Edouard Vanbelle
69 lines
2.9 KiB
SQL
69 lines
2.9 KiB
SQL
-- ─────────────────────────────────────────────────────────────────────────
|
|
-- Round 3 — admit 'calendar' and 'address_book' into
|
|
-- `storage.role_grants.resource_type`.
|
|
--
|
|
-- Companion to the domain unblock in
|
|
-- `src/domain/services/authorization.rs` (Round 3 Phase 1). The
|
|
-- `Resource::Calendar(Uuid)` and `Resource::AddressBook(Uuid)`
|
|
-- variants can't be inserted into `role_grants` until the CHECK
|
|
-- constraint on `resource_type` permits their string discriminators.
|
|
--
|
|
-- CalDAV and CardDAV surfaces have historically enforced access via
|
|
-- dedicated per-domain share tables (`caldav.calendar_shares`,
|
|
-- `carddav.address_book_shares`) and bespoke `check_calendar_access`
|
|
-- / `check_address_book_access` helpers. Round 3 folds both into the
|
|
-- unified ReBAC engine so:
|
|
--
|
|
-- * A single ACL source of truth (`storage.role_grants`) covers
|
|
-- every OxiCloud resource type — files, folders, drives,
|
|
-- calendars, address books.
|
|
-- * Group subjects become a free feature on calendar/book shares
|
|
-- (falls out of `role_grants.subject_type='group'`).
|
|
-- * The `authz.require` audit line ("👮🏻♂️ perms: ⛔ …") fires on
|
|
-- denial with no per-domain retrofit.
|
|
--
|
|
-- Migration of existing rows from `caldav.calendar_shares` and
|
|
-- `carddav.address_book_shares` into `role_grants` happens in the
|
|
-- next migration (Phase 2). The legacy tables stay in place through
|
|
-- this PR for rollback safety; they get dropped one release later.
|
|
|
|
-- `resource_type` is a TEXT column with a CHECK constraint (not a PG
|
|
-- enum), so extending it is a DROP / ADD pair — no `ALTER TYPE` /
|
|
-- non-transactional migration issues.
|
|
|
|
ALTER TABLE storage.role_grants
|
|
DROP CONSTRAINT IF EXISTS role_grants_resource_type_check;
|
|
|
|
ALTER TABLE storage.role_grants
|
|
ADD CONSTRAINT role_grants_resource_type_check
|
|
CHECK (resource_type IN ('folder', 'file', 'drive', 'calendar', 'address_book'));
|
|
|
|
-- Post-flight: introspect the live constraint definition and prove
|
|
-- both new values appear. Cheap read-only check with no INSERT.
|
|
DO $BODY$
|
|
DECLARE
|
|
defn TEXT;
|
|
BEGIN
|
|
SELECT pg_get_constraintdef(c.oid) INTO defn
|
|
FROM pg_constraint c
|
|
JOIN pg_class t ON t.oid = c.conrelid
|
|
JOIN pg_namespace n ON n.oid = t.relnamespace
|
|
WHERE n.nspname = 'storage'
|
|
AND t.relname = 'role_grants'
|
|
AND c.conname = 'role_grants_resource_type_check';
|
|
|
|
IF defn IS NULL THEN
|
|
RAISE EXCEPTION
|
|
'role_grants_resource_type_check not found on storage.role_grants';
|
|
END IF;
|
|
IF position('calendar' IN defn) = 0 THEN
|
|
RAISE EXCEPTION
|
|
'CHECK constraint does not admit ''calendar'': %', defn;
|
|
END IF;
|
|
IF position('address_book' IN defn) = 0 THEN
|
|
RAISE EXCEPTION
|
|
'CHECK constraint does not admit ''address_book'': %', defn;
|
|
END IF;
|
|
END;
|
|
$BODY$;
|