Skip to content

Commit 62a4acb

Browse files
soedirgosoedirgo
committed
test
1 parent 034d40f commit 62a4acb

File tree

2 files changed

+331
-332
lines changed

2 files changed

+331
-332
lines changed

‎ansible/files/admin_api_scripts/pg_upgrade_scripts/change_bootstrap_user.sql

Lines changed: 330 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,330 @@
1+
do $$
2+
declare
3+
postgres_rolpassword text := (select rolpassword from pg_authid where rolname = 'postgres');
4+
supabase_admin_rolpassword text := (select rolpassword from pg_authid where rolname = 'supabase_admin');
5+
postgres_role_settings text[] := (select setconfig from pg_db_role_setting where setdatabase = 0 and setrole = 'postgres'::regrole);
6+
supabase_admin_role_settings text[] := (select setconfig from pg_db_role_setting where setdatabase = 0 and setrole = 'supabase_admin'::regrole);
7+
event_triggers jsonb[] := (select coalesce(array_agg(jsonb_build_object('name', evtname)), '{}') from pg_event_trigger where evtowner = 'postgres'::regrole);
8+
default_acls jsonb[] := (
9+
select coalesce(array_agg(jsonb_build_object('oid', d.oid, 'role', a.rolname, 'schema', n.nspname, 'objtype', d.defaclobjtype, 'acl', defaclacl::text)), '{}')
10+
from pg_default_acl d
11+
join pg_authid a on a.oid = d.defaclrole
12+
left join pg_namespace n on n.oid = d.defaclnamespace
13+
);
14+
-- We only care about swapping init_privs for extensions
15+
init_privs jsonb[] := (
16+
select coalesce(array_agg(jsonb_build_object('objoid', objoid, 'classoid', classoid, 'initprivs', initprivs::text)), '{}')
17+
from pg_init_privs
18+
where privtype = 'e'
19+
);
20+
schemas jsonb[] := (
21+
select coalesce(array_agg(jsonb_build_object('oid', n.oid, 'owner', a.rolname, 'acl', nspacl::text)), '{}')
22+
from pg_namespace n
23+
join pg_authid a on a.oid = n.nspowner
24+
where true
25+
and n.nspname != 'information_schema'
26+
and not starts_with(n.nspname, 'pg_')
27+
);
28+
types jsonb[] := (
29+
select coalesce(array_agg(jsonb_build_object('oid', t.oid, 'owner', a.rolname, 'acl', t.typacl::text)), '{}')
30+
from pg_type t
31+
join pg_namespace n on n.oid = t.typnamespace
32+
join pg_authid a on a.oid = t.typowner
33+
where true
34+
and n.nspname != 'information_schema'
35+
and not starts_with(n.nspname, 'pg_')
36+
and (
37+
t.typrelid = 0
38+
or (
39+
select
40+
c.relkind = 'c'
41+
from
42+
pg_class c
43+
where
44+
c.oid = t.typrelid
45+
)
46+
)
47+
and not exists (
48+
select
49+
from
50+
pg_type el
51+
where
52+
el.oid = t.typelem
53+
and el.typarray = t.oid
54+
)
55+
);
56+
functions jsonb[] := (
57+
select coalesce(array_agg(jsonb_build_object('oid', p.oid, 'owner', a.rolname, 'acl', p.proacl::text)), '{}')
58+
from pg_proc p
59+
join pg_namespace n on n.oid = p.pronamespace
60+
join pg_authid a on a.oid = p.proowner
61+
where true
62+
and n.nspname != 'information_schema'
63+
and not starts_with(n.nspname, 'pg_')
64+
);
65+
relations jsonb[] := (
66+
select coalesce(array_agg(jsonb_build_object('oid', c.oid, 'owner', a.rolname, 'acl', c.relacl::text)), '{}')
67+
from pg_class c
68+
join pg_namespace n on n.oid = c.relnamespace
69+
join pg_authid a on a.oid = c.relowner
70+
where true
71+
and n.nspname != 'information_schema'
72+
and not starts_with(n.nspname, 'pg_')
73+
and c.relkind not in ('c', 'i')
74+
);
75+
rec record;
76+
obj jsonb;
77+
begin
78+
set local search_path = '';
79+
80+
alter role postgres rename to supabase_admin_;
81+
alter role supabase_admin rename to postgres;
82+
alter role supabase_admin_ rename to supabase_admin;
83+
84+
-- role grants
85+
for rec in
86+
select * from pg_auth_members
87+
loop
88+
execute(format('revoke %I from %I;', rec.roleid::regrole, rec.member::regrole));
89+
execute(format(
90+
'grant %I to %I %s granted by %I;',
91+
case
92+
when rec.roleid = 'postgres'::regrole then 'supabase_admin'
93+
when rec.roleid = 'supabase_admin'::regrole then 'postgres'
94+
else rec.roleid::regrole
95+
end,
96+
case
97+
when rec.member = 'postgres'::regrole then 'supabase_admin'
98+
when rec.member = 'supabase_admin'::regrole then 'postgres'
99+
else rec.member::regrole
100+
end,
101+
case
102+
when rec.admin_option then 'with admin option'
103+
else ''
104+
end,
105+
case
106+
when rec.grantor = 'postgres'::regrole then 'supabase_admin'
107+
when rec.grantor = 'supabase_admin'::regrole then 'postgres'
108+
else rec.grantor::regrole
109+
end
110+
));
111+
end loop;
112+
113+
-- role passwords
114+
execute(format('alter role postgres password %L;', postgres_rolpassword));
115+
execute(format('alter role supabase_admin password %L;', supabase_admin_rolpassword));
116+
117+
-- role settings
118+
-- TODO: don't modify system catalog directly
119+
update pg_db_role_setting set setconfig = postgres_role_settings where setdatabase = 0 and setrole = 'postgres'::regrole;
120+
update pg_db_role_setting set setconfig = supabase_admin_role_settings where setdatabase = 0 and setrole = 'supabase_admin'::regrole;
121+
122+
reassign owned by postgres to supabase_admin;
123+
124+
-- databases
125+
for rec in
126+
select * from pg_database where datname not in ('template0')
127+
loop
128+
execute(format('alter database %I owner to postgres;', rec.datname));
129+
end loop;
130+
131+
-- event triggers
132+
foreach obj in array event_triggers
133+
loop
134+
execute(format('alter event trigger %I owner to postgres;', obj->>'name'));
135+
end loop;
136+
137+
-- publications
138+
for rec in
139+
select * from pg_publication
140+
loop
141+
execute(format('alter publication %I owner to postgres;', rec.pubname));
142+
end loop;
143+
144+
-- FDWs
145+
for rec in
146+
select * from pg_foreign_data_wrapper
147+
loop
148+
execute(format('alter foreign data wrapper %I owner to postgres;', rec.fdwname));
149+
end loop;
150+
151+
-- foreign servers
152+
for rec in
153+
select * from pg_foreign_server
154+
loop
155+
execute(format('alter server %I owner to postgres;', rec.srvname));
156+
end loop;
157+
158+
-- user mappings
159+
-- TODO: don't modify system catalog directly
160+
update pg_user_mapping set umuser = 'postgres'::regrole where umuser = 'supabase_admin'::regrole;
161+
162+
-- init privs
163+
foreach obj in array init_privs
164+
loop
165+
update pg_init_privs set initprivs = (obj->>'initprivs')::aclitem[] where objoid = (obj->>'objoid')::oid and classoid = (obj->>'classoid')::oid;
166+
end loop;
167+
168+
-- default acls
169+
foreach obj in array default_acls
170+
loop
171+
for rec in
172+
select grantor, grantee, privilege_type, is_grantable
173+
from aclexplode((obj->>'acl')::aclitem[])
174+
loop
175+
if obj->>'role' in ('postgres', 'supabase_admin') or rec.grantee::regrole in ('postgres', 'supabase_admin') then
176+
execute(format('alter default privileges for role %I %s revoke %s on %s from %I'
177+
, case when obj->>'role' = 'postgres' then 'supabase_admin'
178+
when obj->>'role' = 'supabase_admin' then 'postgres'
179+
else obj->>'role'
180+
end
181+
, case when obj->>'schema' is null then ''
182+
else format('in schema %I', (obj->>'schema')::regnamespace)
183+
end
184+
, rec.privilege_type
185+
, case when obj->>'objtype' = 'r' then 'tables'
186+
when obj->>'objtype' = 'S' then 'sequences'
187+
when obj->>'objtype' = 'f' then 'functions'
188+
when obj->>'objtype' = 'T' then 'types'
189+
when obj->>'objtype' = 'n' then 'schemas'
190+
end
191+
, case when rec.grantee = 'postgres'::regrole then 'supabase_admin'
192+
when rec.grantee = 'supabase_admin'::regrole then 'postgres'
193+
else rec.grantee::regrole
194+
end
195+
));
196+
end if;
197+
end loop;
198+
end loop;
199+
200+
foreach obj in array default_acls
201+
loop
202+
for rec in
203+
select grantor, grantee, privilege_type, is_grantable
204+
from aclexplode((obj->>'acl')::aclitem[])
205+
loop
206+
if obj->>'role' in ('postgres', 'supabase_admin') or rec.grantee::regrole in ('postgres', 'supabase_admin') then
207+
execute(format('alter default privileges for role %I %s grant %s on %s to %I %s'
208+
, obj->>'role'
209+
, case when obj->>'schema' is null then ''
210+
else format('in schema %I', (obj->>'schema')::regnamespace)
211+
end
212+
, rec.privilege_type
213+
, case when obj->>'objtype' = 'r' then 'tables'
214+
when obj->>'objtype' = 'S' then 'sequences'
215+
when obj->>'objtype' = 'f' then 'functions'
216+
when obj->>'objtype' = 'T' then 'types'
217+
when obj->>'objtype' = 'n' then 'schemas'
218+
end
219+
, rec.grantee::regrole
220+
, case when rec.is_grantable then 'with grant option' else '' end
221+
));
222+
end if;
223+
end loop;
224+
end loop;
225+
226+
-- schemas
227+
foreach obj in array schemas
228+
loop
229+
if obj->>'owner' = 'postgres' then
230+
execute(format('alter schema %s owner to postgres;', (obj->>'oid')::regnamespace));
231+
end if;
232+
for rec in
233+
select grantor, grantee, privilege_type, is_grantable
234+
from aclexplode((obj->>'acl')::aclitem[])
235+
where grantee::regrole in ('postgres', 'supabase_admin')
236+
loop
237+
execute(format('revoke %s on schema %s from %I', rec.privilege_type, (obj->>'oid')::regnamespace, case when rec.grantee = 'postgres'::regrole then 'supabase_admin' else 'postgres' end));
238+
end loop;
239+
end loop;
240+
foreach obj in array schemas
241+
loop
242+
for rec in
243+
select grantor, grantee, privilege_type, is_grantable
244+
from aclexplode((obj->>'acl')::aclitem[])
245+
where grantee::regrole in ('postgres', 'supabase_admin')
246+
loop
247+
execute(format('grant %s on schema %s to %I %s', rec.privilege_type, (obj->>'oid')::regnamespace, rec.grantee::regrole, case when rec.is_grantable then 'with grant option' else '' end));
248+
end loop;
249+
end loop;
250+
251+
-- types
252+
foreach obj in array types
253+
loop
254+
if obj->>'owner' = 'postgres' then
255+
execute(format('alter type %s owner to postgres;', (obj->>'oid')::regtype));
256+
end if;
257+
for rec in
258+
select grantor, grantee, privilege_type, is_grantable
259+
from aclexplode((obj->>'acl')::aclitem[])
260+
where grantee::regrole in ('postgres', 'supabase_admin')
261+
loop
262+
execute(format('revoke %s on type %s from %I', rec.privilege_type, (obj->>'oid')::regtype, case when rec.grantee = 'postgres'::regrole then 'supabase_admin' else 'postgres' end));
263+
end loop;
264+
end loop;
265+
foreach obj in array types
266+
loop
267+
for rec in
268+
select grantor, grantee, privilege_type, is_grantable
269+
from aclexplode((obj->>'acl')::aclitem[])
270+
where grantee::regrole in ('postgres', 'supabase_admin')
271+
loop
272+
execute(format('grant %s on type %s to %I %s', rec.privilege_type, (obj->>'oid')::regtype, rec.grantee::regrole, case when rec.is_grantable then 'with grant option' else '' end));
273+
end loop;
274+
end loop;
275+
276+
-- functions
277+
foreach obj in array functions
278+
loop
279+
if obj->>'owner' = 'postgres' then
280+
execute(format('alter routine %s(%s) owner to postgres;', (obj->>'oid')::regproc, pg_get_function_identity_arguments((obj->>'oid')::regproc)));
281+
end if;
282+
for rec in
283+
select grantor, grantee, privilege_type, is_grantable
284+
from aclexplode((obj->>'acl')::aclitem[])
285+
where grantee::regrole in ('postgres', 'supabase_admin')
286+
loop
287+
execute(format('revoke %s on function %s(%s) from %I', rec.privilege_type, (obj->>'oid')::regproc, pg_get_function_identity_arguments((obj->>'oid')::regproc), case when rec.grantee = 'postgres'::regrole then 'supabase_admin' else 'postgres' end));
288+
end loop;
289+
end loop;
290+
foreach obj in array functions
291+
loop
292+
for rec in
293+
select grantor, grantee, privilege_type, is_grantable
294+
from aclexplode((obj->>'acl')::aclitem[])
295+
where grantee::regrole in ('postgres', 'supabase_admin')
296+
loop
297+
execute(format('grant %s on function %s(%s) to %I %s', rec.privilege_type, (obj->>'oid')::regproc, pg_get_function_identity_arguments((obj->>'oid')::regproc), rec.grantee::regrole, case when rec.is_grantable then 'with grant option' else '' end));
298+
end loop;
299+
end loop;
300+
301+
-- relations
302+
foreach obj in array relations
303+
loop
304+
-- obj->>'oid' (text) needs to be casted to oid first for some reason
305+
306+
if obj->>'owner' = 'postgres' then
307+
execute(format('alter table %s owner to postgres;', (obj->>'oid')::oid::regclass));
308+
end if;
309+
for rec in
310+
select grantor, grantee, privilege_type, is_grantable
311+
from aclexplode((obj->>'acl')::aclitem[])
312+
where grantee::regrole in ('postgres', 'supabase_admin')
313+
loop
314+
execute(format('revoke %s on table %s from %I', rec.privilege_type, (obj->>'oid')::oid::regclass, case when rec.grantee = 'postgres'::regrole then 'supabase_admin' else 'postgres' end));
315+
end loop;
316+
end loop;
317+
foreach obj in array relations
318+
loop
319+
-- obj->>'oid' (text) needs to be casted to oid first for some reason
320+
321+
for rec in
322+
select grantor, grantee, privilege_type, is_grantable
323+
from aclexplode((obj->>'acl')::aclitem[])
324+
where grantee::regrole in ('postgres', 'supabase_admin')
325+
loop
326+
execute(format('grant %s on table %s to %I %s', rec.privilege_type, (obj->>'oid')::oid::regclass, rec.grantee::regrole, case when rec.is_grantable then 'with grant option' else '' end));
327+
end loop;
328+
end loop;
329+
end
330+
$$;

0 commit comments

Comments
 (0)