Skip to content

Commit 80d95ff

Browse files
fish-facefish-face
committed
Support setting default_privileges on all schemas
The Postgres default is for the absent specification of a schema name when altering default privileges to apply to all schemas. Support that behaviour, but keep the current default behaviour for an unset schema parameter.
1 parent ecc63f1 commit 80d95ff

File tree

3 files changed

+126
-9
lines changed

3 files changed

+126
-9
lines changed

‎manifests/server/default_privileges.pp

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@
55
# @param db Specifies the database to which you are granting access.
66
# @param object_type Specify target object type: 'FUNCTIONS', 'ROUTINES', 'SEQUENCES', 'TABLES', 'TYPES'.
77
# @param privilege Specifies comma-separated list of privileges to grant. Valid options: depends on object type.
8-
# @param schema Target schema. Defaults to 'public'.
8+
# @param schema Target schema. Defaults to 'public'. Can be set to '' to apply to all schemas.
99
# @param psql_db Defines the database to execute the grant against. This should not ordinarily be changed from the default.
1010
# @param psql_user Specifies the OS user for running psql. Default value: The default user for the module, usually 'postgres'.
1111
# @param psql_path Specifies the OS user for running psql. Default value: The default user for the module, usually 'postgres'.
@@ -50,11 +50,11 @@
5050
case $ensure {
5151
default: {
5252
# default is 'present'
53-
$sql_command = 'ALTER DEFAULT PRIVILEGES IN SCHEMA %s GRANT %s ON %s TO "%s"'
53+
$sql_command = 'ALTER DEFAULT PRIVILEGES%s GRANT %s ON %s TO "%s"'
5454
$unless_is = true
5555
}
5656
'absent': {
57-
$sql_command = 'ALTER DEFAULT PRIVILEGES IN SCHEMA %s REVOKE %s ON %s FROM "%s"'
57+
$sql_command = 'ALTER DEFAULT PRIVILEGES%s REVOKE %s ON %s FROM "%s"'
5858
$unless_is = false
5959
}
6060
}
@@ -70,6 +70,13 @@
7070
$port_override = $postgresql::server::port
7171
}
7272

73+
if $schema != '' {
74+
$_schema = " IN SCHEMA $schema"
75+
$_check_schema = " AND nspname = '$schema'"
76+
} else {
77+
$_schema = ''
78+
$_check_schema = ' AND nspname IS NULL'
79+
}
7380
## Munge the input values
7481
$_object_type = upcase($object_type)
7582
$_privilege = upcase($privilege)
@@ -128,12 +135,12 @@
128135
}
129136

130137
$_unless = $ensure ? {
131-
'absent' => "SELECT 1 WHERE NOT EXISTS (SELECT * FROM pg_default_acl AS da JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE '%s=%s' = ANY (defaclacl) AND nspname = '%s' and defaclobjtype = '%s')",
132-
default => "SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE '%s=%s' = ANY (defaclacl) AND nspname = '%s' and defaclobjtype = '%s')"
138+
'absent' => "SELECT 1 WHERE NOT EXISTS (SELECT * FROM pg_default_acl AS da LEFT JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE '%s=%s' = ANY (defaclacl)%s and defaclobjtype = '%s')",
139+
default => "SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da LEFT JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE '%s=%s' = ANY (defaclacl)%s and defaclobjtype = '%s')"
133140
}
134141

135-
$unless_cmd = sprintf($_unless, $role, $_check_privilege, $schema, $_check_type)
136-
$grant_cmd = sprintf($sql_command, $schema, $_privilege, $_object_type, $role)
142+
$unless_cmd = sprintf($_unless, $role, $_check_privilege, $_check_schema, $_check_type)
143+
$grant_cmd = sprintf($sql_command, $_schema, $_privilege, $_object_type, $role)
137144

138145
postgresql_psql { "default_privileges:${name}":
139146
command => $grant_cmd,

‎spec/acceptance/server/default_privileges_spec.rb

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,67 @@ class { 'postgresql::server': }
6868
MANIFEST
6969
end
7070

71+
let(:all_schemas_check_command) do
72+
"SELECT * FROM pg_default_acl a WHERE '#{user}=arwdDxt' = ANY (defaclacl) AND defaclnamespace = 0 and defaclobjtype = 'r';"
73+
end
74+
75+
let(:pp_unset_schema) do
76+
<<-MANIFEST.unindent
77+
$db = #{db}
78+
$user = #{user}
79+
$group = #{group}
80+
$password = #{password}
81+
82+
class { 'postgresql::server': }
83+
84+
postgresql::server::role { $user:
85+
password_hash => postgresql::postgresql_password($user, $password),
86+
}
87+
88+
postgresql::server::database { $db:
89+
require => Postgresql::Server::Role[$user],
90+
}
91+
92+
# Set default privileges on tables
93+
postgresql::server::default_privileges { "alter default privileges grant all on tables to ${user}":
94+
db => $db,
95+
role => $user,
96+
privilege => 'ALL',
97+
object_type => 'TABLES',
98+
schema => '',
99+
require => Postgresql::Server::Database[$db],
100+
}
101+
MANIFEST
102+
end
103+
let(:pp_unset_schema_revoke) do
104+
<<-MANIFEST
105+
$db = #{db}
106+
$user = #{user}
107+
$group = #{group}
108+
$password = #{password}
109+
110+
class { 'postgresql::server': }
111+
112+
postgresql::server::role { $user:
113+
password_hash => postgresql::postgresql_password($user, $password),
114+
}
115+
postgresql::server::database { $db:
116+
require => Postgresql::Server::Role[$user],
117+
}
118+
119+
# Removes default privileges on tables
120+
postgresql::server::default_privileges { "alter default privileges revoke all on tables for ${user}":
121+
db => $db,
122+
role => $user,
123+
privilege => 'ALL',
124+
object_type => 'TABLES',
125+
schema => '',
126+
ensure => 'absent',
127+
require => Postgresql::Server::Database[$db],
128+
}
129+
MANIFEST
130+
end
131+
71132
it 'grants default privileges to an user' do
72133
if Gem::Version.new(postgresql_version) >= Gem::Version.new('9.6')
73134
idempotent_apply(pp_one)
@@ -90,4 +151,27 @@ class { 'postgresql::server': }
90151
end
91152
end
92153
end
154+
155+
it 'grants default privileges on all schemas to a user' do
156+
if Gem::Version.new(postgresql_version) >= Gem::Version.new('9.6')
157+
idempotent_apply(pp_unset_schema)
158+
159+
psql("--command=\"SET client_min_messages = 'error';#{all_schemas_check_command}\" --db=#{db}") do |r|
160+
expect(r.stdout).to match(%r{\(1 row\)})
161+
expect(r.stderr).to eq('')
162+
end
163+
end
164+
end
165+
166+
it 'revokes default privileges on all schemas for a user' do
167+
if Gem::Version.new(postgresql_version) >= Gem::Version.new('9.6')
168+
apply_manifest(pp_unset_schema, catch_failures: true)
169+
apply_manifest(pp_unset_schema_revoke, expect_changes: true)
170+
171+
psql("--command=\"SET client_min_messages = 'error';#{all_schemas_check_command}\" --db=#{db}") do |r|
172+
expect(r.stdout).to match(%r{\(0 rows\)})
173+
expect(r.stderr).to eq('')
174+
end
175+
end
176+
end
93177
end

‎spec/unit/defines/server/default_privileges_spec.rb

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -112,7 +112,7 @@
112112
# rubocop:disable Layout/LineLength
113113
is_expected.to contain_postgresql_psql('default_privileges:test')
114114
.with_command('ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO "test"')
115-
.with_unless("SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE 'test=arwdDxt' = ANY (defaclacl) AND nspname = 'public' and defaclobjtype = 'r')")
115+
.with_unless("SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da LEFT JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE 'test=arwdDxt' = ANY (defaclacl) AND nspname = 'public' and defaclobjtype = 'r')")
116116
# rubocop:enable Layout/LineLength
117117
end
118118
end
@@ -222,7 +222,33 @@
222222
# rubocop:disable Layout/LineLength
223223
is_expected.to contain_postgresql_psql('default_privileges:test')
224224
.with_command('ALTER DEFAULT PRIVILEGES IN SCHEMA my_schema GRANT ALL ON TABLES TO "test"')
225-
.with_unless("SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE 'test=arwdDxt' = ANY (defaclacl) AND nspname = 'my_schema' and defaclobjtype = 'r')")
225+
.with_unless("SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da LEFT JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE 'test=arwdDxt' = ANY (defaclacl) AND nspname = 'my_schema' and defaclobjtype = 'r')")
226+
# rubocop:enable Layout/LineLength
227+
end
228+
end
229+
230+
context 'with unset schema name' do
231+
let :params do
232+
{
233+
db: 'test',
234+
role: 'test',
235+
privilege: 'all',
236+
object_type: 'tables',
237+
schema: ''
238+
}
239+
end
240+
241+
let :pre_condition do
242+
"class {'postgresql::server':}"
243+
end
244+
245+
it { is_expected.to compile.with_all_deps }
246+
it { is_expected.to contain_postgresql__server__default_privileges('test') }
247+
it do
248+
# rubocop:disable Layout/LineLength
249+
is_expected.to contain_postgresql_psql('default_privileges:test')
250+
.with_command('ALTER DEFAULT PRIVILEGES GRANT ALL ON TABLES TO "test"')
251+
.with_unless("SELECT 1 WHERE EXISTS (SELECT * FROM pg_default_acl AS da LEFT JOIN pg_namespace AS n ON da.defaclnamespace = n.oid WHERE 'test=arwdDxt' = ANY (defaclacl) AND nspname IS NULL and defaclobjtype = 'r')")
226252
# rubocop:enable Layout/LineLength
227253
end
228254
end

0 commit comments

Comments
 (0)