88
99
1010
11-
12- -- fundamental function to check owner <--> rule mapping using the existing view
13- -- "view_rule_with_owner"
14- CREATE OR REPLACE FUNCTION recert_owner_responsible_for_rule (i_owner_id INTEGER , i_rule_id BIGINT ) RETURNS BOOLEAN AS $$
11+ -- This function returns a table of future recert entries
12+ -- but does not write them into the recertification table
13+ CREATE OR REPLACE FUNCTION recert_get_one_owner_one_mgm (
14+ i_owner_id INTEGER ,
15+ i_mgm_id INTEGER
16+ )
17+ RETURNS SETOF recertification AS
18+ $$
1519DECLARE
16- i_id BIGINT ;
20+ b_super_owner BOOLEAN : = FALSE ;
1721BEGIN
18- -- check if this is the super owner:
19- SELECT INTO i_id id FROM owner WHERE id= i_owner_id AND is_default;
20- IF FOUND THEN -- this is the super owner
21- SELECT INTO i_id rule_id FROM view_rule_with_owner WHERE owner_id IS NULL AND rule_id= i_rule_id;
22- IF FOUND THEN
23- RAISE DEBUG ' %' ' rule found for super owner ' || i_rule_id;
24- RETURN TRUE;
25- ELSE
26- RETURN FALSE;
27- END IF;
28- ELSE -- standard owner
29- SELECT INTO i_id rule_id FROM view_rule_with_owner WHERE owner_id= i_owner_id AND rule_id= i_rule_id;
30- IF FOUND THEN
31- RETURN TRUE;
32- ELSE
33- RETURN FALSE;
34- END IF;
35- END IF;
22+ -- Check if this is the super owner
23+ SELECT TRUE INTO b_super_owner FROM owner WHERE id = i_owner_id AND is_default;
24+
25+ RETURN QUERY
26+ SELECT DISTINCT
27+ NULL ::bigint AS id,
28+ M .rule_metadata_id ,
29+ R .rule_id ,
30+ V .matches ::VARCHAR AS ip_match,
31+ CASE WHEN b_super_owner THEN NULL ELSE i_owner_id END AS owner_id,
32+ NULL ::VARCHAR AS user_dn,
33+ FALSE::BOOLEAN AS recertified,
34+ NULL ::TIMESTAMP AS recert_date,
35+ NULL ::VARCHAR AS comment,
36+ MAX ((
37+ SELECT MAX (value)::TIMESTAMP
38+ FROM (
39+ SELECT I .start_time ::timestamp + make_interval(days => O .recert_interval ) AS value
40+ UNION
41+ SELECT C .recert_date + make_interval(days => O .recert_interval ) AS value
42+ ) AS tmp
43+ )) AS next_recert_date,
44+ NULL ::bigint AS owner_recert_id
45+ FROM
46+ view_rule_with_owner V
47+ LEFT JOIN rule R USING (rule_id)
48+ LEFT JOIN rule_metadata M ON (R .rule_uid = M .rule_uid AND R .dev_id = M .dev_id )
49+ LEFT JOIN owner O ON (
50+ CASE WHEN b_super_owner THEN O .is_default ELSE V .owner_id = O .id END
51+ )
52+ LEFT JOIN import_control I ON (R .rule_create = I .control_id )
53+ LEFT JOIN recertification C ON (M .rule_metadata_id = C .rule_metadata_id )
54+ WHERE
55+ (
56+ (b_super_owner AND V .owner_id IS NULL )
57+ OR
58+ (NOT b_super_owner AND V .owner_id = i_owner_id)
59+ )
60+ AND R .mgm_id = i_mgm_id
61+ AND R .active
62+ AND (recert_date IS NULL OR (recert_date IS NOT NULL AND recertified))
63+ GROUP BY M .rule_metadata_id , R .rule_id , V .matches ;
3664END;
37- $$ LANGUAGE plpgsql;
38-
39- -- this function deletes existing (future) open recert entries and inserts the new ones into the recertificaiton table
40- -- the new recert date will only replace an existing one, if it is closer (smaller)
41- CREATE OR REPLACE FUNCTION recert_refresh_one_owner_one_mgm
42- (i_owner_id INTEGER , i_mgm_id INTEGER , t_requested_next_recert_date TIMESTAMP ) RETURNS VOID AS $$
43- DECLARE
44- r_rule RECORD;
45- i_recert_entry_id BIGINT ;
46- b_super_owner BOOLEAN := FALSE;
47- t_rule_created TIMESTAMP ;
48- t_current_next_recert_date TIMESTAMP ;
49- t_next_recert_date_by_interval TIMESTAMP ;
50- t_rule_last_recertified TIMESTAMP ;
51- t_next_recert_date TIMESTAMP ;
52- i_recert_inverval INTEGER ;
53- b_never_recertified BOOLEAN := FALSE;
54- b_no_current_next_recert_date BOOLEAN := FALSE;
55- b_super_owner_exists BOOLEAN := FALSE;
56- i_previous_import BIGINT ;
57- i_current_import_id BIGINT ;
58- i_super_owner_id INT ;
59- i_current_owner_id_tmp INT ;
60- BEGIN
61- IF i_owner_id IS NULL OR i_mgm_id IS NULL THEN
62- IF i_owner_id IS NULL THEN
63- RAISE WARNING ' found undefined owner_id in recert_refresh_one_owner_one_mgm'
64- ELSE -- mgm_id NULL
65- RAISE WARNING ' found undefined mgm_id in recert_refresh_one_owner_one_mgm'
66- END IF;
67- ELSE
68- -- get id of previous import:
69- SELECT INTO i_current_import_id control_id FROM import_control WHERE mgm_id= i_mgm_id AND stop_time IS NULL ;
70- SELECT INTO i_previous_import * FROM get_previous_import_id_for_mgmt(i_mgm_id,i_current_import_id);
71- IF NOT FOUND OR i_previous_import IS NULL THEN
72- i_previous_import := - 1 ; -- prevent match for previous import
73- END IF;
74-
75- SELECT INTO i_super_owner_id id FROM owner WHERE is_default;
76- IF FOUND THEN
77- b_super_owner_exists := TRUE;
78- END IF;
79-
80- SELECT INTO i_current_owner_id_tmp id FROM owner WHERE id= i_owner_id AND is_default;
81- IF FOUND THEN
82- b_super_owner := TRUE;
83- END IF;
84-
85- SELECT INTO i_recert_inverval recert_interval FROM owner WHERE id= i_owner_id;
86-
87- FOR r_rule IN
88- SELECT rule_uid, rule_id FROM rule WHERE mgm_id= i_mgm_id AND (active OR NOT active AND rule_last_seen= i_previous_import)
89- LOOP
90-
91- IF recert_owner_responsible_for_rule (i_owner_id, r_rule .rule_id ) THEN
92-
93- -- collects dates
94- SELECT INTO t_current_next_recert_date next_recert_date FROM recertification
95- WHERE owner_id= i_owner_id AND rule_id= r_rule .rule_id AND recert_date IS NULL ;
96-
97- IF NOT FOUND THEN
98- b_no_current_next_recert_date := TRUE;
99- END IF;
100-
101- SELECT INTO t_rule_last_recertified MAX (recert_date)
102- FROM recertification
103- WHERE rule_id= r_rule .rule_id AND NOT recert_date IS NULL ;
104-
105- IF NOT FOUND OR t_rule_last_recertified IS NULL THEN -- no prior recertification, use initial rule import date
106- b_never_recertified := TRUE;
107- SELECT INTO t_rule_created rule_metadata .rule_created
108- FROM rule
109- LEFT JOIN rule_metadata ON (rule .rule_uid = rule_metadata .rule_uid AND rule .dev_id = rule_metadata .dev_id )
110- WHERE rule_id= r_rule .rule_id ;
111- END IF;
112-
113- IF t_requested_next_recert_date IS NULL THEN
114- -- if the currenct next recert date is before the intended fixed input date, ignore it
115- IF b_never_recertified THEN
116- t_next_recert_date := t_rule_created + make_interval (days => i_recert_inverval);
117- ELSE
118- t_next_recert_date := t_rule_last_recertified + make_interval (days => i_recert_inverval);
119- END IF;
120- ELSE
121- t_next_recert_date := t_requested_next_recert_date;
122- END IF;
123-
124- -- do not set next recert date later than actually calculated date
125- IF NOT b_no_current_next_recert_date THEN
126- IF t_next_recert_date> t_current_next_recert_date THEN
127- t_next_recert_date := t_current_next_recert_date;
128- END IF;
129- END IF;
130-
131- -- delete old recert entry:
132- DELETE FROM recertification WHERE owner_id= i_owner_id AND rule_id= r_rule .rule_id AND recert_date IS NULL ;
133-
134- -- add new recert entry:
135- IF b_super_owner THEN -- special case for super owner (convert NULL to ID)
136- INSERT INTO recertification (rule_metadata_id, next_recert_date, rule_id, ip_match, owner_id)
137- SELECT rule_metadata_id,
138- t_next_recert_date AS next_recert_date,
139- rule_id,
140- matches as ip_match,
141- i_owner_id AS owner_id
142- FROM view_rule_with_owner
143- LEFT JOIN rule USING (rule_id)
144- LEFT JOIN rule_metadata ON (rule .rule_uid = rule_metadata .rule_uid AND rule .dev_id = rule_metadata .dev_id )
145- WHERE view_rule_with_owner .rule_id = r_rule .rule_id AND view_rule_with_owner .owner_id IS NULL ;
146- ELSE
147- INSERT INTO recertification (rule_metadata_id, next_recert_date, rule_id, ip_match, owner_id)
148- SELECT rule_metadata_id,
149- t_next_recert_date AS next_recert_date,
150- rule_id,
151- matches as ip_match,
152- i_owner_id AS owner_id
153- FROM view_rule_with_owner
154- LEFT JOIN rule USING (rule_id)
155- LEFT JOIN rule_metadata ON (rule .rule_uid = rule_metadata .rule_uid AND rule .dev_id = rule_metadata .dev_id )
156- WHERE view_rule_with_owner .rule_id = r_rule .rule_id AND view_rule_with_owner .owner_id = i_owner_id;
157- END IF;
158- ELSE
159- -- delete old outdated recert entry if owner is not responsible any more
160- DELETE FROM recertification WHERE owner_id= i_owner_id AND rule_id= r_rule .rule_id AND recert_date IS NULL ;
161- END IF;
162- END LOOP;
65+ $$ LANGUAGE plpgsql STABLE;
16366
164- -- -- finally, when not super user - recalculate super user recert entries - since these might change with each owner change
165- -- IF NOT b_super_owner AND b_super_owner_exists THEN
166- -- PERFORM recert_refresh_one_owner_one_mgm (i_super_owner_id, i_mgm_id, t_requested_next_recert_date);
167- -- END IF;
168- END IF;
169- END;
170- $$ LANGUAGE plpgsql;
17167
17268
17369-- function used during import of a single management config
18884END;
18985$$ LANGUAGE plpgsql;
19086
87+ -- select * from recert_get_one_owner_one_mgm(4,1)
19188
19289-- this function returns a table of future recert entries
19390-- but does not write them into the recertification table
@@ -226,7 +123,8 @@ BEGIN
226123 SELECT I .start_time ::timestamp + make_interval (days => o .recert_interval ) AS value
227124 UNION
228125 SELECT C .recert_date + make_interval (days => o .recert_interval ) AS value
229- ) AS temp_table))
126+ ) AS temp_table)),
127+ NULL ::bigint AS owner_recert_id
230128 FROM
231129 view_rule_with_owner V
232130 LEFT JOIN rule R USING (rule_id)
@@ -253,7 +151,8 @@ BEGIN
253151 SELECT I .start_time ::timestamp + make_interval (days => o .recert_interval ) AS value
254152 UNION
255153 SELECT C .recert_date + make_interval (days => o .recert_interval ) AS value
256- ) AS temp_table))
154+ ) AS temp_table)),
155+ NULL ::bigint AS owner_recert_id
257156 FROM
258157 view_rule_with_owner V
259158 LEFT JOIN rule R USING (rule_id)
0 commit comments