yunchan/vignette
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Stabilize runtime auth and E2E coverage

Browse source
This commit is contained in:
Yun Chan 2026-06-26 14:47:00 +09:00
parent 6a3e3b541c
commit 188e899394
133 changed files with 55987 additions and 6775 deletions
Download patch file Download diff file Expand all files Collapse all files

46
infra/db/init/99_app_role.sh Normal file
View file

@ -0,0 +1,46 @@
#!/usr/bin/env bash
set -e
APP_DB_USER="${APP_DB_USER:-vignette_app}"
APP_DB_PASSWORD="${APP_DB_PASSWORD:-vignette_app}"
case "$APP_DB_USER" in
*[!a-zA-Z0-9_]*)
echo "APP_DB_USER must contain only letters, numbers, and underscores" >&2
exit 1
;;
esac
if psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" -tAc "SELECT 1 FROM pg_roles WHERE rolname = '$APP_DB_USER'" | grep -q 1; then
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
ALTER ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
EOSQL
else
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v app_password="$APP_DB_PASSWORD" <<'EOSQL'
CREATE ROLE :"app_user" WITH LOGIN PASSWORD :'app_password' NOBYPASSRLS;
EOSQL
fi
psql --username "$POSTGRES_USER" --dbname "$POSTGRES_DB" \
-v app_user="$APP_DB_USER" \
-v db_name="$POSTGRES_DB" <<'EOSQL'
GRANT CONNECT ON DATABASE :"db_name" TO :"app_user";
GRANT USAGE ON SCHEMA app, kb, audit, ds TO :"app_user";
GRANT SELECT, INSERT, UPDATE, DELETE ON ALL TABLES IN SCHEMA app, kb, audit, ds TO :"app_user";
GRANT USAGE, SELECT ON ALL SEQUENCES IN SCHEMA app, kb, audit, ds TO :"app_user";
GRANT EXECUTE ON ALL FUNCTIONS IN SCHEMA app TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT SELECT, INSERT, UPDATE, DELETE ON TABLES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA kb GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA audit GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA ds GRANT USAGE, SELECT ON SEQUENCES TO :"app_user";
ALTER DEFAULT PRIVILEGES IN SCHEMA app GRANT EXECUTE ON FUNCTIONS TO :"app_user";
EOSQL