Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Refs #37883 - wrap evr remote checks in method #999

Merged
merged 2 commits into from
Nov 21, 2024
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 40 additions & 37 deletions hooks/pre_commit/42-evr_extension_permissions.rb
Original file line number Diff line number Diff line change
@@ -1,38 +1,41 @@
# Managed databases will be handled automatically.
return if local_postgresql?
return unless katello_enabled?

config = load_db_config('foreman')

# If postgres is the owner of the DB, then the permissions will not matter.
return if config[:username] == 'postgres'

evr_existence_command = pg_sql_statement("SELECT 1 FROM pg_extension WHERE extname = 'evr';")
logger.debug "Checking if the evr extension exists via #{evr_existence_command}"
evr_existence_output, = execute_command(evr_existence_command, false, true, pg_env(config))

# If the evr extension does not exist, then we can skip this check.
return if evr_existence_output&.strip != '1'

check_evr_owner_sql = "SELECT CASE" \
" WHEN r.rolname = '#{config[:username]}' THEN 0" \
" ELSE 1" \
" END AS evr_owned_by_postgres" \
" FROM pg_extension e" \
" JOIN pg_roles r ON e.extowner = r.oid" \
" WHERE e.extname = 'evr';"

command = pg_sql_statement(check_evr_owner_sql)
logger.debug "Checking if the evr extension is owned by the postgres user via #{command}"
output, = execute_command(command, false, true, pg_env(config))

case output&.strip
when '0'
# The evr extension is owned by the foreman DB owner, so we can skip this check.
return
when '1'
fail_and_exit("The evr extension is not owned by the foreman DB owner. Please run the following command to fix it: " \
"UPDATE pg_extension SET extowner = (SELECT oid FROM pg_authid WHERE rolname='#{config[:username]}') WHERE extname='evr';")
else
fail_and_exit("Failed to check the ownership of the evr extension.")
def check_remote_evr_extension_permissions
# Managed databases will be handled automatically.
return if local_postgresql?
return unless katello_enabled?

config = load_db_config('foreman')

# If postgres is the owner of the DB, then the permissions will not matter.
return if config[:username] == 'postgres'

evr_existence_command = pg_sql_statement("SELECT 1 FROM pg_extension WHERE extname = 'evr';")
logger.debug "Checking if the evr extension exists via #{evr_existence_command}"
evr_existence_output, = execute_command(evr_existence_command, false, true, pg_env(config))

# If the evr extension does not exist, then we can skip this check.
return if evr_existence_output&.strip != '1'

check_evr_owner_sql = "SELECT CASE " \
"WHEN r.rolname = '#{config[:username]}' THEN 0 " \
"ELSE 1 " \
"END AS evr_owned_by_postgres " \
"FROM pg_extension e " \
"JOIN pg_roles r ON e.extowner = r.oid " \
"WHERE e.extname = 'evr';"

command = pg_sql_statement(check_evr_owner_sql)
logger.debug "Checking if the evr extension is owned by the postgres user via #{command}"
output, = execute_command(command, false, true, pg_env(config))

case output&.strip
when '0'
logger.debug('PostgreSQL EVR extension owned by Foreman DB owner')
when '1'
fail_and_exit("The evr extension is not owned by the foreman DB owner. Please run the following command to fix it: " \
"UPDATE pg_extension SET extowner = (SELECT oid FROM pg_authid WHERE rolname='#{config[:username]}') WHERE extname='evr';")
else
fail_and_exit("Failed to check the ownership of the evr extension.")
end
end

check_remote_evr_extension_permissions
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if we should have guards here

Suggested change
check_remote_evr_extension_permissions
check_remote_evr_extension_permissions if !local_postgresql? && katello_enabled?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wasn't quite sure what's nicer. It probably doesn't really matter.

What does matter is the trailing whitespace failure that breaks RuboCop.