Skip to content

Commit 07ec6a0

Browse files
soedirgosoedirgo
committed
tmp
1 parent de68fda commit 07ec6a0

File tree

1 file changed

+80
-80
lines changed
  • ansible/files/admin_api_scripts/pg_upgrade_scripts

1 file changed

+80
-80
lines changed

‎ansible/files/admin_api_scripts/pg_upgrade_scripts/complete.sh‎

Lines changed: 80 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -152,86 +152,86 @@ EOF
152152
run_sql -c "update pg_extension set extowner = 'postgres'::regrole where extname = 'pgmq';"
153153
fi
154154

155-
# If upgrading to pgsodium-less Vault, Wrappers need to be updated so that
156-
# foreign servers use `vault.secrets.id` instead of `vault.secrets.key_id`
157-
UPDATE_WRAPPERS_SERVER_OPTIONS_QUERY=$(cat <<EOF
158-
DO \$\$
159-
DECLARE
160-
server_rec RECORD;
161-
option_rec RECORD;
162-
vault_secrets RECORD;
163-
BEGIN
164-
IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'wrappers' AND version = '0.4.6')
165-
AND EXISTS (SELECT FROM pg_extension WHERE extname = 'wrappers')
166-
THEN
167-
FOR server_rec IN
168-
SELECT srvname, srvoptions
169-
FROM pg_foreign_server
170-
LOOP
171-
FOR option_rec IN
172-
SELECT split_part(srvoption, '=', 1) AS option_name, split_part(srvoption, '=', 2) AS option_value
173-
FROM UNNEST(server_rec.srvoptions) AS srvoption
174-
LOOP
175-
IF EXISTS (SELECT FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text)) THEN
176-
RAISE WARNING '%', format(
177-
'ALTER SERVER %I OPTIONS (SET %I %L)',
178-
server_rec.srvname,
179-
option_rec.option_name,
180-
(SELECT id FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text))
181-
);
182-
EXECUTE format(
183-
'ALTER SERVER %I OPTIONS (SET %I %L)',
184-
server_rec.srvname,
185-
option_rec.option_name,
186-
(SELECT id FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text))
187-
);
188-
END IF;
189-
END LOOP;
190-
END LOOP;
191-
END IF;
192-
END;
193-
\$\$;
194-
EOF
195-
)
196-
run_sql -c "$UPDATE_WRAPPERS_SERVER_OPTIONS_QUERY"
197-
198-
# Patch to handle upgrading to pgsodium-less Vault
199-
REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
200-
DO \$\$
201-
BEGIN
202-
IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
203-
AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
204-
THEN
205-
IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
206-
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
207-
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
208-
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
209-
END IF;
210-
-- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
211-
IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
212-
UPDATE vault.secrets s
213-
SET
214-
secret = encode(
215-
vault._crypto_aead_det_encrypt(
216-
message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
217-
additional := convert_to(s.id::text, 'utf8'),
218-
key_id := 0,
219-
context := 'pgsodium'::bytea,
220-
nonce := s.nonce
221-
),
222-
'base64'
223-
),
224-
key_id = NULL
225-
WHERE
226-
key_id IS NOT NULL;
227-
END IF;
228-
END IF;
229-
END
230-
\$\$;
231-
EOF
232-
)
233-
run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
234-
exit 1
155+
# # If upgrading to pgsodium-less Vault, Wrappers need to be updated so that
156+
# # foreign servers use `vault.secrets.id` instead of `vault.secrets.key_id`
157+
# UPDATE_WRAPPERS_SERVER_OPTIONS_QUERY=$(cat <<EOF
158+
# DO \$\$
159+
# DECLARE
160+
# server_rec RECORD;
161+
# option_rec RECORD;
162+
# vault_secrets RECORD;
163+
# BEGIN
164+
# IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'wrappers' AND version = '0.4.6')
165+
# AND EXISTS (SELECT FROM pg_extension WHERE extname = 'wrappers')
166+
# THEN
167+
# FOR server_rec IN
168+
# SELECT srvname, srvoptions
169+
# FROM pg_foreign_server
170+
# LOOP
171+
# FOR option_rec IN
172+
# SELECT split_part(srvoption, '=', 1) AS option_name, split_part(srvoption, '=', 2) AS option_value
173+
# FROM UNNEST(server_rec.srvoptions) AS srvoption
174+
# LOOP
175+
# IF EXISTS (SELECT FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text)) THEN
176+
# RAISE WARNING '%', format(
177+
# 'ALTER SERVER %I OPTIONS (SET %I %L)',
178+
# server_rec.srvname,
179+
# option_rec.option_name,
180+
# (SELECT id FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text))
181+
# );
182+
# EXECUTE format(
183+
# 'ALTER SERVER %I OPTIONS (SET %I %L)',
184+
# server_rec.srvname,
185+
# option_rec.option_name,
186+
# (SELECT id FROM vault.secrets WHERE option_rec.option_value IN (id::text, key_id::text))
187+
# );
188+
# END IF;
189+
# END LOOP;
190+
# END LOOP;
191+
# END IF;
192+
# END;
193+
# \$\$;
194+
# EOF
195+
# )
196+
# run_sql -c "$UPDATE_WRAPPERS_SERVER_OPTIONS_QUERY"
197+
198+
# # Patch to handle upgrading to pgsodium-less Vault
199+
# REENCRYPT_VAULT_SECRETS_QUERY=$(cat <<EOF
200+
# DO \$\$
201+
# BEGIN
202+
# IF EXISTS (SELECT FROM pg_available_extension_versions WHERE name = 'supabase_vault' AND version = '0.3.0')
203+
# AND EXISTS (SELECT FROM pg_extension WHERE extname = 'supabase_vault')
204+
# THEN
205+
# IF (SELECT extversion FROM pg_extension WHERE extname = 'supabase_vault') != '0.2.8' THEN
206+
# GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
207+
# GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
208+
# GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
209+
# END IF;
210+
# -- Do an explicit IF EXISTS check to avoid referencing pgsodium objects if the project already migrated away from using pgsodium.
211+
# IF EXISTS (SELECT FROM vault.secrets WHERE key_id IS NOT NULL) THEN
212+
# UPDATE vault.secrets s
213+
# SET
214+
# secret = encode(
215+
# vault._crypto_aead_det_encrypt(
216+
# message := pgsodium.crypto_aead_det_decrypt(decode(s.secret, 'base64'), convert_to(s.id || s.description || s.created_at || s.updated_at, 'utf8'), s.key_id, s.nonce),
217+
# additional := convert_to(s.id::text, 'utf8'),
218+
# key_id := 0,
219+
# context := 'pgsodium'::bytea,
220+
# nonce := s.nonce
221+
# ),
222+
# 'base64'
223+
# ),
224+
# key_id = NULL
225+
# WHERE
226+
# key_id IS NOT NULL;
227+
# END IF;
228+
# END IF;
229+
# END
230+
# \$\$;
231+
# EOF
232+
# )
233+
# run_sql -c "$REENCRYPT_VAULT_SECRETS_QUERY"
234+
# exit 1
235235

236236
run_sql -c "grant pg_read_all_data, pg_signal_backend to postgres"
237237
}

0 commit comments

Comments
 (0)