hostsharing/hs.hsadmin.ng
1
0
Fork 0
Code Activity

introduce-separate-database-schemas-hs-booking-and-hosting (#106)

Browse Source 
Co-authored-by: Michael Hoennig <michael@hoennig.de>
Reviewed-on: https://dev.hostsharing.net/hostsharing/hs.hsadmin.ng/pulls/106
Reviewed-by: Marc Sandlus <marc.sandlus@hostsharing.net>
This commit is contained in:
Michael Hoennig
2024-09-23 10:52:37 +02:00
parent 23b60641e3
commit f33a3a2df7
101 changed files with 1072 additions and 1071 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/main/resources/db/changelog/0-base/010-context.sql
View File

@@ -168,45 +168,6 @@ begin
return cleanIdentifier;
end; $$;
create or replace function base.findObjectUuidByIdName(objectTable varchar, objectIdName varchar)
returns uuid
returns null on null input
language plpgsql as $$
declare
sql varchar;
uuid uuid;
begin
objectTable := base.pureIdentifier(objectTable);
objectIdName := base.pureIdentifier(objectIdName);
sql := format('select * from %sUuidByIdName(%L);', objectTable, objectIdName);
begin
execute sql into uuid;
exception
when others then
raise exception 'function %UuidByIdName(...) not found, add identity view support for table %', objectTable, objectTable;
end;
return uuid;
end ; $$;
create or replace function base.findIdNameByObjectUuid(objectTable varchar, objectUuid uuid)
returns varchar
returns null on null input
language plpgsql as $$
declare
sql varchar;
idName varchar;
begin
objectTable := base.pureIdentifier(objectTable);
sql := format('select * from %sIdNameByUuid(%L::uuid);', objectTable, objectUuid);
begin
execute sql into idName;
exception
when others then
raise exception 'function %IdNameByUuid(...) not found, add identity view support for table %', objectTable, objectTable;
end;
return idName;
end ; $$;
create or replace function base.currentSubjects()
returns varchar(1023)[]
stable -- leakproof

3
src/main/resources/db/changelog/0-base/011-table-schema-and-name.sql
View File

@@ -9,6 +9,9 @@ create or replace function base.combine_table_schema_and_name(tableSchema name,
returns text
language plpgsql as $$
begin
assert LEFT(tableSchema, 1) <> '"', 'tableSchema must not start with "';
assert LEFT(tableName, 1) <> '"', 'tableName must not start with "';
if tableSchema is null or tableSchema = 'public' or tableSchema = '' then
return tableName::text;
else

15
src/main/resources/db/changelog/0-base/030-historization.sql
View File

@@ -63,7 +63,6 @@ begin
if (currentSubject is null or currentSubject = '') then
raise exception 'hsadminng.currentSubject must be defined, please use "SET LOCAL ...;"';
end if;
raise notice 'currentSubject: %', currentSubject;
-- determine task
currentTask = current_setting('hsadminng.currentTask');
@@ -81,8 +80,9 @@ begin
"alive" := false;
end if;
sql := format('INSERT INTO %3$I_ex VALUES (DEFAULT, pg_current_xact_id(), %1$L, %2$L, $1.*)',
sql := format('INSERT INTO %3$s_ex VALUES (DEFAULT, pg_current_xact_id(), %1$L, %2$L, $1.*)',
TG_OP, alive, base.combine_table_schema_and_name(tg_table_schema, tg_table_name)::name);
-- raise exception 'generated-SQL: %', sql;
execute sql using "row";
return "row";
@@ -117,12 +117,12 @@ begin
' EXCLUDING CONSTRAINTS' ||
' EXCLUDING STATISTICS' ||
')';
raise notice 'sql: %', createHistTableSql;
-- raise notice 'sql: %', createHistTableSql;
execute createHistTableSql;
-- create the historical view
viewName = quote_ident(format('%s_hv', baseTable));
exVersionsTable = quote_ident(format('%s_ex', baseTable));
viewName = baseTable || '_hv';
exVersionsTable = baseTable || '_ex';
baseCols = (select string_agg(quote_ident(column_name), ', ')
from information_schema.columns
where table_schema = 'public'
@@ -146,15 +146,14 @@ begin
' )' ||
')',
viewName, baseCols, exVersionsTable
);
raise notice 'sql: %', createViewSQL;
);
-- raise notice 'generated-sql: %', createViewSQL;
execute createViewSQL;
-- "-9-" to put the trigger execution after any alphabetically lesser tx-triggers
createTriggerSQL = 'CREATE TRIGGER tx_9_historicize_tg' ||
' AFTER INSERT OR DELETE OR UPDATE ON ' || baseTable ||
' FOR EACH ROW EXECUTE PROCEDURE base.tx_historicize_tf()';
raise notice 'sql: %', createTriggerSQL;
execute createTriggerSQL;
end; $$;

46
src/main/resources/db/changelog/1-rbac/1050-rbac-base.sql
View File

@@ -233,6 +233,50 @@ $$;
--//
-- ============================================================================
--changeset michael.hoennig:rbac-base-IDNAME-FUNCTIONS endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function rbac.findObjectUuidByIdName(objectTable varchar, objectIdName varchar)
returns uuid
returns null on null input
language plpgsql as $$
declare
sql varchar;
uuid uuid;
begin
objectTable := base.pureIdentifier(objectTable);
objectIdName := base.pureIdentifier(objectIdName);
sql := format('select * from %s_uuid_by_id_name(%L);', objectTable, objectIdName);
begin
execute sql into uuid;
exception
when others then
raise exception 'function %_uuid_by_id_name(...) not found, add identity view support for table %', objectTable, objectTable;
end;
return uuid;
end ; $$;
create or replace function rbac.findIdNameByObjectUuid(objectTable varchar, objectUuid uuid)
returns varchar
returns null on null input
language plpgsql as $$
declare
sql varchar;
idName varchar;
begin
objectTable := base.pureIdentifier(objectTable);
sql := format('select * from %s_id_name_by_uuid(%L::uuid);', objectTable, objectUuid);
begin
execute sql into idName;
exception
when others then
raise exception 'function %_id_name_by_uuid(...) not found, add identity view support for table %', objectTable, objectTable;
end;
return idName;
end ; $$;
--//
-- ============================================================================
--changeset michael.hoennig:rbac-base-ROLE-FUNCTIONS endDelimiter:--//
-- ----------------------------------------------------------------------------
@@ -262,7 +306,7 @@ begin
objectTableFromRoleIdName = split_part(roleParts, '#', 1);
objectNameFromRoleIdName = split_part(roleParts, '#', 2);
roleTypeFromRoleIdName = split_part(roleParts, '#', 3);
objectUuidOfRole = base.findObjectUuidByIdName(objectTableFromRoleIdName, objectNameFromRoleIdName);
objectUuidOfRole = rbac.findObjectUuidByIdName(objectTableFromRoleIdName, objectNameFromRoleIdName);
select uuid
from rbac.role

2
src/main/resources/db/changelog/1-rbac/1054-rbac-context.sql
View File

@@ -55,7 +55,7 @@ begin
objectNameToAssume = split_part(roleNameParts, '#', 2);
roleTypeToAssume = split_part(roleNameParts, '#', 3);
objectUuidToAssume = base.findObjectUuidByIdName(objectTableToAssume, objectNameToAssume);
objectUuidToAssume = rbac.findObjectUuidByIdName(objectTableToAssume, objectNameToAssume);
if objectUuidToAssume is null then
raise exception '[401] object % cannot be found in table % (from roleNameParts=%)', objectNameToAssume, objectTableToAssume, roleNameParts;
end if;

22
src/main/resources/db/changelog/1-rbac/1055-rbac-views.sql
View File

@@ -13,7 +13,7 @@ select (objectTable || '#' || objectIdName || ':' || roleType) as roleIdName, *
-- @formatter:off
from (
select r.*,
o.objectTable, base.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
o.objectTable, rbac.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
from rbac.role as r
join rbac.object as o on o.uuid = r.objectuuid
) as unordered
@@ -34,7 +34,7 @@ select *
-- @formatter:off
from (
select r.*, o.objectTable,
base.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
rbac.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
from rbac.role as r
join rbac.object as o on o.uuid = r.objectuuid
where rbac.isGranted(rbac.currentSubjectOrAssumedRolesUuids(), r.uuid)
@@ -57,7 +57,7 @@ create or replace view rbac.grants_ev as
-- @formatter:off
select x.grantUuid as uuid,
x.grantedByTriggerOf as grantedByTriggerOf,
go.objectTable || '#' || base.findIdNameByObjectUuid(go.objectTable, go.uuid) || ':' || r.roletype as grantedByRoleIdName,
go.objectTable || '#' || rbac.findIdNameByObjectUuid(go.objectTable, go.uuid) || ':' || r.roletype as grantedByRoleIdName,
x.ascendingIdName as ascendantIdName,
x.descendingIdName as descendantIdName,
x.grantedByRoleUuid,
@@ -72,15 +72,15 @@ create or replace view rbac.grants_ev as
coalesce(
'user:' || au.name,
'role:' || aro.objectTable || '#' || base.findIdNameByObjectUuid(aro.objectTable, aro.uuid) || ':' || ar.roletype
'role:' || aro.objectTable || '#' || rbac.findIdNameByObjectUuid(aro.objectTable, aro.uuid) || ':' || ar.roletype
) as ascendingIdName,
aro.objectTable, aro.uuid,
( case
when dro is not null
then ('role:' || dro.objectTable || '#' || base.findIdNameByObjectUuid(dro.objectTable, dro.uuid) || ':' || dr.roletype)
then ('role:' || dro.objectTable || '#' || rbac.findIdNameByObjectUuid(dro.objectTable, dro.uuid) || ':' || dr.roletype)
when dp.op = 'INSERT'
then 'perm:' || dpo.objecttable || '#' || base.findIdNameByObjectUuid(dpo.objectTable, dpo.uuid) || ':' || dp.op || '>' || dp.opTableName
else 'perm:' || dpo.objecttable || '#' || base.findIdNameByObjectUuid(dpo.objectTable, dpo.uuid) || ':' || dp.op
then 'perm:' || dpo.objecttable || '#' || rbac.findIdNameByObjectUuid(dpo.objectTable, dpo.uuid) || ':' || dp.op || '>' || dp.opTableName
else 'perm:' || dpo.objecttable || '#' || rbac.findIdNameByObjectUuid(dpo.objectTable, dpo.uuid) || ':' || dp.op
end
) as descendingIdName,
dro.objectTable, dro.uuid,
@@ -114,14 +114,14 @@ create or replace view rbac.grants_ev as
*/
create or replace view rbac.grants_rv as
-- @formatter:off
select o.objectTable || '#' || base.findIdNameByObjectUuid(o.objectTable, o.uuid) || ':' || r.roletype as grantedByRoleIdName,
select o.objectTable || '#' || rbac.findIdNameByObjectUuid(o.objectTable, o.uuid) || ':' || r.roletype as grantedByRoleIdName,
g.objectTable || '#' || g.objectIdName || ':' || g.roletype as grantedRoleIdName, g.userName, g.assumed,
g.grantedByRoleUuid, g.descendantUuid as grantedRoleUuid, g.ascendantUuid as subjectUuid,
g.objectTable, g.objectUuid, g.objectIdName, g.roleType as grantedRoleType
from (
select g.grantedbyroleuuid, g.ascendantuuid, g.descendantuuid, g.assumed,
u.name as userName, o.objecttable, r.objectuuid, r.roletype,
base.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
rbac.findIdNameByObjectUuid(o.objectTable, o.uuid) as objectIdName
from rbac.grants as g
join rbac.role as r on r.uuid = g.descendantUuid
join rbac.object o on o.uuid = r.objectuuid
@@ -363,10 +363,10 @@ begin
xp.permissionObjectTable, xp.permissionObjectIdName, xp.permissionObjectUuid
from (select
r.uuid as roleUuid, r.roletype, ro.objectTable as roleObjectTable,
base.findIdNameByObjectUuid(ro.objectTable, ro.uuid) as roleObjectIdName,
rbac.findIdNameByObjectUuid(ro.objectTable, ro.uuid) as roleObjectIdName,
p.uuid as permissionUuid, p.op, p.opTableName,
po.objecttable as permissionObjectTable,
base.findIdNameByObjectUuid(po.objectTable, po.uuid) as permissionObjectIdName,
rbac.findIdNameByObjectUuid(po.objectTable, po.uuid) as permissionObjectIdName,
po.uuid as permissionObjectUuid
from rbac.queryPermissionsGrantedToSubjectId( targetSubjectUuid) as p
join rbac.grants as g on g.descendantUuid = p.uuid

32
src/main/resources/db/changelog/1-rbac/1058-rbac-generators.sql
View File

@@ -49,62 +49,62 @@ $$;
--changeset michael.hoennig:rbac-generators-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
create procedure rbac.generateRbacRoleDescriptors(prefix text, targetTable text)
create procedure rbac.generateRbacRoleDescriptors(targetTable text)
language plpgsql as $$
declare
sql text;
begin
sql = format($sql$
create or replace function %1$sOwner(entity %2$s, assumed boolean = true)
create or replace function %1$s_OWNER(entity %1$s, assumed boolean = true)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'OWNER', assumed);
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'OWNER', assumed);
end; $f$;
create or replace function %1$sAdmin(entity %2$s, assumed boolean = true)
create or replace function %1$s_ADMIN(entity %1$s, assumed boolean = true)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'ADMIN', assumed);
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'ADMIN', assumed);
end; $f$;
create or replace function %1$sAgent(entity %2$s, assumed boolean = true)
create or replace function %1$s_AGENT(entity %1$s, assumed boolean = true)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'AGENT', assumed);
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'AGENT', assumed);
end; $f$;
create or replace function %1$sTenant(entity %2$s, assumed boolean = true)
create or replace function %1$s_TENANT(entity %1$s, assumed boolean = true)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'TENANT', assumed);
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'TENANT', assumed);
end; $f$;
-- TODO: remove guest role
create or replace function %1$sGuest(entity %2$s, assumed boolean = true)
create or replace function %1$s_GUEST(entity %1$s, assumed boolean = true)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'GUEST', assumed);
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'GUEST', assumed);
end; $f$;
create or replace function %1$sReferrer(entity %2$s)
create or replace function %1$s_REFERRER(entity %1$s)
returns rbac.RoleDescriptor
language plpgsql
strict as $f$
begin
return rbac.roleDescriptorOf('%2$s', entity.uuid, 'REFERRER');
return rbac.roleDescriptorOf('%1$s', entity.uuid, 'REFERRER');
end; $f$;
$sql$, prefix, targetTable);
$sql$, targetTable);
execute sql;
end; $$;
--//
@@ -130,7 +130,7 @@ begin
-- creates a function which maps an idName to the objectUuid
sql = format($sql$
create or replace function %1$sUuidByIdName(givenIdName varchar)
create or replace function %1$s_uuid_by_id_name(givenIdName varchar)
returns uuid
language plpgsql as $f$
declare
@@ -144,7 +144,7 @@ begin
-- creates a function which maps an objectUuid to the related idName
sql = format($sql$
create or replace function %1$sIdNameByUuid(givenUuid uuid)
create or replace function %1$s_id_name_by_uuid(givenUuid uuid)
returns varchar
language sql
strict as $f$

16
src/main/resources/db/changelog/1-rbac/1080-rbac-global.sql
View File

@@ -30,7 +30,7 @@ create or replace function rbac.isGlobalAdmin()
returns boolean
language plpgsql as $$
begin
return rbac.isGranted(rbac.currentSubjectOrAssumedRolesUuids(), rbac.findRoleId(rbac.globalAdmin()));
return rbac.isGranted(rbac.currentSubjectOrAssumedRolesUuids(), rbac.findRoleId(rbac.global_ADMIN()));
end; $$;
--//
@@ -66,21 +66,21 @@ grant all privileges on rbac.global_iv to ${HSADMINNG_POSTGRES_RESTRICTED_USERNA
/*
Returns the objectUuid for a given identifying name (in this case the idName).
*/
create or replace function rbac.globalUuidByIdName(idName varchar)
create or replace function rbac.global_uuid_by_id_name(idName varchar)
returns uuid
language sql
strict as $$
select uuid from rbac.global_iv iv where iv.idName = globalUuidByIdName.idName;
select uuid from rbac.global_iv iv where iv.idName = global_uuid_by_id_name.idName;
$$;
/*
Returns the identifying name for a given objectUuid (in this case the idName).
*/
create or replace function rbac.globalIdNameByUuid(uuid uuid)
create or replace function rbac.global_id_name_by_uuid(uuid uuid)
returns varchar
language sql
strict as $$
select idName from rbac.global_iv iv where iv.uuid = globalIdNameByUuid.uuid;
select idName from rbac.global_iv iv where iv.uuid = global_id_name_by_uuid.uuid;
$$;
--//
@@ -109,7 +109,7 @@ commit;
/*
A rbac.Global administrator role.
*/
create or replace function rbac.globalAdmin(assumed boolean = true)
create or replace function rbac.global_ADMIN(assumed boolean = true)
returns rbac.RoleDescriptor
returns null on null input
stable -- leakproof
@@ -119,7 +119,7 @@ $$;
begin transaction;
call base.defineContext('creating role:rbac.global#global:ADMIN', null, null, null);
select rbac.createRole(rbac.globalAdmin());
select rbac.createRole(rbac.global_ADMIN());
commit;
--//
@@ -157,7 +157,7 @@ do language plpgsql $$
begin
call base.defineContext('creating fake test-realm admin users', null, null, null);
admins = rbac.findRoleId(rbac.globalAdmin());
admins = rbac.findRoleId(rbac.global_ADMIN());
call rbac.grantRoleToSubjectUnchecked(admins, admins, rbac.create_subject('superuser-alex@hostsharing.net'));
call rbac.grantRoleToSubjectUnchecked(admins, admins, rbac.create_subject('superuser-fran@hostsharing.net'));
perform rbac.create_subject('selfregistered-user-drew@hostsharing.org');

26
src/main/resources/db/changelog/2-rbactest/201-rbactest-customer/2013-rbactest-customer-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('rbactest.customer');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:rbactest-customer-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testCustomer', 'rbactest.customer');
call rbac.generateRbacRoleDescriptors('rbactest.customer');
--//
@@ -35,22 +35,22 @@ begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
perform rbac.defineRoleWithGrants(
testCustomerOWNER(NEW),
rbactest.customer_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN(rbac.unassumed())],
incomingSuperRoles => array[rbac.global_ADMIN(rbac.unassumed())],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
testCustomerADMIN(NEW),
rbactest.customer_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[testCustomerOWNER(NEW)]
incomingSuperRoles => array[rbactest.customer_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
testCustomerTENANT(NEW),
rbactest.customer_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[testCustomerADMIN(NEW)]
incomingSuperRoles => array[rbactest.customer_ADMIN(NEW)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -96,7 +96,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'rbactest.customer'),
rbac.globalADMIN());
rbac.global_ADMIN());
END LOOP;
end;
$$;
@@ -104,7 +104,7 @@ $$;
/**
Grants rbactest.customer INSERT permission to specified role of new global rows.
*/
create or replace function rbactest.new_customer_grants_insert_to_global_tf()
create or replace function rbactest.customer_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
@@ -112,16 +112,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'rbactest.customer'),
rbac.globalADMIN());
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_customer_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger customer_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure rbactest.new_customer_grants_insert_to_global_tf();
execute procedure rbactest.customer_grants_insert_to_global_tf();
-- ============================================================================

18
src/main/resources/db/changelog/2-rbactest/201-rbactest-customer/2018-rbactest-customer-test-data.sql
View File

@@ -7,7 +7,7 @@
/*
Generates a customer reference number for a given test data counter.
*/
create or replace function testCustomerReference(customerCount integer)
create or replace function rbactest.customer_create_test_data(customerCount integer)
returns integer
returns null on null input
language plpgsql as $$
@@ -19,7 +19,7 @@ end; $$;
/*
Creates a single customer test record with dist.
*/
create or replace procedure createTestCustomerTestData(
create or replace procedure rbactest.customer_create_test_data(
custReference integer,
custPrefix varchar
)
@@ -41,8 +41,8 @@ begin
select * into newCust
from rbactest.customer where reference=custReference;
call rbac.grantRoleToSubject(
rbac.getRoleId(testCustomerOwner(newCust)),
rbac.getRoleId(testCustomerAdmin(newCust)),
rbac.getRoleId(rbactest.customer_OWNER(newCust)),
rbac.getRoleId(rbactest.customer_ADMIN(newCust)),
custAdminUuid,
true);
end; $$;
@@ -51,7 +51,7 @@ end; $$;
/*
Creates a range of test customers for mass data generation.
*/
create or replace procedure createTestCustomerTestData(
create or replace procedure rbactest.customer_create_test_data(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
@@ -59,7 +59,7 @@ create or replace procedure createTestCustomerTestData(
begin
for t in startCount..endCount
loop
call createTestCustomerTestData(testCustomerReference(t), base.intToVarChar(t, 3));
call rbactest.customer_create_test_data(rbactest.testCustomerReference(t), base.intToVarChar(t, 3));
commit;
end loop;
end; $$;
@@ -74,9 +74,9 @@ do language plpgsql $$
begin
call base.defineContext('creating RBAC test customer', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createTestCustomerTestData(99901, 'xxx');
call createTestCustomerTestData(99902, 'yyy');
call createTestCustomerTestData(99903, 'zzz');
call rbactest.customer_create_test_data(99901, 'xxx');
call rbactest.customer_create_test_data(99902, 'yyy');
call rbactest.customer_create_test_data(99903, 'zzz');
end;
$$;
--//

36
src/main/resources/db/changelog/2-rbactest/202-rbactest-package/2023-rbactest-package-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('rbactest.package');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:rbactest-package-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testPackage', 'rbactest.package');
call rbac.generateRbacRoleDescriptors('rbactest.package');
--//
@@ -40,21 +40,21 @@ begin
perform rbac.defineRoleWithGrants(
testPackageOWNER(NEW),
rbactest.package_OWNER(NEW),
permissions => array['DELETE', 'UPDATE'],
incomingSuperRoles => array[testCustomerADMIN(newCustomer)]
incomingSuperRoles => array[rbactest.customer_ADMIN(newCustomer)]
);
perform rbac.defineRoleWithGrants(
testPackageADMIN(NEW),
incomingSuperRoles => array[testPackageOWNER(NEW)]
rbactest.package_ADMIN(NEW),
incomingSuperRoles => array[rbactest.package_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
testPackageTENANT(NEW),
rbactest.package_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[testPackageADMIN(NEW)],
outgoingSubRoles => array[testCustomerTENANT(newCustomer)]
incomingSuperRoles => array[rbactest.package_ADMIN(NEW)],
outgoingSubRoles => array[rbactest.customer_TENANT(newCustomer)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -110,11 +110,11 @@ begin
if NEW.customerUuid <> OLD.customerUuid then
call rbac.revokeRoleFromRole(testPackageOWNER(OLD), testCustomerADMIN(oldCustomer));
call rbac.grantRoleToRole(testPackageOWNER(NEW), testCustomerADMIN(newCustomer));
call rbac.revokeRoleFromRole(rbactest.package_OWNER(OLD), rbactest.customer_ADMIN(oldCustomer));
call rbac.grantRoleToRole(rbactest.package_OWNER(NEW), rbactest.customer_ADMIN(newCustomer));
call rbac.revokeRoleFromRole(testCustomerTENANT(oldCustomer), testPackageTENANT(OLD));
call rbac.grantRoleToRole(testCustomerTENANT(newCustomer), testPackageTENANT(NEW));
call rbac.revokeRoleFromRole(rbactest.customer_TENANT(oldCustomer), rbactest.package_TENANT(OLD));
call rbac.grantRoleToRole(rbactest.customer_TENANT(newCustomer), rbactest.package_TENANT(NEW));
end if;
@@ -161,7 +161,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'rbactest.package'),
testCustomerADMIN(row));
rbactest.customer_ADMIN(row));
END LOOP;
end;
$$;
@@ -169,7 +169,7 @@ $$;
/**
Grants rbactest.package INSERT permission to specified role of new customer rows.
*/
create or replace function rbactest.new_package_grants_insert_to_customer_tf()
create or replace function rbactest.package_grants_insert_to_customer_tf()
returns trigger
language plpgsql
strict as $$
@@ -177,16 +177,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'rbactest.package'),
testCustomerADMIN(NEW));
rbactest.customer_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_package_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger package_z_grants_after_insert_tg
after insert on rbactest.customer
for each row
execute procedure rbactest.new_package_grants_insert_to_customer_tf();
execute procedure rbactest.package_grants_insert_to_customer_tf();
-- ============================================================================

16
src/main/resources/db/changelog/2-rbactest/202-rbactest-package/2028-rbactest-package-test-data.sql
View File

@@ -6,7 +6,7 @@
/*
Creates the given number of test packages for the given customer.
*/
create or replace procedure createPackageTestData(customerPrefix varchar, pacCount int)
create or replace procedure rbactest.package_create_test_data(customerPrefix varchar, pacCount int)
language plpgsql as $$
declare
cust rbactest.customer;
@@ -30,8 +30,8 @@ begin
returning * into pac;
call rbac.grantRoleToSubject(
rbac.getRoleId(testCustomerAdmin(cust)),
rbac.findRoleId(testPackageAdmin(pac)),
rbac.getRoleId(rbactest.customer_ADMIN(cust)),
rbac.findRoleId(rbactest.package_ADMIN(pac)),
rbac.create_subject('pac-admin-' || pacName || '@' || cust.prefix || '.example.com'),
true);
@@ -41,7 +41,7 @@ end; $$;
/*
Creates a range of test packages for mass data generation.
*/
create or replace procedure createPackageTestData()
create or replace procedure rbactest.package_create_test_data()
language plpgsql as $$
declare
cust rbactest.customer;
@@ -49,7 +49,7 @@ begin
for cust in (select * from rbactest.customer)
loop
continue when cust.reference >= 90000; -- reserved for functional testing
call createPackageTestData(cust.prefix, 3);
call rbactest.package_create_test_data(cust.prefix, 3);
end loop;
commit;
@@ -64,9 +64,9 @@ $$;
do language plpgsql $$
begin
call createPackageTestData('xxx', 3);
call createPackageTestData('yyy', 3);
call createPackageTestData('zzz', 3);
call rbactest.package_create_test_data('xxx', 3);
call rbactest.package_create_test_data('yyy', 3);
call rbactest.package_create_test_data('zzz', 3);
end;
$$;
--//

38
src/main/resources/db/changelog/2-rbactest/203-rbactest-domain/2033-rbactest-domain-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('rbactest.domain');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:rbactest-domain-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('testDomain', 'rbactest.domain');
call rbac.generateRbacRoleDescriptors('rbactest.domain');
--//
@@ -40,17 +40,17 @@ begin
perform rbac.defineRoleWithGrants(
testDomainOWNER(NEW),
rbactest.domain_OWNER(NEW),
permissions => array['DELETE', 'UPDATE'],
incomingSuperRoles => array[testPackageADMIN(newPackage)],
outgoingSubRoles => array[testPackageTENANT(newPackage)]
incomingSuperRoles => array[rbactest.package_ADMIN(newPackage)],
outgoingSubRoles => array[rbactest.package_TENANT(newPackage)]
);
perform rbac.defineRoleWithGrants(
testDomainADMIN(NEW),
rbactest.domain_ADMIN(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[testDomainOWNER(NEW)],
outgoingSubRoles => array[testPackageTENANT(newPackage)]
incomingSuperRoles => array[rbactest.domain_OWNER(NEW)],
outgoingSubRoles => array[rbactest.package_TENANT(newPackage)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -106,14 +106,14 @@ begin
if NEW.packageUuid <> OLD.packageUuid then
call rbac.revokeRoleFromRole(testDomainOWNER(OLD), testPackageADMIN(oldPackage));
call rbac.grantRoleToRole(testDomainOWNER(NEW), testPackageADMIN(newPackage));
call rbac.revokeRoleFromRole(rbactest.domain_OWNER(OLD), rbactest.package_ADMIN(oldPackage));
call rbac.grantRoleToRole(rbactest.domain_OWNER(NEW), rbactest.package_ADMIN(newPackage));
call rbac.revokeRoleFromRole(testPackageTENANT(oldPackage), testDomainOWNER(OLD));
call rbac.grantRoleToRole(testPackageTENANT(newPackage), testDomainOWNER(NEW));
call rbac.revokeRoleFromRole(rbactest.package_TENANT(oldPackage), rbactest.domain_OWNER(OLD));
call rbac.grantRoleToRole(rbactest.package_TENANT(newPackage), rbactest.domain_OWNER(NEW));
call rbac.revokeRoleFromRole(testPackageTENANT(oldPackage), testDomainADMIN(OLD));
call rbac.grantRoleToRole(testPackageTENANT(newPackage), testDomainADMIN(NEW));
call rbac.revokeRoleFromRole(rbactest.package_TENANT(oldPackage), rbactest.domain_ADMIN(OLD));
call rbac.grantRoleToRole(rbactest.package_TENANT(newPackage), rbactest.domain_ADMIN(NEW));
end if;
@@ -160,7 +160,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'rbactest.domain'),
testPackageADMIN(row));
rbactest.package_ADMIN(row));
END LOOP;
end;
$$;
@@ -168,7 +168,7 @@ $$;
/**
Grants rbactest.domain INSERT permission to specified role of new package rows.
*/
create or replace function rbactest.new_domain_grants_insert_to_package_tf()
create or replace function rbactest.domain_grants_insert_to_package_tf()
returns trigger
language plpgsql
strict as $$
@@ -176,16 +176,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'rbactest.domain'),
testPackageADMIN(NEW));
rbactest.package_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_domain_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger domain_z_grants_after_insert_tg
after insert on rbactest.package
for each row
execute procedure rbactest.new_domain_grants_insert_to_package_tf();
execute procedure rbactest.domain_grants_insert_to_package_tf();
-- ============================================================================

26
src/main/resources/db/changelog/2-rbactest/203-rbactest-domain/2038-rbactest-domain-test-data.sql
View File

@@ -6,7 +6,7 @@
/*
Creates the given count of test unix users for a single package.
*/
create or replace procedure createdomainTestData( packageName varchar, domainCount int )
create or replace procedure rbactest.domain_create_test_data( packageName varchar, domainCount int )
language plpgsql as $$
declare
pac record;
@@ -32,12 +32,10 @@ end; $$;
/*
Creates a range of unix users for mass data generation.
*/
create or replace procedure createdomainTestData( domainPerPackage integer )
create or replace procedure rbactest.domain_create_test_data( domainPerPackage integer )
language plpgsql as $$
declare
pac record;
pacAdmin varchar;
currentTask varchar;
begin
for pac in
(select p.uuid, p.name
@@ -45,7 +43,7 @@ begin
join rbactest.customer c on p.customeruuid = c.uuid
where c.reference < 90000) -- reserved for functional testing
loop
call createdomainTestData(pac.name, 2);
call rbactest.domain_create_test_data(pac.name, 2);
commit;
end loop;
@@ -59,17 +57,17 @@ end; $$;
do language plpgsql $$
begin
call createdomainTestData('xxx00', 2);
call createdomainTestData('xxx01', 2);
call createdomainTestData('xxx02', 2);
call rbactest.domain_create_test_data('xxx00', 2);
call rbactest.domain_create_test_data('xxx01', 2);
call rbactest.domain_create_test_data('xxx02', 2);
call createdomainTestData('yyy00', 2);
call createdomainTestData('yyy01', 2);
call createdomainTestData('yyy02', 2);
call rbactest.domain_create_test_data('yyy00', 2);
call rbactest.domain_create_test_data('yyy01', 2);
call rbactest.domain_create_test_data('yyy02', 2);
call createdomainTestData('zzz00', 2);
call createdomainTestData('zzz01', 2);
call createdomainTestData('zzz02', 2);
call rbactest.domain_create_test_data('zzz00', 2);
call rbactest.domain_create_test_data('zzz01', 2);
call rbactest.domain_create_test_data('zzz02', 2);
end;
$$;
--//

14
src/main/resources/db/changelog/5-hs-office/501-contact/5013-hs-office-contact-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.contact');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-contact-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeContact', 'hs_office.contact');
call rbac.generateRbacRoleDescriptors('hs_office.contact');
--//
@@ -35,22 +35,22 @@ begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
perform rbac.defineRoleWithGrants(
hsOfficeContactOWNER(NEW),
hs_office.contact_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN()],
incomingSuperRoles => array[rbac.global_ADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficeContactADMIN(NEW),
hs_office.contact_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficeContactOWNER(NEW)]
incomingSuperRoles => array[hs_office.contact_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficeContactREFERRER(NEW),
hs_office.contact_REFERRER(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[hsOfficeContactADMIN(NEW)]
incomingSuperRoles => array[hs_office.contact_ADMIN(NEW)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);

12
src/main/resources/db/changelog/5-hs-office/501-contact/5016-hs-office-contact-migration.sql
View File

@@ -49,7 +49,7 @@ INSERT INTO hs_office.contact_legacy_id(uuid, contact_id)
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-MIGRATION-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertContactLegacyIdMapping()
create or replace function hs_office.contact_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -64,17 +64,17 @@ begin
return NEW;
end; $$;
create trigger createContactLegacyIdMapping
create trigger insert_legacy_id_mapping_tg
after insert on hs_office.contact
for each row
execute procedure insertContactLegacyIdMapping();
execute procedure hs_office.contact_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-contact-MIGRATION-delete-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deleteContactLegacyIdMapping()
create or replace function hs_office.contact_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -89,8 +89,8 @@ begin
return OLD;
end; $$;
create trigger removeContactLegacyIdMapping
create trigger delete_legacy_id_mapping_tf
before delete on hs_office.contact
for each row
execute procedure deleteContactLegacyIdMapping();
execute procedure hs_office.contact_delete_legacy_id_mapping_tf();
--/

30
src/main/resources/db/changelog/5-hs-office/501-contact/5018-hs-office-contact-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single contact test record.
*/
create or replace procedure createHsOfficeContactTestData(contCaption varchar)
create or replace procedure hs_office.contact_create_test_data(contCaption varchar)
language plpgsql as $$
declare
postalAddr varchar;
@@ -36,7 +36,7 @@ end; $$;
/*
Creates a range of test contact for mass data generation.
*/
create or replace procedure createHsOfficeContactTestData(
create or replace procedure hs_office.contact_create_test_data(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
@@ -44,7 +44,7 @@ create or replace procedure createHsOfficeContactTestData(
begin
for t in startCount..endCount
loop
call createHsOfficeContactTestData(base.intToVarChar(t, 4) || '#' || t);
call hs_office.contact_create_test_data(base.intToVarChar(t, 4) || '#' || t);
commit;
end loop;
end; $$;
@@ -58,18 +58,18 @@ end; $$;
do language plpgsql $$
begin
-- TODO: use better names
call createHsOfficeContactTestData('first contact');
call createHsOfficeContactTestData('second contact');
call createHsOfficeContactTestData('third contact');
call createHsOfficeContactTestData('fourth contact');
call createHsOfficeContactTestData('fifth contact');
call createHsOfficeContactTestData('sixth contact');
call createHsOfficeContactTestData('seventh contact');
call createHsOfficeContactTestData('eighth contact');
call createHsOfficeContactTestData('ninth contact');
call createHsOfficeContactTestData('tenth contact');
call createHsOfficeContactTestData('eleventh contact');
call createHsOfficeContactTestData('twelfth contact');
call hs_office.contact_create_test_data('first contact');
call hs_office.contact_create_test_data('second contact');
call hs_office.contact_create_test_data('third contact');
call hs_office.contact_create_test_data('fourth contact');
call hs_office.contact_create_test_data('fifth contact');
call hs_office.contact_create_test_data('sixth contact');
call hs_office.contact_create_test_data('seventh contact');
call hs_office.contact_create_test_data('eighth contact');
call hs_office.contact_create_test_data('ninth contact');
call hs_office.contact_create_test_data('tenth contact');
call hs_office.contact_create_test_data('eleventh contact');
call hs_office.contact_create_test_data('twelfth contact');
end;
$$;
--//

6
src/main/resources/db/changelog/5-hs-office/502-person/5020-hs-office-person.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-office-person-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TYPE HsOfficePersonType AS ENUM (
CREATE TYPE hs_office.PersonType AS ENUM (
'??', -- unknown
'NP', -- natural person
'LP', -- legal person
@@ -12,13 +12,13 @@ CREATE TYPE HsOfficePersonType AS ENUM (
'UF', -- unincorporated firm
'PI'); -- public institution
CREATE CAST (character varying as HsOfficePersonType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_office.PersonType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office.person
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
personType HsOfficePersonType not null,
personType hs_office.PersonType not null,
tradeName varchar(96),
salutation varchar(30),
title varchar(20),

14
src/main/resources/db/changelog/5-hs-office/502-person/5023-hs-office-person-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.person');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-person-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePerson', 'hs_office.person');
call rbac.generateRbacRoleDescriptors('hs_office.person');
--//
@@ -35,22 +35,22 @@ begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
perform rbac.defineRoleWithGrants(
hsOfficePersonOWNER(NEW),
hs_office.person_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN()],
incomingSuperRoles => array[rbac.global_ADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficePersonADMIN(NEW),
hs_office.person_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficePersonOWNER(NEW)]
incomingSuperRoles => array[hs_office.person_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficePersonREFERRER(NEW),
hs_office.person_REFERRER(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[hsOfficePersonADMIN(NEW)]
incomingSuperRoles => array[hs_office.person_ADMIN(NEW)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);

47
src/main/resources/db/changelog/5-hs-office/502-person/5028-hs-office-person-test-data.sql
View File

@@ -8,8 +8,8 @@
/*
Creates a single person test record.
*/
create or replace procedure createHsOfficePersonTestData(
newPersonType HsOfficePersonType,
create or replace procedure hs_office.person_create_test_data(
newPersonType hs_office.PersonType,
newTradeName varchar,
newFamilyName varchar = null,
newGivenName varchar = null
@@ -32,23 +32,6 @@ begin
end; $$;
--//
/*
Creates a range of test persons for mass data generation.
*/
create or replace procedure createTestPersonTestData(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
language plpgsql as $$
begin
for t in startCount..endCount
loop
call createHsOfficePersonTestData('LP', base.intToVarChar(t, 4));
commit;
end loop;
end; $$;
--//
-- ============================================================================
--changeset michael.hoennig:hs-office-person-TEST-DATA-GENERATION –context=dev,tc endDelimiter:--//
@@ -56,19 +39,19 @@ end; $$;
do language plpgsql $$
begin
call createHsOfficePersonTestData('LP', 'Hostsharing eG');
call createHsOfficePersonTestData('LP', 'First GmbH');
call createHsOfficePersonTestData('NP', null, 'Firby', 'Susan');
call createHsOfficePersonTestData('NP', null, 'Smith', 'Peter');
call createHsOfficePersonTestData('NP', null, 'Tucker', 'Jack');
call createHsOfficePersonTestData('NP', null, 'Fouler', 'Ellie');
call createHsOfficePersonTestData('LP', 'Second e.K.', 'Smith', 'Peter');
call createHsOfficePersonTestData('IF', 'Third OHG');
call createHsOfficePersonTestData('LP', 'Fourth eG');
call createHsOfficePersonTestData('UF', 'Erben Bessler', 'Mel', 'Bessler');
call createHsOfficePersonTestData('NP', null, 'Bessler', 'Anita');
call createHsOfficePersonTestData('NP', null, 'Bessler', 'Bert');
call createHsOfficePersonTestData('NP', null, 'Winkler', 'Paul');
call hs_office.person_create_test_data('LP', 'Hostsharing eG');
call hs_office.person_create_test_data('LP', 'First GmbH');
call hs_office.person_create_test_data('NP', null, 'Firby', 'Susan');
call hs_office.person_create_test_data('NP', null, 'Smith', 'Peter');
call hs_office.person_create_test_data('NP', null, 'Tucker', 'Jack');
call hs_office.person_create_test_data('NP', null, 'Fouler', 'Ellie');
call hs_office.person_create_test_data('LP', 'Second e.K.', 'Smith', 'Peter');
call hs_office.person_create_test_data('IF', 'Third OHG');
call hs_office.person_create_test_data('LP', 'Fourth eG');
call hs_office.person_create_test_data('UF', 'Erben Bessler', 'Mel', 'Bessler');
call hs_office.person_create_test_data('NP', null, 'Bessler', 'Anita');
call hs_office.person_create_test_data('NP', null, 'Bessler', 'Bert');
call hs_office.person_create_test_data('NP', null, 'Winkler', 'Paul');
end;
$$;
--//

6
src/main/resources/db/changelog/5-hs-office/503-relation/5030-hs-office-relation.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-office-relation-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TYPE HsOfficeRelationType AS ENUM (
CREATE TYPE hs_office.RelationType AS ENUM (
'UNKNOWN',
'PARTNER',
'EX_PARTNER',
@@ -14,7 +14,7 @@ CREATE TYPE HsOfficeRelationType AS ENUM (
'OPERATIONS',
'SUBSCRIBER');
CREATE CAST (character varying as HsOfficeRelationType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_office.RelationType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office.relation
(
@@ -23,7 +23,7 @@ create table if not exists hs_office.relation
anchorUuid uuid not null references hs_office.person(uuid),
holderUuid uuid not null references hs_office.person(uuid),
contactUuid uuid references hs_office.contact(uuid),
type HsOfficeRelationType not null,
type hs_office.RelationType not null,
mark varchar(24)
);
--//

48
src/main/resources/db/changelog/5-hs-office/503-relation/5033-hs-office-relation-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.relation');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-relation-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeRelation', 'hs_office.relation');
call rbac.generateRbacRoleDescriptors('hs_office.relation');
--//
@@ -48,42 +48,42 @@ begin
perform rbac.defineRoleWithGrants(
hsOfficeRelationOWNER(NEW),
hs_office.relation_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN()],
incomingSuperRoles => array[rbac.global_ADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficeRelationADMIN(NEW),
hs_office.relation_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficeRelationOWNER(NEW)]
incomingSuperRoles => array[hs_office.relation_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficeRelationAGENT(NEW),
incomingSuperRoles => array[hsOfficeRelationADMIN(NEW)]
hs_office.relation_AGENT(NEW),
incomingSuperRoles => array[hs_office.relation_ADMIN(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficeRelationTENANT(NEW),
hs_office.relation_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[
hsOfficeContactADMIN(newContact),
hsOfficeRelationAGENT(NEW)],
hs_office.contact_ADMIN(newContact),
hs_office.relation_AGENT(NEW)],
outgoingSubRoles => array[
hsOfficeContactREFERRER(newContact),
hsOfficePersonREFERRER(newAnchorPerson),
hsOfficePersonREFERRER(newHolderPerson)]
hs_office.contact_REFERRER(newContact),
hs_office.person_REFERRER(newAnchorPerson),
hs_office.person_REFERRER(newHolderPerson)]
);
IF NEW.type = 'REPRESENTATIVE' THEN
call rbac.grantRoleToRole(hsOfficePersonOWNER(newAnchorPerson), hsOfficeRelationADMIN(NEW));
call rbac.grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficePersonADMIN(newAnchorPerson));
call rbac.grantRoleToRole(hsOfficeRelationOWNER(NEW), hsOfficePersonADMIN(newHolderPerson));
call rbac.grantRoleToRole(hs_office.person_OWNER(newAnchorPerson), hs_office.relation_ADMIN(NEW));
call rbac.grantRoleToRole(hs_office.relation_AGENT(NEW), hs_office.person_ADMIN(newAnchorPerson));
call rbac.grantRoleToRole(hs_office.relation_OWNER(NEW), hs_office.person_ADMIN(newHolderPerson));
ELSE
call rbac.grantRoleToRole(hsOfficeRelationAGENT(NEW), hsOfficePersonADMIN(newHolderPerson));
call rbac.grantRoleToRole(hsOfficeRelationOWNER(NEW), hsOfficePersonADMIN(newAnchorPerson));
call rbac.grantRoleToRole(hs_office.relation_AGENT(NEW), hs_office.person_ADMIN(newHolderPerson));
call rbac.grantRoleToRole(hs_office.relation_OWNER(NEW), hs_office.person_ADMIN(newAnchorPerson));
END IF;
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -170,7 +170,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.relation'),
hsOfficePersonADMIN(row));
hs_office.person_ADMIN(row));
END LOOP;
end;
$$;
@@ -178,7 +178,7 @@ $$;
/**
Grants hs_office.relation INSERT permission to specified role of new person rows.
*/
create or replace function hs_office.new_relation_grants_insert_to_person_tf()
create or replace function hs_office.relation_grants_insert_to_person_tf()
returns trigger
language plpgsql
strict as $$
@@ -186,16 +186,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.relation'),
hsOfficePersonADMIN(NEW));
hs_office.person_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_relation_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger relation_z_grants_after_insert_tg
after insert on hs_office.person
for each row
execute procedure hs_office.new_relation_grants_insert_to_person_tf();
execute procedure hs_office.relation_grants_insert_to_person_tf();
-- ============================================================================

38
src/main/resources/db/changelog/5-hs-office/503-relation/5038-hs-office-relation-test-data.sql
View File

@@ -8,9 +8,9 @@
/*
Creates a single relation test record.
*/
create or replace procedure createHsOfficeRelationTestData(
create or replace procedure hs_office.relation_create_test_data(
holderPersonName varchar,
relationType HsOfficeRelationType,
relationType hs_office.RelationType,
anchorPersonName varchar,
contactCaption varchar,
mark varchar default null)
@@ -58,7 +58,7 @@ end; $$;
/*
Creates a range of test relation for mass data generation.
*/
create or replace procedure createHsOfficeRelationTestData(
create or replace procedure hs_office.relation_create_test_data(
startCount integer, -- count of auto generated rows before the run
endCount integer -- count of auto generated rows after the run
)
@@ -72,7 +72,7 @@ begin
select p.* from hs_office.person p where tradeName = base.intToVarChar(t, 4) into person;
select c.* from hs_office.contact c where c.caption = base.intToVarChar(t, 4) || '#' || t into contact;
call createHsOfficeRelationTestData(person.uuid, contact.uuid, 'REPRESENTATIVE');
call hs_office.relation_create_test_data(person.uuid, contact.uuid, 'REPRESENTATIVE');
commit;
end loop;
end; $$;
@@ -87,25 +87,25 @@ do language plpgsql $$
begin
call base.defineContext('creating relation test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsOfficeRelationTestData('First GmbH', 'PARTNER', 'Hostsharing eG', 'first contact');
call createHsOfficeRelationTestData('Firby', 'REPRESENTATIVE', 'First GmbH', 'first contact');
call createHsOfficeRelationTestData('First GmbH', 'DEBITOR', 'First GmbH', 'first contact');
call hs_office.relation_create_test_data('First GmbH', 'PARTNER', 'Hostsharing eG', 'first contact');
call hs_office.relation_create_test_data('Firby', 'REPRESENTATIVE', 'First GmbH', 'first contact');
call hs_office.relation_create_test_data('First GmbH', 'DEBITOR', 'First GmbH', 'first contact');
call createHsOfficeRelationTestData('Second e.K.', 'PARTNER', 'Hostsharing eG', 'second contact');
call createHsOfficeRelationTestData('Smith', 'REPRESENTATIVE', 'Second e.K.', 'second contact');
call createHsOfficeRelationTestData('Second e.K.', 'DEBITOR', 'Second e.K.', 'second contact');
call hs_office.relation_create_test_data('Second e.K.', 'PARTNER', 'Hostsharing eG', 'second contact');
call hs_office.relation_create_test_data('Smith', 'REPRESENTATIVE', 'Second e.K.', 'second contact');
call hs_office.relation_create_test_data('Second e.K.', 'DEBITOR', 'Second e.K.', 'second contact');
call createHsOfficeRelationTestData('Third OHG', 'PARTNER', 'Hostsharing eG', 'third contact');
call createHsOfficeRelationTestData('Tucker', 'REPRESENTATIVE', 'Third OHG', 'third contact');
call createHsOfficeRelationTestData('Third OHG', 'DEBITOR', 'Third OHG', 'third contact');
call hs_office.relation_create_test_data('Third OHG', 'PARTNER', 'Hostsharing eG', 'third contact');
call hs_office.relation_create_test_data('Tucker', 'REPRESENTATIVE', 'Third OHG', 'third contact');
call hs_office.relation_create_test_data('Third OHG', 'DEBITOR', 'Third OHG', 'third contact');
call createHsOfficeRelationTestData('Fourth eG', 'PARTNER', 'Hostsharing eG', 'fourth contact');
call createHsOfficeRelationTestData('Fouler', 'REPRESENTATIVE', 'Third OHG', 'third contact');
call createHsOfficeRelationTestData('Third OHG', 'DEBITOR', 'Third OHG', 'third contact');
call hs_office.relation_create_test_data('Fourth eG', 'PARTNER', 'Hostsharing eG', 'fourth contact');
call hs_office.relation_create_test_data('Fouler', 'REPRESENTATIVE', 'Third OHG', 'third contact');
call hs_office.relation_create_test_data('Third OHG', 'DEBITOR', 'Third OHG', 'third contact');
call createHsOfficeRelationTestData('Smith', 'PARTNER', 'Hostsharing eG', 'sixth contact');
call createHsOfficeRelationTestData('Smith', 'DEBITOR', 'Smith', 'third contact');
call createHsOfficeRelationTestData('Smith', 'SUBSCRIBER', 'Third OHG', 'third contact', 'members-announce');
call hs_office.relation_create_test_data('Smith', 'PARTNER', 'Hostsharing eG', 'sixth contact');
call hs_office.relation_create_test_data('Smith', 'DEBITOR', 'Smith', 'third contact');
call hs_office.relation_create_test_data('Smith', 'SUBSCRIBER', 'Third OHG', 'third contact', 'members-announce');
end;
$$;
--//

50
src/main/resources/db/changelog/5-hs-office/504-partner/5043-hs-office-partner-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.partner');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-partner-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePartner', 'hs_office.partner');
call rbac.generateRbacRoleDescriptors('hs_office.partner');
--//
@@ -42,12 +42,12 @@ begin
SELECT * FROM hs_office.partner_details WHERE uuid = NEW.detailsUuid INTO newPartnerDetails;
assert newPartnerDetails.uuid is not null, format('newPartnerDetails must not be null for NEW.detailsUuid = %s', NEW.detailsUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hsOfficeRelationOWNER(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeRelationTENANT(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hsOfficeRelationADMIN(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'DELETE'), hsOfficeRelationOWNER(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'SELECT'), hsOfficeRelationAGENT(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'UPDATE'), hsOfficeRelationAGENT(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hs_office.relation_OWNER(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hs_office.relation_TENANT(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hs_office.relation_ADMIN(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'DELETE'), hs_office.relation_OWNER(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'SELECT'), hs_office.relation_AGENT(newPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'UPDATE'), hs_office.relation_AGENT(newPartnerRel));
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
@@ -110,23 +110,23 @@ begin
if NEW.partnerRelUuid <> OLD.partnerRelUuid then
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'DELETE'), hsOfficeRelationOWNER(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hsOfficeRelationOWNER(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'DELETE'), hs_office.relation_OWNER(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hs_office.relation_OWNER(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'UPDATE'), hsOfficeRelationADMIN(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hsOfficeRelationADMIN(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'UPDATE'), hs_office.relation_ADMIN(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hs_office.relation_ADMIN(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'SELECT'), hsOfficeRelationTENANT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeRelationTENANT(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(OLD.uuid, 'SELECT'), hs_office.relation_TENANT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hs_office.relation_TENANT(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'DELETE'), hsOfficeRelationOWNER(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'DELETE'), hsOfficeRelationOWNER(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'DELETE'), hs_office.relation_OWNER(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'DELETE'), hs_office.relation_OWNER(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'UPDATE'), hsOfficeRelationAGENT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'UPDATE'), hsOfficeRelationAGENT(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'UPDATE'), hs_office.relation_AGENT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'UPDATE'), hs_office.relation_AGENT(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'SELECT'), hsOfficeRelationAGENT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'SELECT'), hsOfficeRelationAGENT(newPartnerRel));
call rbac.revokePermissionFromRole(rbac.getPermissionId(oldPartnerDetails.uuid, 'SELECT'), hs_office.relation_AGENT(oldPartnerRel));
call rbac.grantPermissionToRole(rbac.createPermission(newPartnerDetails.uuid, 'SELECT'), hs_office.relation_AGENT(newPartnerRel));
end if;
@@ -173,7 +173,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.partner'),
rbac.globalADMIN());
rbac.global_ADMIN());
END LOOP;
end;
$$;
@@ -181,7 +181,7 @@ $$;
/**
Grants hs_office.partner INSERT permission to specified role of new global rows.
*/
create or replace function hs_office.new_partner_grants_insert_to_global_tf()
create or replace function hs_office.partner_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
@@ -189,16 +189,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.partner'),
rbac.globalADMIN());
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_partner_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger partner_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure hs_office.new_partner_grants_insert_to_global_tf();
execute procedure hs_office.partner_grants_insert_to_global_tf();
-- ============================================================================

14
src/main/resources/db/changelog/5-hs-office/504-partner/5044-hs-office-partner-details-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.partner_details');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-partner-details-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficePartnerDetails', 'hs_office.partner_details');
call rbac.generateRbacRoleDescriptors('hs_office.partner_details');
--//
@@ -77,7 +77,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.partner_details'),
rbac.globalADMIN());
rbac.global_ADMIN());
END LOOP;
end;
$$;
@@ -85,7 +85,7 @@ $$;
/**
Grants hs_office.partner_details INSERT permission to specified role of new global rows.
*/
create or replace function hs_office.new_partner_details_grants_insert_to_global_tf()
create or replace function hs_office.partner_details_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
@@ -93,16 +93,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.partner_details'),
rbac.globalADMIN());
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_partner_details_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger partner_details_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure hs_office.new_partner_details_grants_insert_to_global_tf();
execute procedure hs_office.partner_details_grants_insert_to_global_tf();
-- ============================================================================

12
src/main/resources/db/changelog/5-hs-office/504-partner/5046-hs-office-partner-migration.sql
View File

@@ -48,7 +48,7 @@ INSERT INTO hs_office.partner_legacy_id(uuid, bp_id)
-- ============================================================================
--changeset michael.hoennig:hs-office-partner-MIGRATION-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertPartnerLegacyIdMapping()
create or replace function hs_office.partner_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -63,17 +63,17 @@ begin
return NEW;
end; $$;
create trigger createPartnerLegacyIdMapping
create trigger insert_legacy_id_mapping_tf
after insert on hs_office.partner
for each row
execute procedure insertPartnerLegacyIdMapping();
execute procedure hs_office.partner_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-partner-MIGRATION-delete-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deletePartnerLegacyIdMapping()
create or replace function hs_office.partner_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -88,8 +88,8 @@ begin
return OLD;
end; $$;
create trigger removePartnerLegacyIdMapping
create trigger delete_legacy_id_mapping_tg
before delete on hs_office.partner
for each row
execute procedure deletePartnerLegacyIdMapping();
execute procedure hs_office.partner_delete_legacy_id_mapping_tf();
--/

12
src/main/resources/db/changelog/5-hs-office/504-partner/5048-hs-office-partner-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single partner test record.
*/
create or replace procedure createHsOfficePartnerTestData(
create or replace procedure hs_office.partner_create_test_data(
mandantTradeName varchar,
newPartnerNumber numeric(5),
partnerPersonName varchar,
@@ -73,11 +73,11 @@ do language plpgsql $$
begin
call base.defineContext('creating partner test-data ', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsOfficePartnerTestData('Hostsharing eG', 10001, 'First GmbH', 'first contact');
call createHsOfficePartnerTestData('Hostsharing eG', 10002, 'Second e.K.', 'second contact');
call createHsOfficePartnerTestData('Hostsharing eG', 10003, 'Third OHG', 'third contact');
call createHsOfficePartnerTestData('Hostsharing eG', 10004, 'Fourth eG', 'fourth contact');
call createHsOfficePartnerTestData('Hostsharing eG', 10010, 'Smith', 'fifth contact');
call hs_office.partner_create_test_data('Hostsharing eG', 10001, 'First GmbH', 'first contact');
call hs_office.partner_create_test_data('Hostsharing eG', 10002, 'Second e.K.', 'second contact');
call hs_office.partner_create_test_data('Hostsharing eG', 10003, 'Third OHG', 'third contact');
call hs_office.partner_create_test_data('Hostsharing eG', 10004, 'Fourth eG', 'fourth contact');
call hs_office.partner_create_test_data('Hostsharing eG', 10010, 'Smith', 'fifth contact');
end;
$$;
--//

14
src/main/resources/db/changelog/5-hs-office/505-bankaccount/5053-hs-office-bankaccount-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.bankaccount');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-bankaccount-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeBankAccount', 'hs_office.bankaccount');
call rbac.generateRbacRoleDescriptors('hs_office.bankaccount');
--//
@@ -35,22 +35,22 @@ begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
perform rbac.defineRoleWithGrants(
hsOfficeBankAccountOWNER(NEW),
hs_office.bankaccount_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN()],
incomingSuperRoles => array[rbac.global_ADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficeBankAccountADMIN(NEW),
hs_office.bankaccount_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficeBankAccountOWNER(NEW)]
incomingSuperRoles => array[hs_office.bankaccount_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficeBankAccountREFERRER(NEW),
hs_office.bankaccount_REFERRER(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[hsOfficeBankAccountADMIN(NEW)]
incomingSuperRoles => array[hs_office.bankaccount_ADMIN(NEW)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);

18
src/main/resources/db/changelog/5-hs-office/505-bankaccount/5058-hs-office-bankaccount-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single bankaccount test record.
*/
create or replace procedure createHsOfficeBankAccountTestData(givenHolder varchar, givenIBAN varchar, givenBIC varchar)
create or replace procedure hs_office.bankaccount_create_test_data(givenHolder varchar, givenIBAN varchar, givenBIC varchar)
language plpgsql as $$
declare
emailAddr varchar;
@@ -34,13 +34,13 @@ do language plpgsql $$
call base.defineContext('creating bankaccount test-data');
-- IBANs+BICs taken from https://ibanvalidieren.de/beispiele.html
call createHsOfficeBankAccountTestData('First GmbH', 'DE02120300000000202051', 'BYLADEM1001');
call createHsOfficeBankAccountTestData('Peter Smith', 'DE02500105170137075030', 'INGDDEFF');
call createHsOfficeBankAccountTestData('Second e.K.', 'DE02100500000054540402', 'BELADEBE');
call createHsOfficeBankAccountTestData('Third OHG', 'DE02300209000106531065', 'CMCIDEDD');
call createHsOfficeBankAccountTestData('Fourth eG', 'DE02200505501015871393', 'HASPDEHH');
call createHsOfficeBankAccountTestData('Mel Bessler', 'DE02100100100006820101', 'PBNKDEFF');
call createHsOfficeBankAccountTestData('Anita Bessler', 'DE02300606010002474689', 'DAAEDEDD');
call createHsOfficeBankAccountTestData('Paul Winkler', 'DE02600501010002034304', 'SOLADEST600');
call hs_office.bankaccount_create_test_data('First GmbH', 'DE02120300000000202051', 'BYLADEM1001');
call hs_office.bankaccount_create_test_data('Peter Smith', 'DE02500105170137075030', 'INGDDEFF');
call hs_office.bankaccount_create_test_data('Second e.K.', 'DE02100500000054540402', 'BELADEBE');
call hs_office.bankaccount_create_test_data('Third OHG', 'DE02300209000106531065', 'CMCIDEDD');
call hs_office.bankaccount_create_test_data('Fourth eG', 'DE02200505501015871393', 'HASPDEHH');
call hs_office.bankaccount_create_test_data('Mel Bessler', 'DE02100100100006820101', 'PBNKDEFF');
call hs_office.bankaccount_create_test_data('Anita Bessler', 'DE02300606010002474689', 'DAAEDEDD');
call hs_office.bankaccount_create_test_data('Paul Winkler', 'DE02600501010002034304', 'SOLADEST600');
end;
$$;

30
src/main/resources/db/changelog/5-hs-office/506-debitor/5063-hs-office-debitor-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.debitor');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-debitor-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeDebitor', 'hs_office.debitor');
call rbac.generateRbacRoleDescriptors('hs_office.debitor');
--//
@@ -51,15 +51,15 @@ begin
SELECT * FROM hs_office.bankaccount WHERE uuid = NEW.refundBankAccountUuid INTO newRefundBankAccount;
call rbac.grantRoleToRole(hsOfficeBankAccountREFERRER(newRefundBankAccount), hsOfficeRelationAGENT(newDebitorRel));
call rbac.grantRoleToRole(hsOfficeRelationADMIN(newDebitorRel), hsOfficeRelationADMIN(newPartnerRel));
call rbac.grantRoleToRole(hsOfficeRelationAGENT(newDebitorRel), hsOfficeBankAccountADMIN(newRefundBankAccount));
call rbac.grantRoleToRole(hsOfficeRelationAGENT(newDebitorRel), hsOfficeRelationAGENT(newPartnerRel));
call rbac.grantRoleToRole(hsOfficeRelationTENANT(newPartnerRel), hsOfficeRelationAGENT(newDebitorRel));
call rbac.grantRoleToRole(hs_office.bankaccount_REFERRER(newRefundBankAccount), hs_office.relation_AGENT(newDebitorRel));
call rbac.grantRoleToRole(hs_office.relation_ADMIN(newDebitorRel), hs_office.relation_ADMIN(newPartnerRel));
call rbac.grantRoleToRole(hs_office.relation_AGENT(newDebitorRel), hs_office.bankaccount_ADMIN(newRefundBankAccount));
call rbac.grantRoleToRole(hs_office.relation_AGENT(newDebitorRel), hs_office.relation_AGENT(newPartnerRel));
call rbac.grantRoleToRole(hs_office.relation_TENANT(newPartnerRel), hs_office.relation_AGENT(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hsOfficeRelationOWNER(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeRelationTENANT(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hsOfficeRelationADMIN(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), hs_office.relation_OWNER(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hs_office.relation_TENANT(newDebitorRel));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hs_office.relation_ADMIN(newDebitorRel));
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
@@ -146,7 +146,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.debitor'),
rbac.globalADMIN());
rbac.global_ADMIN());
END LOOP;
end;
$$;
@@ -154,7 +154,7 @@ $$;
/**
Grants hs_office.debitor INSERT permission to specified role of new global rows.
*/
create or replace function hs_office.new_debitor_grants_insert_to_global_tf()
create or replace function hs_office.debitor_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
@@ -162,16 +162,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.debitor'),
rbac.globalADMIN());
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_debitor_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger debitor_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure hs_office.new_debitor_grants_insert_to_global_tf();
execute procedure hs_office.debitor_grants_insert_to_global_tf();
-- ============================================================================

8
src/main/resources/db/changelog/5-hs-office/506-debitor/5068-hs-office-debitor-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single debitor test record.
*/
create or replace procedure createHsOfficeDebitorTestData(
create or replace procedure hs_office.debitor_create_test_data(
withDebitorNumberSuffix numeric(5),
forPartnerPersonName varchar,
forBillingContactCaption varchar,
@@ -52,9 +52,9 @@ do language plpgsql $$
begin
call base.defineContext('creating debitor test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsOfficeDebitorTestData(11, 'First GmbH', 'first contact', 'fir');
call createHsOfficeDebitorTestData(12, 'Second e.K.', 'second contact', 'sec');
call createHsOfficeDebitorTestData(13, 'Third OHG', 'third contact', 'thi');
call hs_office.debitor_create_test_data(11, 'First GmbH', 'first contact', 'fir');
call hs_office.debitor_create_test_data(12, 'Second e.K.', 'second contact', 'sec');
call hs_office.debitor_create_test_data(13, 'Third OHG', 'third contact', 'thi');
end;
$$;
--//

40
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5073-hs-office-sepamandate-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.sepamandate');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-sepamandate-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeSepaMandate', 'hs_office.sepamandate');
call rbac.generateRbacRoleDescriptors('hs_office.sepamandate');
--//
@@ -48,34 +48,34 @@ begin
perform rbac.defineRoleWithGrants(
hsOfficeSepaMandateOWNER(NEW),
hs_office.sepamandate_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[rbac.globalADMIN()],
incomingSuperRoles => array[rbac.global_ADMIN()],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficeSepaMandateADMIN(NEW),
hs_office.sepamandate_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsOfficeSepaMandateOWNER(NEW)]
incomingSuperRoles => array[hs_office.sepamandate_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsOfficeSepaMandateAGENT(NEW),
incomingSuperRoles => array[hsOfficeSepaMandateADMIN(NEW)],
hs_office.sepamandate_AGENT(NEW),
incomingSuperRoles => array[hs_office.sepamandate_ADMIN(NEW)],
outgoingSubRoles => array[
hsOfficeBankAccountREFERRER(newBankAccount),
hsOfficeRelationAGENT(newDebitorRel)]
hs_office.bankaccount_REFERRER(newBankAccount),
hs_office.relation_AGENT(newDebitorRel)]
);
perform rbac.defineRoleWithGrants(
hsOfficeSepaMandateREFERRER(NEW),
hs_office.sepamandate_REFERRER(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[
hsOfficeBankAccountADMIN(newBankAccount),
hsOfficeRelationAGENT(newDebitorRel),
hsOfficeSepaMandateAGENT(NEW)],
outgoingSubRoles => array[hsOfficeRelationTENANT(newDebitorRel)]
hs_office.bankaccount_ADMIN(newBankAccount),
hs_office.relation_AGENT(newDebitorRel),
hs_office.sepamandate_AGENT(NEW)],
outgoingSubRoles => array[hs_office.relation_TENANT(newDebitorRel)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -121,7 +121,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.sepamandate'),
hsOfficeRelationADMIN(row));
hs_office.relation_ADMIN(row));
END LOOP;
end;
$$;
@@ -129,7 +129,7 @@ $$;
/**
Grants hs_office.sepamandate INSERT permission to specified role of new relation rows.
*/
create or replace function hs_office.new_sepamandate_grants_insert_to_relation_tf()
create or replace function hs_office.sepamandate_grants_insert_to_relation_tf()
returns trigger
language plpgsql
strict as $$
@@ -137,16 +137,16 @@ begin
if NEW.type = 'DEBITOR' then
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.sepamandate'),
hsOfficeRelationADMIN(NEW));
hs_office.relation_ADMIN(NEW));
end if;
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_sepamandate_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger sepamandate_z_grants_after_insert_tg
after insert on hs_office.relation
for each row
execute procedure hs_office.new_sepamandate_grants_insert_to_relation_tf();
execute procedure hs_office.sepamandate_grants_insert_to_relation_tf();
-- ============================================================================

12
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5076-hs-office-sepamandate-migration.sql
View File

@@ -50,7 +50,7 @@ INSERT INTO hs_office.sepamandate_legacy_id(uuid, sepa_mandate_id)
-- ============================================================================
--changeset michael.hoennig:hs-office-sepamandate-MIGRATION-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertSepaMandateLegacyIdMapping()
create or replace function hs_office.sepamandate_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -65,17 +65,17 @@ begin
return NEW;
end; $$;
create trigger createSepaMandateLegacyIdMapping
create trigger insert_legacy_id_mapping_tg
after insert on hs_office.sepamandate
for each row
execute procedure insertSepaMandateLegacyIdMapping();
execute procedure hs_office.sepamandate_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-sepamandate-MIGRATION-delete-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deleteSepaMandateLegacyIdMapping()
create or replace function hs_office.sepamandate_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -90,8 +90,8 @@ begin
return OLD;
end; $$;
create trigger removeSepaMandateLegacyIdMapping
create trigger delete_legacy_id_mapping_tf
before delete on hs_office.sepamandate
for each row
execute procedure deleteSepaMandateLegacyIdMapping();
execute procedure hs_office.sepamandate_delete_legacy_id_mapping_tf();
--/

8
src/main/resources/db/changelog/5-hs-office/507-sepamandate/5078-hs-office-sepamandate-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single sepaMandate test record.
*/
create or replace procedure createHsOfficeSepaMandateTestData(
create or replace procedure hs_office.sepamandate_create_test_data(
forPartnerNumber numeric(5),
forDebitorSuffix char(2),
forIban varchar,
@@ -45,9 +45,9 @@ do language plpgsql $$
begin
call base.defineContext('creating SEPA-mandate test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsOfficeSepaMandateTestData(10001, '11', 'DE02120300000000202051', 'ref-10001-11');
call createHsOfficeSepaMandateTestData(10002, '12', 'DE02100500000054540402', 'ref-10002-12');
call createHsOfficeSepaMandateTestData(10003, '13', 'DE02300209000106531065', 'ref-10003-13');
call hs_office.sepamandate_create_test_data(10001, '11', 'DE02120300000000202051', 'ref-10001-11');
call hs_office.sepamandate_create_test_data(10002, '12', 'DE02100500000054540402', 'ref-10002-12');
call hs_office.sepamandate_create_test_data(10003, '13', 'DE02300209000106531065', 'ref-10003-13');
end;
$$;
--//

6
src/main/resources/db/changelog/5-hs-office/510-membership/5100-hs-office-membership.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-office-membership-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TYPE HsOfficeMembershipStatus AS ENUM (
CREATE TYPE hs_office.HsOfficeMembershipStatus AS ENUM (
'INVALID',
'ACTIVE',
'CANCELLED',
@@ -15,7 +15,7 @@ CREATE TYPE HsOfficeMembershipStatus AS ENUM (
'UNKNOWN'
);
CREATE CAST (character varying as HsOfficeMembershipStatus) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_office.HsOfficeMembershipStatus) WITH INOUT AS IMPLICIT;
create table if not exists hs_office.membership
(
@@ -24,7 +24,7 @@ create table if not exists hs_office.membership
partnerUuid uuid not null references hs_office.partner(uuid),
memberNumberSuffix char(2) not null check (memberNumberSuffix::text ~ '^[0-9][0-9]$'),
validity daterange not null,
status HsOfficeMembershipStatus not null default 'ACTIVE',
status hs_office.HsOfficeMembershipStatus not null default 'ACTIVE',
membershipFeeBillable boolean not null default true,
UNIQUE(partnerUuid, memberNumberSuffix)

30
src/main/resources/db/changelog/5-hs-office/510-membership/5103-hs-office-membership-rbac.sql
View File

@@ -12,7 +12,7 @@ call rbac.generateRelatedRbacObject('hs_office.membership');
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-membership-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeMembership', 'hs_office.membership');
call rbac.generateRbacRoleDescriptors('hs_office.membership');
--//
@@ -44,25 +44,25 @@ begin
perform rbac.defineRoleWithGrants(
hsOfficeMembershipOWNER(NEW),
hs_office.membership_OWNER(NEW),
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsOfficeMembershipADMIN(NEW),
hs_office.membership_ADMIN(NEW),
permissions => array['DELETE', 'UPDATE'],
incomingSuperRoles => array[
hsOfficeMembershipOWNER(NEW),
hsOfficeRelationADMIN(newPartnerRel)]
hs_office.membership_OWNER(NEW),
hs_office.relation_ADMIN(newPartnerRel)]
);
perform rbac.defineRoleWithGrants(
hsOfficeMembershipAGENT(NEW),
hs_office.membership_AGENT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[
hsOfficeMembershipADMIN(NEW),
hsOfficeRelationAGENT(newPartnerRel)],
outgoingSubRoles => array[hsOfficeRelationTENANT(newPartnerRel)]
hs_office.membership_ADMIN(NEW),
hs_office.relation_AGENT(newPartnerRel)],
outgoingSubRoles => array[hs_office.relation_TENANT(newPartnerRel)]
);
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
@@ -108,7 +108,7 @@ do language plpgsql $$
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.membership'),
rbac.globalADMIN());
rbac.global_ADMIN());
END LOOP;
end;
$$;
@@ -116,7 +116,7 @@ $$;
/**
Grants hs_office.membership INSERT permission to specified role of new global rows.
*/
create or replace function hs_office.new_membership_grants_insert_to_global_tf()
create or replace function hs_office.membership_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
@@ -124,16 +124,16 @@ begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.membership'),
rbac.globalADMIN());
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_membership_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger membership_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure hs_office.new_membership_grants_insert_to_global_tf();
execute procedure hs_office.membership_grants_insert_to_global_tf();
-- ============================================================================

8
src/main/resources/db/changelog/5-hs-office/510-membership/5108-hs-office-membership-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single membership test record.
*/
create or replace procedure createHsOfficeMembershipTestData(
create or replace procedure hs_office.membership_create_test_data(
forPartnerNumber numeric(5),
newMemberNumberSuffix char(2) )
language plpgsql as $$
@@ -35,9 +35,9 @@ do language plpgsql $$
begin
call base.defineContext('creating Membership test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsOfficeMembershipTestData(10001, '01');
call createHsOfficeMembershipTestData(10002, '02');
call createHsOfficeMembershipTestData(10003, '03');
call hs_office.membership_create_test_data(10001, '01');
call hs_office.membership_create_test_data(10002, '02');
call hs_office.membership_create_test_data(10003, '03');
end;
$$;
--//

22
src/main/resources/db/changelog/5-hs-office/511-coopshares/5110-hs-office-coopshares.sql
View File

@@ -4,20 +4,20 @@
--changeset michael.hoennig:hs-office-coopshares-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TYPE HsOfficeCoopSharesTransactionType AS ENUM ('ADJUSTMENT', 'SUBSCRIPTION', 'CANCELLATION');
CREATE TYPE hs_office.CoopSharesTransactionType AS ENUM ('ADJUSTMENT', 'SUBSCRIPTION', 'CANCELLATION');
CREATE CAST (character varying as HsOfficeCoopSharesTransactionType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_office.CoopSharesTransactionType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office.coopsharestransaction
create table if not exists hs_office.coopsharetx
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
membershipUuid uuid not null references hs_office.membership(uuid),
transactionType HsOfficeCoopSharesTransactionType not null,
transactionType hs_office.CoopSharesTransactionType not null,
valueDate date not null,
shareCount integer not null,
reference varchar(48) not null,
adjustedShareTxUuid uuid unique REFERENCES hs_office.coopsharestransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
adjustedShareTxUuid uuid unique REFERENCES hs_office.coopsharetx(uuid) DEFERRABLE INITIALLY DEFERRED,
comment varchar(512)
);
--//
@@ -26,7 +26,7 @@ create table if not exists hs_office.coopsharestransaction
--changeset michael.hoennig:hs-office-coopshares-BUSINESS-RULES endDelimiter:--//
-- ----------------------------------------------------------------------------
alter table hs_office.coopsharestransaction
alter table hs_office.coopsharetx
add constraint reverse_entry_missing
check ( transactionType = 'ADJUSTMENT' and adjustedShareTxUuid is not null
or transactionType <> 'ADJUSTMENT' and adjustedShareTxUuid is null);
@@ -36,7 +36,7 @@ alter table hs_office.coopsharestransaction
--changeset michael.hoennig:hs-office-coopshares-SHARE-COUNT-CONSTRAINT endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function checkSharesByMembershipUuid(forMembershipUuid UUID, newShareCount integer)
create or replace function hs_office.coopsharestx_check_positive_total(forMembershipUuid UUID, newShareCount integer)
returns boolean
language plpgsql as $$
declare
@@ -44,7 +44,7 @@ declare
totalShareCount integer;
begin
select sum(cst.shareCount)
from hs_office.coopsharestransaction cst
from hs_office.coopsharetx cst
where cst.membershipUuid = forMembershipUuid
into currentShareCount;
totalShareCount := currentShareCount + newShareCount;
@@ -54,9 +54,9 @@ begin
return true;
end; $$;
alter table hs_office.coopsharestransaction
alter table hs_office.coopsharetx
add constraint check_positive_total_shares_count
check ( checkSharesByMembershipUuid(membershipUuid, shareCount) );
check ( hs_office.coopsharestx_check_positive_total(membershipUuid, shareCount) );
--//
@@ -64,5 +64,5 @@ alter table hs_office.coopsharestransaction
--changeset michael.hoennig:hs-office-coopshares-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office.coopsharestransaction');
call base.create_journal('hs_office.coopsharetx');
--//

76
src/main/resources/db/changelog/5-hs-office/511-coopshares/5113-hs-office-coopshares-rbac.sql
View File

@@ -3,29 +3,29 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-coopsharestransaction-rbac-OBJECT endDelimiter:--//
--changeset RbacObjectGenerator:hs-office-coopsharetx-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office.coopsharestransaction');
call rbac.generateRelatedRbacObject('hs_office.coopsharetx');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-coopsharestransaction-rbac-ROLE-DESCRIPTORS endDelimiter:--//
--changeset RbacRoleDescriptorsGenerator:hs-office-coopsharetx-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeCoopSharesTransaction', 'hs_office.coopsharestransaction');
call rbac.generateRbacRoleDescriptors('hs_office.coopsharetx');
--//
-- ============================================================================
--changeset RolesGrantsAndPermissionsGenerator:hs-office-coopsharestransaction-rbac-insert-trigger endDelimiter:--//
--changeset RolesGrantsAndPermissionsGenerator:hs-office-coopsharetx-rbac-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure hs_office.coopsharestransaction_build_rbac_system(
NEW hs_office.coopsharestransaction
create or replace procedure hs_office.coopsharetx_build_rbac_system(
NEW hs_office.coopsharetx
)
language plpgsql as $$
@@ -38,114 +38,114 @@ begin
SELECT * FROM hs_office.membership WHERE uuid = NEW.membershipUuid INTO newMembership;
assert newMembership.uuid is not null, format('newMembership must not be null for NEW.membershipUuid = %s', NEW.membershipUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeMembershipAGENT(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hsOfficeMembershipADMIN(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hs_office.membership_AGENT(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hs_office.membership_ADMIN(newMembership));
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopsharestransaction row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopsharetx row.
*/
create or replace function hs_office.coopsharestransaction_build_rbac_system_after_insert_tf()
create or replace function hs_office.coopsharetx_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_office.coopsharestransaction_build_rbac_system(NEW);
call hs_office.coopsharetx_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.coopsharestransaction
after insert on hs_office.coopsharetx
for each row
execute procedure hs_office.coopsharestransaction_build_rbac_system_after_insert_tf();
execute procedure hs_office.coopsharetx_build_rbac_system_after_insert_tf();
--//
-- ============================================================================
--changeset InsertTriggerGenerator:hs-office-coopsharestransaction-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-coopsharetx-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office.membership ----------------------------
/*
Grants INSERT INTO hs_office.coopsharestransaction permissions to specified role of pre-existing hs_office.membership rows.
Grants INSERT INTO hs_office.coopsharetx permissions to specified role of pre-existing hs_office.membership rows.
*/
do language plpgsql $$
declare
row hs_office.membership;
begin
call base.defineContext('create INSERT INTO hs_office.coopsharestransaction permissions for pre-exising hs_office.membership rows');
call base.defineContext('create INSERT INTO hs_office.coopsharetx permissions for pre-exising hs_office.membership rows');
FOR row IN SELECT * FROM hs_office.membership
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopsharestransaction'),
hsOfficeMembershipADMIN(row));
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopsharetx'),
hs_office.membership_ADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office.coopsharestransaction INSERT permission to specified role of new membership rows.
Grants hs_office.coopsharetx INSERT permission to specified role of new membership rows.
*/
create or replace function hs_office.new_coopsharetx_grants_insert_to_membership_tf()
create or replace function hs_office.coopsharetx_grants_insert_to_membership_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopsharestransaction'),
hsOfficeMembershipADMIN(NEW));
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopsharetx'),
hs_office.membership_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_coopsharestransaction_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger coopsharetx_z_grants_after_insert_tg
after insert on hs_office.membership
for each row
execute procedure hs_office.new_coopsharetx_grants_insert_to_membership_tf();
execute procedure hs_office.coopsharetx_grants_insert_to_membership_tf();
-- ============================================================================
--changeset InsertTriggerGenerator:hs-office-coopsharestransaction-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-coopsharetx-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopsharestransaction.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopsharetx.
*/
create or replace function hs_office.coopsharestransaction_insert_permission_check_tf()
create or replace function hs_office.coopsharetx_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT permission via direct foreign key: NEW.membershipUuid
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopsharestransaction') then
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopsharetx') then
return NEW;
end if;
raise exception '[403] insert into hs_office.coopsharestransaction values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.coopsharetx values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger coopsharestransaction_insert_permission_check_tg
before insert on hs_office.coopsharestransaction
create trigger coopsharetx_insert_permission_check_tg
before insert on hs_office.coopsharetx
for each row
execute procedure hs_office.coopsharestransaction_insert_permission_check_tf();
execute procedure hs_office.coopsharetx_insert_permission_check_tf();
--//
-- ============================================================================
--changeset RbacIdentityViewGenerator:hs-office-coopsharestransaction-rbac-IDENTITY-VIEW endDelimiter:--//
--changeset RbacIdentityViewGenerator:hs-office-coopsharetx-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopsharestransaction',
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopsharetx',
$idName$
reference
$idName$);
@@ -153,9 +153,9 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office.coopsharestransactio
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-coopsharestransaction-rbac-RESTRICTED-VIEW endDelimiter:--//
--changeset RbacRestrictedViewGenerator:hs-office-coopsharetx-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office.coopsharestransaction',
call rbac.generateRbacRestrictedView('hs_office.coopsharetx',
$orderBy$
reference
$orderBy$,

20
src/main/resources/db/changelog/5-hs-office/511-coopshares/5116-hs-office-coopshares-migration.sql
View File

@@ -9,7 +9,7 @@
CREATE TABLE hs_office.coopsharestransaction_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office.coopsharestransaction(uuid),
uuid uuid NOT NULL REFERENCES hs_office.coopsharetx(uuid),
member_share_id integer NOT NULL
);
--//
@@ -42,14 +42,14 @@ ALTER TABLE hs_office.coopsharestransaction_legacy_id
CALL base.defineContext('schema-migration');
INSERT INTO hs_office.coopsharestransaction_legacy_id(uuid, member_share_id)
SELECT uuid, nextVal('hs_office.coopsharestransaction_legacy_id_seq') FROM hs_office.coopsharestransaction;
SELECT uuid, nextVal('hs_office.coopsharestransaction_legacy_id_seq') FROM hs_office.coopsharetx;
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-coopShares-MIGRATION-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertCoopSharesLegacyIdMapping()
create or replace function hs_office.coopsharetx_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -64,17 +64,17 @@ begin
return NEW;
end; $$;
create trigger createCoopSharesLegacyIdMapping
after insert on hs_office.coopsharestransaction
create trigger insert_legacy_id_mapping_tg
after insert on hs_office.coopsharetx
for each row
execute procedure insertCoopSharesLegacyIdMapping();
execute procedure hs_office.coopsharetx_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-coopShares-MIGRATION-delete-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deleteCoopSharesLegacyIdMapping()
create or replace function hs_office.coopsharetx_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -89,8 +89,8 @@ begin
return OLD;
end; $$;
create trigger removeCoopSharesLegacyIdMapping
before delete on hs_office.coopsharestransaction
create trigger delete_legacy_id_mapping_tg
before delete on hs_office.coopsharetx
for each row
execute procedure deleteCoopSharesLegacyIdMapping();
execute procedure hs_office.coopsharetx_delete_legacy_id_mapping_tf();
--/

10
src/main/resources/db/changelog/5-hs-office/511-coopshares/5118-hs-office-coopshares-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single coopSharesTransaction test record.
*/
create or replace procedure createHsOfficeCoopSharesTransactionTestData(
create or replace procedure hs_office.coopsharetx_create_test_data(
givenPartnerNumber numeric,
givenMemberNumberSuffix char(2)
)
@@ -27,7 +27,7 @@ begin
raise notice 'creating test coopSharesTransaction: %', givenPartnerNumber::text || givenMemberNumberSuffix;
subscriptionEntryUuid := uuid_generate_v4();
insert
into hs_office.coopsharestransaction(uuid, membershipuuid, transactiontype, valuedate, sharecount, reference, comment, adjustedShareTxUuid)
into hs_office.coopsharetx(uuid, membershipuuid, transactiontype, valuedate, sharecount, reference, comment, adjustedShareTxUuid)
values
(uuid_generate_v4(), membership.uuid, 'SUBSCRIPTION', '2010-03-15', 4, 'ref '||givenPartnerNumber::text || givenMemberNumberSuffix||'-1', 'initial subscription', null),
(uuid_generate_v4(), membership.uuid, 'CANCELLATION', '2021-09-01', -2, 'ref '||givenPartnerNumber::text || givenMemberNumberSuffix||'-2', 'cancelling some', null),
@@ -46,8 +46,8 @@ do language plpgsql $$
call base.defineContext('creating coopSharesTransaction test-data');
SET CONSTRAINTS ALL DEFERRED;
call createHsOfficeCoopSharesTransactionTestData(10001, '01');
call createHsOfficeCoopSharesTransactionTestData(10002, '02');
call createHsOfficeCoopSharesTransactionTestData(10003, '03');
call hs_office.coopsharetx_create_test_data(10001, '01');
call hs_office.coopsharetx_create_test_data(10002, '02');
call hs_office.coopsharetx_create_test_data(10003, '03');
end;
$$;

22
src/main/resources/db/changelog/5-hs-office/512-coopassets/5120-hs-office-coopassets.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-office-coopassets-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TYPE HsOfficeCoopAssetsTransactionType AS ENUM ('ADJUSTMENT',
CREATE TYPE hs_office.CoopAssetsTransactionType AS ENUM ('ADJUSTMENT',
'DEPOSIT',
'DISBURSAL',
'TRANSFER',
@@ -13,18 +13,18 @@ CREATE TYPE HsOfficeCoopAssetsTransactionType AS ENUM ('ADJUSTMENT',
'LOSS',
'LIMITATION');
CREATE CAST (character varying as HsOfficeCoopAssetsTransactionType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_office.CoopAssetsTransactionType) WITH INOUT AS IMPLICIT;
create table if not exists hs_office.coopassetstransaction
create table if not exists hs_office.coopassettx
(
uuid uuid unique references rbac.object (uuid) initially deferred,
version int not null default 0,
membershipUuid uuid not null references hs_office.membership(uuid),
transactionType HsOfficeCoopAssetsTransactionType not null,
transactionType hs_office.CoopAssetsTransactionType not null,
valueDate date not null,
assetValue money not null,
reference varchar(48) not null,
adjustedAssetTxUuid uuid unique REFERENCES hs_office.coopassetstransaction(uuid) DEFERRABLE INITIALLY DEFERRED,
adjustedAssetTxUuid uuid unique REFERENCES hs_office.coopassettx(uuid) DEFERRABLE INITIALLY DEFERRED,
comment varchar(512)
);
--//
@@ -34,7 +34,7 @@ create table if not exists hs_office.coopassetstransaction
--changeset michael.hoennig:hs-office-coopassets-BUSINESS-RULES endDelimiter:--//
-- ----------------------------------------------------------------------------
alter table hs_office.coopassetstransaction
alter table hs_office.coopassettx
add constraint reverse_entry_missing
check ( transactionType = 'ADJUSTMENT' and adjustedAssetTxUuid is not null
or transactionType <> 'ADJUSTMENT' and adjustedAssetTxUuid is null);
@@ -44,7 +44,7 @@ alter table hs_office.coopassetstransaction
--changeset michael.hoennig:hs-office-coopassets-ASSET-VALUE-CONSTRAINT endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function checkAssetsByMembershipUuid(forMembershipUuid UUID, newAssetValue money)
create or replace function hs_office.coopassetstx_check_positive_total(forMembershipUuid UUID, newAssetValue money)
returns boolean
language plpgsql as $$
declare
@@ -52,7 +52,7 @@ declare
totalAssetValue money;
begin
select sum(cat.assetValue)
from hs_office.coopassetstransaction cat
from hs_office.coopassettx cat
where cat.membershipUuid = forMembershipUuid
into currentAssetValue;
totalAssetValue := currentAssetValue + newAssetValue;
@@ -62,9 +62,9 @@ begin
return true;
end; $$;
alter table hs_office.coopassetstransaction
alter table hs_office.coopassettx
add constraint check_positive_total
check ( checkAssetsByMembershipUuid(membershipUuid, assetValue) );
check ( hs_office.coopassetstx_check_positive_total(membershipUuid, assetValue) );
--//
@@ -72,5 +72,5 @@ alter table hs_office.coopassetstransaction
--changeset michael.hoennig:hs-office-coopassets-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_office.coopassetstransaction');
call base.create_journal('hs_office.coopassettx');
--//

76
src/main/resources/db/changelog/5-hs-office/512-coopassets/5123-hs-office-coopassets-rbac.sql
View File

@@ -3,29 +3,29 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-office-coopassetstransaction-rbac-OBJECT endDelimiter:--//
--changeset RbacObjectGenerator:hs-office-coopassettx-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_office.coopassetstransaction');
call rbac.generateRelatedRbacObject('hs_office.coopassettx');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-office-coopassetstransaction-rbac-ROLE-DESCRIPTORS endDelimiter:--//
--changeset RbacRoleDescriptorsGenerator:hs-office-coopassettx-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsOfficeCoopAssetsTransaction', 'hs_office.coopassetstransaction');
call rbac.generateRbacRoleDescriptors('hs_office.coopassettx');
--//
-- ============================================================================
--changeset RolesGrantsAndPermissionsGenerator:hs-office-coopassetstransaction-rbac-insert-trigger endDelimiter:--//
--changeset RolesGrantsAndPermissionsGenerator:hs-office-coopassettx-rbac-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
/*
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure hs_office.coopassetstransaction_build_rbac_system(
NEW hs_office.coopassetstransaction
create or replace procedure hs_office.coopassettx_build_rbac_system(
NEW hs_office.coopassettx
)
language plpgsql as $$
@@ -38,114 +38,114 @@ begin
SELECT * FROM hs_office.membership WHERE uuid = NEW.membershipUuid INTO newMembership;
assert newMembership.uuid is not null, format('newMembership must not be null for NEW.membershipUuid = %s', NEW.membershipUuid);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hsOfficeMembershipAGENT(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hsOfficeMembershipADMIN(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'SELECT'), hs_office.membership_AGENT(newMembership));
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'UPDATE'), hs_office.membership_ADMIN(newMembership));
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopassetstransaction row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_office.coopassettx row.
*/
create or replace function hs_office.coopassetstransaction_build_rbac_system_after_insert_tf()
create or replace function hs_office.coopassettx_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_office.coopassetstransaction_build_rbac_system(NEW);
call hs_office.coopassettx_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger build_rbac_system_after_insert_tg
after insert on hs_office.coopassetstransaction
after insert on hs_office.coopassettx
for each row
execute procedure hs_office.coopassetstransaction_build_rbac_system_after_insert_tf();
execute procedure hs_office.coopassettx_build_rbac_system_after_insert_tf();
--//
-- ============================================================================
--changeset InsertTriggerGenerator:hs-office-coopassetstransaction-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-coopassettx-rbac-GRANTING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
-- granting INSERT permission to hs_office.membership ----------------------------
/*
Grants INSERT INTO hs_office.coopassetstransaction permissions to specified role of pre-existing hs_office.membership rows.
Grants INSERT INTO hs_office.coopassettx permissions to specified role of pre-existing hs_office.membership rows.
*/
do language plpgsql $$
declare
row hs_office.membership;
begin
call base.defineContext('create INSERT INTO hs_office.coopassetstransaction permissions for pre-exising hs_office.membership rows');
call base.defineContext('create INSERT INTO hs_office.coopassettx permissions for pre-exising hs_office.membership rows');
FOR row IN SELECT * FROM hs_office.membership
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopassetstransaction'),
hsOfficeMembershipADMIN(row));
rbac.createPermission(row.uuid, 'INSERT', 'hs_office.coopassettx'),
hs_office.membership_ADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_office.coopassetstransaction INSERT permission to specified role of new membership rows.
Grants hs_office.coopassettx INSERT permission to specified role of new membership rows.
*/
create or replace function hs_office.new_coopassettx_grants_insert_to_membership_tf()
create or replace function hs_office.coopassettx_grants_insert_to_membership_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopassetstransaction'),
hsOfficeMembershipADMIN(NEW));
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_office.coopassettx'),
hs_office.membership_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_coopassetstransaction_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger coopassettx_z_grants_after_insert_tg
after insert on hs_office.membership
for each row
execute procedure hs_office.new_coopassettx_grants_insert_to_membership_tf();
execute procedure hs_office.coopassettx_grants_insert_to_membership_tf();
-- ============================================================================
--changeset InsertTriggerGenerator:hs-office-coopassetstransaction-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
--changeset InsertTriggerGenerator:hs-office-coopassettx-rbac-CHECKING-INSERT-PERMISSION endDelimiter:--//
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopassetstransaction.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_office.coopassettx.
*/
create or replace function hs_office.coopassetstransaction_insert_permission_check_tf()
create or replace function hs_office.coopassettx_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
superObjectUuid uuid;
begin
-- check INSERT permission via direct foreign key: NEW.membershipUuid
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopassetstransaction') then
if rbac.hasInsertPermission(NEW.membershipUuid, 'hs_office.coopassettx') then
return NEW;
end if;
raise exception '[403] insert into hs_office.coopassetstransaction values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_office.coopassettx values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger coopassetstransaction_insert_permission_check_tg
before insert on hs_office.coopassetstransaction
create trigger coopassettx_insert_permission_check_tg
before insert on hs_office.coopassettx
for each row
execute procedure hs_office.coopassetstransaction_insert_permission_check_tf();
execute procedure hs_office.coopassettx_insert_permission_check_tf();
--//
-- ============================================================================
--changeset RbacIdentityViewGenerator:hs-office-coopassetstransaction-rbac-IDENTITY-VIEW endDelimiter:--//
--changeset RbacIdentityViewGenerator:hs-office-coopassettx-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopassetstransaction',
call rbac.generateRbacIdentityViewFromProjection('hs_office.coopassettx',
$idName$
reference
$idName$);
@@ -153,9 +153,9 @@ call rbac.generateRbacIdentityViewFromProjection('hs_office.coopassetstransactio
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-office-coopassetstransaction-rbac-RESTRICTED-VIEW endDelimiter:--//
--changeset RbacRestrictedViewGenerator:hs-office-coopassettx-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_office.coopassetstransaction',
call rbac.generateRbacRestrictedView('hs_office.coopassettx',
$orderBy$
reference
$orderBy$,

38
src/main/resources/db/changelog/5-hs-office/512-coopassets/5126-hs-office-coopassets-migration.sql
View File

@@ -7,9 +7,9 @@
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-mapping endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_office.coopassetstransaction_legacy_id
CREATE TABLE hs_office.coopassettx_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_office.coopassetstransaction(uuid),
uuid uuid NOT NULL REFERENCES hs_office.coopassettx(uuid),
member_asset_id integer NOT NULL
);
--//
@@ -19,10 +19,10 @@ CREATE TABLE hs_office.coopassetstransaction_legacy_id
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-sequence endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_office.coopassetstransaction_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_office.coopassettx_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_office.coopassetstransaction_legacy_id.member_asset_id;
OWNED BY hs_office.coopassettx_legacy_id.member_asset_id;
--//
@@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_office.coopassetstransaction_legacy_id_seq
--changeset michael.hoennig:hs-office-coopassets-MIGRATION-default endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_office.coopassetstransaction_legacy_id
ALTER TABLE hs_office.coopassettx_legacy_id
ALTER COLUMN member_asset_id
SET DEFAULT nextVal('hs_office.coopassetstransaction_legacy_id_seq');
SET DEFAULT nextVal('hs_office.coopassettx_legacy_id_seq');
--/
@@ -41,15 +41,15 @@ ALTER TABLE hs_office.coopassetstransaction_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_office.coopassetstransaction_legacy_id(uuid, member_asset_id)
SELECT uuid, nextVal('hs_office.coopassetstransaction_legacy_id_seq') FROM hs_office.coopassetstransaction;
INSERT INTO hs_office.coopassettx_legacy_id(uuid, member_asset_id)
SELECT uuid, nextVal('hs_office.coopassettx_legacy_id_seq') FROM hs_office.coopassettx;
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-coopAssets-MIGRATION-insert-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertCoopAssetsLegacyIdMapping()
create or replace function hs_office.coopassettx_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -58,23 +58,23 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_office.coopassetstransaction_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.coopassetstransaction_legacy_id_seq'));
INSERT INTO hs_office.coopassettx_legacy_id VALUES
(NEW.uuid, nextVal('hs_office.coopassettx_legacy_id_seq'));
return NEW;
end; $$;
create trigger createCoopAssetsLegacyIdMapping
after insert on hs_office.coopassetstransaction
create trigger insert_legacy_id_mapping_tg
after insert on hs_office.coopassettx
for each row
execute procedure insertCoopAssetsLegacyIdMapping();
execute procedure hs_office.coopassettx_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset michael.hoennig:hs-office-coopAssets-MIGRATION-delete-trigger endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deleteCoopAssetsLegacyIdMapping()
create or replace function hs_office.coopassettx_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -83,14 +83,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_office.coopassetstransaction_legacy_id
DELETE FROM hs_office.coopassettx_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger removeCoopAssetsLegacyIdMapping
before delete on hs_office.coopassetstransaction
create trigger delete_legacy_id_mapping_tg
before delete on hs_office.coopassettx
for each row
execute procedure deleteCoopAssetsLegacyIdMapping();
execute procedure hs_office.coopassettx_delete_legacy_id_mapping_tf();
--/

10
src/main/resources/db/changelog/5-hs-office/512-coopassets/5128-hs-office-coopassets-test-data.sql
View File

@@ -8,7 +8,7 @@
/*
Creates a single coopAssetsTransaction test record.
*/
create or replace procedure createHsOfficeCoopAssetsTransactionTestData(
create or replace procedure hs_office.coopassettx_create_test_data(
givenPartnerNumber numeric,
givenMemberNumberSuffix char(2)
)
@@ -27,7 +27,7 @@ begin
raise notice 'creating test coopAssetsTransaction: %', givenPartnerNumber || givenMemberNumberSuffix;
lossEntryUuid := uuid_generate_v4();
insert
into hs_office.coopassetstransaction(uuid, membershipuuid, transactiontype, valuedate, assetvalue, reference, comment, adjustedAssetTxUuid)
into hs_office.coopassettx(uuid, membershipuuid, transactiontype, valuedate, assetvalue, reference, comment, adjustedAssetTxUuid)
values
(uuid_generate_v4(), membership.uuid, 'DEPOSIT', '2010-03-15', 320.00, 'ref '||givenPartnerNumber || givenMemberNumberSuffix||'-1', 'initial deposit', null),
(uuid_generate_v4(), membership.uuid, 'DISBURSAL', '2021-09-01', -128.00, 'ref '||givenPartnerNumber || givenMemberNumberSuffix||'-2', 'partial disbursal', null),
@@ -46,8 +46,8 @@ do language plpgsql $$
call base.defineContext('creating coopAssetsTransaction test-data');
SET CONSTRAINTS ALL DEFERRED;
call createHsOfficeCoopAssetsTransactionTestData(10001, '01');
call createHsOfficeCoopAssetsTransactionTestData(10002, '02');
call createHsOfficeCoopAssetsTransactionTestData(10003, '03');
call hs_office.coopassettx_create_test_data(10001, '01');
call hs_office.coopassettx_create_test_data(10002, '02');
call hs_office.coopassettx_create_test_data(10003, '03');
end;
$$;

8
src/main/resources/db/changelog/6-hs-booking/600-hs-booking-schema.sql Normal file
View File

@@ -0,0 +1,8 @@
--liquibase formatted sql
-- ============================================================================
--changeset michael.hoennig:hs-booking-SCHEMA endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SCHEMA hs_booking;
--//

2
src/main/resources/db/changelog/6-hs-booking/610-booking-debitor/6100-hs-booking-debitor.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hs-booking-debitor-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
create view hs_booking_debitor_xv as
create view hs_booking.debitor_xv as
select debitor.uuid,
debitor.version,
(partner.partnerNumber::varchar || debitor.debitorNumberSuffix)::numeric as debitorNumber,

6
src/main/resources/db/changelog/6-hs-booking/620-booking-project/6200-hs-booking-project.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:booking-project-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create table if not exists hs_booking_project
create table if not exists hs_booking.project
(
uuid uuid unique references rbac.object (uuid),
version int not null default 0,
@@ -18,12 +18,12 @@ create table if not exists hs_booking_project
--changeset michael.hoennig:hs-booking-project-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_booking_project');
call base.create_journal('hs_booking.project');
--//
-- ============================================================================
--changeset michael.hoennig:hs-booking-project-MAIN-TABLE-HISTORIZATION endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.tx_create_historicization('hs_booking_project');
call base.tx_create_historicization('hs_booking.project');
--//

82
src/main/resources/db/changelog/6-hs-booking/620-booking-project/6203-hs-booking-project-rbac.sql
View File

@@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-booking-project-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_booking_project');
call rbac.generateRelatedRbacObject('hs_booking.project');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-booking-project-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsBookingProject', 'hs_booking_project');
call rbac.generateRbacRoleDescriptors('hs_booking.project');
--//
@@ -24,8 +24,8 @@ call rbac.generateRbacRoleDescriptors('hsBookingProject', 'hs_booking_project');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure hs_booking_project_build_rbac_system(
NEW hs_booking_project
create or replace procedure hs_booking.project_build_rbac_system(
NEW hs_booking.project
)
language plpgsql as $$
@@ -48,50 +48,50 @@ begin
perform rbac.defineRoleWithGrants(
hsBookingProjectOWNER(NEW),
incomingSuperRoles => array[hsOfficeRelationAGENT(newDebitorRel, rbac.unassumed())]
hs_booking.project_OWNER(NEW),
incomingSuperRoles => array[hs_office.relation_AGENT(newDebitorRel, rbac.unassumed())]
);
perform rbac.defineRoleWithGrants(
hsBookingProjectADMIN(NEW),
hs_booking.project_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsBookingProjectOWNER(NEW)]
incomingSuperRoles => array[hs_booking.project_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsBookingProjectAGENT(NEW),
incomingSuperRoles => array[hsBookingProjectADMIN(NEW)]
hs_booking.project_AGENT(NEW),
incomingSuperRoles => array[hs_booking.project_ADMIN(NEW)]
);
perform rbac.defineRoleWithGrants(
hsBookingProjectTENANT(NEW),
hs_booking.project_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[hsBookingProjectAGENT(NEW)],
outgoingSubRoles => array[hsOfficeRelationTENANT(newDebitorRel)]
incomingSuperRoles => array[hs_booking.project_AGENT(NEW)],
outgoingSubRoles => array[hs_office.relation_TENANT(newDebitorRel)]
);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), rbac.globalAdmin());
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), rbac.global_ADMIN());
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_booking_project row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_booking.project row.
*/
create or replace function hs_booking_project_build_rbac_system_after_insert_tf()
create or replace function hs_booking.project_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_booking_project_build_rbac_system(NEW);
call hs_booking.project_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger build_rbac_system_after_insert_tg
after insert on hs_booking_project
after insert on hs_booking.project
for each row
execute procedure hs_booking_project_build_rbac_system_after_insert_tf();
execute procedure hs_booking.project_build_rbac_system_after_insert_tf();
--//
@@ -102,45 +102,45 @@ execute procedure hs_booking_project_build_rbac_system_after_insert_tf();
-- granting INSERT permission to hs_office.relation ----------------------------
/*
Grants INSERT INTO hs_booking_project permissions to specified role of pre-existing hs_office.relation rows.
Grants INSERT INTO hs_booking.project permissions to specified role of pre-existing hs_office.relation rows.
*/
do language plpgsql $$
declare
row hs_office.relation;
begin
call base.defineContext('create INSERT INTO hs_booking_project permissions for pre-exising hs_office.relation rows');
call base.defineContext('create INSERT INTO hs_booking.project permissions for pre-exising hs_office.relation rows');
FOR row IN SELECT * FROM hs_office.relation
WHERE type = 'DEBITOR'
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking_project'),
hsOfficeRelationADMIN(row));
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking.project'),
hs_office.relation_ADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_booking_project INSERT permission to specified role of new relation rows.
Grants hs_booking.project INSERT permission to specified role of new relation rows.
*/
create or replace function new_hsbk_project_grants_insert_to_relation_tf()
create or replace function hs_booking.project_grants_insert_to_relation_tf()
returns trigger
language plpgsql
strict as $$
begin
if NEW.type = 'DEBITOR' then
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking_project'),
hsOfficeRelationADMIN(NEW));
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking.project'),
hs_office.relation_ADMIN(NEW));
end if;
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_booking_project_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger project_z_grants_after_insert_tg
after insert on hs_office.relation
for each row
execute procedure new_hsbk_project_grants_insert_to_relation_tf();
execute procedure hs_booking.project_grants_insert_to_relation_tf();
-- ============================================================================
@@ -148,9 +148,9 @@ execute procedure new_hsbk_project_grants_insert_to_relation_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_booking_project.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_booking.project.
*/
create or replace function hs_booking_project_insert_permission_check_tf()
create or replace function hs_booking.project_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
@@ -162,19 +162,19 @@ begin
JOIN hs_office.debitor debitor ON debitor.debitorRelUuid = debitorRel.uuid
WHERE debitor.uuid = NEW.debitorUuid
);
assert superObjectUuid is not null, 'object uuid fetched depending on hs_booking_project.debitorUuid must not be null, also check fetchSql in RBAC DSL';
if rbac.hasInsertPermission(superObjectUuid, 'hs_booking_project') then
assert superObjectUuid is not null, 'object uuid fetched depending on hs_booking.project.debitorUuid must not be null, also check fetchSql in RBAC DSL';
if rbac.hasInsertPermission(superObjectUuid, 'hs_booking.project') then
return NEW;
end if;
raise exception '[403] insert into hs_booking_project values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_booking.project values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_booking_project_insert_permission_check_tg
before insert on hs_booking_project
create trigger project_insert_permission_check_tg
before insert on hs_booking.project
for each row
execute procedure hs_booking_project_insert_permission_check_tf();
execute procedure hs_booking.project_insert_permission_check_tf();
--//
@@ -182,10 +182,10 @@ create trigger hs_booking_project_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-booking-project-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromQuery('hs_booking_project',
call rbac.generateRbacIdentityViewFromQuery('hs_booking.project',
$idName$
SELECT bookingProject.uuid as uuid, debitorIV.idName || '-' || base.cleanIdentifier(bookingProject.caption) as idName
FROM hs_booking_project bookingProject
FROM hs_booking.project bookingProject
JOIN hs_office.debitor_iv debitorIV ON debitorIV.uuid = bookingProject.debitorUuid
$idName$);
--//
@@ -194,7 +194,7 @@ call rbac.generateRbacIdentityViewFromQuery('hs_booking_project',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-booking-project-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_booking_project',
call rbac.generateRbacRestrictedView('hs_booking.project',
$orderBy$
caption
$orderBy$,

12
src/main/resources/db/changelog/6-hs-booking/620-booking-project/6208-hs-booking-project-test-data.sql
View File

@@ -6,9 +6,9 @@
-- ----------------------------------------------------------------------------
/*
Creates a single hs_booking_project test record.
Creates a single hs_booking.project test record.
*/
create or replace procedure createHsBookingProjectTransactionTestData(
create or replace procedure hs_booking.project_create_test_data(
givenPartnerNumber numeric,
givenDebitorSuffix char(2)
)
@@ -27,7 +27,7 @@ begin
raise notice 'creating test booking-project: %', givenDebitorSuffix::text;
raise notice '- using debitor (%): %', relatedDebitor.uuid, relatedDebitor;
insert
into hs_booking_project (uuid, debitoruuid, caption)
into hs_booking.project (uuid, debitoruuid, caption)
values (uuid_generate_v4(), relatedDebitor.uuid, 'D-' || givenPartnerNumber::text || givenDebitorSuffix || ' default project');
end; $$;
--//
@@ -41,9 +41,9 @@ do language plpgsql $$
begin
call base.defineContext('creating booking-project test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsBookingProjectTransactionTestData(10001, '11');
call createHsBookingProjectTransactionTestData(10002, '12');
call createHsBookingProjectTransactionTestData(10003, '13');
call hs_booking.project_create_test_data(10001, '11');
call hs_booking.project_create_test_data(10002, '12');
call hs_booking.project_create_test_data(10003, '13');
end;
$$;
--//

18
src/main/resources/db/changelog/6-hs-booking/630-booking-item/6300-hs-booking-item.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:booking-item-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create type HsBookingItemType as enum (
create type hs_booking.ItemType as enum (
'PRIVATE_CLOUD',
'CLOUD_SERVER',
'MANAGED_SERVER',
@@ -12,20 +12,20 @@ create type HsBookingItemType as enum (
'DOMAIN_SETUP'
);
CREATE CAST (character varying as HsBookingItemType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_booking.ItemType) WITH INOUT AS IMPLICIT;
create table if not exists hs_booking_item
create table if not exists hs_booking.item
(
uuid uuid unique references rbac.object (uuid),
version int not null default 0,
projectUuid uuid null references hs_booking_project(uuid),
type HsBookingItemType not null,
parentItemUuid uuid null references hs_booking_item(uuid) initially deferred,
projectUuid uuid null references hs_booking.project(uuid),
type hs_booking.ItemType not null,
parentItemUuid uuid null references hs_booking.item(uuid) initially deferred,
validity daterange not null,
caption varchar(80) not null,
resources jsonb not null,
constraint chk_hs_booking_item_has_project_or_parent_asset
constraint booking_item_has_project_or_parent_asset
check (projectUuid is not null or parentItemUuid is not null)
);
--//
@@ -35,13 +35,13 @@ create table if not exists hs_booking_item
--changeset michael.hoennig:hs-booking-item-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_booking_item');
call base.create_journal('hs_booking.item');
--//
-- ============================================================================
--changeset michael.hoennig:hs-booking-item-MAIN-TABLE-HISTORIZATION endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.tx_create_historicization('hs_booking_item');
call base.tx_create_historicization('hs_booking.item');
--//

142
src/main/resources/db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql
View File

@@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-booking-item-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_booking_item');
call rbac.generateRelatedRbacObject('hs_booking.item');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-booking-item-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsBookingItem', 'hs_booking_item');
call rbac.generateRbacRoleDescriptors('hs_booking.item');
--//
@@ -24,73 +24,73 @@ call rbac.generateRbacRoleDescriptors('hsBookingItem', 'hs_booking_item');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure hs_booking_item_build_rbac_system(
NEW hs_booking_item
create or replace procedure hs_booking.item_build_rbac_system(
NEW hs_booking.item
)
language plpgsql as $$
declare
newProject hs_booking_project;
newParentItem hs_booking_item;
newProject hs_booking.project;
newParentItem hs_booking.item;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_booking_project WHERE uuid = NEW.projectUuid INTO newProject;
SELECT * FROM hs_booking.project WHERE uuid = NEW.projectUuid INTO newProject;
SELECT * FROM hs_booking_item WHERE uuid = NEW.parentItemUuid INTO newParentItem;
SELECT * FROM hs_booking.item WHERE uuid = NEW.parentItemUuid INTO newParentItem;
perform rbac.defineRoleWithGrants(
hsBookingItemOWNER(NEW),
hs_booking.item_OWNER(NEW),
incomingSuperRoles => array[
hsBookingItemAGENT(newParentItem),
hsBookingProjectAGENT(newProject)]
hs_booking.item_AGENT(newParentItem),
hs_booking.project_AGENT(newProject)]
);
perform rbac.defineRoleWithGrants(
hsBookingItemADMIN(NEW),
hs_booking.item_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[hsBookingItemOWNER(NEW)]
incomingSuperRoles => array[hs_booking.item_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsBookingItemAGENT(NEW),
incomingSuperRoles => array[hsBookingItemADMIN(NEW)]
hs_booking.item_AGENT(NEW),
incomingSuperRoles => array[hs_booking.item_ADMIN(NEW)]
);
perform rbac.defineRoleWithGrants(
hsBookingItemTENANT(NEW),
hs_booking.item_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[hsBookingItemAGENT(NEW)],
incomingSuperRoles => array[hs_booking.item_AGENT(NEW)],
outgoingSubRoles => array[
hsBookingItemTENANT(newParentItem),
hsBookingProjectTENANT(newProject)]
hs_booking.item_TENANT(newParentItem),
hs_booking.project_TENANT(newProject)]
);
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), rbac.globalAdmin());
call rbac.grantPermissionToRole(rbac.createPermission(NEW.uuid, 'DELETE'), rbac.global_ADMIN());
call rbac.leaveTriggerForObjectUuid(NEW.uuid);
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_booking_item row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_booking.item row.
*/
create or replace function hs_booking_item_build_rbac_system_after_insert_tf()
create or replace function hs_booking.item_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_booking_item_build_rbac_system(NEW);
call hs_booking.item_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger build_rbac_system_after_insert_tg
after insert on hs_booking_item
after insert on hs_booking.item
for each row
execute procedure hs_booking_item_build_rbac_system_after_insert_tf();
execute procedure hs_booking.item_build_rbac_system_after_insert_tf();
--//
@@ -101,115 +101,115 @@ execute procedure hs_booking_item_build_rbac_system_after_insert_tf();
-- granting INSERT permission to rbac.global ----------------------------
/*
Grants INSERT INTO hs_booking_item permissions to specified role of pre-existing rbac.global rows.
Grants INSERT INTO hs_booking.item permissions to specified role of pre-existing rbac.global rows.
*/
do language plpgsql $$
declare
row rbac.global;
begin
call base.defineContext('create INSERT INTO hs_booking_item permissions for pre-exising rbac.global rows');
call base.defineContext('create INSERT INTO hs_booking.item permissions for pre-exising rbac.global rows');
FOR row IN SELECT * FROM rbac.global
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking_item'),
rbac.globalADMIN());
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking.item'),
rbac.global_ADMIN());
END LOOP;
end;
$$;
/**
Grants hs_booking_item INSERT permission to specified role of new global rows.
Grants hs_booking.item INSERT permission to specified role of new global rows.
*/
create or replace function new_hsbk_item_grants_insert_to_global_tf()
create or replace function hs_booking.item_grants_insert_to_global_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking_item'),
rbac.globalADMIN());
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking.item'),
rbac.global_ADMIN());
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_booking_item_grants_after_insert_tg
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger item_z_grants_after_insert_tg
after insert on rbac.global
for each row
execute procedure new_hsbk_item_grants_insert_to_global_tf();
execute procedure hs_booking.item_grants_insert_to_global_tf();
-- granting INSERT permission to hs_booking_project ----------------------------
-- granting INSERT permission to hs_booking.project ----------------------------
/*
Grants INSERT INTO hs_booking_item permissions to specified role of pre-existing hs_booking_project rows.
Grants INSERT INTO hs_booking.item permissions to specified role of pre-existing hs_booking.project rows.
*/
do language plpgsql $$
declare
row hs_booking_project;
row hs_booking.project;
begin
call base.defineContext('create INSERT INTO hs_booking_item permissions for pre-exising hs_booking_project rows');
call base.defineContext('create INSERT INTO hs_booking.item permissions for pre-exising hs_booking.project rows');
FOR row IN SELECT * FROM hs_booking_project
FOR row IN SELECT * FROM hs_booking.project
-- unconditional for all rows in that table
LOOP
call rbac.grantPermissionToRole(
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking_item'),
hsBookingProjectADMIN(row));
rbac.createPermission(row.uuid, 'INSERT', 'hs_booking.item'),
hs_booking.project_ADMIN(row));
END LOOP;
end;
$$;
/**
Grants hs_booking_item INSERT permission to specified role of new hs_booking_project rows.
Grants hs_booking.item INSERT permission to specified role of new project rows.
*/
create or replace function new_hsbk_item_grants_insert_to_hsbk_project_tf()
create or replace function hs_booking.item_grants_insert_to_project_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking_item'),
hsBookingProjectADMIN(NEW));
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking.item'),
hs_booking.project_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_booking_item_grants_after_insert_tg
after insert on hs_booking_project
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger item_z_grants_after_insert_tg
after insert on hs_booking.project
for each row
execute procedure new_hsbk_item_grants_insert_to_hsbk_project_tf();
execute procedure hs_booking.item_grants_insert_to_project_tf();
-- granting INSERT permission to hs_booking_item ----------------------------
-- granting INSERT permission to hs_booking.item ----------------------------
-- Granting INSERT INTO hs_hosting_asset permissions to specified role of pre-existing hs_hosting_asset rows slipped,
-- Granting INSERT INTO hs_hosting.asset permissions to specified role of pre-existing hs_hosting.asset rows slipped,
-- because there cannot yet be any pre-existing rows in the same table yet.
/**
Grants hs_booking_item INSERT permission to specified role of new hs_booking_item rows.
Grants hs_booking.item INSERT permission to specified role of new item rows.
*/
create or replace function new_hsbk_item_grants_insert_to_hsbk_item_tf()
create or replace function hs_booking.item_grants_insert_to_item_tf()
returns trigger
language plpgsql
strict as $$
begin
-- unconditional for all rows in that table
call rbac.grantPermissionToRole(
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking_item'),
hsBookingItemADMIN(NEW));
rbac.createPermission(NEW.uuid, 'INSERT', 'hs_booking.item'),
hs_booking.item_ADMIN(NEW));
-- end.
return NEW;
end; $$;
-- z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger z_new_hs_booking_item_grants_after_insert_tg
after insert on hs_booking_item
-- ..._z_... is to put it at the end of after insert triggers, to make sure the roles exist
create trigger item_z_grants_after_insert_tg
after insert on hs_booking.item
for each row
execute procedure new_hsbk_item_grants_insert_to_hsbk_item_tf();
execute procedure hs_booking.item_grants_insert_to_item_tf();
-- ============================================================================
@@ -217,9 +217,9 @@ execute procedure new_hsbk_item_grants_insert_to_hsbk_item_tf();
-- ----------------------------------------------------------------------------
/**
Checks if the user respectively the assumed roles are allowed to insert a row to hs_booking_item.
Checks if the user respectively the assumed roles are allowed to insert a row to hs_booking.item.
*/
create or replace function hs_booking_item_insert_permission_check_tf()
create or replace function hs_booking.item_insert_permission_check_tf()
returns trigger
language plpgsql as $$
declare
@@ -230,22 +230,22 @@ begin
return NEW;
end if;
-- check INSERT permission via direct foreign key: NEW.projectUuid
if rbac.hasInsertPermission(NEW.projectUuid, 'hs_booking_item') then
if rbac.hasInsertPermission(NEW.projectUuid, 'hs_booking.item') then
return NEW;
end if;
-- check INSERT permission via direct foreign key: NEW.parentItemUuid
if rbac.hasInsertPermission(NEW.parentItemUuid, 'hs_booking_item') then
if rbac.hasInsertPermission(NEW.parentItemUuid, 'hs_booking.item') then
return NEW;
end if;
raise exception '[403] insert into hs_booking_item values(%) not allowed for current subjects % (%)',
raise exception '[403] insert into hs_booking.item values(%) not allowed for current subjects % (%)',
NEW, base.currentSubjects(), rbac.currentSubjectOrAssumedRolesUuids();
end; $$;
create trigger hs_booking_item_insert_permission_check_tg
before insert on hs_booking_item
create trigger item_insert_permission_check_tg
before insert on hs_booking.item
for each row
execute procedure hs_booking_item_insert_permission_check_tf();
execute procedure hs_booking.item_insert_permission_check_tf();
--//
@@ -253,7 +253,7 @@ create trigger hs_booking_item_insert_permission_check_tg
--changeset RbacIdentityViewGenerator:hs-booking-item-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_booking_item',
call rbac.generateRbacIdentityViewFromProjection('hs_booking.item',
$idName$
caption
$idName$);
@@ -263,7 +263,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_booking_item',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-booking-item-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_booking_item',
call rbac.generateRbacRestrictedView('hs_booking.item',
$orderBy$
validity
$orderBy$,

16
src/main/resources/db/changelog/6-hs-booking/630-booking-item/6308-hs-booking-item-test-data.sql
View File

@@ -6,20 +6,20 @@
-- ----------------------------------------------------------------------------
/*
Creates a single hs_booking_item test record.
Creates a single hs_booking.item test record.
*/
create or replace procedure createHsBookingItemTransactionTestData(
create or replace procedure hs_booking.item_create_test_data(
givenPartnerNumber numeric,
givenDebitorSuffix char(2)
)
language plpgsql as $$
declare
relatedProject hs_booking_project;
relatedProject hs_booking.project;
privateCloudUuid uuid;
managedServerUuid uuid;
begin
select project.* into relatedProject
from hs_booking_project project
from hs_booking.project project
where project.caption = 'D-' || givenPartnerNumber || givenDebitorSuffix || ' default project';
raise notice 'creating test booking-item: %', givenPartnerNumber::text || givenDebitorSuffix::text;
@@ -27,7 +27,7 @@ begin
privateCloudUuid := uuid_generate_v4();
managedServerUuid := uuid_generate_v4();
insert
into hs_booking_item (uuid, projectuuid, type, parentitemuuid, caption, validity, resources)
into hs_booking.item (uuid, projectuuid, type, parentitemuuid, caption, validity, resources)
values (privateCloudUuid, relatedProject.uuid, 'PRIVATE_CLOUD', null, 'some PrivateCloud', daterange('20240401', null, '[]'), '{ "CPU": 10, "RAM": 32, "SSD": 4000, "HDD": 10000, "Traffic": 2000 }'::jsonb),
(uuid_generate_v4(), null, 'MANAGED_SERVER', privateCloudUuid, 'some ManagedServer', daterange('20230115', '20240415', '[)'), '{ "CPU": 2, "RAM": 4, "SSD": 500, "Traffic": 500 }'::jsonb),
(uuid_generate_v4(), null, 'CLOUD_SERVER', privateCloudUuid, 'test CloudServer', daterange('20230115', '20240415', '[)'), '{ "CPU": 2, "RAM": 4, "SSD": 750, "Traffic": 500 }'::jsonb),
@@ -49,9 +49,9 @@ do language plpgsql $$
begin
call base.defineContext('creating booking-item test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsBookingItemTransactionTestData(10001, '11');
call createHsBookingItemTransactionTestData(10002, '12');
call createHsBookingItemTransactionTestData(10003, '13');
call hs_booking.item_create_test_data(10001, '11');
call hs_booking.item_create_test_data(10002, '12');
call hs_booking.item_create_test_data(10003, '13');
end;
$$;
--//

8
src/main/resources/db/changelog/7-hs-hosting/700-hs-hosting-schema.sql Normal file
View File

@@ -0,0 +1,8 @@
--liquibase formatted sql
-- ============================================================================
--changeset michael.hoennig:hs-hosting-SCHEMA endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SCHEMA hs_hosting;
--//

50
src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql
View File

@@ -4,7 +4,7 @@
--changeset michael.hoennig:hosting-asset-MAIN-TABLE endDelimiter:--//
-- ----------------------------------------------------------------------------
create type HsHostingAssetType as enum (
create type hs_hosting.AssetType as enum (
'CLOUD_SERVER',
'MANAGED_SERVER',
'MANAGED_WEBSPACE',
@@ -26,22 +26,22 @@ create type HsHostingAssetType as enum (
'IPV6_NUMBER'
);
CREATE CAST (character varying as HsHostingAssetType) WITH INOUT AS IMPLICIT;
CREATE CAST (character varying as hs_hosting.AssetType) WITH INOUT AS IMPLICIT;
create table if not exists hs_hosting_asset
create table if not exists hs_hosting.asset
(
uuid uuid unique references rbac.object (uuid),
version int not null default 0,
bookingItemUuid uuid null references hs_booking_item(uuid),
type HsHostingAssetType not null,
parentAssetUuid uuid null references hs_hosting_asset(uuid) initially deferred,
assignedToAssetUuid uuid null references hs_hosting_asset(uuid) initially deferred,
bookingItemUuid uuid null references hs_booking.item(uuid),
type hs_hosting.AssetType not null,
parentAssetUuid uuid null references hs_hosting.asset(uuid) initially deferred,
assignedToAssetUuid uuid null references hs_hosting.asset(uuid) initially deferred,
identifier varchar(80) not null,
caption varchar(80),
config jsonb not null,
alarmContactUuid uuid null references hs_office.contact(uuid) initially deferred,
constraint chk_hs_hosting_asset_has_booking_item_or_parent_asset
constraint hosting_asset_has_booking_item_or_parent_asset
check (bookingItemUuid is not null or parentAssetUuid is not null or type in ('DOMAIN_SETUP', 'IPV4_NUMBER', 'IPV6_NUMBER'))
);
--//
@@ -54,16 +54,16 @@ create table if not exists hs_hosting_asset
-- TODO.impl: this could be generated from HsHostingAssetType
-- also including a check for assignedToAssetUuud
create or replace function hs_hosting_asset_type_hierarchy_check_tf()
create or replace function hs_hosting.asset_type_hierarchy_check_tf()
returns trigger
language plpgsql as $$
declare
actualParentType HsHostingAssetType;
expectedParentType HsHostingAssetType;
actualParentType hs_hosting.AssetType;
expectedParentType hs_hosting.AssetType;
begin
if NEW.parentAssetUuid is not null then
actualParentType := (select type
from hs_hosting_asset
from hs_hosting.asset
where NEW.parentAssetUuid = uuid);
end if;
@@ -104,10 +104,10 @@ begin
return NEW;
end; $$;
create trigger hs_hosting_asset_type_hierarchy_check_tg
before insert on hs_hosting_asset
create trigger hosting_asset_type_hierarchy_check_tg
before insert on hs_hosting.asset
for each row
execute procedure hs_hosting_asset_type_hierarchy_check_tf();
execute procedure hs_hosting.asset_type_hierarchy_check_tf();
--//
@@ -116,7 +116,7 @@ create trigger hs_hosting_asset_type_hierarchy_check_tg
--changeset michael.hoennig:hosting-asset-system-sequences endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_hosting_asset_unixuser_system_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_hosting.asset_unixuser_system_id_seq
AS integer
MINVALUE 1000000
MAXVALUE 9999999
@@ -130,15 +130,15 @@ CREATE SEQUENCE IF NOT EXISTS hs_hosting_asset_unixuser_system_id_seq
--changeset michael.hoennig:hosting-asset-BOOKING-ITEM-HIERARCHY-CHECK endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function hs_hosting_asset_booking_item_hierarchy_check_tf()
create or replace function hs_hosting.asset_booking_item_hierarchy_check_tf()
returns trigger
language plpgsql as $$
declare
actualBookingItemType HsBookingItemType;
expectedBookingItemType HsBookingItemType;
actualBookingItemType hs_booking.ItemType;
expectedBookingItemType hs_booking.ItemType;
begin
actualBookingItemType := (select type
from hs_booking_item
from hs_booking.item
where NEW.bookingItemUuid = uuid);
if NEW.type = 'CLOUD_SERVER' then
@@ -156,24 +156,24 @@ begin
return NEW;
end; $$;
create trigger hs_hosting_asset_booking_item_hierarchy_check_tg
before insert on hs_hosting_asset
create trigger hosting_asset_booking_item_hierarchy_check_tg
before insert on hs_hosting.asset
for each row
execute procedure hs_hosting_asset_booking_item_hierarchy_check_tf();
execute procedure hs_hosting.asset_booking_item_hierarchy_check_tf();
--//
-- ============================================================================
--changeset michael.hoennig:hs-hosting-asset-MAIN-TABLE-JOURNAL endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.create_journal('hs_hosting_asset');
call base.create_journal('hs_hosting.asset');
--//
-- ============================================================================
--changeset michael.hoennig:hs-hosting-asset-MAIN-TABLE-HISTORIZATION endDelimiter:--//
-- ----------------------------------------------------------------------------
call base.tx_create_historicization('hs_hosting_asset');
call base.tx_create_historicization('hs_hosting.asset');
--//

88
src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7013-hs-hosting-asset-rbac.sql
View File

@@ -5,14 +5,14 @@
-- ============================================================================
--changeset RbacObjectGenerator:hs-hosting-asset-rbac-OBJECT endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRelatedRbacObject('hs_hosting_asset');
call rbac.generateRelatedRbacObject('hs_hosting.asset');
--//
-- ============================================================================
--changeset RbacRoleDescriptorsGenerator:hs-hosting-asset-rbac-ROLE-DESCRIPTORS endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRoleDescriptors('hsHostingAsset', 'hs_hosting_asset');
call rbac.generateRbacRoleDescriptors('hs_hosting.asset');
--//
@@ -24,66 +24,66 @@ call rbac.generateRbacRoleDescriptors('hsHostingAsset', 'hs_hosting_asset');
Creates the roles, grants and permission for the AFTER INSERT TRIGGER.
*/
create or replace procedure hs_hosting_asset_build_rbac_system(
NEW hs_hosting_asset
create or replace procedure hs_hosting.asset_build_rbac_system(
NEW hs_hosting.asset
)
language plpgsql as $$
declare
newBookingItem hs_booking_item;
newAssignedToAsset hs_hosting_asset;
newBookingItem hs_booking.item;
newAssignedToAsset hs_hosting.asset;
newAlarmContact hs_office.contact;
newParentAsset hs_hosting_asset;
newParentAsset hs_hosting.asset;
begin
call rbac.enterTriggerForObjectUuid(NEW.uuid);
SELECT * FROM hs_booking_item WHERE uuid = NEW.bookingItemUuid INTO newBookingItem;
SELECT * FROM hs_booking.item WHERE uuid = NEW.bookingItemUuid INTO newBookingItem;
SELECT * FROM hs_hosting_asset WHERE uuid = NEW.assignedToAssetUuid INTO newAssignedToAsset;
SELECT * FROM hs_hosting.asset WHERE uuid = NEW.assignedToAssetUuid INTO newAssignedToAsset;
SELECT * FROM hs_office.contact WHERE uuid = NEW.alarmContactUuid INTO newAlarmContact;
SELECT * FROM hs_hosting_asset WHERE uuid = NEW.parentAssetUuid INTO newParentAsset;
SELECT * FROM hs_hosting.asset WHERE uuid = NEW.parentAssetUuid INTO newParentAsset;
perform rbac.defineRoleWithGrants(
hsHostingAssetOWNER(NEW),
hs_hosting.asset_OWNER(NEW),
permissions => array['DELETE'],
incomingSuperRoles => array[
hsBookingItemADMIN(newBookingItem),
hsHostingAssetADMIN(newParentAsset),
rbac.globalADMIN(rbac.unassumed())],
hs_booking.item_ADMIN(newBookingItem),
hs_hosting.asset_ADMIN(newParentAsset),
rbac.global_ADMIN(rbac.unassumed())],
subjectUuids => array[rbac.currentSubjectUuid()]
);
perform rbac.defineRoleWithGrants(
hsHostingAssetADMIN(NEW),
hs_hosting.asset_ADMIN(NEW),
permissions => array['UPDATE'],
incomingSuperRoles => array[
hsBookingItemAGENT(newBookingItem),
hsHostingAssetAGENT(newParentAsset),
hsHostingAssetOWNER(NEW)]
hs_booking.item_AGENT(newBookingItem),
hs_hosting.asset_AGENT(newParentAsset),
hs_hosting.asset_OWNER(NEW)]
);
perform rbac.defineRoleWithGrants(
hsHostingAssetAGENT(NEW),
hs_hosting.asset_AGENT(NEW),
incomingSuperRoles => array[
hsHostingAssetADMIN(NEW),
hsHostingAssetAGENT(newAssignedToAsset)],
hs_hosting.asset_ADMIN(NEW),
hs_hosting.asset_AGENT(newAssignedToAsset)],
outgoingSubRoles => array[
hsHostingAssetTENANT(newAssignedToAsset),
hsOfficeContactREFERRER(newAlarmContact)]
hs_hosting.asset_TENANT(newAssignedToAsset),
hs_office.contact_REFERRER(newAlarmContact)]
);
perform rbac.defineRoleWithGrants(
hsHostingAssetTENANT(NEW),
hs_hosting.asset_TENANT(NEW),
permissions => array['SELECT'],
incomingSuperRoles => array[
hsHostingAssetAGENT(NEW),
hsOfficeContactADMIN(newAlarmContact)],
hs_hosting.asset_AGENT(NEW),
hs_office.contact_ADMIN(newAlarmContact)],
outgoingSubRoles => array[
hsBookingItemTENANT(newBookingItem),
hsHostingAssetTENANT(newParentAsset)]
hs_booking.item_TENANT(newBookingItem),
hs_hosting.asset_TENANT(newParentAsset)]
);
IF NEW.type = 'DOMAIN_SETUP' THEN
@@ -93,22 +93,22 @@ begin
end; $$;
/*
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_hosting_asset row.
AFTER INSERT TRIGGER to create the role+grant structure for a new hs_hosting.asset row.
*/
create or replace function hs_hosting_asset_build_rbac_system_after_insert_tf()
create or replace function hs_hosting.asset_build_rbac_system_after_insert_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_hosting_asset_build_rbac_system(NEW);
call hs_hosting.asset_build_rbac_system(NEW);
return NEW;
end; $$;
create trigger build_rbac_system_after_insert_tg
after insert on hs_hosting_asset
after insert on hs_hosting.asset
for each row
execute procedure hs_hosting_asset_build_rbac_system_after_insert_tf();
execute procedure hs_hosting.asset_build_rbac_system_after_insert_tf();
--//
@@ -120,9 +120,9 @@ execute procedure hs_hosting_asset_build_rbac_system_after_insert_tf();
Called from the AFTER UPDATE TRIGGER to re-wire the grants.
*/
create or replace procedure hs_hosting_asset_update_rbac_system(
OLD hs_hosting_asset,
NEW hs_hosting_asset
create or replace procedure hs_hosting.asset_update_rbac_system(
OLD hs_hosting.asset,
NEW hs_hosting.asset
)
language plpgsql as $$
begin
@@ -130,27 +130,27 @@ begin
if NEW.assignedToAssetUuid is distinct from OLD.assignedToAssetUuid
or NEW.alarmContactUuid is distinct from OLD.alarmContactUuid then
delete from rbac.grants g where g.grantedbytriggerof = OLD.uuid;
call hs_hosting_asset_build_rbac_system(NEW);
call hs_hosting.asset_build_rbac_system(NEW);
end if;
end; $$;
/*
AFTER UPDATE TRIGGER to re-wire the grant structure for a new hs_hosting_asset row.
AFTER UPDATE TRIGGER to re-wire the grant structure for a new hs_hosting.asset row.
*/
create or replace function hs_hosting_asset_update_rbac_system_after_update_tf()
create or replace function hs_hosting.asset_update_rbac_system_after_update_tf()
returns trigger
language plpgsql
strict as $$
begin
call hs_hosting_asset_update_rbac_system(OLD, NEW);
call hs_hosting.asset_update_rbac_system(OLD, NEW);
return NEW;
end; $$;
create trigger update_rbac_system_after_update_tg
after update on hs_hosting_asset
after update on hs_hosting.asset
for each row
execute procedure hs_hosting_asset_update_rbac_system_after_update_tf();
execute procedure hs_hosting.asset_update_rbac_system_after_update_tf();
--//
@@ -158,7 +158,7 @@ execute procedure hs_hosting_asset_update_rbac_system_after_update_tf();
--changeset RbacIdentityViewGenerator:hs-hosting-asset-rbac-IDENTITY-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacIdentityViewFromProjection('hs_hosting_asset',
call rbac.generateRbacIdentityViewFromProjection('hs_hosting.asset',
$idName$
identifier
$idName$);
@@ -168,7 +168,7 @@ call rbac.generateRbacIdentityViewFromProjection('hs_hosting_asset',
-- ============================================================================
--changeset RbacRestrictedViewGenerator:hs-hosting-asset-rbac-RESTRICTED-VIEW endDelimiter:--//
-- ----------------------------------------------------------------------------
call rbac.generateRbacRestrictedView('hs_hosting_asset',
call rbac.generateRbacRestrictedView('hs_hosting.asset',
$orderBy$
identifier
$orderBy$,

38
src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7016-hs-hosting-asset-migration.sql
View File

@@ -7,9 +7,9 @@
--changeset hs-hosting-asset-MIGRATION-mapping:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE TABLE hs_hosting_asset_legacy_id
CREATE TABLE hs_hosting.asset_legacy_id
(
uuid uuid NOT NULL REFERENCES hs_hosting_asset(uuid),
uuid uuid NOT NULL REFERENCES hs_hosting.asset(uuid),
legacy_id integer NOT NULL
);
--//
@@ -19,10 +19,10 @@ CREATE TABLE hs_hosting_asset_legacy_id
--changeset hs-hosting-asset-MIGRATION-sequence:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
CREATE SEQUENCE IF NOT EXISTS hs_hosting_asset_legacy_id_seq
CREATE SEQUENCE IF NOT EXISTS hs_hosting.asset_legacy_id_seq
AS integer
START 1000000000
OWNED BY hs_hosting_asset_legacy_id.legacy_id;
OWNED BY hs_hosting.asset_legacy_id.legacy_id;
--//
@@ -30,9 +30,9 @@ CREATE SEQUENCE IF NOT EXISTS hs_hosting_asset_legacy_id_seq
--changeset hs-hosting-asset-MIGRATION-default:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
ALTER TABLE hs_hosting_asset_legacy_id
ALTER TABLE hs_hosting.asset_legacy_id
ALTER COLUMN legacy_id
SET DEFAULT nextVal('hs_hosting_asset_legacy_id_seq');
SET DEFAULT nextVal('hs_hosting.asset_legacy_id_seq');
--/
@@ -41,15 +41,15 @@ ALTER TABLE hs_hosting_asset_legacy_id
-- ----------------------------------------------------------------------------
CALL base.defineContext('schema-migration');
INSERT INTO hs_hosting_asset_legacy_id(uuid, legacy_id)
SELECT uuid, nextVal('hs_hosting_asset_legacy_id_seq') FROM hs_hosting_asset;
INSERT INTO hs_hosting.asset_legacy_id(uuid, legacy_id)
SELECT uuid, nextVal('hs_hosting.asset_legacy_id_seq') FROM hs_hosting.asset;
--/
-- ============================================================================
--changeset hs-hosting-asset-MIGRATION-insert-trigger:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function insertassetLegacyIdMapping()
create or replace function hs_hosting.asset_insert_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -58,23 +58,23 @@ begin
raise exception 'invalid usage of trigger';
end if;
INSERT INTO hs_hosting_asset_legacy_id VALUES
(NEW.uuid, nextVal('hs_hosting_asset_legacy_id_seq'));
INSERT INTO hs_hosting.asset_legacy_id VALUES
(NEW.uuid, nextVal('hs_hosting.asset_legacy_id_seq'));
return NEW;
end; $$;
create trigger createassetLegacyIdMapping
after insert on hs_hosting_asset
create trigger insert_legacy_id_mapping_tg
after insert on hs_hosting.asset
for each row
execute procedure insertassetLegacyIdMapping();
execute procedure hs_hosting.asset_insert_legacy_id_mapping_tf();
--/
-- ============================================================================
--changeset hs-hosting-asset-MIGRATION-delete-trigger:1 endDelimiter:--//
-- ----------------------------------------------------------------------------
create or replace function deleteassetLegacyIdMapping_tf()
create or replace function hs_hosting.asset_delete_legacy_id_mapping_tf()
returns trigger
language plpgsql
strict as $$
@@ -83,14 +83,14 @@ begin
raise exception 'invalid usage of trigger';
end if;
DELETE FROM hs_hosting_asset_legacy_id
DELETE FROM hs_hosting.asset_legacy_id
WHERE uuid = OLD.uuid;
return OLD;
end; $$;
create trigger deleteassetLegacyIdMapping_tg
before delete on hs_hosting_asset
create trigger delete_legacy_id_mapping_tg
before delete on hs_hosting.asset
for each row
execute procedure deleteassetLegacyIdMapping_tf();
execute procedure hs_hosting.asset_delete_legacy_id_mapping_tf();
--/

36
src/main/resources/db/changelog/7-hs-hosting/701-hosting-asset/7018-hs-hosting-asset-test-data.sql
View File

@@ -6,23 +6,23 @@
-- ----------------------------------------------------------------------------
/*
Creates a single hs_hosting_asset test record.
Creates a single hs_hosting.asset test record.
*/
create or replace procedure createHsHostingAssetTestData(givenProjectCaption varchar)
create or replace procedure hs_hosting.asset_create_test_data(givenProjectCaption varchar)
language plpgsql as $$
declare
relatedProject hs_booking_project;
relatedProject hs_booking.project;
relatedDebitor hs_office.debitor;
privateCloudBI hs_booking_item;
managedServerBI hs_booking_item;
cloudServerBI hs_booking_item;
managedWebspaceBI hs_booking_item;
privateCloudBI hs_booking.item;
managedServerBI hs_booking.item;
cloudServerBI hs_booking.item;
managedWebspaceBI hs_booking.item;
debitorNumberSuffix varchar;
defaultPrefix varchar;
managedServerUuid uuid;
managedWebspaceUuid uuid;
webUnixSubjectUuid uuid;
mboxUnixSubjectUuid uuid;
webUnixSubjectUuid uuid;
mboxUnixSubjectUuid uuid;
domainSetupUuid uuid;
domainMBoxSetupUuid uuid;
mariaDbInstanceUuid uuid;
@@ -33,7 +33,7 @@ begin
call base.defineContext('creating hosting-asset test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
select project.* into relatedProject
from hs_booking_project project
from hs_booking.project project
where project.caption = givenProjectCaption;
assert relatedProject.uuid is not null, 'relatedProject for "' || givenProjectCaption || '" must not be null';
@@ -43,25 +43,25 @@ begin
assert relatedDebitor.uuid is not null, 'relatedDebitor for "' || givenProjectCaption || '" must not be null';
select item.* into privateCloudBI
from hs_booking_item item
from hs_booking.item item
where item.projectUuid = relatedProject.uuid
and item.type = 'PRIVATE_CLOUD';
assert privateCloudBI.uuid is not null, 'relatedPrivateCloudBookingItem for "' || givenProjectCaption|| '" must not be null';
select item.* into managedServerBI
from hs_booking_item item
from hs_booking.item item
where item.projectUuid = relatedProject.uuid
and item.type = 'MANAGED_SERVER';
assert managedServerBI.uuid is not null, 'relatedManagedServerBookingItem for "' || givenProjectCaption|| '" must not be null';
select item.* into cloudServerBI
from hs_booking_item item
from hs_booking.item item
where item.parentItemuuid = privateCloudBI.uuid
and item.type = 'CLOUD_SERVER';
assert cloudServerBI.uuid is not null, 'relatedCloudServerBookingItem for "' || givenProjectCaption|| '" must not be null';
select item.* into managedWebspaceBI
from hs_booking_item item
from hs_booking.item item
where item.projectUuid = relatedProject.uuid
and item.type = 'MANAGED_WEBSPACE';
assert managedWebspaceBI.uuid is not null, 'relatedManagedWebspaceBookingItem for "' || givenProjectCaption|| '" must not be null';
@@ -79,7 +79,7 @@ begin
debitorNumberSuffix := relatedDebitor.debitorNumberSuffix;
defaultPrefix := relatedDebitor.defaultPrefix;
insert into hs_hosting_asset
insert into hs_hosting.asset
(uuid, bookingitemuuid, type, parentAssetUuid, assignedToAssetUuid, identifier, caption, config)
values
(managedServerUuid, managedServerBI.uuid, 'MANAGED_SERVER', null, null, 'vm10' || debitorNumberSuffix, 'some ManagedServer', '{ "monit_max_cpu_usage": 90, "monit_max_ram_usage": 80, "monit_max_ssd_usage": 70 }'::jsonb),
@@ -112,9 +112,9 @@ do language plpgsql $$
begin
call base.defineContext('creating hosting-asset test-data', null, 'superuser-alex@hostsharing.net', 'rbac.global#global:ADMIN');
call createHsHostingAssetTestData('D-1000111 default project');
call createHsHostingAssetTestData('D-1000212 default project');
call createHsHostingAssetTestData('D-1000313 default project');
call hs_hosting.asset_create_test_data('D-1000111 default project');
call hs_hosting.asset_create_test_data('D-1000212 default project');
call hs_hosting.asset_create_test_data('D-1000313 default project');
end;
$$;
--//

8
src/main/resources/db/changelog/9-hs-global/9000-statistics.sql
View File

@@ -12,12 +12,12 @@ select *
from rbac.object
group by objecttable
union all
select to_char(count(*)::int, '9 999 999 999'), 'objects', 'hs_hosting_asset', type::text
from hs_hosting_asset
select to_char(count(*)::int, '9 999 999 999'), 'objects', 'hs_hosting.asset', type::text
from hs_hosting.asset
group by type
union all
select to_char(count(*)::int, '9 999 999 999'), 'objects', 'hs_booking_item', type::text
from hs_booking_item
select to_char(count(*)::int, '9 999 999 999'), 'objects', 'hs_booking.item', type::text
from hs_booking.item
group by type
) as totals order by replace(count, ' ', '')::int desc;
--//

4
src/main/resources/db/changelog/db.changelog-master.yaml
View File

@@ -143,6 +143,8 @@ databaseChangeLog:
file: db/changelog/5-hs-office/512-coopassets/5126-hs-office-coopassets-migration.sql
- include:
file: db/changelog/5-hs-office/512-coopassets/5128-hs-office-coopassets-test-data.sql
- include:
file: db/changelog/6-hs-booking/600-hs-booking-schema.sql
- include:
file: db/changelog/6-hs-booking/610-booking-debitor/6100-hs-booking-debitor.sql
- include:
@@ -157,6 +159,8 @@ databaseChangeLog:
file: db/changelog/6-hs-booking/630-booking-item/6303-hs-booking-item-rbac.sql
- include:
file: db/changelog/6-hs-booking/630-booking-item/6308-hs-booking-item-test-data.sql
- include:
file: db/changelog/7-hs-hosting/700-hs-hosting-schema.sql
- include:
file: db/changelog/7-hs-hosting/701-hosting-asset/7010-hs-hosting-asset.sql
- include: