🔨 Doc and scripts to create read-only user in PostgreSQL

[pcrespov]

What do these changes do?

This PR introduces a way to create a read-only user in PostgreSQL databases.

• Adds environment variables POSTGRES_READONLY_USER and POSTGRES_READONLY_PASSWORD to define credentials for the read-only user.
• Provides an initialization script for PostgreSQL services, which runs during the initial setup (i.e., only when the PostgreSQL data directory is empty) to automatically create a read-only user.
• For existing databases, you can manually create the read-only user by executing the generated SQL script. To generate and apply the script, follow these steps:

  make .env
  cd services/postgres
  make readonly-user-sql
  

  Then, run the script in your PostgreSQL instance using a tool like Adminer, or via a Docker exec command.
  • NOTE: @YuryHrytsuk @mrnicegyu11 we have to adapt this in the ops-scripts

Related issue/s

• Requested by @calys for TIP: lite osparc-issues#1701

How to test

• Test new user in an existing db
  1. cd services/postgres
  2. make scripts/create-readonly-user.sql
  3. login in adminer
  4. Execute in SQL query the result of (2)

Dev-ops checklist

• Review new POSTGRES_READONLY_USER, POSTGRES_READONLY_PASSWORD and following steps in osparc-config

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 88.2%. Comparing base (cafbf96) to head (9065a59).
Report is 573 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff            @@
##           master   #6426      +/-   ##
=========================================
+ Coverage    84.5%   88.2%    +3.6%     
=========================================
  Files          10    1507    +1497     
  Lines         214   62506   +62292     
  Branches       25    2070    +2045     
=========================================
+ Hits          181   55164   +54983     
- Misses         23    7022    +6999     
- Partials       10     320     +310     

Flag	Coverage Δ
integrationtests	64.7% <ø> (?)
unittests	86.2% <ø> (+1.6%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 1457 files with indirect coverage changes

[GitHK]

nothing more to add form my behalf

[mrnicegyu11]

I am not sure that we can merge this in as-is.

Ideally this PR requires:

• Sister PRs in osparc-ops-deployment-configuration to add those env-vars to the repo.config.template.
• Potentially a PR in osparc-ops-environments that adds this env-var in the simcore/docker-compose*.yml files
• Likely there should be a test running periodically to asses that both the readonly user and the admin user login works as expected. This would then also add those credentials to the credentialspage.

[mrnicegyu11]

Please let us know how you want to proceed :--) we can help/assist.

[YuryHrytsuk]

Thank you!

[mrnicegyu11]

ok as said

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud