roles

Author: pyramation

.github/workflows/ci.yml

@@ -67,6 +67,14 @@ jobs:
       - name: Build
         run: pnpm -r build
 
+      - name: Create roles
+        run: psql -f roles.sql
+        env:
+          PGHOST: pg_db
+          PGPORT: 5432
+          PGUSER: postgres
+          PGPASSWORD: password
+
       - name: Seed app_user
         run: |
           lql admin-users bootstrap --yes
@@ -150,6 +158,9 @@ jobs:
       - name: Build
         run: pnpm -r build
 
+      - name: Create roles
+        run: psql -f roles.sql
+
       - name: Seed app_user
         run: |
           lql admin-users bootstrap --yes

roles.sql

@@ -0,0 +1,45 @@
+-- anon
+CREATE ROLE IF NOT EXISTS anon;
+
+ALTER USER anon WITH NOCREATEDB;
+
+ALTER USER anon WITH NOSUPERUSER;
+
+ALTER USER anon WITH NOCREATEROLE;
+
+ALTER USER anon WITH NOLOGIN;
+
+ALTER USER anon WITH NOREPLICATION;
+
+ALTER USER anon WITH NOBYPASSRLS;
+
+-- authenticated
+CREATE ROLE IF NOT EXISTS authenticated;
+
+ALTER USER authenticated WITH NOCREATEDB;
+
+ALTER USER authenticated WITH NOSUPERUSER;
+
+ALTER USER authenticated WITH NOCREATEROLE;
+
+ALTER USER authenticated WITH NOLOGIN;
+
+ALTER USER authenticated WITH NOREPLICATION;
+
+ALTER USER authenticated WITH NOBYPASSRLS;
+
+-- service_role
+CREATE ROLE IF NOT EXISTS service_role;
+
+ALTER USER service_role WITH NOCREATEDB;
+
+ALTER USER service_role WITH NOSUPERUSER;
+
+ALTER USER service_role WITH NOCREATEROLE;
+
+ALTER USER service_role WITH NOLOGIN;
+
+ALTER USER service_role WITH NOREPLICATION;
+
+-- they CAN bypass RLS
+ALTER USER service_role WITH BYPASSRLS;