hostsharing/hs.hsadmin.ng
1
0
Fork 0
Code Activity

replace unixuser test entities with domain

Browse Source
This commit is contained in:
Michael Hoennig
2022-08-31 14:57:15 +02:00
parent 84ce90b28f
commit a117258085
14 changed files with 163 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/main/resources/db/changelog/123-test-package-rbac.sql
View File

@ -76,7 +76,7 @@ begin
-- an owner role is created and assigned to the package owner role
packageAdminRoleUuid = createRole(
testPackageAdmin(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['add-unixuser', 'add-domain']),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['add-domain']),
beneathRole(packageOwnerRoleUuid)
);

6
src/main/resources/db/changelog/130-test-unixuser.sql → src/main/resources/db/changelog/130-test-domain.sql
View File

@ -1,14 +1,14 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-unixuser-MAIN-TABLE:1 endDelimiter:--//
--changeset test-domain-MAIN-TABLE:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists test_unixuser
create table if not exists test_domain
(
uuid uuid unique references RbacObject (uuid),
packageUuid uuid references test_package (uuid),
name character varying(32),
name character varying(253),
description character varying(96)
);
--//

124
src/main/resources/db/changelog/133-test-unixuser-rbac.sql → src/main/resources/db/changelog/133-test-domain-rbac.sql
View File

@ -6,81 +6,81 @@
/*
Creates the related RbacObject through a BEFORE INSERT TRIGGER.
*/
drop trigger if exists createRbacObjectFortest_unixuser_Trigger on test_unixuser;
create trigger createRbacObjectFortest_unixuser_Trigger
drop trigger if exists createRbacObjectFortest_domain_Trigger on test_domain;
create trigger createRbacObjectFortest_domain_Trigger
before insert
on test_unixuser
on test_domain
for each row
execute procedure createRbacObject();
--//
-- ============================================================================
--changeset test-unixuser-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
--changeset test-domain-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function testUnixUserOwner(uu test_unixuser)
create or replace function testdomainOwner(uu test_domain)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('test_unixuser', uu.uuid, 'owner');
return roleDescriptor('test_domain', uu.uuid, 'owner');
end; $$;
create or replace function testUnixUserAdmin(uu test_unixuser)
create or replace function testdomainAdmin(uu test_domain)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('test_unixuser', uu.uuid, 'admin');
return roleDescriptor('test_domain', uu.uuid, 'admin');
end; $$;
create or replace function testUnixUserTenant(uu test_unixuser)
create or replace function testdomainTenant(uu test_domain)
returns RbacRoleDescriptor
returns null on null input
language plpgsql as $$
begin
return roleDescriptor('test_unixuser', uu.uuid, 'tenant');
return roleDescriptor('test_domain', uu.uuid, 'tenant');
end; $$;
create or replace function createTestUnixUserTenantRoleIfNotExists(unixUser test_unixuser)
create or replace function createTestDomainTenantRoleIfNotExists(domain test_domain)
returns uuid
returns null on null input
language plpgsql as $$
declare
unixUserTenantRoleDesc RbacRoleDescriptor;
unixUserTenantRoleUuid uuid;
domainTenantRoleDesc RbacRoleDescriptor;
domainTenantRoleUuid uuid;
begin
unixUserTenantRoleDesc = testUnixUserTenant(unixUser);
unixUserTenantRoleUuid = findRoleId(unixUserTenantRoleDesc);
if unixUserTenantRoleUuid is not null then
return unixUserTenantRoleUuid;
domainTenantRoleDesc = testdomainTenant(domain);
domainTenantRoleUuid = findRoleId(domainTenantRoleDesc);
if domainTenantRoleUuid is not null then
return domainTenantRoleUuid;
end if;
return createRole(
unixUserTenantRoleDesc,
grantingPermissions(forObjectUuid => unixUser.uuid, permitOps => array ['view']),
beneathRole(testUnixUserAdmin(unixUser))
domainTenantRoleDesc,
grantingPermissions(forObjectUuid => domain.uuid, permitOps => array ['view']),
beneathRole(testdomainAdmin(domain))
);
end; $$;
--//
-- ============================================================================
--changeset test-unixuser-rbac-ROLES-CREATION:1 endDelimiter:--//
--changeset test-domain-rbac-ROLES-CREATION:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles and their assignments for a new UnixUser for the AFTER INSERT TRIGGER.
Creates the roles and their assignments for a new domain for the AFTER INSERT TRIGGER.
*/
create or replace function createRbacRulesForTestUnixUser()
create or replace function createRbacRulesForTestDomain()
returns trigger
language plpgsql
strict as $$
declare
parentPackage test_package;
unixuserOwnerRoleId uuid;
unixuserAdminRoleId uuid;
domainOwnerRoleId uuid;
domainAdminRoleId uuid;
begin
if TG_OP <> 'INSERT' then
raise exception 'invalid usage of TRIGGER AFTER INSERT';
@ -89,17 +89,17 @@ begin
select * from test_package where uuid = NEW.packageUuid into parentPackage;
-- an owner role is created and assigned to the package's admin group
unixuserOwnerRoleId = createRole(
testUnixUserOwner(NEW),
domainOwnerRoleId = createRole(
testdomainOwner(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['*']),
beneathRole(testPackageAdmin(parentPackage))
);
-- and a unixuser admin role is created and assigned to the unixuser owner as well
unixuserAdminRoleId = createRole(
testUnixUserAdmin(NEW),
-- and a domain admin role is created and assigned to the domain owner as well
domainAdminRoleId = createRole(
testdomainAdmin(NEW),
grantingPermissions(forObjectUuid => NEW.uuid, permitOps => array ['edit']),
beneathRole(unixuserOwnerRoleId),
beneathRole(domainOwnerRoleId),
beingItselfA(testPackageTenant(parentPackage))
);
@ -110,86 +110,86 @@ end; $$;
/*
An AFTER INSERT TRIGGER which creates the role structure for a new UnixUser.
An AFTER INSERT TRIGGER which creates the role structure for a new domain.
*/
drop trigger if exists createRbacRulesForTestUnixuser_Trigger on test_unixuser;
create trigger createRbacRulesForTestUnixuser_Trigger
drop trigger if exists createRbacRulesForTestDomain_Trigger on test_domain;
create trigger createRbacRulesForTestDomain_Trigger
after insert
on test_unixuser
on test_domain
for each row
execute procedure createRbacRulesForTestUnixUser();
execute procedure createRbacRulesForTestDomain();
--//
-- ============================================================================
--changeset test-unixuser-rbac-ROLES-REMOVAL:1 endDelimiter:--//
--changeset test-domain-rbac-ROLES-REMOVAL:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Deletes the roles and their assignments of a deleted UnixUser for the BEFORE DELETE TRIGGER.
Deletes the roles and their assignments of a deleted domain for the BEFORE DELETE TRIGGER.
*/
create or replace function deleteRbacRulesForTestUnixUser()
create or replace function deleteRbacRulesForTestDomain()
returns trigger
language plpgsql
strict as $$
begin
if TG_OP = 'DELETE' then
call deleteRole(findRoleId(testUnixUserOwner(OLD)));
call deleteRole(findRoleId(testUnixUserAdmin(OLD)));
call deleteRole(findRoleId(testUnixUserTenant(OLD)));
call deleteRole(findRoleId(testdomainOwner(OLD)));
call deleteRole(findRoleId(testdomainAdmin(OLD)));
call deleteRole(findRoleId(testdomainTenant(OLD)));
else
raise exception 'invalid usage of TRIGGER BEFORE DELETE';
end if;
end; $$;
/*
An BEFORE DELETE TRIGGER which deletes the role structure of a UnixUser.
An BEFORE DELETE TRIGGER which deletes the role structure of a domain.
*/
drop trigger if exists deleteRbacRulesForTestUnixUser_Trigger on test_package;
create trigger deleteRbacRulesForTestUnixUser_Trigger
drop trigger if exists deleteRbacRulesForTestDomain_Trigger on test_package;
create trigger deleteRbacRulesForTestDomain_Trigger
before delete
on test_unixuser
on test_domain
for each row
execute procedure deleteRbacRulesForTestUnixUser();
execute procedure deleteRbacRulesForTestDomain();
--//
-- ============================================================================
--changeset test-unixuser-rbac-IDENTITY-VIEW:1 endDelimiter:--//
--changeset test-domain-rbac-IDENTITY-VIEW:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates a view to the UnixUser main table which maps the identifying name
Creates a view to the domain main table which maps the identifying name
(in this case, actually the column `name`) to the objectUuid.
*/
drop view if exists test_unixuser_iv;
create or replace view test_unixuser_iv as
drop view if exists test_domain_iv;
create or replace view test_domain_iv as
select distinct target.uuid, target.name as idName
from test_unixuser as target;
from test_domain as target;
-- TODO: Is it ok that everybody has access to this information?
grant all privileges on test_unixuser_iv to restricted;
grant all privileges on test_domain_iv to restricted;
/*
Returns the objectUuid for a given identifying name (in this case, actually the column `name`).
*/
create or replace function test_unixUserUuidByIdName(idName varchar)
create or replace function test_domainUuidByIdName(idName varchar)
returns uuid
language sql
strict as $$
select uuid from test_unixuser_iv iv where iv.idName = test_unixUserUuidByIdName.idName;
select uuid from test_domain_iv iv where iv.idName = test_domainUuidByIdName.idName;
$$;
/*
Returns the identifying name for a given objectUuid (in this case the name).
*/
create or replace function test_unixUserIdNameByUuid(uuid uuid)
create or replace function test_domainIdNameByUuid(uuid uuid)
returns varchar
stable leakproof
language sql
strict as $$
select idName from test_unixuser_iv iv where iv.uuid = test_unixUserIdNameByUuid.uuid;
select idName from test_domain_iv iv where iv.uuid = test_domainIdNameByUuid.uuid;
$$;
--//
@ -202,10 +202,10 @@ $$;
Creates a view to the customer main table which maps the identifying name
(in this case, the prefix) to the objectUuid.
*/
drop view if exists test_unixuser_rv;
create or replace view test_unixuser_rv as
drop view if exists test_domain_rv;
create or replace view test_domain_rv as
select target.*
from test_unixuser as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'unixuser', currentSubjectsUuids()));
grant all privileges on test_unixuser_rv to restricted;
from test_domain as target
where target.uuid in (select queryAccessibleObjectUuidsOfSubjectIds('view', 'domain', currentSubjectsUuids()));
grant all privileges on test_domain_rv to restricted;
--//

34
src/main/resources/db/changelog/138-test-unixuser-test-data.sql → src/main/resources/db/changelog/138-test-domain-test-data.sql
View File

@ -1,12 +1,12 @@
--liquibase formatted sql
-- ============================================================================
--changeset hs-unixuser-TEST-DATA-GENERATOR:1 endDelimiter:--//
--changeset hs-domain-TEST-DATA-GENERATOR:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the given count of test unix users for a single package.
*/
create or replace procedure createUnixUserTestData( packageName varchar, unixUserCount int )
create or replace procedure createdomainTestData( packageName varchar, domainCount int )
language plpgsql as $$
declare
pac record;
@ -19,15 +19,15 @@ begin
where p.name = packageName
into pac;
for t in 0..(unixUserCount-1)
for t in 0..(domainCount-1)
loop
currentTask = 'creating RBAC test unixuser #' || t || ' for package ' || pac.name || ' #' || pac.uuid;
currentTask = 'creating RBAC test domain #' || t || ' for package ' || pac.name || ' #' || pac.uuid;
raise notice 'task: %', currentTask;
pacAdmin = 'pac-admin-' || pac.name || '@' || pac.custPrefix || '.example.com';
call defineContext(currentTask, null, pacAdmin, null);
insert
into test_unixuser (name, packageUuid)
into test_domain (name, packageUuid)
values (pac.name || '-' || intToVarChar(t, 4), pac.uuid);
end loop;
end; $$;
@ -35,7 +35,7 @@ end; $$;
/*
Creates a range of unix users for mass data generation.
*/
create or replace procedure createUnixUserTestData( unixUserPerPackage integer )
create or replace procedure createdomainTestData( domainPerPackage integer )
language plpgsql as $$
declare
pac record;
@ -48,7 +48,7 @@ begin
join test_customer c on p.customeruuid = c.uuid
where c.reference < 90000) -- reserved for functional testing
loop
call createUnixUserTestData(pac.name, 2);
call createdomainTestData(pac.name, 2);
commit;
end loop;
@ -57,22 +57,22 @@ end; $$;
-- ============================================================================
--changeset hs-unixuser-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
--changeset hs-domain-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
-- ----------------------------------------------------------------------------
do language plpgsql $$
begin
call createUnixUserTestData('xxx00', 2);
call createUnixUserTestData('xxx01', 2);
call createUnixUserTestData('xxx02', 2);
call createdomainTestData('xxx00', 2);
call createdomainTestData('xxx01', 2);
call createdomainTestData('xxx02', 2);
call createUnixUserTestData('yyy00', 2);
call createUnixUserTestData('yyy01', 2);
call createUnixUserTestData('yyy02', 2);
call createdomainTestData('yyy00', 2);
call createdomainTestData('yyy01', 2);
call createdomainTestData('yyy02', 2);
call createUnixUserTestData('zzz00', 2);
call createUnixUserTestData('zzz01', 2);
call createUnixUserTestData('zzz02', 2);
call createdomainTestData('zzz00', 2);
call createdomainTestData('zzz01', 2);
call createdomainTestData('zzz02', 2);
end;
$$;
--//

6
src/main/resources/db/changelog/db.changelog-master.yaml
View File

@ -42,10 +42,10 @@ databaseChangeLog:
- include:
file: db/changelog/128-test-package-test-data.sql
- include:
file: db/changelog/130-test-unixuser.sql
file: db/changelog/130-test-domain.sql
- include:
file: db/changelog/133-test-unixuser-rbac.sql
file: db/changelog/133-test-domain-rbac.sql
- include:
file: db/changelog/138-test-unixuser-test-data.sql
file: db/changelog/138-test-domain-test-data.sql