRbacRoleDescriptors('hsOfficeSepaMandate', 'hs_office.sepamandate');
--//
@ -24,24 +24,24 @@ call rbac.generateRbacRoleDescriptors('hsOfficeSepaMandate', 'hs_office_sepamand
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeSepaMandate(
NEW hs_office_sepamandate
create or replace procedure hs_office.sepamandate_build_rbac_system(
NEW hs_office.sepamandate
)
language plpgsql as $$
declare
newBankAccount hs_office_bankaccount;
newDebitorRel hs_office_relation;
newBankAccount hs_office.bankaccount;
newDebitorRel hs_office.relation;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_bankaccount WHERE uuid = NEW.bankAccountUuid INTO newBankAccount;
SELECT * FROM hs_office.bankaccount WHERE uuid = NEW.bankAccountUuid INTO newBankAccount;
assert newBankAccount.uuid is not null, format('newBankAccount must not be null for NEW.bankAccountUuid = %s', NEW.bankAccountUuid);
SELECT debitorRel.*
FROM hs_office_relation debitorRel
JOIN hs_office_debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
FROM hs_office.relation debitorRel
JOIN hs_office.debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
WHERE debitor.uuid = NEW.debitorUuid
INTO newDebitorRel;
assert newDebitorRel.uuid is not null, format('newDebitorRel must not be null for NEW.debitorUuid = %s', NEW.debitorUuid);
@ -82,22 +82,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_sepamandate row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.sepamandate row.
*/
create or replace function insertTriggerForHsOfficeSepaMandate_tf()
create or replace function hs_office.sepamandate_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeSepaMandate(NEW);
call hs_office.sepamandate_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeSepaMandate_tg
after insert on hs_office_sepamandate
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.sepamandate
for each row
execute procedure insertTriggerForHsOfficeSepaMandate_tf();
execute procedure hs_office.sepamandate_build_rbac_system_after_insert_tf();
--//
@ -105,48 +105,48 @@ execute procedure insertTriggerForHsOfficeSepaMandate_tf();
--changeset InsertTriggerGenerator:hs-office-sepamandate-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office_relation ----------------------------
-- granting INSERT permission to hs_office.relation ----------------------------
/*
Grants INSERT INTO hs_office_sepamandate permissions to specified role of pre-existing hs_office_relation rows.
Grants INSERT INTO hs_office.sepamandate permissions to specified role of pre-existing hs_office.relation rows.
*/
do language plpgsql $$
declare
row hs_office_relation;
row hs_office.relation;
begin
call base.defineContext('create INSERT INTO hs_office_sepamandate permissions for pre-exising hs_office_relation rows');
call base.defineContext('create INSERT INTO hs_office.sepamandate permissions for pre-exising hs_office.relation rows');
FOR row IN SELECT * FROM hs_office_relation
FOR row IN SELECT * FROM hs_office.relation
WHERE type = 'DEBITOR'
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_sepamandate'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.sepamandate'),
hsOfficeRelationADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office_sepamandate INSERT permission to specified role of new hs_office_relation rows.
Grants hs_office.sepamandate INSERT permission to specified role of new relation rows.
*/
create or replace function new_hsof_sepamandate_grants_insert_to_hsof_relation_tf()
create or replace function hs_office.new_sepamandate_grants_insert_to_relation_tf()
returns trigger
language plpgsql
strict as $$
begin
if NEW.type = 'DEBITOR' then
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_sepamandate'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.sepamandate'),
hsOfficeRelationADMIN(NEW));
end if;
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_sepamandate_grants_after_insert_tg
after insert on hs_office_relation
create trigger z_new_sepamandate_grants_after_insert_tg
after insert on hs_office.relation
for each row
execute procedure new_hsof_sepamandate_grants_insert_to_hsof_relation_tf();
execute procedure hs_office.new_sepamandate_grants_insert_to_relation_tf();
-- ============================================================================
@ -154,9 +154,9 @@ execute procedure new_hsof_sepamandate_grants_insert_to_hsof_relation_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_sepamandate.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.sepamandate.
*/
create or replace function hs_office_sepamandate_insert_permission_check_tf()
create or replace function hs_office.sepamandate_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
@ -164,23 +164,23 @@ declare
begin
-- check INSERT permission via indirect foreign key: NEW.debitorUuid
superObjectUuid := (SELECT debitorRel.uuid
FROM hs_office_relation debitorRel
JOIN hs_office_debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
FROM hs_office.relation debitorRel
JOIN hs_office.debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
WHERE debitor.uuid = NEW.debitorUuid
);
assert superObjectUuid is not null, 'object uuid fetched depending on hs_office_sepamandate.debitorUuid must not be null, also check fetchSql in RBAC DSL';
if rbac.hasInsertPermission(superObjectUuid, 'hs_office_sepamandate') then
assert superObjectUuid is not null, 'object uuid fetched depending on hs_office.sepamandate.debitorUuid must not be null, also check fetchSql in RBAC DSL';
if rbac.hasInsertPermission(superObjectUuid, 'hs_office.sepamandate') then
return NEW;
end if;
raise exception '[403] insert into hs_office_sepamandate values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.sepamandate values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_sepamandate_insert_permission_check_tg
before insert on hs_office_sepamandate
create trigger sepamandate_insert_permission_check_tg
before insert on hs_office.sepamandate
for each row
execute procedure hs_office_sepamandate_insert_permission_check_tf();
execute procedure hs_office.sepamandate_insert_permission_check_tf();
--//
@ -188,11 +188,11 @@ create trigger hs_office_sepamandate_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-sepamandate-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromQuery('hs_office_sepamandate',
call rbac.generateRbacIdentityViewFromQuery('hs_office.sepamandate',
$idName$
select sm.uuid as uuid, ba.iban || '-' || sm.validity as idName
from hs_office_sepamandate sm
join hs_office_bankaccount ba on ba.uuid = sm.bankAccountUuid
from hs_office.sepamandate sm
join hs_office.bankaccount ba on ba.uuid = sm.bankAccountUuid
$idName$);
--//
@ -200,7 +200,7 @@ call rbac.generateRbacIdentityViewFromQuery('hs_office_sepamandate',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-sepamandate-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_sepamandate',
call rbac.generateRbacRestrictedView('hs_office.sepamandate',
$orderBy$
validity
$orderBy$,

26
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5076-hs-office-sepamandate-migration.sql
View File

@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-sepamandate-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office_sepamandate_legacy_id
CREATE TABLE hs_office.sepamandate_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office_sepamandate(uuid),
uuid uuid NOT NULL REFERENCES hs_office.sepamandate(uuid),
sepa_mandate_id integer NOT NULL
);
--//
@ -19,10 +19,10 @@ CREATE TABLE hs_office_sepamandate_legacy_id
--changeset michael.hoennig:hs-office-sepamandate-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office_sepamandate_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.sepamandate_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office_sepamandate_legacy_id.sepa_mandate_id;
OWNED BY hs_office.sepamandate_legacy_id.sepa_mandate_id;
--//
@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office_sepamandate_legacy_id_seq
--changeset michael.hoennig:hs-office-sepamandate-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office_sepamandate_legacy_id
ALTER TABLE hs_office.sepamandate_legacy_id
ALTER COLUMN sepa_mandate_id
SET DEFAULT nextVal('hs_office_sepamandate_legacy_id_seq');
SET DEFAULT nextVal('hs_office.sepamandate_legacy_id_seq');
--/
@ -42,8 +42,8 @@ ALTER TABLE hs_office_sepamandate_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office_sepamandate_legacy_id(uuid, sepa_mandate_id)
SELECT uuid, nextVal('hs_office_sepamandate_legacy_id_seq') FROM hs_office_sepamandate;
INSERT INTO hs_office.sepamandate_legacy_id(uuid, sepa_mandate_id)
SELECT uuid, nextVal('hs_office.sepamandate_legacy_id_seq') FROM hs_office.sepamandate;
--/
@ -59,14 +59,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office_sepamandate_legacy_id VALUES
(NEW.uuid, nextVal('hs_office_sepamandate_legacy_id_seq'));
INSERT INTO hs_office.sepamandate_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.sepamandate_legacy_id_seq'));
return NEW;
end; $$;
create trigger createSepaMandateLegacyIdMapping
after insert on hs_office_sepamandate
after insert on hs_office.sepamandate
for each row
execute procedure insertSepaMandateLegacyIdMapping();
--/
@ -84,14 +84,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office_sepamandate_legacy_id
DELETE FROM hs_office.sepamandate_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removeSepaMandateLegacyIdMapping
before delete on hs_office_sepamandate
before delete on hs_office.sepamandate
for each row
execute procedure deleteSepaMandateLegacyIdMapping();
--/

16
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5078-hs-office-sepamandate-test-data.sql
View File

@ -15,23 +15,23 @@ create or replace procedure createHsOfficeSepaMandateTestData(
withReference varchar)
language plpgsql as $$
declare
relatedDebitor hs_office_debitor;
relatedBankAccount hs_office_bankAccount;
relatedDebitor hs_office.debitor;
relatedBankAccount hs_office.bankAccount;
begin
select debitor.* into relatedDebitor
from hs_office_debitor debitor
join hs_office_relation debitorRel on debitorRel.uuid = debitor.debitorRelUuid
join hs_office_relation partnerRel on partnerRel.holderUuid = debitorRel.anchorUuid
join hs_office_partner partner on partner.partnerRelUuid = partnerRel.uuid
from hs_office.debitor debitor
join hs_office.relation debitorRel on debitorRel.uuid = debitor.debitorRelUuid
join hs_office.relation partnerRel on partnerRel.holderUuid = debitorRel.anchorUuid
join hs_office.partner partner on partner.partnerRelUuid = partnerRel.uuid
where partner.partnerNumber = forPartnerNumber and debitor.debitorNumberSuffix = forDebitorSuffix;
select b.* into relatedBankAccount
from hs_office_bankAccount b where b.iban = forIban;
from hs_office.bankAccount b where b.iban = forIban;
raise notice 'creating test SEPA-mandate: %', forPartnerNumber::text || forDebitorSuffix::text;
raise notice '- using debitor (%): %', relatedDebitor.uuid, relatedDebitor;
raise notice '- using bankAccount (%): %', relatedBankAccount.uuid, relatedBankAccount;
insert
into hs_office_sepamandate (uuid, debitoruuid, bankAccountuuid, reference, agreement, validity)
into hs_office.sepamandate (uuid, debitoruuid, bankAccountuuid, reference, agreement, validity)
values (uuid_generate_v4(), relatedDebitor.uuid, relatedBankAccount.uuid, withReference, '20220930', daterange('20221001' , '20261231', '[]'));
end; $$;
--//

6
src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql
View File

@ -17,11 +17,11 @@ CREATE TYPE HsOfficeMembershipStatus AS ENUM (
CREATE CAST (character varying as HsOfficeMembershipStatus) WITH INOUT AS IMPLICIT;
create table if not exists hs_office_membership
create table if not exists hs_office.membership
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
partnerUuid uuid not null references hs_office_partner(uuid),
partnerUuid uuid not null references hs_office.partner(uuid),
memberNumberSuffix char(2) not null check (memberNumberSuffix::text ~ '^[0-9][0-9]$'),
validity daterange not null,
status HsOfficeMembershipStatus not null default 'ACTIVE',
@ -36,5 +36,5 @@ create table if not exists hs_office_membership
--changeset michael.hoennig:hs-office-membership-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_membership');
call base.create_journal('hs_office.membership');
--//

64
src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-membership-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_membership');
call rbac.generateRelatedRbacObject('hs_office.membership');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-membership-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeMembership', 'hs_office_membership');
call rbac.generateRbacRoleDescriptors('hsOfficeMembership', 'hs_office.membership');
--//
@ -24,20 +24,20 @@ call rbac.generateRbacRoleDescriptors('hsOfficeMembership', 'hs_office_membershi
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeMembership(
NEW hs_office_membership
create or replace procedure hs_office.membership_build_rbac_system(
NEW hs_office.membership
)
language plpgsql as $$
declare
newPartnerRel hs_office_relation;
newPartnerRel hs_office.relation;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT partnerRel.*
FROM hs_office_partner AS partner
JOIN hs_office_relation AS partnerRel ON partnerRel.uuid = partner.partnerRelUuid
FROM hs_office.partner AS partner
JOIN hs_office.relation AS partnerRel ON partnerRel.uuid = partner.partnerRelUuid
WHERE partner.uuid = NEW.partnerUuid
INTO newPartnerRel;
assert newPartnerRel.uuid is not null, format('newPartnerRel must not be null for NEW.partnerUuid = %s', NEW.partnerUuid);
@ -69,22 +69,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_membership row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.membership row.
*/
create or replace function insertTriggerForHsOfficeMembership_tf()
create or replace function hs_office.membership_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeMembership(NEW);
call hs_office.membership_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeMembership_tg
after insert on hs_office_membership
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.membership
for each row
execute procedure insertTriggerForHsOfficeMembership_tf();
execute procedure hs_office.membership_build_rbac_system_after_insert_tf();
--//
@ -95,45 +95,45 @@ execute procedure insertTriggerForHsOfficeMembership_tf();
-- granting INSERT permission to rbac.global ----------------------------
/*
Grants INSERT INTO hs_office_membership permissions to specified role of pre-existing rbac.global rows.
Grants INSERT INTO hs_office.membership permissions to specified role of pre-existing rbac.global rows.
*/
do language plpgsql $$
declare
row rbac.global;
begin
call base.defineContext('create INSERT INTO hs_office_membership permissions for pre-exising rbac.global rows');
call base.defineContext('create INSERT INTO hs_office.membership permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_membership'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.membership'),
rbac.globalADMIN());
END LOOP;
end;
$$;
/**
Grants hs_office_membership INSERT permission to specified role of new global rows.
Grants hs_office.membership INSERT permission to specified role of new global rows.
*/
create or replace function new_hsof_membership_grants_insert_to_global_tf()
create or replace function hs_office.new_membership_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_membership'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.membership'),
rbac.globalADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_membership_grants_after_insert_tg
create trigger z_new_membership_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure new_hsof_membership_grants_insert_to_global_tf();
execute procedure hs_office.new_membership_grants_insert_to_global_tf();
-- ============================================================================
@ -141,27 +141,27 @@ execute procedure new_hsof_membership_grants_insert_to_global_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_membership.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.membership.
*/
create or replace function hs_office_membership_insert_permission_check_tf()
create or replace function hs_office.membership_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT INSERT if rbac.global ADMIN
-- check INSERT permission if rbac.global ADMIN
if rbac.isGlobalAdmin() then
return NEW;
end if;
raise exception '[403] insert into hs_office_membership values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.membership values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_membership_insert_permission_check_tg
before insert on hs_office_membership
create trigger membership_insert_permission_check_tg
before insert on hs_office.membership
for each row
execute procedure hs_office_membership_insert_permission_check_tf();
execute procedure hs_office.membership_insert_permission_check_tf();
--//
@ -169,12 +169,12 @@ create trigger hs_office_membership_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-membership-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromQuery('hs_office_membership',
call rbac.generateRbacIdentityViewFromQuery('hs_office.membership',
$idName$
SELECT m.uuid AS uuid,
'M-' || p.partnerNumber || m.memberNumberSuffix as idName
FROM hs_office_membership AS m
JOIN hs_office_partner AS p ON p.uuid = m.partnerUuid
FROM hs_office.membership AS m
JOIN hs_office.partner AS p ON p.uuid = m.partnerUuid
$idName$);
--//
@ -182,7 +182,7 @@ call rbac.generateRbacIdentityViewFromQuery('hs_office_membership',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-membership-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_membership',
call rbac.generateRbacRestrictedView('hs_office.membership',
$orderBy$
validity
$orderBy$,

6
src/main/resources/db/changelog/5-hs-office/510-membership/5108-hs-office-membership-test-data.sql
View File

@ -13,15 +13,15 @@ create or replace procedure createHsOfficeMembershipTestData(
newMemberNumberSuffix char(2) )
language plpgsql as $$
declare
relatedPartner hs_office_partner;
relatedPartner hs_office.partner;
begin
select partner.* from hs_office_partner partner
select partner.* from hs_office.partner partner
where partner.partnerNumber = forPartnerNumber into relatedPartner;
raise notice 'creating test Membership: M-% %', forPartnerNumber, newMemberNumberSuffix;
raise notice '- using partner (%): %', relatedPartner.uuid, relatedPartner;
insert
into hs_office_membership (uuid, partneruuid, memberNumberSuffix, validity, status)
into hs_office.membership (uuid, partneruuid, memberNumberSuffix, validity, status)
values (uuid_generate_v4(), relatedPartner.uuid, newMemberNumberSuffix, daterange('20221001' , null, '[]'), 'ACTIVE');
end; $$;
--//

18
src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql
View File

@ -8,16 +8,16 @@ CREATE TYPE HsOfficeCoopSharesTransactionType AS ENUM ('ADJUSTMENT', 'SUBSCRIPTI
CREATE CAST (character varying as HsOfficeCoopSharesTransactionType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office_coopsharestransaction
create table if not exists hs_office.coopsharestransaction
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
membershipUuid uuid not null references hs_office_membership(uuid),
membershipUuid uuid not null references hs_office.membership(uuid),
transactionType HsOfficeCoopSharesTransactionType not null,
valueDate date not null,
shareCount integer not null,
reference varchar(48) not null,
adjustedShareTxUuid uuid unique REFERENCES hs_office_coopsharestransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
adjustedShareTxUuid uuid unique REFERENCES hs_office.coopsharestransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
comment varchar(512)
);
--//
@ -26,8 +26,8 @@ create table if not exists hs_office_coopsharestransaction
--changeset michael.hoennig:hs-office-coopshares-BUSINESS-RULES endDelimiter:--//
-- ----------------------------------------------------------------------------
alter table hs_office_coopsharestransaction
add constraint hs_office_coopsharestransaction_reverse_entry_missing
alter table hs_office.coopsharestransaction
add constraint reverse_entry_missing
check ( transactionType = 'ADJUSTMENT' and adjustedShareTxUuid is not null
or transactionType <> 'ADJUSTMENT' and adjustedShareTxUuid is null);
--//
@ -44,7 +44,7 @@ declare
totalShareCount integer;
begin
select sum(cst.shareCount)
from hs_office_coopsharestransaction cst
from hs_office.coopsharestransaction cst
where cst.membershipUuid = forMembershipUuid
into currentShareCount;
totalShareCount := currentShareCount + newShareCount;
@ -54,8 +54,8 @@ begin
return true;
end; $$;
alter table hs_office_coopsharestransaction
add constraint hs_office_coopshares_positive
alter table hs_office.coopsharestransaction
add constraint check_positive_total_shares_count
check ( checkSharesByMembershipUuid(membershipUuid, shareCount) );
--//
@ -64,5 +64,5 @@ alter table hs_office_coopsharestransaction
--changeset michael.hoennig:hs-office-coopshares-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_coopsharestransaction');
call base.create_journal('hs_office.coopsharestransaction');
--//

66
src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-coopsharestransaction-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_coopsharestransaction');
call rbac.generateRelatedRbacObject('hs_office.coopsharestransaction');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-coopsharestransaction-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeCoopSharesTransaction', 'hs_office_coopsharestransaction');
call rbac.generateRbacRoleDescriptors('hsOfficeCoopSharesTransaction', 'hs_office.coopsharestransaction');
--//
@ -24,18 +24,18 @@ call rbac.generateRbacRoleDescriptors('hsOfficeCoopSharesTransaction', 'hs_offic
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeCoopSharesTransaction(
NEW hs_office_coopsharestransaction
create or replace procedure hs_office.coopsharestransaction_build_rbac_system(
NEW hs_office.coopsharestransaction
)
language plpgsql as $$
declare
newMembership hs_office_membership;
newMembership hs_office.membership;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_membership WHERE uuid = NEW.membershipUuid INTO newMembership;
SELECT * FROM hs_office.membership WHERE uuid = NEW.membershipUuid INTO newMembership;
assert newMembership.uuid is not null, format('newMembership must not be null for NEW.membershipUuid = %s', NEW.membershipUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeMembershipAGENT(newMembership));
@ -45,22 +45,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_coopsharestransaction row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopsharestransaction row.
*/
create or replace function insertTriggerForHsOfficeCoopSharesTransaction_tf()
create or replace function hs_office.coopsharestransaction_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeCoopSharesTransaction(NEW);
call hs_office.coopsharestransaction_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeCoopSharesTransaction_tg
after insert on hs_office_coopsharestransaction
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.coopsharestransaction
for each row
execute procedure insertTriggerForHsOfficeCoopSharesTransaction_tf();
execute procedure hs_office.coopsharestransaction_build_rbac_system_after_insert_tf();
--//
@ -68,48 +68,48 @@ execute procedure insertTriggerForHsOfficeCoopSharesTransaction_tf();
--changeset InsertTriggerGenerator:hs-office-coopsharestransaction-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office_membership ----------------------------
-- granting INSERT permission to hs_office.membership ----------------------------
/*
Grants INSERT INTO hs_office_coopsharestransaction permissions to specified role of pre-existing hs_office_membership rows.
Grants INSERT INTO hs_office.coopsharestransaction permissions to specified role of pre-existing hs_office.membership rows.
*/
do language plpgsql $$
declare
row hs_office_membership;
row hs_office.membership;
begin
call base.defineContext('create INSERT INTO hs_office_coopsharestransaction permissions for pre-exising hs_office_membership rows');
call base.defineContext('create INSERT INTO hs_office.coopsharestransaction permissions for pre-exising hs_office.membership rows');
FOR row IN SELECT * FROM hs_office_membership
FOR row IN SELECT * FROM hs_office.membership
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_coopsharestransaction'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopsharestransaction'),
hsOfficeMembershipADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office_coopsharestransaction INSERT permission to specified role of new hs_office_membership rows.
Grants hs_office.coopsharestransaction INSERT permission to specified role of new membership rows.
*/
create or replace function new_hsof_coopsharetx_grants_insert_to_hsof_membership_tf()
create or replace function hs_office.new_coopsharetx_grants_insert_to_membership_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_coopsharestransaction'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopsharestransaction'),
hsOfficeMembershipADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_coopsharestransaction_grants_after_insert_tg
after insert on hs_office_membership
create trigger z_new_coopsharestransaction_grants_after_insert_tg
after insert on hs_office.membership
for each row
execute procedure new_hsof_coopsharetx_grants_insert_to_hsof_membership_tf();
execute procedure hs_office.new_coopsharetx_grants_insert_to_membership_tf();
-- ============================================================================
@ -117,27 +117,27 @@ execute procedure new_hsof_coopsharetx_grants_insert_to_hsof_membership_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_coopsharestransaction.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopsharestransaction.
*/
create or replace function hs_office_coopsharestransaction_insert_permission_check_tf()
create or replace function hs_office.coopsharestransaction_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT permission via direct foreign key: NEW.membershipUuid
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office_coopsharestransaction') then
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopsharestransaction') then
return NEW;
end if;
raise exception '[403] insert into hs_office_coopsharestransaction values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.coopsharestransaction values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_coopsharestransaction_insert_permission_check_tg
before insert on hs_office_coopsharestransaction
create trigger coopsharestransaction_insert_permission_check_tg
before insert on hs_office.coopsharestransaction
for each row
execute procedure hs_office_coopsharestransaction_insert_permission_check_tf();
execute procedure hs_office.coopsharestransaction_insert_permission_check_tf();
--//
@ -145,7 +145,7 @@ create trigger hs_office_coopsharestransaction_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-coopsharestransaction-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_coopsharestransaction',
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopsharestransaction',
$idName$
reference
$idName$);
@ -155,7 +155,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_coopsharestransactio
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-coopsharestransaction-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_coopsharestransaction',
call rbac.generateRbacRestrictedView('hs_office.coopsharestransaction',
$orderBy$
reference
$orderBy$,

26
src/main/resources/db/changelog/5-hs-office/511-coopshares/5116-hs-office-coopshares-migration.sql
View File

@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-coopshares-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office_coopsharestransaction_legacy_id
CREATE TABLE hs_office.coopsharestransaction_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office_coopsharestransaction(uuid),
uuid uuid NOT NULL REFERENCES hs_office.coopsharestransaction(uuid),
member_share_id integer NOT NULL
);
--//
@ -19,10 +19,10 @@ CREATE TABLE hs_office_coopsharestransaction_legacy_id
--changeset michael.hoennig:hs-office-coopshares-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office_coopsharestransaction_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.coopsharestransaction_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office_coopsharestransaction_legacy_id.member_share_id;
OWNED BY hs_office.coopsharestransaction_legacy_id.member_share_id;
--//
@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office_coopsharestransaction_legacy_id_seq
--changeset michael.hoennig:hs-office-coopshares-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office_coopsharestransaction_legacy_id
ALTER TABLE hs_office.coopsharestransaction_legacy_id
ALTER COLUMN member_share_id
SET DEFAULT nextVal('hs_office_coopsharestransaction_legacy_id_seq');
SET DEFAULT nextVal('hs_office.coopsharestransaction_legacy_id_seq');
--/
@ -41,8 +41,8 @@ ALTER TABLE hs_office_coopsharestransaction_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office_coopsharestransaction_legacy_id(uuid, member_share_id)
SELECT uuid, nextVal('hs_office_coopsharestransaction_legacy_id_seq') FROM hs_office_coopsharestransaction;
INSERT INTO hs_office.coopsharestransaction_legacy_id(uuid, member_share_id)
SELECT uuid, nextVal('hs_office.coopsharestransaction_legacy_id_seq') FROM hs_office.coopsharestransaction;
--/
@ -58,14 +58,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office_coopsharestransaction_legacy_id VALUES
(NEW.uuid, nextVal('hs_office_coopsharestransaction_legacy_id_seq'));
INSERT INTO hs_office.coopsharestransaction_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.coopsharestransaction_legacy_id_seq'));
return NEW;
end; $$;
create trigger createCoopSharesLegacyIdMapping
after insert on hs_office_coopsharestransaction
after insert on hs_office.coopsharestransaction
for each row
execute procedure insertCoopSharesLegacyIdMapping();
--/
@ -83,14 +83,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office_coopsharestransaction_legacy_id
DELETE FROM hs_office.coopsharestransaction_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removeCoopSharesLegacyIdMapping
before delete on hs_office_coopsharestransaction
before delete on hs_office.coopsharestransaction
for each row
execute procedure deleteCoopSharesLegacyIdMapping();
--/

8
src/main/resources/db/changelog/5-hs-office/511-coopshares/5118-hs-office-coopshares-test-data.sql
View File

@ -14,12 +14,12 @@ create or replace procedure createHsOfficeCoopSharesTransactionTestData(
)
language plpgsql as $$
declare
membership hs_office_membership;
membership hs_office.membership;
subscriptionEntryUuid uuid;
begin
select m.uuid
from hs_office_membership m
join hs_office_partner p on p.uuid = m.partneruuid
from hs_office.membership m
join hs_office.partner p on p.uuid = m.partneruuid
where p.partnerNumber = givenPartnerNumber
and m.memberNumberSuffix = givenMemberNumberSuffix
into membership;
@ -27,7 +27,7 @@ begin
raise notice 'creating test coopSharesTransaction: %', givenPartnerNumber::text || givenMemberNumberSuffix;
subscriptionEntryUuid := uuid_generate_v4();
insert
into hs_office_coopsharestransaction(uuid, membershipuuid, transactiontype, valuedate, sharecount, reference, comment, adjustedShareTxUuid)
into hs_office.coopsharestransaction(uuid, membershipuuid, transactiontype, valuedate, sharecount, reference, comment, adjustedShareTxUuid)
values
(uuid_generate_v4(), membership.uuid, 'SUBSCRIPTION', '2010-03-15', 4, 'ref '||givenPartnerNumber::text || givenMemberNumberSuffix||'-1', 'initial subscription', null),
(uuid_generate_v4(), membership.uuid, 'CANCELLATION', '2021-09-01', -2, 'ref '||givenPartnerNumber::text || givenMemberNumberSuffix||'-2', 'cancelling some', null),

18
src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql
View File

@ -15,16 +15,16 @@ CREATE TYPE HsOfficeCoopAssetsTransactionType AS ENUM ('ADJUSTMENT',
CREATE CAST (character varying as HsOfficeCoopAssetsTransactionType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office_coopassetstransaction
create table if not exists hs_office.coopassetstransaction
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
membershipUuid uuid not null references hs_office_membership(uuid),
membershipUuid uuid not null references hs_office.membership(uuid),
transactionType HsOfficeCoopAssetsTransactionType not null,
valueDate date not null,
assetValue money not null,
reference varchar(48) not null,
adjustedAssetTxUuid uuid unique REFERENCES hs_office_coopassetstransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
adjustedAssetTxUuid uuid unique REFERENCES hs_office.coopassetstransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
comment varchar(512)
);
--//
@ -34,8 +34,8 @@ create table if not exists hs_office_coopassetstransaction
--changeset michael.hoennig:hs-office-coopassets-BUSINESS-RULES endDelimiter:--//
-- ----------------------------------------------------------------------------
alter table hs_office_coopassetstransaction
add constraint hs_office_coopassetstransaction_reverse_entry_missing
alter table hs_office.coopassetstransaction
add constraint reverse_entry_missing
check ( transactionType = 'ADJUSTMENT' and adjustedAssetTxUuid is not null
or transactionType <> 'ADJUSTMENT' and adjustedAssetTxUuid is null);
--//
@ -52,7 +52,7 @@ declare
totalAssetValue money;
begin
select sum(cat.assetValue)
from hs_office_coopassetstransaction cat
from hs_office.coopassetstransaction cat
where cat.membershipUuid = forMembershipUuid
into currentAssetValue;
totalAssetValue := currentAssetValue + newAssetValue;
@ -62,8 +62,8 @@ begin
return true;
end; $$;
alter table hs_office_coopassetstransaction
add constraint hs_office_coopassets_positive
alter table hs_office.coopassetstransaction
add constraint check_positive_total
check ( checkAssetsByMembershipUuid(membershipUuid, assetValue) );
--//
@ -72,5 +72,5 @@ alter table hs_office_coopassetstransaction
--changeset michael.hoennig:hs-office-coopassets-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office_coopassetstransaction');
call base.create_journal('hs_office.coopassetstransaction');
--//

66
src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql
View File

@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-coopassetstransaction-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office_coopassetstransaction');
call rbac.generateRelatedRbacObject('hs_office.coopassetstransaction');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-coopassetstransaction-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeCoopAssetsTransaction', 'hs_office_coopassetstransaction');
call rbac.generateRbacRoleDescriptors('hsOfficeCoopAssetsTransaction', 'hs_office.coopassetstransaction');
--//
@ -24,18 +24,18 @@ call rbac.generateRbacRoleDescriptors('hsOfficeCoopAssetsTransaction', 'hs_offic
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure buildRbacSystemForHsOfficeCoopAssetsTransaction(
NEW hs_office_coopassetstransaction
create or replace procedure hs_office.coopassetstransaction_build_rbac_system(
NEW hs_office.coopassetstransaction
)
language plpgsql as $$
declare
newMembership hs_office_membership;
newMembership hs_office.membership;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_office_membership WHERE uuid = NEW.membershipUuid INTO newMembership;
SELECT * FROM hs_office.membership WHERE uuid = NEW.membershipUuid INTO newMembership;
assert newMembership.uuid is not null, format('newMembership must not be null for NEW.membershipUuid = %s', NEW.membershipUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeMembershipAGENT(newMembership));
@ -45,22 +45,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office_coopassetstransaction row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopassetstransaction row.
*/
create or replace function insertTriggerForHsOfficeCoopAssetsTransaction_tf()
create or replace function hs_office.coopassetstransaction_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call buildRbacSystemForHsOfficeCoopAssetsTransaction(NEW);
call hs_office.coopassetstransaction_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger insertTriggerForHsOfficeCoopAssetsTransaction_tg
after insert on hs_office_coopassetstransaction
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.coopassetstransaction
for each row
execute procedure insertTriggerForHsOfficeCoopAssetsTransaction_tf();
execute procedure hs_office.coopassetstransaction_build_rbac_system_after_insert_tf();
--//
@ -68,48 +68,48 @@ execute procedure insertTriggerForHsOfficeCoopAssetsTransaction_tf();
--changeset InsertTriggerGenerator:hs-office-coopassetstransaction-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office_membership ----------------------------
-- granting INSERT permission to hs_office.membership ----------------------------
/*
Grants INSERT INTO hs_office_coopassetstransaction permissions to specified role of pre-existing hs_office_membership rows.
Grants INSERT INTO hs_office.coopassetstransaction permissions to specified role of pre-existing hs_office.membership rows.
*/
do language plpgsql $$
declare
row hs_office_membership;
row hs_office.membership;
begin
call base.defineContext('create INSERT INTO hs_office_coopassetstransaction permissions for pre-exising hs_office_membership rows');
call base.defineContext('create INSERT INTO hs_office.coopassetstransaction permissions for pre-exising hs_office.membership rows');
FOR row IN SELECT * FROM hs_office_membership
FOR row IN SELECT * FROM hs_office.membership
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office_coopassetstransaction'),
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopassetstransaction'),
hsOfficeMembershipADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office_coopassetstransaction INSERT permission to specified role of new hs_office_membership rows.
Grants hs_office.coopassetstransaction INSERT permission to specified role of new membership rows.
*/
create or replace function new_hsof_coopassettx_grants_insert_to_hsof_membership_tf()
create or replace function hs_office.new_coopassettx_grants_insert_to_membership_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office_coopassetstransaction'),
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopassetstransaction'),
hsOfficeMembershipADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_office_coopassetstransaction_grants_after_insert_tg
after insert on hs_office_membership
create trigger z_new_coopassetstransaction_grants_after_insert_tg
after insert on hs_office.membership
for each row
execute procedure new_hsof_coopassettx_grants_insert_to_hsof_membership_tf();
execute procedure hs_office.new_coopassettx_grants_insert_to_membership_tf();
-- ============================================================================
@ -117,27 +117,27 @@ execute procedure new_hsof_coopassettx_grants_insert_to_hsof_membership_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office_coopassetstransaction.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopassetstransaction.
*/
create or replace function hs_office_coopassetstransaction_insert_permission_check_tf()
create or replace function hs_office.coopassetstransaction_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT permission via direct foreign key: NEW.membershipUuid
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office_coopassetstransaction') then
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopassetstransaction') then
return NEW;
end if;
raise exception '[403] insert into hs_office_coopassetstransaction values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.coopassetstransaction values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_office_coopassetstransaction_insert_permission_check_tg
before insert on hs_office_coopassetstransaction
create trigger coopassetstransaction_insert_permission_check_tg
before insert on hs_office.coopassetstransaction
for each row
execute procedure hs_office_coopassetstransaction_insert_permission_check_tf();
execute procedure hs_office.coopassetstransaction_insert_permission_check_tf();
--//
@ -145,7 +145,7 @@ create trigger hs_office_coopassetstransaction_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-office-coopassetstransaction-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office_coopassetstransaction',
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopassetstransaction',
$idName$
reference
$idName$);
@ -155,7 +155,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office_coopassetstransactio
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-coopassetstransaction-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office_coopassetstransaction',
call rbac.generateRbacRestrictedView('hs_office.coopassetstransaction',
$orderBy$
reference
$orderBy$,

26
src/main/resources/db/changelog/5-hs-office/512-coopassets/5126-hs-office-coopassets-migration.sql
View File

@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office_coopassetstransaction_legacy_id
CREATE TABLE hs_office.coopassetstransaction_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office_coopassetstransaction(uuid),
uuid uuid NOT NULL REFERENCES hs_office.coopassetstransaction(uuid),
member_asset_id integer NOT NULL
);
--//
@ -19,10 +19,10 @@ CREATE TABLE hs_office_coopassetstransaction_legacy_id
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office_coopassetstransaction_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.coopassetstransaction_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office_coopassetstransaction_legacy_id.member_asset_id;
OWNED BY hs_office.coopassetstransaction_legacy_id.member_asset_id;
--//
@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office_coopassetstransaction_legacy_id_seq
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office_coopassetstransaction_legacy_id
ALTER TABLE hs_office.coopassetstransaction_legacy_id
ALTER COLUMN member_asset_id
SET DEFAULT nextVal('hs_office_coopassetstransaction_legacy_id_seq');
SET DEFAULT nextVal('hs_office.coopassetstransaction_legacy_id_seq');
--/
@ -41,8 +41,8 @@ ALTER TABLE hs_office_coopassetstransaction_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office_coopassetstransaction_legacy_id(uuid, member_asset_id)
SELECT uuid, nextVal('hs_office_coopassetstransaction_legacy_id_seq') FROM hs_office_coopassetstransaction;
INSERT INTO hs_office.coopassetstransaction_legacy_id(uuid, member_asset_id)
SELECT uuid, nextVal('hs_office.coopassetstransaction_legacy_id_seq') FROM hs_office.coopassetstransaction;
--/
@ -58,14 +58,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office_coopassetstransaction_legacy_id VALUES
(NEW.uuid, nextVal('hs_office_coopassetstransaction_legacy_id_seq'));
INSERT INTO hs_office.coopassetstransaction_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.coopassetstransaction_legacy_id_seq'));
return NEW;
end; $$;
create trigger createCoopAssetsLegacyIdMapping
after insert on hs_office_coopassetstransaction
after insert on hs_office.coopassetstransaction
for each row
execute procedure insertCoopAssetsLegacyIdMapping();
--/
@ -83,14 +83,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office_coopassetstransaction_legacy_id
DELETE FROM hs_office.coopassetstransaction_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removeCoopAssetsLegacyIdMapping
before delete on hs_office_coopassetstransaction
before delete on hs_office.coopassetstransaction
for each row
execute procedure deleteCoopAssetsLegacyIdMapping();
--/

8
src/main/resources/db/changelog/5-hs-office/512-coopassets/5128-hs-office-coopassets-test-data.sql
View File

@ -14,12 +14,12 @@ create or replace procedure createHsOfficeCoopAssetsTransactionTestData(
)
language plpgsql as $$
declare
membership hs_office_membership;
membership hs_office.membership;
lossEntryUuid uuid;
begin
select m.uuid
from hs_office_membership m
join hs_office_partner p on p.uuid = m.partneruuid
from hs_office.membership m
join hs_office.partner p on p.uuid = m.partneruuid
where p.partnerNumber = givenPartnerNumber
and m.memberNumberSuffix = givenMemberNumberSuffix
into membership;
@ -27,7 +27,7 @@ begin
raise notice 'creating test coopAssetsTransaction: %', givenPartnerNumber || givenMemberNumberSuffix;
lossEntryUuid := uuid_generate_v4();
insert
into hs_office_coopassetstransaction(uuid, membershipuuid, transactiontype, valuedate, assetvalue, reference, comment, adjustedAssetTxUuid)
into hs_office.coopassetstransaction(uuid, membershipuuid, transactiontype, valuedate, assetvalue, reference, comment, adjustedAssetTxUuid)
values
(uuid_generate_v4(), membership.uuid, 'DEPOSIT', '2010-03-15', 320.00, 'ref '||givenPartnerNumber || givenMemberNumberSuffix||'-1', 'initial deposit', null),
(uuid_generate_v4(), membership.uuid, 'DISBURSAL', '2021-09-01', -128.00, 'ref '||givenPartnerNumber || givenMemberNumberSuffix||'-2', 'partial disbursal', null),