Skip to content

Commit 7c7171a

Browse files
cohansencohansen
committed
Reworked the actions schema to use the sequencing user for now
1 parent 63adba1 commit 7c7171a

File tree

8 files changed

+40
-45
lines changed

8 files changed

+40
-45
lines changed

‎.github/workflows/pgcmp.yml

+8-8
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,7 @@ jobs:
8282
- name: Dump v2.8.0 Database
8383
run: |
8484
mkdir pgdumpV2_8_0
85-
PGURI=postgres://"${POSTGRES_USER}":"${POSTGRES_PASSWORD}"@localhost:5432/aerie \
85+
PGURI=postgres://"${AERIE_USERNAME}":"${AERIE_PASSWORD}"@localhost:5432/aerie \
8686
PGCMPOUTPUT=./pgdumpV2_8_0/AerieV2_8_0 \
8787
PGCLABEL=AerieV2_8_0 \
8888
PGBINDIR=/usr/bin \
@@ -109,8 +109,8 @@ jobs:
109109
run: |
110110
cd deployment
111111
cat << EOF > .env
112-
AERIE_USERNAME=${POSTGRES_USER}
113-
AERIE_PASSWORD=${POSTGRES_PASSWORD}
112+
AERIE_USERNAME=${AERIE_USERNAME}
113+
AERIE_PASSWORD=${AERIE_PASSWORD}
114114
EOF
115115
python -m pip install -r requirements.txt
116116
python aerie_db_migration.py migrate --apply --all
@@ -123,7 +123,7 @@ jobs:
123123
- name: Dump Migrated Database
124124
run: |
125125
mkdir pgdumpmigrated
126-
PGURI=postgres://"${POSTGRES_USER}":"${POSTGRES_PASSWORD}"@localhost:5432/aerie \
126+
PGURI=postgres://"${AERIE_USERNAME}":"${AERIE_PASSWORD}"@localhost:5432/aerie \
127127
PGCMPOUTPUT=./pgdumpmigrated/AerieMigratedUp \
128128
PGCLABEL=AerieMigratedUp \
129129
PGBINDIR=/usr/bin \
@@ -186,7 +186,7 @@ jobs:
186186
- name: Dump Current Database
187187
run: |
188188
mkdir pgdumpcurrent
189-
PGURI=postgres://"${POSTGRES_USER}":"${POSTGRES_PASSWORD}"@localhost:5432/aerie \
189+
PGURI=postgres://"${AERIE_USERNAME}":"${AERIE_PASSWORD}"@localhost:5432/aerie \
190190
PGCMPOUTPUT=./pgdumpcurrent/AerieCurrent \
191191
PGCLABEL=AerieCurrent \
192192
PGBINDIR=/usr/bin \
@@ -202,16 +202,16 @@ jobs:
202202
run: |
203203
cd deployment
204204
cat << EOF > .env
205-
AERIE_USERNAME=${POSTGRES_USER}
206-
AERIE_PASSWORD=${POSTGRES_PASSWORD}
205+
AERIE_USERNAME=${AERIE_USERNAME}
206+
AERIE_PASSWORD=${AERIE_PASSWORD}
207207
EOF
208208
python -m pip install -r requirements.txt
209209
python aerie_db_migration.py migrate --revert --all
210210
cd ..
211211
- name: Dump Migrated Database
212212
run: |
213213
mkdir pgdumpmigrateddown
214-
PGURI=postgres://"${POSTGRES_USER}":"${POSTGRES_PASSWORD}"@localhost:5432/aerie \
214+
PGURI=postgres://"${AERIE_USERNAME}":"${AERIE_PASSWORD}"@localhost:5432/aerie \
215215
PGCMPOUTPUT=./pgdumpmigrateddown/AerieMigratedDown \
216216
PGCLABEL=AerieMigratedDown \
217217
PGBINDIR=/usr/bin \

‎deployment/hasura/migrations/Aerie/14_actions/down.sql

+5-7
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,15 @@
11
drop trigger notify_action_run_inserted on actions.action_run;
2-
drop function actions.notify_action_run_inserted cascade;
2+
drop function actions.notify_action_run_inserted;
33

4-
drop table actions.action_run cascade;
4+
drop table actions.action_run;
55

66
drop trigger notify_action_definition_inserted on actions.action_definition;
7-
drop function actions.notify_action_definition_inserted cascade;
7+
drop function actions.notify_action_definition_inserted;
88
drop trigger set_timestamp on actions.action_definition;
9-
drop table actions.action_definition cascade;
9+
drop table actions.action_definition;
1010

1111
drop type actions.action_run_status;
1212

13-
drop role action_server;
14-
15-
drop schema actions cascade;
13+
drop schema actions;
1614

1715
call migrations.mark_migration_rolled_back('14');

‎deployment/hasura/migrations/Aerie/14_actions/up.sql

+17-11
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,22 @@
11
create schema actions;
22

3-
create role action_server;
4-
5-
grant create, usage on schema actions to action_server;
6-
grant select, insert, update, delete on all tables in schema actions to action_server;
7-
grant execute on all routines in schema actions to action_server;
8-
9-
alter default privileges in schema actions grant select, insert, update, delete on tables to action_server;
10-
alter default privileges in schema actions grant execute on routines to action_server;
11-
12-
grant create, usage on schema sequencing to action_server;
13-
grant select, insert, update, delete on table sequencing.user_sequence to action_server;
3+
DO $$
4+
DECLARE seq_user text;
5+
BEGIN
6+
SELECT into seq_user grantee
7+
FROM information_schema.role_table_grants
8+
WHERE table_schema = 'sequencing'
9+
AND table_name = 'user_sequence'
10+
and privilege_type = 'INSERT'
11+
and grantee != (select current_user as usersss)
12+
limit 1;
13+
14+
EXECUTE format('grant create, usage on schema actions to %I', seq_user);
15+
EXECUTE format('grant select, insert, update, delete on all tables in schema actions to %I', seq_user);
16+
EXECUTE format('grant execute on all routines in schema actions to %I', seq_user);
17+
EXECUTE format('alter default privileges in schema actions grant select, insert, update, delete on tables to %I', seq_user);
18+
EXECUTE format('alter default privileges in schema actions grant execute on routines to %I', seq_user);
19+
END $$;
1420

1521
create type actions.action_run_status as enum ('pending', 'in-progress', 'failed', 'complete');
1622

‎deployment/postgres-init-db/init-aerie.sh

-4
Original file line numberDiff line numberDiff line change
@@ -23,9 +23,6 @@ psql -v ON_ERROR_STOP=1 --username "$POSTGRES_USER" --dbname postgres <<-EOSQL
2323
CREATE USER "$SEQUENCING_DB_USER" WITH PASSWORD '$SEQUENCING_DB_PASSWORD';
2424
\echo 'Done!'
2525
26-
\echo 'Initializing action user...'
27-
CREATE USER "$ACTION_DB_USER" WITH PASSWORD '$ACTION_DB_PASSWORD';
28-
2926
\echo 'Initializing aerie database...'
3027
CREATE DATABASE aerie OWNER "$AERIE_USERNAME";
3128
\connect aerie
@@ -47,7 +44,6 @@ psql -v ON_ERROR_STOP=1 --username "$AERIE_USERNAME" --dbname "aerie" <<-EOSQL
4744
\set merlin_user $MERLIN_DB_USER
4845
\set scheduler_user $SCHEDULER_DB_USER
4946
\set sequencing_user $SEQUENCING_DB_USER
50-
\set action_user $ACTION_DB_USER
5147
\echo 'Initializing aerie database objects...'
5248
\ir /docker-entrypoint-initdb.d/sql/init.sql
5349
\echo 'Done!'

‎deployment/postgres-init-db/sql/init.sql

-3
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@ begin;
99
-- Create Non-Public Schemas
1010
\ir schemas.sql
1111

12-
-- Create roles
13-
\ir roles.sql
14-
1512
-- Migrations
1613
\ir tables/migrations/schema_migrations.sql
1714
\ir applied_migrations.sql

‎deployment/postgres-init-db/sql/init_db_users.sql

+8-8
Original file line numberDiff line numberDiff line change
@@ -95,14 +95,14 @@ begin;
9595
-- Action DB Permissions --
9696
---------------------------
9797
-- The Action User currently has control of all tables in the actions schema
98-
grant create, usage on schema actions to action_server;
99-
grant select, insert, update, delete on all tables in schema actions to action_server;
100-
grant execute on all routines in schema actions to action_server;
98+
grant create, usage on schema actions to :"sequencing_user";
99+
grant select, insert, update, delete on all tables in schema actions to :"sequencing_user";
100+
grant execute on all routines in schema actions to :"sequencing_user";
101101

102-
alter default privileges in schema actions grant select, insert, update, delete on tables to action_server;
103-
alter default privileges in schema actions grant execute on routines to action_server;
102+
alter default privileges in schema actions grant select, insert, update, delete on tables to :"sequencing_user";
103+
alter default privileges in schema actions grant execute on routines to :"sequencing_user";
104104

105-
-- The Action Server needs to be able to write sequences
106-
grant create, usage on schema sequencing to action_server;
107-
grant select, insert, update, delete on table sequencing.user_sequence to action_server;
105+
-- The Action Server needs to be able to write sequences, right now we're reusing the sequencing user so these are commented out.
106+
-- grant create, usage on schema sequencing to :"sequencing_user";
107+
-- grant select, insert, update, delete on table sequencing.user_sequence to :"sequencing_user";
108108
end;

‎deployment/postgres-init-db/sql/roles.sql

-2
This file was deleted.

‎docker-compose.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -15,8 +15,8 @@ services:
1515
PORT: 27186
1616
AERIE_DB_HOST: postgres
1717
AERIE_DB_PORT: 5432
18-
ACTION_DB_USER: "${ACTION_USERNAME}"
19-
ACTION_DB_PASSWORD: "${ACTION_PASSWORD}"
18+
ACTION_DB_USER: "${SEQUENCING_USERNAME}"
19+
ACTION_DB_PASSWORD: "${SEQUENCING_PASSWORD}"
2020
ACTION_LOCAL_STORE: /usr/src/app/action_file_store
2121
ACTION_WORKER_NUM: 8
2222
ACTION_MAX_WORKER_NUM: 8

0 commit comments

Comments
 (0)