db-evolve 0.1.7 → 0.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 021f7f7fa230d96348c7531d71ea4f8cc6a14af0
-  data.tar.gz: 64e7d50a940325d5fc7669c2ed39ea51f90be8eb
+  metadata.gz: 8abf7748fc2f2f9425e4d63c7656593de7fb889b
+  data.tar.gz: 4a30a774c669bcc6493213269ec75b770ab1b579
 SHA512:
-  metadata.gz: 63e145aa1e7166fa52648376359a8832e624c44a91af12409ed8c25cd065932e42725e15bfd746b15ff280be645e863e22f1db6bb735e7c2543725403c720661
-  data.tar.gz: 69e299cbbf73075d9773b81971cea6dbc9a8dc4eac9095dcb26bda57da95f7222cd93463f9f8dd89e5f29c0e2b148508c6de842531ac3311793b73d4e3b37751
+  metadata.gz: 833c3994a6603bf1cb55f78d9432d67459c54274017dc33ea4c19ed1e48dd67772f3c036ff0f9e951a188896c93c2f890491c703fe6d6b5a91b22ca2a25e41e0
+  data.tar.gz: a2725c132f67375b5c7e955f4da020dd4efb31c14ef5dff07a91f928f4f28aaae176f189252e1a5c7dfc08d8ae43ceceb391ab94ee9b2b5a535aaccc99463e86

data/lib/tasks/db.rb

@@ -47,6 +47,34 @@ namespace :db do
 
 end
 
+$i_nagged = false
+
+def build_real_connection_config to_exec: false, noop: false
+  require 'pg'
+  if to_exec
+    config_name = "#{Rails.env}_dbevolve"
+    if Rails.configuration.database_configuration[config_name].present?
+      config = Rails.configuration.database_configuration[config_name].clone
+    else
+      config = ActiveRecord::Base.connection_config.clone
+      unless $i_nagged || noop || Rails.env=='development'
+        puts "Your database.yml file does not contain an entry for '#{config_name}', so we're using '#{Rails.env}'.  This works if your database user has permission to edit your schema, but this is not recommended outside of development.  For more information visit: https://github.com/keredson/ruby-db-evolve/blob/master/README.md#schema-change-permissions"
+        $i_nagged = true
+      end
+    end
+  else
+    config = ActiveRecord::Base.connection_config.clone
+  end
+  config.delete(:adapter)
+  config.delete(:pool)
+  config[:dbname] = config.delete(:database)
+  config[:user] = config.delete(:username) || ENV['USER'] || ENV['USERNAME']
+  return config 
+end
+
+def build_real_connection to_exec: false, noop: false
+  return PG::Connection.open(build_real_connection_config to_exec: to_exec, noop: noop)
+end
 
 def do_evolve(noop, yes, nowait)
   existing_tables, existing_indexes = load_existing_tables()
@@ -74,6 +102,8 @@ def do_evolve(noop, yes, nowait)
   
   to_run += calc_index_changes(existing_indexes, $schema_indexes, renames, rename_cols_by_table)
 
+  to_run += calc_perms_changes($schema_tables, noop) unless $check_perms_for.empty?
+
   to_run += sql_drops(deletes)
 
   # prompt and execute
@@ -97,7 +127,7 @@ def do_evolve(noop, yes, nowait)
       return
     end
 
-    config = ActiveRecord::Base.connection_config
+    config = build_real_connection_config to_exec: true
     puts "Connecting to database:"
     config.each do |k,v|
       next if k==:password
@@ -108,11 +138,6 @@ def do_evolve(noop, yes, nowait)
       print "Run this SQL? (type yes or no) "
     end
     if yes || STDIN.gets.strip=='yes'
-      require 'pg'
-      config = ActiveRecord::Base.connection_config
-      config.delete(:adapter)
-      config[:dbname] = config.delete(:database)
-      config[:user] = config.delete(:username)
       if !nowait
         print "\nExecuting in "
         [3,2,1].each do |c|
@@ -121,7 +146,7 @@ def do_evolve(noop, yes, nowait)
         end
       end
       puts
-      conn = PG::Connection.open(config)
+      conn = build_real_connection to_exec: true
       to_run.each do |sql|
         puts SQLColor.colorize(sql)
         conn.exec(sql)
@@ -172,6 +197,43 @@ def calc_index_changes(existing_indexes, schema_indexes, table_renames, rename_c
   return to_run
 end
 
+def get_db_username
+  username = ActiveRecord::Base.connection_config[:username] || ENV['USER'] || ENV['USERNAME']
+  return username
+end
+
+def calc_perms_changes schema_tables, noop
+  username = get_db_username
+  users = ($check_perms_for.map { |user| ActiveRecord::Base::sanitize(user) }).join ","
+  database = ActiveRecord::Base.connection_config[:database]
+  sql = %{
+    select grantee, table_name, privilege_type
+    from information_schema.role_table_grants
+    where table_catalog=#{ActiveRecord::Base::sanitize(database)}
+      and grantee in (#{users})
+      and table_schema='public';
+  }
+  results = build_real_connection(noop: noop).exec(sql)
+  existing_perms = Hash.new { |h, k| h[k] = Hash.new { |h, k| h[k] = Set.new } }
+  results.each do |row|
+    existing_perms[row['grantee']][row['table_name']].add(row['privilege_type'])
+  end
+  to_run = []
+  schema_tables.each do |table_name, tbl|
+    $check_perms_for.each do |user|
+      to_grant = (tbl.perms_for_user[user] - existing_perms[user][table_name]).to_a
+      to_revoke = (existing_perms[user][table_name] - tbl.perms_for_user[user]).to_a
+      to_run.push("GRANT "+ to_grant.join(',') +" ON #{escape_table(table_name)} TO #{user}") unless to_grant.empty?
+      to_run.push("REVOKE "+ to_revoke.join(',') +" ON #{escape_table(table_name)} FROM #{user}") unless to_revoke.empty?
+    end
+  end
+
+  if !to_run.empty?
+    to_run.unshift("\n-- update permissions")
+  end
+  
+  return to_run
+end
 
 
 IgnoreTables = Set.new ["schema_migrations"]
@@ -196,12 +258,28 @@ end
 
 
 class Table
-  attr_accessor :name, :opts, :id, :columns
+  attr_accessor :name, :opts, :id, :columns, :perms_for_user
   
   def initialize()
     @columns = []
   end
   
+  def grant *args, to: nil
+    to = get_db_username if to.nil?
+    $check_perms_for.add(to)
+    args.each do |arg|
+      @perms_for_user[to] |= check_perm(arg)
+    end
+  end
+  
+  def revoke *args, from: nil
+    from = get_db_username if from.nil?
+    $check_perms_for.add(from)
+    args.each do |arg|
+      @perms_for_user[from] -= check_perm(arg)
+    end
+  end
+  
   def method_missing(method_sym, *arguments, &block)
     c = Column.new
     c.type = method_sym.to_s
@@ -233,11 +311,16 @@ end
 
 $schema_tables = {}
 $akas_tables = Hash.new { |h, k| h[k] = Set.new }
+$check_perms_for = Set.new
 
 def create_table(name, opts={})
   tbl = Table.new
   tbl.name = name
   tbl.opts = opts
+  tbl.perms_for_user = Hash.new { |h, k| h[k] = Set.new }
+  $default_perms_for.each do |k,v|
+    tbl.perms_for_user[k] += v
+  end
   if opts
     if opts.has_key? 'id'
       tbl.id = opts['id']
@@ -275,6 +358,32 @@ def add_index(table, columns, opts)
   $schema_indexes.append(opts)
 end
 
+$allowed_perms = Set.new ["INSERT", "SELECT", "UPDATE", "DELETE", "TRUNCATE", "REFERENCES", "TRIGGER"]
+$default_perms_for = Hash.new { |h, k| h[k] = Set.new }
+
+def check_perm perm
+    perm = perm.to_s.upcase
+    return Set.new($allowed_perms) if perm=="ALL"
+    raise ArgumentError.new("permission #{perm} is not one of #{$allowed_perms.to_a}") unless $allowed_perms.include? perm
+    return Set.new [perm]
+end
+
+def grant(*perms, to: nil)
+  to = get_db_username if to.nil?
+  $check_perms_for.add(to)
+  perms.each do |perm|
+    $default_perms_for[to] |= check_perm(perm)
+  end
+end
+
+def revoke(*perms, from: nil)
+  from = get_db_username if from.nil?
+  $check_perms_for.add(from)
+  perms.each do |perm|
+    $default_perms_for[from] -= check_perm(perm)
+  end
+end
+
 module DB
   module Evolve
     class Schema
@@ -355,6 +464,9 @@ def sql_adds(tables)
   end
   if !$tmp_to_run.empty?
     $tmp_to_run.unshift("\n-- add tables")
+    if !$check_perms_for.empty?
+      $tmp_to_run << "REVOKE ALL ON #{(tables.map {|t| escape_table(t)}).join(',')} FROM #{$check_perms_for.to_a.join(',')}"
+    end
   end
   return $tmp_to_run
 end

data/lib/tasks/sql_color.rb

@@ -15,7 +15,7 @@ class SQLColor
     if sql.strip.start_with?('--')
       return apply(CYAN, sql)
     end
-    sql = sql.gsub(/(CREATE|ALTER|TABLE|COLUMN|ADD|TYPE|BEGIN|TRANSACTION|COMMIT| ON |INDEX|UPDATE|SET|WHERE)/){|s|apply(GREEN, s)}
+    sql = sql.gsub(/(CREATE|ALTER|TABLE|COLUMN|ADD|TYPE|BEGIN|TRANSACTION|COMMIT|GRANT|REVOKE| ON |INDEX|UPDATE|SET|WHERE)/){|s|apply(GREEN, s)}
     sql = sql.gsub(/(DROP)/){|s|apply(RED, s)}
     sql = sql.gsub(/("[^"]*")/){|s|apply(WHITE, s, bold=true)}
     return sql

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: db-evolve
 version: !ruby/object:Gem::Version
-  version: 0.1.7
+  version: 0.2.0
 platform: ruby
 authors:
 - Derek Anderson
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2016-02-11 00:00:00.000000000 Z
+date: 2016-02-27 00:00:00.000000000 Z
 dependencies: []
 description: A diff/patch-esque tool to replace schema migrations in Ruby.  See https://github.com/keredson/ruby-db-evolve
   for details.