From e44decb9c2c0c657312a8f79d71262001bce7813 Mon Sep 17 00:00:00 2001 From: HugoCasa Date: Tue, 8 Oct 2024 20:08:29 +0200 Subject: [PATCH] BYPASSRLS admin policy falllback (#4493) * BYPASSRLS admin policy falllback * use fixed list instead --------- Co-authored-by: Ruben Fiszel --- ...d41037de4bc69dd434232029c731cbbcbc22f.json | 12 ------- ...05d0cfb0d6cdba9cc56c6139f57e46345f843.json | 20 ------------ backend/custom_migrations/bypassrls_1.sql | 14 -------- .../20241006144414_admin_policy.down.sql | 1 + .../20241006144414_admin_policy.up.sql | 24 ++++++++++++++ backend/windmill-api/src/db.rs | 32 ------------------- 6 files changed, 25 insertions(+), 78 deletions(-) delete mode 100644 backend/.sqlx/query-722a3096f03d25ef94292d53801d41037de4bc69dd434232029c731cbbcbc22f.json delete mode 100644 backend/.sqlx/query-eb1f916f9beea3eea83ce359f5305d0cfb0d6cdba9cc56c6139f57e46345f843.json delete mode 100644 backend/custom_migrations/bypassrls_1.sql create mode 100644 backend/migrations/20241006144414_admin_policy.down.sql create mode 100644 backend/migrations/20241006144414_admin_policy.up.sql diff --git a/backend/.sqlx/query-722a3096f03d25ef94292d53801d41037de4bc69dd434232029c731cbbcbc22f.json b/backend/.sqlx/query-722a3096f03d25ef94292d53801d41037de4bc69dd434232029c731cbbcbc22f.json deleted file mode 100644 index 2e4dee2a30..0000000000 --- a/backend/.sqlx/query-722a3096f03d25ef94292d53801d41037de4bc69dd434232029c731cbbcbc22f.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "INSERT INTO windmill_migrations (name) VALUES ('bypassrls_1-2')", - "describe": { - "columns": [], - "parameters": { - "Left": [] - }, - "nullable": [] - }, - "hash": "722a3096f03d25ef94292d53801d41037de4bc69dd434232029c731cbbcbc22f" -} diff --git a/backend/.sqlx/query-eb1f916f9beea3eea83ce359f5305d0cfb0d6cdba9cc56c6139f57e46345f843.json b/backend/.sqlx/query-eb1f916f9beea3eea83ce359f5305d0cfb0d6cdba9cc56c6139f57e46345f843.json deleted file mode 100644 index ecd83ae2e3..0000000000 --- a/backend/.sqlx/query-eb1f916f9beea3eea83ce359f5305d0cfb0d6cdba9cc56c6139f57e46345f843.json +++ /dev/null @@ -1,20 +0,0 @@ -{ - "db_name": "PostgreSQL", - "query": "SELECT EXISTS(SELECT name FROM windmill_migrations WHERE name = 'bypassrls_1-2')", - "describe": { - "columns": [ - { - "ordinal": 0, - "name": "exists", - "type_info": "Bool" - } - ], - "parameters": { - "Left": [] - }, - "nullable": [ - null - ] - }, - "hash": "eb1f916f9beea3eea83ce359f5305d0cfb0d6cdba9cc56c6139f57e46345f843" -} diff --git a/backend/custom_migrations/bypassrls_1.sql b/backend/custom_migrations/bypassrls_1.sql deleted file mode 100644 index 1918b26b0b..0000000000 --- a/backend/custom_migrations/bypassrls_1.sql +++ /dev/null @@ -1,14 +0,0 @@ -CREATE POLICY admin_policy ON account TO windmill_admin USING (true); -CREATE POLICY admin_policy ON app TO windmill_admin USING (true); -CREATE POLICY admin_policy ON audit TO windmill_admin USING (true); -CREATE POLICY admin_policy ON capture TO windmill_admin USING (true); -CREATE POLICY admin_policy ON completed_job TO windmill_admin USING (true); -CREATE POLICY admin_policy ON flow TO windmill_admin USING (true); -CREATE POLICY admin_policy ON folder TO windmill_admin USING (true); -CREATE POLICY admin_policy ON queue TO windmill_admin USING (true); -CREATE POLICY admin_policy ON raw_app TO windmill_admin USING (true); -CREATE POLICY admin_policy ON resource TO windmill_admin USING (true); -CREATE POLICY admin_policy ON schedule TO windmill_admin USING (true); -CREATE POLICY admin_policy ON script TO windmill_admin USING (true); -CREATE POLICY admin_policy ON usr_to_group TO windmill_admin USING (true); -CREATE POLICY admin_policy ON variable TO windmill_admin USING (true); \ No newline at end of file diff --git a/backend/migrations/20241006144414_admin_policy.down.sql b/backend/migrations/20241006144414_admin_policy.down.sql new file mode 100644 index 0000000000..d2f607c5b8 --- /dev/null +++ b/backend/migrations/20241006144414_admin_policy.down.sql @@ -0,0 +1 @@ +-- Add down migration script here diff --git a/backend/migrations/20241006144414_admin_policy.up.sql b/backend/migrations/20241006144414_admin_policy.up.sql new file mode 100644 index 0000000000..e6a3f3807e --- /dev/null +++ b/backend/migrations/20241006144414_admin_policy.up.sql @@ -0,0 +1,24 @@ +-- Add up migration script here +DO +$$ +DECLARE + tbl_name text; + policy_exists boolean; + tbl_names text[] := ARRAY['account', 'app', 'audit', 'capture', 'completed_job', 'flow', 'folder', 'http_trigger', 'queue', 'raw_app', 'resource', 'schedule', 'script', 'usr_to_group', 'variable']; +BEGIN + FOR tbl_name IN SELECT unnest(tbl_names) + LOOP + SELECT EXISTS ( + SELECT 1 + FROM pg_policies + WHERE schemaname = 'public' + AND tablename = tbl_name + AND policyname = 'admin_policy' + ) INTO policy_exists; + + IF NOT policy_exists THEN + EXECUTE format('CREATE POLICY admin_policy ON %I TO windmill_admin USING (true);', tbl_name); + END IF; + END LOOP; +END; +$$; \ No newline at end of file diff --git a/backend/windmill-api/src/db.rs b/backend/windmill-api/src/db.rs index d6e6ed1a1d..c44b8c18e6 100644 --- a/backend/windmill-api/src/db.rs +++ b/backend/windmill-api/src/db.rs @@ -199,11 +199,6 @@ pub async fn migrate(db: &DB) -> Result<(), Error> { Err(err) => Err(err), }?; - #[cfg(feature = "enterprise")] - if let Err(e) = windmill_migrations(&mut custom_migrator, db).await { - tracing::error!("Could not apply windmill custom migrations: {e:#}") - } - Ok(()) } @@ -497,33 +492,6 @@ async fn fix_job_completed_index(db: &DB) -> Result<(), Error> { Ok(()) } -#[cfg(feature = "enterprise")] -async fn windmill_migrations(migrator: &mut CustomMigrator, db: &DB) -> Result<(), Error> { - if std::env::var("MIGRATION_NO_BYPASSRLS").is_ok() { - migrator.lock().await?; - let has_done_migration = sqlx::query_scalar!( - "SELECT EXISTS(SELECT name FROM windmill_migrations WHERE name = 'bypassrls_1-2')", - ) - .fetch_one(db) - .await? - .unwrap_or(false); - - if !has_done_migration { - let query = include_str!("../../custom_migrations/bypassrls_1.sql"); - tracing::info!("Applying bypassrls_1.sql"); - let mut tx: sqlx::Transaction<'_, Postgres> = db.begin().await?; - tx.execute(query).await?; - tracing::info!("Applied bypassrls_1.sql"); - sqlx::query!("INSERT INTO windmill_migrations (name) VALUES ('bypassrls_1-2')") - .execute(&mut *tx) - .await?; - tx.commit().await?; - } - migrator.unlock().await?; - } - Ok(()) -} - #[derive(Clone, Debug)] pub struct ApiAuthed { pub email: String,