Fix build and code structure improvements. New but essential UI functionality. CI improvements. Documentation improvements. AI module improvements.
This commit is contained in:
StellaOps Bot
153
devops/compose/postgres-init/03-grant-permissions.sql
Normal file
153
devops/compose/postgres-init/03-grant-permissions.sql
Normal file
@@ -0,0 +1,153 @@
|
||||
-- ============================================================================
|
||||
-- Per-Module Schema Permissions
|
||||
-- ============================================================================
|
||||
-- Grants each module user access to their respective schema(s).
|
||||
-- Users can only access tables in their designated schemas.
|
||||
-- ============================================================================
|
||||
|
||||
-- ============================================================================
|
||||
-- Authority Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA authority TO authority_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA authority TO authority_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA authority TO authority_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA authority GRANT ALL ON TABLES TO authority_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA authority GRANT ALL ON SEQUENCES TO authority_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Concelier Module (uses 'vuln' schema)
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA vuln TO concelier_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vuln TO concelier_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA vuln TO concelier_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA vuln GRANT ALL ON TABLES TO concelier_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA vuln GRANT ALL ON SEQUENCES TO concelier_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Excititor Module (uses 'vex' schema)
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA vex TO excititor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA vex TO excititor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA vex TO excititor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA vex GRANT ALL ON TABLES TO excititor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA vex GRANT ALL ON SEQUENCES TO excititor_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Scanner Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA scanner TO scanner_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA scanner TO scanner_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA scanner TO scanner_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA scanner GRANT ALL ON TABLES TO scanner_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA scanner GRANT ALL ON SEQUENCES TO scanner_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Scheduler Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA scheduler TO scheduler_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA scheduler TO scheduler_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA scheduler TO scheduler_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA scheduler GRANT ALL ON TABLES TO scheduler_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA scheduler GRANT ALL ON SEQUENCES TO scheduler_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- TaskRunner Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA taskrunner TO taskrunner_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA taskrunner TO taskrunner_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA taskrunner TO taskrunner_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA taskrunner GRANT ALL ON TABLES TO taskrunner_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA taskrunner GRANT ALL ON SEQUENCES TO taskrunner_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Policy Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA policy TO policy_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA policy TO policy_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA policy TO policy_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA policy GRANT ALL ON TABLES TO policy_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA policy GRANT ALL ON SEQUENCES TO policy_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Unknowns Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA unknowns TO unknowns_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA unknowns TO unknowns_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA unknowns TO unknowns_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA unknowns GRANT ALL ON TABLES TO unknowns_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA unknowns GRANT ALL ON SEQUENCES TO unknowns_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Attestor Module (uses 'proofchain' and 'attestor' schemas)
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA proofchain TO attestor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA proofchain TO attestor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA proofchain TO attestor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA proofchain GRANT ALL ON TABLES TO attestor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA proofchain GRANT ALL ON SEQUENCES TO attestor_user;
|
||||
|
||||
GRANT USAGE ON SCHEMA attestor TO attestor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA attestor TO attestor_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA attestor TO attestor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA attestor GRANT ALL ON TABLES TO attestor_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA attestor GRANT ALL ON SEQUENCES TO attestor_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Signer Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA signer TO signer_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA signer TO signer_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA signer TO signer_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA signer GRANT ALL ON TABLES TO signer_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA signer GRANT ALL ON SEQUENCES TO signer_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Notify Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA notify TO notify_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA notify TO notify_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA notify TO notify_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA notify GRANT ALL ON TABLES TO notify_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA notify GRANT ALL ON SEQUENCES TO notify_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Signals Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA signals TO signals_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA signals TO signals_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA signals TO signals_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA signals GRANT ALL ON TABLES TO signals_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA signals GRANT ALL ON SEQUENCES TO signals_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Packs Registry Module
|
||||
-- ============================================================================
|
||||
GRANT USAGE ON SCHEMA packs TO packs_user;
|
||||
GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA packs TO packs_user;
|
||||
GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA packs TO packs_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA packs GRANT ALL ON TABLES TO packs_user;
|
||||
ALTER DEFAULT PRIVILEGES IN SCHEMA packs GRANT ALL ON SEQUENCES TO packs_user;
|
||||
|
||||
-- ============================================================================
|
||||
-- Verification
|
||||
-- ============================================================================
|
||||
DO $$
|
||||
DECLARE
|
||||
v_user TEXT;
|
||||
v_schema TEXT;
|
||||
BEGIN
|
||||
RAISE NOTICE 'Per-module permissions granted:';
|
||||
RAISE NOTICE ' authority_user -> authority';
|
||||
RAISE NOTICE ' concelier_user -> vuln';
|
||||
RAISE NOTICE ' excititor_user -> vex';
|
||||
RAISE NOTICE ' scanner_user -> scanner';
|
||||
RAISE NOTICE ' scheduler_user -> scheduler';
|
||||
RAISE NOTICE ' taskrunner_user -> taskrunner';
|
||||
RAISE NOTICE ' policy_user -> policy';
|
||||
RAISE NOTICE ' unknowns_user -> unknowns';
|
||||
RAISE NOTICE ' attestor_user -> proofchain, attestor';
|
||||
RAISE NOTICE ' signer_user -> signer';
|
||||
RAISE NOTICE ' notify_user -> notify';
|
||||
RAISE NOTICE ' signals_user -> signals';
|
||||
RAISE NOTICE ' packs_user -> packs';
|
||||
END $$;
|
||||
Reference in New Issue
Block a user