-
-
Notifications
You must be signed in to change notification settings - Fork 152
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'develop' into sam/oriole-extensions-schema
- Loading branch information
Showing
17 changed files
with
564 additions
and
153 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 25 additions & 19 deletions
44
migrations/db/migrations/20250218031949_pgsodium_mask_role.sql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,25 +1,31 @@ | ||
| -- migrate:up | ||
| CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role regrole, source_name text, view_name text) | ||
| RETURNS void | ||
| LANGUAGE plpgsql | ||
| SECURITY DEFINER | ||
| SET search_path TO '' | ||
| AS $function$ | ||
|
|
||
| DO $$ | ||
| BEGIN | ||
| EXECUTE format( | ||
| 'GRANT SELECT ON pgsodium.key TO %s', | ||
| masked_role); | ||
| IF EXISTS (SELECT FROM pg_extension WHERE extname = 'pgsodium') THEN | ||
| CREATE OR REPLACE FUNCTION pgsodium.mask_role(masked_role regrole, source_name text, view_name text) | ||
| RETURNS void | ||
| LANGUAGE plpgsql | ||
| SECURITY DEFINER | ||
| SET search_path TO '' | ||
| AS $function$ | ||
| BEGIN | ||
| EXECUTE format( | ||
| 'GRANT SELECT ON pgsodium.key TO %s', | ||
| masked_role); | ||
|
|
||
| EXECUTE format( | ||
| 'GRANT pgsodium_keyiduser, pgsodium_keyholder TO %s', | ||
| masked_role); | ||
| EXECUTE format( | ||
| 'GRANT pgsodium_keyiduser, pgsodium_keyholder TO %s', | ||
| masked_role); | ||
|
|
||
| EXECUTE format( | ||
| 'GRANT ALL ON %I TO %s', | ||
| view_name, | ||
| masked_role); | ||
| RETURN; | ||
| END | ||
| $function$; | ||
| EXECUTE format( | ||
| 'GRANT ALL ON %I TO %s', | ||
| view_name, | ||
| masked_role); | ||
| RETURN; | ||
| END | ||
| $function$; | ||
| END IF; | ||
| END $$; | ||
|
|
||
| -- migrate:down |
64 changes: 64 additions & 0 deletions
64
migrations/db/migrations/20250220051611_pg_net_perms_fix.sql
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| -- migrate:up | ||
| CREATE OR REPLACE FUNCTION extensions.grant_pg_net_access() | ||
| RETURNS event_trigger | ||
| LANGUAGE plpgsql | ||
| AS $$ | ||
| BEGIN | ||
| IF EXISTS ( | ||
| SELECT 1 | ||
| FROM pg_event_trigger_ddl_commands() AS ev | ||
| JOIN pg_extension AS ext | ||
| ON ev.objid = ext.oid | ||
| WHERE ext.extname = 'pg_net' | ||
| ) | ||
| THEN | ||
| IF NOT EXISTS ( | ||
| SELECT 1 | ||
| FROM pg_roles | ||
| WHERE rolname = 'supabase_functions_admin' | ||
| ) | ||
| THEN | ||
| CREATE USER supabase_functions_admin NOINHERIT CREATEROLE LOGIN NOREPLICATION; | ||
| END IF; | ||
|
|
||
| GRANT USAGE ON SCHEMA net TO supabase_functions_admin, postgres, anon, authenticated, service_role; | ||
|
|
||
| IF EXISTS ( | ||
| SELECT FROM pg_extension | ||
| WHERE extname = 'pg_net' | ||
| -- all versions in use on existing projects as of 2025-02-20 | ||
| -- version 0.12.0 onwards don't need these applied | ||
| AND extversion IN ('0.2', '0.6', '0.7', '0.7.1', '0.8', '0.10.0', '0.11.0') | ||
| ) THEN | ||
| ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER; | ||
| ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY DEFINER; | ||
|
|
||
| ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net; | ||
| ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SET search_path = net; | ||
|
|
||
| REVOKE ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC; | ||
| REVOKE ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM PUBLIC; | ||
|
|
||
| GRANT EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role; | ||
| GRANT EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO supabase_functions_admin, postgres, anon, authenticated, service_role; | ||
| END IF; | ||
| END IF; | ||
| END; | ||
| $$; | ||
|
|
||
| DO $$ | ||
| BEGIN | ||
| IF EXISTS (SELECT FROM pg_extension WHERE extname = 'pg_net') | ||
| THEN | ||
| ALTER function net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY INVOKER; | ||
| ALTER function net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) SECURITY INVOKER; | ||
|
|
||
| REVOKE EXECUTE ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) FROM supabase_functions_admin, postgres, anon, authenticated, service_role; | ||
| REVOKE EXECUTE ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) FROM supabase_functions_admin, postgres, anon, authenticated, service_role; | ||
|
|
||
| GRANT ALL ON FUNCTION net.http_get(url text, params jsonb, headers jsonb, timeout_milliseconds integer) TO PUBLIC; | ||
| GRANT ALL ON FUNCTION net.http_post(url text, body jsonb, params jsonb, headers jsonb, timeout_milliseconds integer) TO PUBLIC; | ||
| END IF; | ||
| END $$; | ||
|
|
||
| -- migrate:down |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.