Skip to content

Commit 7422553

Browse files
soedirgosoedirgo
committed
fix: update migration to support vault 0.2.8 and above
1 parent 4a7790c commit 7422553

File tree

5 files changed

+41
-164
lines changed

5 files changed

+41
-164
lines changed

‎migrations/db/migrations/20221207154255_create_pgsodium_and_vault.sql‎

Lines changed: 35 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -5,34 +5,44 @@ DECLARE
55
pgsodium_exists boolean;
66
vault_exists boolean;
77
BEGIN
8-
pgsodium_exists = (
9-
select count(*) = 1
10-
from pg_available_extensions
11-
where name = 'pgsodium'
12-
and default_version in ('3.1.6', '3.1.7', '3.1.8', '3.1.9')
13-
);
14-
15-
vault_exists = (
8+
IF EXISTS (SELECT FROM pg_available_extensions WHERE name = 'supabase_vault' AND default_version != '0.2.8') THEN
9+
CREATE EXTENSION IF NOT EXISTS supabase_vault;
10+
11+
-- for some reason extension custom scripts aren't run during AMI build, so
12+
-- we manually run it here
13+
GRANT USAGE ON SCHEMA vault TO postgres WITH GRANT OPTION;
14+
GRANT SELECT, DELETE ON vault.secrets, vault.decrypted_secrets TO postgres WITH GRANT OPTION;
15+
GRANT EXECUTE ON FUNCTION vault.create_secret, vault.update_secret, vault._crypto_aead_det_decrypt TO postgres WITH GRANT OPTION;
16+
ELSE
17+
pgsodium_exists = (
1618
select count(*) = 1
1719
from pg_available_extensions
18-
where name = 'supabase_vault'
19-
);
20-
21-
IF pgsodium_exists
22-
THEN
23-
create extension if not exists pgsodium;
24-
25-
grant pgsodium_keyiduser to postgres with admin option;
26-
grant pgsodium_keyholder to postgres with admin option;
27-
grant pgsodium_keymaker to postgres with admin option;
28-
29-
grant execute on function pgsodium.crypto_aead_det_decrypt(bytea, bytea, uuid, bytea) to service_role;
30-
grant execute on function pgsodium.crypto_aead_det_encrypt(bytea, bytea, uuid, bytea) to service_role;
31-
grant execute on function pgsodium.crypto_aead_det_keygen to service_role;
32-
33-
IF vault_exists
20+
where name = 'pgsodium'
21+
and default_version in ('3.1.6', '3.1.7', '3.1.8', '3.1.9')
22+
);
23+
24+
vault_exists = (
25+
select count(*) = 1
26+
from pg_available_extensions
27+
where name = 'supabase_vault'
28+
);
29+
30+
IF pgsodium_exists
3431
THEN
35-
create extension if not exists supabase_vault;
32+
create extension if not exists pgsodium;
33+
34+
grant pgsodium_keyiduser to postgres with admin option;
35+
grant pgsodium_keyholder to postgres with admin option;
36+
grant pgsodium_keymaker to postgres with admin option;
37+
38+
grant execute on function pgsodium.crypto_aead_det_decrypt(bytea, bytea, uuid, bytea) to service_role;
39+
grant execute on function pgsodium.crypto_aead_det_encrypt(bytea, bytea, uuid, bytea) to service_role;
40+
grant execute on function pgsodium.crypto_aead_det_keygen to service_role;
41+
42+
IF vault_exists
43+
THEN
44+
create extension if not exists supabase_vault;
45+
END IF;
3646
END IF;
3747
END IF;
3848
END $$;

‎migrations/db/migrations/20230529180330_alter_api_roles_for_inherit.sql‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,12 @@ ALTER ROLE authenticated inherit;
44
ALTER ROLE anon inherit;
55
ALTER ROLE service_role inherit;
66

7-
GRANT pgsodium_keyholder to service_role;
7+
DO $$
8+
BEGIN
9+
IF EXISTS (SELECT FROM pg_roles WHERE rolname = 'pgsodium_keyholder') THEN
10+
GRANT pgsodium_keyholder to service_role;
11+
END IF;
12+
END $$;
813

914
-- migrate:down
1015

‎migrations/schema-15.sql‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -44,27 +44,6 @@ CREATE SCHEMA graphql_public;
4444
CREATE SCHEMA pgbouncer;
4545

4646

47-
--
48-
-- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: -
49-
--
50-
51-
CREATE SCHEMA pgsodium;
52-
53-
54-
--
55-
-- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
56-
--
57-
58-
CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
59-
60-
61-
--
62-
-- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: -
63-
--
64-
65-
COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
66-
67-
6847
--
6948
-- Name: realtime; Type: SCHEMA; Schema: -; Owner: -
7049
--
@@ -574,28 +553,6 @@ END
574553
$$;
575554

576555

577-
--
578-
-- Name: secrets_encrypt_secret_secret(); Type: FUNCTION; Schema: vault; Owner: -
579-
--
580-
581-
CREATE FUNCTION vault.secrets_encrypt_secret_secret() RETURNS trigger
582-
LANGUAGE plpgsql
583-
AS $$
584-
BEGIN
585-
new.secret = CASE WHEN new.secret IS NULL THEN NULL ELSE
586-
CASE WHEN new.key_id IS NULL THEN NULL ELSE pg_catalog.encode(
587-
pgsodium.crypto_aead_det_encrypt(
588-
pg_catalog.convert_to(new.secret, 'utf8'),
589-
pg_catalog.convert_to((new.id::text || new.description::text || new.created_at::text || new.updated_at::text)::text, 'utf8'),
590-
new.key_id::uuid,
591-
new.nonce
592-
),
593-
'base64') END END;
594-
RETURN new;
595-
END;
596-
$$;
597-
598-
599556
SET default_tablespace = '';
600557

601558
SET default_table_access_method = heap;
@@ -782,30 +739,6 @@ CREATE TABLE storage.objects (
782739
);
783740

784741

785-
--
786-
-- Name: decrypted_secrets; Type: VIEW; Schema: vault; Owner: -
787-
--
788-
789-
CREATE VIEW vault.decrypted_secrets AS
790-
SELECT secrets.id,
791-
secrets.name,
792-
secrets.description,
793-
secrets.secret,
794-
CASE
795-
WHEN (secrets.secret IS NULL) THEN NULL::text
796-
ELSE
797-
CASE
798-
WHEN (secrets.key_id IS NULL) THEN NULL::text
799-
ELSE convert_from(pgsodium.crypto_aead_det_decrypt(decode(secrets.secret, 'base64'::text), convert_to(((((secrets.id)::text || secrets.description) || (secrets.created_at)::text) || (secrets.updated_at)::text), 'utf8'::name), secrets.key_id, secrets.nonce), 'utf8'::name)
800-
END
801-
END AS decrypted_secret,
802-
secrets.key_id,
803-
secrets.nonce,
804-
secrets.created_at,
805-
secrets.updated_at
806-
FROM vault.secrets;
807-
808-
809742
--
810743
-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: -
811744
--

‎migrations/schema-orioledb-17.sql‎

Lines changed: 0 additions & 67 deletions
Original file line numberDiff line numberDiff line change
@@ -45,27 +45,6 @@ CREATE SCHEMA graphql_public;
4545
CREATE SCHEMA pgbouncer;
4646

4747

48-
--
49-
-- Name: pgsodium; Type: SCHEMA; Schema: -; Owner: -
50-
--
51-
52-
CREATE SCHEMA pgsodium;
53-
54-
55-
--
56-
-- Name: pgsodium; Type: EXTENSION; Schema: -; Owner: -
57-
--
58-
59-
CREATE EXTENSION IF NOT EXISTS pgsodium WITH SCHEMA pgsodium;
60-
61-
62-
--
63-
-- Name: EXTENSION pgsodium; Type: COMMENT; Schema: -; Owner: -
64-
--
65-
66-
COMMENT ON EXTENSION pgsodium IS 'Pgsodium is a modern cryptography library for Postgres.';
67-
68-
6948
--
7049
-- Name: realtime; Type: SCHEMA; Schema: -; Owner: -
7150
--
@@ -589,28 +568,6 @@ END
589568
$$;
590569

591570

592-
--
593-
-- Name: secrets_encrypt_secret_secret(); Type: FUNCTION; Schema: vault; Owner: -
594-
--
595-
596-
CREATE FUNCTION vault.secrets_encrypt_secret_secret() RETURNS trigger
597-
LANGUAGE plpgsql
598-
AS $$
599-
BEGIN
600-
new.secret = CASE WHEN new.secret IS NULL THEN NULL ELSE
601-
CASE WHEN new.key_id IS NULL THEN NULL ELSE pg_catalog.encode(
602-
pgsodium.crypto_aead_det_encrypt(
603-
pg_catalog.convert_to(new.secret, 'utf8'),
604-
pg_catalog.convert_to((new.id::text || new.description::text || new.created_at::text || new.updated_at::text)::text, 'utf8'),
605-
new.key_id::uuid,
606-
new.nonce
607-
),
608-
'base64') END END;
609-
RETURN new;
610-
END;
611-
$$;
612-
613-
614571
SET default_tablespace = '';
615572

616573
SET default_table_access_method = orioledb;
@@ -797,30 +754,6 @@ CREATE TABLE storage.objects (
797754
);
798755

799756

800-
--
801-
-- Name: decrypted_secrets; Type: VIEW; Schema: vault; Owner: -
802-
--
803-
804-
CREATE VIEW vault.decrypted_secrets AS
805-
SELECT id,
806-
name,
807-
description,
808-
secret,
809-
CASE
810-
WHEN (secret IS NULL) THEN NULL::text
811-
ELSE
812-
CASE
813-
WHEN (key_id IS NULL) THEN NULL::text
814-
ELSE convert_from(pgsodium.crypto_aead_det_decrypt(decode(secret, 'base64'::text), convert_to(((((id)::text || description) || (created_at)::text) || (updated_at)::text), 'utf8'::name), key_id, nonce), 'utf8'::name)
815-
END
816-
END AS decrypted_secret,
817-
key_id,
818-
nonce,
819-
created_at,
820-
updated_at
821-
FROM vault.secrets;
822-
823-
824757
--
825758
-- Name: refresh_tokens id; Type: DEFAULT; Schema: auth; Owner: -
826759
--

‎migrations/tests/database/privs.sql‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,6 @@ SELECT database_privs_are(
22
'postgres', 'postgres', ARRAY['CONNECT', 'TEMPORARY', 'CREATE']
33
);
44

5-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_decrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
6-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_encrypt', array['bytea', 'bytea', 'uuid', 'bytea'], 'service_role', array['EXECUTE']);
7-
SELECT function_privs_are('pgsodium', 'crypto_aead_det_keygen', array[]::text[], 'service_role', array['EXECUTE']);
8-
95
-- Verify public schema privileges
106
SELECT schema_privs_are('public', 'postgres', array['CREATE', 'USAGE']);
117
SELECT schema_privs_are('public', 'anon', array['USAGE']);

0 commit comments

Comments
 (0)