From 4edcccc1f1b774b9be7ff249877d20eefa5b2b34 Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Thu, 27 Feb 2025 14:37:39 +0100 Subject: [PATCH] fix: migrations do not refer to public schema anymore (#5400) --- .../grant_all_current_schema.sql | 27 ++++++++++++++ ...31523_grant_all_in_current_schema.down.sql | 1 + ...5131523_grant_all_in_current_schema.up.sql | 37 +++++++++++++++++++ backend/windmill-api/src/db.rs | 33 ++++++++++++++--- 4 files changed, 93 insertions(+), 5 deletions(-) create mode 100644 backend/custom_migrations/grant_all_current_schema.sql create mode 100644 backend/migrations/20250205131523_grant_all_in_current_schema.down.sql create mode 100644 backend/migrations/20250205131523_grant_all_in_current_schema.up.sql diff --git a/backend/custom_migrations/grant_all_current_schema.sql b/backend/custom_migrations/grant_all_current_schema.sql new file mode 100644 index 0000000000..4a2860cf29 --- /dev/null +++ b/backend/custom_migrations/grant_all_current_schema.sql @@ -0,0 +1,27 @@ +DO +$$ +DECLARE + tbl_name text; + policy_exists boolean; + current_sch text; + tbl_names text[] := ARRAY['account', 'app', 'audit', 'capture', 'completed_job', 'flow', 'folder', 'http_trigger', 'queue', 'raw_app', 'resource', 'schedule', 'script', 'usr_to_group', 'variable']; +BEGIN + -- Get the current schema + SELECT current_schema() INTO current_sch; + + FOR tbl_name IN SELECT unnest(tbl_names) + LOOP + SELECT EXISTS ( + SELECT 1 + FROM pg_policies + WHERE schemaname = current_sch + AND tablename = tbl_name + AND policyname = 'admin_policy' + ) INTO policy_exists; + + IF NOT policy_exists THEN + EXECUTE format('CREATE POLICY admin_policy ON %I.%I TO windmill_admin USING (true);', current_sch, tbl_name); + END IF; + END LOOP; +END; +$$; diff --git a/backend/migrations/20250205131523_grant_all_in_current_schema.down.sql b/backend/migrations/20250205131523_grant_all_in_current_schema.down.sql new file mode 100644 index 0000000000..d2f607c5b8 --- /dev/null +++ b/backend/migrations/20250205131523_grant_all_in_current_schema.down.sql @@ -0,0 +1 @@ +-- Add down migration script here diff --git a/backend/migrations/20250205131523_grant_all_in_current_schema.up.sql b/backend/migrations/20250205131523_grant_all_in_current_schema.up.sql new file mode 100644 index 0000000000..04047fa2b0 --- /dev/null +++ b/backend/migrations/20250205131523_grant_all_in_current_schema.up.sql @@ -0,0 +1,37 @@ +DO +$do$ +DECLARE + current_schema_name TEXT; +BEGIN + -- Get the current schema for the session + SELECT current_schema() INTO current_schema_name; + + -- Lock the roles table to prevent race conditions + LOCK TABLE pg_catalog.pg_roles; + + + + EXECUTE format('GRANT USAGE ON SCHEMA %I TO windmill_user', current_schema_name); + EXECUTE format('GRANT USAGE ON SCHEMA %I TO windmill_admin', current_schema_name); + + + -- Grant privileges dynamically to the current schema + EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO windmill_user', current_schema_name); + EXECUTE format('GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I TO windmill_user', current_schema_name); + + -- Alter default privileges dynamically + EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO windmill_user', current_schema_name); + EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO windmill_user', current_schema_name); + + -- Grant privileges dynamically to the current schema + EXECUTE format('GRANT ALL ON ALL TABLES IN SCHEMA %I TO windmill_admin', current_schema_name); + EXECUTE format('GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA %I TO windmill_admin', current_schema_name); + + -- Alter default privileges dynamically + EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON TABLES TO windmill_admin', current_schema_name); + EXECUTE format('ALTER DEFAULT PRIVILEGES IN SCHEMA %I GRANT ALL ON SEQUENCES TO windmill_admin', current_schema_name); + +EXCEPTION WHEN OTHERS THEN + RAISE NOTICE 'Error granting proper permissions to windmill users: %', SQLERRM; +END +$do$; diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs index 9b694ad3bf..86601b4718 100644 --- a/backend/windmill-api/src/db.rs +++ b/backend/windmill-api/src/db.rs @@ -32,6 +32,28 @@ async fn current_database(conn: &mut PgConnection) -> Result = vec![(20221207103910, include_str!( + "../../custom_migrations/create_workspace_without_md5.sql" + ).to_string()), + (20240216100535, include_str!( + "../../migrations/20240216100535_improve_policies.up.sql" + ).replace("public.", "")), + (20240403083110, include_str!( + "../../migrations/20240403083110_remove_team_id_constraint.up.sql" + ).replace("public.", "")), + (20240613150524, include_str!( + "../../migrations/20240613150524_add_job_perms.up.sql" + ).replace("public.", "")), + (20250102145420, include_str!( + "../../migrations/20250102145420_more_captures.up.sql" + ).replace("public.", "")), + (20241006144414, include_str!( + "../../custom_migrations/grant_all_current_schema.sql" + ).to_string()), + ].into_iter().collect(); +} + struct CustomMigrator { inner: PoolConnection, } @@ -132,12 +154,13 @@ impl Migrate for CustomMigrator { migration.version, migration.description ); - if migration.version == 20221207103910 { - tracing::info!("Skipping migration 20221207103910 to avoid using md5"); + + + if let Some(migration_sql) = OVERRIDDEN_MIGRATIONS.get(&migration.version) { + tracing::info!("Using custom migration for version {}", migration.version); + self.inner - .execute(include_str!( - "../../custom_migrations/create_workspace_without_md5.sql" - )) + .execute(&**migration_sql) .await?; let _ = sqlx::query( r#"