cookbooks/postgresql/resources/schema.rb

   1 #
   2 # Cookbook:: postgresql
   3 # Resource:: postgresql_schema
   4 #
   5 # Copyright:: 2024, OpenStreetMap Foundation
   6 #
   7 # Licensed under the Apache License, Version 2.0 (the "License");
   8 # you may not use this file except in compliance with the License.
   9 # You may obtain a copy of the License at
  10 #
  11 # https://www.apache.org/licenses/LICENSE-2.0
  12 #
  13 # Unless required by applicable law or agreed to in writing, software
  14 # distributed under the License is distributed on an "AS IS" BASIS,
  15 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16 # See the License for the specific language governing permissions and
  17 # limitations under the License.
  18 #
  19
  20 unified_mode true
  21
  22 default_action :create
  23
  24 property :schema, :kind_of => String, :name_property => true
  25 property :cluster, :kind_of => String, :required => true
  26 property :database, :kind_of => String, :required => true
  27 property :owner, :kind_of => String, :required => [:create]
  28 property :permissions, :kind_of => Hash, :default => {}
  29
  30 action :create do
  31   if schemas.include?(qualified_name)
  32     # Handle the case of an existing schema
  33     if new_resource.owner != schemas[qualified_name][:owner]
  34       converge_by("set owner for #{new_resource} to #{new_resource.owner}") do
  35         Chef::Log.info("Setting owner for #{new_resource} to #{new_resource.owner}")
  36         cluster.execute(:command => "ALTER SCHEMA #{qualified_name} OWNER TO \"#{new_resource.owner}\"", :database => new_resource.database)
  37       end
  38     end
  39
  40     schemas[qualified_name][:permissions].each_key do |user|
  41       next if new_resource.permissions[user]
  42       # Remove permissions from users who no longer have them
  43       converge_by("revoke all for #{user} on #{new_resource}") do
  44         Chef::Log.info("Revoking all for #{user} on #{new_resource}")
  45         cluster.execute(:command => "REVOKE ALL ON SCHEMA #{qualified_name} FROM \"#{user}\"", :database => new_resource.database)
  46       end
  47     end
  48     new_resource.permissions.each do |user, new_privileges|
  49       current_privileges = schemas[qualified_name][:permissions][user] || {}
  50       new_privileges = Array(new_privileges)
  51
  52       if new_privileges.include?(:all)
  53         new_privileges |= OpenStreetMap::PostgreSQL::SCHEMA_PRIVILEGES
  54       end
  55
  56       OpenStreetMap::PostgreSQL::SCHEMA_PRIVILEGES.each do |privilege|
  57         if new_privileges.include?(privilege)
  58           unless current_privileges.include?(privilege)
  59             converge_by("grant #{privilege} for #{user} on #{new_resource}") do
  60               Chef::Log.info("Granting #{privilege} for #{user} on #{new_resource}")
  61               cluster.execute(:command => "GRANT #{privilege.to_s.upcase} ON SCHEMA #{qualified_name} TO \"#{user}\"", :database => new_resource.database)
  62             end
  63           end
  64         elsif current_privileges.include?(privilege)
  65           converge_by("revoke #{privilege} for #{user} on #{new_resource}") do
  66             Chef::Log.info("Revoking #{privilege} for #{user} on #{new_resource}")
  67             cluster.execute(:command => "REVOKE #{privilege.to_s.upcase} ON SCHEMA #{qualified_name} FROM \"#{user}\"", :database => new_resource.database)
  68           end
  69         end
  70       end
  71     end
  72   else
  73     converge_by "create schema #{new_resource.schema}" do
  74       cluster.execute(:command => "CREATE SCHEMA #{new_resource.schema} AUTHORIZATION #{new_resource.owner}", :database => new_resource.database)
  75       # Because the schema is new, we don't have to worry about revoking or checking current permissions
  76       new_resource.permissions.each do |user, new_privileges|
  77         new_privileges = Array(new_privileges)
  78         if new_privileges.include?(:all)
  79           new_privileges |= OpenStreetMap::PostgreSQL::SCHEMA_PRIVILEGES
  80         end
  81         OpenStreetMap::PostgreSQL::SCHEMA_PRIVILEGES.each do |privilege|
  82           next unless new_privileges.include?(privilege)
  83           converge_by("grant #{privilege} for #{user} on #{new_resource}") do
  84             Chef::Log.info("Granting #{privilege} for #{user} on #{new_resource}")
  85             cluster.execute(:command => "GRANT #{privilege.to_s.upcase} ON SCHEMA #{qualified_name} TO \"#{user}\"", :database => new_resource.database)
  86           end
  87         end
  88       end
  89     end
  90   end
  91 end
  92
  93 action :drop do
  94   if schemas.include?(qualified_name)
  95     converge_by("drop #{new_resource}") do
  96       Chef::Log.info("Dropping #{new_resource}")
  97       cluster.execute(:command => "DROP SCHEMA #{qualified_name}", :database => new_resource.database)
  98     end
  99   end
 100 end
 101
 102 action_class do
 103   def cluster
 104     @cluster ||= OpenStreetMap::PostgreSQL.new(new_resource.cluster)
 105   end
 106
 107   def schemas
 108     @schemas ||= cluster.schemas(new_resource.database)
 109   end
 110
 111   def qualified_name
 112     new_resource.name
 113   end
 114 end