avniproject/avni-webapp#1304 - function to grant permission only on t…

…able
avniproject · Aug 8, 2024 · e9f4e21 · e9f4e21
1 parent 9917dd4
commit e9f4e21
Show file tree

Hide file tree

Showing 2 changed files with 44 additions and 0 deletions.
diff --git a/avni-server-api/src/main/resources/db/migration/R__Functions.sql b/avni-server-api/src/main/resources/db/migration/R__Functions.sql
@@ -201,6 +201,27 @@ BEGIN
 END;
 $$;
 
+CREATE OR REPLACE FUNCTION grant_all_on_table(rolename text, tablename text)
+    RETURNS text AS
+$body$
+BEGIN
+    EXECUTE (
+        SELECT 'GRANT ALL ON TABLE '
+                   || tablename
+                   || ' TO ' || quote_ident(rolename)
+    );
+
+    EXECUTE (
+        SELECT 'GRANT SELECT ON '
+                   || tablename
+                   || ' TO ' || quote_ident(rolename)
+    );
+
+    EXECUTE 'GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ' || quote_ident(rolename) || '';
+    RETURN 'ALL PERMISSIONS GRANTED TO ' || quote_ident(rolename);
+END;
+$body$ LANGUAGE plpgsql;
+
 CREATE OR REPLACE FUNCTION grant_all_on_all(rolename text)
     RETURNS text AS
 $body$

diff --git a/avni-server-api/src/main/resources/db/migration/V1_339_6__GrantPermissionOnNewOrgTables.sql b/avni-server-api/src/main/resources/db/migration/V1_339_6__GrantPermissionOnNewOrgTables.sql
@@ -0,0 +1,23 @@
+CREATE OR REPLACE FUNCTION grant_all_on_table(rolename text, tablename text)
+    RETURNS text AS
+$body$
+BEGIN
+    EXECUTE (
+        SELECT 'GRANT ALL ON TABLE '
+                   || tablename
+                   || ' TO ' || quote_ident(rolename)
+    );
+
+    EXECUTE (
+        SELECT 'GRANT SELECT ON '
+                   || tablename
+                   || ' TO ' || quote_ident(rolename)
+    );
+
+    EXECUTE 'GRANT ALL ON ALL SEQUENCES IN SCHEMA public TO ' || quote_ident(rolename) || '';
+    RETURN 'ALL PERMISSIONS GRANTED TO ' || quote_ident(rolename);
+END;
+$body$ LANGUAGE plpgsql;
+
+SELECT grant_all_on_table(a.rolname, 'organisation_category') FROM pg_roles a WHERE pg_has_role('openchs', a.oid, 'member');
+SELECT grant_all_on_table(a.rolname, 'organisation_status') FROM pg_roles a WHERE pg_has_role('openchs', a.oid, 'member');