Limit required attributes to the actions that need them

[chef.git] / cookbooks / postgresql / resources / user.rb

diff --git a/cookbooks/postgresql/resources/user.rb b/cookbooks/postgresql/resources/user.rb
index f5fefa35aa1a2ab37b2b2963b68a7223c1fad09a..2fac867314cff2a414f3f1dccc586f230d810abe 100644 (file)
--- a/cookbooks/postgresql/resources/user.rb
+++ b/cookbooks/postgresql/resources/user.rb
@@ -1,14 +1,14 @@
 #
-# Cookbook Name:: postgresql
+# Cookbook:: postgresql
 # Resource:: postgresql_user
 #
-# Copyright 2012, OpenStreetMap Foundation
+# Copyright:: 2012, OpenStreetMap Foundation
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
-# http://www.apache.org/licenses/LICENSE-2.0
+# https://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
 # distributed under the License is distributed on an "AS IS" BASIS,
@@ -17,17 +17,70 @@
 # limitations under the License.
 #
 
-actions :create, :drop
+require "shellwords"
 
-attribute :user, :kind_of => String, :name_attribute => true
-attribute :cluster, :kind_of => String, :required => true
-attribute :password, :kind_of => String
-attribute :superuser, :default => false
-attribute :createdb, :default => false
-attribute :createrole, :default => false
-attribute :replication, :default => false
+default_action :create
 
-def initialize(*args)
-  super
-  @action = :create
+property :user, :kind_of => String, :name_property => true
+property :cluster, :kind_of => String, :required => true
+property :password, :kind_of => String
+property :superuser, :default => false
+property :createdb, :default => false
+property :createrole, :default => false
+property :replication, :default => false
+
+action :create do
+  password = new_resource.password ? "ENCRYPTED PASSWORD '#{new_resource.password.shellescape}'" : ""
+  superuser = new_resource.superuser ? "SUPERUSER" : "NOSUPERUSER"
+  createdb = new_resource.createdb ? "CREATEDB" : "NOCREATEDB"
+  createrole = new_resource.createrole ? "CREATEROLE" : "NOCREATEROLE"
+  replication = new_resource.replication ? "REPLICATION" : "NOREPLICATION"
+
+  if !cluster.users.include?(new_resource.user)
+    converge_by "create role #{new_resource.user}" do
+      cluster.execute(:command => "CREATE ROLE \"#{new_resource.user}\" LOGIN #{password} #{superuser} #{createdb} #{createrole}")
+    end
+  else
+    current_user = cluster.users[new_resource.user]
+
+    if new_resource.superuser != current_user[:superuser]
+      converge_by "alter role #{new_resource.user}" do
+        cluster.execute(:command => "ALTER ROLE \"#{new_resource.user}\" #{superuser}")
+      end
+    end
+
+    unless new_resource.superuser
+      if new_resource.createdb != current_user[:createdb]
+        converge_by "alter role #{new_resource.user}" do
+          cluster.execute(:command => "ALTER ROLE \"#{new_resource.user}\" #{createdb}")
+        end
+      end
+
+      if new_resource.createrole != current_user[:createrole]
+        converge_by "alter role #{new_resource.user}" do
+          cluster.execute(:command => "ALTER ROLE \"#{new_resource.user}\" #{createrole}")
+        end
+      end
+
+      if new_resource.replication != current_user[:replication]
+        converge_by "alter role #{new_resource.user}" do
+          cluster.execute(:command => "ALTER ROLE \"#{new_resource.user}\" #{replication}")
+        end
+      end
+    end
+  end
+end
+
+action :drop do
+  if cluster.users.include?(new_resource.user)
+    converge_by "drop role #{new_resource.user}" do
+      cluster.execute(:command => "DROP ROLE \"#{new_resource.user}\"")
+    end
+  end
+end
+
+action_class do
+  def cluster
+    @cluster ||= OpenStreetMap::PostgreSQL.new(new_resource.cluster)
+  end
 end