Melvin Strobl
a03d17975f
Playwright Tests / test-playwright (1, 2) (push) Canceled after 0s
Playwright Tests / test-playwright (2, 2) (push) Canceled after 0s
pre-commit / pre-commit (push) Canceled after 0s
Compose Smoke Test / test-compose (push) Canceled after 0s
Playwright Tests / merge-reports (push) Canceled after 0s
Signed-off-by: Melvin Strobl <lc3267@kit.edu>
21 lines
956 B
SQL
21 lines
956 B
SQL
-- Least-privilege Postgres role + database for the optional Umami analytics
|
|
-- service. Umami must not connect as the shared superuser, which can read the
|
|
-- `app` database holding every user, flow and credential. This role owns only
|
|
-- its own database, so it has full rights there and none on `app`.
|
|
--
|
|
-- Invoked by `make umami` (piped into psql in the db container). Idempotent.
|
|
-- Identifiers and the password arrive as psql variables (-v role=… -v pw=…
|
|
-- -v db=…) and are quoted via format()'s %I / %L, so they are injection-safe.
|
|
|
|
SELECT format('CREATE ROLE %I LOGIN PASSWORD %L', :'role', :'pw')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'role')
|
|
\gexec
|
|
|
|
SELECT format('ALTER ROLE %I LOGIN PASSWORD %L', :'role', :'pw')
|
|
WHERE EXISTS (SELECT 1 FROM pg_roles WHERE rolname = :'role')
|
|
\gexec
|
|
|
|
SELECT format('CREATE DATABASE %I OWNER %I', :'db', :'role')
|
|
WHERE NOT EXISTS (SELECT 1 FROM pg_database WHERE datname = :'db')
|
|
\gexec
|