starred/windmill
1
0
Fork 0
mirror of https://github.com/windmill-labs/windmill.git synced 2026-08-25 00:01:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: users privileges

Browse Source
This commit is contained in:
Ruben Fiszel
2022-08-14 22:47:51 +02:00
parent 1fcb376be3
commit b5a0dc262a
3 changed files with 64 additions and 72 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -213,7 +213,7 @@ the following format:
}
```
and mount it at `/src/usr/app/oauth.json`.
and mount it at `/usr/src/app/oauth.json`.
For instance with github, it is enough to create a Github OAuth app with
callback: `https://<yourinstance>/api/oauth/login_callback/github` and use for
backend/migrations/20220123221903_first.up.sql
+63 -67
View File
@@ -2,73 +2,6 @@
create SCHEMA IF NOT exists extensions;
create extension if not exists "uuid-ossp" with schema extensions;
DO
$do$
BEGIN
IF EXISTS (
select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
AND NOT EXISTS (
SELECT
FROM pg_catalog.pg_roles
WHERE rolname = 'windmill_user') THEN
LOCK TABLE pg_catalog.pg_roles;
CREATE ROLE windmill_user;
GRANT ALL
ON ALL TABLES IN SCHEMA public
TO windmill_user;
GRANT ALL PRIVILEGES
ON ALL SEQUENCES IN SCHEMA public
TO windmill_user;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_user
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_user;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_user
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_user;
END IF;
END
$do$;
DO
$do$
BEGIN
IF EXISTS (select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
AND NOT EXISTS (
SELECT
FROM pg_catalog.pg_roles
WHERE rolname = 'windmill_admin') THEN
CREATE ROLE windmill_admin WITH BYPASSRLS;
GRANT ALL
ON ALL TABLES IN SCHEMA public
TO windmill_admin;
GRANT ALL PRIVILEGES
ON ALL SEQUENCES IN SCHEMA public
TO windmill_admin;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_admin
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_admin;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_admin
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_admin;
END IF;
END
$do$;
CREATE TABLE workspace (
id VARCHAR(50) PRIMARY KEY,
@@ -568,3 +501,66 @@ WITH CHECK (exists(
SELECT f.* FROM group_ g, jsonb_each_text(g.extra_perms) f
WHERE usr_to_group.group_ = g.name AND usr_to_group.workspace_id = g.workspace_id AND SPLIT_PART(key, '/', 1) = 'g' AND key = ANY(regexp_split_to_array(current_setting('session.pgroups'), ',')::text[])
AND value::boolean));
DO
$do$
BEGIN
IF EXISTS (
select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
AND NOT EXISTS (
SELECT
FROM pg_catalog.pg_roles
WHERE rolname = 'windmill_user') THEN
LOCK TABLE pg_catalog.pg_roles;
CREATE ROLE windmill_user;
GRANT ALL
ON ALL TABLES IN SCHEMA public
TO windmill_user;
GRANT ALL PRIVILEGES
ON ALL SEQUENCES IN SCHEMA public
TO windmill_user;
ALTER DEFAULT PRIVILEGES
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_user;
ALTER DEFAULT PRIVILEGES
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_user;
END IF;
END
$do$;
DO
$do$
BEGIN
IF EXISTS (select usesuper from pg_user where usename = CURRENT_USER AND usesuper = 't')
AND NOT EXISTS (
SELECT
FROM pg_catalog.pg_roles
WHERE rolname = 'windmill_admin') THEN
CREATE ROLE windmill_admin WITH BYPASSRLS;
GRANT ALL
ON ALL TABLES IN SCHEMA public
TO windmill_admin;
GRANT ALL PRIVILEGES
ON ALL SEQUENCES IN SCHEMA public
TO windmill_admin;
ALTER DEFAULT PRIVILEGES
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_admin;
ALTER DEFAULT PRIVILEGES
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_admin;
END IF;
END
$do$;
init-db-as-superuser.sql
-4
View File
@@ -21,12 +21,10 @@ BEGIN
TO windmill_user;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_user
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_user;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_user
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_user;
@@ -53,12 +51,10 @@ BEGIN
TO windmill_admin;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_admin
IN SCHEMA public
GRANT ALL ON TABLES TO windmill_admin;
ALTER DEFAULT PRIVILEGES
FOR ROLE windmill_admin
IN SCHEMA public
GRANT ALL ON SEQUENCES TO windmill_admin;
END IF;