From cb47d526ac559dff5ffd2d0b591ea36221ca455d Mon Sep 17 00:00:00 2001
From: Michael Hoennig <michael@hoennig.de>
Date: Tue, 18 Oct 2022 17:29:36 +0200
Subject: [PATCH] add hs-office-coopshares rbac + test-data
---
.../313-hs-office-coopshares-rbac.md | 29 ++++
.../313-hs-office-coopshares-rbac.sql | 124 ++++++++++++++++++
.../318-hs-office-coopshares-test-data.sql | 44 +++++++
.../db/changelog/db.changelog-master.yaml | 4 +
4 files changed, 201 insertions(+)
create mode 100644 src/main/resources/db/changelog/313-hs-office-coopshares-rbac.md
create mode 100644 src/main/resources/db/changelog/313-hs-office-coopshares-rbac.sql
create mode 100644 src/main/resources/db/changelog/318-hs-office-coopshares-test-data.sql
diff --git a/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.md b/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.md
new file mode 100644
index 00000000..4093eb2d
--- /dev/null
+++ b/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.md
@@ -0,0 +1,29 @@
+### hs_office_coopSharesTransaction RBAC
+
+```mermaid
+flowchart TB
+
+subgraph hsOfficeMembership
+ direction TB
+ style hsOfficeMembership fill:#eee
+
+ role:hsOfficeMembership.owner[membership.admin]
+ --> role:hsOfficeMembership.admin[membership.admin]
+ --> role:hsOfficeMembership.agent[membership.agent]
+ --> role:hsOfficeMembership.tenant[membership.tenant]
+ --> role:hsOfficeMembership.guest[membership.guest]
+
+ role:hsOfficePartner.agent --> role:hsOfficeMembership.agent
+end
+
+subgraph hsOfficeCoopSharesTransaction
+
+ role:hsOfficeMembership.admin
+ --> perm:hsOfficeCoopSharesTransaction.create{{coopSharesTx.create}}
+
+ role:hsOfficeMembership.agent
+ --> perm:hsOfficeCoopSharesTransaction.view{{coopSharesTx.view}}
+end
+
+
+```
diff --git a/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.sql b/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.sql
new file mode 100644
index 00000000..d6afcfc8
--- /dev/null
+++ b/src/main/resources/db/changelog/313-hs-office-coopshares-rbac.sql
@@ -0,0 +1,124 @@
+--liquibase formatted sql
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-OBJECT:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRelatedRbacObject('hs_office_coopSharesTransaction');
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-ROLE-DESCRIPTORS:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRbacRoleDescriptors('hsOfficeCoopSharesTransaction', 'hs_office_coopSharesTransaction');
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-ROLES-CREATION:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+
+/*
+ Creates and updates the permissions for coopSharesTransaction entities.
+ */
+
+create or replace function hsOfficeCoopSharesTransactionRbacRolesTrigger()
+ returns trigger
+ language plpgsql
+ strict as $$
+declare
+ newHsOfficeMembership hs_office_membership;
+begin
+
+ select * from hs_office_membership as p where p.uuid = NEW.membershipUuid into newHsOfficeMembership;
+
+ if TG_OP = 'INSERT' then
+
+ -- Each coopSharesTransaction entity belong exactly to one membership entity
+ -- and it makes little sense just to delegate coopSharesTransaction roles.
+ -- Therefore, we do not create coopSharesTransaction roles at all,
+ -- but instead just assign extra permissions to existing membership-roles.
+
+ -- coopsharestransactions cannot be edited nor deleted, just created+viewed
+ call grantPermissionsToRole(
+ getRoleId(hsOfficeMembershipTenant(newHsOfficeMembership), 'fail'),
+ createPermissions(NEW.uuid, array ['view'])
+ );
+
+ else
+ raise exception 'invalid usage of TRIGGER';
+ end if;
+
+ return NEW;
+end; $$;
+
+/*
+ An AFTER INSERT TRIGGER which creates the role structure for a new customer.
+ */
+create trigger createRbacRolesForHsOfficeCoopSharesTransaction_Trigger
+ after insert
+ on hs_office_coopSharesTransaction
+ for each row
+execute procedure hsOfficeCoopSharesTransactionRbacRolesTrigger();
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-IDENTITY-VIEW:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRbacIdentityView('hs_office_coopSharesTransaction',
+ idNameExpression => 'target.reference');
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-RESTRICTED-VIEW:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+call generateRbacRestrictedView('hs_office_coopSharesTransaction', orderby => 'target.reference');
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-rbac-NEW-CoopSharesTransaction:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+/*
+ Creates a global permission for new-coopSharesTransaction and assigns it to the hostsharing admins role.
+ */
+do language plpgsql $$
+ declare
+ addCustomerPermissions uuid[];
+ globalObjectUuid uuid;
+ globalAdminRoleUuid uuid ;
+ begin
+ call defineContext('granting global new-coopSharesTransaction permission to global admin role', null, null, null);
+
+ globalAdminRoleUuid := findRoleId(globalAdmin());
+ globalObjectUuid := (select uuid from global);
+ addCustomerPermissions := createPermissions(globalObjectUuid, array ['new-coopsharestransaction']);
+ call grantPermissionsToRole(globalAdminRoleUuid, addCustomerPermissions);
+ end;
+$$;
+
+/**
+ Used by the trigger to prevent the add-customer to current user respectively assumed roles.
+ */
+create or replace function addHsOfficeCoopSharesTransactionNotAllowedForCurrentSubjects()
+ returns trigger
+ language PLPGSQL
+as $$
+begin
+ raise exception '[403] new-coopsharestransaction not permitted for %',
+ array_to_string(currentSubjects(), ';', 'null');
+end; $$;
+
+/**
+ Checks if the user or assumed roles are allowed to create a new customer.
+ */
+create trigger hs_office_coopSharesTransaction_insert_trigger
+ before insert
+ on hs_office_coopSharesTransaction
+ for each row
+ when ( not hasAssumedRole() )
+execute procedure addHsOfficeCoopSharesTransactionNotAllowedForCurrentSubjects();
+--//
+
diff --git a/src/main/resources/db/changelog/318-hs-office-coopshares-test-data.sql b/src/main/resources/db/changelog/318-hs-office-coopshares-test-data.sql
new file mode 100644
index 00000000..3948272d
--- /dev/null
+++ b/src/main/resources/db/changelog/318-hs-office-coopshares-test-data.sql
@@ -0,0 +1,44 @@
+--liquibase formatted sql
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-TEST-DATA-GENERATOR:1 endDelimiter:--//
+-- ----------------------------------------------------------------------------
+
+/*
+ Creates a single coopSharesTransaction test record.
+ */
+create or replace procedure createHsOfficeCoopSharesTransactionTestData(givenMembershipNumber numeric)
+ language plpgsql as $$
+declare
+ currentTask varchar;
+ membership hs_office_membership;
+begin
+ currentTask = 'creating coopSharesTransaction test-data ' || givenMembershipNumber;
+ execute format('set local hsadminng.currentTask to %L', currentTask);
+
+ call defineContext(currentTask);
+ select m.uuid from hs_office_membership m where m.memberNumber = givenMembershipNumber into membership;
+
+ raise notice 'creating test coopSharesTransaction: %', givenMembershipNumber;
+ insert
+ into hs_office_coopsharestransaction(uuid, membershipuuid, transactiontype, valuedate, sharecount, reference, comment)
+ values
+ (uuid_generate_v4(), membership.uuid, 'SUBSCRIPTION', '2010-03-15', 2, 'ref '||givenMembershipNumber||'-1', 'initial subscription'),
+ (uuid_generate_v4(), membership.uuid, 'SUBSCRIPTION', '2021-09-01', 24, 'ref '||givenMembershipNumber||'-2', 'subsscibing more'),
+ (uuid_generate_v4(), membership.uuid, 'CANCELLATION', '2022-10-20', 12, 'ref '||givenMembershipNumber||'-3', 'cancelling some');
+end; $$;
+--//
+
+
+-- ============================================================================
+--changeset hs-office-coopSharesTransaction-TEST-DATA-GENERATION:1 –context=dev,tc endDelimiter:--//
+-- ----------------------------------------------------------------------------
+
+do language plpgsql $$
+ begin
+ call createHsOfficeCoopSharesTransactionTestData(10001);
+ call createHsOfficeCoopSharesTransactionTestData(10002);
+ call createHsOfficeCoopSharesTransactionTestData(10003);
+ end;
+$$;
diff --git a/src/main/resources/db/changelog/db.changelog-master.yaml b/src/main/resources/db/changelog/db.changelog-master.yaml
index e0345a10..c082e609 100644
--- a/src/main/resources/db/changelog/db.changelog-master.yaml
+++ b/src/main/resources/db/changelog/db.changelog-master.yaml
@@ -99,3 +99,7 @@ databaseChangeLog:
file: db/changelog/308-hs-office-membership-test-data.sql
- include:
file: db/changelog/310-hs-office-coopshares.sql
+ - include:
+ file: db/changelog/313-hs-office-coopshares-rbac.sql
+ - include:
+ file: db/changelog/318-hs-office-coopshares-test-data.sql